Add UPDATING entries and bump patch version

Approved by:	so

.cirrus.yml

@@ -4,7 +4,7 @@ compute_engine_instance:
   # gcloud compute images list --project freebsd-org-cloud-dev --no-standard-images
   platform: freebsd
   image_project: freebsd-org-cloud-dev
-  image: freebsd-14-2-release-amd64-ufs
+  image: freebsd-14-3-release-amd64-ufs
   cpu: 8
   memory: 8G
   disk: 40

Makefile.inc1

@@ -466,7 +466,7 @@ SUBDIR+=	${_DIR}
 # by calling 'makedb' in share/man.  This is only relevant for
 # install/distribute so they build the whatis file after every manpage is
 # installed.
-.if make(installworld) || make(install)
+.if make(installworld) || make(install) || make(distributeworld) || make(distribute)
 SUBDIR+=.WAIT
 .endif
 SUBDIR+=etc
@@ -600,7 +600,16 @@ PKG_VERSION:=	${_PKG_REVISION}${EXTRA_REVISION:C/[[:space:]]//g}
 .endif
 .endif	# !defined(_MKSHOWCONFIG)
 
+PKG_NAME_PREFIX?=	FreeBSD
+PKG_MAINTAINER?=	[email protected]
+PKG_WWW?=		https://www.FreeBSD.org
+PKG_WORKERS_COUNT?=	1
+
 .if make(*package*)
+.export PKG_NAME_PREFIX
+.export PKG_MAINTAINER
+.export PKG_WWW
+
 .if !defined(PKG_TIMESTAMP)
 .if !empty(GIT_CMD) && exists(${GIT_CMD}) && exists(${SRCDIR}/.git)
 SOURCE_DATE_EPOCH!=	${GIT_CMD} -C ${SRCDIR} show -s --format=%ct HEAD
@@ -611,14 +620,6 @@ SOURCE_DATE_EPOCH=	${TIMEEPOCHNOW:gmtime}
 .else
 SOURCE_DATE_EPOCH=	${PKG_TIMESTAMP}
 .endif
-PKG_WORKERS_COUNT?=	1
-
-PKG_NAME_PREFIX?=	FreeBSD
-PKG_MAINTAINER?=	[email protected]
-PKG_WWW?=		https://www.FreeBSD.org
-.export PKG_NAME_PREFIX
-.export PKG_MAINTAINER
-.export PKG_WWW
 .endif
 
 .if !defined(_MKSHOWCONFIG)
@@ -1366,6 +1367,28 @@ __installcheck_DESTDIR: .PHONY
 .endif
 .endif
 
+#
+# Don't allow installworld or installkernel on a pkgbase system.  This avoids
+# accidentally updating a pkgbase system with install{world,kernel}, causing
+# the installed system to become out of date with the package database.
+#
+# Skip the check if DESTDIR is defined on the assumption the user knows what
+# they're doing.  This means the check can be disabled for the running system
+# using DESTDIR=/.
+#
+.if !make(distributeworld) && !defined(DESTDIR)
+_installcheck_world: __installcheck_PKG
+_installcheck_kernel: __installcheck_PKG
+__installcheck_PKG: .PHONY
+.if exists(${LOCALBASE}/sbin/pkg-static)
+	@if ${LOCALBASE}/sbin/pkg-static info -e ${PKG_NAME_PREFIX}-runtime; then \
+		echo >&2 "ERROR: This target should not be used on a system installed from packages." ; \
+		echo >&2 "       To override this check, set DESTDIR=/."; \
+		false; \
+	fi
+.endif
+.endif
+
 .if !defined(DB_FROM_SRC)
 #
 # Check for missing UIDs/GIDs.
@@ -1977,6 +2000,7 @@ REPODIR?=	${OBJROOT}repo
 PKG_FORMAT?=	tzst
 PKG_LEVEL?=	-1
 PKG_CLEVEL?=	${"${PKG_FORMAT:Mtar}" != "":?:-l ${PKG_LEVEL}}
+PKG_CTHREADS?=	0
 PKG_REPO_SIGNING_KEY?=	# empty
 PKG_OUTPUT_DIR?=	${PKG_VERSION}
 PKG_ABI_FILE?=	${WSTAGEDIR}/usr/bin/uname
@@ -2107,6 +2131,7 @@ create-packages-world:	_pkgbootstrap _repodir .PHONY
 
 .ORDER: create-packages-world create-packages-sets
 .ORDER: create-packages-kernel create-packages-sets
+.ORDER: create-packages-source create-packages-sets
 create-packages-sets:	_pkgbootstrap _repodir .PHONY
 	${_+_}@cd ${.CURDIR}; \
 		${MAKE} -f Makefile.inc1 \
@@ -2156,7 +2181,7 @@ create-source-src-package: _pkgbootstrap .PHONY
 		${SSTAGEDIR}/src.ucl
 	${PKG_CMD} -o ABI=${PKG_ABI} \
 		-o OSVERSION="${SRCRELDATE}" \
-		create -f ${PKG_FORMAT} ${PKG_CLEVEL} \
+		create -f ${PKG_FORMAT} ${PKG_CLEVEL} -T${PKG_CTHREADS} \
 		-M ${SSTAGEDIR}/src.ucl \
 		-p ${SSTAGEDIR}/src.plist \
 		-r ${SRCDIR} \
@@ -2182,7 +2207,7 @@ create-source-src-sys-package: _pkgbootstrap .PHONY
 		${SSTAGEDIR}/src-sys.ucl
 	${PKG_CMD} -o ABI=${PKG_ABI} \
 		-o OSVERSION="${SRCRELDATE}" \
-		create -f ${PKG_FORMAT} ${PKG_CLEVEL} \
+		create -f ${PKG_FORMAT} ${PKG_CLEVEL} -T${PKG_CTHREADS} \
 		-M ${SSTAGEDIR}/src-sys.ucl \
 		-p ${SSTAGEDIR}/src-sys.plist \
 		-r ${SRCDIR} \
@@ -2225,7 +2250,7 @@ create-world-package-${pkgname}: .PHONY
 	fi
 	${PKG_CMD} -o ABI=${PKG_ABI} -o ALLOW_BASE_SHLIBS=yes \
 		-o OSVERSION="${SRCRELDATE}" \
-		create -f ${PKG_FORMAT} ${PKG_CLEVEL} \
+		create -f ${PKG_FORMAT} ${PKG_CLEVEL} -T${PKG_CTHREADS} \
 		-M ${WSTAGEDIR}/${pkgname}.ucl \
 		-p ${WSTAGEDIR}/${pkgname}.plist \
 		-r ${WSTAGEDIR} \
@@ -2244,7 +2269,7 @@ create-sets-packages: .PHONY
 	@for manifest in ${WSTAGEDIR}/set-*.ucl; do \
 		echo "--> Processing manifest: $$manifest"; \
 		${PKG_CMD} -o ABI=${PKG_ABI} -o OSVERSION="${SRCRELDATE}" \
-			create -f ${PKG_FORMAT} ${PKG_CLEVEL} \
