Re: childlevel's pom comment

[Patrick McHardy <kaber@trash.net>]

Matthew Strait wrote:
>>I would prefer if "any" wouldn't need to be matched in the kernel,
>>something like:
>>
>>if (info->name[0] == '\0')
>>       ret = !info->invert;
>>else
>>       ...
>>
>>and have userspace do the "any" <=> "" translation.
> 
> 
> That would be fine with me, but iptables seems to consider the empty
> string to be an error condition:
> 
> --- libipt_helper.c.old 2004-03-03 21:39:07.000000000 -0600
> +++ libipt_helper.c     2004-03-04 14:50:13.408377032 -0600
> @@ -46,6 +47,12 @@
>         case '1':
>                 check_inverse(optarg, &invert, &invert, 0);
>                 strncpy(info->name, optarg, 29);
> +
> +               /* special case, translate "any" to "" so the kernel
> +               doesn't have to run strcmp. */
> +               if(!strcmp(info->name, "any"))
> +                       info->name[0] = '\0';
> +
>                 if (invert)
>                         info->invert = 1;
>                 *flags = 1;
> 
> 
> root@quadong# iptables -A POSTROUTING -t mangle -m helper --helper any
> iptables: Invalid argument
> 
> It seems like I'd have to make significantly more invasive changes than
> are really called for to get it to accept an empty string.  What do you
> think?

You just need to remove the check for empty strings in ipt_helper.c:

         /* verify that we actually should match anything */
         if ( strlen(info->name) == 0 )
                 return 0;

Regards
Patrick

> 
> -matthew
>