summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorStuart Henderson <sthen@cvs.openbsd.org>2011-06-02 22:03:31 +0000
committerStuart Henderson <sthen@cvs.openbsd.org>2011-06-02 22:03:31 +0000
commit782a7300cedfa5b9fbe695306bf6e9733e9ff3bb (patch)
tree35e75f76f3a9fabe9d41ddb50aa33baf5139a8c5 /sys
parent2840a6297c747616b60e4a0895382a75e02fa40e (diff)
Don't destroy a non-persistent table if referenced by src_nodes. Fixes
a crash if max-src-* options are triggered both before and after a ruleset reload, when the rules are overloading to a non-persistent table. Discovered by and fix from Martin Pelikan.
Diffstat (limited to 'sys')
-rw-r--r--sys/net/pf_ioctl.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/net/pf_ioctl.c b/sys/net/pf_ioctl.c
index effc6b586c4..4b1d4f3b9ca 100644
--- a/sys/net/pf_ioctl.c
+++ b/sys/net/pf_ioctl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pf_ioctl.c,v 1.239 2011/04/19 21:58:03 chl Exp $ */
+/* $OpenBSD: pf_ioctl.c,v 1.240 2011/06/02 22:03:30 sthen Exp $ */
/*
* Copyright (c) 2001 Daniel Hartmeier
@@ -263,7 +263,7 @@ void
pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
{
if (rulequeue != NULL) {
- if (rule->states_cur <= 0) {
+ if (rule->states_cur <= 0 && rule->src_nodes <= 0) {
/*
* XXX - we need to remove the table *before* detaching
* the rule to make sure the table code does not delete