summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2021-03-07 15:09:12 +0000
committerchristos <christos@NetBSD.org>2021-03-07 15:09:12 +0000
commit8afe193a71a3956d4cfb3500576b35486f1b7cf0 (patch)
tree79826081689f31f439cfedd194e5544e3fa6e302 /lib
parent5fe9e000235d7f8b672327e27046df719d8f0f2b (diff)
Add blocklist support to libwrap which enables all programs using libwrap
to block access from hosts we deny. (libwrap support from Greg A. Woods)
Diffstat (limited to 'lib')
-rw-r--r--lib/Makefile6
-rw-r--r--lib/libwrap/Makefile5
-rw-r--r--lib/libwrap/hosts_access.c38
3 files changed, 41 insertions, 8 deletions
diff --git a/lib/Makefile b/lib/Makefile
index 23c620c3b9c..a1b31f19283 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.286 2020/10/29 20:11:17 nia Exp $
+# $NetBSD: Makefile,v 1.287 2021/03/07 15:09:12 christos Exp $
# from: @(#)Makefile 5.25.1.1 (Berkeley) 5/7/91
.include <bsd.own.mk>
@@ -27,7 +27,7 @@ SUBDIR+= libarch \
libossaudio libpci libposix libprop libpthread \
libpuffs libresolv librmt librpcsvc librt \
libtelnet libterminfo \
- libusbhid libutil libwrap liby libz
+ libusbhid libutil liby libz
.if !defined(BSD_MK_COMPAT_FILE)
SUBDIR+= libkern
@@ -178,6 +178,8 @@ SUBDIR+= ../external/mit/libuv/lib
#==================== 2nd library dependency barrier ====================
SUBDIR+= .WAIT
+SUBDIR+= libwrap
+
.if (${MKGCC} != "no" && ${MKCXX} != "no" && ${MKLIBSTDCXX} != "no")
.for sanitizer in asan lsan ubsan
.if exists(../external/gpl3/${EXTERNAL_GCC_SUBDIR}/lib/lib${sanitizer})
diff --git a/lib/libwrap/Makefile b/lib/libwrap/Makefile
index 35c2732b33b..bd0189939cd 100644
--- a/lib/libwrap/Makefile
+++ b/lib/libwrap/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.11 2019/01/11 20:37:30 christos Exp $
+# $NetBSD: Makefile,v 1.12 2021/03/07 15:09:12 christos Exp $
USE_FORT?= yes # network server
@@ -14,6 +14,9 @@ MLINKS+=hosts_access.3 hosts_ctl.3
MLINKS+=hosts_access.3 request_init.3
MLINKS+=hosts_access.3 request_set.3
+#LDADD+=-lblocklist
+PADD+=${LIBBLOCKLIST}
+
INCS= tcpd.h
INCSDIR=/usr/include
diff --git a/lib/libwrap/hosts_access.c b/lib/libwrap/hosts_access.c
index 80f551b4f2e..ed05c3e20f5 100644
--- a/lib/libwrap/hosts_access.c
+++ b/lib/libwrap/hosts_access.c
@@ -1,4 +1,4 @@
-/* $NetBSD: hosts_access.c,v 1.22 2020/03/30 08:34:38 ryo Exp $ */
+/* $NetBSD: hosts_access.c,v 1.23 2021/03/07 15:09:12 christos Exp $ */
/*
* This module implements a simple access control language that is based on
@@ -24,7 +24,7 @@
#if 0
static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22";
#else
-__RCSID("$NetBSD: hosts_access.c,v 1.22 2020/03/30 08:34:38 ryo Exp $");
+__RCSID("$NetBSD: hosts_access.c,v 1.23 2021/03/07 15:09:12 christos Exp $");
#endif
#endif
@@ -37,6 +37,7 @@ __RCSID("$NetBSD: hosts_access.c,v 1.22 2020/03/30 08:34:38 ryo Exp $");
#endif
#include <netinet/in.h>
#include <arpa/inet.h>
+#include <blocklist.h>
#include <stdio.h>
#include <stdlib.h>
#include <syslog.h>
@@ -103,6 +104,24 @@ static int masked_match6(char *, char *, char *);
#define BUFLEN 2048
+static void
+pfilter_notify(struct request_info *request, int b)
+{
+ static struct blocklist *blstate;
+
+ if (blstate == NULL) {
+ blstate = blocklist_open();
+ }
+ if (request->client->sin != NULL) {
+ blocklist_sa_r(blstate, b, request->fd != -1 ? request->fd : 3,
+ request->client->sin, request->client->sin->sa_len,
+ request->daemon ? request->daemon : getprogname());
+ } else {
+ blocklist_r(blstate, b, (request->fd != -1) ? request->fd : 3,
+ request->daemon ? request->daemon : getprogname());
+ }
+}
+
/* hosts_access - host access control facility */
int
@@ -128,12 +147,21 @@ hosts_access(struct request_info *request)
if (resident <= 0)
resident++;
verdict = setjmp(tcpd_buf);
- if (verdict != 0)
+ if (verdict != 0) {
+ if (verdict != AC_PERMIT)
+ pfilter_notify(request, BLOCKLIST_AUTH_FAIL);
+ /* XXX pfilter_notify(0)??? */
return (verdict == AC_PERMIT);
- if (table_match(hosts_allow_table, request))
+ }
+ if (table_match(hosts_allow_table, request)) {
+ /* XXX pfilter_notify(0)??? */
return (YES);
- if (table_match(hosts_deny_table, request))
+ }
+ if (table_match(hosts_deny_table, request)) {
+ pfilter_notify(request, BLOCKLIST_AUTH_FAIL);
return (NO);
+ }
+ /* XXX pfilter_notify(0)??? */
return (YES);
}