Re: pfctl: defuse `-F all -i ...'

2019-01-06 Thread Alexandr Nedvedicky
Hello, > mcbride introduced this code with r1.298 in 2010 but used > > if (*ifaceopt) { > > only to have stsp fix a segfault in r1.299 by changing it to the current > form. > > One might as well assume that my proposed condition was the originally > intended behaviour after all and

Re: pfctl: defuse `-F all -i ...'

2019-01-05 Thread Klemens Nanni
On Sat, Jan 05, 2019 at 08:04:07PM +0100, Klemens Nanni wrote: > Diff below bails out immediately when `-i ...' is passed Just that now. Ignore the option argument if the option was passed since that already fulfills our error condition of passing `-i ...' with `-F all'. `ifaceopt' is global and

Re: pfctl: defuse `-F all -i ...', catch empty argument values

2019-01-05 Thread Klemens Nanni
On Sat, Jan 05, 2019 at 12:07:59PM -0700, Theo de Raadt wrote: > + if (!*optarg) > > I despise this idiom. You are checking for a zero-length string. > But you are hiding what is going on. Because the value is used in many places. Some check for nullity, some check for

pfctl: defuse `-F all -i ...', catch empty argument values

2019-01-05 Thread Klemens Nanni
Limiting the "flush all" operation to a specific interface does not make sense, and the intention was clear as well: pfctl.c revision 1.298 date: 2010/06/28 23:21:41; author: mcbride; state: Exp; lines: +27 -11; Clean up iterface stats handling: - 'make -Fi'