pf: reject table anchors with empty path components

[ojanerif_amd.com]

Summary

pfr_fix_anchor() strips leading slashes from table anchors but not
trailing or repeated ones. pf_find_or_create_kruleset() ignores those,
so a table added as "foo/bar/" lands in ruleset "foo/bar" but keeps
"foo/bar/" as its anchor. pfr_table_count() and pfr_skip_table() then
disagree, and with INVARIANTS:

# pfctl -a foo/bar/ -t t -T add 192.0.2.1
# pfctl -a foo/bar -sT
panic: pfr_get_tables: corruption detected (1)

"foo//bar" does the same once "foo" exists, and pfctl -vsT hits the
same check in pfr_get_tstats().

Loading rules into such an anchor already fails with EINVAL, since
pf_find_kruleset() doesn't find it. Reject it for tables as well.

Sponsored by: Advanced Micro Devices, Inc.
Signed-off-by: Osvaldo Janeri Filho <[e-mail]>

Test Plan

New table:anchor_slash test. It fails on main and passes with the fix.
The table, anchor and ioctl tests pass (64/64) in a bhyve guest running
GENERIC.

[kp]

I’ll try to review this in detail next week, when I’m back.

tests/sys/netpfil/pf/table.sh

633

You don’t really need to create a jail here. We already run these tests in their own vnet jail. Kyua takes care of that.

(A lot of these tests predate that feature, so they do create one.)