Distinguish pf state-tracking modes with bracketed letter tags

Previously "keep state" and "modulate state" both collapsed to the
same generic "[state]" tag, losing a real distinction: modulate state
hardens TCP ISN generation and synproxy state (not handled at all
before) proxies the handshake against spoofed SYN floods - neither is
just "some tracking is happening." Now [N]/[K]/[M]/[S] map to no/keep/
modulate/synproxy state respectively, documented in a comment since
the mapping isn't self-evident without pf.conf familiarity.

Considered thematic unicode symbols from the font's supported blocks
(Mathematical Operators, Geometric Shapes) instead, but a bracketed
letter is unambiguous without a legend - a clever but obscure glyph
isn't actually more compact once you factor in "what does this mean."

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 13 insertions, 2 deletions

diff --git a/statuspage/checks/pf.sh b/statuspage/checks/pf.sh
index 08dc7d3..651b638 100755
--- a/statuspage/checks/pf.sh
+++ b/statuspage/checks/pf.sh
@@ -20,6 +20,15 @@ DIR=$(dirname "$0")
 # the scientifica font); avoids Dingbats (✓/✗) since that block isn't
 # shipped. A rule shape this doesn't recognize just passes through
 # unshortened - still correct, just longer.
+#
+# State-tracking mode is tagged with a single bracketed letter rather
+# than a symbol, since the four modes (no/keep/modulate/synproxy) have
+# meaningfully different security properties and a bracket+letter reads
+# unambiguously without needing a legend memorized:
+#   [N] no state       - untracked, matches TCP/UDP/ICMP
+#   [K] keep state      - default state tracking, TCP/UDP/ICMP
+#   [M] modulate state  - TCP only, PF randomizes the ISN
+#   [S] synproxy state  - TCP only, proxies the handshake (implies K+M)
 abbreviate_rule() {
     printf '%s' "$1" | sed -E \
         -e 's/ in / → /' \
@@ -27,8 +36,10 @@ abbreviate_rule() {
         -e 's/ quick//' \
         -e 's/ on / /' \
         -e 's/ flags [A-Za-z\/]+//' \
-        -e 's/ modulate state/ [state]/' \
-        -e 's/ keep state/ [state]/' \
+        -e 's/ modulate state/ [M]/' \
+        -e 's/ synproxy state/ [S]/' \
+        -e 's/ keep state/ [K]/' \
+        -e 's/ no state/ [N]/' \
         -e 's/ proto (tcp|udp|icmp)/ \1/' \
         -e 's/ from any to any port = ([a-zA-Z0-9]+)/ :\1/' \
         -e 's/ from any to any/ /' \