Re: pfctl table cleared time is jumping around

2010-02-24 Thread Dan Harnett
On Wed, Feb 24, 2010 at 08:30:05AM +0100, Henning Brauer wrote: * Dan Harnett dan...@harnett.name [2010-02-23 21:19]: Probably wrong, but this fixes it. i would not call that wrong. i don't understand how this ever worked and I don't understand what broke it. the only commit in that

Re: pfctl table cleared time is jumping around

2010-02-24 Thread Henning Brauer
* Dan Harnett dan...@harnett.name [2010-02-24 15:29]: On Wed, Feb 24, 2010 at 08:30:05AM +0100, Henning Brauer wrote: * Dan Harnett dan...@harnett.name [2010-02-23 21:19]: Probably wrong, but this fixes it. i would not call that wrong. i don't understand how this ever worked

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Dan Harnett
On Mon, Feb 22, 2010 at 10:40:29PM +0100, Michael Lechtermann wrote: it's a slightly weird side-effect. a quick glance indicates that the tzero timestamp is part of the stats struct and tables don't keep stats/counters by default any more. for some time tho. i don't remember any recent

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Henning Brauer
* Dan Harnett dan...@harnett.name [2010-02-23 17:19]: 'pfctl -t tablename -T expire ' is also currently broken. Everything appears to be removed from the table immediately regardless of ''. $ sudo cat /etc/pf.conf table testing persist counters $ sudo pfctl -vv -t testing -T add

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Stuart Henderson
On 2010-02-23, Henning Brauer lists-open...@bsws.de wrote: * Dan Harnett dan...@harnett.name [2010-02-23 17:19]: 'pfctl -t tablename -T expire ' is also currently broken. Everything appears to be removed from the table immediately regardless of ''. $ sudo cat /etc/pf.conf table

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Michael Lechtermann
Hi, I don't remember any changes in that area lately so this puzzles me. do we know when this breakage was introduced, approximately? I found a couple of boxes with May 2009 kernels where expire works as expected. I can't think of anything I have running code dated between then and now to

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Dan Harnett
On Tue, Feb 23, 2010 at 05:24:30PM +0100, Henning Brauer wrote: * Dan Harnett dan...@harnett.name [2010-02-23 17:19]: 'pfctl -t tablename -T expire ' is also currently broken. Everything appears to be removed from the table immediately regardless of ''. $ sudo cat /etc/pf.conf

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Dan Harnett
On Tue, Feb 23, 2010 at 02:28:17PM -0500, Dan Harnett wrote: On Tue, Feb 23, 2010 at 05:24:30PM +0100, Henning Brauer wrote: I don't remember any changes in that area lately so this puzzles me. do we know when this breakage was introduced, approximately? I have narrowed it down to between

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Henning Brauer
* Dan Harnett dan...@harnett.name [2010-02-23 21:19]: On Tue, Feb 23, 2010 at 02:28:17PM -0500, Dan Harnett wrote: On Tue, Feb 23, 2010 at 05:24:30PM +0100, Henning Brauer wrote: I don't remember any changes in that area lately so this puzzles me. do we know when this breakage was

Re: pfctl table cleared time is jumping around

2010-02-22 Thread Michael Lechtermann
Hi, it's a slightly weird side-effect. a quick glance indicates that the tzero timestamp is part of the stats struct and tables don't keep stats/counters by default any more. for some time tho. i don't remember any recent changes to the table code (as if anybody wanted to touch that mess)

Re: pfctl table cleared time is jumping around

2010-02-22 Thread Stuart Henderson
On 2010-02-22, Michael Lechtermann mich...@lechtermann.net wrote: Hi, it's a slightly weird side-effect. a quick glance indicates that the tzero timestamp is part of the stats struct and tables don't keep stats/counters by default any more. for some time tho. i don't remember any recent

Re: pfctl table cleared time is jumping around

2010-02-22 Thread Michael Lechtermann
Hi, it's a slightly weird side-effect. a quick glance indicates that the tzero timestamp is part of the stats struct and tables don't keep stats/counters by default any more. for some time tho. i don't remember any recent changes to the table code (as if anybody wanted to touch that mess)

Re: pfctl table cleared time is jumping around

2010-02-09 Thread Henning Brauer
* Didier Wiroth dwir...@gmail.com [2010-01-23 23:15]: On Wednesday 20 January 2010 23:21:35 Michael Lechtermann wrote: Am 20.01.2010 23:15, schrieb frantisek holop: hmm, on Wed, Jan 20, 2010 at 04:58:32PM +0100, Michael Lechtermann said that it seems there is a bug in pfctl

Re: pfctl table cleared time is jumping around

2010-01-23 Thread Didier Wiroth
On Wednesday 20 January 2010 23:21:35 Michael Lechtermann wrote: Am 20.01.2010 23:15, schrieb frantisek holop: hmm, on Wed, Jan 20, 2010 at 04:58:32PM +0100, Michael Lechtermann said that it seems there is a bug in pfctl regarding the cleared time of a table entry. The attack actually

pfctl table cleared time is jumping around

2010-01-20 Thread Michael Lechtermann
Hi, it seems there is a bug in pfctl regarding the cleared time of a table entry. The attack actually happend this year, but the date shown is constantly changing: # pfctl -t bruteforce -vT show 81.38.199.134 Cleared: Sun Apr 12 18:24:16 2009 88.183.20.179 Cleared:

Re: pfctl table cleared time is jumping around

2010-01-20 Thread frantisek holop
hmm, on Wed, Jan 20, 2010 at 04:58:32PM +0100, Michael Lechtermann said that it seems there is a bug in pfctl regarding the cleared time of a table entry. The attack actually happend this year, but the date shown is constantly changing: been like this forever... -pa-r-- bad-ssh

Re: pfctl table cleared time is jumping around

2010-01-20 Thread Michael Lechtermann
Am 20.01.2010 23:15, schrieb frantisek holop: hmm, on Wed, Jan 20, 2010 at 04:58:32PM +0100, Michael Lechtermann said that it seems there is a bug in pfctl regarding the cleared time of a table entry. The attack actually happend this year, but the date shown is constantly changing: been