mirror of
https://git.freebsd.org/src.git
synced 2026-01-11 19:57:22 +00:00
blacklist: Avoid duplicate manual pages in METALOG
Previously, blacklist man pages were just a symlink to their blocklist
counterpart, this in turn installed blocklist man pages twice, and
resulted in a duplicate error when running metalog_reader.lua -c.
Take advantage of the duplication to document nuances in blacklist, such
as the fact that it uses the new database and socket name (blocklist).
Also, note that it has been renamed to blocklist. In the future, it
will help to document its deprecation.
Approved by: emaste (mentor)
Fixes: 7238317403 ("blocklist: Rename blacklist to blocklist")
MFC after: 2 days
This commit is contained in:
Jose Luis Duran
parent
0cc81b375e
commit
c624004553
7 changed files with 883 additions and 13 deletions
136
contrib/blocklist/bin/blacklistctl.8
Normal file
136
contrib/blocklist/bin/blacklistctl.8
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
.\" $NetBSD: blocklistctl.8,v 1.4 2025/02/07 01:35:38 kre Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
|
||||
.\" All rights reserved.
|
||||
.\"
|
||||
.\" This code is derived from software contributed to The NetBSD Foundation
|
||||
.\" by Christos Zoulas.
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
|
||||
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
||||
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
|
||||
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
||||
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
||||
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
.\" POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd January 27, 2025
|
||||
.Dt BLACKLISTCTL 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm blacklistctl
|
||||
.Nd display and change the state of the blacklistd database
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Cm dump
|
||||
.Op Fl abdnrw
|
||||
.Op Fl D Ar dbname
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
is a program used to display and change the state of the
|
||||
.Xr blacklistd 8
|
||||
database.
|
||||
The following sub-commands are supported:
|
||||
.Ss dump
|
||||
.Pp
|
||||
The following options are available for the
|
||||
.Cm dump
|
||||
sub-command:
|
||||
.Bl -tag -width indent
|
||||
.It Fl a
|
||||
Show all database entries, by default it shows only the active ones.
|
||||
Inactive entries will be shown with a last-access (or, with
|
||||
.Fl r ,
|
||||
the remaining) time of
|
||||
.Ql never .
|
||||
.It Fl b
|
||||
Show only the blocked entries.
|
||||
.It Fl D Ar dbname
|
||||
Specify the location of the
|
||||
.Ic blacklistd
|
||||
database file to use.
|
||||
The default is
|
||||
.Pa /var/db/blocklistd.db .
|
||||
.It Fl d
|
||||
Increase debugging level.
|
||||
.It Fl n
|
||||
Don't display a header.
|
||||
.It Fl r
|
||||
Show the remaining blocked time instead of the last activity time.
|
||||
.It Fl w
|
||||
Normally the width of addresses is good for IPv4, the
|
||||
.Fl w
|
||||
flag, makes the display wide enough for IPv6 addresses.
|
||||
.El
|
||||
.Pp
|
||||
The output of the
|
||||
.Cm dump
|
||||
sub-command consists of a header (unless
|
||||
.Fl n
|
||||
was given) and one line for each record in the database, where each line
|
||||
has the following columns:
|
||||
.Bl -tag -width indent
|
||||
.It Ql address/ma:port
|
||||
The remote address, mask, and local port number of the client connection
|
||||
associated with the database entry.
|
||||
.It Ql id
|
||||
column will show the identifier for the packet filter rule associated
|
||||
with the database entry, though this may only be the word
|
||||
.Ql OK
|
||||
for packet filters which do not creat a unique identifier for each rule.
|
||||
.It Ql nfail
|
||||
The number of
|
||||
.Em failures
|
||||
reported for the client on the noted port, as well as the number of
|
||||
failures allowed before blocking (or, with
|
||||
.Fl a ,
|
||||
an asterisk
|
||||
.Aq * )
|
||||
.It So last access Sc | So remaining time Sc
|
||||
The last time a the client was reported as attempting access, or, with
|
||||
.Fl r ,
|
||||
the time remaining before the rule blocking the client will be removed.
