diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm index f455f887a..62ec964c2 100644 --- a/Shorewall/Perl/Shorewall/Config.pm +++ b/Shorewall/Perl/Shorewall/Config.pm @@ -1812,8 +1812,12 @@ sub split_list2( $$ ) { sub split_list3( $$ ) { my ($list, $type ) = @_; - - fatal_error "Invalid $type ($list)" if $list =~ /^,|,,/; + # + # We allow omitted arguments in action invocations. + # + $list =~ s/^,/-,/; + $list =~ s/,$/,-/; + $list =~ s/,,/,-,/g; my @list1 = split /,/, $list; my @list2; diff --git a/Shorewall/Perl/Shorewall/Rules.pm b/Shorewall/Perl/Shorewall/Rules.pm index 4a4a11eb2..798ca3e7d 100644 --- a/Shorewall/Perl/Shorewall/Rules.pm +++ b/Shorewall/Perl/Shorewall/Rules.pm @@ -2121,8 +2121,6 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) { return $generated; - } elsif ( $actiontype & ( ACTION | INLINE ) ) { - split_list1 $param, 'Action parameter'; } elsif ( $actiontype & NFQ ) { require_capability( 'NFQUEUE_TARGET', 'NFQUEUE Rules', '' ); my $paramval = $param eq '' ? 0 : numeric_value( $param ); @@ -2140,7 +2138,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) { validate_level( $action ); $loglevel = supplied $loglevel ? join( ':', $action, $loglevel ) : $action; $action = 'LOG'; - } else { + } elsif ( ! ( $actiontype & (ACTION | INLINE) ) ) { fatal_error "The $basictarget TARGET does not accept a parameter" unless $param eq ''; } diff --git a/docs/Actions.xml b/docs/Actions.xml index 0860eca37..a68797ae7 100644 --- a/docs/Actions.xml +++ b/docs/Actions.xml @@ -394,6 +394,13 @@ REDIRECT net - tcp 80 - 1.2.3.4 In the above example, $2 would expand to nothing. + Beginning with Shorewall 4.5.13, completely omitting a arameter is + equivalent to passing '-'. + + Example: ACTION(REDIRECT,,info) + + This example behaves the same as the one shown above. + If you want to make '-' a parameter value, use '--' (e.g., ACTION(REDIRECT,--.info)). @@ -407,10 +414,6 @@ REDIRECT net - tcp 80 - 1.2.3.4 for the second parameter and so on. You can specify an empty default using '-' (e.g. DEFAULTS DROP,-,audit). - The DEFAULTS directive also determines the maximum number of - parameters that an action may have. If more parameters are passed than - have default values, an error message is issued. - For additional information about actions, see the Action Variables section of the Configuration Basics article.