git: b39a387442db - releng/15.0 - libpfctl: Fix displaying deeply nested anchors

The branch releng/15.0 has been updated by cperciva:

URL: https://cgit.FreeBSD.org/src/commit/?id=b39a387442db422ff3e962a440cf7dc7ec277df3

commit b39a387442db422ff3e962a440cf7dc7ec277df3
Author:     Jose Luis Duran <jlduran@FreeBSD.org>
AuthorDate: 2025-10-25 09:19:18 +0000
Commit:     Colin Percival <cperciva@FreeBSD.org>
CommitDate: 2025-10-30 04:36:20 +0000

    libpfctl: Fix displaying deeply nested anchors
    
    Set the number of rulesets (i.e., anchors) directly attached to the
    anchor and its path in pfctl_get_ruleset().
    
    While here, add a test to document this behavior.
    
    Approved by:    re (cperciva)
    PR:             290478
    Reviewed by:    kp
    Fixes:          041ce1d690f1 ("pfctl: recursively flush rules and tables")
    MFC after:      2 days
    Differential Revision:  https://reviews.freebsd.org/D53358
    
    (cherry picked from commit a943a96a50ba7e9d1e1935bdd18df0e11d158acb)
    (cherry picked from commit 1c8a554f757de06f64e6fd0d86fc674a215ee314)
---
 lib/libpfctl/libpfctl.c        |  3 +++
 tests/sys/netpfil/pf/anchor.sh | 46 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)

diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 190ee46baf21..fbf9796d9887 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -3194,6 +3194,9 @@ pfctl_get_ruleset(struct pfctl_handle *h, const char *path, uint32_t nr, struct
 			continue;
 	}
 
+	rs->nr = nr;
+	strlcpy(rs->path, path, sizeof(rs->path));
+
 	return (e.error);
 }
 
diff --git a/tests/sys/netpfil/pf/anchor.sh b/tests/sys/netpfil/pf/anchor.sh
index 64ca84b34c3d..034fe0d3d574 100644
--- a/tests/sys/netpfil/pf/anchor.sh
+++ b/tests/sys/netpfil/pf/anchor.sh
@@ -123,6 +123,51 @@ nested_anchor_cleanup()
 	pft_cleanup
 }
 
+atf_test_case "deeply_nested" "cleanup"
+deeply_nested_head()
+{
+	atf_set descr 'Test setting and retrieving deeply nested anchors'
+	atf_set require.user root
+}
+
+deeply_nested_body()
+{
+	pft_init
+
+	epair=$(vnet_mkepair)
+	vnet_mkjail alcatraz ${epair}a
+
+	pft_set_rules alcatraz \
+		"anchor \"foo\" { \n\
+			anchor \"bar\" { \n\
+				anchor \"foobar\" { \n\
+					pass on ${epair}a \n\
+				} \n\
+				anchor \"quux\" { \n\
+					pass on ${epair}a \n\
+				} \n\
+			} \n\
+			anchor \"baz\" { \n\
+				pass on ${epair}a \n\
+			} \n\
+			anchor \"qux\" { \n\
+				pass on ${epair}a \n\
+			} \n\
+		}"
+
+	atf_check -s exit:0 -o \
+	    inline:"  foo\n  foo/bar\n  foo/bar/foobar\n  foo/bar/quux\n  foo/baz\n  foo/qux\n" \
+	    -e ignore jexec alcatraz pfctl -sA
+
+	atf_check -s exit:0 -o inline:"  foo/bar/foobar\n  foo/bar/quux\n" \
+	    -e ignore jexec alcatraz pfctl -a foo/bar -sA
+}
+
+deeply_nested_cleanup()
+{
+	pft_cleanup
+}
+
 atf_test_case "wildcard" "cleanup"
 wildcard_head()
 {
@@ -498,6 +543,7 @@ atf_init_test_cases()
 	atf_add_test_case "pr183198"
 	atf_add_test_case "pr279225"
 	atf_add_test_case "nested_anchor"
+	atf_add_test_case "deeply_nested"
 	atf_add_test_case "wildcard"
 	atf_add_test_case "nested_label"
 	atf_add_test_case "quick"