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr blacklistd 8
|
||||
.Sh NOTES
|
||||
The
|
||||
.Nm
|
||||
program has been renamed to
|
||||
.Xr blocklistctl 8 .
|
||||
.Pp
|
||||
Sometimes the reported number of failed attempts can exceed the number
|
||||
of attempts that
|
||||
.Xr blacklistd 8
|
||||
is configured to block.
|
||||
This can happen either because the rule has been removed manually, or
|
||||
because there were more attempts in flight while the rule block was being
|
||||
added.
|
||||
This condition is normal; in that case
|
||||
.Xr blacklistd 8
|
||||
will first attempt to remove the existing rule, and then it will re-add
|
||||
it to make sure that there is only one rule active.
|
||||
.Sh HISTORY
|
||||
.Nm
|
||||
first appeared in
|
||||
.Nx 7 .
|
||||
.Fx
|
||||
support for
|
||||
.Nm
|
||||
was implemented in
|
||||
.Fx 11 .
|
||||
.Sh AUTHORS
|
||||
.An Christos Zoulas
|
||||
308
contrib/blocklist/bin/blacklistd.8
Normal file
308
contrib/blocklist/bin/blacklistd.8
Normal file
|
|
@ -0,0 +1,308 @@
|
|||
.\" $NetBSD: blocklistd.8,v 1.8 2025/02/25 22:13:34 christos Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
|
||||
.\" All rights reserved.
|
||||
.\"
|
||||
.\" This code is derived from software contributed to The NetBSD Foundation
|
||||
.\" by Christos Zoulas.
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
|
||||
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
||||
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
|
||||
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
||||
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
||||
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
.\" POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd February 25, 2025
|
||||
.Dt BLACKLISTD 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm blacklistd
|
||||
.Nd block and release ports on demand to avoid DoS abuse
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Op Fl dfrv
|
||||
.Op Fl C Ar controlprog
|
||||
.Op Fl c Ar configfile
|
||||
.Op Fl D Ar dbfile
|
||||
.Op Fl P Ar sockpathsfile
|
||||
.Op Fl R Ar rulename
|
||||
.Op Fl s Ar sockpath
|
||||
.Op Fl t Ar timeout
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
is a daemon similar to
|
||||
.Xr syslogd 8
|
||||
that listens to sockets at paths specified in the
|
||||
.Ar sockpathsfile
|
||||
for notifications from other daemons about successful or failed connection
|
||||
attempts.
|
||||
If no such file is specified, then it only listens to the socket path
|
||||
specified by
|
||||
.Ar sockpath
|
||||
or if that is not specified to
|
||||
.Pa /var/run/blocklistd.sock .
|
||||
Each notification contains an (action, port, protocol, address, owner) tuple
|
||||
that identifies the remote connection and the action.
|
||||
This tuple is consulted against entries from the
|
||||
.Ar configfile ,
|
||||
with the syntax specified in
|
||||
.Xr blacklistd.conf 5 .
|
||||
If an entry is matched, a state entry is created for that tuple.
|
||||
Each entry contains a number of tries limit and a duration.
|
||||
.Pp
|
||||
If
|
||||
.Ar configfile
|
||||
is a directory, or a directory exists with the same name as
|
||||
.Ar configfile
|
||||
with
|
||||
.Qq .d
|
||||
appended to it, each file in the directory will be read as configuration file.
|
||||
If
|
||||
.Ar configfile
|
||||
exists as a file it will be processed before the contents of the
|
||||
.Ar configfile Ns .d
|
||||
directory if that also exists.
|
||||
.Pp
|
||||
The way
|
||||
.Nm
|
||||
does configuration entry matching is by having the client side pass the
|
||||
file descriptor associated with the connection the client wants to blacklist
|
||||
as well as passing socket credentials.
|
||||
.Pp
|
||||
The file descriptor is used to retrieve information (address and port)
|
||||
about the remote side with
|
||||
.Xr getpeername 2
|
||||
and the local side with
|
||||
.Xr getsockname 2 .
|
||||
.Pp
|
||||
By examining the port of the local side,
|
||||
.Nm
|
||||
can determine if the client program
|
||||
.Dq owns
|
||||
the port.
|
||||
By examining the optional address portion on the local side, it can match
|
||||
interfaces.
|
||||
By examining the remote address, it can match specific allow or deny rules.
|
||||
.Pp
|
||||
Finally
|
||||
.Nm
|
||||
can examine the socket credentials to match the user in the configuration file.
