pfSense

https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/1203

Applied in changeset 27db374dbca226f0429b1453802ff70764b3102d.

Found a hiccup with the current output.

Sometimes a rule in the rules.debug gets expanded into multiple rules in pf. The current hover popup only shows the first matching rule (which may be same as before, I can't recall). However, it may not appear to be correct, even if it is.

For example:

Log entry:

Mar 31 09:59:40 jack filterlog[63907]: 91,,,1000005670,re1.50,match,block,in,4,0xc0,,1,7612,0,DF,17,udp,132,203.0.113.2,224.0.0.9,520,520,112

Hovering over that rule in the GUI shows:

Note: It's saying rule 88 matched, but the log shows 91, though the tracker matches. It's confusing to the user because the log entry is IPv4, but the rule it shows matches is for IPv6.

Looking at /tmp/rules.debug it shows:

: grep 1000005670 /tmp/rules.debug 
antispoof log for $WAN2 ridentifier 1000005670

But when you look at pfctl -vvsr it shows that pf expanded that one rule into multiple rules with unique rule numbers but using the same tracker ID:

: pfctl -vvsr | grep 1000005670
@88 block drop in log on ! re0 inet6 from 2001:db8:0:2::/64 to any ridentifier 1000005670
@89 block drop in log on re0 inet6 from fe80::20d:b9ff:fe33:f70 to any ridentifier 1000005670
@90 block drop in log inet6 from 2001:db8:0:2::14 to any ridentifier 1000005670
@91 block drop in log on ! re0 inet from 203.0.113.0/24 to any ridentifier 1000005670
@92 block drop in log inet from 203.0.113.14 to any ridentifier 1000005670

Seems like we should do one of the following:

• Check if the tracker ID and rule number match, if so, display that rule, not just the first match by tracker ID (fall back to only tracker ID if no matches on rule number?)
  OR
• Show all rules matching the tracker ID

The following splits the rules found into "Matched Rule" and "Associated Rules". The matched rule shows the closest match of the rule which triggered the log. The associated rules show all rules with the same tracking ID: 738d2703ec4f483ea2d5038d4d6faa2f26a921b2.

Works great with that change, now the redundant single associated rule is hidden, but it still shows if there are multiple matches.

Thanks!