1 /* 2 * Copyright (C) 1993-2001 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 7 * Use is subject to license terms. 8 */ 9 10 #pragma ident "%Z%%M% %I% %E% SMI" 11 12 #if !defined(lint) 13 static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed"; 14 static const char rcsid[] = "@(#)$Id: ipfcomp.c,v 1.24.2.2 2004/04/28 10:34:44 darrenr Exp $"; 15 #endif 16 17 #include "ipf.h" 18 19 20 typedef struct { 21 int c; 22 int e; 23 int n; 24 int p; 25 int s; 26 } mc_t; 27 28 29 static char *portcmp[] = { "*", "==", "!=", "<", ">", "<=", ">=", "**", "***" }; 30 static int count = 0; 31 32 int intcmp __P((const void *, const void *)); 33 static void indent __P((FILE *, int)); 34 static void printeq __P((FILE *, char *, int, int, int)); 35 static void printipeq __P((FILE *, char *, int, int, int)); 36 static void addrule __P((FILE *, frentry_t *)); 37 static void printhooks __P((FILE *, int, int, frgroup_t *)); 38 static void emitheader __P((frgroup_t *, u_int, u_int)); 39 static void emitGroup __P((int, int, void *, frentry_t *, char *, 40 u_int, u_int)); 41 static void emittail __P((void)); 42 static void printCgroup __P((int, frentry_t *, mc_t *, char *)); 43 44 #define FRC_IFN 0 45 #define FRC_V 1 46 #define FRC_P 2 47 #define FRC_FL 3 48 #define FRC_TOS 4 49 #define FRC_TTL 5 50 #define FRC_SRC 6 51 #define FRC_DST 7 52 #define FRC_TCP 8 53 #define FRC_SP 9 54 #define FRC_DP 10 55 #define FRC_OPT 11 56 #define FRC_SEC 12 57 #define FRC_ATH 13 58 #define FRC_ICT 14 59 #define FRC_ICC 15 60 #define FRC_MAX 16 61 62 63 static FILE *cfile = NULL; 64 65 /* 66 * This is called once per filter rule being loaded to emit data structures 67 * required. 68 */ 69 void printc(fr) 70 frentry_t *fr; 71 { 72 fripf_t *ipf; 73 u_long *ulp; 74 char *and; 75 FILE *fp; 76 int i; 77 78 if (fr->fr_v != 4) 79 return; 80 if ((fr->fr_type != FR_T_IPF) && (fr->fr_type != FR_T_NONE)) 81 return; 82 if ((fr->fr_type == FR_T_IPF) && 83 ((fr->fr_datype != FRI_NORMAL) || (fr->fr_satype != FRI_NORMAL))) 84 return; 85 ipf = fr->fr_ipf; 86 87 if (cfile == NULL) 88 cfile = fopen("ip_rules.c", "w"); 89 if (cfile == NULL) 90 return; 91 fp = cfile; 92 if (count == 0) { 93 fprintf(fp, "/*\n"); 94 fprintf(fp, "* Copyright (C) 1993-2000 by Darren Reed.\n"); 95 fprintf(fp, "*\n"); 96 fprintf(fp, "* Redistribution and use in source and binary forms are permitted\n"); 97 fprintf(fp, "* provided that this notice is preserved and due credit is given\n"); 98 fprintf(fp, "* to the original author and the contributors.\n"); 99 fprintf(fp, "*/\n\n"); 100 101 fprintf(fp, "#include <sys/types.h>\n"); 102 fprintf(fp, "#include <sys/time.h>\n"); 103 fprintf(fp, "#include <sys/socket.h>\n"); 104 fprintf(fp, "#if !defined(__FreeBSD__) && !defined(__OpenBSD__) && !defined(__sgi)\n"); 105 fprintf(fp, "# include <sys/systm.h>\n"); 106 fprintf(fp, "#endif\n"); 107 fprintf(fp, "#include <sys/errno.h>\n"); 108 fprintf(fp, "#include <sys/param.h>\n"); 109 fprintf(fp, 110 "#if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux)\n"); 111 fprintf(fp, "# include <sys/mbuf.h>\n"); 112 fprintf(fp, "#endif\n"); 113 fprintf(fp, 114 "#if defined(__FreeBSD__) && (__FreeBSD_version > 220000)\n"); 115 fprintf(fp, "# include <sys/sockio.h>\n"); 116 fprintf(fp, "#else\n"); 117 fprintf(fp, "# include <sys/ioctl.h>\n"); 118 fprintf(fp, "#endif /* FreeBSD */\n"); 119 fprintf(fp, "#include <net/if.h>\n"); 120 fprintf(fp, "#include <netinet/in.h>\n"); 121 fprintf(fp, "#include <netinet/in_systm.h>\n"); 122 fprintf(fp, "#include <netinet/ip.h>\n"); 123 fprintf(fp, "#include <netinet/tcp.h>\n"); 124 fprintf(fp, "#include \"netinet/ip_compat.h\"\n"); 125 fprintf(fp, "#include \"netinet/ip_fil.h\"\n\n"); 126 fprintf(fp, "#include \"netinet/ip_rules.h\"\n\n"); 127 fprintf(fp, "#ifndef _KERNEL\n"); 128 fprintf(fp, "# include <string.h>\n"); 129 fprintf(fp, "#endif /* _KERNEL */\n"); 130 fprintf(fp, "\n"); 131 fprintf(fp, "#ifdef IPFILTER_COMPILED\n"); 132 } 133 134 addrule(fp, fr); 135 fr->fr_type |= FR_T_BUILTIN; 136 and = ""; 137 fr->fr_ref = 1; 138 i = sizeof(*fr); 139 if (i & -(1 - sizeof(*ulp))) 140 i += sizeof(u_long); 141 for (i /= sizeof(u_long), ulp = (u_long *)fr; i > 0; i--) { 142 fprintf(fp, "%s%#lx", and, *ulp++); 143 and = ", "; 144 } 145 fprintf(fp, "\n};\n"); 146 fr->fr_type &= ~FR_T_BUILTIN; 147 148 count++; 149 150 fflush(fp); 151 } 152 153 154 static frgroup_t *groups = NULL; 155 156 157 static void addrule(fp, fr) 158 FILE *fp; 159 frentry_t *fr; 160 { 161 frentry_t *f, **fpp; 162 frgroup_t *g; 163 u_long *ulp; 164 char *and; 165 int i; 166 167 f = (frentry_t *)malloc(sizeof(*f)); 168 if (f == NULL) { 169 fprintf(stderr, "out of memory\n"); 170 exit(1); 171 } 172 bcopy((char *)fr, (char *)f, sizeof(*fr)); 173 if (fr->fr_ipf) { 174 f->fr_ipf = (fripf_t *)malloc(sizeof(*f->fr_ipf)); 175 if (f->fr_ipf == NULL) { 176 fprintf(stderr, "out of memory\n"); 177 exit(1); 178 } 179 bcopy((char *)fr->fr_ipf, (char *)f->fr_ipf, 180 sizeof(*fr->fr_ipf)); 181 } 182 183 f->fr_next = NULL; 184 for (g = groups; g != NULL; g = g->fg_next) 185 if ((strncmp(g->fg_name, f->fr_group, FR_GROUPLEN) == 0) && 186 (g->fg_flags == (f->fr_flags & FR_INOUT))) 187 break; 188 189 if (g == NULL) { 190 g = (frgroup_t *)calloc(1, sizeof(*g)); 191 if (g == NULL) { 192 fprintf(stderr, "out of memory\n"); 193 exit(1); 194 } 195 g->fg_next = groups; 196 groups = g; 197 g->fg_head = f; 198 bcopy(f->fr_group, g->fg_name, FR_GROUPLEN); 199 g->fg_ref = 0; 200 g->fg_flags = f->fr_flags & FR_INOUT; 201 } 202 203 for (fpp = &g->fg_start; *fpp != NULL; ) 204 fpp = &((*fpp)->fr_next); 205 *fpp = f; 206 207 if (fr->fr_dsize > 0) { 208 fprintf(fp, "\ 209 static u_long ipf%s_rule_data_%s_%u[] = {\n", 210 f->fr_flags & FR_INQUE ? "in" : "out", 211 g->fg_name, g->fg_ref); 212 and = ""; 213 i = fr->fr_dsize; 214 ulp = fr->fr_data; 215 for (i /= sizeof(u_long); i > 0; i--) { 216 fprintf(fp, "%s%#lx", and, *ulp++); 217 and = ", "; 218 } 219 fprintf(fp, "\n};\n"); 220 } 221 222 fprintf(fp, "\nstatic u_long %s_rule_%s_%d[] = {\n", 223 f->fr_flags & FR_INQUE ? "in" : "out", g->fg_name, g->fg_ref); 224 225 g->fg_ref++; 226 227 if (f->fr_grhead != 0) { 228 for (g = groups; g != NULL; g = g->fg_next) 229 if ((strncmp(g->fg_name, f->fr_grhead, 230 FR_GROUPLEN) == 0) && 231 g->fg_flags == (f->fr_flags & FR_INOUT)) 232 break; 233 if (g == NULL) { 234 g = (frgroup_t *)calloc(1, sizeof(*g)); 235 if (g == NULL) { 236 fprintf(stderr, "out of memory\n"); 237 exit(1); 238 } 239 g->fg_next = groups; 240 groups = g; 241 g->fg_head = f; 242 bcopy(f->fr_grhead, g->fg_name, FR_GROUPLEN); 243 g->fg_ref = 0; 244 g->fg_flags = f->fr_flags & FR_INOUT; 245 } 246 } 247 } 248 249 250 int intcmp(c1, c2) 251 const void *c1, *c2; 252 { 253 const mc_t *i1 = (const mc_t *)c1, *i2 = (const mc_t *)c2; 254 255 if (i1->n == i2->n) { 256 return i1->c - i2->c; 257 } 258 return i2->n - i1->n; 259 } 260 261 262 static void indent(fp, in) 263 FILE *fp; 264 int in; 265 { 266 for (; in; in--) 267 fputc('\t', fp); 268 } 269 270 static void printeq(fp, var, m, max, v) 271 FILE *fp; 272 char *var; 273 int m, max, v; 274 { 275 if (m == max) 276 fprintf(fp, "%s == %#x) {\n", var, v); 277 else 278 fprintf(fp, "(%s & %#x) == %#x) {\n", var, m, v); 279 } 280 281 /* 282 * Parameters: var - IP# being compared 283 * fl - 0 for positive match, 1 for negative match 284 * m - netmask 285 * v - required address 286 */ 287 static void printipeq(fp, var, fl, m, v) 288 FILE *fp; 289 char *var; 290 int fl, m, v; 291 { 292 if (m == 0xffffffff) 293 fprintf(fp, "%s ", var); 294 else 295 fprintf(fp, "(%s & %#x) ", var, m); 296 fprintf(fp, "%c", fl ? '!' : '='); 297 fprintf(fp, "= %#x) {\n", v); 298 } 299 300 301 void emit(num, dir, v, fr) 302 int num, dir; 303 void *v; 304 frentry_t *fr; 305 { 306 u_int incnt, outcnt; 307 frgroup_t *g; 308 frentry_t *f; 309 310 for (g = groups; g != NULL; g = g->fg_next) { 311 if (dir == 0 || dir == -1) { 312 if ((g->fg_flags & FR_INQUE) == 0) 313 continue; 314 for (incnt = 0, f = g->fg_start; f != NULL; 315 f = f->fr_next) 316 incnt++; 317 emitGroup(num, dir, v, fr, g->fg_name, incnt, 0); 318 } 319 if (dir == 1 || dir == -1) { 320 if ((g->fg_flags & FR_OUTQUE) == 0) 321 continue; 322 for (outcnt = 0, f = g->fg_start; f != NULL; 323 f = f->fr_next) 324 outcnt++; 325 