| Age | Commit message (Collapse) | Author |
|---|
|
From a fresh-agent review of AGENTS.md against two hypothetical tasks:
- abbreviate_rule() in pf.sh has only ever been developed/tested
against filter-rule (-sr) syntax, despite also running on -sn
(nat/rdr) output. It degrades safely (unshortened passthrough) but
a new nat/rdr rule shape isn't guaranteed to compress as tightly -
noted both in the code comment and in AGENTS.md's compression
writeup so this doesn't need rediscovering.
- ddclient logging isn't enabled on the box, so "is the last DNS
update actually succeeding" can't be built by tailing a log that
doesn't exist - it'd need the cache file or a public-IP comparison
instead. Recorded in AGENTS.md's topology section since ddclient.sh
currently only checks the process is running, not update success.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
Previously "keep state" and "modulate state" both collapsed to the
same generic "[state]" tag, losing a real distinction: modulate state
hardens TCP ISN generation and synproxy state (not handled at all
before) proxies the handshake against spoofed SYN floods - neither is
just "some tracking is happening." Now [N]/[K]/[M]/[S] map to no/keep/
modulate/synproxy state respectively, documented in a comment since
the mapping isn't self-evident without pf.conf familiarity.
Considered thematic unicode symbols from the font's supported blocks
(Mathematical Operators, Geometric Shapes) instead, but a bracketed
letter is unambiguous without a legend - a clever but obscure glyph
isn't actually more compact once you factor in "what does this mean."
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
Filter rules now sort by (interface, in-before-out) rather than
pfctl's raw eval order, which just reflects pf.conf's authoring order
and reads as arbitrarily interleaved (an "out" rule sandwiched between
unrelated "in" rules for the same interface). Display-only reorder -
pf's actual evaluation order and quick/first-match semantics on the
box are untouched, only the informational listing is re-sorted.
Generalized the "from X to Y" abbreviation beyond the from-any-to-any-
port special case, and replaced pfctl's own "->" (nat rewrite target)
with the unicode arrow for consistency with the in/out arrows already
in use. Also dropped the "nat: " prefix, which was redundant with the
rule text already starting with "nat". Applied the same "->" -> "→"
consistency swap to jails.sh's http child-row label.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
pfctl's verbose syntax (flags S/SA, quick, from any to any port = X,
proto tcp/udp/icmp) was overflowing the .section column width and
wrapping mid-rule. abbreviate_rule() in pf.sh strips the near-
universal boilerplate tokens on this ruleset and swaps in/out for
arrows - cuts each rule to roughly 35-45% of its original length.
Deliberately not a real pf syntax parser: it's a handful of targeted
sed substitutions, so a rule shape it doesn't recognize just passes
through unshortened rather than mangling. Only uses the Arrows block
(confirmed shipped in the scientifica font) - avoided Dingbats
(checkmark/X) since that block isn't included in this font.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
checks/pf.sh reports pf enabled/disabled, state table usage (warn/down
as it nears the configured limit), and the loaded filter/nat rule
count, then lists each active rule as its own row for at-a-glance
visibility into what's actually being enforced.
Those rule rows use a new "info" status (gray square) rather than
"ok" - they're not a health check on any individual rule, so a green
square there would misleadingly imply otherwise. render.sh maps
info -> gray; anything else still falls back to red.
checks/wg-watcher.sh checks the route-monitor process wg-quick spawns
to react to WAN interface/address changes - it isn't rc.d-managed, so
there's no `service status` for it, hence the new proc_running helper
in lib/common.sh (pgrep -f based).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