+			create -f ${PKG_FORMAT} ${PKG_CLEVEL} -T${PKG_CTHREADS} \
 			-M $$manifest \
 			-o "${REPODIR}/${PKG_ABI}/${PKG_OUTPUT_DIR}" \
 			|| exit 1; \
@@ -2274,7 +2299,7 @@ create-dtb-package:	.PHONY
 		${KSTAGEDIR}/${DISTDIR}/dtb.ucl ; \
 	${PKG_CMD} -o ABI=${PKG_ABI} -o ALLOW_BASE_SHLIBS=yes \
 		-o OSVERSION="${SRCRELDATE}" \
-		create -f ${PKG_FORMAT} ${PKG_CLEVEL} \
+		create -f ${PKG_FORMAT} ${PKG_CLEVEL} -T${PKG_CTHREADS} \
 		-M ${KSTAGEDIR}/${DISTDIR}/dtb.ucl \
 		-p ${KSTAGEDIR}/${DISTDIR}/dtb.plist \
 		-r ${KSTAGEDIR}/${DISTDIR} \
@@ -2311,7 +2336,7 @@ create-kernel-packages-flavor${flavor:C,^""$,${_default_flavor},}: _pkgbootstrap
 		${KSTAGEDIR}/${DISTDIR}/kernel.${INSTALLKERNEL}${flavor}.ucl ; \
 	${PKG_CMD} -o ABI=${PKG_ABI} -o ALLOW_BASE_SHLIBS=yes \
 		-o OSVERSION="${SRCRELDATE}" \
-		create -f ${PKG_FORMAT} ${PKG_CLEVEL} \
+		create -f ${PKG_FORMAT} ${PKG_CLEVEL} -T${PKG_CTHREADS} \
 		-M ${KSTAGEDIR}/${DISTDIR}/kernel.${INSTALLKERNEL}${flavor}.ucl \
 		-p ${KSTAGEDIR}/${DISTDIR}/kernel.${INSTALLKERNEL}${flavor}.plist \
 		-r ${KSTAGEDIR}/${DISTDIR} \
@@ -2351,7 +2376,7 @@ create-kernel-packages-extra-flavor${flavor:C,^""$,${_default_flavor},}-${_kerne
 		${KSTAGEDIR}/kernel.${_kernel}/kernel.${_kernel}${flavor}.ucl ; \
 	${PKG_CMD} -o ABI=${PKG_ABI} -o ALLOW_BASE_SHLIBS=yes \
 		-o OSVERSION="${SRCRELDATE}" \
-		create -f ${PKG_FORMAT} ${PKG_CLEVEL} \
+		create -f ${PKG_FORMAT} ${PKG_CLEVEL} -T${PKG_CTHREADS} \
 		-M ${KSTAGEDIR}/kernel.${_kernel}/kernel.${_kernel}${flavor}.ucl \
 		-p ${KSTAGEDIR}/kernel.${_kernel}/kernel.${_kernel}${flavor}.plist \
 		-r ${KSTAGEDIR}/kernel.${_kernel} \

