diff options
Diffstat (limited to 'statuspage/checks/pf.sh')
| -rwxr-xr-x | statuspage/checks/pf.sh | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/statuspage/checks/pf.sh b/statuspage/checks/pf.sh index 08dc7d3..651b638 100755 --- a/statuspage/checks/pf.sh +++ b/statuspage/checks/pf.sh @@ -20,6 +20,15 @@ DIR=$(dirname "$0") # the scientifica font); avoids Dingbats (✓/✗) since that block isn't # shipped. A rule shape this doesn't recognize just passes through # unshortened - still correct, just longer. +# +# State-tracking mode is tagged with a single bracketed letter rather +# than a symbol, since the four modes (no/keep/modulate/synproxy) have +# meaningfully different security properties and a bracket+letter reads +# unambiguously without needing a legend memorized: +# [N] no state - untracked, matches TCP/UDP/ICMP +# [K] keep state - default state tracking, TCP/UDP/ICMP +# [M] modulate state - TCP only, PF randomizes the ISN +# [S] synproxy state - TCP only, proxies the handshake (implies K+M) abbreviate_rule() { printf '%s' "$1" | sed -E \ -e 's/ in / → /' \ @@ -27,8 +36,10 @@ abbreviate_rule() { -e 's/ quick//' \ -e 's/ on / /' \ -e 's/ flags [A-Za-z\/]+//' \ - -e 's/ modulate state/ [state]/' \ - -e 's/ keep state/ [state]/' \ + -e 's/ modulate state/ [M]/' \ + -e 's/ synproxy state/ [S]/' \ + -e 's/ keep state/ [K]/' \ + -e 's/ no state/ [N]/' \ -e 's/ proto (tcp|udp|icmp)/ \1/' \ -e 's/ from any to any port = ([a-zA-Z0-9]+)/ :\1/' \ -e 's/ from any to any/ /' \ |