The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=fed2e93b0a00b2110d25ffb13da235941a14c505
commit fed2e93b0a00b2110d25ffb13da235941a14c505
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-06-23 09:36:24 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2025-06-26 13:11:01 +0000
pf: fix regression in pflog output
pf_match_rule() must remember current anchor before descents
towards leaf. it must restore anchor as it ascents towards root.
Bug pointed out and fix also tested by Matthias Pitzl from genua.
OK bluhm@
Obtained from: OpenBSD, sashan <sas...@openbsd.org>, 73e0536f0e
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
sys/netpfil/pf/pf.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index a40e1744cbc8..6533b06c5d9d 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -4665,9 +4665,9 @@ pf_step_into_anchor(struct pf_test_ctx *ctx, struct
pf_krule *r)
rv = pf_match_rule(ctx, &child->ruleset);
if ((rv == PF_TEST_QUICK) || (rv == PF_TEST_FAIL)) {
/*
- * we either hit a rule qith quick action
+ * we either hit a rule with quick action
* (more likely), or hit some runtime
- * error (e.g. pool_get() faillure).
+ * error (e.g. pool_get() failure).
*/
break;
}
@@ -5512,6 +5512,8 @@ pf_match_rule(struct pf_test_ctx *ctx, struct pf_kruleset
*ruleset)
{
struct pf_krule_item *ri;
struct pf_krule *r;
+ struct pf_krule *save_a;
+ struct pf_kruleset *save_aruleset;
struct pf_pdesc *pd = ctx->pd;
u_short transerror;
@@ -5681,13 +5683,22 @@ pf_match_rule(struct pf_test_ctx *ctx, struct
pf_kruleset *ruleset)
break;
}
} else {
+ save_a = ctx->a;
+ save_aruleset = ctx->aruleset;
+
ctx->a = r; /* remember anchor */
ctx->aruleset = ruleset; /* and its ruleset */
if (ctx->a->quick)
ctx->test_status = PF_TEST_QUICK;
+ /*
+ * Note: we don't need to restore if we are not going
+ * to continue with ruleset evaluation.
+ */
if (pf_step_into_anchor(ctx, r) != PF_TEST_OK) {
break;
}
+ ctx->a = save_a;
+ ctx->aruleset = save_aruleset;
}
r = TAILQ_NEXT(r, entries);
}
