diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm
index a083ee16b..fa74d8754 100644
--- a/Shorewall/Perl/Shorewall/Chains.pm
+++ b/Shorewall/Perl/Shorewall/Chains.pm
@@ -3748,7 +3748,7 @@ sub do_condition( $ ) {
my $invert = $condition =~ s/^!// ? '! ' : '';
require_capability 'CONDITION_MATCH', 'A non-empty SWITCH column', 's';
- fatal_error "Invalid switch name ($condition)" unless $condition =~ /^[a-zA-Z][-\w]*$/;
+ fatal_error "Invalid switch name ($condition)" unless $condition =~ /^[a-zA-Z][-\w]*$/ && length $condition <= 30;
"-m condition ${invert}--condition $condition "
}
diff --git a/docs/configuration_file_basics.xml b/docs/configuration_file_basics.xml
index 1bdb5b762..a524d9a31 100644
--- a/docs/configuration_file_basics.xml
+++ b/docs/configuration_file_basics.xml
@@ -1660,16 +1660,23 @@ DNAT net loc:192.168.1.3 tcp 4000:4100
rule is enabled only when the switch is on. If you precede the switch name with ! (e.g.,
!switch1), then the rule is enabled only when the switch is off.
+ role="bold">off. Switch settings are retained over
+ shorewall restart.
-
- The shorewall restart command resets all
- switches to off.
-
+ Shorewall requires that switch names:
- Shorewall requires that switch names begin with a letter and be
- composed of letters, digits, underscore ('_') or hyphen ('-'). Multiple
- rules can be controlled by the same switch.
+
+
+ begin with a letter and be composed of letters, digits,
+ underscore ('_') or hyphen ('-'); and
+
+
+
+ be 30 characters or less in length.
+
+
+
+ Multiple rules can be controlled by the same switch.
Example:
diff --git a/manpages/shorewall-rules.xml b/manpages/shorewall-rules.xml
index a0c9164ca..0e4a2d6e1 100644
--- a/manpages/shorewall-rules.xml
+++ b/manpages/shorewall-rules.xml
@@ -1283,29 +1283,36 @@
[!]switch-name
- Added in Shorewall 4.4.24. Matches if the value stored in
- /proc/net/nf_condition/switch-name
- is 1. Does not match if that file contains 0 (the default). If '!'
- is supplied, the test is inverted such that there is a match if the
- file contains 0. The switch-name must begin with a letter and be
- composed of letters, decimal digits, underscores or hyphens.
+ Added in Shorewall 4.4.24 and allows enabling and disabling
+ the rule without requiring shorewall
+ restart.
- Switches are normally off. To turn on a switch:
+ The rule is enabled if the value stored in
+ /proc/net/nf_condition/switch-name
+ is 1. The rule is disabled if that file contains 0 (the default). If
+ '!' is supplied, the test is inverted such that the rule is enabled
+ if the file contains 0. switch-name must
+ begin with a letter and be composed of letters, decimal digits,
+ underscores or hyphens. Switch names must be 30 characters or less
+ in length.
+
+ Switches are normally off. To
+ turn a switch on:
echo 1 >
/proc/net/nf_condition/switch-name
- To turn it off again:
+ To turn it off again:
echo 0 >
/proc/net/nf_condition/switch-name
- The shorewall restart command turns all
- switches off.
+ Switch settings are retained over shorewall
+ restart.
diff --git a/manpages6/shorewall6-rules.xml b/manpages6/shorewall6-rules.xml
index f4715fc8a..0241d6db7 100644
--- a/manpages6/shorewall6-rules.xml
+++ b/manpages6/shorewall6-rules.xml
@@ -1108,29 +1108,36 @@
[!]switch-name
- Added in Shorewall6 4.4.24. Matches if the value stored in
- /proc/net/nf_condition/switch-name
- is 1. Does not match if that file contains 0 (the default). If '!'
- is supplied, the test is inverted such that there is a match if the
- file contains 0. The switch-name must begin with a letter and be
- composed of letters, decimal digits, underscores or hyphens.
+ Added in Shorewall6 4.4.24 and allows enabling and disabling
+ the rule without requiring shorewall6
+ restart.
- Switches are normally off. To turn on a switch:
+ Enables the rule if the value stored in
+ /proc/net/nf_condition/switch-name
+ is 1. Disables the rule if that file contains 0 (the default). If
+ '!' is supplied, the test is inverted such that the rule is enabled
+ if the file contains 0. The switch-name
+ must begin with a letter and be composed of letters, decimal digits,
+ underscores or hyphens. Switch names must be 30 characters or less
+ in length.
+
+ Switches are normally off. To
+ turn a switch on:
echo 1 >
/proc/net/nf_condition/switch-name
- To turn it off again:
+ To turn it off again:
echo 0 >
/proc/net/nf_condition/switch-name
- The shorewall6 restart command turns all
- switches off.
+ Switch settings are retained over shorewall6
+ restart.