Re: iptables nfacct match question

[Michael Zintakis <michael.zintakis@googlemail.com>]

Michael Zintakis wrote:
> We would have had the consistency (in other words, getting a consistent result regardless of the order of the various conditions/matches) if nfacct was a target, not a match, but I know that would be difficult (I already examined that possibility) since the x_tables target does not provide a 'destroy' method, so there isn't a way to track the 'refcnt' in the nfacct kernel struct, so inventing this method is as equally as ugly as the hack I did with the nfacct match above, so I thought to ask and see whether there is a better solution.
It looks as though I was wrong - I must have been blind when I looked in the x_tables header file!

There is a destroy method as part of mt_target. So if I 'reform' the nfacct match and make it a target, then I guess that whole 'inconsistency' thing will disappear since I could now use something like:

iptables -A INPUT -m match1 -m match2 -j NFACCT --nfacct <nfacct_obj>

and regardless of the order of match1 and match2, the result will be the same, am I correct or is there something very wrong?