emitGroup(num, dir, v, fr, g->fg_name, 0, outcnt); 326 } 327 } 328 329 if (num == -1 && dir == -1) { 330 for (g = groups; g != NULL; g = g->fg_next) { 331 if ((g->fg_flags & FR_INQUE) != 0) { 332 for (incnt = 0, f = g->fg_start; f != NULL; 333 f = f->fr_next) 334 incnt++; 335 if (incnt > 0) 336 emitheader(g, incnt, 0); 337 } 338 if ((g->fg_flags & FR_OUTQUE) != 0) { 339 for (outcnt = 0, f = g->fg_start; f != NULL; 340 f = f->fr_next) 341 outcnt++; 342 if (outcnt > 0) 343 emitheader(g, 0, outcnt); 344 } 345 } 346 emittail(); 347 fprintf(cfile, "#endif /* IPFILTER_COMPILED */\n"); 348 } 349 350 } 351 352 353 static void emitheader(grp, incount, outcount) 354 frgroup_t *grp; 355 u_int incount, outcount; 356 { 357 static FILE *fph = NULL; 358 frgroup_t *g; 359 360 if (fph == NULL) { 361 fph = fopen("ip_rules.h", "w"); 362 if (fph == NULL) 363 return; 364 365 fprintf(fph, "extern int ipfrule_add __P((void));\n"); 366 fprintf(fph, "extern int ipfrule_remove __P((void));\n"); 367 } 368 369 printhooks(cfile, incount, outcount, grp); 370 371 if (incount) { 372 fprintf(fph, "\n\ 373 extern frentry_t *ipfrule_match_in_%s __P((fr_info_t *, u_32_t *));\n\ 374 extern frentry_t *ipf_rules_in_%s[%d];\n", 375 grp->fg_name, grp->fg_name, incount); 376 377 for (g = groups; g != grp; g = g->fg_next) 378 if ((strncmp(g->fg_name, grp->fg_name, 379 FR_GROUPLEN) == 0) && 380 g->fg_flags == grp->fg_flags) 381 break; 382 if (g == grp) { 383 fprintf(fph, "\n\ 384 extern int ipfrule_add_in_%s __P((void));\n\ 385 extern int ipfrule_remove_in_%s __P((void));\n", grp->fg_name, grp->fg_name); 386 } 387 } 388 if (outcount) { 389 fprintf(fph, "\n\ 390 extern frentry_t *ipfrule_match_out_%s __P((fr_info_t *, u_32_t *));\n\ 391 extern frentry_t *ipf_rules_out_%s[%d];\n", 392 grp->fg_name, grp->fg_name, outcount); 393 394 for (g = groups; g != g; g = g->fg_next) 395 if ((strncmp(g->fg_name, grp->fg_name, 396 FR_GROUPLEN) == 0) && 397 g->fg_flags == grp->fg_flags) 398 break; 399 if (g == grp) { 400 fprintf(fph, "\n\ 401 extern int ipfrule_add_out_%s __P((void));\n\ 402 extern int ipfrule_remove_out_%s __P((void));\n", 403 grp->fg_name, grp->fg_name); 404 } 405 } 406 } 407 408 static void emittail() 409 { 410 frgroup_t *g; 411 412 fprintf(cfile, "\n\ 413 int ipfrule_add()\n\ 414 {\n\ 415 int err;\n\ 416 \n"); 417 for (g = groups; g != NULL; g = g->fg_next) 418 fprintf(cfile, "\ 419 err = ipfrule_add_%s_%s();\n\ 420 if (err != 0)\n\ 421 return err;\n", 422 (g->fg_flags & FR_INQUE) ? "in" : "out", g->fg_name); 423 fprintf(cfile, "\ 424 return 0;\n"); 425 fprintf(cfile, "}\n\ 426 \n"); 427 428 fprintf(cfile, "\n\ 429 int ipfrule_remove()\n\ 430 {\n\ 431 int err;\n\ 432 \n"); 433 for (g = groups; g != NULL; g = g->fg_next) 434 fprintf(cfile, "\ 435 err = ipfrule_remove_%s_%s();\n\ 436 if (err != 0)\n\ 437 return err;\n", 438 (g->fg_flags & FR_INQUE) ? "in" : "out", g->fg_name); 439 fprintf(cfile, "\ 440 return 0;\n"); 441 fprintf(cfile, "}\n"); 442 } 443 444 445 static void emitGroup(num, dir, v, fr, group, incount, outcount) 446 int num, dir; 447 void *v; 448 frentry_t *fr; 449 char *group; 450 u_int incount, outcount; 451 { 452 static FILE *fp = NULL; 453 static int header[2] = { 0, 0 }; 454 static char egroup[FR_GROUPLEN] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}; 455 static int openfunc = 0; 456 static mc_t *n = NULL; 457 static int sin = 0; 458 frentry_t *f; 459 frgroup_t *g; 460 fripf_t *ipf; 461 int i, in, j; 462 mc_t *m = v; 463 464 if (fp == NULL) 465 fp = cfile; 466 if (fp == NULL) 467 return; 468 if (strncmp(egroup, group, FR_GROUPLEN)) { 469 for (sin--; sin > 0; sin--) { 470 indent(fp, sin); 471 fprintf(fp, "}\n"); 472 } 473 if (openfunc == 1) { 474 fprintf(fp, "\treturn fr;\n}\n"); 475 openfunc = 0; 476 if (n != NULL) { 477 free(n); 478 n = NULL; 479 } 480 } 481 sin = 0; 482 header[0] = 0; 483 header[1] = 0; 484 strncpy(egroup, group, FR_GROUPLEN); 485 } else if (openfunc == 1 && num < 0) { 486 if (n != NULL) { 487 free(n); 488 n = NULL; 489 } 490 for (sin--; sin > 0; sin--) { 491 indent(fp, sin); 492 fprintf(fp, "}\n"); 493 } 494 if (openfunc == 1) { 495 fprintf(fp, "\treturn fr;\n}\n"); 496 openfunc = 0; 497 } 498 } 499 500 if (dir == -1) 501 return; 502 503 for (g = groups; g != NULL; g = g->fg_next) { 504 if (dir == 0 && (g->fg_flags & FR_INQUE) == 0) 505 continue; 506 else if (dir == 1 && (g->fg_flags & FR_OUTQUE) == 0) 507 continue; 508 if (strncmp(g->fg_name, group, FR_GROUPLEN) != 0) 509 continue; 510 break; 511 } 512 513 /* 514 * Output the array of pointers to rules for this group. 