Import NetBSD's blacklist source from vendor tree

This import includes The basic blacklist library and utility programs,
to add a system-wide packet filtering notification mechanism to
FreeBSD.

The rational behind the daemon was given by Christos Zoulas in a
presentation at vBSDcon 2015: https://youtu.be/fuuf8G28mjs

Reviewed by:	rpaulo
Approved by:	rpaulo
Obtained from:	NetBSD
Relnotes:	YES
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D5912

16 files changed, 1757 insertions, 0 deletions

diff --git a/contrib/blacklist/port/Makefile.am b/contrib/blacklist/port/Makefile.am
new file mode 100644
index 000000000000..f1b36ca880a3
--- /dev/null
+++ b/contrib/blacklist/port/Makefile.am
@@ -0,0 +1,25 @@
+#
+ACLOCAL_AMFLAGS = -I m4
+lib_LTLIBRARIES = libblacklist.la
+include_HEADERS = blacklist.h
+
+bin_PROGRAMS = blacklistd blacklistctl srvtest cltest
+
+VPATH = ../bin:../lib:../test
+
+AM_CPPFLAGS = -I../include  -DDOT="."
+AM_CFLAGS = @WARNINGS@
+
+libblacklist_la_SOURCES = bl.c blacklist.c
+libblacklist_la_LDFLAGS = -no-undefined -version-info 0:0:0
+libblacklist_la_LIBADD = $(LTLIBOBJS)
+
+SRCS = internal.c support.c run.c conf.c state.c
+blacklistd_SOURCES = blacklistd.c ${SRCS}
+blacklistd_LDADD = libblacklist.la
+blacklistctl_SOURCES = blacklistctl.c ${SRCS}
+blacklistctl_LDADD = libblacklist.la
+srvtest_SOURCES = srvtest.c ${SRCS}
+srvtest_LDADD = libblacklist.la
+cltest_SOURCES = cltest.c ${SRCS}
+cltest_LDADD = libblacklist.la
diff --git a/contrib/blacklist/port/_strtoi.h b/contrib/blacklist/port/_strtoi.h
new file mode 100644
index 000000000000..4b2b4e80f0d8
--- /dev/null
+++ b/contrib/blacklist/port/_strtoi.h
@@ -0,0 +1,93 @@
+/*	$NetBSD: _strtoi.h,v 1.1 2015/01/22 02:15:59 christos Exp $	*/
+
+/*-
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * Original version ID:
+ * NetBSD: src/lib/libc/locale/_wcstoul.h,v 1.2 2003/08/07 16:43:03 agc Exp
+ *
+ * Created by Kamil Rytarowski, based on ID:
+ * NetBSD: src/common/lib/libc/stdlib/_strtoul.h,v 1.7 2013/05/17 12:55:56 joerg Exp
+ */
+
+/*
+ * function template for strtoi and strtou
+ *
+ * parameters:
+ *	_FUNCNAME    : function name
+ *      __TYPE       : return and range limits type
+ *      __WRAPPED    : wrapped function, strtoimax or strtoumax
+ */
+
+__TYPE
+_FUNCNAME(const char * __restrict nptr, char ** __restrict endptr, int base,
+          __TYPE lo, __TYPE hi, int * rstatus)
+{
+	int serrno;
+	__TYPE im;
+	char *ep;
+	int rep;
+
+	/* endptr may be NULL */
+
+	if (endptr == NULL)
+		endptr = &ep;
+
+	if (rstatus == NULL)
+		rstatus = &rep;
+
+	serrno = errno;
+	errno = 0;
+
+	im = __WRAPPED(nptr, endptr, base);
+
+	*rstatus = errno;
+	errno = serrno;
+
+	if (*rstatus == 0) {
+		/* No digits were found */
+		if (nptr == *endptr)
+			*rstatus = ECANCELED;
+		/* There are further characters after number */
+		else if (**endptr != '\0')
+			*rstatus = ENOTSUP;
+	}
+
+	if (im < lo) {
+		if (*rstatus == 0)
+			*rstatus = ERANGE;
+		return lo;
+	}
+	if (im > hi) {
+		if (*rstatus == 0)
+			*rstatus = ERANGE;
+		return hi;
+	}
+
+	return im;
+}
diff --git a/contrib/blacklist/port/clock_gettime.c b/contrib/blacklist/port/clock_gettime.c
new file mode 100644
index 000000000000..284bd8176901
--- /dev/null
+++ b/contrib/blacklist/port/clock_gettime.c
@@ -0,0 +1,17 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <time.h>
+#include <sys/time.h>
+
+int
+clock_gettime(int clock __unused, struct timespec *ts)
+{
+	struct timeval tv;
+	if (gettimeofday(&tv, NULL) == -1)
+		return -1;
+	ts->tv_sec = tv.tv_sec;
+	ts->tv_nsec = tv.tv_usec * 1000;
+	return 0;
+}
diff --git a/contrib/blacklist/port/config.h b/contrib/blacklist/port/config.h
new file mode 100644
index 000000000000..27f32636de01
--- /dev/null
+++ b/contrib/blacklist/port/config.h
@@ -0,0 +1,3 @@
+#if defined(__FreeBSD__)
+#include "port.h"
+#endif
diff --git a/contrib/blacklist/port/configure.ac b/contrib/blacklist/port/configure.ac
new file mode 100644
index 000000000000..eef8065f060a
--- /dev/null
+++ b/contrib/blacklist/port/configure.ac
@@ -0,0 +1,91 @@
+dnl Process this file with autoconf to produce a configure script.
+AC_INIT([blacklistd],[0.1],[christos@netbsd.com])
+AM_INIT_AUTOMAKE([subdir-objects foreign])
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+
+AC_CONFIG_HEADERS([config.h])
+AC_CONFIG_MACRO_DIR([m4])
+
+AC_SUBST(WARNINGS)
+
+dnl Checks for programs.
+AC_PROG_CC_STDC
+AC_USE_SYSTEM_EXTENSIONS
+AM_PROG_CC_C_O
+AC_C_BIGENDIAN
+AC_PROG_INSTALL
+AC_PROG_LN_S
+LT_INIT([disable-static pic-only])
+gl_VISIBILITY
+dnl Checks for headers
+AC_HEADER_STDC
+AC_HEADER_MAJOR
+AC_HEADER_SYS_WAIT
+AC_CHECK_HEADERS(stdint.h fcntl.h stdint.h inttypes.h unistd.h)
+AC_CHECK_HEADERS(sys/un.h sys/socket.h limits.h)
+AC_CHECK_HEADERS(arpa/inet.h getopt.h err.h)
+AC_CHECK_HEADERS(sys/types.h util.h sys/time.h time.h)
+AC_CHECK_HEADERS(netatalk/at.h net/if_dl.h db.h db_185.h)
+AC_CHECK_LIB(rt, clock_gettime)
+AC_CHECK_LIB(db, __db185_open)
+AC_CHECK_LIB(util, pidfile)
+AC_CHECK_LIB(util, sockaddr_snprintf)
+
+AH_BOTTOM([
+#ifndef __NetBSD__
+#include "port.h"
+#endif
+])
+
+dnl Checks for typedefs, structures, and compiler characteristics.
