Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/external/bsd/blacklist The original blacklist library suppor...
details: https://anonhg.NetBSD.org/src/rev/28a9db27785c
branches: trunk
changeset: 846247:28a9db27785c
user: christos <christos%NetBSD.org@localhost>
date: Wed Nov 06 20:50:01 2019 +0000
description:
The original blacklist library supported two operations - a
notification of a failed auth attempt, and a notification of a
successful auth attempt.
Implements a third option - notification of abusive behavior, and
accepts, but does not act on a forth type - "bad username". It is
envisioned that a system administrator will configure a small list
of "known bad usernames" that should be blocked immediately.
>From Kurt Lidl @ FreeBSD
diffstat:
external/bsd/blacklist/bin/blacklistd.c | 18 ++++++++++-
external/bsd/blacklist/include/bl.h | 6 ++-
external/bsd/blacklist/include/blacklist.h | 11 ++++++-
external/bsd/blacklist/lib/blacklist.c | 26 +++++++++++++++--
external/bsd/blacklist/lib/libblacklist.3 | 45 +++++++++++++++++++++++------
5 files changed, 88 insertions(+), 18 deletions(-)
diffs (217 lines):
diff -r f5aadedeb97c -r 28a9db27785c external/bsd/blacklist/bin/blacklistd.c
--- a/external/bsd/blacklist/bin/blacklistd.c Wed Nov 06 20:33:30 2019 +0000
+++ b/external/bsd/blacklist/bin/blacklistd.c Wed Nov 06 20:50:01 2019 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: blacklistd.c,v 1.38 2019/02/27 02:20:18 christos Exp $ */
+/* $NetBSD: blacklistd.c,v 1.39 2019/11/06 20:50:01 christos Exp $ */
/*-
* Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,7 +32,7 @@
#include "config.h"
#endif
#include <sys/cdefs.h>
-__RCSID("$NetBSD: blacklistd.c,v 1.38 2019/02/27 02:20:18 christos Exp $");
+__RCSID("$NetBSD: blacklistd.c,v 1.39 2019/11/06 20:50:01 christos Exp $");
#include <sys/types.h>
#include <sys/socket.h>
@@ -214,6 +214,17 @@
}
switch (bi->bi_type) {
+ case BL_ABUSE:
+ /*
+ * If the application has signaled abusive behavior,
+ * set the number of fails to be one less than the
+ * configured limit. Fallthrough to the normal BL_ADD
+ * processing, which will increment the failure count
+ * to the threshhold, and block the abusive address.
+ */
+ if (c.c_nfail != -1)
+ dbi.count = c.c_nfail - 1;
+ /*FALLTHROUGH*/
case BL_ADD:
dbi.count++;
dbi.last = ts.tv_sec;
@@ -249,6 +260,9 @@
dbi.count = 0;
dbi.last = 0;
break;
+ case BL_BADUSER:
+ /* ignore for now */
+ break;
default:
(*lfun)(LOG_ERR, "unknown message %d", bi->bi_type);
}
diff -r f5aadedeb97c -r 28a9db27785c external/bsd/blacklist/include/bl.h
--- a/external/bsd/blacklist/include/bl.h Wed Nov 06 20:33:30 2019 +0000
+++ b/external/bsd/blacklist/include/bl.h Wed Nov 06 20:50:01 2019 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: bl.h,v 1.13 2016/03/11 17:16:40 christos Exp $ */
+/* $NetBSD: bl.h,v 1.14 2019/11/06 20:50:01 christos Exp $ */
/*-
* Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -40,7 +40,9 @@
typedef enum {
BL_INVALID,
BL_ADD,
- BL_DELETE
+ BL_DELETE,
+ BL_ABUSE,
+ BL_BADUSER
} bl_type_t;
typedef struct {
diff -r f5aadedeb97c -r 28a9db27785c external/bsd/blacklist/include/blacklist.h
--- a/external/bsd/blacklist/include/blacklist.h Wed Nov 06 20:33:30 2019 +0000
+++ b/external/bsd/blacklist/include/blacklist.h Wed Nov 06 20:50:01 2019 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: blacklist.h,v 1.3 2015/01/23 18:48:56 christos Exp $ */
+/* $NetBSD: blacklist.h,v 1.4 2019/11/06 20:50:01 christos Exp $ */
/*-
* Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -43,4 +43,13 @@
const struct sockaddr *, socklen_t, const char *);
__END_DECLS
+/* action values for user applications */
+#define BLACKLIST_API_ENUM 1
+enum {
+ BLACKLIST_AUTH_OK = 0,
+ BLACKLIST_AUTH_FAIL,
+ BLACKLIST_ABUSIVE_BEHAVIOR,
