diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm index e02268f9b..94b99a0a5 100644 --- a/Shorewall/Perl/Shorewall/Chains.pm +++ b/Shorewall/Perl/Shorewall/Chains.pm @@ -4654,9 +4654,9 @@ sub do_condition( $$ ) { require_capability 'CONDITION_MATCH', 'A non-empty SWITCH column', 's'; - if ( $condition =~ /@/ ) { + if ( $condition =~ /\@\{0\}/ ) { $chain =~ s/[^\w-]//g; - $condition =~ s/@/$chain/g; + $condition =~ s/\@\{0\}/$chain/g; } fatal_error "Invalid switch name ($condition)" unless $condition =~ /^[a-zA-Z][-\w]*$/ && length $condition <= 30; diff --git a/Shorewall/manpages/shorewall-conntrack.xml b/Shorewall/manpages/shorewall-conntrack.xml index 62522ce26..6d69c1132 100644 --- a/Shorewall/manpages/shorewall-conntrack.xml +++ b/Shorewall/manpages/shorewall-conntrack.xml @@ -397,7 +397,11 @@ /proc/net/nf_condition/switch-name is 1. The rule is disabled if that file contains 0 (the default). If '!' is supplied, the test is inverted such that the rule is enabled - if the file contains 0. switch-name must + if the file contains 0. + + Within the switch-name, '@{0}' is + replaced by the name of the chain to which the rule is a added. The + switch-name (after '@{0}' expansion) must begin with a letter and be composed of letters, decimal digits, underscores or hyphens. Switch names must be 30 characters or less in length. diff --git a/Shorewall/manpages/shorewall-masq.xml b/Shorewall/manpages/shorewall-masq.xml index 25479a248..6dfae86c2 100644 --- a/Shorewall/manpages/shorewall-masq.xml +++ b/Shorewall/manpages/shorewall-masq.xml @@ -471,7 +471,11 @@ /proc/net/nf_condition/switch-name is 1. The rule is disabled if that file contains 0 (the default). If '!' is supplied, the test is inverted such that the rule is enabled - if the file contains 0. switch-name must + if the file contains 0. + + Within the switch-name, '@{0}' is + replaced by the name of the chain to which the rule is a added. The + switch-name (after '@{0}' expansion) must begin with a letter and be composed of letters, decimal digits, underscores or hyphens. Switch names must be 30 characters or less in length. diff --git a/Shorewall/manpages/shorewall-rules.xml b/Shorewall/manpages/shorewall-rules.xml index 6319a2357..d242a96cc 100644 --- a/Shorewall/manpages/shorewall-rules.xml +++ b/Shorewall/manpages/shorewall-rules.xml @@ -1380,7 +1380,11 @@ /proc/net/nf_condition/switch-name is 1. The rule is disabled if that file contains 0 (the default). If '!' is supplied, the test is inverted such that the rule is enabled - if the file contains 0. switch-name must + if the file contains 0. + + Within the switch-name, '@{0}' is + replaced by the name of the chain to which the rule is a added. The + switch-name (after '@{0}' expansion) must begin with a letter and be composed of letters, decimal digits, underscores or hyphens. Switch names must be 30 characters or less in length. diff --git a/Shorewall6/manpages/shorewall6-conntrack.xml b/Shorewall6/manpages/shorewall6-conntrack.xml index 3b41144f6..2cb9b7c3a 100644 --- a/Shorewall6/manpages/shorewall6-conntrack.xml +++ b/Shorewall6/manpages/shorewall6-conntrack.xml @@ -293,8 +293,12 @@ /proc/net/nf_condition/switch-name is 1. Disables the rule if that file contains 0 (the default). If '!' is supplied, the test is inverted such that the rule is enabled - if the file contains 0. The switch-name - must begin with a letter and be composed of letters, decimal digits, + if the file contains 0. + + Within the switch-name, '@{0}' is + replaced by the name of the chain to which the rule is a added. The + switch-name (after '@{0}' expansion) must + begin with a letter and be composed of letters, decimal digits, underscores or hyphens. Switch names must be 30 characters or less in length. diff --git a/Shorewall6/manpages/shorewall6-rules.xml b/Shorewall6/manpages/shorewall6-rules.xml index 682e6ea0f..aacecf270 100644 --- a/Shorewall6/manpages/shorewall6-rules.xml +++ b/Shorewall6/manpages/shorewall6-rules.xml @@ -1255,8 +1255,12 @@ /proc/net/nf_condition/switch-name is 1. Disables the rule if that file contains 0 (the default). If '!' is supplied, the test is inverted such that the rule is enabled - if the file contains 0. The switch-name - must begin with a letter and be composed of letters, decimal digits, + if the file contains 0. + + Within the switch-name, '@{0}' is + replaced by the name of the chain to which the rule is a added. The + switch-name (after '@{0}' expansion) must + begin with a letter and be composed of letters, decimal digits, underscores or hyphens. Switch names must be 30 characters or less in length.