diff options
| author | batsumaru <> | 2026-07-01 18:22:17 +0900 |
|---|---|---|
| committer | batsumaru <> | 2026-07-01 18:22:17 +0900 |
| commit | f3f4d8bcde122a711000bb79c4a30f1edd9874ff (patch) | |
| tree | b68224886547018ea6547ca6793772154905b28f /statuspage/checks | |
| parent | f035b94c216a8324e5b0d1637340c3736227781f (diff) | |
Distinguish pf state-tracking modes with bracketed letter tags
Previously "keep state" and "modulate state" both collapsed to the
same generic "[state]" tag, losing a real distinction: modulate state
hardens TCP ISN generation and synproxy state (not handled at all
before) proxies the handshake against spoofed SYN floods - neither is
just "some tracking is happening." Now [N]/[K]/[M]/[S] map to no/keep/
modulate/synproxy state respectively, documented in a comment since
the mapping isn't self-evident without pf.conf familiarity.
Considered thematic unicode symbols from the font's supported blocks
(Mathematical Operators, Geometric Shapes) instead, but a bracketed
letter is unambiguous without a legend - a clever but obscure glyph
isn't actually more compact once you factor in "what does this mean."
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Diffstat (limited to 'statuspage/checks')
| -rwxr-xr-x | statuspage/checks/pf.sh | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/statuspage/checks/pf.sh b/statuspage/checks/pf.sh index 08dc7d3..651b638 100755 --- a/statuspage/checks/pf.sh +++ b/statuspage/checks/pf.sh @@ -20,6 +20,15 @@ DIR=$(dirname "$0") # the scientifica font); avoids Dingbats (✓/✗) since that block isn't # shipped. A rule shape this doesn't recognize just passes through # unshortened - still correct, just longer. +# +# State-tracking mode is tagged with a single bracketed letter rather +# than a symbol, since the four modes (no/keep/modulate/synproxy) have +# meaningfully different security properties and a bracket+letter reads +# unambiguously without needing a legend memorized: +# [N] no state - untracked, matches TCP/UDP/ICMP +# [K] keep state - default state tracking, TCP/UDP/ICMP +# [M] modulate state - TCP only, PF randomizes the ISN +# [S] synproxy state - TCP only, proxies the handshake (implies K+M) abbreviate_rule() { printf '%s' "$1" | sed -E \ -e 's/ in / → /' \ @@ -27,8 +36,10 @@ abbreviate_rule() { -e 's/ quick//' \ -e 's/ on / /' \ -e 's/ flags [A-Za-z\/]+//' \ - -e 's/ modulate state/ [state]/' \ - -e 's/ keep state/ [state]/' \ + -e 's/ modulate state/ [M]/' \ + -e 's/ synproxy state/ [S]/' \ + -e 's/ keep state/ [K]/' \ + -e 's/ no state/ [N]/' \ -e 's/ proto (tcp|udp|icmp)/ \1/' \ -e 's/ from any to any port = ([a-zA-Z0-9]+)/ :\1/' \ -e 's/ from any to any/ /' \ |