Date: Thu, 01 Dec 2016 15:58:35 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-amd64@FreeBSD.org Subject: [Bug 214980] blacklistd and sshd incorrect counting of failed login attempts Message-ID: <bug-214980-6-3lMXk3gpHS@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-214980-6@https.bugs.freebsd.org/bugzilla/> References: <bug-214980-6@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D214980 --- Comment #1 from Kurt Lidl <lidl@FreeBSD.org> --- The relevant bit of the current blacklist-helper script: ipfw) # use $ipfw_offset+$port for rule number rule=3D$(($ipfw_offset + $6)) tname=3D"port$6" /sbin/ipfw table $tname create type addr 2>/dev/null /sbin/ipfw -q table $tname add "$addr/$mask" /sbin/ipfw -q add $rule drop $3 from "table("$tname")" to \ any dst-port $6 && echo OK ;; I think that the problem is the '-q' on the last line is forcing "quiet" behaviour, and (I missed this when adapting the code from 'pf'), it no longer errors out on duplicate rules with the same number. There's two different ways to address this that come to mind immediately: 1) Check to see if the rule exists before attempting to add it, and if it already exists, don't add it a second time. 2) Attempt to add the rule without -q, but with stderr redirected to /dev/n= ull. I don't particularly like this, as it means that otherwise legitimate errors cannot be handled. I'll take a stab at implementing #1 in the next few days. (My dev machines run 'pf'.) --=20 You are receiving this mail because: You are on the CC list for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-214980-6-3lMXk3gpHS>