+AC_C_CONST
+AC_TYPE_OFF_T
+AC_TYPE_SIZE_T
+AC_SYS_LARGEFILE
+AC_CHECK_MEMBERS([struct sockaddr.sa_len], [], [], [#include <sys/socket.h>])
+
+AC_TYPE_PID_T
+AC_TYPE_UINT8_T
+AC_TYPE_UINT16_T
+AC_TYPE_UINT32_T
+AC_TYPE_INT32_T
+AC_TYPE_UINT64_T
+AC_TYPE_INT64_T
+AC_TYPE_INTPTR_T
+AC_TYPE_UINTPTR_T
+
+AC_MSG_CHECKING(for gcc compiler warnings)
+AC_ARG_ENABLE(warnings,
+[  --disable-warnings	disable compiler warnings],
+[if test "${enableval}" = no -o "$GCC" = no; then
+   AC_MSG_RESULT(no)
+   WARNINGS=
+else
+   AC_MSG_RESULT(yes)
+   WARNINGS="-Wall -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith \
+       -Wmissing-declarations -Wredundant-decls -Wnested-externs \
+       -Wsign-compare -Wreturn-type -Wswitch -Wshadow \
+       -Wcast-qual -Wwrite-strings -Wextra -Wunused-parameter -Wformat=2"
+fi], [
+if test "$GCC" = yes; then
+   AC_MSG_RESULT(yes)
+   WARNINGS="-Wall -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith \
+       -Wmissing-declarations -Wredundant-decls -Wnested-externs \
+       -Wsign-compare -Wreturn-type -Wswitch -Wshadow \
+       -Wcast-qual -Wwrite-strings -Wextra -Wunused-parameter -Wformat=2"
+else
+   WARNINGS=
+   AC_MSG_RESULT(no)
+fi])
+
+dnl Checks for functions
+AC_CHECK_FUNCS(strerror)
+
+dnl Provide implementation of some required functions if necessary
+AC_REPLACE_FUNCS(strtoi sockaddr_snprintf popenve clock_gettime strlcpy strlcat getprogname fparseln fgetln pidfile)
+
+dnl See if we are cross-compiling
+AM_CONDITIONAL(IS_CROSS_COMPILE, test "$cross_compiling" = yes)
+
+AC_CONFIG_FILES([Makefile])
+AC_OUTPUT
diff --git a/contrib/blacklist/port/fgetln.c b/contrib/blacklist/port/fgetln.c
new file mode 100644
index 000000000000..a41a383a6653
--- /dev/null
+++ b/contrib/blacklist/port/fgetln.c
@@ -0,0 +1,106 @@
+/*	$NetBSD: fgetln.c,v 1.1 2015/01/22 03:48:07 christos Exp $	*/
+
+/*-
+ * Copyright (c) 1998 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#if !HAVE_FGETLN
+#include <stdlib.h>
+#ifndef HAVE_NBTOOL_CONFIG_H
+/* These headers are required, but included from nbtool_config.h */
+#include <stdio.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+#endif
+
+char *
+fgetln(FILE *fp, size_t *len)
+{
+	static char *buf = NULL;
+	static size_t bufsiz = 0;
+	char *ptr;
+
+
+	if (buf == NULL) {
+		bufsiz = BUFSIZ;
+		if ((buf = malloc(bufsiz)) == NULL)
+			return NULL;
+	}
+
+	if (fgets(buf, bufsiz, fp) == NULL)
+		return NULL;
+
+	*len = 0;
+	while ((ptr = strchr(&buf[*len], '\n')) == NULL) {
+		size_t nbufsiz = bufsiz + BUFSIZ;
+		char *nbuf = realloc(buf, nbufsiz);
+
+		if (nbuf == NULL) {
+			int oerrno = errno;
+			free(buf);
+			errno = oerrno;
+			buf = NULL;
+			return NULL;
+		} else
+			buf = nbuf;
+
+		if (fgets(&buf[bufsiz], BUFSIZ, fp) == NULL) {
+			buf[bufsiz] = '\0';
+			*len = strlen(buf);
+			return buf;
+		}
+
+		*len = bufsiz;
+		bufsiz = nbufsiz;
+	}
+
+	*len = (ptr - buf) + 1;
+	return buf;
+}
+
+#endif
+
+#ifdef TEST
+int
+main(int argc, char *argv[])
+{
+	char *p;
+	size_t len;
+
+	while ((p = fgetln(stdin, &len)) != NULL) {
+		(void)printf("%zu %s", len, p);
+		free(p);
+	}
+	return 0;
+}
+#endif
diff --git a/contrib/blacklist/port/fparseln.c b/contrib/blacklist/port/fparseln.c
new file mode 100644
index 000000000000..5bfae54b9a9b
--- /dev/null
+++ b/contrib/blacklist/port/fparseln.c
@@ -0,0 +1,236 @@
+/*	$NetBSD: fparseln.c,v 1.1 2015/01/22 03:48:07 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997 Christos Zoulas.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/cdefs.h>
+#if defined(LIBC_SCCS) && !defined(lint)
+__RCSID("$NetBSD: fparseln.c,v 1.1 2015/01/22 03:48:07 christos Exp $");
+#endif /* LIBC_SCCS and not lint */
+
+#include <assert.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#if ! HAVE_FPARSELN || BROKEN_FPARSELN
+
+#define FLOCKFILE(fp)
+#define FUNLOCKFILE(fp)
+
+#if defined(_REENTRANT) && !HAVE_NBTOOL_CONFIG_H
+#define __fgetln(f, l) __fgetstr(f, l, '\n')
+#else
+#define __fgetln(f, l) fgetln(f, l)
+#endif
+
+static int isescaped(const char *, const char *, int);
+
+/* isescaped():
+ *	Return true if the character in *p that belongs to a string
+ *	that starts in *sp, is escaped by the escape character esc.
