pf: Re-optimize state key handlingHEADmain

pf states may be looked up using one of two keys: the stack key or the
wire key.  For states involving address translation, these will be
distinct; the stack key describes the addresses seen by the local
network stack, and the wire key has the translated addresses.

Historically, pf would avoid allocating separate keys if both are
identical.  This changed in commit fcdb520c1b4e ("pf: nat64") to always
allocate separate state key structures.  Incidentally, OpenBSD seems to
maintain the optimization, but also has an explicit reference count
embedded in state keys.

The change breaks another optimization: pf_state_key_attach() still uses
state key pointer equality to check whether the stack and wire keys are
equal, so those checks are always false after the aforementioned commit.
Thus we never skip the second key lookup, even when that's possible
(i.e., no address translation is involved).

So, for some rulesets we're consuming more memory than needed and
performing more state key lookups than needed.  The behaviour of always
looking up the stack key also happens to break some existing rulesets
involving RDR and divert-to, which is how I noticed the problem.  I
think those rulesets effectively worked by accident before, but it seems
worth restoring the optimization regardless.

Reviewed by:	kp
MFC after:	2 weeks
Fixes:		fcdb520c1b4e ("pf: nat64")
Sponsored by:	OPNsense
Sponsored by:	Klara, Inc.
Differential Revision:	https://reviews.freebsd.org/D58922

0 files changed, 0 insertions, 0 deletions