Discussion: Sanity checking URL aliases

[pfry]

Seems desirable offhand, as bad values could ruin your day.

Easier checks, likely of limited use:

• Entropy (most likely changes since last load)
• Block size (v4/v6)
• Reserved blocks (another alias)

Possible actions:

• Block update (do not update table/alias)
• Filter matching elements
• Alert (send some sort of notification, perhaps combined with block/filter)

The only really useful sanity check I can think of would be to match accessed IPs. That is, keep a history of the n most common source and destination IPs passing through the firewall (stateful only), and match alias elements to that history. OPNsense has top ten sources/destinations, but I'd be looking at n=(a lot more), and preservation through reboots. Could be a fairly expensive feature (memory, possibly computation).

Thoughts?