aboutsummaryrefslogtreecommitdiff
path: root/usr.sbin
diff options
context:
space:
mode:
Diffstat (limited to 'usr.sbin')
-rw-r--r--usr.sbin/Makefile2
-rw-r--r--usr.sbin/blacklistctl/Makefile10
-rw-r--r--usr.sbin/blacklistd/Makefile13
-rw-r--r--usr.sbin/blacklistd/blacklistd.conf10
-rw-r--r--usr.sbin/blocklistctl/Makefile22
-rw-r--r--usr.sbin/blocklistctl/Makefile.depend18
-rw-r--r--usr.sbin/blocklistd/Makefile23
-rw-r--r--usr.sbin/blocklistd/Makefile.depend18
-rw-r--r--usr.sbin/blocklistd/blocklistd.conf16
-rwxr-xr-xusr.sbin/periodic/etc/security/520.pfdenied2
10 files changed, 121 insertions, 13 deletions
diff --git a/usr.sbin/Makefile b/usr.sbin/Makefile
index 3c5fd0973a43..44679ca290a5 100644
--- a/usr.sbin/Makefile
+++ b/usr.sbin/Makefile
@@ -121,6 +121,8 @@ SUBDIR.${MK_AUTHPF}+= authpf
SUBDIR.${MK_AUTOFS}+= autofs
SUBDIR.${MK_BLACKLIST}+= blacklistctl
SUBDIR.${MK_BLACKLIST}+= blacklistd
+SUBDIR.${MK_BLOCKLIST}+= blocklistctl
+SUBDIR.${MK_BLOCKLIST}+= blocklistd
SUBDIR.${MK_BLUETOOTH}+= bluetooth
SUBDIR.${MK_BOOTPARAMD}+= bootparamd
SUBDIR.${MK_BSDINSTALL}+= bsdinstall
diff --git a/usr.sbin/blacklistctl/Makefile b/usr.sbin/blacklistctl/Makefile
index 7bdff4158bb4..8a01f52926a7 100644
--- a/usr.sbin/blacklistctl/Makefile
+++ b/usr.sbin/blacklistctl/Makefile
@@ -4,19 +4,21 @@ BLOCKLIST_DIR=${SRCTOP}/contrib/blocklist
PACKAGE= blocklist
PROG= blacklistctl
-SRCS= blacklistctl.c conf.c state.c support.c internal.c \
+SRCS= blacklistctl.c conf.c state.c support.c old_internal.c \
sockaddr_snprintf.c pidfile.c strtoi.c popenve.c
-MAN= blacklistctl.8
+MAN= blocklistctl.8
+MLINKS= blocklistctl.8 blacklistctl.8
LDFLAGS+=-L${LIBBLACKLISTDIR}
-LIBADD+= blacklist util
+LIBADD+= blocklist util
CFLAGS+=-I${BLOCKLIST_DIR}/include -I${BLOCKLIST_DIR}/port \
+ -D_PATH_BLCONF=\"/etc/blacklistd.conf\" \
-D_PATH_BLCONTROL=\"/usr/libexec/blacklistd-helper\" \
-DHAVE_CONFIG_H -DHAVE_DB_H -DHAVE_LIBUTIL_H \
-DHAVE_CLOCK_GETTIME -DHAVE_FGETLN -DHAVE_FPARSELN \
-DHAVE_GETPROGNAME -DHAVE_STRLCAT -DHAVE_STRLCPY \
- -DHAVE_STRUCT_SOCKADDR_SA_LEN
+ -DHAVE_STRUCT_SOCKADDR_SA_LEN -DHAVE_SYS_CDEFS_H
# CFLAGS+= -D_REENTRANT
.include <bsd.prog.mk>
diff --git a/usr.sbin/blacklistd/Makefile b/usr.sbin/blacklistd/Makefile
index e0a3ddd80881..b4ba4ca2f9ad 100644
--- a/usr.sbin/blacklistd/Makefile
+++ b/usr.sbin/blacklistd/Makefile
@@ -5,19 +5,22 @@ PACKAGE= blocklist
CONFS= blacklistd.conf
PROG= blacklistd
-SRCS= blacklistd.c conf.c run.c state.c support.c internal.c \
- sockaddr_snprintf.c pidfile.c strtoi.c popenve.c
-MAN= blacklistd.8 blacklistd.conf.5
+SRCS= blacklistd.c conf.c run.c state.c support.c old_internal.c \
+ sockaddr_snprintf.c pidfile.c strtoi.c popenve.c vsyslog_r.c
