IPQ BDB filter - News
posted by ale2003, Tue 09 Apr 2024 04:33:38 PM UTC
The main change is doing IPv6.
Version 2.00 can be installed over previous versions, as database format didn't change. DB files for IPv6 are created anew, using the names of IPv4 files and adding "6" to the base name.
[...]
posted by ale2003, Wed 20 Jan 2021 12:37:52 PM UTC
Adding a category field to each description. Categorized abuse can then be reported to external sites, for example AbudeIPDB.
posted by ale2003, Sat 02 Nov 2019 05:43:14 PM UTC
This release includes a redistribution of jsmn JSON parsing library. It consists of a single include file. Using that and libcurl an easily coded RDAP client, abuserdap makes its entry into ipqbdb. [...]
posted by ale2003, Thu 06 Jun 2019 12:04:08 PM UTC
Changes and new features:
ibd-parse:
- added optional IPv6 prefix in the <HOST> replacement, so as to catch IPv4-mapped or -compatible address,
- tweak log line adding descr for changes,
- add elapsed time in summary line,
posted by ale2003, Thu 12 Sep 2013 03:58:27 PM UTC
Maintenance release enabling BDB version 5.*, and minor changes including:
- Man pages for ibd-del, ibd-ban, and ibd-white. More man pages will be added soon.
- Allow multiple addresses to be passed in a single ibd-ban command.
- Accept IPv4 mapped IPv6 addresses. (These tools will only store IPv4 addresses until I get a real IPv6 host address to experiment with.)
- Decay treatment tweaks: Default value changed from 2 mins to 6 hours, and decay doubled on passing the threshold.
posted by ale2003, Thu 10 Mar 2011 06:44:09 PM UTC
Changes and new features:
- New option --exec-connkill (-e for short) in ibd-ban and ibd-parse. Detailed below.
- ibd-config displays the new configuration file, and also the maximum initial-count that the architecture supports.
- New options for ibd-judge allow to configure nfnetfilter buffer size, ENOBUFS error notification, and each
posted by ale2003, Fri 30 Jul 2010 06:37:55 PM UTC
After some months, it seems linking with the newer version of libnetfilter_queue fixes the behavior when a queue error is experienced. Ipqbdb v1.02 logs such error and continues to run smoothly. That error --recv() returning -1 retrieving a message from the queue-- happens very seldom and is still being investigated. [...]
posted by ale2003, Sun 24 Jan 2010 06:46:53 PM UTC
In the new version I've renamed the ipqbdbd daemon to ibd-judge, as it emits verdicts. That way it's easier to grep logs or processes. New features are
- terminate established connections by letting iptables send tcp-reset to the local server for packets marked guilty,
- specify the target database size when deleting old records, and
- collect statistics.
posted by ale2003, Tue 23 Dec 2008 04:59:10 PM UTC
The 0.1 release has been running smoothly on a 64bit Intel debian system since December 16, 2008. It has a unique queue. Parsing consumes much more than actual filtering.
It did catch the lame dictionary attack that it has been designed to block!
[...]
Powered by Savane 3.14-8aba.
Corresponding source code