From 2ded65a547116e7cfbe4a8c6054d5da0cc9a2564 Mon Sep 17 00:00:00 2001
From: Marcos de Oliveira <markinholiveira@gmail.com>
Date: Tue, 26 Jul 2022 11:56:38 -0300
Subject: [PATCH] Allow specifying mod set multiple times

`ipset` matching module doesn't allow specifying multiple `--match-set` for a single `-m set`, so, we'll keep every `mod set` specified in the config.
---
 src/ferm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/ferm b/src/ferm
index 47fed834..83070d71 100755
--- a/src/ferm
+++ b/src/ferm
@@ -2763,7 +2763,10 @@ sub enter($$) {
                     my $defs = $match_defs{$domain_family}{$module};
 
                     append_option(%rule, 'match', $module);
-                    $rule{match}{$module} = 1;
+                    # ipset doesn't allow multiple '--match-set' for a single '-m set'
+                    # so we'll keep every '-m set' specified
+                    $rule{match}{$module} = 1
+                        unless $module =~ /^set$/;
 
                     merge_keywords(%rule, $defs->{keywords})
                       if defined $defs;