Date: Wed, 20 Nov 2024 17:43:33 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 282877] pfctl: [Feature request] Allow pfctl to reset statistics for an individual IP address Message-ID: <bug-282877-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D282877 Bug ID: 282877 Summary: pfctl: [Feature request] Allow pfctl to reset statistics for an individual IP address Product: Base System Version: 14.1-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: bin Assignee: bugs@FreeBSD.org Reporter: freebsd@ohreally.nl Hi, I'd like to request the implementation of a new feature in pfctl. This new feature, as stated in the subject, would allow resetting the statistics for a single IP address. The resetting of statistics for all IP addresses in a specified table is already implemented (`pfctl -t sometable -T zero'). However, resetting the statistics for a single IP address in a table would allow me to continuously block repeat offenders, while releasing one-time offenders. The scenario I'm thinking about is as follows: An offender is added to a certain table, let's call it <blocked>, either by= PF using the 'overload' feature, an external tool like blacklistd or fail2ban,= or manually. A cronjob expires addresses in table <blocked> after a time period X (`pfct= l -t blocked -T expire 1209600'). An external tool like blacklistd or fail2ban (or something home-brewn) trac= ks the PF log, and resets the statistics for offending hosts that are already = in table <blocked>. This way, repeat offenders will remain in table <blocked> indefinitely, whi= le hosts that attacked my server 'by accident' will get a retry. PF already supports the necessary ioctl command DIOCRCLRASTATS, which does exactly what I want. So only pfctl would need to be patched for this featur= e to be implemented. Actually, thinking FreeBSD pfctl was the same as OpenBSD pfctl, I requested this feature on the OpenBSD bugs mailing list yesterday. The request was accepted, and a patch was committed this afternoon. However, after all this, they told me that the 2 are not the same, and I sh= ould make a new feature request here. So, here it is. More info can be found on the OpenBSD bugs and tech mailing lists: https://marc.info/?l=3Dopenbsd-bugs&m=3D173206758904599&w=3D2 https://marc.info/?l=3Dopenbsd-tech&m=3D173210109222862&w=3D2 And the definitive OpenBSD patch is here: https://marc.info/?l=3Dopenbsd-tech&m=3D173210375324534&w=3D2 Thank you for considering this feature request. Sincerely, Rob LA LAU --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-282877-227>