git: 5b8ab97b3e4a - stable/15 - pfctl: parser must not ignore error from pfctl_optimize_ruleset()

The branch stable/15 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=5b8ab97b3e4abd3df9cee11d61115479fe2fc4de

commit 5b8ab97b3e4abd3df9cee11d61115479fe2fc4de
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-03-22 02:50:47 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-03-30 15:07:22 +0000

    pfctl: parser must not ignore error from pfctl_optimize_ruleset()
    
    Ignoring the error may cause pfctl(8) to load inconsistent ruleset
    preventing pf(4) to enforce desired policy.
    
    Issue reported and fix suggested by berts _from_ fastmail _dot_ com
    
    'Looks good.' @deraadt
    
    MFC after:      1 week
    Obtained from:  OpenBSD, sashan <sashan@openbsd.org>, 9fd28a8cca
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    
    (cherry picked from commit 343ace42f82a629374af4dc3a72da5f46f2c3feb)
---
 sbin/pfctl/pfctl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index 7865467f2ea8..1b0a342337e7 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -2095,8 +2095,9 @@ pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
 			printf("\n");
 	}
 
-	if (pf->optimize && rs_num == PF_RULESET_FILTER)
-		pfctl_optimize_ruleset(pf, rs);
+	if (pf->optimize && rs_num == PF_RULESET_FILTER &&
+	    (error = pfctl_optimize_ruleset(pf, rs)) != 0)
+		goto error;
 
 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);