git: d3b73a944b11 - main - pfctl: deny "once" flags for match rules

[Kristof Provost]

The branch main has been updated by kp:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=d3b73a944b11311b8428f30b019802ebe7aeaef8

commit d3b73a944b11311b8428f30b019802ebe7aeaef8
Author:     Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-08-27 14:00:38 +0000
Commit:     Kristof Provost <k...@freebsd.org>
CommitDate: 2025-09-25 12:41:08 +0000

    pfctl: deny "once" flags for match rules
    
    ok henning
    
    Obtained from:  OpenBSD, mikeb <mi...@openbsd.org>, 47068a62ee
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sbin/pfctl/parse.y | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index c35460f5443d..c8c6f6047fa5 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -2396,8 +2396,14 @@ pfrule           : action dir logquick interface route 
af proto fromto
                        r.quick = $3.quick;
                        r.af = $6;
 
-                       if ($9.marker & FOM_ONCE)
+                       if ($9.marker & FOM_ONCE) {
+                               if (r.action == PF_MATCH) {
+                                       yyerror("can't specify once for "
+                                           "match rules");
+                                       YYERROR;
+                               }
                                r.rule_flag |= PFRULE_ONCE;
+                       }
 
                        if (filteropts_to_rule(&r, &$9))
                                YYERROR;