+ */
+static int
+isescaped(const char *sp, const char *p, int esc)
+{
+	const char     *cp;
+	size_t		ne;
+
+	/* No escape character */
+	if (esc == '\0')
+		return 0;
+
+	/* Count the number of escape characters that precede ours */
+	for (ne = 0, cp = p; --cp >= sp && *cp == esc; ne++)
+		continue;
+
+	/* Return true if odd number of escape characters */
+	return (ne & 1) != 0;
+}
+
+
+/* fparseln():
+ *	Read a line from a file parsing continuations ending in \
+ *	and eliminating trailing newlines, or comments starting with
+ *	the comment char.
+ */
+char *
+fparseln(FILE *fp, size_t *size, size_t *lineno, const char str[3], int flags)
+{
+	static const char dstr[3] = { '\\', '\\', '#' };
+
+	size_t	s, len;
+	char   *buf;
+	char   *ptr, *cp;
+	int	cnt;
+	char	esc, con, nl, com;
+
+	len = 0;
+	buf = NULL;
+	cnt = 1;
+
+	if (str == NULL)
+		str = dstr;
+
+	esc = str[0];
+	con = str[1];
+	com = str[2];
+	/*
+	 * XXX: it would be cool to be able to specify the newline character,
+	 * but unfortunately, fgetln does not let us
+	 */
+	nl  = '\n';
+
+	FLOCKFILE(fp);
+
+	while (cnt) {
+		cnt = 0;
+
+		if (lineno)
+			(*lineno)++;
+
+		if ((ptr = __fgetln(fp, &s)) == NULL)
+			break;
+
+		if (s && com) {		/* Check and eliminate comments */
+			for (cp = ptr; cp < ptr + s; cp++)
+				if (*cp == com && !isescaped(ptr, cp, esc)) {
+					s = cp - ptr;
+					cnt = s == 0 && buf == NULL;
+					break;
+				}
+		}
+
+		if (s && nl) { 		/* Check and eliminate newlines */
+			cp = &ptr[s - 1];
+
+			if (*cp == nl)
+				s--;	/* forget newline */
+		}
+
+		if (s && con) {		/* Check and eliminate continuations */
+			cp = &ptr[s - 1];
+
+			if (*cp == con && !isescaped(ptr, cp, esc)) {
+				s--;	/* forget continuation char */
+				cnt = 1;
+			}
+		}
+
+		if (s == 0) {
+			/*
+			 * nothing to add, skip realloc except in case
+			 * we need a minimal buf to return an empty line
+			 */
+			if (cnt || buf != NULL)
+				continue;
+		}
+
+		if ((cp = realloc(buf, len + s + 1)) == NULL) {
+			FUNLOCKFILE(fp);
+			free(buf);
+			return NULL;
+		}
+		buf = cp;
+
+		(void) memcpy(buf + len, ptr, s);
+		len += s;
+		buf[len] = '\0';
+	}
+
+	FUNLOCKFILE(fp);
+
+	if ((flags & FPARSELN_UNESCALL) != 0 && esc && buf != NULL &&
+	    strchr(buf, esc) != NULL) {
+		ptr = cp = buf;
+		while (cp[0] != '\0') {
+			int skipesc;
+
+			while (cp[0] != '\0' && cp[0] != esc)
+				*ptr++ = *cp++;
+			if (cp[0] == '\0' || cp[1] == '\0')
+				break;
+
+			skipesc = 0;
+			if (cp[1] == com)
+				skipesc += (flags & FPARSELN_UNESCCOMM);
+			if (cp[1] == con)
+				skipesc += (flags & FPARSELN_UNESCCONT);
+			if (cp[1] == esc)
+				skipesc += (flags & FPARSELN_UNESCESC);
+			if (cp[1] != com && cp[1] != con && cp[1] != esc)
+				skipesc = (flags & FPARSELN_UNESCREST);
+
+			if (skipesc)
+				cp++;
+			else
+				*ptr++ = *cp++;
+			*ptr++ = *cp++;
+		}
+		*ptr = '\0';
+		len = strlen(buf);
+	}
+
+	if (size)
+		*size = len;
+	return buf;
+}
+
+#ifdef TEST
+
+int main(int, char **);
+
+int
+main(int argc, char **argv)
+{
+	char   *ptr;
+	size_t	size, line;
+
+	line = 0;
+	while ((ptr = fparseln(stdin, &size, &line, NULL,
+	    FPARSELN_UNESCALL)) != NULL)
+		printf("line %d (%d) |%s|\n", line, size, ptr);
+	return 0;
+}
+
+/*
+
+# This is a test
+line 1
+line 2 \
+line 3 # Comment
+line 4 \# Not comment \\\\
+
+# And a comment \
+line 5 \\\
+line 6
+
+*/
+
+#endif /* TEST */
+#endif	/* ! HAVE_FPARSELN || BROKEN_FPARSELN */
diff --git a/contrib/blacklist/port/getprogname.c b/contrib/blacklist/port/getprogname.c
new file mode 100644
index 000000000000..983d6740c88c
--- /dev/null
+++ b/contrib/blacklist/port/getprogname.c
@@ -0,0 +1,24 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+#include <string.h>
+
+extern char *__progname;
+
+const char *
+getprogname(void)
+{
+	return __progname;
+}
+
+void
+setprogname(char *p)
+{
+	char *q;
+	if (p == NULL)
+		return;
+	if ((q = strrchr(p, '/')) != NULL)
+		__progname = ++q;
+	else
+		__progname = p;
+}
diff --git a/contrib/blacklist/port/m4/.cvsignore b/contrib/blacklist/port/m4/.cvsignore
new file mode 100644
index 000000000000..0f4126cd6718
--- /dev/null
+++ b/contrib/blacklist/port/m4/.cvsignore
@@ -0,0 +1 @@
+*.m4
diff --git a/contrib/blacklist/port/pidfile.c b/contrib/blacklist/port/pidfile.c
new file mode 100644
index 000000000000..4deb2349d20a
--- /dev/null
+++ b/contrib/blacklist/port/pidfile.c
@@ -0,0 +1,183 @@
+/*	$NetBSD: pidfile.c,v 1.2 2016/04/05 12:28:57 christos Exp $	*/
+
+/*-
+ * Copyright (c) 1999 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Jason R. Thorpe, Matthias Scheler and Julio Merino.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/cdefs.h>
+#if defined(LIBC_SCCS) && !defined(lint)
+__RCSID("$NetBSD: pidfile.c,v 1.2 2016/04/05 12:28:57 christos Exp $");
+#endif
+
+#include <sys/param.h>
+
+#include <paths.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#ifdef HAVE_LIBUTIL_H
+#include <libutil.h>
+#endif
+#ifdef HAVE_UTIL_H
+#include <util.h>
+#endif
+
+static pid_t pidfile_pid;
+static char *pidfile_path;
+
+/* Deletes an existent pidfile iff it was created by this process. */
+static void
+pidfile_cleanup(void)
+{
+
+	if ((pidfile_path != NULL) && (pidfile_pid == getpid()))
+		(void) unlink(pidfile_path);
+}
+
+/* Registers an atexit(3) handler to delete the pidfile we have generated.
