Sort pf rules by interface, iconify from/to, drop redundant nat prefix

Filter rules now sort by (interface, in-before-out) rather than
pfctl's raw eval order, which just reflects pf.conf's authoring order
and reads as arbitrarily interleaved (an "out" rule sandwiched between
unrelated "in" rules for the same interface). Display-only reorder -
pf's actual evaluation order and quick/first-match semantics on the
box are untouched, only the informational listing is re-sorted.

Generalized the "from X to Y" abbreviation beyond the from-any-to-any-
port special case, and replaced pfctl's own "->" (nat rewrite target)
with the unicode arrow for consistency with the in/out arrows already
in use. Also dropped the "nat: " prefix, which was redundant with the
rule text already starting with "nat". Applied the same "->" -> "→"
consistency swap to jails.sh's http child-row label.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2 files changed, 24 insertions, 3 deletions

diff --git a/statuspage/checks/jails.sh b/statuspage/checks/jails.sh
index 71024cc..ccdf68e 100755
--- a/statuspage/checks/jails.sh
+++ b/statuspage/checks/jails.sh
@@ -36,6 +36,6 @@ jls -n name 2>/dev/null | sed -n 's/.*name=\([^ ]*\).*/\1/p' | while IFS= read -
 
     if [ -n "$ip" ]; then
         http_status=$(port_check "$ip" 80)
-        json_line "jails" "  -> http :80" "" "$http_status"
+        json_line "jails" "  → http :80" "" "$http_status"
     fi
 done
diff --git a/statuspage/checks/pf.sh b/statuspage/checks/pf.sh
index ef39268..08dc7d3 100755
--- a/statuspage/checks/pf.sh
+++ b/statuspage/checks/pf.sh
@@ -31,8 +31,11 @@ abbreviate_rule() {
         -e 's/ keep state/ [state]/' \
         -e 's/ proto (tcp|udp|icmp)/ \1/' \
         -e 's/ from any to any port = ([a-zA-Z0-9]+)/ :\1/' \
+        -e 's/ from any to any/ /' \
+        -e 's/ from ([^ ]+) to ([^ ]+)/ \1 → \2/' \
         -e 's/ inet / /' \
         -e 's/ round-robin//' \
+        -e 's/ -> / → /' \
         -e 's/ all$//' \
         -e 's/ all / /' \
         -e 's/  +/ /g' \
@@ -66,12 +69,30 @@ fi
 RULE_COUNT=$(pfctl -sr 2>/dev/null | grep -c .) || RULE_COUNT=0
 json_line "pf" "filter rules loaded" "$RULE_COUNT" "ok"
 
-pfctl -sr 2>/dev/null | while IFS= read -r rule; do
+# Group rules by interface (then in before out) rather than pfctl's raw
+# eval order, which is just how the ruleset happens to be authored and
+# reads as arbitrarily interleaved (e.g. an "out" rule sandwiched between
+# unrelated "in" rules for the same interface). This is a display-only
+# reorder - pf's actual evaluation order (and quick/first-match
+# semantics) is untouched, only pfctl -sr's raw output is re-sorted here.
+TAB=$(printf '\t')
+pfctl -sr 2>/dev/null | awk -v OFS="$TAB" '
+{
+    iface = ""
+    n = split($0, w, " ")
+    for (i = 1; i <= n; i++) {
+        if (w[i] == "on" && i < n) { iface = w[i + 1]; break }
+    }
+    dir = "2"
+    if ($0 ~ / in /) dir = "0"
+    else if ($0 ~ / out /) dir = "1"
+    print iface, dir, $0
+}' | sort -t "$TAB" -k1,1 -k2,2 -k3 | cut -f3- | while IFS= read -r rule; do
     [ -n "$rule" ] || continue
     json_line "pf" "  $(abbreviate_rule "$rule")" "" "info"
 done
 
 pfctl -sn 2>/dev/null | while IFS= read -r rule; do
     [ -n "$rule" ] || continue
-    json_line "pf" "  nat: $(abbreviate_rule "$rule")" "" "info"
+    json_line "pf" "  $(abbreviate_rule "$rule")" "" "info"
 done