Re: pfctl table cleared time is jumping around

2010-02-24 Thread Henning Brauer
* Dan Harnett [2010-02-24 15:29]: > On Wed, Feb 24, 2010 at 08:30:05AM +0100, Henning Brauer wrote: > > * Dan Harnett [2010-02-23 21:19]: > > > > > > Probably wrong, but this fixes it. > > > > i would not call that wrong. > > > > i don't understand how this ever worked and I don't understand w

Re: pfctl table cleared time is jumping around

2010-02-24 Thread Dan Harnett
On Wed, Feb 24, 2010 at 08:30:05AM +0100, Henning Brauer wrote: > * Dan Harnett [2010-02-23 21:19]: > > > > Probably wrong, but this fixes it. > > i would not call that wrong. > > i don't understand how this ever worked and I don't understand what > broke it. the only commit in that timeframe t

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Henning Brauer
* Dan Harnett [2010-02-23 21:19]: > On Tue, Feb 23, 2010 at 02:28:17PM -0500, Dan Harnett wrote: > > On Tue, Feb 23, 2010 at 05:24:30PM +0100, Henning Brauer wrote: > > > I don't remember any changes in that area lately so this puzzles me. > > > do we know when this breakage was introduced, approx

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Dan Harnett
On Tue, Feb 23, 2010 at 02:28:17PM -0500, Dan Harnett wrote: > On Tue, Feb 23, 2010 at 05:24:30PM +0100, Henning Brauer wrote: > > I don't remember any changes in that area lately so this puzzles me. > > do we know when this breakage was introduced, approximately? > > I have narrowed it down to be

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Dan Harnett
On Tue, Feb 23, 2010 at 05:24:30PM +0100, Henning Brauer wrote: > * Dan Harnett [2010-02-23 17:19]: > > 'pfctl -t tablename -T expire ' is also currently broken. > > Everything appears to be removed from the table immediately regardless > > of ''. > > > > $ sudo cat /etc/pf.conf > > table

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Michael Lechtermann
Hi, >> I don't remember any changes in that area lately so this puzzles me. >> do we know when this breakage was introduced, approximately? >> > > I found a couple of boxes with May 2009 kernels where expire > works as expected. I can't think of anything I have running code > dated between then a

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Stuart Henderson
On 2010-02-23, Henning Brauer wrote: > * Dan Harnett [2010-02-23 17:19]: >> 'pfctl -t tablename -T expire ' is also currently broken. >> Everything appears to be removed from the table immediately regardless >> of ''. >> >> $ sudo cat /etc/pf.conf >> table persist counters >> >> $ sudo

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Henning Brauer
* Dan Harnett [2010-02-23 17:19]: > 'pfctl -t tablename -T expire ' is also currently broken. > Everything appears to be removed from the table immediately regardless > of ''. > > $ sudo cat /etc/pf.conf > table persist counters > > $ sudo pfctl -vv -t testing -T add 172.16.1.8 172.16.1

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Dan Harnett
On Mon, Feb 22, 2010 at 10:40:29PM +0100, Michael Lechtermann wrote: > >>> it's a slightly weird side-effect. a quick glance indicates that the > >>> tzero timestamp is part of the stats struct and tables don't keep > >>> stats/counters by default any more. for some time tho. i don't > >>> remember

Re: pfctl table cleared time is jumping around

2010-02-23 Thread Henning Brauer
* Michael Lechtermann [2010-02-22 22:45]: > Hi, > > >>> it's a slightly weird side-effect. a quick glance indicates that the > >>> tzero timestamp is part of the stats struct and tables don't keep > >>> stats/counters by default any more. for some time tho. i don't > >>> remember any recent chang

Re: pfctl table cleared time is jumping around

2010-02-22 Thread Michael Lechtermann
Hi, >>> it's a slightly weird side-effect. a quick glance indicates that the >>> tzero timestamp is part of the stats struct and tables don't keep >>> stats/counters by default any more. for some time tho. i don't >>> remember any recent changes to the table code (as if anybody wanted to >>> touch

Re: pfctl table cleared time is jumping around

2010-02-22 Thread Stuart Henderson
On 2010-02-22, Michael Lechtermann wrote: > Hi, > >> it's a slightly weird side-effect. a quick glance indicates that the >> tzero timestamp is part of the stats struct and tables don't keep >> stats/counters by default any more. for some time tho. i don't >> remember any recent changes to the tab

Re: pfctl table cleared time is jumping around

2010-02-22 Thread Michael Lechtermann
Hi, > it's a slightly weird side-effect. a quick glance indicates that the > tzero timestamp is part of the stats struct and tables don't keep > stats/counters by default any more. for some time tho. i don't > remember any recent changes to the table code (as if anybody wanted to > touch that mess

Re: pfctl table cleared time is jumping around

2010-02-09 Thread Henning Brauer
* Didier Wiroth [2010-01-23 23:15]: > On Wednesday 20 January 2010 23:21:35 Michael Lechtermann wrote: > > Am 20.01.2010 23:15, schrieb frantisek holop: > > > hmm, on Wed, Jan 20, 2010 at 04:58:32PM +0100, Michael Lechtermann said > > > that > > > > > >> it seems there is a bug in pfctl regarding

Re: pfctl table cleared time is jumping around

2010-01-23 Thread Didier Wiroth
On Wednesday 20 January 2010 23:21:35 Michael Lechtermann wrote: > Am 20.01.2010 23:15, schrieb frantisek holop: > > hmm, on Wed, Jan 20, 2010 at 04:58:32PM +0100, Michael Lechtermann said > > that > > > >> it seems there is a bug in pfctl regarding the cleared time of a table > >> entry. The attac

Re: pfctl table cleared time is jumping around

2010-01-20 Thread Michael Lechtermann
Am 20.01.2010 23:15, schrieb frantisek holop: > hmm, on Wed, Jan 20, 2010 at 04:58:32PM +0100, Michael Lechtermann said that >> it seems there is a bug in pfctl regarding the cleared time of a table >> entry. The attack actually happend this year, but the date shown is >> constantly changing: > >

Re: pfctl table cleared time is jumping around

2010-01-20 Thread frantisek holop
hmm, on Wed, Jan 20, 2010 at 04:58:32PM +0100, Michael Lechtermann said that > it seems there is a bug in pfctl regarding the cleared time of a table > entry. The attack actually happend this year, but the date shown is > constantly changing: been like this forever... -pa-r-- bad-ssh Addr

pfctl table cleared time is jumping around

2010-01-20 Thread Michael Lechtermann
Hi, it seems there is a bug in pfctl regarding the cleared time of a table entry. The attack actually happend this year, but the date shown is constantly changing: # pfctl -t bruteforce -vT show 81.38.199.134 Cleared: Sun Apr 12 18:24:16 2009 88.183.20.179 Cleared: S