From f3f4d8bcde122a711000bb79c4a30f1edd9874ff Mon Sep 17 00:00:00 2001 From: batsumaru <> Date: Wed, 1 Jul 2026 18:22:17 +0900 Subject: Distinguish pf state-tracking modes with bracketed letter tags Previously "keep state" and "modulate state" both collapsed to the same generic "[state]" tag, losing a real distinction: modulate state hardens TCP ISN generation and synproxy state (not handled at all before) proxies the handshake against spoofed SYN floods - neither is just "some tracking is happening." Now [N]/[K]/[M]/[S] map to no/keep/ modulate/synproxy state respectively, documented in a comment since the mapping isn't self-evident without pf.conf familiarity. Considered thematic unicode symbols from the font's supported blocks (Mathematical Operators, Geometric Shapes) instead, but a bracketed letter is unambiguous without a legend - a clever but obscure glyph isn't actually more compact once you factor in "what does this mean." Co-Authored-By: Claude Sonnet 5 --- statuspage/checks/pf.sh | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) (limited to 'statuspage/checks') diff --git a/statuspage/checks/pf.sh b/statuspage/checks/pf.sh index 08dc7d3..651b638 100755 --- a/statuspage/checks/pf.sh +++ b/statuspage/checks/pf.sh @@ -20,6 +20,15 @@ DIR=$(dirname "$0") # the scientifica font); avoids Dingbats (✓/✗) since that block isn't # shipped. A rule shape this doesn't recognize just passes through # unshortened - still correct, just longer. +# +# State-tracking mode is tagged with a single bracketed letter rather +# than a symbol, since the four modes (no/keep/modulate/synproxy) have +# meaningfully different security properties and a bracket+letter reads +# unambiguously without needing a legend memorized: +# [N] no state - untracked, matches TCP/UDP/ICMP +# [K] keep state - default state tracking, TCP/UDP/ICMP +# [M] modulate state - TCP only, PF randomizes the ISN +# [S] synproxy state - TCP only, proxies the handshake (implies K+M) abbreviate_rule() { printf '%s' "$1" | sed -E \ -e 's/ in / → /' \ @@ -27,8 +36,10 @@ abbreviate_rule() { -e 's/ quick//' \ -e 's/ on / /' \ -e 's/ flags [A-Za-z\/]+//' \ - -e 's/ modulate state/ [state]/' \ - -e 's/ keep state/ [state]/' \ + -e 's/ modulate state/ [M]/' \ + -e 's/ synproxy state/ [S]/' \ + -e 's/ keep state/ [K]/' \ + -e 's/ no state/ [N]/' \ -e 's/ proto (tcp|udp|icmp)/ \1/' \ -e 's/ from any to any port = ([a-zA-Z0-9]+)/ :\1/' \ -e 's/ from any to any/ /' \ -- cgit v1.3