+MAN= blocklistd.8 blocklistd.conf.5
+MLINKS= blocklistd.8 blacklistd.8 \
+ blocklistd.conf.5 blacklistd.conf.5
LDFLAGS+=-L${LIBBLACKLISTDIR}
-LIBADD+= blacklist util
+LIBADD+= blocklist util
CFLAGS+=-I${BLOCKLIST_DIR}/include -I${BLOCKLIST_DIR}/port \
+ -D_PATH_BLCONF=\"/etc/blacklistd.conf\" \
-D_PATH_BLCONTROL=\"/usr/libexec/blacklistd-helper\" \
-DHAVE_CONFIG_H -DHAVE_DB_H -DHAVE_LIBUTIL_H \
-DHAVE_CLOCK_GETTIME -DHAVE_FGETLN -DHAVE_FPARSELN \
-DHAVE_GETPROGNAME -DHAVE_STRLCAT -DHAVE_STRLCPY \
- -DHAVE_STRUCT_SOCKADDR_SA_LEN
+ -DHAVE_STRUCT_SOCKADDR_SA_LEN -DHAVE_SYS_CDEFS_H
# CFLAGS+= -D_REENTRANT
.include <bsd.prog.mk>
diff --git a/usr.sbin/blacklistd/blacklistd.conf b/usr.sbin/blacklistd/blacklistd.conf
index b8dee6768cc7..ec995e038574 100644
--- a/usr.sbin/blacklistd/blacklistd.conf
+++ b/usr.sbin/blacklistd/blacklistd.conf
@@ -1,6 +1,9 @@
-#
+# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+# @ The file blacklistd.conf has been renamed to blocklistd.conf @
+# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+
# Blacklist rule
-# adr/mask:port type proto owner name nfail disable
+# adr/mask:port type proto owner name nfail duration
[local]
ssh stream * * * 3 24h
ftp stream * * * 3 24h
@@ -9,8 +12,9 @@ submission stream * * * 3 24h
#6161 stream tcp6 christos * 2 10m
* * * * * 3 60
-# adr/mask:port type proto owner name nfail disable
+# adr/mask:port type proto owner name nfail duration
[remote]
#129.168.0.0/16 * * * = * *
+#[2001:db8::]/32:ssh * * * = * *
#6161 = = = =/24 = =
#* stream tcp * = = =
diff --git a/usr.sbin/blocklistctl/Makefile b/usr.sbin/blocklistctl/Makefile
new file mode 100644
index 000000000000..55891bfb2670
--- /dev/null
+++ b/usr.sbin/blocklistctl/Makefile
@@ -0,0 +1,22 @@
+BLOCKLIST_DIR=${SRCTOP}/contrib/blocklist
+.PATH: ${BLOCKLIST_DIR}/bin ${BLOCKLIST_DIR}/port
+
+PACKAGE= blocklist
+
+PROG= blocklistctl
+SRCS= blocklistctl.c conf.c state.c support.c internal.c \
+ sockaddr_snprintf.c pidfile.c strtoi.c popenve.c
+MAN= blocklistctl.8
+
+LDFLAGS+=-L${LIBBLOCKLISTDIR}
+LIBADD+= blocklist util
+
+CFLAGS+=-I${BLOCKLIST_DIR}/include -I${BLOCKLIST_DIR}/port \
+ -D_PATH_BLCONTROL=\"/usr/libexec/blocklistd-helper\" \
+ -DHAVE_CONFIG_H -DHAVE_DB_H -DHAVE_LIBUTIL_H \
+ -DHAVE_CLOCK_GETTIME -DHAVE_FGETLN -DHAVE_FPARSELN \
+ -DHAVE_GETPROGNAME -DHAVE_STRLCAT -DHAVE_STRLCPY \
+ -DHAVE_STRUCT_SOCKADDR_SA_LEN -DHAVE_SYS_CDEFS_H
+# CFLAGS+= -D_REENTRANT
+
+.include <bsd.prog.mk>
diff --git a/usr.sbin/blocklistctl/Makefile.depend b/usr.sbin/blocklistctl/Makefile.depend
new file mode 100644
index 000000000000..6b74110bfe08
--- /dev/null
+++ b/usr.sbin/blocklistctl/Makefile.depend
@@ -0,0 +1,18 @@
+# Autogenerated - do NOT edit!
