Hi,

This is a second diff and it makes sure that pf_step_into_anchor always
saves a pointer to the rule that owns the anchor on the pf anchor stack.
There's no reason why we should check for depth here.  As a side effect
this makes sure that the correct nested anchor gets it's counter bumped
instead of the top most.

For the save/restore symmetry pf_step_out_of_anchor is made to always
restore previous value of the anchor rule.  depth == 0 means what we a
at the top (main ruleset).

OK?

diff --git sys/net/pf.c sys/net/pf.c
index 9832e47..8708417 100644
--- sys/net/pf.c
+++ sys/net/pf.c
@@ -2666,11 +2666,11 @@ pf_step_into_anchor(int *depth, struct pf_ruleset **rs,
        if (*depth >= sizeof(pf_anchor_stack) /
            sizeof(pf_anchor_stack[0])) {
                log(LOG_ERR, "pf_step_into_anchor: stack overflow\n");
                *r = TAILQ_NEXT(*r, entries);
                return;
-       } else if (*depth == 0 && a != NULL)
+       } else if (a != NULL)
                *a = *r;
        f = pf_anchor_stack + (*depth)++;
        f->rs = *rs;
        f->r = *r;
        if ((*r)->anchor_wildcard) {
@@ -2711,10 +2711,12 @@ pf_step_out_of_anchor(int *depth, struct pf_ruleset 
**rs,
                        }
                }
                (*depth)--;
                if (*depth == 0 && a != NULL)
                        *a = NULL;
+               else if (a != NULL)
+                       *a = f->r;
                *rs = f->rs;
                if (*match > *depth) {
                        *match = *depth;
                        if (f->r->quick)
                                quick = 1;

Reply via email to