Move the validation checks to pf_rule_to_krule() to reduce duplication.
This also makes the checks consistent across different ioctls.
MFC after: 1 week
Details
Details
Diff Detail
Diff Detail
- Repository
- rS FreeBSD src repository - subversion
- Lint
Lint Passed - Unit
No Test Coverage - Build Status
Buildable 36518 Build 33407: arc lint + arc unit
Event Timeline
| sys/netpfil/pf/pf_ioctl.c | ||
|---|---|---|
| 1564–1574 | I'd reverse this logic. #ifdef INET
if (rule->af == AF_INET) ;
else
#endif
#ifdef INET6
if (rule->af == AF_INET6) ;
else
#endif
return (EAFNOSUPPORT);So each family only tests it's own positive case. And all other families fail automatically. | |
| sys/netpfil/pf/pf_ioctl.c | ||
|---|---|---|
| 1564–1574 | Even more clever approach switch (rule->af) {
#ifdef INET
case AF_INET: break;
#endif
#ifdef INET6
case AF_INET6: break;
#endif
default: return (EAFNOSUPPORT);
} | |
| sys/netpfil/pf/pf_ioctl.c | ||
|---|---|---|
| 1564–1574 | I like the suggestion, but it turns out not to work. We don't always specify an address family (i.e. rule->af can be 0) | |