PF_LOG_SOCKET_LOOKUP
| USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
| GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
if (r->log & PF_LOG_SOCKET_LOOKUP)
if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done)