|
||||
.Pp
|
||||
While this works well for TCP sockets, it cannot be relied on for unbound
|
||||
UDP sockets.
|
||||
It is also less meaningful when it comes to connections using non-privileged
|
||||
ports.
|
||||
On the other hand, if we receive a request that has a local endpoint indicating
|
||||
a UDP privileged port, we can presume that the client was privileged to be
|
||||
able to acquire that port.
|
||||
.Pp
|
||||
Once an entry is matched
|
||||
.Nm
|
||||
can perform various actions.
|
||||
If the action is
|
||||
.Dq add
|
||||
and the number of tries limit is reached, then a
|
||||
control script
|
||||
.Ar controlprog
|
||||
is invoked with arguments:
|
||||
.Bd -literal -offset indent
|
||||
control add <rulename> <proto> <address> <mask> <port>
|
||||
.Ed
|
||||
.Pp
|
||||
and should invoke a packet filter command to block the connection
|
||||
specified by the arguments.
|
||||
The
|
||||
.Ar rulename
|
||||
argument can be set from the command line (default
|
||||
.Dv blacklistd ) .
|
||||
The script could print a numerical id to stdout as a handle for
|
||||
the rule that can be used later to remove that connection, but
|
||||
that is not required as all information to remove the rule is
|
||||
kept.
|
||||
.Pp
|
||||
If the action is
|
||||
.Dq rem
|
||||
Then the same control script is invoked as:
|
||||
.Bd -literal -offset indent
|
||||
control rem <rulename> <proto> <address> <mask> <port> <id>
|
||||
.Ed
|
||||
.Pp
|
||||
where
|
||||
.Ar id
|
||||
is the number returned from the
|
||||
.Dq add
|
||||
action.
|
||||
.Pp
|
||||
.Nm
|
||||
maintains a database of known connections in
|
||||
.Ar dbfile .
|
||||
On startup it reads entries from that file, and updates its internal state.
|
||||
.Pp
|
||||
.Nm
|
||||
checks the list of active entries every
|
||||
.Ar timeout
|
||||
seconds (default
|
||||
.Dv 15 )
|
||||
and removes entries and block rules using the control program as necessary.
|
||||
.Pp
|
||||
The following options are available:
|
||||
.Bl -tag -width indent
|
||||
.It Fl C Ar controlprog
|
||||
Use
|
||||
.Ar controlprog
|
||||
to communicate with the packet filter, instead of the default, which is
|
||||
.Pa /usr/libexec/blacklistd-helper .
|
||||
The following arguments are passed to the control program:
|
||||
.Bl -tag -width protocol
|
||||
.It action
|
||||
The action to perform:
|
||||
.Dv add ,
|
||||
.Dv rem ,
|
||||
or
|
||||
.Dv flush ;
|
||||
to add, remove or flush a firewall rule.
|
||||
.It name
|
||||
The rule name.
|
||||
.It protocol
|
||||
The optional protocol name (can be empty):
|
||||
.Dv tcp ,
|
||||
.Dv tcp6 ,
|
||||
.Dv udp ,
|
||||
.Dv udp6 .
|
||||
.It address
|
||||
The IPv4 or IPv6 numeric address to be blocked or released.
|
||||
.It mask
|
||||
The numeric mask to be applied to the blocked or released address
|
||||
.It port
|
||||
The optional numeric port to be blocked (can be empty).
|
||||
.It id
|
||||
For packet filters that support removal of rules by rule identifier, the
|
||||
identifier of the rule to be removed.
|
||||
The add command is expected to return the rule identifier string to stdout.
|
||||
.El
|
||||
.It Fl c Ar configuration
|
||||
The name of the configuration file to read.
|
||||
The default when
|
||||
.Fl c
|
||||
is not given is
|
||||
.Pa /etc/blacklistd.conf .
|
||||
.It Fl D Ar dbfile
|
||||
The Berkeley DB file where
|
||||
.Nm
|
||||
stores its state.
|
||||
It defaults to
|
||||
.Pa /var/db/blocklistd.db .
|
||||
.It Fl d
|
||||
Normally,
|
||||
.Nm
|
||||
disassociates itself from the terminal unless the
|
||||
.Fl d
|
||||
flag is specified, in which case it stays in the foreground.
