Restrict 520.pfdenied to only list rules that blocked traffic.

Before this change, the 520.pfdenied script listed all rules that
matched /^block/ in the rule. Restrict the printed output to only
those rules that result in packets being dropped.

PR:		conf/187224
Approved by:	rpaulo (mentor)
Differential Revision:	https://reviews.freebsd.org/D4068

diff --git a/etc/periodic/security/520.pfdenied b/etc/periodic/security/520.pfdenied
index 7a32bf2a193be20c1ef724fe4d15e0fc02a67b50..3fea360f4582691d4d1fad9dd663a7893199c6b9 100755 (executable)
--- a/etc/periodic/security/520.pfdenied
+++ b/etc/periodic/security/520.pfdenied
@@ -44,7 +44,7 @@ rc=0
 if check_yesno_period security_status_pfdenied_enable
 then
        TMP=`mktemp -t security`
-       if pfctl -sr -v 2>/dev/null | nawk '{if (/^block/) {buf=$0; getline; gsub(" +"," ",$0); print buf$0;} }' > ${TMP}; then
+       if pfctl -sr -v 2>/dev/null | nawk '{if (/^block/) {buf=$0; getline; gsub(" +"," ",$0); if ($5 > 0) print buf$0;} }' > ${TMP}; then
          check_diff new_only pf ${TMP} "${host} pf denied packets:"
        fi
        rc=$?