515 */ 516 if (num == -2 && dir == 0 && header[0] == 0 && incount != 0) { 517 fprintf(fp, "\nfrentry_t *ipf_rules_in_%s[%d] = {", 518 group, incount); 519 for (f = g->fg_start, i = 0; f != NULL; f = f->fr_next) { 520 if ((f->fr_flags & FR_INQUE) == 0) 521 continue; 522 if ((i & 1) == 0) { 523 fprintf(fp, "\n\t"); 524 } 525 fprintf(fp, 526 "(frentry_t *)&in_rule_%s_%d", 527 f->fr_group, i); 528 if (i + 1 < incount) 529 fprintf(fp, ", "); 530 i++; 531 } 532 fprintf(fp, "\n};\n"); 533 } 534 535 if (num == -2 && dir == 1 && header[1] == 0 && outcount != 0) { 536 fprintf(fp, "\nfrentry_t *ipf_rules_out_%s[%d] = {", 537 group, outcount); 538 for (f = g->fg_start, i = 0; f != NULL; f = f->fr_next) { 539 if ((f->fr_flags & FR_OUTQUE) == 0) 540 continue; 541 if ((i & 1) == 0) { 542 fprintf(fp, "\n\t"); 543 } 544 fprintf(fp, 545 "(frentry_t *)&out_rule_%s_%d", 546 f->fr_group, i); 547 if (i + 1 < outcount) 548 fprintf(fp, ", "); 549 i++; 550 } 551 fprintf(fp, "\n};\n"); 552 fp = NULL; 553 } 554 555 if (num < 0) 556 return; 557 558 in = 0; 559 ipf = fr->fr_ipf; 560 561 /* 562 * If the function header has not been printed then print it now. 563 */ 564 if (header[dir] == 0) { 565 int pdst = 0, psrc = 0; 566 567 openfunc = 1; 568 fprintf(fp, "\nfrentry_t *ipfrule_match_%s_%s(fin, passp)\n", 569 (dir == 0) ? "in" : "out", group); 570 fprintf(fp, "fr_info_t *fin;\n"); 571 fprintf(fp, "u_32_t *passp;\n"); 572 fprintf(fp, "{\n"); 573 fprintf(fp, "\tfrentry_t *fr = NULL;\n"); 574 575 /* 576 * Print out any variables that need to be declared. 577 */ 578 for (f = g->fg_start, i = 0; f != NULL; f = f->fr_next) { 579 if (incount + outcount > m[FRC_SRC].e + 1) 580 psrc = 1; 581 if (incount + outcount > m[FRC_DST].e + 1) 582 pdst = 1; 583 } 584 if (psrc == 1) 585 fprintf(fp, "\tu_32_t src = ntohl(%s);\n", 586 "fin->fin_fi.fi_saddr"); 587 if (pdst == 1) 588 fprintf(fp, "\tu_32_t dst = ntohl(%s);\n", 589 "fin->fin_fi.fi_daddr"); 590 } 591 592 for (i = 0; i < FRC_MAX; i++) { 593 switch(m[i].c) 594 { 595 case FRC_IFN : 596 if (*fr->fr_ifname) 597 m[i].s = 1; 598 break; 599 case FRC_V : 600 if (ipf != NULL && ipf->fri_mip.fi_v != 0) 601 m[i].s = 1; 602 break; 603 case FRC_FL : 604 if (ipf != NULL && ipf->fri_mip.fi_flx != 0) 605 m[i].s = 1; 606 break; 607 case FRC_P : 608 if (ipf != NULL && ipf->fri_mip.fi_p != 0) 609 m[i].s = 1; 610 break; 611 case FRC_TTL : 612 if (ipf != NULL && ipf->fri_mip.fi_ttl != 0) 613 m[i].s = 1; 614 break; 615 case FRC_TOS : 616 if (ipf != NULL && ipf->fri_mip.fi_tos != 0) 617 m[i].s = 1; 618 break; 619 case FRC_TCP : 620 if (ipf == NULL) 621 break; 622 if ((ipf->fri_ip.fi_p == IPPROTO_TCP) && 623 fr->fr_tcpfm != 0) 624 m[i].s = 1; 625 break; 626 case FRC_SP : 627 if (ipf == NULL) 628 break; 629 if (fr->fr_scmp == FR_INRANGE) 630 m[i].s = 1; 631 else if (fr->fr_scmp == FR_OUTRANGE) 632 m[i].s = 1; 633 else if (fr->fr_scmp != 0) 634 m[i].s = 1; 635 break; 636 case FRC_DP : 637 if (ipf == NULL) 638 break; 639 if (fr->fr_dcmp == FR_INRANGE) 640 m[i].s = 1; 641 else if (fr->fr_dcmp == FR_OUTRANGE) 642 m[i].s = 1; 643 else if (fr->fr_dcmp != 0) 644 m[i].s = 1; 645 break; 646 case FRC_SRC : 647 if (ipf == NULL) 648 break; 649 if (fr->fr_satype == FRI_LOOKUP) { 650 ; 651 } else if ((fr->fr_smask != 0) || 652 (fr->fr_flags & FR_NOTSRCIP) != 0) 653 m[i].s = 1; 654 break; 655 case FRC_DST : 656 if (ipf == NULL) 657 break; 658 if (fr->fr_datype == FRI_LOOKUP) { 659 ; 660 } else if ((fr->fr_dmask != 0) || 661 (fr->fr_flags & FR_NOTDSTIP) != 0) 662 m[i].s = 1; 663 break; 664 case FRC_OPT : 665 if (ipf == NULL) 666 break; 667 if (fr->fr_optmask != 0) 668 m[i].s = 1; 669 break; 670 case FRC_SEC : 671 if (ipf == NULL) 672 break; 673 if (fr->fr_secmask != 0) 674 m[i].s = 1; 675 