Automatic expiry at timeout for pf(4) overload tables (opens in new tab)

Network-oriented readers will be familiar with the concept of overload tables, commonly used with state tracking options to create adaptive rulesets for such things as punishing password-guessing botnets. A downside to tables that would tend to fill up indefinitely is that at some point they will be quite full, and the administrator would need to either manually run pfctl expire or set up a crontab entry to weed out old entries at intervals. Now Alexandr Nedvedicky (sashan@) is airing a patch...