https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=282877
Bug ID: 282877
Summary: pfctl: [Feature request] Allow pfctl to reset
statistics for an individual IP address
Product: Base System
Version: 14.1-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: bin
Assignee: [email protected]
Reporter: [email protected]
Hi,
I'd like to request the implementation of a new feature in pfctl.
This new feature, as stated in the subject, would allow resetting the
statistics for a single IP address.
The resetting of statistics for all IP addresses in a specified table is
already implemented (`pfctl -t sometable -T zero').
However, resetting the statistics for a single IP address in a table would
allow me to continuously block repeat offenders, while releasing one-time
offenders.
The scenario I'm thinking about is as follows:
An offender is added to a certain table, let's call it <blocked>, either by PF
using the 'overload' feature, an external tool like blacklistd or fail2ban, or
manually.
A cronjob expires addresses in table <blocked> after a time period X (`pfctl -t
blocked -T expire 1209600').
An external tool like blacklistd or fail2ban (or something home-brewn) tracks
the PF log, and resets the statistics for offending hosts that are already in
table <blocked>.
This way, repeat offenders will remain in table <blocked> indefinitely, while
hosts that attacked my server 'by accident' will get a retry.
PF already supports the necessary ioctl command DIOCRCLRASTATS, which does
exactly what I want. So only pfctl would need to be patched for this feature to
be implemented.
Actually, thinking FreeBSD pfctl was the same as OpenBSD pfctl, I requested
this feature on the OpenBSD bugs mailing list yesterday. The request was
accepted, and a patch was committed this afternoon.
However, after all this, they told me that the 2 are not the same, and I should
make a new feature request here. So, here it is.
More info can be found on the OpenBSD bugs and tech mailing lists:
https://marc.info/?l=openbsd-bugs&m=173206758904599&w=2
https://marc.info/?l=openbsd-tech&m=173210109222862&w=2
And the definitive OpenBSD patch is here:
https://marc.info/?l=openbsd-tech&m=173210375324534&w=2
Thank you for considering this feature request.
Sincerely,
Rob LA LAU
--
You are receiving this mail because:
You are the assignee for the bug.