break; 676 case FRC_ATH : 677 if (ipf == NULL) 678 break; 679 if (fr->fr_authmask != 0) 680 m[i].s = 1; 681 break; 682 case FRC_ICT : 683 if (ipf == NULL) 684 break; 685 if ((fr->fr_icmpm & 0xff00) != 0) 686 m[i].s = 1; 687 break; 688 case FRC_ICC : 689 if (ipf == NULL) 690 break; 691 if ((fr->fr_icmpm & 0xff) != 0) 692 m[i].s = 1; 693 break; 694 } 695 } 696 697 if (!header[dir]) { 698 fprintf(fp, "\n"); 699 header[dir] = 1; 700 sin = 0; 701 } 702 703 qsort(m, FRC_MAX, sizeof(mc_t), intcmp); 704 705 if (n) { 706 /* 707 * Calculate the indentation interval upto the last common 708 * common comparison being made. 709 */ 710 for (i = 0, in = 1; i < FRC_MAX; i++) { 711 if (n[i].c != m[i].c) 712 break; 713 if (n[i].s != m[i].s) 714 break; 715 if (n[i].s) { 716 if (n[i].n && (n[i].n > n[i].e)) { 717 m[i].p++; 718 in += m[i].p; 719 break; 720 } 721 if (n[i].e > 0) { 722 in++; 723 } else 724 break; 725 } 726 } 727 if (sin != in) { 728 for (j = sin - 1; j >= in; j--) { 729 indent(fp, j); 730 fprintf(fp, "}\n"); 731 } 732 } 733 } else { 734 in = 1; 735 i = 0; 736 } 737 738 /* 739 * print out C code that implements a filter rule. 740 */ 741 for (; i < FRC_MAX; i++) { 742 switch(m[i].c) 743 { 744 case FRC_IFN : 745 if (m[i].s) { 746 indent(fp, in); 747 fprintf(fp, "if (fin->fin_ifp == "); 748 fprintf(fp, "ipf_rules_%s_%s[%d]->fr_ifa) {\n", 749 dir ? "out" : "in", group, num); 750 in++; 751 } 752 break; 753 case FRC_V : 754 if (m[i].s) { 755 indent(fp, in); 756 fprintf(fp, "if (fin->fin_v == %d) {\n", 757 ipf->fri_ip.fi_v); 758 in++; 759 } 760 break; 761 case FRC_FL : 762 if (m[i].s) { 763 indent(fp, in); 764 fprintf(fp, "if ("); 765 printeq(fp, "fin->fin_flx", 766 ipf->fri_mip.fi_flx, 0xf, 767 ipf->fri_ip.fi_flx); 768 in++; 769 } 770 break; 771 case FRC_P : 772 if (m[i].s) { 773 indent(fp, in); 774 fprintf(fp, "if (fin->fin_p == %d) {\n", 775 ipf->fri_ip.fi_p); 776 in++; 777 } 778 break; 779 case FRC_TTL : 780 if (m[i].s) { 781 indent(fp, in); 782 fprintf(fp, "if ("); 783 printeq(fp, "fin->fin_ttl", 784 ipf->fri_mip.fi_ttl, 0xff, 785 ipf->fri_ip.fi_ttl); 786 in++; 787 } 788 break; 789 case FRC_TOS : 790 if (m[i].s) { 791 indent(fp, in); 792 fprintf(fp, "if (fin->fin_tos"); 793 printeq(fp, "fin->fin_tos", 794 ipf->fri_mip.fi_tos, 0xff, 795 ipf->fri_ip.fi_tos); 796 in++; 797 } 798 break; 799 case FRC_TCP : 800 if (m[i].s) { 801 indent(fp, in); 802 fprintf(fp, "if ("); 803 printeq(fp, "fin->fin_tcpf", fr->fr_tcpfm, 804 0xff, fr->fr_tcpf); 805 in++; 806 } 807 break; 808 case FRC_SP : 809 if (!m[i].s) 810 break; 811 if (fr->fr_scmp == FR_INRANGE) { 812 indent(fp, in); 813 fprintf(fp, "if ((fin->fin_data[0] > %d) && ", 814 fr->fr_sport); 815 fprintf(fp, "(fin->fin_data[0] < %d)", 816 fr->fr_stop); 817 fprintf(fp, ") {\n"); 818 in++; 819 } else if (fr->fr_scmp == FR_OUTRANGE) { 820 indent(fp, in); 821 fprintf(fp, "if ((fin->fin_data[0] < %d) || ", 822 fr->fr_sport); 823 fprintf(fp, "(fin->fin_data[0] > %d)", 824 fr->fr_stop); 825 fprintf(fp, ") {\n"); 826 in++; 827 } else if (fr->fr_scmp) { 828 indent(fp, in); 829 fprintf(fp, "if (fin->fin_data[0] %s %d)", 830 portcmp[fr->fr_scmp], fr->fr_sport); 831 fprintf(fp, " {\n"); 832 in++; 833 } 834 break; 835 case FRC_DP : 836 if (!m[i].s) 837 break; 838 if (fr->fr_dcmp == FR_INRANGE) { 839 indent(fp, in); 840 fprintf(fp, "if ((fin->fin_data[1] > %d) && ", 841 fr->fr_dport); 842 fprintf(fp, "(fin->fin_data[1] < %d)", 843 fr->fr_dtop); 844 fprintf(fp, ") {\n"); 845 in++; 846 } else if (fr->fr_dcmp == FR_OUTRANGE) { 847 indent(fp, in); 848 fprintf(fp, "if ((fin->fin_data[1] < %d) || ", 849 fr->fr_dport); 850 fprintf(fp, "(fin->fin_data[1] > %d)", 851 fr->fr_dtop); 852 fprintf(fp, ") {\n"); 853 in++; 854 } else if (fr->fr_dcmp) { 855 indent(fp, in); 856 fprintf(fp, "if (fin->fin_data[1] %s %d)", 857 portcmp[fr->fr_dcmp], fr->fr_dport); 858 fprintf(fp, " {\n"); 859 in++; 860 } 861 break; 862 case FRC_SRC : 863 if (!m[i].s) 864 break; 865 if (fr->fr_satype == FRI_LOOKUP) { 866 ; 867 } else if ((fr->fr_smask != 0) || 868 (fr->fr_flags & FR_NOTSRCIP) != 0) { 869 indent(fp, in); 870 fprintf(fp, "if ("); 871 printipeq(fp, "src", 872 fr->fr_flags & FR_NOTSRCIP, 