On Thu, Apr 7, 2011 at 5:14 PM, Quentin Narvor <quentin.nar...@gmail.com> wrote: > 2011/4/7 Ermal Luçi <e...@freebsd.org> > >> On Thu, Apr 7, 2011 at 10:21 AM, Quentin Narvor >> <quentin.nar...@gmail.com> wrote: >> > Hello, >> > >> > My name is Quentin Narvor and I am currently working on intrusion >> detection. >> > I use Freebsd 8.2 and I recently needed pf to be able to dynamically fill >> in >> > tables according pass rule. >> > >> > For performances reasons, I didn't want to do it with a script and pfctl. >> > Then, with the help of Mr Nicolas Greneche, I made this patch named >> "add". >> > It enables pf to add src ip or dst ip in a table when a match occurs on a >> > pass rule. >> > >> >> I cannot see, apart collecting ips in tables, anything else that >> cannot be done through pf(4) tags! >> Can you please describe a use case for this patch? > > > Indeed, it enables pf to change its behaviour toward some hosts dynamically. > I will build a blacklist of ip which have been recognized as compromized > (botnets, spam, etc). I build a table with thoses IP. > > If I match a connection between one host of my internal network and one > blacklisted ip, there are chances that this host is infected. > I want to do a comprehensive capture of this host connections by adding src > ip to a table of hosts to watch. A dup-to rule dump traffic from "host to > watch" table to a sensor. > > Here are the rules : > pass in on $int_if from any to <blacklist> add ipsrc <infected_hosts> > pass in on $int_if dup-to ($sensor_if, sensor_ip) from <infected_hosts> to > any
Hmm, the below should work. ..... pass in on $int_if from any to <blacklist> tag SUSPECT pass in on $int_if dup-to ($sensor_if, sensor_ip) from all tagged SUSPECT ..... > > Unless I miss something, I think it is not possible to make this example > just with pf(4) tags : it would have been possible if I wanted to copy only > the traffic between my hosts and botnets. > > >> > I submit this patch to your attention. Is this feature is of interest to >> be >> > added in PF mainstream ? >> > >> > You will find the patch and its documentation in attachment. >> > Let me know if you think that some modifications are needed. >> > >> > Best regards, >> > >> > Quentin Narvor >> > >> > _______________________________________________ >> > freebsd-net@freebsd.org mailing list >> > http://lists.freebsd.org/mailman/listinfo/freebsd-net >> > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" >> > >> >> >> >> -- >> Ermal >> > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" > -- Ermal _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
