Page MenuHomeFreeBSD

pf: always log nat rule and do it pre-rewrite
ClosedPublic

Authored by franco_opnsense.org on Aug 11 2021, 8:24 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Mar 14, 8:58 AM
Unknown Object (File)
Thu, Mar 7, 7:52 PM
Unknown Object (File)
Feb 11 2024, 4:30 PM
Unknown Object (File)
Feb 8 2024, 10:12 PM
Unknown Object (File)
Jan 23 2024, 11:37 PM
Unknown Object (File)
Jan 12 2024, 12:00 AM
Unknown Object (File)
Dec 31 2023, 6:05 PM
Unknown Object (File)
Dec 22 2023, 10:37 PM

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

Thanks for posting this here.

I've not lost track of this patch, but I've yet to find the time to dig into it in detail. It's still very much on my todo list.

sys/netpfil/pf/pf.c
3635

Why are we adding a match count here? Do we want to count each NAT-ed packet twice in the match counter?

sys/netpfil/pf/pf.c
3635

Well, it's needed in the "rdr pass" case at least. I see your point about double-accounting. The code was copied to retain integrity, though REASON_SET is a strange macro with an intended side effect not making this easy. Let me try to propose a different approach.

But to be fair both rules are matching accounting-wise unless we assume that only "pass" can account for "match".

void REASON_SET by directly passing PFRES_MATCH

Not sure about omitting the match on a NAT rule, but doing it inside the log code was definitely wrong.

(Not forgotten to this, but busy with eurobsd for the next few days)

This revision was not accepted when it landed; it landed in state Needs Review.Sep 18 2021, 1:51 PM
This revision was automatically updated to reflect the committed changes.