d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: always log nat rule and do it pre-rewrite

Browse Source 
See also https://github.com/opnsense/core/issues/5005

Reviewed by:	kp
Differential Revision:	https://reviews.freebsd.org/D31504
This commit is contained in:
Franco Fichtner 2021-09-18 13:42:43 +02:00 committed by Kristof Provost
parent f902e4bb04
commit 8e496ea1df
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/netpfil/pf/pf.c
View File

@ -3629,6 +3629,11 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, int direction,
KASSERT(sk != NULL, ("%s: null sk", __func__));
KASSERT(nk != NULL, ("%s: null nk", __func__));
if (nr->log) {
PFLOG_PACKET(kif, m, af, direction, PFRES_MATCH, nr, a,
ruleset, pd, 1);
}
if (pd->ip_sum)
bip_sum = *pd->ip_sum;
@ -3857,10 +3862,10 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, int direction,
/* apply actions for last matching pass/block rule */
pf_rule_to_actions(r, &pd->act);
if (r->log || (nr != NULL && nr->log)) {
if (r->log) {
if (rewrite)
m_copyback(m, off, hdrlen, pd->hdr.any);
PFLOG_PACKET(kif, m, af, direction, reason, r->log ? r : nr, a,
PFLOG_PACKET(kif, m, af, direction, reason, r, a,
ruleset, pd, 1);
}