pfSense » pfSense Packages

diff --git a/net/pfSense-pkg-pfBlockerNG-devel/files/usr/local/pkg/pfblockerng/pfblockerng.inc b/net/pfSense-pkg-pfBlockerNG-devel/files/usr/local/pkg/pfblockerng/pfblockerng.inc
index 482cd1f52057..78035231706a 100644
--- a/net/pfSense-pkg-pfBlockerNG-devel/files/usr/local/pkg/pfblockerng/pfblockerng.inc
+++ b/net/pfSense-pkg-pfBlockerNG-devel/files/usr/local/pkg/pfblockerng/pfblockerng.inc
@@ -10050,8 +10050,12 @@ function sync_package_pfblockerng($cron='') {
     #    Assign Rules    #
     #########################

+    // Any pfB alias not in this list will be killed.
+    $pfb_active_aliases = null;
+
     // Only execute if autorules are defined or if an alias has been removed.
     if ($pfb['autorules'] || $pfb['enable'] == '' || $pfb['remove']) {
+        $pfb_active_aliases = [];
         $message = '';
         if (!empty($pfb['deny_inbound']) || !empty($pfb['permit_inbound']) || !empty($pfb['match_inbound'])) {
             if (empty($pfb['inbound_interfaces'])) {
@@ -10136,6 +10140,14 @@ function sync_package_pfblockerng($cron='') {
                         }
                     }

+                    // Track pfB aliases referenced by rules.
+                    foreach (array('source', 'destination') as $rtype) {
+                        if ((substr($rule[$rtype]['address'], 0, 4) == 'pfB_') &&
+                            !in_array($rule[$rtype]['address'], $pfb_active_aliases)) {
+                            $pfb_active_aliases[] = $rule[$rtype]['address'];
+                        }
+                    }
+
                     // Remove 'created' tag
                     if (isset($rule['created'])) {
                         unset($rule['created']);
@@ -10385,12 +10397,31 @@ function sync_package_pfblockerng($cron='') {
             pfb_logger("{$log}\n", 1);
         }

-        // Remove all pfB aliastables
         exec("{$pfb['pfctl']} -s Tables | {$pfb['grep']} '^pfB_'", $pfb_tables);
         if (isset($pfb_tables)) {
+            $final_alias = array();
+            $pfb_active_aliases = isset($pfb_active_aliases) ? array_unique($pfb_active_aliases) : [];
+            if ($pfb['repcheck'] && ($pfb['drep'] == 'on' || $pfb['prep'] == 'on')) {
+                if (!empty($pfb_alias_lists_all)) {
+                    $final_alias = array_intersect(array_unique($pfb_alias_lists_all), $pfb_active_aliases);
+                }
+            } else {
+                if (!empty($pfb_alias_lists)) {
+                    $final_alias = array_intersect(array_unique($pfb_alias_lists), $pfb_active_aliases);
+                }
+            }
             foreach ($pfb_tables as $pfb_table) {
                 $pfb_table_esc = escapeshellarg($pfb_table);
-                exec("{$pfb['pfctl']} -t {$pfb_table_esc} -T kill 2>&1", $result);
+                $pfb_table_path_esc    = escapeshellarg("{$pfb['aliasdir']}/{$pfb_table}.txt");
+                if (in_array($pfb_table, $pfb_active_aliases)) {
+                    if (in_array($pfb_table, $final_alias)) {
+                        // Replace active pfB aliastables which have been updated
+                        exec("{$pfb['pfctl']} -t {$pfb_table_esc} -T replace -f {$pfb_table_path_esc} 2>&1", $result);
+                    }
+                } else {
+                    // Remove inactive pfB aliastables
+                    exec("{$pfb['pfctl']} -t {$pfb_table_esc} -T kill 2>&1", $result);
+                }
             }
         }