diff --git a/Shorewall/Perl/Shorewall/Accounting.pm b/Shorewall/Perl/Shorewall/Accounting.pm index e0ba0c52e..1595f5f58 100644 --- a/Shorewall/Perl/Shorewall/Accounting.pm +++ b/Shorewall/Perl/Shorewall/Accounting.pm @@ -102,6 +102,14 @@ sub process_accounting_rule( ) { unless ( $action eq 'COUNT' ) { if ( $action eq 'DONE' ) { $target = 'RETURN'; + } elsif ( $action =~ /^ACCOUNT\((.+)\)$/ ) { + my ( $table, $net ) = split/,/, $1; + require_capability 'ACCOUNT_TARGET' , 'ACCOUNT Rules' , ''; + fatal_error "Invalid or Missing Table Name ($table)" unless $table =~ /^([-\w.]+)$/; + fatal_error "Invalid Network Address" unless $net =~ '/(\d+)$'; + fatal_error "Netmask ($1) out of range" unless $1 >= 8; + validate_net $net, 0; + $target = "ACCOUNT --addr $net --tname $table"; } else { ( $action, my $cmd ) = split /:/, $action; if ( $cmd ) { diff --git a/Shorewall6/lib.cli b/Shorewall6/lib.cli index bf15b74ae..1285e3e4b 100644 --- a/Shorewall6/lib.cli +++ b/Shorewall6/lib.cli @@ -1479,7 +1479,7 @@ determine_capabilities() { qt $IP6TABLES -A $chain -j LOG || LOG_TARGET= qt $IP6TABLES -A $chain -j MARK --set-mark 5 && MARK_ANYWHERE=Yes qt $IP6TABLES -A $chain -m ipv6header --header 255 && HEADER_MATCH=Yes - qt $IP6TABLES -A $chain -j ACCOUNT --addr 1::/29 --tname $chain + qt $IP6TABLES -A $chain -j ACCOUNT --addr 1::/122 --tname $chain && ACCOUNT_TARGET=Yes qt $IP6TABLES -F $chain qt $IP6TABLES -X $chain