From 5a85c2d669c3e10601c3d5b19b6dc7409281440d Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@slot.vk.crocodile.org>
Date: Fri, 6 May 2011 18:21:41 -0700
Subject: [PATCH] see #2367 ipfw actions queue,pipe and divert are terminating
 so we do not need to add permit to the generated command

---
 .../migration/FWObjectDatabase_20.xslt        |  3 ++
 src/pflib/PolicyCompiler_ipfw_writers.cpp     | 41 ++++++++++---------
 2 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/src/libfwbuilder/migration/FWObjectDatabase_20.xslt b/src/libfwbuilder/migration/FWObjectDatabase_20.xslt
index ec5980913..2f401105d 100644
--- a/src/libfwbuilder/migration/FWObjectDatabase_20.xslt
+++ b/src/libfwbuilder/migration/FWObjectDatabase_20.xslt
@@ -136,6 +136,9 @@
       <xsl:when test="($pf_make_terminating = 'True') and ($platform = 'pf')">
         <xsl:attribute name="action">Accept</xsl:attribute>
       </xsl:when>
+      <xsl:when test="$platform = 'ipfw'">
+        <xsl:attribute name="action">Accept</xsl:attribute>
+      </xsl:when>
       <xsl:otherwise>
         <xsl:attribute name="action">Continue</xsl:attribute>
       </xsl:otherwise>
diff --git a/src/pflib/PolicyCompiler_ipfw_writers.cpp b/src/pflib/PolicyCompiler_ipfw_writers.cpp
index 329dce8c7..a7bb29ce5 100644
--- a/src/pflib/PolicyCompiler_ipfw_writers.cpp
+++ b/src/pflib/PolicyCompiler_ipfw_writers.cpp
@@ -159,10 +159,29 @@ string PolicyCompiler_ipfw::PrintRule::_printTCPFlags(TCPService *srv)
 
 void PolicyCompiler_ipfw::PrintRule::_printAction(PolicyRule *rule)
 {
-    FWOptions *ruleopt =rule->getOptionsObject();
-    Service *srv=compiler->getFirstSrv(rule);    assert(srv);
+    FWOptions *ruleopt = rule->getOptionsObject();
+    Service *srv = compiler->getFirstSrv(rule);
+    assert(srv);
 
-    switch (rule->getAction()) {
+    if (rule->getClassification())
+    {
+        int portNum = ruleopt->getInt("ipfw_pipe_queue_num");
+        switch (ruleopt->getInt("ipfw_classify_method"))
+        {
+        case DUMMYNETPIPE:
+            compiler->output << "pipe "   << portNum << " ";
+            return;
+        case DUMMYNETQUEUE:
+            compiler->output << "queue "  << portNum << " ";
+            return;
+        default:
+            compiler->output << "divert " << portNum << " ";
+            return;
+        }
+    }
+
+    switch (rule->getAction())
+    {
     case PolicyRule::Skip:
         compiler->output << "skipto " << rule->getInt("skip_to") << " ";
         break;
@@ -223,22 +242,6 @@ void PolicyCompiler_ipfw::PrintRule::_printAction(PolicyRule *rule)
 //   compiler->output << rule->getActionAsString() << " ";
     }
 
-    if (rule->getClassification())
-    {
-        int portNum = ruleopt->getInt("ipfw_pipe_queue_num");
-        switch (ruleopt->getInt("ipfw_classify_method"))
-        {
-        case DUMMYNETPIPE:
-            compiler->output << "pipe "   << portNum << " ";
-            break;
-        case DUMMYNETQUEUE:
-            compiler->output << "queue "  << portNum << " ";
-            break;
-        default:
-            compiler->output << "divert " << portNum << " ";
-            break;
-        }
-    }
 }
 
 /*