+ * We only register the handler when we create a pidfile, so we can assume
+ * that the pidfile exists.
+ *
+ * Returns 0 on success or -1 if the handler could not be registered. */
+static int
+register_atexit_handler(void)
+{
+	static bool done = false;
+
+	if (!done) {
+		if (atexit(pidfile_cleanup) < 0)
+			return -1;
+		done = true;
+	}
+
+	return 0;
+}
+
+/* Given a new pidfile name in 'path', deletes any previously-created pidfile
+ * if the previous file differs to the new one.
+ *
+ * If a previous file is deleted, returns 1, which means that a new pidfile
+ * must be created.  Otherwise, this returns 0, which means that the existing
+ * file does not need to be touched. */
+static int
+cleanup_old_pidfile(const char* path)
+{
+	if (pidfile_path != NULL) {
+		if (strcmp(pidfile_path, path) != 0) {
+			pidfile_cleanup();
+
+			free(pidfile_path);
+			pidfile_path = NULL;
+
+			return 1;
+		} else
+			return 0;
+	} else
+		return 1;
+}
+
+/* Constructs a name for a pidfile in the default location (/var/run).  If
+ * 'basename' is NULL, uses the name of the current program for the name of
+ * the pidfile.
+ *
+ * Returns a pointer to a dynamically-allocatd string containing the absolute
+ * path to the pidfile; NULL on failure. */
+static char *
+generate_varrun_path(const char *bname)
+{
+	char *path;
+
+	if (bname == NULL)
+		bname = getprogname();
+
+	/* _PATH_VARRUN includes trailing / */
+	if (asprintf(&path, "%s%s.pid", _PATH_VARRUN, bname) == -1)
+		return NULL;
+	return path;
+}
+
+/* Creates a pidfile with the provided name.  The new pidfile is "registered"
+ * in the global variables pidfile_path and pidfile_pid so that any further
+ * call to pidfile(3) can check if we are recreating the same file or a new
+ * one.
+ *
+ * Returns 0 on success or -1 if there is any error. */
+static int
+create_pidfile(const char* path)
+{
+	FILE *f;
+
+	if (register_atexit_handler() == -1)
+		return -1;
+
+	if (cleanup_old_pidfile(path) == 0)
+		return 0;
+
+	pidfile_path = strdup(path);
+	if (pidfile_path == NULL)
+		return -1;
+
+	if ((f = fopen(path, "w")) == NULL) {
+		free(pidfile_path);
+		pidfile_path = NULL;
+		return -1;
+	}
+
+	pidfile_pid = getpid();
+
+	(void) fprintf(f, "%d\n", pidfile_pid);
+	(void) fclose(f);
+
+	return 0;
+}
+
+int
+pidfile(const char *path)
+{
+
+	if (path == NULL || strchr(path, '/') == NULL) {
+		char *default_path;
+
+		if ((default_path = generate_varrun_path(path)) == NULL)
+			return -1;
+
+		if (create_pidfile(default_path) == -1) {
+			free(default_path);
+			return -1;
+		}
+
+		free(default_path);
+		return 0;
+	} else
+		return create_pidfile(path);
+}
diff --git a/contrib/blacklist/port/popenve.c b/contrib/blacklist/port/popenve.c
new file mode 100644
index 000000000000..20f6b5b86b68
--- /dev/null
+++ b/contrib/blacklist/port/popenve.c
@@ -0,0 +1,274 @@
+/*	$NetBSD: popenve.c,v 1.2 2015/01/22 03:10:50 christos Exp $	*/
+
+/*
+ * Copyright (c) 1988, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * This code is derived from software written by Ken Arnold and
+ * published in UNIX Review, Vol. 6, No. 8.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/cdefs.h>
+#if defined(LIBC_SCCS) && !defined(lint)
+#if 0
+static char sccsid[] = "@(#)popen.c	8.3 (Berkeley) 5/3/95";
+#else
+__RCSID("$NetBSD: popenve.c,v 1.2 2015/01/22 03:10:50 christos Exp $");
+#endif
+#endif /* LIBC_SCCS and not lint */
+
+#include <sys/param.h>
+#include <sys/wait.h>
+#include <sys/socket.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <paths.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+
+#ifdef __weak_alias
+__weak_alias(popen,_popen)
+__weak_alias(pclose,_pclose)
+#endif
+
+static struct pid {
+	struct pid *next;
+	FILE *fp;
+#ifdef _REENTRANT
+	int fd;
+#endif
+	pid_t pid;
+} *pidlist; 
+	
+#ifdef _REENTRANT
+static rwlock_t pidlist_lock = RWLOCK_INITIALIZER;
+#endif
+
+static struct pid *
+pdes_get(int *pdes, const char **type)
+{
+	struct pid *cur;
+	int flags = strchr(*type, 'e') ? O_CLOEXEC : 0;
+	int serrno;
+
+	if (strchr(*type, '+')) {
+#ifndef SOCK_CLOEXEC
+#define SOCK_CLOEXEC 0
+#endif
+		int stype = flags ? (SOCK_STREAM | SOCK_CLOEXEC) : SOCK_STREAM;
+		*type = "r+";
+		if (socketpair(AF_LOCAL, stype, 0, pdes) < 0)
+			return NULL;
+#if SOCK_CLOEXEC == 0
+		fcntl(pdes[0], F_SETFD, FD_CLOEXEC);
+		fcntl(pdes[1], F_SETFD, FD_CLOEXEC);
+#endif
+	} else  {
+		*type = strrchr(*type, 'r') ? "r" : "w";
+#if SOCK_CLOEXEC != 0
+		if (pipe2(pdes, flags) == -1)
+			return NULL;
+#else
+		if (pipe(pdes) == -1)
+			return NULL;
+		fcntl(pdes[0], F_SETFL, fcntl(pdes[0], F_GETFL) | flags);
+		fcntl(pdes[1], F_SETFL, fcntl(pdes[1], F_GETFL) | flags);
+#endif
+	}
+
+	if ((cur = malloc(sizeof(*cur))) != NULL)
+		return cur;
+	serrno = errno;
+	(void)close(pdes[0]);
+	(void)close(pdes[1]);
+	errno = serrno;
+	return NULL;
+}
+
+static void
+pdes_child(int *pdes, const char *type)
+{
+	struct pid *old;
+
+	/* POSIX.2 B.3.2.2 "popen() shall ensure that any streams
+	   from previous popen() calls that remain open in the 
