From 96944ab79acd48d8a552e6b1229fc46361e65341 Mon Sep 17 00:00:00 2001 From: "R. Christian McDonald" Date: Mon, 19 Oct 2026 14:47:05 -0400 Subject: [PATCH] pfctl: Report why a table definition failed pfctl_ina_define() returns an error number instead of setting errno, but both of its callers print errno. A table that failed to load was reported as "cannot define table t: No error: 0", or with a stale errno, both in the main ruleset (process_tabledef()) and in anchors (pfctl_load_tables()). Reviewed by: kp Fixes: 219ce3063840 ("pf: convert DIOCRINADEFINE to netlink") Sponsored by: Rubicon Communications, LLC ("Netgate") --- sbin/pfctl/parse.y | 7 ++++--- sbin/pfctl/pfctl.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 1505e566f3ba..945955059d91 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -5937,6 +5937,7 @@ process_tabledef(char *name, struct table_opts *opts, int popts) struct pfr_uktable *ukt; unsigned long maxcount; size_t s = sizeof(maxcount); + int error; bzero(&ab, sizeof(ab)); ab.pfrb_type = PFRB_ADDRS; @@ -5982,8 +5983,8 @@ process_tabledef(char *name, struct table_opts *opts, int popts) } else ukt = NULL; if (!(pf->opts & PF_OPT_NOACTION) && - pfctl_define_table(name, opts->flags, opts->init_addr, - pf->anchor->path, &ab, pf->anchor->ruleset.tticket, ukt)) { + (error = pfctl_define_table(name, opts->flags, opts->init_addr, + pf->anchor->path, &ab, pf->anchor->ruleset.tticket, ukt)) != 0) { if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s, NULL, 0) == -1) @@ -5995,7 +5996,7 @@ process_tabledef(char *name, struct table_opts *opts, int popts) name); else yyerror("cannot define table %s: %s", name, - pf_strerror(errno)); + pf_strerror(error)); goto _error; } diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 75ee6c700bbd..9ffdea03fea3 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -2476,7 +2476,7 @@ pfctl_load_tables(struct pfctl *pf, char *path, struct pfctl_anchor *a, pf->anchor->ruleset.tticket, ukt->pfrukt_init_addr ? PFR_FLAG_ADDRSTOO : 0); if (e != 0) - err(1, "%s pfctl_ina_define() %s@%s", __func__, + errc(1, e, "%s pfctl_ina_define() %s@%s", __func__, kt->pfrkt_name, kt->pfrkt_anchor); RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt); pfr_buf_clear(&ukt->pfrukt_addrs);