ObsoleteFiles.inc

@@ -51,6 +51,13 @@
 #   xargs -n1 | sort | uniq -d;
 # done
 
+# 20251121: Remove duplicate pam_krb5 manual page
+OLD_FILES+=usr/share/man/man8/pam-krb5.8.gz
+
+# 20251112: Remove pccard(4) and related
+OLD_FILES+=share/man/man4/pccard.4.gz
+OLD_FILES+=share/man/man4/pcic.4.gz
+
 # 20251006: Remove libnss_tacplus.a (it never should have been installed)
 OLD_FILES+=usr/lib/libnss_tacplus.a
 

UPDATING

@@ -12,11 +12,84 @@ Items affecting the ports and packages system can be found in
 /usr/ports/UPDATING.  Please read that file before updating system packages
 and/or ports.
 
+20260127:
+	15.0-RELEASE-p2 SA-26:01.openssl
+			EN-26:01.devinfo
+			EN-26:02.arm64
+			EN-26:03.vm
+
+	Fix multiple vulnerabilities in OpenSSL. [SA-26:01.openssl]
+
+	devinfo output formatting regression. [EN-26:01.devinfo]
+
+	arm64 SVE signal context misalignment. [EN-26:02.arm64]
+
+	The page fault handler fails to zero memory. [EN-26:03.vm]
+
+20251216:
+	15.0-RELEASE-p1	SA-25:12.rtsold
+			EN-25:19.zfs
+			EN-25:20.vmm
+
+	Remote code execution via ND6 Router Advertisements. [SA-25:12.rtsold]
+
+	Unprivileged kernel NULL pointer dereference. [EN-25:19.zfs]
+
+	bhyve(8) PCI passthru regression. [EN-25:20.vmm]
+
+20251202:
+	15.0-RELEASE.
+
+20251126:
+	15.0-RC4-p1     SA-25:10.unbound
+
+	Fix DNS cache poison through YXDOMAIN and nodata non-referral
+	answers. [SA-25:10.unbound]
+
+20251115:
+	The FreeBSD-base repository is now defined in /etc/pkg/FreeBSD.conf,
+	disabled by default.  In -CURRENT and -STABLE this points at nightly
+	builds on pkg.freebsd.org; for BETA/RC/RELEASE builds it points at
+	release engineering builds on pkgbase.freebsd.org.
+
+	Users of pkgbase will need to replace any existing definition of the
+	FreeBSD-base repository in /usr/local/etc/pkg/repos/ with a single
+	line "FreeBSD-base: { enabled: yes }".
+
+20251030:
+	flua(1) has moved to the new FreeBSD-flua package.  If you use flua,
+	you may want to install this package if it's not otherwise installed
+	as a dependency of something else.  This change only affects pkgbase
+	users.
+
+20251023:
+	Bump __FreeBSD_version to 1500068 for LinuxKPI.  An embedded struct
+	has changed size and might possibly be an issue otherwise.
+
+20251022:
+	15.0-BETA2-p1 SA-25:09.netinet
+
+	SO_REUSEPORT_LB breaks connect(2) for UDP sockets. [SA-25:09.netinet]
+
+20251015:
+	The "FreeBSD-unbound" package is renamed to "FreeBSD-local-unbound".
+	If you have set-optional or set-base installed, the new package will
+	be installed automatically, otherwise you should manually install the
+	new package and remove the old one.
+
+	This change only affects pkgbase users.
+
 20251001:
 	The deprecated ftpd(8) has been removed.  Users who still need ftpd
 	can install the ftp/freebsd-ftpd port.  pkgbase users should remove
 	the orphaned FreeBSD-ftpd package.
 
+20251012:
+	Blacklist has been renamed upstream to Blocklist.  If you have it
+	configured, rename all configuration files, firewall anchors or
+	sentinel files to reflect the new nomenclature.  Old setups will
+	continue to work emitting a warning.
+
 20251002:
 	Audio-related utilities including mixer(8) and virtual_oss(8) have
 	moved to the new FreeBSD-sound package.  If you have set-optional or

bin/cp/cp.c

@@ -433,6 +433,8 @@ copy(char *argv[], enum op type, int fts_options, struct stat *root_stat)
 				sep = strchr(to.base, '\0');
 				sep[0] = '/';
 				sep[1] = '\0';
+			} else if (strcmp(curr->fts_name, "/") == 0) {
+				/* special case when source is the root directory */
 			} else {
 				/* entering a directory; append its name to to.path */
 				len = snprintf(to.end, END(to.path) - to.end, "%s%s",
@@ -520,6 +522,8 @@ copy(char *argv[], enum op type, int fts_options, struct stat *root_stat)
 				if (type == DIR_TO_DNE &&
 				    curr->fts_level == FTS_ROOTLEVEL) {
 					/* this is actually our created root */
+				} else if (strcmp(curr->fts_name, "/") == 0) {
+					/* special case when source is the root directory */
 				} else {
 					while (to.end > to.path && *to.end != '/')
 						to.end--;
@@ -551,7 +555,8 @@ copy(char *argv[], enum op type, int fts_options, struct stat *root_stat)
 		/* Not an error but need to remember it happened. */
 		if (to.path[0] == '\0') {
 			/*
-			 * This can happen in two cases:
+			 * This can happen in three cases:
+			 * - The source path is the root directory.
 			 * - DIR_TO_DNE; we created the directory and
 			 *   populated root_stat earlier.
 			 * - FILE_TO_DIR if a source has a trailing slash;

