From 1e6f293c3c74eea2a3f40f543ec43f1ba688c56d Mon Sep 17 00:00:00 2001
From: Tom Eastep <teastep@shorewall.net>
Date: Mon, 23 Aug 2010 15:36:17 -0700
Subject: [PATCH] Fix an old optimization bug

---
 Shorewall/Perl/Shorewall/Chains.pm | 31 +++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm
index 2e486284b..b382049af 100644
--- a/Shorewall/Perl/Shorewall/Chains.pm
+++ b/Shorewall/Perl/Shorewall/Chains.pm
@@ -685,7 +685,7 @@ sub delete_jumps ( $$ ) {
     # deleting elements from the array over which we are iterating.
     #
     for ( my $rule = 0; $rule <= $#{$rules}; $rule++ ) {
-	if (  $rules->[$rule] =~ / -[gj] ${to}\s*$/ ) {
+	if (  $rules->[$rule] =~ / -[gj] ${to}( -m comment .*)?\s*$/ ) {
 	    trace( $fromref, 'D', $rule + 1, $rules->[$rule] ) if $debug;
 	    splice(  @$rules, $rule, 1 );
 	    last unless --$refs > 0;
@@ -3105,17 +3105,6 @@ sub expand_rule( $$$$$$$$$$;$ )
     } elsif ( $disposition eq 'LOG' ) {
 	fatal_error "LOG requires a level";
     }
-    #
-    # Mark Target as referenced, if it's a chain
-    #
-    if ( $target =~ /-[jg]\s+([^\s]+)/ ) {
-	my $targetref = $chain_table{$chainref->{table}}{$1};
-	if ( $targetref ) {
-	    $targetref->{referenced} = 1;
-	    add_reference $chainref, $targetref;
-	}
-    }
-
     #
     # Isolate Source Interface, if any
     #
@@ -3385,6 +3374,8 @@ sub expand_rule( $$$$$$$$$$;$ )
     fatal_error "SOURCE interface may not be specified with a source IP address in the POSTROUTING chain"   if $restriction == POSTROUTE_RESTRICT && $iiface && ( $inets ne ALLIP || $iexcl || $trivialiexcl);
     fatal_error "DEST interface may not be specified with a destination IP address in the PREROUTING chain" if $restriction == PREROUTE_RESTRICT &&  $diface && ( $dnets ne ALLIP || $dexcl || $trivialdexcl);
 
+    my $fromref;
+
     if ( $iexcl || $dexcl || $oexcl ) {
 	#
 	# We have non-trivial exclusion -- need to create an exclusion chain
@@ -3426,7 +3417,7 @@ sub expand_rule( $$$$$$$$$$;$ )
 	#
 	# Generate Final Rule
 	#
-	add_rule( $echainref, $exceptionrule . $target, 1 ) unless $disposition eq 'LOG';
+	add_rule( $fromref = $echainref, $exceptionrule . $target, 1 ) unless $disposition eq 'LOG';
     } else {
 	#
 	# No exclusions
@@ -3466,7 +3457,7 @@ sub expand_rule( $$$$$$$$$$;$ )
 					       'add',
 					       $matches );
 
-				add_rule( $chainref, $matches . $target, 1 );
+				add_rule( $fromref = $chainref, $matches . $target, 1 );
 			    }
 			} else {
 			    #
@@ -3487,12 +3478,22 @@ sub expand_rule( $$$$$$$$$$;$ )
 			#
 			# No logging -- add the target rule with matches to the rule chain
 			#
-			add_rule( $chainref, $matches . $target , 1 );
+			add_rule( $fromref = $chainref, $matches . $target , 1 );
 		    }
 		}
 	    }
 	}
     }
+    #
+    # Mark Target as referenced, if it's a chain
+    #
+    if ( $fromref && $target =~ /-[jg]\s+([^\s]+)/ ) {
+	my $targetref = $chain_table{$chainref->{table}}{$1};
+	if ( $targetref ) {
+	    $targetref->{referenced} = 1;
+	    add_reference $fromref, $targetref;
+	}
+    }
 
     while ( @ends ) {
 	decr_cmd_level $chainref;