CVSROOT: /cvs
Module name: src
Changes by: henn...@cvs.openbsd.org 2010/09/21 04:43:41
Modified files:
sys/net : pf.c
Log message:
after ruleset eval is done, we must apply actions from the last matching
pass or block rule, not the last matching rule. triggered by pr6401.
this means that, for example, a rdr-to on a pass rule can override an
rdr-to on a match rule that comes later in the ruleset. but that's the
semantics: for block and pass rules, the last matching one wins, aka
actions are applied after we're done with ruleset eval, and match rules'
actions are applied on the fly. discussion with dlg and claudio, ok dlg ryan