bin/cp/tests/cp_test.sh

@@ -747,9 +747,23 @@ dstmode_body()
 	atf_check cmp dir/file dst/file
 }
 
+atf_test_case root
+root_head()
+{
+	atf_set "descr" "Test copying the root directory"
+}
+root_body()
+{
+	atf_check mkdir dst
+	atf_check -s exit:1 \
+	    -e inline:"cp: / is a directory (not copied).\n" \
+	    cp / dst
+}
+
 atf_test_case to_root cleanup
 to_root_head()
 {
+	atf_set "descr" "Test copying to the root directory"
 	atf_set "require.user" "unprivileged"
 }
 to_root_body()
@@ -893,6 +907,7 @@ atf_init_test_cases()
 	atf_add_test_case to_deaddirlink
 	atf_add_test_case to_link_outside
 	atf_add_test_case dstmode
+	atf_add_test_case root
 	atf_add_test_case to_root
 	atf_add_test_case dirloop
 	atf_add_test_case unrdir

bin/pwait/pwait.1

@@ -30,7 +30,7 @@
 .\" USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
 .\" OF SUCH DAMAGE.
 .\"
-.Dd January 21, 2021
+.Dd October 22, 2025
 .Dt PWAIT 1
 .Os
 .Sh NAME
@@ -39,7 +39,7 @@
 .Sh SYNOPSIS
 .Nm
 .Op Fl t Ar duration
-.Op Fl ov
+.Op Fl opv
 .Ar pid
 \&...
 .Sh DESCRIPTION
@@ -51,6 +51,8 @@ The following option is available:
 .Bl -tag -width indent
 .It Fl o
 Exit when any of the given processes has terminated.
+.It Fl p
+On exit, print a list of processes that have not terminated.
 .It Fl t Ar duration
 If any process is still running after
 .Ar duration ,

bin/pwait/pwait.c

@@ -33,7 +33,9 @@
 
 #include <sys/types.h>
 #include <sys/event.h>
+#include <sys/sysctl.h>
 #include <sys/time.h>
+#include <sys/tree.h>
 #include <sys/wait.h>
 
 #include <err.h>
@@ -46,10 +48,25 @@
 #include <sysexits.h>
 #include <unistd.h>
 
+struct pid {
+	RB_ENTRY(pid) entry;
+	pid_t pid;
+};
+
+static int
+pidcmp(const struct pid *a, const struct pid *b)
+{
+	return (a->pid > b->pid ? 1 : a->pid < b->pid ? -1 : 0);
+}
+
+RB_HEAD(pidtree, pid);
+static struct pidtree pids = RB_INITIALIZER(&pids);
+RB_GENERATE_STATIC(pidtree, pid, entry, pidcmp);
+
 static void
 usage(void)
 {
-	fprintf(stderr, "usage: pwait [-t timeout] [-ov] pid ...\n");
+	fprintf(stderr, "usage: pwait [-t timeout] [-opv] pid ...\n");
 	exit(EX_USAGE);
 }
 
@@ -61,21 +78,28 @@ main(int argc, char *argv[])
 {
 	struct itimerval itv;
 	struct kevent *e;
+	struct pid k, *p;
 	char *end, *s;
 	double timeout;
+	size_t sz;
 	long pid;
-	int i, kq, n, nleft, opt, status;
-	bool oflag, tflag, verbose;
+	pid_t mypid;
+	int i, kq, n, ndone, nleft, opt, pid_max, ret, status;
+	bool oflag, pflag, tflag, verbose;
 
 	oflag = false;
+	pflag = false;
 	tflag = false;
 	verbose = false;
 	memset(&itv, 0, sizeof(itv));
 
-	while ((opt = getopt(argc, argv, "ot:v")) != -1) {
+	while ((opt = getopt(argc, argv, "opt:v")) != -1) {
 		switch (opt) {
 		case 'o':
-			oflag = 1;
+			oflag = true;
+			break;
+		case 'p':
+			pflag = true;
 			break;
 		case 't':
 			tflag = true;
@@ -127,16 +151,18 @@ main(int argc, char *argv[])
 		usage();
 	}
 
-	kq = kqueue();
-	if (kq == -1) {
+	if ((kq = kqueue()) < 0)
 		err(EX_OSERR, "kqueue");
-	}
 
