Re: pf: fix dropped packet byte accounting

Hello,

My understanding is the current code for some reason deliberately uses packet
length from IP header for accounting.

if IP header can not be parsed, because it is malformed, then zero
is used for stats. IMO the current code kind of makes sense.

to be honest I don't feel strongly. either way is sort of fine.
I wonder what other people here think about it.

thanks and
regards
sashan

On Fri, Aug 28, 2026 at 11:17:22PM -0700, Nick Owens wrote:
> tot_len is initialized to zero, so packets dropped early did not
> increment dropped byte counters. fixes dropped byte accounting for a
> number of early drop paths, including corrupt ip options which is what i
> ran into and tested.
> 
> later assignments still override this and work as before.
> 
> diff --git a/sys/net/pf.c b/sys/net/pf.c
> index 130843a03a1..53c586a0acd 100644
> --- a/sys/net/pf.c
> +++ b/sys/net/pf.c
> @@ -8040,6 +8040,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
>  	pd->dir = dir;
>  	pd->kif = kif;		/* kif is NULL when called by pflog */
>  	pd->m = m;
> +	pd->tot_len = pd->m->m_pkthdr.len;
>  	pd->sidx = (dir == PF_IN) ? 0 : 1;
>  	pd->didx = (dir == PF_IN) ? 1 : 0;
>  	pd->af = pd->naf = af;
>