Re: bug in iptables

[Patrick McHardy <kaber@trash.net>]

Patrick McHardy wrote:
> Patrick McHardy wrote:
>> justin joseph wrote:
>>
>>> root@hq.enpaq:~# uname -r
>>> 2.6.15-29-386
>>> root@hq.enpaq:~#
>>
>>
>> Thanks, I can reproduce it on current -git. I'll look into it.
> 
> 
> OK actually we've never had a check for this in the kernel.
> Userspace contains some basic checks based on the chainname,
> but this only works for the built-in chains.
> 
> This patch adds the proper checks to the kernel. I'm a bit
> worried though that this might break some rulesets. So
> far we've allowed to create used-defined rules with these
> "invalid" matches, which might even be useful to share
> chains between multiple hooks, even if some matches will
> not match depending on where the jump came from.
> 
> Opinions?


Well, I decided against pushing this patch since there's no
harm in the current behaviour and the risk of breaking things
seems to high.