Re: iptables nfacct match question

[Michael Zintakis <michael.zintakis@googlemail.com>]

Hello Pablo,


Michael Zintakis wrote:
> Pablo Neira Ayuso wrote:
>> I see. Then my new proposal is to add a new automagic function to
>> round the output to the most expressive measure, would be somehow
>> similar to xtables_print_num:
>>
>> http://git.netfilter.org/cgi-bin/gitweb.cgi?p=iptables.git;a=blob;f=libxtables/xtables.c;h=009ab9115f6fd687a762a2552f89ac0b81ee1a42;hb=HEAD#l1915
Something we've discovered with regards to the nfacct match recently. If I have the following iptables statement:

iptables -A INPUT -m nfacct --nfacct <nfacct_obj> -m <match2> -m <match3>


The above aklways updates the "nfacct_obj" byte and packet counters, regardless of whether "match2" and "match3" actually matches. However, if we have:

iptables -A INPUT -m <match2> -m nfacct --nfacct <nfacct_obj> -m <match3>


then "nfacct_obj" counters are updated only when "match1" is satisfied, but if we have:

iptables -A INPUT -m <match2> -m <match3> -m nfacct --nfacct <nfacct_obj>


then "nfacct_obj" counters are updated when both match2 and match3 are matched (which was the initial intention).

This inconsistency stems from the fact that the nfacct match in the kernel (xt_nfacct.c::nfacct_mt) always returns true, but also because of how iptables evaluates matches: it does so from left to right.

Since there isn't a callback in the xt_match struct which is called after ALL matches have been satisfied (xt_match.match is called for each registered match in that statement), this causes the nfacct counters to be updated (or not) depending on the position of the nfacct match.

What I have done locally is to add a separate callback (I called it "matched") which is called for all matches after all such matches in a particular statement have been satisfied, but that obviously will break lots of code depending on the old xt_match struct if such approach is adopted. My question is: is there more elegant solution to do this? Thanks.


MZ