Commit Graph

11 Commits

Author SHA1 Message Date
Kurt Lidl
30f7128157 Make blacklist-helper commands emit a message when successful
The blacklistd daemon expects to see a message on stdout, instead
of just relying on the exit value from any invoked programs.

Change the pf filtering to create multiple filters, attached under
a the "blacklist/*" anchor point.  This prevents the filtering for
each port's filtering rule from overwriting the previously installed
filtering rule.  Check for an existing filtering rule for each port,
so the installation of a given filtering rule only happens once.
Reinstalling the same rule resets the counters for the pf rule, and
we don't want that.

Reported by:	David Horn (dhorn2000 at gmail.com)
Reviewed by:	emaste
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D8081
2016-10-04 23:10:43 +00:00
Kurt Lidl
63ecbc6b55 Fix blacklistd's state restoral at startup
The blacklistd daemon attempted to restore the filtering rules
before the database of blocked addresses was opened, so no rules
were being reloaded.  Now the rules are properly recreated when the
daemon is started with '-r'.

This bug was fixed locally, and then sent upstream to NetBSD.
This changeset is the import the NetBSD version of the change,
which added debugging output to alert about a null database.

Reviewed by:	emaste
Obtained from:	NetBSD
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2016-09-30 16:35:30 +00:00
Kurt Lidl
0a1942cc0a Update blacklistd.8 with changes from NetBSD
Obtained from:	NetBSD
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D8079
2016-09-30 16:31:12 +00:00
Kurt Lidl
4e9ac06d0d libblacklist: Do not use %m for logging, use strerror(errno)
The blacklist library can accept a function to use for logging,
defaulting to vsyslog(), if no function is specified.  Make the
blacklist library use strerror(errno) explicitly, instead of %m,
so that the passed in function does not need to support the
syslog specific placeholder.

This matches a change already submitted and accepted upstream.

MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2016-07-29 21:11:32 +00:00
Kurt Lidl
74bc093c1c Add ipfilter support to blacklistd-helper
In addition to adding initial support for the ipfilter
packet filtering system, wrap a few long lines, perform
whitespace cleanup and sync with upstream changes made
in NetBSD.

Submitted by:	cy
Reviewed by:	cy
Approved by:	re (hrs)
Relnotes:	YES
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D6823
2016-06-12 23:34:48 +00:00
Kurt Lidl
5cc0844d4b Add IPFW support to blacklistd-helper
Relnotes:	YES
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D6753
2016-06-09 15:19:48 +00:00
Renato Botelho
d87f5e3055 Move misplaced break statement to right place
Reported by:	Coverity
CID:		1304340
Reviewed by:	lidl
Differential Revision:	https://reviews.freebsd.org/D6749
Sponsored by:	Rubicon Communications (Netgate)
2016-06-08 11:58:03 +00:00
Kurt Lidl
04a83165f2 Bump dates in blacklist related manpages
Reported by:	araujo
Sponsored by:	The FreeBSD Foundation
2016-06-07 16:51:56 +00:00
Kurt Lidl
9349564fec Note blacklist support first appeared in FreeBSD 11
Reported by:	jbeich
Sponsored by:	The FreeBSD Foundation
2016-06-07 16:26:34 +00:00
Kurt Lidl
1d0f5925cd Fixup path in NetBSD supplied documentation for FreeBSD
NetBSD installs the blacklist-helper script in /libexec, and
it goes into /usr/libexec on FreeBSD.  Update the docs to
match FreeBSD's installation location.

Reviewed by:	rpaulo
Approved by:	rpaulo
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D6592
2016-06-02 18:25:32 +00:00
Kurt Lidl
12017ca883 Import NetBSD's blacklist source from vendor tree
This import includes The basic blacklist library and utility programs,
to add a system-wide packet filtering notification mechanism to
FreeBSD.

The rational behind the daemon was given by Christos Zoulas in a
presentation at vBSDcon 2015: https://youtu.be/fuuf8G28mjs

Reviewed by:	rpaulo
Approved by:	rpaulo
Obtained from:	NetBSD
Relnotes:	YES
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D5912
2016-06-01 22:04:10 +00:00