|
||||
.It Fl f
|
||||
Truncate the state database and flush all the rules named
|
||||
.Ar rulename
|
||||
are deleted by invoking the control script as:
|
||||
.Bd -literal -offset indent
|
||||
control flush <rulename>
|
||||
.Ed
|
||||
.It Fl P Ar sockpathsfile
|
||||
A file containing a list of pathnames, one per line that
|
||||
.Nm
|
||||
will create sockets to listen to.
|
||||
This is useful for chrooted environments.
|
||||
.It Fl R Ar rulename
|
||||
Specify the default rule name for the packet filter rules, usually
|
||||
.Dv blacklistd .
|
||||
.It Fl r
|
||||
Re-read the firewall rules from the internal database, then
|
||||
remove and re-add them.
|
||||
This helps for packet filters that do not retain state across reboots.
|
||||
.It Fl s Ar sockpath
|
||||
Add
|
||||
.Ar sockpath
|
||||
to the list of Unix sockets
|
||||
.Nm
|
||||
listens to.
|
||||
.It Fl t Ar timeout
|
||||
The interval in seconds
|
||||
.Nm
|
||||
polls the state file to update the rules.
|
||||
.It Fl v
|
||||
Cause
|
||||
.Nm
|
||||
to print
|
||||
diagnostic messages to
|
||||
.Dv stdout
|
||||
instead of
|
||||
.Xr syslogd 8 .
|
||||
.El
|
||||
.Sh SIGNAL HANDLING
|
||||
.Nm
|
||||
deals with the following signals:
|
||||
.Bl -tag -width "USR2"
|
||||
.It Dv HUP
|
||||
Receipt of this signal causes
|
||||
.Nm
|
||||
to re-read the configuration file.
|
||||
.It Dv INT , Dv TERM & Dv QUIT
|
||||
These signals tell
|
||||
.Nm
|
||||
to exit in an orderly fashion.
|
||||
.It Dv USR1
|
||||
This signal tells
|
||||
.Nm
|
||||
to increase the internal debugging level by 1.
|
||||
.It Dv USR2
|
||||
This signal tells
|
||||
.Nm
|
||||
to decrease the internal debugging level by 1.
|
||||
.El
|
||||
.Sh FILES
|
||||
.Bl -tag -width /usr/libexec/blacklistd-helper -compact
|
||||
.It Pa /usr/libexec/blacklistd-helper
|
||||
Shell script invoked to interface with the packet filter.
|
||||
.It Pa /etc/blacklistd.conf
|
||||
Configuration file.
|
||||
.It Pa /var/db/blocklistd.db
|
||||
Database of current connection entries.
|
||||
.It Pa /var/run/blocklistd.sock
|
||||
Socket to receive connection notifications.
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr blacklistd.conf 5 ,
|
||||
.Xr blacklistctl 8 ,
|
||||
.Xr ipf 8 ,
|
||||
.Xr ipfw 8 ,
|
||||
.Xr pfctl 8 ,
|
||||
.Xr syslogd 8
|
||||
.Sh NOTES
|
||||
The
|
||||
.Nm
|
||||
daemon has been renamed to
|
||||
.Xr blocklistd 8 .
|
||||
.Sh HISTORY
|
||||
.Nm
|
||||
first appeared in
|
||||
.Nx 7 .
|
||||
.Fx
|
||||
support for
|
||||
.Nm
|
||||
was implemented in
|
||||
.Fx 11 .
|
||||
.Sh AUTHORS
|
||||
.An Christos Zoulas
|
||||
242
contrib/blocklist/bin/blacklistd.conf.5
Normal file
242
contrib/blocklist/bin/blacklistd.conf.5
Normal file
|
|
@ -0,0 +1,242 @@
|
|||
.\" $NetBSD: blocklistd.conf.5,v 1.7 2025/02/11 17:47:05 christos Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2015, 2025 The NetBSD Foundation, Inc.
|
||||
.\" All rights reserved.
|
||||
.\"
|
||||
.\" This code is derived from software contributed to The NetBSD Foundation
|
||||
.\" by Christos Zoulas.
