From nobody Wed Oct 12 13:27:36 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MnYNm4K4Wz4fLsS; Wed, 12 Oct 2022 13:27:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MnYNm3g1Cz40n6; Wed, 12 Oct 2022 13:27:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1665581256; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BuRJm7TgagFIO98mH+sY+P/5N2SxnzfY6x4TBoUlpOM=; b=DDH63RBg4IkhsemsfqPSxIdPeAE8lNwvNbVnZ9pbZ3pBKUBsp+UbFz+t3BTgse/UsOJLwe A4wOMxaizrFxVB1gSZUY5bk84DivOTMQE640nfDnDLRIjm0a17JzMdogJ0VOQ5imaXtA0r rSKISHp2tg1dxFKfgNMQEgFBQZM7Sm0EFCQVF/xsaG6z7Q6kB46QFw+OHaTwD4R9xmoXJj DG/PsswdWmpBNMKnsWoZ31UrSm+VZbWsZw21bDaTvsrCvJs+PS+y03lJxYE3Ngv7zRA7NJ NNoXkxnn3hcACwHbB7aU001Ff5Xq60N6jx+98k934hFL3xz/+ATne0p4NwrlgQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MnYNm2SXQz1Jyx; Wed, 12 Oct 2022 13:27:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 29CDRaHA056847; Wed, 12 Oct 2022 13:27:36 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 29CDRabn056846; Wed, 12 Oct 2022 13:27:36 GMT (envelope-from git) Date: Wed, 12 Oct 2022 13:27:36 GMT Message-Id: <202210121327.29CDRabn056846@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Ed Maste Subject: git: aa05c93cb793 - main - blacklistd: Update documentation changes List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: aa05c93cb793f65cb3bed1548e514f9943c6472e Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1665581256; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BuRJm7TgagFIO98mH+sY+P/5N2SxnzfY6x4TBoUlpOM=; b=Xca8i4qwTVSZrptC+4XHsmbt2d6aXgLJduTfmhDFROJNhrsZyKVV4kemM7n9Fg9xr+O488 fsMAypxOV6IuKylu6zZYn4s+xbb0zGZR9QUR0VDDvWIe1uA8XlvP/lUCG2J6o5kNF2dz5c F/qlEFW70Y663/6GR9uTZe2oT+S6SXH4aEkRmrdJ7mzd4hLRbhdX2rwtx3nDRUmk+CB0La 8lXcpI4uw1ka9Y9rCRpyx/acrOcyx47HApu0um83JiUmtpV8U5xHIe/5Oc3hn6O5PWXhEK SL2TUUcMgiLMIVEJH07HcUbdPir9MPlqCPPQU1RhbvWAfPXqEl8FUsZpult9FA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1665581256; a=rsa-sha256; cv=none; b=waBmG0+x53jrHU3s8s45NRhYpI5KVEidygCft0pKzaAYthK06t75JwTY6nfB9IAzvtUiHA SSNZbwJ17MymJ85sjfL/nZWgpOHimTTycCn29hKPWjadN8YQ6c6RQybPQLGzXuJ1Ot/dL8 yFqZ6WVo2mGjFkHaY6paUvmNWIOrMEkVtqLY55qYU8WRbL9U5+pE3PQfLS2A6Z9x7y62uU +uIj4/vHLho83kWZ2mwIAPrNLzfgXTWwlkmeG8x28Ti/T1fLXfye2yXD03PRXZQ0IWWI1n hDrFwzgKZG3FfURZM5gwEX+AMrLEtEuLwVRLEUQhfJS/M0I8LGP8txPcTF223w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=aa05c93cb793f65cb3bed1548e514f9943c6472e commit aa05c93cb793f65cb3bed1548e514f9943c6472e Author: Jose Luis Duran AuthorDate: 2022-10-12 13:23:39 +0000 Commit: Ed Maste CommitDate: 2022-10-12 13:27:08 +0000 blacklistd: Update documentation changes Cherry-pick upstream documentation changes. Obtained from: https://github.com/zoulasc/blocklist Differential Revision: https://reviews.freebsd.org/D36086 --- contrib/blacklist/bin/blacklistd.8 | 52 ++++++++++++++++++++++++++++----- contrib/blacklist/bin/blacklistd.conf.5 | 6 ++-- contrib/blacklist/lib/libblacklist.3 | 18 +++++++++--- 3 files changed, 61 insertions(+), 15 deletions(-) diff --git a/contrib/blacklist/bin/blacklistd.8 b/contrib/blacklist/bin/blacklistd.8 index ec7f8b429d9d..82e1f15f61c9 100644 --- a/contrib/blacklist/bin/blacklistd.8 +++ b/contrib/blacklist/bin/blacklistd.8 @@ -1,4 +1,4 @@ -.\" $NetBSD: blacklistd.8,v 1.18 2016/07/30 06:09:29 dholland Exp $ +.\" $NetBSD: blacklistd.8,v 1.23 2020/04/21 13:57:12 christos Exp $ .\" .\" Copyright (c) 2015 The NetBSD Foundation, Inc. .\" All rights reserved. @@ -27,7 +27,7 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd October 5, 2018 +.Dd April 21, 2020 .Dt BLACKLISTD 8 .Os .Sh NAME @@ -65,6 +65,42 @@ with syntax specified in If an entry is matched, a state entry is created for that tuple. Each entry contains a number of tries limit and a duration. .Pp +The way +.Nm +does configuration entry matching is by having the client side pass the +file descriptor associated with the connection the client wants to blacklist +as well as passing socket credentials. +.Pp +The file descriptor is used to retrieve information (address and port) +about the remote side with +.Xr getpeername 2 +and the local side with +.Xr getsockname 