pf: always log nat rule and do it pre-rewrite

[franco_opnsense.org]

Summary

PR: https://github.com/opnsense/core/issues/5005

[kp]

Thanks for posting this here.

I've not lost track of this patch, but I've yet to find the time to dig into it in detail. It's still very much on my todo list.

[kp]

sys/netpfil/pf/pf.c

3569

Why are we adding a match count here? Do we want to count each NAT-ed packet twice in the match counter?

[franco_opnsense.org]

sys/netpfil/pf/pf.c

3569

Well, it's needed in the "rdr pass" case at least. I see your point about double-accounting. The code was copied to retain integrity, though REASON_SET is a strange macro with an intended side effect not making this easy. Let me try to propose a different approach.

[franco_opnsense.org]

But to be fair both rules are matching accounting-wise unless we assume that only "pass" can account for "match".

[franco_opnsense.org]

void REASON_SET by directly passing PFRES_MATCH

[franco_opnsense.org]

Not sure about omitting the match on a NAT rule, but doing it inside the log code was definitely wrong.

[kp]

(Not forgotten to this, but busy with eurobsd for the next few days)