Re: How to use mark and connmark in one rule

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Gáspár Lajos a écrit :
> 
> I think it is happens like this:
> 1. iptables checks the command line for matches and loads them,
> 2. every match registers its "extra_opts" in an internal table, (this 
> time connmark and mark registers the same "mark" option.)
> 3. iptables checks the remaining command line options against the table.
> 4. if the option found in the table then the match will decide the 
> option's fate (with the "parse" callback function).

Well, then I rephrase : why does iptables pass to the match options 
which are beyond the next -m ? It seems obvious to me that those options 
belong to the next matches. Is it an accepted practice to order matches 
and options randomly ? If yes, then non-exclusive matches should not be 
allowed to have the same options.