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
|
||||
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
||||
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
|
||||
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
||||
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
||||
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
.\" POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd February 5, 2025
|
||||
.Dt BLACKLISTD.CONF 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm blacklistd.conf
|
||||
.Nd configuration file format for blacklistd
|
||||
.Sh DESCRIPTION
|
||||
The
|
||||
.Nm
|
||||
file contains configuration entries for
|
||||
.Xr blacklistd 8
|
||||
in a fashion similar to
|
||||
.Xr inetd.conf 5 .
|
||||
Only one entry per line is permitted.
|
||||
Every entry must have all fields populated.
|
||||
Each field can be separated by a tab or a space.
|
||||
Comments are denoted by a
|
||||
.Dq #
|
||||
at the beginning of a line.
|
||||
.Pp
|
||||
There are two kinds of configuration lines,
|
||||
.Va [local]
|
||||
and
|
||||
.Va [remote] .
|
||||
By default, configuration lines are
|
||||
.Va [local] ,
|
||||
i.e. the address specified refers to the addresses on the local machine.
|
||||
To switch to between
|
||||
.Va [local]
|
||||
and
|
||||
.Va [remote]
|
||||
configuration lines you can specify the stanzas:
|
||||
.Dq [local]
|
||||
and
|
||||
.Dq [remote] .
|
||||
.Pp
|
||||
On
|
||||
.Va [local]
|
||||
and
|
||||
.Va [remote]
|
||||
lines
|
||||
.Dq *
|
||||
means use the default, or wildcard match.
|
||||
In addition, for
|
||||
.Va [remote]
|
||||
lines
|
||||
.Dq =
|
||||
means use the values from the matched
|
||||
.Va [local]
|
||||
configuration line.
|
||||
.Pp
|
||||
The first four fields,
|
||||
.Va location ,
|
||||
.Va type ,
|
||||
.Va proto ,
|
||||
and
|
||||
.Va owner
|
||||
are used to match the
|
||||
.Va [local]
|
||||
or
|
||||
.Va [remote]
|
||||
addresses, whereas the last 3 fields
|
||||
.Va name ,
|
||||
.Va nfail ,
|
||||
and
|
||||
.Va disable
|
||||
are used to modify the filtering action.
|
||||
.Pp
|
||||
The first field denotes the
|
||||
.Va location
|
||||
as an address, mask, and port.
|
||||
The syntax for the
|
||||
.Va location
|
||||
is:
|
||||
.Bd -literal -offset indent
|
||||
[<address>|<interface>][/<mask>][:<port>]
|
||||
.Ed
|
||||
.Pp
|
||||
The
|
||||
.Dv address
|
||||
can be an IPv4 address in numeric format, an IPv6 address
|
||||
in numeric format and enclosed by square brackets, or an interface name.
|
||||
Mask modifiers are not allowed on interfaces because interfaces
|
||||
can have multiple addresses in different protocols where the mask has a
|
||||
different size.
|
||||
.Pp
|
||||
The
|
||||
.Dv mask
|
||||
is always numeric, but the
|
||||
.Dv port
|
||||
can be either numeric or symbolic.
|
||||
.Pp
|
||||
The second field is the socket
|
||||
.Va type :
|
||||
.Dv stream ,
|
||||
.Dv dgram ,
|
||||
or numeric.
|
||||
The third field is the
|
||||
.Va protocol :
|
||||
.Dv tcp ,
|
||||
.Dv udp ,
|
||||
.Dv tcp6 ,
|
||||
.Dv udp6 ,
|
||||
or numeric.
|
||||
The fourth field is the effective user
|
||||
.Va ( owner )
|
||||
of the daemon process reporting the event,
|
||||
either as a username or a userid.
|
||||
.Pp
|
||||
The rest of the fields control the behavior of the filter.
|
||||
.Pp
|
||||
The
|
||||
.Va name
|
||||
field, is the name of the packet filter rule to be used.
|
||||
If the
|
||||
.Va name
|
||||
starts with a hyphen
|
||||
.Pq Dq - ,
|
||||
then the default rulename is prepended to the given name.
|
||||
If the
|
||||
.Dv name
|
||||
contains a
|
||||
.Dq / ,
|
||||
the remaining portion of the name is interpreted as the mask to be
|
||||
applied to the address specified in the rule, causing a single rule violation to
|
||||
block the entire subnet for the configured prefix.
