Re: About matching (also was: Multiple Targets)

[Ben La Monica <ben.lamonica@gmail.com>]

On 4/13/05, Henrik Nordstrom <hno@marasystems.com> wrote:
> On Wed, 13 Apr 2005, Patrick Schaaf wrote:
> 
> > BTW, anybody ever thought about giving -j RETURN an --up N option?

I actually started working on a patch, but then someone mentioned that
it had to be binary compatible with the current iptables. The problem
being that RETURN is a special case. The --up N option is only like 15
lines of code if nobody minds the fact that you'll need to use a newer
version of the iptables binary and newer kernel. Since RETURN is just
an ipt_standard_target like DROP or ACCEPT.

Also, concerning the multiple targets for one match, what about a
module that did something like this:

iptables -I INPUT -p tcp -s 10.0.0.0/24 -j MULTIPLE --mjump ULOG
--ulog-prefix "bad" --mjump REJECT --reject-with tcp-reset

And then the MULTIPLE target would actually create the targets for
ULOG and REJECT, put them in a linked list, execute them in the order
received, and then use the last value to return to iptables with the
verdict.

Anyway, if you have any input regarding this, I can try to write it
this weekend.

-Ben