873 fr->fr_smask, fr->fr_saddr); 874 in++; 875 } 876 break; 877 case FRC_DST : 878 if (!m[i].s) 879 break; 880 if (fr->fr_datype == FRI_LOOKUP) { 881 ; 882 } else if ((fr->fr_dmask != 0) || 883 (fr->fr_flags & FR_NOTDSTIP) != 0) { 884 indent(fp, in); 885 fprintf(fp, "if ("); 886 printipeq(fp, "dst", 887 fr->fr_flags & FR_NOTDSTIP, 888 fr->fr_dmask, fr->fr_daddr); 889 in++; 890 } 891 break; 892 case FRC_OPT : 893 if (m[i].s) { 894 indent(fp, in); 895 fprintf(fp, "if ("); 896 printeq(fp, "fin->fin_fi.fi_optmsk", 897 fr->fr_optmask, 0xffffffff, 898 fr->fr_optbits); 899 in++; 900 } 901 break; 902 case FRC_SEC : 903 if (m[i].s) { 904 indent(fp, in); 905 fprintf(fp, "if ("); 906 printeq(fp, "fin->fin_fi.fi_secmsk", 907 fr->fr_secmask, 0xffff, 908 fr->fr_secbits); 909 in++; 910 } 911 break; 912 case FRC_ATH : 913 if (m[i].s) { 914 indent(fp, in); 915 fprintf(fp, "if ("); 916 printeq(fp, "fin->fin_fi.fi_authmsk", 917 fr->fr_authmask, 0xffff, 918 fr->fr_authbits); 919 in++; 920 } 921 break; 922 case FRC_ICT : 923 if (m[i].s) { 924 indent(fp, in); 925 fprintf(fp, "if ("); 926 printeq(fp, "fin->fin_data[0]", 927 fr->fr_icmpm & 0xff00, 0xffff, 928 fr->fr_icmp & 0xff00); 929 in++; 930 } 931 break; 932 case FRC_ICC : 933 if (m[i].s) { 934 indent(fp, in); 935 fprintf(fp, "if ("); 936 printeq(fp, "fin->fin_data[0]", 937 fr->fr_icmpm & 0xff, 0xffff, 938 fr->fr_icmp & 0xff); 939 in++; 940 } 941 break; 942 } 943 944 } 945 946 indent(fp, in); 947 if (fr->fr_flags & FR_QUICK) { 948 fprintf(fp, "return (frentry_t *)&%s_rule_%s_%d;\n", 949 fr->fr_flags & FR_INQUE ? "in" : "out", 950 fr->fr_group, num); 951 } else { 952 fprintf(fp, "fr = (frentry_t *)&%s_rule_%s_%d;\n", 953 fr->fr_flags & FR_INQUE ? "in" : "out", 954 fr->fr_group, num); 955 } 956 if (n == NULL) { 957 n = (mc_t *)malloc(sizeof(*n) * FRC_MAX); 958 if (n == NULL) { 959 fprintf(stderr, "out of memory\n"); 960 exit(1); 961 } 962 } 963 bcopy((char *)m, (char *)n, sizeof(*n) * FRC_MAX); 964 sin = in; 965 } 966 967 968 void printC(dir) 969 int dir; 970 { 971 static mc_t *m = NULL; 972 frgroup_t *g; 973 974 if (m == NULL) { 975 m = (mc_t *)calloc(1, sizeof(*m) * FRC_MAX); 976 if (m == NULL) { 977 fprintf(stderr, "out of memory\n"); 978 exit(1); 979 } 980 } 981 982 for (g = groups; g != NULL; g = g->fg_next) { 983 if ((dir == 0) && ((g->fg_flags & FR_INQUE) != 0)) 984 printCgroup(dir, g->fg_start, m, g->fg_name); 985 if ((dir == 1) && ((g->fg_flags & FR_OUTQUE) != 0)) 986 printCgroup(dir, g->fg_start, m, g->fg_name); 987 } 988 989 emit(-1, dir, m, NULL); 990 } 991 992 993 /* 994 * Now print out code to implement all of the rules. 995 */ 996 static void printCgroup(dir, top, m, group) 997 int dir; 998 frentry_t *top; 999 mc_t *m; 1000 char *group; 1001 { 1002 frentry_t *fr, *fr1; 1003 int i, n, rn; 1004 u_int count; 1005 1006 for (count = 0, fr1 = top; fr1 != NULL; fr1 = fr1->fr_next) { 1007 if ((dir == 0) && ((fr1->fr_flags & FR_INQUE) != 0)) 1008 count++; 1009 else if ((dir == 1) && ((fr1->fr_flags & FR_OUTQUE) != 0)) 1010 count++; 1011 } 1012 1013 if (dir == 0) 1014 emitGroup(-2, dir, m, fr1, group, count, 0); 1015 else if (dir == 1) 1016 emitGroup(-2, dir, m, fr1, group, 0, count); 1017 1018 /* 1019 * Before printing each rule, check to see how many of its fields are 1020 * matched by subsequent rules. 1021 */ 1022 for (fr1 = top, rn = 0; fr1 != NULL; fr1 = fr1->fr_next, rn++) { 1023 if (!dir && !(fr1->fr_flags & FR_INQUE)) 1024 continue; 1025 if (dir && !(fr1->fr_flags & FR_OUTQUE)) 1026 continue; 1027 n = 0xfffffff; 1028 1029 for (i = 0; i < FRC_MAX; i++) 1030 m[i].e = 0; 1031 qsort(m, FRC_MAX, sizeof(mc_t), intcmp); 1032 1033 for (i = 0; i < FRC_MAX; i++) { 1034 m[i].c = i; 1035 m[i].e = 0; 1036 m[i].n = 0; 1037 m[i].s = 0; 1038 } 1039 1040 for (fr = fr1->fr_next; fr; fr = fr->fr_next) { 1041 if (!dir && !(fr->fr_flags & FR_INQUE)) 1042 continue; 1043 if (dir && !