aboutsummaryrefslogtreecommitdiff
path: root/contrib/blacklist
Commit message (Collapse)AuthorAgeFilesLines
* blacklistd.conf.5: typo/grammar fixesEd Maste2020-05-191-3/+3
| | | | | | | | PR: 246467 Submitted by: Mike Lempriere Notes: svn path=/head/; revision=361230
* blacklistd.8: fix db file pathEd Maste2020-04-211-1/+1
| | | | | | | | | PR: 245781 Submitted by: Jose Luis Duran MFC after: 3 days Notes: svn path=/head/; revision=360144
* blacklistd.conf.5: pluralization correctionEd Maste2019-11-061-1/+1
| | | | | | | | Submitted by: bcr in review D22259 MFC with: r354399 Notes: svn path=/head/; revision=354401
* blacklist: update to NetBSD snapshot on 20191106Ed Maste2019-11-067-191/+136
| | | | | | | | | | Cursory review: cem MFC after: 3 months Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D22259 Notes: svn path=/head/; revision=354399
* blacklistd: remove reference to NetBSD npfctlEd Maste2019-10-221-1/+1
| | | | | | | | | | | Xr pfctl instead. PR: 221069 Submitted by: "fml" MFC after: 3 days Notes: svn path=/head/; revision=353898
* Fixup syslog() call that should have used logging function pointerKurt Lidl2019-03-181-1/+1
| | | | | | | | PR: 236614 Submitted by: Helge Oldach <freebsd@oldach.net> Notes: svn path=/head/; revision=345276
* Document signal handling in blacklistd(8).Kurt Lidl2018-10-051-2/+23
| | | | | | | | | | Reviewed by: bcr@, 0mp@ Approved by: re (gjb@) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D17423 Notes: svn path=/head/; revision=339199
* Revert 335888 ("Ensure va_list is declared by including stdarg.h.")Ruslan Bukin2018-07-031-1/+0
| | | | | | | | | | | | | The issue was caused by header pollution brought by GCC 8.1. We now have to remove include-fixed headers in the GCC installation directory. Sponsored by: DARPA, AFRL Pointed out by: jhb Notes: svn path=/head/; revision=335893
* o Ensure va_list is declared by including stdarg.h.Ruslan Bukin2018-07-031-0/+1
| | | | | | | | | | | | o Also move printf.h to go after it since it does require declaration of va_list. This fixes build with latest RISC-V GNU Toolchain with GCC 8.1 Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=335888
* blacklist: Fix minor memory leak in configuration parsing error caseConrad Meyer2018-03-201-0/+1
| | | | | | | | | | | | Ordinarily, the continue clause of the for-loop would free 'line.' In this case we instead return early, missing the free. Add an explicit free to avoid the leak. Reported by: Coverity Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=331230
* Update blacklist-helper to not emit messages from pf during operation.Kurt Lidl2018-02-041-4/+10
| | | | | | | | | | | | | Use 'pfctl -k' when blocking a site to kill active tcp connections from the blocked address. Fix 'purge' operation for pf, which must dynamically determine which filters have been created, so the filters can be flushed by name. MFC after: 2 weeks Notes: svn path=/head/; revision=328861
* Extend libblacklist support with new action typesKurt Lidl2017-05-235-11/+81
| | | | | | | | | | | | | | | | | | | | | | | | The original blacklist library supported two notification types: - failed auth attempt, which incremented the failed login count by one for the remote address - successful auth attempt, which reset the failed login count to zero for that remote address When the failed login count reached the limit in the configuration file, the remote address would be blocked by a packet filter. This patch implements a new notification type, "abusive behavior", and accepts, but does not act on an additional type, "bad username". It is envisioned that a system administrator will configure a small list of "known bad usernames" that should be blocked immediately. Reviewed by: emaste MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D10604 Notes: svn path=/head/; revision=318755
* Merge latest version of blacklist sources from NetBSD (@ 20170503)Kurt Lidl2017-05-0411-36/+71
| | | | | | | | MFC after: 3 days Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=317802
* Reset failed login count to zero when removing a blocked addressKurt Lidl2017-02-231-5/+17
| | | | | | | | | | | | | | | | | | | | | | | | The blacklistd daemon keeps records of failed login attempts for each address:port that is flagged as a failed login. When a successful login occurs for that address:port combination, the record's last update time is set to zero, to indicate no current failed login attempts. Reset the failed login count to zero, so that at the next failed login attempt, the counting will restart properly at zero. Without this reset to zero, the first failed login after a successful login will cause the address to be blocked immediately. When debugging is turned on, output more information about database state before and after the database updates have occured. A similar patch has already been upstreamed to NetBSD. MFC after: 3 days Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=314120
