Hello
I have been having a problem trying to use the stateful tracking
option "override <TABLE> flush" in OpenBSD 4.7-stable. My system is
a i386 GENERIC system, running as a vmware guest under Windows XP.
Consider the following ruleset:
set skip on lo
block drop all
block drop quick from <BLACKLIST> to any
pass out on egress inet all
pass in inet proto tcp from any to (self) port ssh keep state \
(max 20, max-src-conn-rate 2/20, overload <BLACKLIST> flush)
My understanding of the pf.conf(5) manual is that if the connection
rate is exceeded, the offending source host will be added to
the <BLACKLIST> table, and all states created by the matching rule
which originate from the offending host will be killed.
I tested the ruleset by ssh'ing from the vmware host into the vmware
guest (openbsd 4.7). After the 2nd ssh session is logged in, the
OpenBSD system will not accept anymore connections (expected
behaviour), but the first two sessions remain operational, in other
words, the states have not been killed. I've appended the output
of "pfctl -ss -vv".
The problem I'm seeing is that while IP addresses are in fact added
to <BLACKLIST> when the connection rate is exceeded, the flush
command has no effect. I tried "flush global" as well, but that made
no difference. I also tried "synproxy state" and "modulate state" to no avail.
Would someone know if I there is an error in my understanding, in my ruleset, or is this a problem?
By the way, I also tried the same ruleset on each stable distribution
back to 4.2. I get the behaviour described in the manual on 4.2 and
4.3, but from 4.4 onwards the flush does not seem to have any effect.
Kind regards
Robert Mills
-------------------------------------------
FILTER RULES:
@0 block drop all
[ Evaluations: 9 Packets: 4 Bytes: 192 States: 0 ]
[ Inserted: uid 0 pid 12362 State Creations: 0 ]
@1 block drop quick from <BLACKLIST:1> to any
[ Evaluations: 9 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 12362 State Creations: 0 ]
@2 pass out on egress inet all flags S/SA keep state
[ Evaluations: 9 Packets: 4 Bytes: 470 States: 0 ]
[ Inserted: uid 0 pid 12362 State Creations: 2 ]
@3 pass in inet proto tcp from any to (self:2) port = ssh flags S/SA keep state (max 20, source-track rule, max-src-conn-rate 2/20, overload <BLACKLIST> flush, adaptive.start 12, adaptive.end 24, src.track 20)
[ Evaluations: 9 Packets: 98 Bytes: 14516 States: 2 ]
[ Inserted: uid 0 pid 12362 State Creations: 3 ]
No queue in use
STATES:
all tcp 192.168.9.133:22 <- 192.168.9.1:1184 ESTABLISHED:ESTABLISHED
[4060316721 + 65535] [419322259 + 17520]
age 00:00:50, expires in 23:59:11, 21:27 pkts, 2933:4301 bytes, rule 3, source-track
id: 4c6def3e00000061 creatorid: d3c137f4
all tcp 192.168.9.133:22 <- 192.168.9.1:1189 ESTABLISHED:ESTABLISHED
[1683884458 + 65535] [4062748640 + 17520]
age 00:00:48, expires in 23:59:13, 21:27 pkts, 2933:4253 bytes, rule 3, source-track
id: 4c6def3e00000063 creatorid: d3c137f4
SOURCE TRACKING NODES:
192.168.9.1 ( states 2, connections 2, rate 0.0/20s )
age 00:00:50, 98 pkts, 14516 bytes, rule 3
INFO:
Status: Enabled for 0 days 00:00:53 Debug: err
Hostid: 0xd3c137f4
Checksum: 0xace54961a7d232676d422b5a8cf754c7
State Table Total Rate
current entries 2
searches 529 10.0/s
inserts 102 1.9/s
removals 100 1.9/s
Source Tracking Table
current entries 1
searches 3 0.1/s
inserts 1 0.0/s
removals 0 0.0/s
Counters
match 108 2.0/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 0 0.0/s
proto-cksum 0 0.0/s
state-mismatch 0 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 1 0.0/s
synproxy 0 0.0/s
Limit Counters
max states per rule 0 0.0/s
max-src-states 0 0.0/s
max-src-nodes 0 0.0/s
max-src-conn 0 0.0/s
max-src-conn-rate 1 0.0/s
overload table insertion 1 0.0/s
overload flush states 1 0.0/s
TIMEOUTS:
tcp.first 120s
tcp.opening 30s
tcp.established 86400s
tcp.closing 900s
tcp.finwait 45s
tcp.closed 90s
tcp.tsdiff 30s
udp.first 60s
udp.single 30s
udp.multiple 60s
icmp.first 20s
icmp.error 10s
other.first 60s
other.single 30s
other.multiple 60s
frag 30s
interval 10s
adaptive.start 6000 states
adaptive.end 12000 states
src.track 0s
LIMITS:
states hard limit 10000
src-nodes hard limit 10000
frags hard limit 5000
tables hard limit 1000
table-entries hard limit 200000
TABLES:
--a-r-- BLACKLIST
Addresses: 1
Cleared: Fri Aug 20 14:07:29 2010
References: [ Anchors: 0 Rules: 2 ]
Evaluations: [ NoMatch: 9 Match: 0 ]
In/Block: [ Packets: 0 Bytes: 0 ]
In/Pass: [ Packets: 0 Bytes: 0 ]
In/XPass: [ Packets: 0 Bytes: 0 ]
Out/Block: [ Packets: 0 Bytes: 0 ]
Out/Pass: [ Packets: 0 Bytes: 0 ]
Out/XPass: [ Packets: 0 Bytes: 0 ]
OS FINGERPRINTS:
696 fingerprints loaded
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.