Consider these two rules: pass quick 'special match condition' 'do something' keep state pass quick 'more general match condition' 'do something else'
With your change, the special packets, matching both rules, would match the first rule only as long as there are free states left. After that, they would starting to match the second rule and do something else. Did I get that right? If so, that is not be the behaviour I would expect. It is against the last match (or first match with quick) semantics we normaly have. If there is a matching rule, use this one. If there is an error while creating the state, drop the packet. bluhm