-	e = malloc((argc + tflag) * sizeof(struct kevent));
-	if (e == NULL) {
+	sz = sizeof(pid_max);
+	if (sysctlbyname("kern.pid_max", &pid_max, &sz, NULL, 0) != 0) {
+		pid_max = 99999;
+	}
+	if ((e = malloc((argc + tflag) * sizeof(*e))) == NULL) {
 		err(EX_OSERR, "malloc");
 	}
-	nleft = 0;
+	ndone = nleft = 0;
+	mypid = getpid();
 	for (n = 0; n < argc; n++) {
 		s = argv[n];
 		/* Undocumented Solaris compat */
@@ -145,35 +171,37 @@ main(int argc, char *argv[])
 		}
 		errno = 0;
 		pid = strtol(s, &end, 10);
-		if (pid < 0 || *end != '\0' || errno != 0) {
+		if (pid < 0 || pid > pid_max || *end != '\0' || errno != 0) {
 			warnx("%s: bad process id", s);
 			continue;
 		}
-		if (pid == getpid()) {
+		if (pid == mypid) {
 			warnx("%s: skipping my own pid", s);
 			continue;
 		}
-		for (i = 0; i < nleft; i++) {
-			if (e[i].ident == (uintptr_t)pid) {
-				break;
-			}
+		if ((p = malloc(sizeof(*p))) == NULL) {
+			err(EX_OSERR, NULL);
 		}
-		if (i < nleft) {
+		p->pid = pid;
+		if (RB_INSERT(pidtree, &pids, p) != NULL) {
 			/* Duplicate. */
+			free(p);
 			continue;
 		}
 		EV_SET(e + nleft, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL);
 		if (kevent(kq, e + nleft, 1, NULL, 0, NULL) == -1) {
+			if (errno != ESRCH)
+				err(EX_OSERR, "kevent()");
 			warn("%ld", pid);
-			if (oflag) {
-				exit(EX_OK);
-			}
+			RB_REMOVE(pidtree, &pids, p);
+			free(p);
+			ndone++;
 		} else {
 			nleft++;
 		}
 	}
 
-	if (nleft > 0 && tflag) {
+	if ((ndone == 0 || !oflag) && nleft > 0 && tflag) {
 		/*
 		 * Explicitly detect SIGALRM so that an exit status of 124
 		 * can be returned rather than 142.
@@ -188,7 +216,8 @@ main(int argc, char *argv[])
 			err(EX_OSERR, "setitimer");
 		}
 	}
-	while (nleft > 0) {
+	ret = EX_OK;
+	while ((ndone == 0 || !oflag) && ret == EX_OK && nleft > 0) {
 		n = kevent(kq, NULL, 0, e, nleft + tflag, NULL);
 		if (n == -1) {
 			err(EX_OSERR, "kevent");
@@ -198,29 +227,34 @@ main(int argc, char *argv[])
 				if (verbose) {
 					printf("timeout\n");
 				}
-				exit(124);
+				ret = 124;
 			}
+			pid = e[i].ident;
 			if (verbose) {
 				status = e[i].data;
 				if (WIFEXITED(status)) {
 					printf("%ld: exited with status %d.\n",
-					    (long)e[i].ident,
-					    WEXITSTATUS(status));
+					    pid, WEXITSTATUS(status));
 				} else if (WIFSIGNALED(status)) {
 					printf("%ld: killed by signal %d.\n",
-					    (long)e[i].ident,
-					    WTERMSIG(status));
+					    pid, WTERMSIG(status));
 				} else {
-					printf("%ld: terminated.\n",
-					    (long)e[i].ident);
+					printf("%ld: terminated.\n", pid);
 				}
 			}
-			if (oflag) {
-				exit(EX_OK);
+			k.pid = pid;
+			if ((p = RB_FIND(pidtree, &pids, &k)) != NULL) {
+				RB_REMOVE(pidtree, &pids, p);
+				free(p);
+				ndone++;
 			}
 			--nleft;
 		}
 	}
-
-	exit(EX_OK);
+	if (pflag) {
+		RB_FOREACH(p, pidtree, &pids) {
+			printf("%d\n", p->pid);
+		}
+	}
+	exit(ret);
 }

