diff options
| author | jruoho <jruoho@NetBSD.org> | 2020-07-11 08:10:52 +0000 |
|---|---|---|
| committer | jruoho <jruoho@NetBSD.org> | 2020-07-11 08:10:52 +0000 |
| commit | edc3f0d832a966b416dc4ee591eb2dc7a6ca885f (patch) | |
| tree | c2c96087c680724b39b2ee33ec0da718985b9d3f /libexec/httpd | |
| parent | 559b72bdcc09b1ece2deca9f4d6bf62fb4cfd2a5 (diff) | |
Add blocklistd(8) support.
Diffstat (limited to 'libexec/httpd')
| -rw-r--r-- | libexec/httpd/Makefile | 7 | ||||
| -rw-r--r-- | libexec/httpd/auth-bozo.c | 7 | ||||
| -rw-r--r-- | libexec/httpd/bozohttpd.8 | 43 | ||||
| -rw-r--r-- | libexec/httpd/bozohttpd.c | 34 | ||||
| -rw-r--r-- | libexec/httpd/bozohttpd.h | 9 |
5 files changed, 91 insertions, 9 deletions
diff --git a/libexec/httpd/Makefile b/libexec/httpd/Makefile index dc806e747bd..05c7700bcda 100644 --- a/libexec/httpd/Makefile +++ b/libexec/httpd/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.28 2019/01/17 07:39:00 mrg Exp $ +# $NetBSD: Makefile,v 1.29 2020/07/11 08:10:52 jruoho Exp $ # # $eterna: Makefile,v 1.30 2010/07/11 00:34:27 mrg Exp $ # @@ -14,6 +14,7 @@ # NO_SSL_SUPPORT /* don't support ssl (https) */ # DO_HTPASSWD /* support .htpasswd files */ # NO_LUA_SUPPORT /* don't support Lua for dynamic content */ +# NO_BLOCKLIST_SUPPORT /* don't support blocklist */ # # other system specific defines: # HAVE_NBUTIL_H /* netbsd compat is in <nbutil.h> @@ -32,8 +33,8 @@ SRCS= bozohttpd.c ssl-bozo.c auth-bozo.c cgi-bozo.c daemon-bozo.c \ tilde-luzah-bozo.c dir-index-bozo.c content-bozo.c lua-bozo.c SRCS+= main.c -LDADD= -lcrypt -llua -lm -DPADD= ${LIBCRYPT} ${LIBLUA} ${LIBM} +LDADD= -lblocklist -lcrypt -llua -lm +DPADD= ${LIBBLOCKLIST} ${LIBCRYPT} ${LIBLUA} ${LIBM} WARNS?= 4 diff --git a/libexec/httpd/auth-bozo.c b/libexec/httpd/auth-bozo.c index 994e88c9199..3d58d7a4419 100644 --- a/libexec/httpd/auth-bozo.c +++ b/libexec/httpd/auth-bozo.c @@ -1,4 +1,4 @@ -/* $NetBSD: auth-bozo.c,v 1.24 2019/02/28 08:28:21 mrg Exp $ */ +/* $NetBSD: auth-bozo.c,v 1.25 2020/07/11 08:10:52 jruoho Exp $ */ /* $eterna: auth-bozo.c,v 1.17 2011/11/18 09:21:15 mrg Exp $ */ @@ -105,6 +105,11 @@ bozo_auth_check(bozo_httpreq_t *request, const char *file) pass) != 0) break; fclose(fp); + +#ifndef NO_BLOCKLIST_SUPPORT + pfilter_notify(BLOCKLIST_AUTH_OK, 200); +#endif /* !NO_BLOCKLIST_SUPPORT */ + return 0; } } diff --git a/libexec/httpd/bozohttpd.8 b/libexec/httpd/bozohttpd.8 index d7926dd3e3c..bb8eae2873b 100644 --- a/libexec/httpd/bozohttpd.8 +++ b/libexec/httpd/bozohttpd.8 @@ -1,4 +1,4 @@ -.\" $NetBSD: bozohttpd.8,v 1.80 2020/07/06 23:31:36 jmcneill Exp $ +.\" $NetBSD: bozohttpd.8,v 1.81 2020/07/11 08:10:52 jruoho Exp $ .\" .\" $eterna: bozohttpd.8,v 1.101 2011/11/18 01:25:11 mrg Exp $ .\" @@ -26,7 +26,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd July 6, 2020 +.Dd July 11, 2020 .Dt BOZOHTTPD 8 .Os .Sh NAME @@ -454,6 +454,45 @@ with on the compiler command line to enable this support. It may require linking with the crypt library, using .Dq -lcrypt . +.Ss BLOCKLIST SUPPORT +On NetBSD, +.Nm +supports +.Xr blocklistd 8 +by default. +The support can be disabled with the +.Dq -DNO_BLOCKLIST_SUPPORT +compilation option. +.Pp +Upon occurrence, +.Nm +reports three HTTP status codes to +.Xr blocklistd 8 +as failures: +.Em 401 +(``Unauthorized'') , +.Em 403 +(``Forbidden'') , +and +.Em 500 +(``Internal Server Error'') . +Of these, +.Em 401 +is the one received upon authorization failure with the +HTTP Basic Authorization mechanism. +A successful authorization decreases the counter kept by +.Xr blocklistd 8 . +.Pp +Note that the implementation of the HTTP Basic Authorization mechanism +uses a redirection; a status code +.Em 401 +is always initially received. +Therefore, a single authorization failure of +.Pa .htpasswd +is reported as two failures to +.Xr blocklistd 8 , +but no failures are recorded upon successful authorization +due to the decrease of the failure counter. .Ss SSL SUPPORT .Nm has support for TLSv1.1 and TLSv1.2 protocols that are included by diff --git a/libexec/httpd/bozohttpd.c b/libexec/httpd/bozohttpd.c index 149633ae101..378814528d1 100644 --- a/libexec/httpd/bozohttpd.c +++ b/libexec/httpd/bozohttpd.c @@ -1,4 +1,4 @@ -/* $NetBSD: bozohttpd.c,v 1.115 2020/07/06 23:31:36 jmcneill Exp $ */ +/* $NetBSD: bozohttpd.c,v 1.116 2020/07/11 08:10:52 jruoho Exp $ */ /* $eterna: bozohttpd.c,v 1.178 2011/11/18 09:21:15 mrg Exp $ */ @@ -2133,6 +2133,7 @@ static struct errors_map { const char *shortmsg; /* short version of message */ const char *longmsg; /* long version of message */ } errors_map[] = { + { 200, "200 OK", "The request was valid", }, { 400, "400 Bad Request", "The request was not valid", }, { 401, "401 Unauthorized", "No authorization", }, { 403, "403 Forbidden", "Access to this item has been denied",}, @@ -2170,6 +2171,23 @@ http_errors_long(int code) return (help); } +#ifndef NO_BLOCKLIST_SUPPORT +static struct blocklist *blstate; + +void +pfilter_notify(const int what, const int code) +{ + + if (blstate == NULL) + blstate = blocklist_open(); + + if (blstate == NULL) + return; + + (void)blocklist_r(blstate, what, 0, http_errors_short(code)); +} +#endif /* !NO_BLOCKLIST_SUPPORT */ + /* the follow functions and variables are used in handling HTTP errors */ /* ARGSUSED */ int @@ -2272,6 +2290,20 @@ bozo_http_error(bozohttpd_t *httpd, int code, bozo_httpreq_t *request, bozo_printf(httpd, "%s", httpd->errorbuf); bozo_flush(httpd, stdout); +#ifndef NO_BLOCKLIST_SUPPORT + switch(code) { + + case 401: + pfilter_notify(BLOCKLIST_AUTH_FAIL, code); + break; + + case 403: /* FALLTHROUGH */ + case 500: + pfilter_notify(BLOCKLIST_ABUSIVE_BEHAVIOR, code); + break; + } +#endif /* !NO_BLOCKLIST_SUPPORT */ + return code; } diff --git a/libexec/httpd/bozohttpd.h b/libexec/httpd/bozohttpd.h index d9f99920d47..3d31ac6c402 100644 --- a/libexec/httpd/bozohttpd.h +++ b/libexec/httpd/bozohttpd.h @@ -1,4 +1,4 @@ -/* $NetBSD: bozohttpd.h,v 1.61 2020/07/06 23:31:36 jmcneill Exp $ */ +/* $NetBSD: bozohttpd.h,v 1.62 2020/07/11 08:10:52 jruoho Exp $ */ /* $eterna: bozohttpd.h,v 1.39 2011/11/18 09:21:15 mrg Exp $ */ @@ -35,6 +35,7 @@ #include "netbsd_queue.h" #include <stdbool.h> +#include <stdio.h> #include <signal.h> #include <sys/stat.h> @@ -42,7 +43,11 @@ #ifndef NO_LUA_SUPPORT #include <lua.h> #endif -#include <stdio.h> + +#ifndef NO_BLOCKLIST_SUPPORT +#include <blocklist.h> +void pfilter_notify(const int, const int); +#endif /* QNX provides a lot of NetBSD things in nbutil.h */ #ifdef HAVE_NBUTIL_H |
