pfctl: parser must not ignore error from pfctl_optimize_ruleset()

Ignoring the error may cause pfctl(8) to load inconsistent ruleset
preventing pf(4) to enforce desired policy.

Issue reported and fix suggested by berts _from_ fastmail _dot_ com

'Looks good.' @deraadt

MFC after:	1 week
Obtained from:	OpenBSD, sashan <sashan@openbsd.org>, 9fd28a8cca
Sponsored by:	Rubicon Communications, LLC ("Netgate")

This commit is contained in:

Kristof Provost

2026-03-22 03:50:47 +01:00

parent 0b0d34fd2f

commit 343ace42f8

1 changed files with 3 additions and 2 deletions

									
										sbin/pfctl/pfctl.c
									
		+3
		-2
	
												View File
												
				@@ -2513,8 +2513,9 @@ pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,

							printf("\n");

					}

					if (pf->optimize && rs_num == PF_RULESET_FILTER)

						pfctl_optimize_ruleset(pf, rs);

					if (pf->optimize && rs_num == PF_RULESET_FILTER &&

					    (error = pfctl_optimize_ruleset(pf, rs)) != 0)

						goto error;

					while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {

						TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);