From 3ce5c48c0eadb8c4309a02d0b8fdc68d231cd657 Mon Sep 17 00:00:00 2001 From: Q-Feeds Date: Sun, 19 Oct 2025 13:36:47 +0200 Subject: [PATCH] Fix log parser for rules with tags (#4985) Example rules: block drop out log quick on em0_vlan108 inet6 from any to <__qfeeds_malware_ip> label "dc5f8e7ee80be02f12014877d82c96a2" tag qtag block drop out log quick on em0_vlan109 inet from any to <__qfeeds_malware_ip> label "dc5f8e7ee80be02f12014877d82c96a2" tag qtag block drop out log quick on em0_vlan109 inet6 from any to <__qfeeds_malware_ip> label "dc5f8e7ee80be02f12014877d82c96a2" tag qtag block drop in quick on em1 reply-to (em1 x.x.x.22) inet from <__qfeeds_malware_ip> to any label "de057b37c3fe418169db727c1d8a3f79" block drop in quick on em1 reply-to (em1 fe80::1e52) inet6 from <__qfeeds_malware_ip> to any label "de057b37c3fe418169db727c1d8a3f79" --- .../src/opnsense/scripts/qfeeds/lib/log.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/security/q-feeds-connector/src/opnsense/scripts/qfeeds/lib/log.py b/security/q-feeds-connector/src/opnsense/scripts/qfeeds/lib/log.py index 0f327b533..d9e7cbd34 100644 --- a/security/q-feeds-connector/src/opnsense/scripts/qfeeds/lib/log.py +++ b/security/q-feeds-connector/src/opnsense/scripts/qfeeds/lib/log.py @@ -50,6 +50,11 @@ class PFLogCrawler: for table in self._table_names: if line.find("<%s>" % table) > 0: self._rule_ids.add(line.split()[-1].strip('"')) + if 'label "' in line: + quote_start = line.find('"', line.find('label "')) + quote_end = line.find('"', quote_start + 1) + if quote_end > quote_start: + self._rule_ids.add(line[quote_start + 1:quote_end]) @staticmethod def _parse_log_line(line): @@ -73,4 +78,4 @@ class PFLogCrawler: if (idx % 100000 == 0 and time.time() - start_time > max_time) or rows_processed >= max_results: return result - return result + return result \ No newline at end of file