diff options
| author | christos <christos@NetBSD.org> | 2021-03-07 15:09:12 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2021-03-07 15:09:12 +0000 |
| commit | 8afe193a71a3956d4cfb3500576b35486f1b7cf0 (patch) | |
| tree | 79826081689f31f439cfedd194e5544e3fa6e302 /lib | |
| parent | 5fe9e000235d7f8b672327e27046df719d8f0f2b (diff) | |
Add blocklist support to libwrap which enables all programs using libwrap
to block access from hosts we deny. (libwrap support from Greg A. Woods)
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/Makefile | 6 | ||||
| -rw-r--r-- | lib/libwrap/Makefile | 5 | ||||
| -rw-r--r-- | lib/libwrap/hosts_access.c | 38 |
3 files changed, 41 insertions, 8 deletions
diff --git a/lib/Makefile b/lib/Makefile index 23c620c3b9c..a1b31f19283 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.286 2020/10/29 20:11:17 nia Exp $ +# $NetBSD: Makefile,v 1.287 2021/03/07 15:09:12 christos Exp $ # from: @(#)Makefile 5.25.1.1 (Berkeley) 5/7/91 .include <bsd.own.mk> @@ -27,7 +27,7 @@ SUBDIR+= libarch \ libossaudio libpci libposix libprop libpthread \ libpuffs libresolv librmt librpcsvc librt \ libtelnet libterminfo \ - libusbhid libutil libwrap liby libz + libusbhid libutil liby libz .if !defined(BSD_MK_COMPAT_FILE) SUBDIR+= libkern @@ -178,6 +178,8 @@ SUBDIR+= ../external/mit/libuv/lib #==================== 2nd library dependency barrier ==================== SUBDIR+= .WAIT +SUBDIR+= libwrap + .if (${MKGCC} != "no" && ${MKCXX} != "no" && ${MKLIBSTDCXX} != "no") .for sanitizer in asan lsan ubsan .if exists(../external/gpl3/${EXTERNAL_GCC_SUBDIR}/lib/lib${sanitizer}) diff --git a/lib/libwrap/Makefile b/lib/libwrap/Makefile index 35c2732b33b..bd0189939cd 100644 --- a/lib/libwrap/Makefile +++ b/lib/libwrap/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.11 2019/01/11 20:37:30 christos Exp $ +# $NetBSD: Makefile,v 1.12 2021/03/07 15:09:12 christos Exp $ USE_FORT?= yes # network server @@ -14,6 +14,9 @@ MLINKS+=hosts_access.3 hosts_ctl.3 MLINKS+=hosts_access.3 request_init.3 MLINKS+=hosts_access.3 request_set.3 +#LDADD+=-lblocklist +PADD+=${LIBBLOCKLIST} + INCS= tcpd.h INCSDIR=/usr/include diff --git a/lib/libwrap/hosts_access.c b/lib/libwrap/hosts_access.c index 80f551b4f2e..ed05c3e20f5 100644 --- a/lib/libwrap/hosts_access.c +++ b/lib/libwrap/hosts_access.c @@ -1,4 +1,4 @@ -/* $NetBSD: hosts_access.c,v 1.22 2020/03/30 08:34:38 ryo Exp $ */ +/* $NetBSD: hosts_access.c,v 1.23 2021/03/07 15:09:12 christos Exp $ */ /* * This module implements a simple access control language that is based on @@ -24,7 +24,7 @@ #if 0 static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22"; #else -__RCSID("$NetBSD: hosts_access.c,v 1.22 2020/03/30 08:34:38 ryo Exp $"); +__RCSID("$NetBSD: hosts_access.c,v 1.23 2021/03/07 15:09:12 christos Exp $"); #endif #endif @@ -37,6 +37,7 @@ __RCSID("$NetBSD: hosts_access.c,v 1.22 2020/03/30 08:34:38 ryo Exp $"); #endif #include <netinet/in.h> #include <arpa/inet.h> +#include <blocklist.h> #include <stdio.h> #include <stdlib.h> #include <syslog.h> @@ -103,6 +104,24 @@ static int masked_match6(char *, char *, char *); #define BUFLEN 2048 +static void +pfilter_notify(struct request_info *request, int b) +{ + static struct blocklist *blstate; + + if (blstate == NULL) { + blstate = blocklist_open(); + } + if (request->client->sin != NULL) { + blocklist_sa_r(blstate, b, request->fd != -1 ? request->fd : 3, + request->client->sin, request->client->sin->sa_len, + request->daemon ? request->daemon : getprogname()); + } else { + blocklist_r(blstate, b, (request->fd != -1) ? request->fd : 3, + request->daemon ? request->daemon : getprogname()); + } +} + /* hosts_access - host access control facility */ int @@ -128,12 +147,21 @@ hosts_access(struct request_info *request) if (resident <= 0) resident++; verdict = setjmp(tcpd_buf); - if (verdict != 0) + if (verdict != 0) { + if (verdict != AC_PERMIT) + pfilter_notify(request, BLOCKLIST_AUTH_FAIL); + /* XXX pfilter_notify(0)??? */ return (verdict == AC_PERMIT); - if (table_match(hosts_allow_table, request)) + } + if (table_match(hosts_allow_table, request)) { + /* XXX pfilter_notify(0)??? */ return (YES); - if (table_match(hosts_deny_table, request)) + } + if (table_match(hosts_deny_table, request)) { + pfilter_notify(request, BLOCKLIST_AUTH_FAIL); return (NO); + } + /* XXX pfilter_notify(0)??? */ return (YES); } |