(fr->fr_flags & FR_OUTQUE)) 1044 continue; 1045 1046 if ((n & 0x0001) && 1047 !strcmp(fr1->fr_ifname, fr->fr_ifname)) { 1048 m[FRC_IFN].e++; 1049 m[FRC_IFN].n++; 1050 } else 1051 n &= ~0x0001; 1052 1053 if ((n & 0x0002) && (fr1->fr_v == fr->fr_v)) { 1054 m[FRC_V].e++; 1055 m[FRC_V].n++; 1056 } else 1057 n &= ~0x0002; 1058 1059 if ((n & 0x0004) && 1060 (fr->fr_type == fr1->fr_type) && 1061 (fr->fr_type == FR_T_IPF) && 1062 (fr1->fr_mip.fi_flx == fr->fr_mip.fi_flx) && 1063 (fr1->fr_ip.fi_flx == fr->fr_ip.fi_flx)) { 1064 m[FRC_FL].e++; 1065 m[FRC_FL].n++; 1066 } else 1067 n &= ~0x0004; 1068 1069 if ((n & 0x0008) && 1070 (fr->fr_type == fr1->fr_type) && 1071 (fr->fr_type == FR_T_IPF) && 1072 (fr1->fr_proto == fr->fr_proto)) { 1073 m[FRC_P].e++; 1074 m[FRC_P].n++; 1075 } else 1076 n &= ~0x0008; 1077 1078 if ((n & 0x0010) && 1079 (fr->fr_type == fr1->fr_type) && 1080 (fr->fr_type == FR_T_IPF) && 1081 (fr1->fr_ttl == fr->fr_ttl)) { 1082 m[FRC_TTL].e++; 1083 m[FRC_TTL].n++; 1084 } else 1085 n &= ~0x0010; 1086 1087 if ((n & 0x0020) && 1088 (fr->fr_type == fr1->fr_type) && 1089 (fr->fr_type == FR_T_IPF) && 1090 (fr1->fr_tos == fr->fr_tos)) { 1091 m[FRC_TOS].e++; 1092 m[FRC_TOS].n++; 1093 } else 1094 n &= ~0x0020; 1095 1096 if ((n & 0x0040) && 1097 (fr->fr_type == fr1->fr_type) && 1098 (fr->fr_type == FR_T_IPF) && 1099 ((fr1->fr_tcpfm == fr->fr_tcpfm) && 1100 (fr1->fr_tcpf == fr->fr_tcpf))) { 1101 m[FRC_TCP].e++; 1102 m[FRC_TCP].n++; 1103 } else 1104 n &= ~0x0040; 1105 1106 if ((n & 0x0080) && 1107 (fr->fr_type == fr1->fr_type) && 1108 (fr->fr_type == FR_T_IPF) && 1109 ((fr1->fr_scmp == fr->fr_scmp) && 1110 (fr1->fr_stop == fr->fr_stop) && 1111 (fr1->fr_sport == fr->fr_sport))) { 1112 m[FRC_SP].e++; 1113 m[FRC_SP].n++; 1114 } else 1115 n &= ~0x0080; 1116 1117 if ((n & 0x0100) && 1118 (fr->fr_type == fr1->fr_type) && 1119 (fr->fr_type == FR_T_IPF) && 1120 ((fr1->fr_dcmp == fr->fr_dcmp) && 1121 (fr1->fr_dtop == fr->fr_dtop) && 1122 (fr1->fr_dport == fr->fr_dport))) { 1123 m[FRC_DP].e++; 1124 m[FRC_DP].n++; 1125 } else 1126 n &= ~0x0100; 1127 1128 if ((n & 0x0200) && 1129 (fr->fr_type == fr1->fr_type) && 1130 (fr->fr_type == FR_T_IPF) && 1131 ((fr1->fr_satype == FRI_LOOKUP) && 1132 (fr->fr_satype == FRI_LOOKUP) && 1133 (fr1->fr_srcnum == fr->fr_srcnum))) { 1134 m[FRC_SRC].e++; 1135 m[FRC_SRC].n++; 1136 } else if ((n & 0x0200) && 1137 (fr->fr_type == fr1->fr_type) && 1138 (fr->fr_type == FR_T_IPF) && 1139 (((fr1->fr_flags & FR_NOTSRCIP) == 1140 (fr->fr_flags & FR_NOTSRCIP)))) { 1141 if ((fr1->fr_smask == fr->fr_smask) && 1142 (fr1->fr_saddr == fr->fr_saddr)) 1143 m[FRC_SRC].e++; 1144 else 1145 n &= ~0x0200; 1146 if (fr1->fr_smask && 1147 (fr1->fr_saddr & fr1->fr_smask) == 1148 (fr->fr_saddr & fr1->fr_smask)) { 1149 m[FRC_SRC].n++; 1150 n |= 0x0200; 1151 } 1152 } else { 1153 n &= ~0x0200; 1154 } 1155 1156 if ((n & 0x0400) && 1157 (fr->fr_type == fr1->fr_type) && 1158 (fr->fr_type == FR_T_IPF) && 1159 ((fr1->fr_datype == FRI_LOOKUP) && 1160 (fr->fr_datype == FRI_LOOKUP) && 1161 (fr1->fr_dstnum == fr->fr_dstnum))) { 1162 m[FRC_DST].e++; 1163 m[FRC_DST].n++; 1164 } else if ((n & 0x0400) && 1165 (fr->fr_type == fr1->fr_type) && 1166 (fr->fr_type == FR_T_IPF) && 1167 (((fr1->fr_flags & FR_NOTDSTIP) == 1168 (fr->fr_flags & FR_NOTDSTIP)))) { 1169 if ((fr1->fr_dmask == fr->fr_dmask) && 1170 (fr1->fr_daddr == fr->fr_daddr)) 1171 m[FRC_DST].e++; 1172 else 1173 n &= ~0x0400; 1174 if (fr1->fr_dmask && 1175 (fr1->fr_daddr & fr1->fr_dmask) == 1176 (fr->fr_daddr & fr1->fr_dmask)) { 1177 m[FRC_DST].n++; 1178 n |= 0x0400; 1179 } 1180 } else { 1181 n &= ~0x0400; 1182 } 1183 1184 if ((n & 0x0800) && 1185 (fr->fr_type == fr1->fr_type) && 1186 (fr->fr_type == FR_T_IPF) && 1187 (fr1->fr_optmask == fr->fr_optmask) && 1188 (fr1->fr_optbits == fr->fr_optbits)) { 1189 m[FRC_OPT].e++; 1190 m[FRC_OPT].n++; 1191 } else 1192 n &= ~0x0800; 1193 1194 if ((n & 0x1000) && 1195 (fr->fr_type == fr1->fr_type) && 1196 (fr->fr_type == FR_T_IPF) && 1197 (fr1->fr_secmask == fr->fr_secmask) && 1198 (fr1->fr_secbits == fr->fr_secbits)) { 1199 m[FRC_SEC].e++; 1200 m[FRC_SEC].n++; 1201 } else 1202 n &= ~0x1000; 1203 1204 if ((n & 0x10000) && 1205 (fr->fr_type == fr1->fr_type) && 1206 (fr->fr_type == FR_T_IPF) && 1207 (fr1->fr_authmask == fr->fr_authmask) && 1208 (fr1->fr_authbits == fr->fr_authbits)) { 1209 m[FRC_ATH].e++; 1210 m[FRC_ATH].n++; 1211 } else 1212 n &= ~0x10000; 1213 