Page MenuHomeFreeBSD

pf: always log nat rule and do it pre-rewrite
ClosedPublic

Authored by franco_opnsense.org on Aug 11 2021, 8:24 AM.

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

Thanks for posting this here.

I've not lost track of this patch, but I've yet to find the time to dig into it in detail. It's still very much on my todo list.

sys/netpfil/pf/pf.c
3634

Why are we adding a match count here? Do we want to count each NAT-ed packet twice in the match counter?

sys/netpfil/pf/pf.c
3634

Well, it's needed in the "rdr pass" case at least. I see your point about double-accounting. The code was copied to retain integrity, though REASON_SET is a strange macro with an intended side effect not making this easy. Let me try to propose a different approach.

But to be fair both rules are matching accounting-wise unless we assume that only "pass" can account for "match".

void REASON_SET by directly passing PFRES_MATCH

Not sure about omitting the match on a NAT rule, but doing it inside the log code was definitely wrong.

(Not forgotten to this, but busy with eurobsd for the next few days)

This revision was not accepted when it landed; it landed in state Needs Review.Sep 18 2021, 1:51 PM
This revision was automatically updated to reflect the committed changes.