1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
#!/bin/sh
# checks/pf.sh
# pf health summary (enabled, state table usage, rule count), plus the
# actual active filter and nat/rdr rules listed as rows below. The rule
# rows use status "info" (a neutral gray square) rather than "ok" -
# they're informational, not a health signal, and a green square there
# would wrongly imply each individual rule was itself being health-
# checked.
set -eu
DIR=$(dirname "$0")
. "$DIR/../lib/common.sh"
# abbreviate_rule RULE
# Best-effort compression of pfctl's verbose rule syntax so rows fit a
# narrow column without wrapping mid-word. Not a semantic parser - just
# strips/replaces the tokens that are near-universal boilerplate on this
# ruleset (quick, flags S/SA, proto/from-to-port verbosity) and swaps
# in/out for arrows. Uses only the Arrows block (confirmed present in
# the scientifica font); avoids Dingbats (✓/✗) since that block isn't
# shipped. A rule shape this doesn't recognize just passes through
# unshortened - still correct, just longer.
#
# State-tracking mode is tagged with a single bracketed letter rather
# than a symbol, since the four modes (no/keep/modulate/synproxy) have
# meaningfully different security properties and a bracket+letter reads
# unambiguously without needing a legend memorized:
# [N] no state - untracked, matches TCP/UDP/ICMP
# [K] keep state - default state tracking, TCP/UDP/ICMP
# [M] modulate state - TCP only, PF randomizes the ISN
# [S] synproxy state - TCP only, proxies the handshake (implies K+M)
abbreviate_rule() {
printf '%s' "$1" | sed -E \
-e 's/ in / → /' \
-e 's/ out / ← /' \
-e 's/ quick//' \
-e 's/ on / /' \
-e 's/ flags [A-Za-z\/]+//' \
-e 's/ modulate state/ [M]/' \
-e 's/ synproxy state/ [S]/' \
-e 's/ keep state/ [K]/' \
-e 's/ no state/ [N]/' \
-e 's/ proto (tcp|udp|icmp)/ \1/' \
-e 's/ from any to any port = ([a-zA-Z0-9]+)/ :\1/' \
-e 's/ from any to any/ /' \
-e 's/ from ([^ ]+) to ([^ ]+)/ \1 → \2/' \
-e 's/ inet / /' \
-e 's/ round-robin//' \
-e 's/ -> / → /' \
-e 's/ all$//' \
-e 's/ all / /' \
-e 's/ +/ /g' \
-e 's/^ +//' -e 's/ +$//'
}
INFO=$(pfctl -si 2>/dev/null) || INFO=""
ENABLED=$(printf '%s\n' "$INFO" | awk -F'[ :]+' '/^Status:/{print $2; exit}')
if [ "$ENABLED" = "Enabled" ]; then
json_line "pf" "pf" "" "ok"
else
json_line "pf" "pf" "${ENABLED:-unknown}" "down"
fi
CURRENT=$(printf '%s\n' "$INFO" | awk '/current entries/{print $NF; exit}')
LIMIT=$(pfctl -sm 2>/dev/null | awk '/^states/{print $NF; exit}')
if [ -n "$CURRENT" ] && [ -n "$LIMIT" ] && [ "$LIMIT" -gt 0 ] 2>/dev/null; then
PCT=$((CURRENT * 100 / LIMIT))
if [ "$PCT" -ge 90 ]; then
SSTATUS=down
elif [ "$PCT" -ge 75 ]; then
SSTATUS=warn
else
SSTATUS=ok
fi
json_line "pf" "state table" "${CURRENT}/${LIMIT} (${PCT}%)" "$SSTATUS"
fi
RULE_COUNT=$(pfctl -sr 2>/dev/null | grep -c .) || RULE_COUNT=0
json_line "pf" "filter rules loaded" "$RULE_COUNT" "ok"
# Group rules by interface (then in before out) rather than pfctl's raw
# eval order, which is just how the ruleset happens to be authored and
# reads as arbitrarily interleaved (e.g. an "out" rule sandwiched between
# unrelated "in" rules for the same interface). This is a display-only
# reorder - pf's actual evaluation order (and quick/first-match
# semantics) is untouched, only pfctl -sr's raw output is re-sorted here.
TAB=$(printf '\t')
pfctl -sr 2>/dev/null | awk -v OFS="$TAB" '
{
iface = ""
n = split($0, w, " ")
for (i = 1; i <= n; i++) {
if (w[i] == "on" && i < n) { iface = w[i + 1]; break }
}
dir = "2"
if ($0 ~ / in /) dir = "0"
else if ($0 ~ / out /) dir = "1"
print iface, dir, $0
}' | sort -t "$TAB" -k1,1 -k2,2 -k3 | cut -f3- | while IFS= read -r rule; do
[ -n "$rule" ] || continue
json_line "pf" " $(abbreviate_rule "$rule")" "" "info"
done
pfctl -sn 2>/dev/null | while IFS= read -r rule; do
[ -n "$rule" ] || continue
json_line "pf" " $(abbreviate_rule "$rule")" "" "info"
done
|
