Re: new iptables policy match

[Patrick McHardy <kaber@trash.net>]

Tom Eastep wrote:
> On Thursday 12 January 2006 00:43, Patrick McHardy wrote:
> 
> 
>>Yes, --next is needed only if your policy has multiple elements, like
>>"--mode tunnel --tunnel-src 1.2.3.4/32 --next --mode transform". I'll
>>fix up the userspace part to reject this incorrect use.
> 
> 
> The second of those patches (Revision 6395 -- Move empty policy element check 
> to also catch last element) has broken compatibility with previous versions 
> of policy match.
> 
> Previously, the following command succeeded and matched any traffic that is to 
> be subsequently transformed:
> 
> gw:~ # iptables -A foo -m policy --pol ipsec --dir out -j ACCEPT
> iptables v1.3.4: policy match: empty policy element
> Try `iptables -h' or 'iptables --help' for more information.
> gw:~ #
> 
> Is this incompatibility intentional? If so, I need to change Shorewall 
> accordingly. 

Its a bug, thanks for catching this. I've fixed it up in SVN.