PF with subanchors possible bug

[Daniel Hartmeier]

On Fri, Apr 28, 2006 at 12:42:13PM +0400, Boris Polevoy wrote:

> Is it bug or not?

Yes, it looks like a bug. Or, more than one, actually.

I assume what you expect the sequence to do is the same as

  # echo 'anchor "external"' | pfctl -f -
  # echo 'anchor "internal"' | pfctl -a external -f -
  # echo 'pass all' | pfctl -a external/internal -f -

(leaving out the table, which isn't really relevant, I think)

i.e. you expect "internal" to be nested within "external", like

  # pfctl -vsA
  external
  external/internal

  # pfctl -sr
  anchor "external" all

  # pfctl -a external -sr
  anchor "internal" all

  # pfctl -a external/internal -sr
  pass all

Your patch fixes that. But there is another one, when doing
"pfctl -a external -f", it doesn't prefix the (relative!) paths
within the input with the anchor specified through -a.

Therefore, when I do the same (it should be the same, IMO) with files,
like

  # cat x
  anchor "external"
  load anchor "external" from "y"

  # cat y
  anchor "internal"
  load anchor "internal" from "z"

  # cat z
  pass z

  # pfctl -f x

  # pfctl -vsA
  external
  external/internal
  internal

  # pfctl -a external/internal -sr
  [ empty ]

  # pfctl -a internal -sr
  pass all

the rule loaded from z is not placed into the right anchor
(external/internal), but a second anchor (internal) is created for it.

I'll have to find the right place to fix THAT, too.

Daniel