diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2025-08-27 16:13:50 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2025-09-25 12:41:09 +0000 |
| commit | 59f3838b0a942b44397063ffb63a4e4d569129f1 (patch) | |
| tree | 8756151b30039a56dc209c18f3cc3fe964e6c7b7 | |
| parent | b9d652bb75ffa0945a3bebf68d6d82de26efd269 (diff) | |
pfctl: reduce duplicate code
* Merge `once' handling from `anchorrule' and `pfrule'
* Remove/shorten duplicate code block
OK sashan
Obtained from: OpenBSD, kn <kn@openbsd.org>, d114b77333
Sponsored by: Rubicon Communications, LLC ("Netgate")
| -rw-r--r-- | sbin/pfctl/parse.y | 23 |
1 files changed, 8 insertions, 15 deletions
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index c8c6f6047fa5..c75632c740b3 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -1061,12 +1061,6 @@ anchorrule : ANCHOR anchorname dir quick interface af proto fromto } } - if ($9.marker & FOM_ONCE) { - yyerror("cannot specify 'once' " - "on anchors"); - YYERROR; - } - if (filteropts_to_rule(&r, &$9)) YYERROR; @@ -2396,15 +2390,6 @@ pfrule : action dir logquick interface route af proto fromto r.quick = $3.quick; r.af = $6; - if ($9.marker & FOM_ONCE) { - if (r.action == PF_MATCH) { - yyerror("can't specify once for " - "match rules"); - YYERROR; - } - r.rule_flag |= PFRULE_ONCE; - } - if (filteropts_to_rule(&r, &$9)) YYERROR; @@ -7757,6 +7742,14 @@ node_mac_from_string_mask(const char *str, const char *mask) int filteropts_to_rule(struct pfctl_rule *r, struct filter_opts *opts) { + if (opts->marker & FOM_ONCE) { + if (r->action != PF_PASS && r->action != PF_MATCH) { + yyerror("'once' only applies to pass/block rules"); + return (1); + } + r->rule_flag |= PFRULE_ONCE; + } + r->keep_state = opts->keep.action; r->pktrate.limit = opts->pktrate.limit; r->pktrate.seconds = opts->pktrate.seconds; |