+	   parent process are closed in the new child process. */
+	for (old = pidlist; old; old = old->next)
+#ifdef _REENTRANT
+		(void)close(old->fd); /* don't allow a flush */
+#else
+		(void)close(fileno(old->fp)); /* don't allow a flush */
+#endif
+
+	if (type[0] == 'r') {
+		(void)close(pdes[0]);
+		if (pdes[1] != STDOUT_FILENO) {
+			(void)dup2(pdes[1], STDOUT_FILENO);
+			(void)close(pdes[1]);
+		}
+		if (type[1] == '+')
+			(void)dup2(STDOUT_FILENO, STDIN_FILENO);
+	} else {
+		(void)close(pdes[1]);
+		if (pdes[0] != STDIN_FILENO) {
+			(void)dup2(pdes[0], STDIN_FILENO);
+			(void)close(pdes[0]);
+		}
+	}
+}
+
+static void
+pdes_parent(int *pdes, struct pid *cur, pid_t pid, const char *type)
+{
+	FILE *iop;
+
+	/* Parent; assume fdopen can't fail. */
+	if (*type == 'r') {
+		iop = fdopen(pdes[0], type);
+#ifdef _REENTRANT
+		cur->fd = pdes[0];
+#endif
+		(void)close(pdes[1]);
+	} else {
+		iop = fdopen(pdes[1], type);
+#ifdef _REENTRANT
+		cur->fd = pdes[1];
+#endif
+		(void)close(pdes[0]);
+	}
+
+	/* Link into list of file descriptors. */
+	cur->fp = iop;
+	cur->pid =  pid;
+	cur->next = pidlist;
+	pidlist = cur;
+}
+
+static void
+pdes_error(int *pdes, struct pid *cur)
+{
+	free(cur);
+	(void)close(pdes[0]);
+	(void)close(pdes[1]);
+}
+
+FILE *
+popenve(const char *cmd, char *const *argv, char *const *envp, const char *type)
+{
+	struct pid *cur;
+	int pdes[2], serrno;
+	pid_t pid;
+
+	if ((cur = pdes_get(pdes, &type)) == NULL)
+		return NULL;
+
+#ifdef _REENTRANT
+	(void)rwlock_rdlock(&pidlist_lock);
+#endif
+	switch (pid = vfork()) {
+	case -1:			/* Error. */
+		serrno = errno;
+#ifdef _REENTRANT
+		(void)rwlock_unlock(&pidlist_lock);
+#endif
+		pdes_error(pdes, cur);
+		errno = serrno;
+		return NULL;
+		/* NOTREACHED */
+	case 0:				/* Child. */
+		pdes_child(pdes, type);
+		execve(cmd, argv, envp);
+		_exit(127);
+		/* NOTREACHED */
+	}
+
+	pdes_parent(pdes, cur, pid, type);
+
+#ifdef _REENTRANT
+	(void)rwlock_unlock(&pidlist_lock);
+#endif
+
+	return cur->fp;
+}
+
+/*
+ * pclose --
+ *	Pclose returns -1 if stream is not associated with a `popened' command,
+ *	if already `pclosed', or waitpid returns an error.
+ */
+int
+pcloseve(FILE *iop)
+{
+	struct pid *cur, *last;
+	int pstat;
+	pid_t pid;
+
+#ifdef _REENTRANT
+	rwlock_wrlock(&pidlist_lock);
+#endif
+
+	/* Find the appropriate file pointer. */
+	for (last = NULL, cur = pidlist; cur; last = cur, cur = cur->next)
+		if (cur->fp == iop)
+			break;
+	if (cur == NULL) {
+#ifdef _REENTRANT
+		(void)rwlock_unlock(&pidlist_lock);
+#endif
+		errno = ESRCH;
+		return -1;
+	}
+
+	(void)fclose(iop);
+
+	/* Remove the entry from the linked list. */
+	if (last == NULL)
+		pidlist = cur->next;
+	else
+		last->next = cur->next;
+
+#ifdef _REENTRANT
+	(void)rwlock_unlock(&pidlist_lock);
+#endif
+
+	do {
+		pid = waitpid(cur->pid, &pstat, 0);
+	} while (pid == -1 && errno == EINTR);
+
+	free(cur);
+
+	return pid == -1 ? -1 : pstat;
+}
diff --git a/contrib/blacklist/port/port.h b/contrib/blacklist/port/port.h
new file mode 100644
index 000000000000..f82fb34b40f5
--- /dev/null
+++ b/contrib/blacklist/port/port.h
@@ -0,0 +1,86 @@
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+#include <stdio.h>
+#include <inttypes.h>
+#include <time.h>
+#include <sys/stat.h>
+#include <netdb.h>
+
+#ifndef __unused
+#define __unused __attribute__((__unused__))
+#endif
+
+#ifndef __dead
+#define __dead __attribute__((__noreturn__))
+#endif
+
+#ifndef __RCSID
+#define __RCSID(a)
+#endif
+
+#ifndef __UNCONST
+#define __UNCONST(a) ((void *)(intptr_t)(a))
+#endif
+
+#ifndef __arraycount
+#define __arraycount(a) (sizeof(a) / sizeof(a[0]))
+#endif
+
+#ifndef HAVE_STRLCPY
+size_t strlcpy(char *, const char *, size_t);
+#endif
+
+#ifndef HAVE_STRLCAT
+size_t strlcat(char *, const char *, size_t);
+#endif
+
+#ifndef HAVE_POPENVE
+FILE *popenve(const char *, char *const *, char *const *, const char *);
+int pcloseve(FILE *);
+#define pclose(a) pcloseve(a);
+#endif
+
+#ifndef HAVE_SOCKADDR_SNPRINTF
+struct sockaddr;
+int sockaddr_snprintf(char *, size_t, const char *, const struct sockaddr *);
+#endif
+
+#ifndef HAVE_STRTOI
+intmax_t strtoi(const char *, char **, int, intmax_t, intmax_t, int *);
+#endif
+
+#ifndef HAVE_GETPROGNAME
+const char *getprogname(void);
+void setprogname(char *);
+#endif
+
+#ifndef HAVE_PIDFILE
+int pidfile(const char *);
+#endif
+
+#ifndef HAVE_FPARSELN
+#define FPARSELN_UNESCALL	0xf
+#define FPARSELN_UNESCCOMM	0x1
+#define FPARSELN_UNESCCONT	0x2
+#define FPARSELN_UNESCESC	0x4
+#define FPARSELN_UNESCREST	0x8
+char *fparseln(FILE *, size_t *, size_t *, const char delim[3], int);
+#endif
+
+#ifndef HAVE_FGETLN
+char *fgetln(FILE *, size_t *);
+#endif
+
+#ifndef HAVE_CLOCK_GETTIME
+struct timespec;
+int clock_gettime(int, struct timespec *);
+#define CLOCK_REALTIME 0
+#endif
+
+#if !defined(__FreeBSD__)
+#define _PATH_BLCONF "conf"
+#define _PATH_BLCONTROL "control"
+#define _PATH_BLSOCK "blacklistd.sock"
+#define _PATH_BLSTATE "blacklistd.db"
+#endif
