misc/90386: pfctl -s labels don't count bytes if labeled rule was NATted

[Denis Grinchuk]

>Number:         90386
>Category:       misc
>Synopsis:       pfctl -s labels don't count bytes if labeled rule was NATted
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Dec 14 12:50:02 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Denis Grinchuk
>Release:        5.4
>Organization:
-
>Environment:
FreeBSD free54.newintech.com. 5.4-RELEASE FreeBSD 5.4-RELEASE #0: Mon Nov  7 15:41:11 MSK 2005     root at free53.newintech.com.:/usr/src/sys/i386/compile/mykernel2  i386          
>Description:
My machine is firewall and proxy-server. I need to count forwarding traffic from Internet (inbound only). Firewall - pf with nat (I have one real IP).Counter based on pf labels. NAT working on extenal interface like this (I simplify):

nat on $ext_if from $INT_NET to any -> $EXT_IP
pass out on $ext_if from $EXT_IP to any
pass in on $ext_if from any to $EXT_IP label "$dstaddr:external"
pass in on $int_if from $INT_NET to !<private>
pass out on $int_if from !<private> to $INT_NET label "$dstaddr:internal"

Counters at internal interface working well, but external show zero bytes:
#pfctl -s labels
192.168.0.0/24:internal 111  10   10000
1.2.3.4:extenal 111   0   0
I.e. hits was, but bytes wasn't counted for nat'ted backward packets.

Sorry for my English. Thank you for FreeBSD!
>How-To-Repeat:
              
>Fix:
              
>Release-Note:
>Audit-Trail:
>Unformatted: