From owner-freebsd-pf@FreeBSD.ORG Fri Mar 25 22:30:14 2011 Return-Path: Delivered-To: freebsd-pf@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D9DD5106566B for ; Fri, 25 Mar 2011 22:30:14 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id C91DF8FC08 for ; Fri, 25 Mar 2011 22:30:14 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p2PMUEu8006108 for ; Fri, 25 Mar 2011 22:30:14 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p2PMUEJM006105; Fri, 25 Mar 2011 22:30:14 GMT (envelope-from gnats) Date: Fri, 25 Mar 2011 22:30:14 GMT Message-Id: <201103252230.p2PMUEJM006105@freefall.freebsd.org> To: freebsd-pf@FreeBSD.org From: =?UTF-8?Q?Marcin_Wi=C5=9Bnicki?= Cc: Subject: Re: kern/148260: [pf] [patch] pf rdr incompatible with dummynet X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: =?UTF-8?Q?Marcin_Wi=C5=9Bnicki?= List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Mar 2011 22:30:14 -0000 The following reply was made to PR kern/148260; it has been noted by GNATS. From: =?UTF-8?Q?Marcin_Wi=C5=9Bnicki?= To: bug-followup , adg Cc: Subject: Re: kern/148260: [pf] [patch] pf rdr incompatible with dummynet Date: Fri, 25 Mar 2011 22:52:22 +0100 How about a more generic solution: Add new mbuf tag PACKET_TAG_PFIL_RESUME_FROM that contains address of a function registered with pfil_add_hook (ipfw_check_hook in this case) and modify pfil_run_hooks() to skip all hooks until that one (if such tag is present). Before reinjecting packet into ip_output by dummynet, prepend this m_tag to mbuf (also strip that tag if it ever comes back?). I don't know if mbuf api allows it but such tag could theoretically have just one instance (created on dummynet module load) to avoid allocation costs. This way you don't have to put ugly workaround in every pfil consumer.