diff --git a/contrib/blacklist/port/sockaddr_snprintf.c b/contrib/blacklist/port/sockaddr_snprintf.c
new file mode 100644
index 000000000000..41e5e0c0ed20
--- /dev/null
+++ b/contrib/blacklist/port/sockaddr_snprintf.c
@@ -0,0 +1,383 @@
+/*	$NetBSD: sockaddr_snprintf.c,v 1.10 2016/04/05 12:28:57 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2004 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/cdefs.h>
+#if defined(LIBC_SCCS) && !defined(lint)
+__RCSID("$NetBSD: sockaddr_snprintf.c,v 1.10 2016/04/05 12:28:57 christos Exp $");
+#endif /* LIBC_SCCS and not lint */
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <netinet/in.h>
+#ifdef __linux__
+#undef HAVE_NETATALK_AT_H
+#endif
+#ifdef HAVE_NETATALK_AT_H
+#include <netatalk/at.h>
+#endif
+#ifdef HAVE_NET_IF_DL_H
+#include <net/if_dl.h>
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <stdlib.h>
+#ifdef HAVE_LIBUTIL_H
+#include <libutil.h>
+#endif
+#ifdef HAVE_UTIL_H
+#include <util.h>
+#endif
+#include <netdb.h>
+
+#ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
+#define SLEN(a)	(a)->a ## _len
+#else
+static socklen_t
+socklen(u_int af)
+{
+	switch (af) {
+	case AF_INET:
+		return sizeof(struct sockaddr_in);
+	case AF_INET6:
+		return sizeof(struct sockaddr_in6);
+	case AF_LOCAL:
+		return sizeof(struct sockaddr_un);
+#ifdef HAVE_NET_IF_DL_H
+	case AF_LINK:
+		return sizeof(struct sockaddr_dl);
+#endif
+#ifdef HAVE_NETATALK_AT_H
+	case AF_APPLETALK:
+		return sizeof(struct sockaddr_at);
+#endif
+	default:
+		return sizeof(struct sockaddr_storage);
+	}
+}
+
+#define SLEN(a)	socklen((a)->a ## _family)
+#endif
+
+#ifdef HAVE_NETATALK_AT_H
+static int
+debug_at(char *str, size_t len, const struct sockaddr_at *sat)
+{
+	return snprintf(str, len, "sat_len=%u, sat_family=%u, sat_port=%u, "
+	    "sat_addr.s_net=%u, sat_addr.s_node=%u, "
+	    "sat_range.r_netrange.nr_phase=%u, "
+	    "sat_range.r_netrange.nr_firstnet=%u, "
+	    "sat_range.r_netrange.nr_lastnet=%u",
+	    SLEN(sat), sat->sat_family, sat->sat_port,
+	    sat->sat_addr.s_net, sat->sat_addr.s_node,
+	    sat->sat_range.r_netrange.nr_phase,
+	    sat->sat_range.r_netrange.nr_firstnet,
+	    sat->sat_range.r_netrange.nr_lastnet);
+}
+#endif
+
+static int
+debug_in(char *str, size_t len, const struct sockaddr_in *sin)
+{
+	return snprintf(str, len, "sin_len=%u, sin_family=%u, sin_port=%u, "
+	    "sin_addr.s_addr=%08x",
+	    SLEN(sin), sin->sin_family, sin->sin_port,
+	    sin->sin_addr.s_addr);
+}
+
+static int
+debug_in6(char *str, size_t len, const struct sockaddr_in6 *sin6)
+{
+	const uint8_t *s = sin6->sin6_addr.s6_addr;
+
+	return snprintf(str, len, "sin6_len=%u, sin6_family=%u, sin6_port=%u, "
+	    "sin6_flowinfo=%u, "
+	    "sin6_addr=%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:"
+	    "%02x:%02x:%02x:%02x:%02x:%02x, sin6_scope_id=%u",
+	    SLEN(sin6), sin6->sin6_family, sin6->sin6_port,
+	    sin6->sin6_flowinfo, s[0x0], s[0x1], s[0x2], s[0x3], s[0x4], s[0x5],
+	    s[0x6], s[0x7], s[0x8], s[0x9], s[0xa], s[0xb], s[0xc], s[0xd],
+	    s[0xe], s[0xf], sin6->sin6_scope_id);
+}
+
+static int
+debug_un(char *str, size_t len, const struct sockaddr_un *sun)
+{
+	return snprintf(str, len, "sun_len=%u, sun_family=%u, sun_path=%*s",
+	    SLEN(sun), sun->sun_family, (int)sizeof(sun->sun_path),
+	    sun->sun_path);
+}
+
+#ifdef HAVE_NET_IF_DL_H
+static int
+debug_dl(char *str, size_t len, const struct sockaddr_dl *sdl)
+{
+	const uint8_t *s = (const void *)sdl->sdl_data;
+
+	return snprintf(str, len, "sdl_len=%u, sdl_family=%u, sdl_index=%u, "
+	    "sdl_type=%u, sdl_nlen=%u, sdl_alen=%u, sdl_slen=%u, sdl_data="
+	    "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x",
+	    SLEN(sdl), sdl->sdl_family, sdl->sdl_index,
+	    sdl->sdl_type, sdl->sdl_nlen, sdl->sdl_alen, sdl->sdl_slen,
+	    s[0x0], s[0x1], s[0x2], s[0x3], s[0x4], s[0x5],
+	    s[0x6], s[0x7], s[0x8], s[0x9], s[0xa], s[0xb]);
+}
+#endif
+
+int
+sockaddr_snprintf(char * const sbuf, const size_t len, const char * const fmt,
+    const struct sockaddr * const sa)
+{
+	const void *a = NULL;
+	char abuf[1024], nbuf[1024], *addr = NULL;
+
+	char Abuf[1024], pbuf[32], *name = NULL, *port = NULL;
+	char *ebuf = &sbuf[len - 1], *buf = sbuf;
+	const char *ptr, *s;
+	int p = -1;
+#ifdef HAVE_NETATALK_AT_H
+	const struct sockaddr_at *sat = NULL;
+#endif
+	const struct sockaddr_in *sin4 = NULL;
+	const struct sockaddr_in6 *sin6 = NULL;
+	const struct sockaddr_un *sun = NULL;
+#ifdef HAVE_NET_IF_DL_H
+	const struct sockaddr_dl *sdl = NULL;
+	char *w = NULL;
+#endif
+	int na = 1;
+
+#define ADDC(c) do { if (buf < ebuf) *buf++ = c; else buf++; } \
+	while (/*CONSTCOND*/0)
+#define ADDS(p) do { for (s = p; *s; s++) ADDC(*s); } \
+	while (/*CONSTCOND*/0)
+#define ADDNA() do { if (na) ADDS("N/A"); } \
+	while (/*CONSTCOND*/0)
+
+	switch (sa->sa_family) {
+	case AF_UNSPEC:
+		goto done;
+#ifdef HAVE_NETATALK_AT_H
+	case AF_APPLETALK:
+		sat = ((const struct sockaddr_at *)(const void *)sa);
+		p = ntohs(sat->sat_port);
+		(void)snprintf(addr = abuf, sizeof(abuf), "%u.%u",