2 . +.Pp +By examining the port of the local side, +.Nm +can determine if the client program +.Dq owns +the port. +By examining the optional address portion on the local side, it can match +interfaces. +By examining the remote address, it can match specific allow or deny rules. +.Pp +Finally +.Nm +can examine the socket credentials to match the user in the configuration file. +.Pp +While this works well for TCP sockets, it cannot be relied on for unbound +UDP sockets. +It is also less meaningful when it comes to connections using non-privileged +ports. +On the other hand, if we receive a request that has a local endpoint indicating +a UDP privileged port, we can presume that the client was privileged to be +able to acquire that port. +.Pp +Once an entry is matched +.Nm +can perform various actions. If the action is .Dq add and the number of tries limit is reached, then a @@ -87,10 +123,10 @@ that is not required as all information to remove the rule is kept. .Pp If the action is -.Dq remove +.Dq rem Then the same control script is invoked as: .Bd -literal -offset indent -control remove
+control rem
.Ed .Pp where @@ -202,19 +238,19 @@ instead of .Nm deals with the following signals: .Bl -tag -width "USR2" -.It HUP +.It Dv HUP Receipt of this signal causes .Nm to re-read the configuration file. -.It INT, TERM & QUIT +.It Dv INT , Dv TERM & Dv QUIT These signals tell .Nm to exit in an orderly fashion. -.It USR1 +.It Dv USR1 This signal tells .Nm to increase the internal debugging level by 1. -.It USR2 +.It Dv USR2 This signal tells .Nm to decrease the internal debugging level by 1. diff --git a/contrib/blacklist/bin/blacklistd.conf.5 b/contrib/blacklist/bin/blacklistd.conf.5 index c0e1a2b87380..3a7ecd9be171 100644 --- a/contrib/blacklist/bin/blacklistd.conf.5 +++ b/contrib/blacklist/bin/blacklistd.conf.5 @@ -1,4 +1,4 @@ -.\" $NetBSD: blacklistd.conf.5,v 1.7 2017/06/07 13:50:57 wiz Exp $ +.\" $NetBSD: blacklistd.conf.5,v 1.9 2019/11/06 20:33:30 para Exp $ .\" .\" Copyright (c) 2015 The NetBSD Foundation, Inc. .\" All rights reserved. @@ -27,7 +27,7 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd June 5, 2017 +.Dd May 18, 2020 .Dt BLACKLISTD.CONF 5 .Os .Sh NAME @@ -192,7 +192,7 @@ rule that matched. .Pp The .Va remote -rules can be used for whitelisting specific addresses, changing the mask +rules can be used for allowing specific addresses, changing the mask size, the rule that the packet filter uses, the number of failed attempts, or the block duration. .Sh FILES diff --git a/contrib/blacklist/lib/libblacklist.3 b/contrib/blacklist/lib/libblacklist.3 index aaf809469e6a..146915c8dc31 100644 --- a/contrib/blacklist/lib/libblacklist.3 +++ b/contrib/blacklist/lib/libblacklist.3 @@ -1,4 +1,4 @@ -.\" $NetBSD: libblacklist.3,v 1.8 2017/10/22 10:31:57 abhinav Exp $ +.\" $NetBSD: libblacklist.3,v 1.10 2020/03/30 15:47:15 christos Exp $ .\" .\" Copyright (c) 2015 The NetBSD Foundation, Inc. .\" All rights reserved. @@ -27,7 +27,7 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd May 5, 2017 +.Dd March 30, 2020 .Dt LIBBLACKLIST 3 .Os .Sh NAME @@ -96,11 +96,13 @@ There was an unsuccessful authentication attempt. A user successfully authenticated. .It Va BLACKLIST_ABUSIVE_BEHAVIOR The sending daemon has detected abusive behavior -from the remote system. The remote address should +from the remote system. +The remote address should be blocked as soon as possible. .It Va BLACKLIST_BAD_USER The sending daemon has determined the username -presented for authentication is invalid. The +presented for authentication is invalid. +The .Xr blacklistd 8 daemon compares the username to a configured list of forbidden usernames and @@ -122,6 +124,14 @@ functions can be used with unconnected sockets, where .Xr getpeername 2 will not work, the server will pass the peer name in the message. .Pp +In all cases the file descriptor passed in the +.Fa fd +argument must be pointing to a valid socket so that +.Xr blacklistd 8 +can establish ownership of the local endpoint +using +.Xr getsockname 2 . +.Pp By default, .Xr syslogd 8 is used for message logging.