Re: About matching

[Wang Jian <lark@linux.net.cn>]

Hi Patrick Schaaf,


On Thu, 7 Apr 2005 08:43:23 +0200, Patrick Schaaf <bof@bof.de> wrote:

> Hmm, regarding --previous... Do we have two bits spare in the
> general rule structure, which could indicate 'match just like
> the previous match did', and 'match exactly if the previous
> match did NOT match'?
> 
> It we do have such bits spare, a general --previous-matched
> and --previous-failed syntax might be easier than a new match
> with signature change or percpu variables: all decision logic
> stays properly localized in the table scanning main loop.
> 
> BTW, it just occurred to be that --previous-failed, a logical
> consequence of the --previous idea :), is a nice thing to
> have by itself: it permits proper if/then/else semantics
> for nonterminating targets!
> 
> iptables -A xxx -m this -m that -j LOG --log-prefix "thisandthat: "
> iptables -A xxx --previous-failed -j LOG --log-prefix "NOT-thisandthat: "
> 

Yes, this will be a very nice feature. But we should notice the
potential race when delete the immediate previous rule before the
--previous-failed rule. I think it is hard to handle the race.


-- 
  lark