+
+DIRDEPS = \
+ include \
+ include/arpa \
+ include/xlocale \
+ lib/${CSU_DIR} \
+ lib/libblocklist \
+ lib/libc \
+ lib/libcompiler_rt \
+ lib/libutil \
+
+
+.include <dirdeps.mk>
+
+.if ${DEP_RELDIR} == ${_DEP_RELDIR}
+# local dependencies - needed for -jN in clean tree
+.endif
diff --git a/usr.sbin/blocklistd/Makefile b/usr.sbin/blocklistd/Makefile
new file mode 100644
index 000000000000..ccee9637e208
--- /dev/null
+++ b/usr.sbin/blocklistd/Makefile
@@ -0,0 +1,23 @@
+BLOCKLIST_DIR=${SRCTOP}/contrib/blocklist
+.PATH: ${BLOCKLIST_DIR}/bin ${BLOCKLIST_DIR}/port
+
+PACKAGE= blocklist
+
+CONFS= blocklistd.conf
+PROG= blocklistd
+SRCS= blocklistd.c conf.c run.c state.c support.c internal.c \
+ sockaddr_snprintf.c pidfile.c strtoi.c popenve.c vsyslog_r.c
+MAN= blocklistd.8 blocklistd.conf.5
+
+LDFLAGS+=-L${LIBBLOCKLISTDIR}
+LIBADD+= blocklist util
+
+CFLAGS+=-I${BLOCKLIST_DIR}/include -I${BLOCKLIST_DIR}/port \
+ -D_PATH_BLCONTROL=\"/usr/libexec/blocklistd-helper\" \
+ -DHAVE_CONFIG_H -DHAVE_DB_H -DHAVE_LIBUTIL_H \
+ -DHAVE_CLOCK_GETTIME -DHAVE_FGETLN -DHAVE_FPARSELN \
+ -DHAVE_GETPROGNAME -DHAVE_STRLCAT -DHAVE_STRLCPY \
+ -DHAVE_STRUCT_SOCKADDR_SA_LEN -DHAVE_SYS_CDEFS_H
+# CFLAGS+= -D_REENTRANT
+
+.include <bsd.prog.mk>
diff --git a/usr.sbin/blocklistd/Makefile.depend b/usr.sbin/blocklistd/Makefile.depend
new file mode 100644
index 000000000000..6b74110bfe08
--- /dev/null
+++ b/usr.sbin/blocklistd/Makefile.depend
@@ -0,0 +1,18 @@
+# Autogenerated - do NOT edit!
+
+DIRDEPS = \
+ include \
+ include/arpa \
+ include/xlocale \
+ lib/${CSU_DIR} \
+ lib/libblocklist \
+ lib/libc \
+ lib/libcompiler_rt \
+ lib/libutil \
+
+
+.include <dirdeps.mk>
+
+.if ${DEP_RELDIR} == ${_DEP_RELDIR}
+# local dependencies - needed for -jN in clean tree
+.endif
diff --git a/usr.sbin/blocklistd/blocklistd.conf b/usr.sbin/blocklistd/blocklistd.conf
new file mode 100644
index 000000000000..c6c7f7c2fafc
--- /dev/null
+++ b/usr.sbin/blocklistd/blocklistd.conf
@@ -0,0 +1,16 @@
+# Blocklist rule
+# adr/mask:port type proto owner name nfail duration
+[local]
+ssh stream * * * 3 24h
+ftp stream * * * 3 24h
+smtp stream * * * 3 24h
+submission stream * * * 3 24h
+#6161 stream tcp6 christos * 2 10m
+* * * * * 3 60
+
+# adr/mask:port type proto owner name nfail duration
+[remote]
+#129.168.0.0/16 * * * = * *
+#[2001:db8::]/32:ssh * * * = * *
+#6161 = = = =/24 = =
+#* stream tcp * = = =
diff --git a/usr.sbin/periodic/etc/security/520.pfdenied b/usr.sbin/periodic/etc/security/520.pfdenied
index 9852936257bc..d87dfa0ae64c 100755
--- a/usr.sbin/periodic/etc/security/520.pfdenied
+++ b/usr.sbin/periodic/etc/security/520.pfdenied
@@ -41,7 +41,7 @@ rc=0
if check_yesno_period security_status_pfdenied_enable
then
TMP=`mktemp -t security`
- for _a in "" $(pfctl -a "blacklistd" -sA 2>/dev/null) ${security_status_pfdenied_additionalanchors}
+ for _a in "" $(pfctl -a "blacklistd" -sA 2>/dev/null) $(pfctl -a "blocklistd" -sA 2>/dev/null) ${security_status_pfdenied_additionalanchors}
do
pfctl -a "${_a}" -sr -v -z 2>/dev/null | \
nawk '{if (/^block/) {buf=$0; getline; gsub(" +"," ",$0); if ($5 > 0) print buf$0;} }' >> ${TMP}
generated by cgit v1.3 (git 2.53.0) at 2026-08-16 13:00:43 +0000