Bug in pfioctl.c

[Jon Coller <jon@coller.org>]

While working on a project which needs to insert arbitrary states into 
the state table, I discovered a bug in the combinations of 
pfioctl/pf_state_expires. If pfioctl is used to insert a state (via 
DIOCADDSTATE), the rule pointer is NULL'd before the call to 
pf_insert_state():

/usr/src/sys/net/pf_ioctl.c line 1362:
	state->rule.ptr = NULL;

Then when the state expiry code is called the rule pointer is 
dereferenced, resulting in a crash:

/usr/src/sys/net/pf.c line 711:
	timeout = state->rule.ptr->timeout[state->timeout];

My quick fix was the following change:
/usr/src/sys/net/pf_ioctl.c line 1362:
-	state->rule.ptr = NULL;
+	state->rule.ptr = &pf_default_rule;
While this is not ideal, it works :)

I did a quick grep through the source tree and it doesn't look like 
anyone else is using this ioctl, so it looks like I'm the only one 
affected :)

Thanks,

Jon Coller