net/firewall - priority matching doesn't match core's

[AdSchellevis]

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• The title contains the plugin to which this issue belongs

Describe the bug

It looks like the priority matching doesn't match the one in core when matching on different types of rules.

https://github.com/opnsense/plugins/blob/master/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/FilterRuleField.php#L104-L120

Noticed this while looking at #6991

The ordering in core originates from

core/src/etc/inc/filter.lib.inc

Lines 632 to 638 in db4b90d

	if (isset($rule['floating'])) {
	$prio = 200000;
	} elseif (isset($ifgroups[$rule['interface']])) {
	$prio = 300000 + $ifgroups[$rule['interface']];
	} else {
	$prio = 400000;
	}

To Reproduce

Add some rules and search for" "prio:" in /tmp/rules.debug

Expected behavior
Rule logic should likely match the one in core, but changing it might influence peoples setups.
A couple of alternatives are possible, leave as is and accept rules are sorted differently (amend text in code) as nobody reported an issue and the rule overview does show where they live.

Align logic to core, where manual rules are sorted like :

• < 200000 --> internal
• >= 200000 < 300000 --> floating
• >= 300000 < 400000 --> interface groups
• >= 400000 < 500000 --> manual rules
• >= 500000 --> internal (after normal rules)

[mimugmail]

I didn't have a deeper look, but will this change the sorting of the rules when combined with net/firewall and local rules?
My understanding is/was that rule order is:

• Floating
• local FW groups
• net/firewall rules
• interface rules

Correct?

[AdSchellevis]

@mimugmail that was more or less the idea, handled by priority, I just made the numbers to small 🙃

[mimugmail]

Ah, should've following the thread more precisely, thx

[doktornotor]

Tested, 5aaada6 works fine here for #6991

Thanks!