1214 if ((n & 0x20000) && 1215 (fr->fr_type == fr1->fr_type) && 1216 (fr->fr_type == FR_T_IPF) && 1217 ((fr1->fr_icmpm & 0xff00) == 1218 (fr->fr_icmpm & 0xff00)) && 1219 ((fr1->fr_icmp & 0xff00) == 1220 (fr->fr_icmp & 0xff00))) { 1221 m[FRC_ICT].e++; 1222 m[FRC_ICT].n++; 1223 } else 1224 n &= ~0x20000; 1225 1226 if ((n & 0x40000) && 1227 (fr->fr_type == fr1->fr_type) && 1228 (fr->fr_type == FR_T_IPF) && 1229 ((fr1->fr_icmpm & 0xff) == (fr->fr_icmpm & 0xff)) && 1230 ((fr1->fr_icmp & 0xff) == (fr->fr_icmp & 0xff))) { 1231 m[FRC_ICC].e++; 1232 m[FRC_ICC].n++; 1233 } else 1234 n &= ~0x40000; 1235 } 1236 /*msort(m);*/ 1237 1238 if (dir == 0) 1239 emitGroup(rn, dir, m, fr1, group, count, 0); 1240 else if (dir == 1) 1241 emitGroup(rn, dir, m, fr1, group, 0, count); 1242 } 1243 } 1244 1245 static void printhooks(fp, in, out, grp) 1246 FILE *fp; 1247 int in; 1248 int out; 1249 frgroup_t *grp; 1250 { 1251 frentry_t *fr; 1252 char *group; 1253 int dogrp, i; 1254 char *instr; 1255 1256 group = grp->fg_name; 1257 dogrp = 0; 1258 1259 if (in && out) { 1260 fprintf(stderr, 1261 "printhooks called with both in and out set\n"); 1262 exit(1); 1263 } 1264 1265 if (in) { 1266 instr = "in"; 1267 } else if (out) { 1268 instr = "out"; 1269 } else { 1270 instr = "???"; 1271 } 1272 fprintf(fp, "static frentry_t ipfrule_%s_%s;\n", instr, group); 1273 1274 fprintf(fp, "\ 1275 \n\ 1276 int ipfrule_add_%s_%s()\n", instr, group); 1277 fprintf(fp, "\ 1278 {\n\ 1279 int i, j, err = 0, max;\n\ 1280 frentry_t *fp;\n"); 1281 1282 if (dogrp) 1283 fprintf(fp, "\ 1284 frgroup_t *fg;\n"); 1285 1286 fprintf(fp, "\n"); 1287 1288 for (i = 0, fr = grp->fg_start; fr != NULL; i++, fr = fr->fr_next) 1289 if (fr->fr_dsize > 0) { 1290 fprintf(fp, "\ 1291 ipf_rules_%s_%s[%d]->fr_data = &ipf%s_rule_data_%s_%u;\n", 1292 instr, grp->fg_name, i, 1293 instr, grp->fg_name, i); 1294 } 1295 fprintf(fp, "\ 1296 max = sizeof(ipf_rules_%s_%s)/sizeof(frentry_t *);\n\ 1297 for (i = 0; i < max; i++) {\n\ 1298 fp = ipf_rules_%s_%s[i];\n\ 1299 fp->fr_next = NULL;\n", instr, group, instr, group); 1300 1301 fprintf(fp, "\ 1302 for (j = i + 1; j < max; j++)\n\ 1303 if (strncmp(fp->fr_group,\n\ 1304 ipf_rules_%s_%s[j]->fr_group,\n\ 1305 FR_GROUPLEN) == 0) {\n\ 1306 fp->fr_next = ipf_rules_%s_%s[j];\n\ 1307 break;\n\ 1308 }\n", instr, group, instr, group); 1309 if (dogrp) 1310 fprintf(fp, "\ 1311 \n\ 1312 if (fp->fr_grhead != 0) {\n\ 1313 fg = fr_addgroup(fp->fr_grhead, fp, FR_INQUE,\n\ 1314 IPL_LOGIPF, 0);\n\ 1315 if (fg != NULL)\n\ 1316 fp->fr_grp = &fg->fg_start;\n\ 1317 }\n"); 1318 fprintf(fp, "\ 1319 }\n\ 1320 \n\ 1321 fp = &ipfrule_%s_%s;\n", instr, group); 1322 fprintf(fp, "\ 1323 bzero((char *)fp, sizeof(*fp));\n\ 1324 fp->fr_type = FR_T_CALLFUNC|FR_T_BUILTIN;\n\ 1325 fp->fr_flags = FR_%sQUE|FR_NOMATCH;\n\ 1326 fp->fr_data = (void *)ipf_rules_%s_%s[0];\n", 1327 (in != 0) ? "IN" : "OUT", instr, group); 1328 fprintf(fp, "\ 1329 fp->fr_dsize = sizeof(ipf_rules_%s_%s[0]);\n", 1330 instr, group); 1331 1332 fprintf(fp, "\ 1333 fp->fr_v = 4;\n\ 1334 fp->fr_func = (ipfunc_t)ipfrule_match_%s_%s;\n\ 1335 err = frrequest(IPL_LOGIPF, SIOCADDFR, (caddr_t)fp, fr_active, 0);\n", 1336 instr, group); 1337 fprintf(fp, "\treturn err;\n}\n"); 1338 1339 fprintf(fp, "\n\n\ 1340 int ipfrule_remove_%s_%s()\n", instr, group); 1341 fprintf(fp, "\ 1342 {\n\ 1343 int err = 0, i;\n\ 1344 frentry_t *fp;\n\ 1345 \n\ 1346 /*\n\ 1347 * Try to remove the %sbound rule.\n", instr); 1348 1349 fprintf(fp, "\ 1350 */\n\ 1351 if (ipfrule_%s_%s.fr_ref > 0) {\n", instr, group); 1352 1353 fprintf(fp, "\ 1354 err = EBUSY;\n\ 1355 } else {\n"); 1356 1357 fprintf(fp, "\ 1358 i = sizeof(ipf_rules_%s_%s)/sizeof(frentry_t *) - 1;\n\ 1359 for (; i >= 0; i--) {\n\ 1360 fp = ipf_rules_%s_%s[i];\n\ 1361 if (fp->fr_ref > 1) {\n\ 1362 err = EBUSY;\n\ 1363 break;\n\ 1364 }\n\ 1365 }\n\ 1366 }\n\ 1367 if (err == 0)\n\ 1368 err = frrequest(IPL_LOGIPF, SIOCDELFR,\n\ 1369 (caddr_t)&ipfrule_%s_%s, fr_active, 0);\n", 1370 instr, group, instr, group, instr, group); 1371 fprintf(fp, "\ 1372 if (err)\n\ 1373 return err;\n\ 1374 \n\n"); 1375 1376 fprintf(fp, "\treturn err;\n}\n"); 1377 } 1378