+ BLACKLIST_BAD_USER
+};
+
#endif /* _BLACKLIST_H */
diff -r f5aadedeb97c -r 28a9db27785c external/bsd/blacklist/lib/blacklist.c
--- a/external/bsd/blacklist/lib/blacklist.c Wed Nov 06 20:33:30 2019 +0000
+++ b/external/bsd/blacklist/lib/blacklist.c Wed Nov 06 20:50:01 2019 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: blacklist.c,v 1.5 2015/01/22 16:19:53 christos Exp $ */
+/* $NetBSD: blacklist.c,v 1.6 2019/11/06 20:50:01 christos Exp $ */
/*-
* Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -33,7 +33,7 @@
#endif
#include <sys/cdefs.h>
-__RCSID("$NetBSD: blacklist.c,v 1.5 2015/01/22 16:19:53 christos Exp $");
+__RCSID("$NetBSD: blacklist.c,v 1.6 2019/11/06 20:50:01 christos Exp $");
#include <stdio.h>
#include <bl.h>
@@ -61,7 +61,27 @@
blacklist_sa_r(struct blacklist *bl, int action, int rfd,
const struct sockaddr *sa, socklen_t slen, const char *msg)
{
- return bl_send(bl, action ? BL_ADD : BL_DELETE, rfd, sa, slen, msg);
+ int internal_action;
+
+ /* internal values are not the same as user application values */
+ switch (action) {
+ case BLACKLIST_AUTH_FAIL:
+ internal_action = BL_ADD;
+ break;
+ case BLACKLIST_AUTH_OK:
+ internal_action = BL_DELETE;
+ break;
+ case BLACKLIST_ABUSIVE_BEHAVIOR:
+ internal_action = BL_ABUSE;
+ break;
+ case BLACKLIST_BAD_USER:
+ internal_action = BL_BADUSER;
+ break;
+ default:
+ internal_action = BL_INVALID;
+ break;
+ }
+ return bl_send(bl, internal_action, rfd, sa, slen, msg);
}
int
diff -r f5aadedeb97c -r 28a9db27785c external/bsd/blacklist/lib/libblacklist.3
--- a/external/bsd/blacklist/lib/libblacklist.3 Wed Nov 06 20:33:30 2019 +0000
+++ b/external/bsd/blacklist/lib/libblacklist.3 Wed Nov 06 20:50:01 2019 +0000
@@ -1,4 +1,4 @@
-.\" $NetBSD: libblacklist.3,v 1.8 2017/10/22 10:31:57 abhinav Exp $
+.\" $NetBSD: libblacklist.3,v 1.9 2019/11/06 20:50:01 christos Exp $
.\"
.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
.\" All rights reserved.
@@ -27,7 +27,7 @@
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd January 22, 2015
+.Dd May 5, 2017
.Dt LIBBLACKLIST 3
.Os
.Sh NAME
@@ -76,13 +76,9 @@
.Fn blacklist
function sends a message to
.Xr blacklistd 8 ,
-with an
+with an integer
.Ar action
-argument specifying
-.Dv 1
-for a failed connection or
-.Dv 0
-for a successful connection,
+argument specifying the type of notification,
a file descriptor
.Ar fd
specifying the accepted file descriptor connected to the client,
@@ -91,6 +87,30 @@
argument.
.Pp
The
+.Ar action
+parameter can take these values:
+.Bl -tag -width ".Va BLACKLIST_ABUSIVE_BEHAVIOR"
+.It Va BLACKLIST_AUTH_FAIL
+There was an unsuccessful authentication attempt.
+.It Va BLACKLIST_AUTH_OK
+A user successfully authenticated.
+.It Va BLACKLIST_ABUSIVE_BEHAVIOR
+The sending daemon has detected abusive behavior
+from the remote system. The remote address should
+be blocked as soon as possible.
+.It Va BLACKLIST_BAD_USER
+The sending daemon has determined the username
+presented for authentication is invalid. The
+.Xr blacklistd 8
+daemon compares the username to a configured list of forbidden
+usernames and
+blocks the address immediately if a forbidden username matches.
+(The
+.Ar BLACKLIST_BAD_USER
+support is not currently available.)
+.El
+.Pp
+The
.Fn blacklist_r
function is more efficient because it keeps the blacklist state around.
.Pp
@@ -102,8 +122,13 @@
.Xr getpeername 2
will not work, the server will pass the peer name in the message.
.Pp
-All functions log errors to
-.Xr syslogd 8 .
+By default,
+.Xr syslogd 8
+is used for message logging.
+The internal
+.Fn bl_create
+function can be used to create the required internal
+state and specify a custom logging function.
.Sh RETURN VALUES
The function
.Fn blacklist_open
Home |
Main Index |
Thread Index |
Old Index