In the meantime I have understand I was wrong about the code snippet
> mc2 = m_dup(m, M_NOWAIT);
> if (mc2 != NULL) {
> /* Keep the layer3 header aligned */
> int i = min(mc2->m_pkthdr.len, max_protohdr);
> mc2 = m_copyup(mc2, i, ETHER_ALIGN);
> }
> if (mc2 != NULL) {
> mc2->m_pkthdr.rcvif = bifp;
> (*bifp->if_input)(bifp, mc2);
> }
My mistake concerned the function call m_copyup(): The mbuf chain is
copied correct and not shortened, I was confused because of the field
m_len in mc2. So reinjecting the packet in the bridge is ok.
Another aspect is what is done next with the broadcast/multicast packet
handled by this code:
> /* Return the original packet for local processing. */
> return (m);
Therefore local processing on the member interface is done for
broadcast/multicast packets without checking the pfil_local_phys
variable. That was confusing me because these packets are counting twice
in the pf rules. I think this is needless and pfil_local_phys should
respect all packets not only unicast.
After introducing the patch
--- if_bridge.c.iorig 2019-05-14 09:43:33.000000000 +0200
+++ if_bridge.c 2019-12-28 11:54:52.000000000 +0100
@@ -2386,6 +2386,10 @@
(*bifp->if_input)(bifp, mc2);
}
+ if (!pfil_local_phys ) {
+ m_freem(m);
+ return (NULL);
+ }
/* Return the original packet for local processing. */
return (m);
}
everything works fine and all the counters in pf have values as expected
(I use state-policy if-bound).
Andreas
_______________________________________________
freebsd-pf@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"
