diff --git a/Shorewall-perl/Shorewall/Accounting.pm b/Shorewall-perl/Shorewall/Accounting.pm index de6a1b72f..df38cc5be 100644 --- a/Shorewall-perl/Shorewall/Accounting.pm +++ b/Shorewall-perl/Shorewall/Accounting.pm @@ -69,6 +69,7 @@ sub process_accounting_rule( $$$$$$$$$ ) { sub check_for_builtin( $ ) { my $chainref = shift; fatal_error "A builtin Chain ($chainref->{name}) may not appear in the accounting file" if $chainref->{builtin}; + fatal_error "A Shorewall-generated chain ($chainref->{name}) may not appear in the accounting file" if $chainref->{policy}; } sub accounting_error() { @@ -77,7 +78,7 @@ sub process_accounting_rule( $$$$$$$$$ ) { sub jump_to_chain( $ ) { my $jumpchain = $_[0]; - $jumpchainref = ensure_chain( 'filter', $jumpchain ); + $jumpchainref = ensure_accounting_chain( $jumpchain ); check_for_builtin( $jumpchainref ); $disposition = $jumpchain; "-j $jumpchain"; diff --git a/Shorewall-perl/Shorewall/Chains.pm b/Shorewall-perl/Shorewall/Chains.pm index 271e27ab8..b53a57fff 100644 --- a/Shorewall-perl/Shorewall/Chains.pm +++ b/Shorewall-perl/Shorewall/Chains.pm @@ -101,6 +101,7 @@ our %EXPORT_TAGS = ( ecn_chain first_chains ensure_chain + ensure_accounting_chain ensure_mangle_chain ensure_nat_chain new_standard_chain @@ -161,6 +162,7 @@ our $VERSION = 4.1.5; # referenced => undef|1 -- If 1, will be written to the iptables-restore-input. # builtin => undef|1 -- If 1, one of Netfilter's built-in chains. # manual => undef|1 -- If 1, a manual chain. +# accounting => undef|1 -- If 1, an accounting chain # log => # policy => # policychain => -- self-reference if this is a policy chain @@ -854,6 +856,25 @@ sub ensure_filter_chain( $$ ) $chainref; } +# +# Create an accounting chain if necessary. +# +sub ensure_accounting_chain( $ ) +{ + my ($chain) = @_; + + my $chainref = $filter_table->{$chain}; + + if ( $chainref ) { + fatal_error "Non-accounting chain ($chain) used in accounting rule" if ! $chainref->{accounting}; + } else { + $chainref = new_chain 'filter' , $chain unless $chainref; + $chainref->{accounting} = 1; + } + + $chainref; +} + sub ensure_mangle_chain($) { my $chain = $_[0];