blob: 47b2acdc1c4a8d5c8d0c57f9169a5d30b84e3c9a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
#!/bin/sh
# checks/pf.sh
# pf health summary (enabled, state table usage, rule count), plus the
# actual active filter and nat/rdr rules listed as rows below. The rule
# rows use status "info" (a neutral gray square) rather than "ok" -
# they're informational, not a health signal, and a green square there
# would wrongly imply each individual rule was itself being health-
# checked.
set -eu
DIR=$(dirname "$0")
. "$DIR/../lib/common.sh"
INFO=$(pfctl -si 2>/dev/null) || INFO=""
ENABLED=$(printf '%s\n' "$INFO" | awk -F'[ :]+' '/^Status:/{print $2; exit}')
if [ "$ENABLED" = "Enabled" ]; then
json_line "pf" "pf" "" "ok"
else
json_line "pf" "pf" "${ENABLED:-unknown}" "down"
fi
CURRENT=$(printf '%s\n' "$INFO" | awk '/current entries/{print $NF; exit}')
LIMIT=$(pfctl -sm 2>/dev/null | awk '/^states/{print $NF; exit}')
if [ -n "$CURRENT" ] && [ -n "$LIMIT" ] && [ "$LIMIT" -gt 0 ] 2>/dev/null; then
PCT=$((CURRENT * 100 / LIMIT))
if [ "$PCT" -ge 90 ]; then
SSTATUS=down
elif [ "$PCT" -ge 75 ]; then
SSTATUS=warn
else
SSTATUS=ok
fi
json_line "pf" "state table" "${CURRENT}/${LIMIT} (${PCT}%)" "$SSTATUS"
fi
RULE_COUNT=$(pfctl -sr 2>/dev/null | grep -c .) || RULE_COUNT=0
json_line "pf" "filter rules loaded" "$RULE_COUNT" "ok"
pfctl -sr 2>/dev/null | while IFS= read -r rule; do
[ -n "$rule" ] || continue
json_line "pf" " $rule" "" "info"
done
pfctl -sn 2>/dev/null | while IFS= read -r rule; do
[ -n "$rule" ] || continue
json_line "pf" " nat: $rule" "" "info"
done
|