|
||||
.Pp
|
||||
The
|
||||
.Va nfail
|
||||
field contains the number of failed attempts before access is blocked,
|
||||
defaulting to
|
||||
.Dq *
|
||||
meaning never, and the last field
|
||||
.Va duration
|
||||
specifies the amount of time since the last access that the blocking
|
||||
rule should be active, defaulting to
|
||||
.Dq *
|
||||
meaning forever.
|
||||
The default unit for
|
||||
.Va duration
|
||||
is seconds, but one can specify suffixes for different units, such as
|
||||
.Dq m
|
||||
for minutes
|
||||
.Dq h
|
||||
for hours and
|
||||
.Dq d
|
||||
for days.
|
||||
.Pp
|
||||
Matching is done first by checking the
|
||||
.Va [local]
|
||||
rules individually, in the order of the most specific to the least specific.
|
||||
If a match is found, then the matching
|
||||
.Va [remote]
|
||||
rules are applied.
|
||||
The
|
||||
.Va name ,
|
||||
.Va nfail ,
|
||||
and
|
||||
.Va duration
|
||||
fields can be altered by the
|
||||
.Va [remote]
|
||||
rule that matched.
|
||||
.Pp
|
||||
The
|
||||
.Va [remote]
|
||||
rules can be used for allowing specific addresses, changing the mask
|
||||
size (via
|
||||
.Va name ) ,
|
||||
the rule that the packet filter uses (also via
|
||||
.Va name ) ,
|
||||
the number of failed attempts (via
|
||||
.Va nfail ) ,
|
||||
or the duration to block (via
|
||||
.Va duration ) .
|
||||
.Sh FILES
|
||||
.Bl -tag -width /etc/blacklistd.conf -compact
|
||||
.It Pa /etc/blacklistd.conf
|
||||
Configuration file.
|
||||
.El
|
||||
.Sh EXAMPLES
|
||||
.Bd -literal -offset 8n
|
||||
# Block ssh, after 3 attempts for 6 hours on the bnx0 interface
|
||||
[local]
|
||||
# location type proto owner name nfail duration
|
||||
bnx0:ssh * * * * 3 6h
|
||||
[remote]
|
||||
# Never block 1.2.3.4
|
||||
1.2.3.4:ssh * * * * * *
|
||||
# Never block the example IPv6 subnet either
|
||||
[2001:db8::]/32:ssh * * * * * *
|
||||
# For addresses coming from 8.8.0.0/16 block whole /24 networks instead
|
||||
# individual hosts, but keep the rest of the blocking parameters the same.
|
||||
8.8.0.0/16:ssh * * * /24 = =
|
||||
.Ed
|
||||
.Sh SEE ALSO
|
||||
.Xr blacklistctl 8 ,
|
||||
.Xr blacklistd 8
|
||||
.Sh NOTES
|
||||
The
|
||||
.Nm
|
||||
file has been renamed to
|
||||
.Xr blocklistd.conf 8 .
|
||||
.Sh HISTORY
|
||||
.Nm
|
||||
first appeared in
|
||||
.Nx 7 .
|
||||
.Fx
|
||||
support for
|
||||
.Nm
|
||||
was implemented in
|
||||
.Fx 11 .
|
||||
.Sh AUTHORS
|
||||
.An Christos Zoulas
|
||||
188
contrib/blocklist/lib/libblacklist.3
Normal file
188
contrib/blocklist/lib/libblacklist.3
Normal file
|
|
@ -0,0 +1,188 @@
|
|||
.\" $NetBSD: libblocklist.3,v 1.7 2025/02/05 20:14:30 christos Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
|
||||
.\" All rights reserved.
|
||||
.\"
|
||||
.\" This code is derived from software contributed to The NetBSD Foundation
|
||||
.\" by Christos Zoulas.
