From 8de9fb54ae9e04806aa51e2349fcb129939b547c Mon Sep 17 00:00:00 2001
From: zhangtian <zhangtian@moresec.cn>
Date: Sun, 18 Feb 2024 17:20:38 +0800
Subject: [PATCH] sort match&options type

---
 iptables/iptables.go  | 25 ++++++++++++++++++-------
 iptables/statement.go | 21 +++++++++++++++++++--
 2 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/iptables/iptables.go b/iptables/iptables.go
index 7a3ed2e..280fa02 100644
--- a/iptables/iptables.go
+++ b/iptables/iptables.go
@@ -62,24 +62,35 @@ func NewIPTables(opts ...IPTablesOption) *IPTables {
 func (iptables *IPTables) dump() *IPTables {
 	newiptables := &IPTables{
 		statement: &Statement{
-			err:     iptables.statement.err,
-			table:   iptables.statement.table,
-			chain:   iptables.statement.chain,
-			matches: make(map[MatchType]Match),
-			options: make(map[OptionType]Option),
-			target:  iptables.statement.target,
-			command: iptables.statement.command,
+			err:             iptables.statement.err,
+			table:           iptables.statement.table,
+			chain:           iptables.statement.chain,
+			matches:         make(map[MatchType]Match),
+			matchTypeOrder:  make([]MatchType, 0),
+			options:         make(map[OptionType]Option),
+			optionTypeOrder: make([]OptionType, 0),
+			target:          iptables.statement.target,
+			command:         iptables.statement.command,
 		},
 		cmdName:  iptables.cmdName,
 		log:      iptables.log,
 		dr:       iptables.dr,
 		drWriter: iptables.drWriter,
 	}
+
+	for _, k := range iptables.statement.matchTypeOrder {
+		newiptables.statement.matchTypeOrder = append(newiptables.statement.matchTypeOrder, k)
+	}
 	for k, v := range iptables.statement.matches {
 		newiptables.statement.matches[k] = v
 	}
+
+	for _, k := range iptables.statement.optionTypeOrder {
+		newiptables.statement.optionTypeOrder = append(newiptables.statement.optionTypeOrder, k)
+	}
 	for k, v := range iptables.statement.options {
 		newiptables.statement.options[k] = v
 	}
+
 	return newiptables
 }
diff --git a/iptables/statement.go b/iptables/statement.go
index ee21556..b2b6330 100644
--- a/iptables/statement.go
+++ b/iptables/statement.go
@@ -14,7 +14,9 @@ type Statement struct {
 	chain            ChainType
 	userDefinedChain string
 	matches          map[MatchType]Match
+	matchTypeOrder   []MatchType
 	options          map[OptionType]Option
+	optionTypeOrder  []OptionType
 	target           Target
 	command          Command
 	dump             bool
@@ -34,10 +36,16 @@ func NewStatement() *Statement {
 }
 
 func (statement *Statement) addMatch(match Match) {
+	if _, ok := statement.matches[match.Type()]; !ok {
+		statement.matchTypeOrder = append(statement.matchTypeOrder, match.Type())
+	}
 	statement.matches[match.Type()] = match
 }
 
 func (statement *Statement) addOption(option Option) {
+	if _, ok := statement.options[option.Type()]; !ok {
+		statement.optionTypeOrder = append(statement.optionTypeOrder, option.Type())
+	}
 	statement.options[option.Type()] = option
 }
 
@@ -102,7 +110,12 @@ func (statement *Statement) Elems() ([]string, error) {
 	}
 
 	// options
-	for _, option := range statement.options {
+	for _, optionType := range statement.optionTypeOrder {
+		option, ok := statement.options[optionType]
+		if !ok {
+			continue
+		}
+
 		args := option.ShortArgs()
 		if args != nil {
 			if option.Type() != OptionTypeNumeric ||
@@ -117,7 +130,11 @@ func (statement *Statement) Elems() ([]string, error) {
 	}
 
 	// matches
-	for _, match := range statement.matches {
+	for _, matchType := range statement.matchTypeOrder {
+		match, ok := statement.matches[matchType]
+		if !ok {
+			continue
+		}
 		args := match.ShortArgs()
 		if args != nil {
 			elems = append(elems, args...)