diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm
index a2c4d098a..40f370e7e 100644
--- a/Shorewall/Perl/Shorewall/Chains.pm
+++ b/Shorewall/Perl/Shorewall/Chains.pm
@@ -3302,6 +3302,30 @@ sub optimize_level4( $$ ) {
$progress = 1 if replace_references1 $chainref, $firstrule;
}
}
+ } else {
+ #
+ # Chain has more than one rule. If the last rule is a simple jump, then delete
+ # all preceding rules that have the same target
+ #
+ my $rulesref = $chainref->{rules};
+ my $lastref = $rulesref->[-1];
+
+ if ( $lastref->{simple} && $lastref->{target} && ! $lastref->{targetopts} ) {
+ my $target = $lastref->{target};
+
+ pop @$rulesref; #Pop the last simple rule
+
+ while ( @$rulesref ) {
+ my $rule1ref = $rulesref->[-1];
+
+ last unless ( $rule1ref->{target} || '' ) eq $target && ! $rule1ref->{targetopts};
+
+ pop @$rulesref;
+ $progress = 1;
+ }
+
+ push @$rulesref, $lastref; #Now restore the last simple rule
+ }
}
}
}
diff --git a/Shorewall/manpages/shorewall.conf.xml b/Shorewall/manpages/shorewall.conf.xml
index 72e6e7910..0dc3b55d5 100644
--- a/Shorewall/manpages/shorewall.conf.xml
+++ b/Shorewall/manpages/shorewall.conf.xml
@@ -96,7 +96,7 @@
role="bold">none}
-+ If CONFIG_PATH is not given or if it is set to the empty value then the contents of /usr/share/shorewall/configpath are @@ -814,7 +814,7 @@ net all DROP infothen the chain name is 'net2all' - + If this variable is not set or is given an empty value @@ -1024,7 +1024,7 @@ net all DROP infothen the chain name is 'net2all' - + For example, using the default LOGFORMAT, the log prefix for @@ -1041,7 +1041,7 @@ net all DROP infothen the chain name is 'net2all' control your firewall after you enable this option. -+ Do not use this option if the resulting log messages will @@ -1538,6 +1538,23 @@ net all DROP infothen the chain name is 'net2all' chain are appended to it. + +An additional optimization was added in Shorewall 4.5.4. + If the last rule in a chain is an unqualified jump to a simple + target, then all immediately preceding rules with the same + simple target are omitted. + +For example, consider this chain: + +-A fw-net -p udp --dport 67:68 -j ACCEPT + -A fw-net -p udp --sport 1194 -j ACCEPT + -A fw-net -p 41 -j ACCEPT + -A fw-net -j ACCEPT + + +Since all of the rules are jumps to the simple target + ACCEPT, this chain is totally optimized away and jumps to the + chain are replace with jumps to ACCEPT. @@ -1677,7 +1694,7 @@ net all DROP infothen the chain name is 'net2all' role="bold">" -- diff --git a/Shorewall6/manpages/shorewall6.conf.xml b/Shorewall6/manpages/shorewall6.conf.xml index c22d921a8..0c8859834 100644 --- a/Shorewall6/manpages/shorewall6.conf.xml +++ b/Shorewall6/manpages/shorewall6.conf.xml @@ -82,7 +82,7 @@ role="bold">none}+ - @@ -92,7 +92,7 @@ role="bold">none}+ - @@ -102,7 +102,7 @@ role="bold">none}+ - @@ -112,7 +112,7 @@ role="bold">none}+ - @@ -887,7 +887,7 @@ net all DROP infothen the chain name is 'net2all'+ + For example, using the default LOGFORMAT, the log prefix for @@ -904,7 +904,7 @@ net all DROP infothen the chain name is 'net2all' control your firewall after you enable this option. -+ Do not use this option if the resulting log messages will @@ -1336,6 +1336,23 @@ net all DROP infothen the chain name is 'net2all' chain are appended to it. + +An additional optimization was added in Shorewall 4.5.4. + If the last rule in a chain is an unqualified jump to a simple + target, then all immediately preceding rules with the same + simple target are omitted. + +For example, consider this chain: + +-A fw-net -p udp --dport 67:68 -j ACCEPT + -A fw-net -p udp --sport 1194 -j ACCEPT + -A fw-net -p 41 -j ACCEPT + -A fw-net -j ACCEPT + + +Since all of the rules are jumps to the simple target + ACCEPT, this chain is totally optimized away and jumps to the + chain are replace with jumps to ACCEPT. @@ -1475,7 +1492,7 @@ net all DROP infothen the chain name is 'net2all' role="bold">" - +