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
|
||||
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
||||
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
|
||||
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
||||
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
||||
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
.\" POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd February 5, 2025
|
||||
.Dt LIBBLACKLIST 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm blacklist_open ,
|
||||
.Nm blacklist_open2 ,
|
||||
.Nm blacklist_close ,
|
||||
.Nm blacklist_r ,
|
||||
.Nm blacklist ,
|
||||
.Nm blacklist_sa ,
|
||||
.Nm blacklist_sa_r
|
||||
.Nd Blacklistd notification library
|
||||
.Sh LIBRARY
|
||||
.Lb libblacklist
|
||||
.Sh SYNOPSIS
|
||||
.In blacklist.h
|
||||
.Ft struct blacklist *
|
||||
.Fn blacklist_open "void"
|
||||
.Ft struct blacklist *
|
||||
.Fn blacklist_open2 "void (*logger)(int, struct syslog_data *, va_list)"
|
||||
.Ft void
|
||||
.Fn blacklist_close "struct blacklist *cookie"
|
||||
.Ft int
|
||||
.Fn blacklist "int action" "int fd" "const char *msg"
|
||||
.Ft int
|
||||
.Fn blacklist_r "struct blacklist *cookie" "int action" "int fd" "const char *msg"
|
||||
.Ft int
|
||||
.Fn blacklist_sa "int action" "int fd" "const struct sockaddr *sa" "socklen_t salen" "const char *msg"
|
||||
.Ft int
|
||||
.Fn blacklist_sa_r "struct blacklist *cookie" "int action" "int fd" "const struct sockaddr *sa" "socklen_t salen" "const char *msg"
|
||||
.Sh DESCRIPTION
|
||||
These functions can be used by daemons to notify
|
||||
.Xr blacklistd 8
|
||||
about successful and failed remote connections so that blacklistd can
|
||||
block or release port access to prevent Denial of Service attacks.
|
||||
.Pp
|
||||
The function
|
||||
.Fn blacklist_open
|
||||
creates the necessary state to communicate with
|
||||
.Xr blacklistd 8
|
||||
and returns a pointer to it, or
|
||||
.Dv NULL
|
||||
on failure.
|
||||
.Pp
|
||||
The function
|
||||
.Fn blacklist_open2
|
||||
is similar to
|
||||
.Fn blacklist_open
|
||||
but allows a
|
||||
.Fa logger
|
||||
to be specified.
|
||||
If the
|
||||
.Fa logger
|
||||
is
|
||||
.Dv NULL ,
|
||||
then no logging is performed.
|
||||
.Pp
|
||||
The
|
||||
.Fn blacklist_close
|
||||
function frees all memory and resources used.
|
||||
.Pp
|
||||
The
|
||||
.Fn blacklist
|
||||
function sends a message to
|
||||
.Xr blacklistd 8 ,
|
||||
with an integer
|
||||
.Ar action
|
||||
argument specifying the type of notification,
|
||||
a file descriptor
|
||||
.Ar fd
|
||||
specifying the accepted file descriptor connected to the client,
|
||||
and an optional message in the
|
||||
.Ar msg
|
||||
argument.
|
||||
.Pp
|
||||
The
|
||||
.Ar action
|
||||
parameter can take these values:
|
||||
.Bl -tag -width ".Dv BLACKLIST_ABUSIVE_BEHAVIOR"
|
||||
.It Dv BLACKLIST_AUTH_FAIL
|
||||
There was an unsuccessful authentication attempt.
|
||||
.It Dv BLACKLIST_AUTH_OK
|
||||
A user successfully authenticated.
|
||||
.It Dv BLACKLIST_ABUSIVE_BEHAVIOR
|
||||
The sending daemon has detected abusive behavior
|
||||
from the remote system.
|
||||
The remote address should
|
||||
be blocked as soon as possible.
|
||||
.It Dv BLACKLIST_BAD_USER
|
||||
The sending daemon has determined the username
|
||||
presented for authentication is invalid.
|
||||
The
|
||||
.Xr blacklistd 8
|
||||
daemon compares the username to a configured list of forbidden
|
||||
usernames and
|
||||
blocks the address immediately if a forbidden username matches.
|
||||
(The
|
||||
.Dv BLACKLIST_BAD_USER
|
||||
support is not currently available.)
|
||||
.El
|
||||
.Pp
|
||||
The
|
||||
.Fn blacklist_r
|
||||
function is more efficient because it keeps the blacklist state around.
|
||||
.Pp
|
||||
The
|
||||
.Fn blacklist_sa
|
||||
and
|
||||
.Fn blacklist_sa_r
|
||||
functions can be used with unconnected sockets, where
|
||||
.Xr getpeername 2
|
||||
will not work, the server will pass the peer name in the message.
