IPQ BDB filter - News
Released v1.03
Item posted by Alessandro Vesely <ale2003> on Thu 10 Mar 2011 06:44:09 PM UTC.
Changes and new features:
- New option --exec-connkill (-e for short) in ibd-ban and ibd-parse. Detailed below.
- ibd-config displays the new configuration file, and also the maximum initial-count that the architecture supports.
- New options for ibd-judge allow to configure nfnetfilter buffer size, ENOBUFS error notification, and each queue's max length.
- Most listing options of ibd-del (--ls, --ls-ban) now compute decay so as to display the percentage that would effectively result in case a packet arrives from the corresponding IP at the present time.
exec-connkill
When this option is given, if an updated address reaches 100% block probability then an external command is invoked. The command is to be configured in a new configuration file, and presumably kills any established connection. Using "conntrack -D" seems to work well, as it allows the stateful firewall to thereafter detect extraneous packets on its own.
This is more efficient than filtering each output packet in order to mark unwanted ones, as it doesn't imply queuing to user space. The two methods are not exactly equivalent, but they can be used concurrently.
Powered by Savane 3.14-f13d.
Corresponding source code