Revisit blacklistd support in ftpd
Enhance blacklistd support to not log anything by default, unless blacklistd support is enabled on the command line. Document new flag in man page, cleanup patches to be less intrusive in code. Reported by: Rick Adams Reviewed by: cem, emaste MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D8374
This commit is contained in:
parent
dda4d36957
commit
e07d11b691
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=308175
@ -37,16 +37,20 @@
|
|||||||
#include <blacklist.h>
|
#include <blacklist.h>
|
||||||
|
|
||||||
static struct blacklist *blstate;
|
static struct blacklist *blstate;
|
||||||
|
extern int use_blacklist;
|
||||||
|
|
||||||
void
|
void
|
||||||
blacklist_init(void)
|
blacklist_init(void)
|
||||||
{
|
{
|
||||||
|
|
||||||
|
if (use_blacklist)
|
||||||
blstate = blacklist_open();
|
blstate = blacklist_open();
|
||||||
}
|
}
|
||||||
|
|
||||||
void
|
void
|
||||||
blacklist_notify(int action, int fd, char *msg)
|
blacklist_notify(int action, int fd, char *msg)
|
||||||
{
|
{
|
||||||
|
|
||||||
if (blstate == NULL)
|
if (blstate == NULL)
|
||||||
return;
|
return;
|
||||||
(void)blacklist_r(blstate, action, fd, msg);
|
(void)blacklist_r(blstate, action, fd, msg);
|
||||||
|
@ -28,5 +28,26 @@
|
|||||||
|
|
||||||
/* $FreeBSD$ */
|
/* $FreeBSD$ */
|
||||||
|
|
||||||
void blacklist_notify(int, int, char *);
|
#ifndef BLACKLIST_CLIENT_H
|
||||||
|
#define BLACKLIST_CLIENT_H
|
||||||
|
|
||||||
|
enum {
|
||||||
|
BLACKLIST_AUTH_OK = 0,
|
||||||
|
BLACKLIST_AUTH_FAIL
|
||||||
|
};
|
||||||
|
|
||||||
|
#ifdef USE_BLACKLIST
|
||||||
void blacklist_init(void);
|
void blacklist_init(void);
|
||||||
|
void blacklist_notify(int, int, char *);
|
||||||
|
|
||||||
|
#define BLACKLIST_INIT() blacklist_init()
|
||||||
|
#define BLACKLIST_NOTIFY(x, y, z) blacklist_notify(x, y, z)
|
||||||
|
|
||||||
|
#else
|
||||||
|
|
||||||
|
#define BLACKLIST_INIT()
|
||||||
|
#define BLACKLIST_NOTIFY(x, y, z)
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif /* BLACKLIST_CLIENT_H */
|
||||||
|
@ -36,7 +36,7 @@
|
|||||||
.Nd Internet File Transfer Protocol server
|
.Nd Internet File Transfer Protocol server
|
||||||
.Sh SYNOPSIS
|
.Sh SYNOPSIS
|
||||||
.Nm
|
.Nm
|
||||||
.Op Fl 468ADdEhMmOoRrSUvW
|
.Op Fl 468ABDdEhMmOoRrSUvW
|
||||||
.Op Fl l Op Fl l
|
.Op Fl l Op Fl l
|
||||||
.Op Fl a Ar address
|
.Op Fl a Ar address
|
||||||
.Op Fl P Ar port
|
.Op Fl P Ar port
|
||||||
@ -95,6 +95,14 @@ When
|
|||||||
.Fl D
|
.Fl D
|
||||||
is specified, accept connections only on the specified
|
is specified, accept connections only on the specified
|
||||||
.Ar address .
|
.Ar address .
|
||||||
|
.It Fl B
|
||||||
|
With this option set,
|
||||||
|
.Nm
|
||||||
|
sends authentication success and failure messages to the
|
||||||
|
.Xr blacklistd 8
|
||||||
|
daemon. If this option is not specified, no communcation with the
|
||||||
|
.Xr blacklistd 8
|
||||||
|
daemon is attempted.