|
||||
.Pp
|
||||
In all cases the file descriptor passed in the
|
||||
.Fa fd
|
||||
argument must be pointing to a valid socket so that
|
||||
.Xr blacklistd 8
|
||||
can establish ownership of the local endpoint
|
||||
using
|
||||
.Xr getsockname 2 .
|
||||
.Pp
|
||||
By default,
|
||||
.Xr syslogd 8
|
||||
is used for message logging.
|
||||
The internal
|
||||
.Fn bl_create
|
||||
function can be used to create the required internal
|
||||
state and specify a custom logging function.
|
||||
.Sh RETURN VALUES
|
||||
The function
|
||||
.Fn blacklist_open
|
||||
returns a cookie on success and
|
||||
.Dv NULL
|
||||
on failure setting
|
||||
.Dv errno
|
||||
to an appropriate value.
|
||||
.Pp
|
||||
The functions
|
||||
.Fn blacklist ,
|
||||
.Fn blacklist_sa ,
|
||||
and
|
||||
.Fn blacklist_sa_r
|
||||
return
|
||||
.Dv 0
|
||||
on success and
|
||||
.Dv \-1
|
||||
on failure setting
|
||||
.Dv errno
|
||||
to an appropriate value.
|
||||
.Sh NOTES
|
||||
The
|
||||
.Lb libblacklist
|
||||
has been renamed to
|
||||
.Xr libblocklist 3 .
|
||||
.Sh SEE ALSO
|
||||
.Xr blacklistd.conf 5 ,
|
||||
.Xr blacklistd 8
|
||||
.Sh AUTHORS
|
||||
.An Christos Zoulas
|
||||
|
|
@ -18,14 +18,13 @@ CFLAGS+=-I${BLOCKLIST_DIR}/include -I${BLOCKLIST_DIR}/port \
|
|||
|
||||
SRCS= old_bl.c blacklist.c vsyslog_r.c
|
||||
INCS= blacklist.h
|
||||
MAN= libblocklist.3
|
||||
MAN= libblacklist.3
|
||||
|
||||
MLINKS+=libblocklist.3 libblacklist.3 \
|
||||
libblocklist.3 blacklist_open.3 \
|
||||
libblocklist.3 blacklist_close.3 \
|
||||
libblocklist.3 blacklist.3 \
|
||||
libblocklist.3 blacklist_r.3 \
|
||||
libblocklist.3 blacklist_sa.3 \
|
||||
libblocklist.3 blacklist_sa_r.3
|
||||
MLINKS= libblacklist.3 blacklist_open.3 \
|
||||
libblacklist.3 blacklist_close.3 \
|
||||
libblacklist.3 blacklist.3 \
|
||||
libblacklist.3 blacklist_r.3 \
|
||||
libblacklist.3 blacklist_sa.3 \
|
||||
libblacklist.3 blacklist_sa_r.3
|
||||
|
||||
.include <bsd.lib.mk>
|
||||
|
|
|
|||
|
|
@ -6,8 +6,7 @@ PACKAGE= blocklist
|
|||
PROG= blacklistctl
|
||||
SRCS= blacklistctl.c conf.c state.c support.c old_internal.c \
|
||||
sockaddr_snprintf.c pidfile.c strtoi.c popenve.c
|
||||
MAN= blocklistctl.8
|
||||
MLINKS= blocklistctl.8 blacklistctl.8
|
||||
MAN= blacklistctl.8
|
||||
|
||||
LDFLAGS+=-L${LIBBLACKLISTDIR}
|
||||
LIBADD+= blocklist util
|
||||
|
|
|
|||
|
|
@ -7,9 +7,7 @@ CONFS= blacklistd.conf
|
|||
PROG= blacklistd
|
||||
SRCS= blacklistd.c conf.c run.c state.c support.c old_internal.c \
|
||||
sockaddr_snprintf.c pidfile.c strtoi.c popenve.c vsyslog_r.c
|
||||
MAN= blocklistd.8 blocklistd.conf.5
|
||||
MLINKS= blocklistd.8 blacklistd.8 \
|
||||
blocklistd.conf.5 blacklistd.conf.5
|
||||
MAN= blacklistd.8 blacklistd.conf.5
|
||||
|
||||
LDFLAGS+=-L${LIBBLACKLISTDIR}
|
||||
LIBADD+= blocklist util
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue