still a WIP

In D45056#1058221, @david_crossfamilyweb.com wrote:

How should I submit this to you for the path; I have never used git format-patch before; I tried doing git format-patch main and it generated 21 files (since I have 21 commits). Manpage suggests I email this to you? But it seems rude to just blast you with 21 patches; and I don't know your email.

In D46069#1050289, @fuz wrote:

Wouldn't it be much simpler to just keep a pointer to the domain part around rather than moving it to the beginning of the domain array?

I kind of feel that '--no-follow' is the more common name, but not that fussed.

ZFS bits look good to me

The warning has been there long enough, and an error is better than doing the wrong thing, it has far fewer side effects.

In D45537#1039434, @delphij wrote:

The most important change was to add support of TLS, which is #ifdef'ed out and the rest of change is not quite worth the effort IMHO.

It would be nice to have something that implements libtls APi, e.g. libretls first.

Fix usage() alignment

Looks good, just the SPDX and the date need fixing.

Are you sure it is safe to drop the __weak_reference() bits at the bottom? They relate to the fact that there are conflicts between libmd and libcrypt (not to be confused with libcrypto)

That was committed as https://reviews.freebsd.org/D42526 / 80044c785cb040a2cf73779d23f9e1e81a00c6c3

In D45317#1034152, @dvl wrote:

After reading that, I did some testing:

• root:wheel yes, it stops logging after HUP.

• snmpd:snmpd logging contines after HUP.

approved by: allanjude (mentor)

Update commit message as suggested by jrtc27

In D44488#1031012, @markj wrote:

I've spent some time looking into the underlying problem, and I'm not sure that this approach (quietly rewriting the src port) is correct. The pf.conf manual page says:

In addition to modifying the address, some translation rules may modify
source or destination ports for tcp(4) or udp(4) connections; implicitly
in the case of nat rules and explicitly in the case of rdr rules.  Port
numbers are never translated with a binat rule.

but with this change we are implicitly rewriting the source port. What explicit mechanism is the man page alluding to here?

I agree with karels@'s suggestion re: commit message

About time the FreeBSD 4.x perl compat bits went away, especially since they were not actually providing compatibility.

In D44488#1014674, @vegeta_tuxpowered.net wrote:

What real-life situation is this fix for? If this is for connections coming from behind a 3rd party SNAT, where SNAT reuses source ports faster than pf expires states, then maybe tuning pf timeouts would be enough. Or we could allow pf states to transition from TCPS_FIN_WAIT_2 back to TCPS_SYN_SENT, basically implementing SO_REUSEPORT for pf.

reviewed-by: allanjude

reviewed-by: allanjude

reviewed-by: allanjude

reviewed-by: allanjude

Address feedback

Add test case

Reviewed-by: allanjude

The world is nothing if not consistency inconsistent.

good catch