[Bug 282877] pfctl: [Feature request] Allow pfctl to reset statistics for an individual IP address

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=282877

            Bug ID: 282877
           Summary: pfctl: [Feature request] Allow pfctl to reset
                    statistics for an individual IP address
           Product: Base System
           Version: 14.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: freebsd@ohreally.nl

Hi,

I'd like to request the implementation of a new feature in pfctl.
This new feature, as stated in the subject, would allow resetting the
statistics for a single IP address.

The resetting of statistics for all IP addresses in a specified table is
already implemented (`pfctl -t sometable -T zero').
However, resetting the statistics for a single IP address in a table would
allow me to continuously block repeat offenders, while releasing one-time
offenders.

The scenario I'm thinking about is as follows:

An offender is added to a certain table, let's call it <blocked>, either by PF
using the 'overload' feature, an external tool like blacklistd or fail2ban, or
manually.
A cronjob expires addresses in table <blocked> after a time period X (`pfctl -t
blocked -T expire 1209600').
An external tool like blacklistd or fail2ban (or something home-brewn) tracks
the PF log, and resets the statistics for offending hosts that are already in
table <blocked>.
This way, repeat offenders will remain in table <blocked> indefinitely, while
hosts that attacked my server 'by accident' will get a retry.

PF already supports the necessary ioctl command DIOCRCLRASTATS, which does
exactly what I want. So only pfctl would need to be patched for this feature to
be implemented.

Actually, thinking FreeBSD pfctl was the same as OpenBSD pfctl, I requested
this feature on the OpenBSD bugs mailing list yesterday. The request was
accepted, and a patch was committed this afternoon.
However, after all this, they told me that the 2 are not the same, and I should
make a new feature request here. So, here it is.

More info can be found on the OpenBSD bugs and tech mailing lists:
https://marc.info/?l=openbsd-bugs&m=173206758904599&w=2
https://marc.info/?l=openbsd-tech&m=173210109222862&w=2

And the definitive OpenBSD patch is here:
https://marc.info/?l=openbsd-tech&m=173210375324534&w=2

Thank you for considering this feature request.

Sincerely,
Rob LA LAU

-- 
You are receiving this mail because:
You are the assignee for the bug.