Commit Graph

15 Commits

Author SHA1 Message Date
Kurt Lidl
5de2cc52e9 Extend libblacklist support with new action types
The original blacklist library supported two notification types:
 - failed auth attempt, which incremented the failed login count
   by one for the remote address
 - successful auth attempt, which reset the failed login count
   to zero for that remote address

When the failed login count reached the limit in the configuration
file, the remote address would be blocked by a packet filter.

This patch implements a new notification type, "abusive behavior",
and accepts, but does not act on an additional type, "bad username".
It is envisioned that a system administrator will configure a small
list of "known bad usernames" that should be blocked immediately.

Reviewed by:	emaste
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D10604
2017-05-23 19:03:07 +00:00
Kurt Lidl
40935b566b Merge latest version of blacklist sources from NetBSD (@ 20170503)
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
2017-05-04 19:07:37 +00:00
Kurt Lidl
2495a63064 Reset failed login count to zero when removing a blocked address
The blacklistd daemon keeps records of failed login attempts for
each address:port that is flagged as a failed login.  When a
successful login occurs for that address:port combination,
the record's last update time is set to zero, to indicate no current
failed login attempts.

Reset the failed login count to zero, so that at the next failed
login attempt, the counting will restart properly at zero.  Without
this reset to zero, the first failed login after a successful login
will cause the address to be blocked immediately.

When debugging is turned on, output more information about database
state before and after the database updates have occured.

A similar patch has already been upstreamed to NetBSD.

MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
2017-02-23 05:40:59 +00:00
Kurt Lidl
ea3431376e Improve ipfw rule creation for blacklist-helper script
When blocking an address, the blacklist-helper script
needs to do the following things for the ipfw packet
filter:

 - create a table to hold the addresses to be blocked,
   so lookups can be done quickly, and place the address
   to be blocked in that table
 - create rule that does the lookup in the table and
   blocks the packet

The ipfw system allows multiple rules to be inserted for
a given rule number.  There only needs to be one rule
to do the lookup per port.  Modify the script to probe
for the existence of the rule before attempting to create
it, so only one rule is inserted, rather than one rule per
blocked address.

PR:		214980
Reported by:	azhegalov (at) gmail.com
Reviewed by:	emaste
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D9681
2017-02-22 21:50:37 +00:00
Kurt Lidl
30f7128157 Make blacklist-helper commands emit a message when successful
The blacklistd daemon expects to see a message on stdout, instead
of just relying on the exit value from any invoked programs.

Change the pf filtering to create multiple filters, attached under
a the "blacklist/*" anchor point.  This prevents the filtering for
each port's filtering rule from overwriting the previously installed
filtering rule.  Check for an existing filtering rule for each port,
so the installation of a given filtering rule only happens once.
Reinstalling the same rule resets the counters for the pf rule, and
we don't want that.

Reported by:	David Horn (dhorn2000 at gmail.com)
Reviewed by:	emaste
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D8081
2016-10-04 23:10:43 +00:00
Kurt Lidl
63ecbc6b55 Fix blacklistd's state restoral at startup
The blacklistd daemon attempted to restore the filtering rules
before the database of blocked addresses was opened, so no rules
were being reloaded.  Now the rules are properly recreated when the
daemon is started with '-r'.

This bug was fixed locally, and then sent upstream to NetBSD.
This changeset is the import the NetBSD version of the change,
which added debugging output to alert about a null database.

Reviewed by:	emaste
Obtained from:	NetBSD
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2016-09-30 16:35:30 +00:00
Kurt Lidl
0a1942cc0a Update blacklistd.8 with changes from NetBSD
Obtained from:	NetBSD
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D8079
2016-09-30 16:31:12 +00:00
Kurt Lidl
4e9ac06d0d libblacklist: Do not use %m for logging, use strerror(errno)
The blacklist library can accept a function to use for logging,
defaulting to vsyslog(), if no function is specified.  Make the
blacklist library use strerror(errno) explicitly, instead of %m,
so that the passed in function does not need to support the
syslog specific placeholder.

This matches a change already submitted and accepted upstream.

MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2016-07-29 21:11:32 +00:00
Kurt Lidl
74bc093c1c Add ipfilter support to blacklistd-helper
In addition to adding initial support for the ipfilter
packet filtering system, wrap a few long lines, perform
whitespace cleanup and sync with upstream changes made
in NetBSD.

Submitted by:	cy
Reviewed by:	cy
Approved by:	re (hrs)
Relnotes:	YES
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D6823
2016-06-12 23:34:48 +00:00
Kurt Lidl
5cc0844d4b Add IPFW support to blacklistd-helper
Relnotes:	YES
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D6753
2016-06-09 15:19:48 +00:00
Renato Botelho
d87f5e3055 Move misplaced break statement to right place
Reported by:	Coverity
CID:		1304340
Reviewed by:	lidl
Differential Revision:	https://reviews.freebsd.org/D6749
Sponsored by:	Rubicon Communications (Netgate)
2016-06-08 11:58:03 +00:00
Kurt Lidl
04a83165f2 Bump dates in blacklist related manpages
Reported by:	araujo
Sponsored by:	The FreeBSD Foundation
2016-06-07 16:51:56 +00:00
Kurt Lidl
9349564fec Note blacklist support first appeared in FreeBSD 11
Reported by:	jbeich
Sponsored by:	The FreeBSD Foundation
2016-06-07 16:26:34 +00:00
Kurt Lidl
1d0f5925cd Fixup path in NetBSD supplied documentation for FreeBSD
NetBSD installs the blacklist-helper script in /libexec, and
it goes into /usr/libexec on FreeBSD.  Update the docs to
match FreeBSD's installation location.

Reviewed by:	rpaulo
Approved by:	rpaulo
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D6592
2016-06-02 18:25:32 +00:00
Kurt Lidl
12017ca883 Import NetBSD's blacklist source from vendor tree
This import includes The basic blacklist library and utility programs,
to add a system-wide packet filtering notification mechanism to
FreeBSD.

The rational behind the daemon was given by Christos Zoulas in a
presentation at vBSDcon 2015: https://youtu.be/fuuf8G28mjs

Reviewed by:	rpaulo
Approved by:	rpaulo
Obtained from:	NetBSD
Relnotes:	YES
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D5912
2016-06-01 22:04:10 +00:00