Page MenuHomeFreeBSD

pf: Log the intended action when a NAT rule matches a packet
ClosedPublic

Authored by markj on Feb 10 2025, 3:53 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Oct 10, 12:01 AM
Unknown Object (File)
Sun, Oct 5, 10:42 AM
Unknown Object (File)
Sep 15 2025, 6:33 PM
Unknown Object (File)
Sep 15 2025, 8:20 AM
Unknown Object (File)
Sep 14 2025, 8:21 PM
Unknown Object (File)
Sep 10 2025, 9:53 PM
Unknown Object (File)
Sep 9 2025, 6:22 PM
Unknown Object (File)
Sep 6 2025, 3:55 PM

Details

Summary

When a packet matches a binat/nat/rdr rule, pf logs the match. The log
metadata includes the rule's action on the packet, e.g., PF_PASS. NAT
rules have their own actions: PF_BINAT, PF_NAT, PF_RDR.

Before commit 948e8413aba0 ("pflog: pass the action to pflog directly"),
pflog_packet() would obtain the action from the rule definition, whereas
after that commit the action is passed as a parameter. When a NAT rule
matches, we want to log the rule action, but after that commit, PF_PASS
is hard-coded. Restore the previous behaviour.

Add a regression test which installs a redirect, logs packets matching
the redirect rule, and verifies that the corresponding pflog entry
includes the correct action.

Fixes: 948e8413aba0 ("pflog: pass the action to pflog directly")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable