diff options
| -rwxr-xr-x | statuspage/checks/jails.sh | 2 | ||||
| -rwxr-xr-x | statuspage/checks/pf.sh | 25 |
2 files changed, 24 insertions, 3 deletions
diff --git a/statuspage/checks/jails.sh b/statuspage/checks/jails.sh index 71024cc..ccdf68e 100755 --- a/statuspage/checks/jails.sh +++ b/statuspage/checks/jails.sh @@ -36,6 +36,6 @@ jls -n name 2>/dev/null | sed -n 's/.*name=\([^ ]*\).*/\1/p' | while IFS= read - if [ -n "$ip" ]; then http_status=$(port_check "$ip" 80) - json_line "jails" " -> http :80" "" "$http_status" + json_line "jails" " → http :80" "" "$http_status" fi done diff --git a/statuspage/checks/pf.sh b/statuspage/checks/pf.sh index ef39268..08dc7d3 100755 --- a/statuspage/checks/pf.sh +++ b/statuspage/checks/pf.sh @@ -31,8 +31,11 @@ abbreviate_rule() { -e 's/ keep state/ [state]/' \ -e 's/ proto (tcp|udp|icmp)/ \1/' \ -e 's/ from any to any port = ([a-zA-Z0-9]+)/ :\1/' \ + -e 's/ from any to any/ /' \ + -e 's/ from ([^ ]+) to ([^ ]+)/ \1 → \2/' \ -e 's/ inet / /' \ -e 's/ round-robin//' \ + -e 's/ -> / → /' \ -e 's/ all$//' \ -e 's/ all / /' \ -e 's/ +/ /g' \ @@ -66,12 +69,30 @@ fi RULE_COUNT=$(pfctl -sr 2>/dev/null | grep -c .) || RULE_COUNT=0 json_line "pf" "filter rules loaded" "$RULE_COUNT" "ok" -pfctl -sr 2>/dev/null | while IFS= read -r rule; do +# Group rules by interface (then in before out) rather than pfctl's raw +# eval order, which is just how the ruleset happens to be authored and +# reads as arbitrarily interleaved (e.g. an "out" rule sandwiched between +# unrelated "in" rules for the same interface). This is a display-only +# reorder - pf's actual evaluation order (and quick/first-match +# semantics) is untouched, only pfctl -sr's raw output is re-sorted here. +TAB=$(printf '\t') +pfctl -sr 2>/dev/null | awk -v OFS="$TAB" ' +{ + iface = "" + n = split($0, w, " ") + for (i = 1; i <= n; i++) { + if (w[i] == "on" && i < n) { iface = w[i + 1]; break } + } + dir = "2" + if ($0 ~ / in /) dir = "0" + else if ($0 ~ / out /) dir = "1" + print iface, dir, $0 +}' | sort -t "$TAB" -k1,1 -k2,2 -k3 | cut -f3- | while IFS= read -r rule; do [ -n "$rule" ] || continue json_line "pf" " $(abbreviate_rule "$rule")" "" "info" done pfctl -sn 2>/dev/null | while IFS= read -r rule; do [ -n "$rule" ] || continue - json_line "pf" " nat: $(abbreviate_rule "$rule")" "" "info" + json_line "pf" " $(abbreviate_rule "$rule")" "" "info" done |