|
||||||
.It Fl D
|
.It Fl D
|
||||||
With this option set,
|
With this option set,
|
||||||
.Nm
|
.Nm
|
||||||
|
@ -144,6 +144,7 @@ int noretr = 0; /* RETR command is disabled. */
|
|||||||
int noguestretr = 0; /* RETR command is disabled for anon users. */
|
int noguestretr = 0; /* RETR command is disabled for anon users. */
|
||||||
int noguestmkd = 0; /* MKD command is disabled for anon users. */
|
int noguestmkd = 0; /* MKD command is disabled for anon users. */
|
||||||
int noguestmod = 1; /* anon users may not modify existing files. */
|
int noguestmod = 1; /* anon users may not modify existing files. */
|
||||||
|
int use_blacklist = 0;
|
||||||
|
|
||||||
off_t file_size;
|
off_t file_size;
|
||||||
off_t byte_count;
|
off_t byte_count;
|
||||||
@ -305,7 +306,7 @@ main(int argc, char *argv[], char **envp)
|
|||||||
openlog("ftpd", LOG_PID | LOG_NDELAY, LOG_FTP);
|
openlog("ftpd", LOG_PID | LOG_NDELAY, LOG_FTP);
|
||||||
|
|
||||||
while ((ch = getopt(argc, argv,
|
while ((ch = getopt(argc, argv,
|
||||||
"468a:AdDEhlmMoOp:P:rRSt:T:u:UvW")) != -1) {
|
"468a:ABdDEhlmMoOp:P:rRSt:T:u:UvW")) != -1) {
|
||||||
switch (ch) {
|
switch (ch) {
|
||||||
case '4':
|
case '4':
|
||||||
family = (family == AF_INET6) ? AF_UNSPEC : AF_INET;
|
family = (family == AF_INET6) ? AF_UNSPEC : AF_INET;
|
||||||
@ -327,6 +328,14 @@ main(int argc, char *argv[], char **envp)
|
|||||||
anon_only = 1;
|
anon_only = 1;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case 'B':
|
||||||
|
#ifdef USE_BLACKLIST
|
||||||
|
use_blacklist = 1;
|
||||||
|
#else
|
||||||
|
syslog(LOG_WARNING, "not compiled with USE_BLACKLIST support");
|
||||||
|
#endif
|
||||||
|
break;
|
||||||
|
|
||||||
case 'd':
|
case 'd':
|
||||||
ftpdebug++;
|
ftpdebug++;
|
||||||
break;
|
break;
|
||||||
@ -644,9 +653,7 @@ main(int argc, char *argv[], char **envp)
|
|||||||
reply(220, "%s FTP server (%s) ready.", hostname, version);
|
reply(220, "%s FTP server (%s) ready.", hostname, version);
|
||||||
else
|
else
|
||||||
reply(220, "FTP server ready.");
|
reply(220, "FTP server ready.");
|
||||||
#ifdef USE_BLACKLIST
|
BLACKLIST_INIT();
|
||||||
blacklist_init();
|
|
||||||
#endif
|
|
||||||
for (;;)
|
for (;;)
|
||||||
(void) yyparse();
|
(void) yyparse();
|
||||||
/* NOTREACHED */
|
/* NOTREACHED */
|
||||||
@ -1422,9 +1429,7 @@ pass(char *passwd)
|
|||||||
*/
|
*/
|
||||||
if (rval) {
|
if (rval) {
|
||||||
reply(530, "Login incorrect.");
|
reply(530, "Login incorrect.");
|
||||||
#ifdef USE_BLACKLIST
|
BLACKLIST_NOTIFY(BLACKLIST_AUTH_FAIL, STDIN_FILENO, "Login incorrect");
|
||||||
blacklist_notify(1, STDIN_FILENO, "Login incorrect");
|
|
||||||
#endif
|
|
||||||
if (logging) {
|
if (logging) {
|
||||||
syslog(LOG_NOTICE,
|
syslog(LOG_NOTICE,
|
||||||
"FTP LOGIN FAILED FROM %s",
|
"FTP LOGIN FAILED FROM %s",
|
||||||
@ -1441,12 +1446,9 @@ pass(char *passwd)
|
|||||||
exit(0);
|
exit(0);
|
||||||
}
|
}
|
||||||
return;
|
return;
|
||||||
|
} else {
|
||||||
|
BLACKLIST_NOTIFY(BLACKLIST_AUTH_OK, STDIN_FILENO, "Login successful");
|
||||||
}
|
}
|
||||||
#ifdef USE_BLACKLIST
|
|
||||||
else {
|
|
||||||
blacklist_notify(0, STDIN_FILENO, "Login successful");
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
}
|
}
|
||||||
login_attempts = 0; /* this time successful */
|
login_attempts = 0; /* this time successful */
|
||||||
if (setegid(pw->pw_gid) < 0) {
|
if (setegid(pw->pw_gid) < 0) {
|
||||||
|
Loading…
Reference in New Issue
Block a user