Rules order randomly changes

[louis2]

@marcosm

At this moment I am using pfSense 24.11

I intend to do some rule changes in favor to test the stability of rule number.

Note that for a start:

• I did apply All recommended patches for 24.11
• and did define an extra patch based on your id c181ebe180017116626da28f30407a1da3cba061
• logged into pfsense using ssh
• created a ruledump with pfctl -vvsr > 20250306_1941_RuleDump.txt
• did read that file into the db I did create in the past in order to create graylog lookups
• among other things that DB creates a CRS32 as unique key for each rule

I will make some changes to the firewall rules in the coming days and after that create another dump. Read that dump in the DB and check if the same CRS32 do still correspond with the same rule numbers.

Since I have limited time, the whole process will take probably something like a week.
Note: I might have generated a ticket related to the issue a few years ago. I did not check.

[SteveITS]

@louis2 said in Rules order randomly changes:

I did apply All recommended patches for 24.11

The patch is in the recommended list but you need to update that package to see it. It wasn't in the list a couple days ago.

[w0w]

@w0w said in Rules order randomly changes:

I don't know if I'm just lucky or what… Sorry, it happened again.

Steps to reproduce:

1. Copy one or two rules using the "Actions" → "Copy" button on the right side of the selected rule. I copied two rules (7.1 and 8.1), pressed Save, but did not apply the changes.
2. Go to the LAN or any other interface and copy a rule the same way, somewhere in the middle of the list, just like you did in the Ethernet tab. Press Save, but do not apply the changes.
3. Go back to the Ethernet tab – the order is messed up.

[marcosm]

@w0w Thank you. Try with this patch:

diff --git a/src/etc/inc/pfsense-utils.inc b/src/etc/inc/pfsense-utils.inc
index 5095c9ff0f..23cdbdf295 100644
--- a/src/etc/inc/pfsense-utils.inc
+++ b/src/etc/inc/pfsense-utils.inc
@@ -3088,18 +3088,33 @@ function filter_rules_sort() {
 	config_set_path('filter/rule', $rules);
 }
 function filter_rules_compare($a, $b) {
-	if ((isset($a['floating']) && isset($b['floating'])) ||
-	    (isset($b['ethernet']) && isset($b['ethernet']))) {
-		return $a['seq'] - $b['seq'];
-	} else if (isset($a['floating']) || isset($a['ethernet'])) {
-		return -1;
-	} else if (isset($b['floating']) || isset($b['ethernet'])) {
+	if (isset($a['ethernet'])) {
+		// Ethernet rules always come first.
+		if (!isset($b['ethernet'])) {
+			return -1;
+		}
+	} elseif (isset($a['floating'])) {
+		// Floating rules are placed after Ethernet rules and before Interface rules.
+		if (isset($b['ethernet'])) {
+			return 1;
+		} elseif (!isset($b['floating'])) {
+			return -1;
+		}
+	} elseif (isset($b['ethernet']) || isset($b['floating'])) {
+		// Interface rules are placed after Ethernet and Floating rules.
 		return 1;
-	} else if ($a['interface'] == $b['interface']) {
-		return $a['seq'] - $b['seq'];
-	} else {
+	} elseif ($a['interface'] != $b['interface']) {
+		// Interface rules for the same interface are grouped together.
 		return compare_interface_friendly_names($a['interface'], $b['interface']);
 	}
+
+	// Use the sequence number as a last resort.
+	if (isset($a['seq']) && isset($b['seq'])) {
+		return ($a['seq'] <=> $b['seq']);
+	}
+
+	// Nothing to compare.
+	return 0;
 }
 
 function generate_ipv6_from_mac($mac) {

If testing on 24.11, apply this one after first applying the latest recommended System patches. If testing on 25.03-BETA, first apply c181ebe180017116626da28f30407a1da3cba061 and the previous one, then this one.

[w0w]

@marcosm said in Rules order randomly changes:

At first glance, everything seems to be working, but we won't rush. I'll test it for some more time.