+			ntohs(sat->sat_addr.s_net), sat->sat_addr.s_node);
+		(void)snprintf(port = pbuf, sizeof(pbuf), "%d", p);
+		break;
+#endif
+	case AF_LOCAL:
+		sun = ((const struct sockaddr_un *)(const void *)sa);
+		(void)strlcpy(addr = abuf, sun->sun_path, sizeof(abuf));
+		break;
+	case AF_INET:
+		sin4 = ((const struct sockaddr_in *)(const void *)sa);
+		p = ntohs(sin4->sin_port);
+		a = &sin4->sin_addr;
+		break;
+	case AF_INET6:
+		sin6 = ((const struct sockaddr_in6 *)(const void *)sa);
+		p = ntohs(sin6->sin6_port);
+		a = &sin6->sin6_addr;
+		break;
+#ifdef HAVE_NET_IF_DL_H
+	case AF_LINK:
+		sdl = ((const struct sockaddr_dl *)(const void *)sa);
+		(void)strlcpy(addr = abuf, link_ntoa(sdl), sizeof(abuf));
+		if ((w = strchr(addr, ':')) != 0) {
+			*w++ = '\0';
+			addr = w;
+		}
+		break;
+#endif
+	default:
+		errno = EAFNOSUPPORT;
+		return -1;
+	}
+
+	if (addr == abuf)
+		name = addr;
+
+	if (a && getnameinfo(sa, (socklen_t)SLEN(sa), addr = abuf,
+	    (unsigned int)sizeof(abuf), NULL, 0,
+	    NI_NUMERICHOST|NI_NUMERICSERV) != 0)
+		return -1;
+
+	for (ptr = fmt; *ptr; ptr++) {
+		if (*ptr != '%') {
+			ADDC(*ptr);
+			continue;
+		}
+	  next_char:
+		switch (*++ptr) {
+		case '?':
+			na = 0;
+			goto next_char;
+		case 'a':
+			ADDS(addr);
+			break;
+		case 'p':
+			if (p != -1) {
+				(void)snprintf(nbuf, sizeof(nbuf), "%d", p);
+				ADDS(nbuf);
+			} else
+				ADDNA();
+			break;
+		case 'f':
+			(void)snprintf(nbuf, sizeof(nbuf), "%d", sa->sa_family);
+			ADDS(nbuf);
+			break;
+		case 'l':
+			(void)snprintf(nbuf, sizeof(nbuf), "%d", SLEN(sa));
+			ADDS(nbuf);
+			break;
+		case 'A':
+			if (name)
+				ADDS(name);
+			else if (!a)
+				ADDNA();
+			else {
+				getnameinfo(sa, (socklen_t)SLEN(sa),
+					name = Abuf,
+					(unsigned int)sizeof(nbuf), NULL, 0, 0);
+				ADDS(name);
+			}
+			break;
+		case 'P':
+			if (port)
+				ADDS(port);
+			else if (p == -1)
+				ADDNA();
+			else {
+				getnameinfo(sa, (socklen_t)SLEN(sa), NULL, 0,
+					port = pbuf,
+					(unsigned int)sizeof(pbuf), 0);
+				ADDS(port);
+			}
+			break;
+		case 'I':
+#ifdef HAVE_NET_IF_DL_H
+			if (sdl && addr != abuf) {
+				ADDS(abuf);
+			} else
+#endif
+			{
+				ADDNA();
+			}
+			break;
+		case 'F':
+			if (sin6) {
+				(void)snprintf(nbuf, sizeof(nbuf), "%d",
+				    sin6->sin6_flowinfo);
+				ADDS(nbuf);
+				break;
+			} else {
+				ADDNA();
+			}
+			break;
+		case 'S':
+			if (sin6) {
+				(void)snprintf(nbuf, sizeof(nbuf), "%d",
+				    sin6->sin6_scope_id);
+				ADDS(nbuf);
+				break;
+			} else {
+				ADDNA();
+			}
+			break;
+		case 'R':
+#ifdef HAVE_NETATALK_AT_H
+			if (sat) {
+				const struct netrange *n =
+				    &sat->sat_range.r_netrange;
+				(void)snprintf(nbuf, sizeof(nbuf),
+				    "%d:[%d,%d]", n->nr_phase , n->nr_firstnet,
+				    n->nr_lastnet);
+				ADDS(nbuf);
+			} else
+#endif
+			{
+				ADDNA();
+			}
+			break;
+		case 'D':
+			switch (sa->sa_family) {
+#ifdef HAVE_NETATALK_AT_H
+			case AF_APPLETALK:
+				debug_at(nbuf, sizeof(nbuf), sat);
+				break;
+#endif
+			case AF_LOCAL:
+				debug_un(nbuf, sizeof(nbuf), sun);
+				break;
+			case AF_INET:
+				debug_in(nbuf, sizeof(nbuf), sin4);
+				break;
+			case AF_INET6:
+				debug_in6(nbuf, sizeof(nbuf), sin6);
+				break;
+#ifdef HAVE_NET_IF_DL_H
+			case AF_LINK:
+				debug_dl(nbuf, sizeof(nbuf), sdl);
+				break;
+#endif
+			default:
+				abort();
+			}
+			ADDS(nbuf);
+			break;
+		default:
+			ADDC('%');
+			if (na == 0)
+				ADDC('?');
+			if (*ptr == '\0')
+				goto done;
+			/*FALLTHROUGH*/
+		case '%':
+			ADDC(*ptr);
+			break;
+		}
+		na = 1;
+	}
+done:
+	if (buf < ebuf)
+		*buf = '\0';
+	else if (len != 0)
+		sbuf[len - 1] = '\0';
+	return (int)(buf - sbuf);
+}
diff --git a/contrib/blacklist/port/strlcat.c b/contrib/blacklist/port/strlcat.c
new file mode 100644
index 000000000000..d3c69b5fab78
--- /dev/null
+++ b/contrib/blacklist/port/strlcat.c
@@ -0,0 +1,96 @@
+/*	$NetBSD: strlcat.c,v 1.2 2015/01/22 03:48:07 christos Exp $	*/
+/*	$OpenBSD: strlcat.c,v 1.10 2003/04/12 21:56:39 millert Exp $	*/
+
+/*
+ * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND TODD C. MILLER DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL TODD C. MILLER BE LIABLE
+ * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(_KERNEL) && !defined(_STANDALONE)
+#if HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/cdefs.h>
+#if defined(LIBC_SCCS) && !defined(lint)
+__RCSID("$NetBSD: strlcat.c,v 1.2 2015/01/22 03:48:07 christos Exp $");
+#endif /* LIBC_SCCS and not lint */
+
+#ifdef _LIBC
+#include "namespace.h"
+#endif
+#include <sys/types.h>
+#include <assert.h>
+#include <string.h>
+
+#ifdef _LIBC
+# ifdef __weak_alias
+__weak_alias(strlcat, _strlcat)
+# endif
+#endif
+
+#else
+#include <lib/libkern/libkern.h>
+#endif /* !_KERNEL && !_STANDALONE */
+
+#if !HAVE_STRLCAT
+/*
+ * Appends src to string dst of size siz (unlike strncat, siz is the
+ * full size of dst, not space left).  At most siz-1 characters
+ * will be copied.  Always NUL terminates (unless siz <= strlen(dst)).
