#!/bin/sh
# pf log packets -> syslog lines (tag "pf", facility local0), each ending in
# label=<rule label>. The rule number -> label map is rebuilt from the loaded
# ruleset at every start, so it always matches what pf is running.
MAP=/var/db/pf-labels
/sbin/pfctl -vvsr 2>/dev/null \
  | sed -n 's/^@\([0-9][0-9]*\) .* label "\([^"]*\)".*/\1 \2/p' > "$MAP"

/usr/sbin/tcpdump -l -n -e -ttt -i pflog0 2>/dev/null \
  | /usr/bin/awk -v map="$MAP" '
      BEGIN { while ((getline line < map) > 0) { split(line, f, " "); label[f[1]] = f[2] } }
      {
        n = ""
        if (match($0, /rule [0-9]+/)) n = substr($0, RSTART + 5, RLENGTH - 5)
        print $0 " label=" ((n in label) ? label[n] : "unknown")
        fflush()
      }' \
  | /usr/bin/logger -t pf -p local0.info