Re: new iptables policy match

[Patrick McHardy <kaber@trash.net>]

Marco Berizzi wrote:
> 
> Patrick McHardy wrote:
> 
>>> Chain FORWARD (policy DROP 0 packets, 0 bytes)
>>> pkts bytes target     prot opt in     out     source               
>>> destination
>>>   19  1140 ACCEPT     all  --  any    any     anywhere             
>>> anywhere            policy match dir out pol ipsec strict [0] [1] [2] 
>>> [3] mode tunnel tunnel-dst 10.1.1.0/24 tunnel-src 10.1.2.0/24
>>>    0     0 DROP       all  --  any    any     anywhere             
>>> anywhere            policy match dir in pol ipsec strict [0] [1] [2] 
>>> [3] mode tunnel tunnel-dst 10.1.2.0/24 tunnel-src 10.1.1.0/24
>>
>>
>> How did you add these rules? It looks like you used "--next" multiple
>> times without specifying a policy element ..
> 
> 
> This is the command:
> 
> iptables -P FORWARD DROP
> iptables -A FORWARD -m policy --next --dir out --next --pol ipsec --next 
> --mode tunnel
> --tunnel-src 10.1.2.0/24 --tunnel-dst 10.1.1.0/24 --strict -j ACCEPT
> iptables -A FORWARD -m policy --next --dir in --next --pol ipsec --next 
> --mode tunnel
> --tunnel-dst 10.1.2.0/24 --tunnel-src 10.1.1.0/24 --strict -j DROP
> 
> Are they wrong?

Yes, --next is needed only if your policy has multiple elements, like
"--mode tunnel --tunnel-src 1.2.3.4/32 --next --mode transform". I'll
fix up the userspace part to reject this incorrect use.