Re: new iptables policy match

[Tom Eastep <teastep@shorewall.net>]

[-- Attachment #1: Type: text/plain, Size: 1077 bytes --]

On Thursday 12 January 2006 00:43, Patrick McHardy wrote:

>
> Yes, --next is needed only if your policy has multiple elements, like
> "--mode tunnel --tunnel-src 1.2.3.4/32 --next --mode transform". I'll
> fix up the userspace part to reject this incorrect use.

The second of those patches (Revision 6395 -- Move empty policy element check 
to also catch last element) has broken compatibility with previous versions 
of policy match.

Previously, the following command succeeded and matched any traffic that is to 
be subsequently transformed:

gw:~ # iptables -A foo -m policy --pol ipsec --dir out -j ACCEPT
iptables v1.3.4: policy match: empty policy element
Try `iptables -h' or 'iptables --help' for more information.
gw:~ #

Is this incompatibility intentional? If so, I need to change Shorewall 
accordingly. 

Thanks,
-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]