Re: About matching (also was: Multiple Targets)

[Martijn Lievaart <m@rtij.nl>]

Patrick Schaaf wrote:

>>iptables -A SOMECHAIN -m this -m that
>>iptables -A SOMECHAIN --previous -j ACTION1
>>iptables -A SOMECHAIN --previous -j ACTION2
>>iptables -A SOMECHAIN --previous -j RETURN
>>
>>But how is that different from:
>>
>>iptables -A SOMECHAIN -m this -m that -j TMPCHAIN
>>iptables -N TMPCHAIN
>>iptables -A TMPCHAIN -j ACTION1
>>iptables -A TMPCHAIN -j ACTION2
>>    
>>
>
>It RETURNs to different places, i.e. to the caller of SOMECHAIN in the
>first case, and to the next rule in SOMECHAIN for the second case.
>
>BTW, anybody ever thought about giving -j RETURN an --up N option?
>
>iptables -A SOMECHAIN -m this -m that -j TMPCHAIN
>iptables -N TMPCHAIN
>iptables -A TMPCHAIN -j ACTION1
>iptables -A TMPCHAIN -j ACTION2
>iptables -A TMPCHAIN -j RETURN --up 2
>
>  
>

Good catch! So even two liters coffee and a packet of sigarets is not 
enough to make me think clearly.

It /could/ be done with the GOTO action:

iptables -A SOMECHAIN -m this -m that -j GOTO --goto TMPCHAIN
iptables -N TMPCHAIN
iptables -A TMPCHAIN -j ACTION1
iptables -A TMPCHAIN -j ACTION2
iptables -A TMPCHAIN -j RETURN


IMO --previous has the advantage of readability here.

So there actually are three options to implement this. Either 
--previous, GOTO or RETURN --up. Advantages:

--previous: Readability
GOTO: Already in POM?
RETURN --up: Also useful in different scenarios?

M4