1) Cosmetic change to compiler.pl

2) Make 'purge_jump' handle '-g <target>' correctly
3) Minor effeciency changes to Chains.pm

Samples/one-interface/policy

@@ -16,7 +16,6 @@
 ###############################################################################
 #SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
 $FW		net		ACCEPT
-net		$FW		DROP		info
 net		all		DROP		info
 # The FOLLOWING POLICY MUST BE LAST
 all		all		REJECT		info

Samples/three-interfaces/policy

@@ -16,65 +16,7 @@
 ###############################################################################
 #SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
 
-#
-# Note about policies and logging:
-#	This file contains an explicit policy for every combination of
-#	zones defined in this sample.  This is solely for the purpose of
-#	providing more specific messages in the logs.  This is not
-#	necessary for correct operation of the firewall, but greatly
-#	assists in diagnosing problems. The policies below are logically
-#	equivalent to:
-#
-#	loc	net		ACCEPT
-#	net	all		DROP		info
-#	all	all		REJECT		info
-#
-#	The Shorewall-perl compiler will generate the individual policies
-#	below from the above general policies if you set 
-#	EXPAND_POLICIES=Yes in shorewall.conf. 
-#
-
-#
-# Policies for traffic originating from the local LAN (loc)
-#
-# If you want to force clients to access the Internet via a proxy server
-# in your DMZ, change the following policy to REJECT info.
 loc		net		ACCEPT
-# If you want open access to DMZ from loc, change the following policy
-# to ACCEPT.  (If you chose not to do this, you will need to add a rule
-# for each service in the rules file.)
-loc		dmz		REJECT		info
-loc		$FW		REJECT		info
-loc		all		REJECT		info
-
-#
-# Policies for traffic originating from the firewall ($FW)
-#
-# If you want open access to the Internet from your firewall, change the
-# $FW to net policy to ACCEPT and remove the 'info' LOG LEVEL.
-$FW		net		REJECT		info
-$FW		dmz		REJECT		info
-$FW		loc		REJECT		info
-$FW		all		REJECT		info
-
-#
-# Policies for traffic originating from the De-Militarized Zone (dmz)
-#
-# If you want open access from DMZ to the Internet change the following
-# policy to ACCEPT.  This may be useful if you run a proxy server in
-# your DMZ.
-dmz		net		REJECT		info
-dmz		$FW		REJECT		info
-dmz		loc		REJECT		info
-dmz		all		REJECT		info
-
-#
-# Policies for traffic originating from the Internet zone (net)
-#
-net		dmz		DROP		info
-net		$FW		DROP		info
-net		loc		DROP		info
 net		all		DROP		info
-
 # THE FOLLOWING POLICY MUST BE LAST
 all		all		REJECT		info

Samples/two-interfaces/policy

@@ -16,49 +16,8 @@
 ###############################################################################
 #SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
 
-#
-# Note about policies and logging:
-#	This file contains an explicit policy for every combination of
-#	zones defined in this sample.  This is solely for the purpose of
-#	providing more specific messages in the logs.  This is not
-#	necessary for correct operation of the firewall, but greatly
-#	assists in diagnosing problems. The policies below are logically
-#	equivalent to:
-#
-#	loc	net		ACCEPT
-#	net	all		DROP		info
-#	all	all		REJECT		info
-#
-#	The Shorewall-perl compiler will generate the individual policies
-#	below from the above general policies if you set 
-#	EXPAND_POLICIES=Yes in shorewall.conf. 
-#
-
-# Policies for traffic originating from the local LAN (loc)
-#
-# If you want to force clients to access the Internet via a proxy server
-# on your firewall, change the loc to net policy to REJECT info.
 loc		net		ACCEPT
-loc		$FW		REJECT		info
-loc		all		REJECT		info
-
-#
-# Policies for traffic originating from the firewall ($FW)
-#
-# If you want open access to the Internet from your firewall, change the
-# $FW to net policy to ACCEPT and remove the 'info' LOG LEVEL.
-# This may be useful if you run a proxy server on the firewall.
-$FW		net		REJECT		info
-$FW		loc		REJECT		info
-$FW		all		REJECT		info
-
-#
-# Policies for traffic originating from the Internet zone (net)
-#
-net		$FW		DROP		info
-net		loc		DROP		info
 net		all		DROP		info
-
 # THE FOLLOWING POLICY MUST BE LAST
 all		all		REJECT		info
 

Shorewall/Perl/Shorewall/Chains.pm

@@ -421,11 +421,11 @@ sub add_command($$)
     $chainref->{referenced} = 1;
 }
 
-sub add_commands {
+sub add_commands ( $$;@ ) {
     my $chainref = shift @_;
 
-    for my $command ( @_ ) {
+    for ( @_ ) {
-	push @{$chainref->{rules}}, join ('', '    ' x $chainref->{cmdlevel} , $command );
+	push @{$chainref->{rules}}, join ('', '    ' x $chainref->{cmdlevel} , $_ );
     }
 
     $chainref->{referenced} = 1;
@@ -546,7 +546,7 @@ sub handle_dport_list( $$$$$ ) {
 #
 # Add a rule to a chain. Arguments are:
 #
-#    Chain reference , Rule [, Expand-long-dest-port-lists ]
+#    Chain reference , Rule [, Expand-long-port-lists ]
 #
 sub add_rule($$;$)
 {
@@ -627,7 +627,7 @@ sub purge_jump ( $$ ) {
     my $to = $toref->{name};
 
     for ( @{$fromref->{rules}} ) {
-	$_ = undef if / -j ${to}\b/;
+	$_ = undef if / -[gj] ${to}\b/;
     }
 	
     $toref->{referenced} = 0 unless @{$toref->{rules}};
@@ -770,7 +770,7 @@ sub use_input_chain($) {
     #
     # We must use the interfaces's chain if the interface is associated with multiple zone nets or
     # if the interface has the 'upnpclient' option. In the latter case, the chain's rules will contain
-    # run-time code which currently cannot be transferred to a zone-oriented chain by move_rules().
+    # run-time code which cannot currently be transferred to a zone-oriented chain by move_rules().
     #    
     return 1 if $nets > 1 || $interfaceref->{options}{upnpclient};
     #
@@ -1167,6 +1167,7 @@ sub initialize_chain_table()
 	}
     }
 }
+
 #
 # Add ESTABLISHED,RELATED rules and synparam jumps to the passed chain
 #

Shorewall/Perl/compiler.pl

@@ -82,7 +82,7 @@ my $family        = 4; # F_IPV4
 Getopt::Long::Configure ('bundling');
 
 my $result = GetOptions('h'               => \$help,
-                        'help'          => \$help,
+                        'help'            => \$help,
                         'export'          => \$export,
 			'e'               => \$export,
 			'directory=s'     => \$shorewall_dir,