#!/bin/sh
# Usage: doas pf-load [file]     (default: /tmp/pf.conf)
# Checks a new pf.conf, installs and loads it, then restarts pflog2syslog so
# its rule number -> label map matches the new ruleset.
set -e
new=${1:-/tmp/pf.conf}
/sbin/pfctl -nf "$new"
install -o root -g wheel -m 0600 "$new" /etc/pf.conf
rm -f "$new"
/sbin/pfctl -f /etc/pf.conf
/usr/sbin/rcctl restart pflog2syslog
sleep 2
echo "pf: loaded, $(wc -l < /var/db/pf-labels | tr -d ' ') labelled rules in the map"