+ * Returns strlen(src) + MIN(siz, strlen(initial dst)).
+ * If retval >= siz, truncation occurred.
+ */
+size_t
+strlcat(char *dst, const char *src, size_t siz)
+{
+#if 1
+	char *d = dst;
+	const char *s = src;
+	size_t n = siz;
+	size_t dlen;
+
+	/* Find the end of dst and adjust bytes left but don't go past end */
+	while (n-- != 0 && *d != '\0')
+		d++;
+	dlen = d - dst;
+	n = siz - dlen;
+
+	if (n == 0)
+		return(dlen + strlen(s));
+	while (*s != '\0') {
+		if (n != 1) {
+			*d++ = *s;
+			n--;
+		}
+		s++;
+	}
+	*d = '\0';
+
+	return(dlen + (s - src));	/* count does not include NUL */
+#else
+
+	/*
+	 * Find length of string in dst (maxing out at siz).
+	 */
+	size_t dlen = strnlen(dst, siz);
+
+	/*
+	 * Copy src into any remaining space in dst (truncating if needed).
+	 * Note strlcpy(dst, src, 0) returns strlen(src).
+	 */
+	return dlen + strlcpy(dst + dlen, src, siz - dlen);
+#endif
+}
+#endif
diff --git a/contrib/blacklist/port/strlcpy.c b/contrib/blacklist/port/strlcpy.c
new file mode 100644
index 000000000000..6646e1ce9696
--- /dev/null
+++ b/contrib/blacklist/port/strlcpy.c
@@ -0,0 +1,78 @@
+/*	$NetBSD: strlcpy.c,v 1.2 2015/01/22 03:48:07 christos Exp $	*/
+/*	$OpenBSD: strlcpy.c,v 1.7 2003/04/12 21:56:39 millert Exp $	*/
+
+/*
+ * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND TODD C. MILLER DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL TODD C. MILLER BE LIABLE
+ * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if !defined(_KERNEL) && !defined(_STANDALONE)
+#if HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/cdefs.h>
+#if defined(LIBC_SCCS) && !defined(lint)
+__RCSID("$NetBSD: strlcpy.c,v 1.2 2015/01/22 03:48:07 christos Exp $");
+#endif /* LIBC_SCCS and not lint */
+
+#ifdef _LIBC
+#include "namespace.h"
+#endif
+#include <sys/types.h>
+#include <assert.h>
+#include <string.h>
+
+#ifdef _LIBC
+# ifdef __weak_alias
+__weak_alias(strlcpy, _strlcpy)
+# endif
+#endif
+#else
+#include <lib/libkern/libkern.h>
+#endif /* !_KERNEL && !_STANDALONE */
+
+
+#if !HAVE_STRLCPY
+/*
+ * Copy src to string dst of size siz.  At most siz-1 characters
+ * will be copied.  Always NUL terminates (unless siz == 0).
+ * Returns strlen(src); if retval >= siz, truncation occurred.
+ */
+size_t
+strlcpy(char *dst, const char *src, size_t siz)
+{
+	char *d = dst;
+	const char *s = src;
+	size_t n = siz;
+
+	/* Copy as many bytes as will fit */
+	if (n != 0 && --n != 0) {
+		do {
+			if ((*d++ = *s++) == 0)
+				break;
+		} while (--n != 0);
+	}
+
+	/* Not enough room in dst, add NUL and traverse rest of src */
+	if (n == 0) {
+		if (siz != 0)
+			*d = '\0';		/* NUL-terminate dst */
+		while (*s++)
+			;
+	}
+
+	return(s - src - 1);	/* count does not include NUL */
+}
+#endif
diff --git a/contrib/blacklist/port/strtoi.c b/contrib/blacklist/port/strtoi.c
new file mode 100644
index 000000000000..5514f1a00a32
--- /dev/null
+++ b/contrib/blacklist/port/strtoi.c
@@ -0,0 +1,61 @@
+/*	$NetBSD: strtoi.c,v 1.3 2015/01/22 03:10:50 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2005 The DragonFly Project.  All rights reserved.
+ * Copyright (c) 2003 Citrus Project,
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * Created by Kamil Rytarowski, based on ID:
+ * NetBSD: src/common/lib/libc/stdlib/strtoul.c,v 1.3 2008/08/20 19:58:34 oster Exp
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/cdefs.h>
+__RCSID("$NetBSD: strtoi.c,v 1.3 2015/01/22 03:10:50 christos Exp $");
+
+#if defined(_KERNEL)
+#include <sys/param.h>
+#include <sys/types.h>
+#include <lib/libkern/libkern.h>
+#elif defined(_STANDALONE)
+#include <sys/param.h>
+#include <sys/types.h>
+#include <lib/libkern/libkern.h>
+#include <lib/libsa/stand.h>
+#else
+#include <stddef.h>
+#include <assert.h>
+#include <errno.h>
+#include <inttypes.h>
+#endif
+
+#define	_FUNCNAME	strtoi
+#define	__TYPE		intmax_t
+#define	__WRAPPED	strtoimax
+
+#if !HAVE_STRTOI
+#include "_strtoi.h"
+#endif