diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2025-10-06 09:45:59 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2025-10-06 21:35:29 +0000 |
| commit | 8fecb09bc58ea39833b57c88637036124d71e0ce (patch) | |
| tree | afc865745585bc0ea308ce0a03b0396a7741cc9c | |
| parent | c943e6ff9ab0ce823e8ac51a6a17789a1945925f (diff) | |
pfctl: store correct ticket type
When loading a new rule only persist the ticket if we're actually looking at a
filter rule. We need that ticket type later if we have to create tables, but we
need the ticket for the correct ruleset.
Fixes: 9dfc5e03da50 ("pfctl: allow tables to be defined inside anchors")
Reported by: Florian Smeets <flo@smeets.xyz>
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")
| -rw-r--r-- | sbin/pfctl/pfctl.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 21562fa03e0d..998148f5e75f 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -2183,6 +2183,7 @@ pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth) { u_int8_t rs_num = pf_get_ruleset_number(r->action); char *name; + uint32_t ticket; char anchor[PF_ANCHOR_NAME_SIZE]; int len = strlen(path); int error; @@ -2192,7 +2193,9 @@ pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth) if ((pf->opts & PF_OPT_NOACTION) == 0) { if (pf->trans == NULL) errx(1, "pfctl_load_rule: no transaction"); - pf->anchor->ruleset.tticket = pfctl_get_ticket(pf->trans, rs_num, path); + ticket = pfctl_get_ticket(pf->trans, rs_num, path); + if (rs_num == PF_RULESET_FILTER) + pf->anchor->ruleset.tticket = ticket; } if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor)) errx(1, "pfctl_load_rule: strlcpy"); @@ -2225,7 +2228,7 @@ pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth) return (1); if (pfctl_add_pool(pf, &r->route, PF_RT)) return (1); - error = pfctl_add_rule_h(pf->h, r, anchor, name, pf->anchor->ruleset.tticket, + error = pfctl_add_rule_h(pf->h, r, anchor, name, ticket, pf->paddr.ticket); switch (error) { case 0: |