Page MenuHomeFreeBSD

pf: always log nat rule and do it pre-rewrite

Authored by on Aug 11 2021, 8:24 AM.

Diff Detail

R10 FreeBSD src repository
Automatic diff as part of commit; lint not applicable.
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

Thanks for posting this here.

I've not lost track of this patch, but I've yet to find the time to dig into it in detail. It's still very much on my todo list.


Why are we adding a match count here? Do we want to count each NAT-ed packet twice in the match counter?


Well, it's needed in the "rdr pass" case at least. I see your point about double-accounting. The code was copied to retain integrity, though REASON_SET is a strange macro with an intended side effect not making this easy. Let me try to propose a different approach.

But to be fair both rules are matching accounting-wise unless we assume that only "pass" can account for "match".

void REASON_SET by directly passing PFRES_MATCH

Not sure about omitting the match on a NAT rule, but doing it inside the log code was definitely wrong.

(Not forgotten to this, but busy with eurobsd for the next few days)

This revision was not accepted when it landed; it landed in state Needs Review.Sep 18 2021, 1:51 PM
This revision was automatically updated to reflect the committed changes.