Re: About matching (also was: Multiple Targets)

[Jonas Berlin <xkr47@outerspace.dyndns.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoting Jozsef Kadlecsik on 2005-05-04 08:09 UTC:

>>And if that flag was set, netfilter would also assert that the return
>>value of the target in question is IPT_CONTINUE ?
> 
> No, targets may return other values. Something like this

I know. But my point was, _should_ these targets with the "cascade flag"
set be allowed to return anything else?

For example LOG, MARK, CONNMARK and CLASSIFY targets always return
IPT_CONTINUE. I could agree that NF_DROP could also be allowed if a bad
packet was recognized or some other problem. But should NF_STOLEN or
NF_REPEAT or others really be allowed from these targets with "cascade
flag" set? If there wasn't any restriction on the return value, I don't
know if there's much point of having a cascade flag either?

- --
- - xkr47
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCeNQvxyF48ZTvn+4RAkPIAKCCUEHZkbRCX+1bMLjZOEqGYH9TCgCgjNBC
39EXx3x72L3by9iTJKyB7qo=
=Xmdn
-----END PGP SIGNATURE-----