Re: How to use mark and connmark in one rule

["Gáspár Lajos" <swifty@freemail.hu>]

Pascal Hambourg írta:
>> The problem is that both connmark and mark have a --mark option...
>
> I just wonder why a match looks for options beyond the next -m which 
> starts a new match.
Maybe I am wrong, but as I know the iptables GIVES the options to the 
match...
So there is no command line parsing/looking for options by the match...

I think it is happens like this:
1. iptables checks the command line for matches and loads them,
2. every match registers its "extra_opts" in an internal table, (this 
time connmark and mark registers the same "mark" option.)
3. iptables checks the remaining command line options against the table.
4. if the option found in the table then the match will decide the 
option's fate (with the "parse" callback function).
The first registered match having "mark" option gets called every time a 
"mark" found in the command line.
And because this option is not allowed twice the match gives an error 
message.

Swifty