From nobody Thu Jun 26 13:11:41 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bSfGP48vRz60XgM; Thu, 26 Jun 2025 13:11:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bSfGP3RtZz3J4T; Thu, 26 Jun 2025 13:11:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1750943501; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0Gguj+2hHDtz86Io93xyF6D6IdFe3d/P2pEnSq73U6g=; b=xXLe4Z5Oa5HqNzDClgcCgArsZk/RJepagJJjoHM/n4HHtmafhpWbCJRMgJ4G8xQ069Adjg 7ESHZOD9GVX9j5zP+IY+k2fY9ENADPoW8ZtsZiU2TM6N2oj55f61Ocu2P1n/STgfART5Sc ZMeQqGJicVr6Ce9FgPjW493L3VA7xSPWX6AduiHo228NDKl36o2JfWPbtqrKE73J1jxvra FdX2zNXaIKo1dIMeuo0B+A15vZrO5tIgzdASDOlpDTiZR8GRFbXT8gdBus3ihxQ/X56vw0 6xtoI/wJhCkiwRIMHQwLZT8cNbq5AEBfUfrLMnh4w6jwnOrTqFV0ZlAxSUiyyw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1750943501; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0Gguj+2hHDtz86Io93xyF6D6IdFe3d/P2pEnSq73U6g=; b=E2KMw40AlH0jyxJ1psc4CrH0+WDE8bzsZblFg4roi9/DWthDd3KqR5EKlvCCYugW2KUtF/ dmy7xWEPdd0ECZm4//TqLkJmtw4S3gTppFsE/5Q0dIQ0njjsFpTuvsd0jGSG2ImFqOGw8b AjzGxFGUDkbUldYQ8CV9j/wPcDXGbEG4lzQDYu0TFaa81OUUWU1a4+mZs5WCHmysABQE+k m6F/6GI6nD/r3ebmgYwMBPtn6yDqGhB3jLcLGPdd/UD6DNFzHVQLtdEVmdVysyOZn1X4RW epBHPQONhqQA8kegoYKyHMZCsjJd6hYkuAjX4ccogHMyF2TJXhFyrOaTGS8IlQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1750943501; a=rsa-sha256; cv=none; b=CvxNQMRzcguo6b5WCuqiWeMvW3AarTm4TlpA45A5FqltreOPjXxvaPxBYqJHI+4PhNE6s9 P8oZHmpKkQcAuxho9LE9xzMHYGCfOf9KI2n6zHFNkHxBDkRHW06wYtDau0eO60fWCjrkQ9 czbMZEHLvumATBAyyUNiPTozIvhYZ03FSPqcDQCaP1TIR2epJVWFucnQCt5A4eaBnmV+e1 jboJ1B840ZvD4Rf8cqxTlGWL/gv8pzakhOkA+wCOQ8H7kcakpQ1jyP71kBEyusnGTS9ei1 Y+BfTerc0bzd3U3GQ2BRzbBkO85YsXv8jwEg15/dmIE5xfLt5tbyEO5vcA2sZw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bSfGP319Vz14CM; Thu, 26 Jun 2025 13:11:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 55QDBfKi022465; Thu, 26 Jun 2025 13:11:41 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 55QDBfZ4022462; Thu, 26 Jun 2025 13:11:41 GMT (envelope-from git) Date: Thu, 26 Jun 2025 13:11:41 GMT Message-Id: <202506261311.55QDBfZ4022462@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 230ae7a67665 - main - pfctl: fails to handle nested 'load anchor' properly List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 230ae7a67665522bada6608dc495e5ce68546b4f Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=230ae7a67665522bada6608dc495e5ce68546b4f commit 230ae7a67665522bada6608dc495e5ce68546b4f Author: Kristof Provost AuthorDate: 2025-06-18 13:24:28 +0000 Commit: Kristof Provost CommitDate: 2025-06-26 13:11:00 +0000 pfctl: fails to handle nested 'load anchor' properly [ + yet another 'anchor name vs. path mix up in load anchor (parse.y) ] OK bluhm@ Obtained from: OpenBSD, sashan , ab40201610 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sbin/pfctl/parse.y | 4 ++-- sbin/pfctl/pfctl.c | 14 +++++++------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 0af53e2692d7..1bd8e2bb55ad 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -1205,7 +1205,7 @@ anchorrule : ANCHOR anchorname dir quick interface af proto fromto loadrule : LOAD ANCHOR string FROM string { struct loadanchors *loadanchor; - if (strlen(pf->anchor->name) + 1 + + if (strlen(pf->anchor->path) + 1 + strlen($3) >= MAXPATHLEN) { yyerror("anchorname %s too long, max %u\n", $3, MAXPATHLEN - 1); @@ -1220,7 +1220,7 @@ loadrule : LOAD ANCHOR string FROM string { err(1, "loadrule: malloc"); if (pf->anchor->name[0]) snprintf(loadanchor->anchorname, MAXPATHLEN, - "%s/%s", pf->anchor->name, $3); + "%s/%s", pf->anchor->path, $3); else strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); if ((loadanchor->filename = strdup($5)) == NULL) diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index cd4e2ae82aae..15766eb9b704 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -2384,17 +2384,17 @@ pfctl_rules(int dev, char *filename, int opts, int optimize, if (check_commit_altq(dev, opts) != 0) ERRX("errors in altq config"); - /* process "load anchor" directives */ - if (!anchorname[0]) + if (trans == NULL) { + /* process "load anchor" directives */ if (pfctl_load_anchors(dev, &pf, t) == -1) ERRX("load anchors"); - if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) { - if (!anchorname[0]) - if (pfctl_load_options(&pf)) + if ((opts & PF_OPT_NOACTION) == 0) { + if (!anchorname[0] && pfctl_load_options(&pf)) goto _error; - if (pfctl_trans(dev, t, DIOCXCOMMIT, osize)) - ERR("DIOCXCOMMIT"); + if (pfctl_trans(dev, t, DIOCXCOMMIT, osize)) + ERR("DIOCXCOMMIT"); + } } free(path); return (0);