Adding a category field to each description. Categorized abuse can then be reported to external sites, for example AbudeIPDB.
This release includes a redistribution of jsmn JSON parsing library. It consists of a single include file. Using that and libcurl an easily coded RDAP client, abuserdap makes its entry into ipqbdb.
ibd-parse -v and ibd-ban -l log the relevant operations in a uniform fashion. A script, exemplified by ibd-report reads those logs providing reports that give more insight of abusive behavior.
A bug fix and minor adjustments complete the release.
Changes and new features:
ibd-parse:
INSTALL:
ibd-del:
ibd-judge:
ibd-config:
Miscellaneous fixes for compiling and documentations.
New man pages for ibd-judge and ibd-parse.
Maintenance release enabling BDB version 5.*, and minor changes including:
Changes and new features:
When this option is given, if an updated address reaches 100% block probability then an external command is invoked. The command is to be configured in a new configuration file, and presumably kills any established connection. Using "conntrack -D" seems to work well, as it allows the stateful firewall to thereafter detect extraneous packets on its own.
This is more efficient than filtering each output packet in order to mark unwanted ones, as it doesn't imply queuing to user space. The two methods are not exactly equivalent, but they can be used concurrently.
After some months, it seems linking with the newer version of libnetfilter_queue fixes the behavior when a queue error is experienced. Ipqbdb v1.02 logs such error and continues to run smoothly. That error --recv() returning -1 retrieving a message from the queue-- happens very seldom and is still being investigated.
Note that libnetfilter_queue has recently released version 1.0.0; some distribution still have 0.0.13; upgrading to 0.0.17 is recommended. More info in README* and INSTALL files in v1.02.
In the new version I've renamed the ipqbdbd daemon to ibd-judge, as it emits verdicts. That way it's easier to grep logs or processes. New features are
The 0.1 release has been running smoothly on a 64bit Intel debian system since December 16, 2008. It has a unique queue. Parsing consumes much more than actual filtering.
It did catch the lame dictionary attack that it has been designed to block!
I have about 5000 records in the database that serves the only one queue set up by the filter. Now I'm programming to collect some statistical data, in order to help adjusting what behaviors deserve being caught. This change implies altering the layout of db records, which will require starting new databases and a change in the major release number, i.e. to 1.0.