* Improve ipfw rule creation for blacklist-helper scriptKurt Lidl2017-02-221-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When blocking an address, the blacklist-helper script needs to do the following things for the ipfw packet filter: - create a table to hold the addresses to be blocked, so lookups can be done quickly, and place the address to be blocked in that table - create rule that does the lookup in the table and blocks the packet The ipfw system allows multiple rules to be inserted for a given rule number. There only needs to be one rule to do the lookup per port. Modify the script to probe for the existence of the rule before attempting to create it, so only one rule is inserted, rather than one rule per blocked address. PR: 214980 Reported by: azhegalov (at) gmail.com Reviewed by: emaste MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D9681 Notes: svn path=/head/; revision=314111
* Make blacklist-helper commands emit a message when successfulKurt Lidl2016-10-041-16/+22
| | | | | | | | | | | | | | | | | | | | | | The blacklistd daemon expects to see a message on stdout, instead of just relying on the exit value from any invoked programs. Change the pf filtering to create multiple filters, attached under a the "blacklist/*" anchor point. This prevents the filtering for each port's filtering rule from overwriting the previously installed filtering rule. Check for an existing filtering rule for each port, so the installation of a given filtering rule only happens once. Reinstalling the same rule resets the counters for the pf rule, and we don't want that. Reported by: David Horn (dhorn2000 at gmail.com) Reviewed by: emaste MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D8081 Notes: svn path=/head/; revision=306695
* Fix blacklistd's state restoral at startupKurt Lidl2016-09-302-8/+10
| | | | | | | | | | | | | | | | | | | The blacklistd daemon attempted to restore the filtering rules before the database of blocked addresses was opened, so no rules were being reloaded. Now the rules are properly recreated when the daemon is started with '-r'. This bug was fixed locally, and then sent upstream to NetBSD. This changeset is the import the NetBSD version of the change, which added debugging output to alert about a null database. Reviewed by: emaste Obtained from: NetBSD MFC after: 1 week Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=306508
* Update blacklistd.8 with changes from NetBSDKurt Lidl2016-09-301-3/+4
| | | | | | | | | | Obtained from: NetBSD MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D8079 Notes: svn path=/head/; revision=306507
* libblacklist: Do not use %m for logging, use strerror(errno)Kurt Lidl2016-07-291-9/+12
| | | | | | | | | | | | | | | | The blacklist library can accept a function to use for logging, defaulting to vsyslog(), if no function is specified. Make the blacklist library use strerror(errno) explicitly, instead of %m, so that the passed in function does not need to support the syslog specific placeholder. This matches a change already submitted and accepted upstream. MFC after: 1 week Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=303518
* Add ipfilter support to blacklistd-helperKurt Lidl2016-06-121-9/+29
| | | | | | | | | | | | | | | | | In addition to adding initial support for the ipfilter packet filtering system, wrap a few long lines, perform whitespace cleanup and sync with upstream changes made in NetBSD. Submitted by: cy Reviewed by: cy Approved by: re (hrs) Relnotes: YES Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D6823 Notes: svn path=/head/; revision=301843
* Add IPFW support to blacklistd-helperKurt Lidl2016-06-091-0/+18
| | | | | | | | | Relnotes: YES Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D6753 Notes: svn path=/head/; revision=301736
* Move misplaced break statement to right placeRenato Botelho2016-06-081-1/+1
| | | | | | | | | | | Reported by: Coverity CID: 1304340 Reviewed by: lidl Differential Revision: https://reviews.freebsd.org/D6749 Sponsored by: Rubicon Communications (Netgate) Notes: svn path=/head/; revision=301603
* Bump dates in blacklist related manpagesKurt Lidl2016-06-073-3/+3
| | | | | | | | Reported by: araujo Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=301555
* Note blacklist support first appeared in FreeBSD 11Kurt Lidl2016-06-073-3/+15
| | | | | | | | Reported by: jbeich Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=301552
* Fixup path in NetBSD supplied documentation for FreeBSDKurt Lidl2016-06-021-3/+3
| | | | | | | | | | | | | | NetBSD installs the blacklist-helper script in /libexec, and it goes into /usr/libexec on FreeBSD. Update the docs to match FreeBSD's installation location. Reviewed by: rpaulo Approved by: rpaulo Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D6592 Notes: svn path=/head/; revision=301219
* Import NetBSD's blacklist source from vendor treeKurt Lidl2016-06-0158-0/+7239
This import includes The basic blacklist library and utility programs, to add a system-wide packet filtering notification mechanism to FreeBSD. The rational behind the daemon was given by Christos Zoulas in a presentation at vBSDcon 2015: https://youtu.be/fuuf8G28mjs Reviewed by: rpaulo Approved by: rpaulo Obtained from: NetBSD Relnotes: YES Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D5912 Notes: svn path=/head/; revision=301172
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-04 07:15:42 +0000