bin/pwait/tests/pwait_test.sh

@@ -310,6 +310,43 @@ or_flag_cleanup()
 	wait $p2 $p4 $p6 >/dev/null 2>&1
 }
 
+atf_test_case print
+print_head()
+{
+	atf_set "descr" "Test the -p flag"
+}
+
+print_body()
+{
+	sleep 1 &
+	p1=$!
+
+	sleep 5 &
+	p5=$!
+
+	sleep 10 &
+	p10=$!
+
+	atf_check \
+		-o inline:"$p5\n$p10\n" \
+		-s exit:124 \
+		pwait -t 2 -p $p10 $p5 $p1 $p5 $p10
+
+	atf_check \
+		-e inline:"kill: $p1: No such process\n" \
+		-s exit:1 \
+		kill -0 $p1
+
+	atf_check kill -0 $p5
+	atf_check kill -0 $p10
+}
+
+print_cleanup()
+{
+	kill $p1 $p5 $p10 >/dev/null 2>&1
+	wait $p1 $p5 $p10 >/dev/null 2>&1
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case basic
@@ -318,4 +355,5 @@ atf_init_test_cases()
 	atf_add_test_case timeout_no_timeout
 	atf_add_test_case timeout_many
 	atf_add_test_case or_flag
+	atf_add_test_case print
 }

contrib/blocklist/Makefile

@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2015/01/22 17:49:41 christos Exp $
+# $NetBSD: Makefile,v 1.1.1.1 2020/06/15 01:52:52 christos Exp $
 
 SUBDIR = lib .WAIT include bin etc libexec
 

contrib/blocklist/Makefile.inc

@@ -1,10 +1,11 @@
-#	$NetBSD: Makefile.inc,v 1.3 2015/01/23 03:57:22 christos Exp $
+#	$NetBSD: Makefile.inc,v 1.3 2025/02/11 17:48:30 christos Exp $
 
 WARNS=6
 .if !defined(LIB)
-LDADD+=	-lblacklist
-DPADD+= ${LIBBLACKLIST}
+LDADD+=	-lblocklist
+DPADD+= ${LIBBLOCKLIST}
 .endif
 CPPFLAGS+= -I${.CURDIR}/../include
 CPPFLAGS+=-DHAVE_STRUCT_SOCKADDR_SA_LEN -DHAVE_UTIL_H -DHAVE_DB_H
+CPPFLAGS+=-DHAVE_SYS_CDEFS_H
 

contrib/blocklist/README

@@ -1,21 +1,21 @@
-# $NetBSD: README,v 1.8 2017/04/13 17:59:34 christos Exp $
+# $NetBSD: README,v 1.3 2024/02/09 00:53:30 wiz Exp $
 
 This package contains library that can be used by network daemons to
 communicate with a packet filter via a daemon to enforce opening and
 closing ports dynamically based on policy.
 
-The interface to the packet filter is in libexec/blacklistd-helper
+The interface to the packet filter is in libexec/blocklistd-helper
 (this is currently designed for npf) and the configuration file
-(inspired from inetd.conf) is in etc/blacklistd.conf.
+(inspired from inetd.conf) is in etc/blocklistd.conf.
 
-On NetBSD you can find an example npf.conf and blacklistd.conf in
-/usr/share/examples/blacklistd; you need to adjust the interface
+On NetBSD you can find an example npf.conf and blocklistd.conf in
+/usr/share/examples/blocklistd; you need to adjust the interface
 in npf.conf and copy both files to /etc; then you just enable
-blacklistd=YES in /etc/rc.conf, start it up, and you are all set.
+blocklistd=YES in /etc/rc.conf, start it up, and you are all set.
 
-There is also a startup file in etc/rc.d/blacklistd
+There is also a startup file in etc/rc.d/blocklistd
 
-Patches to various daemons to add blacklisting capabilitiers are in the
+Patches to various daemons to add blocklisting capabilities are in the
 "diff" directory:
     - OpenSSH: diff/ssh.diff [tcp socket example]
     - Bind: diff/named.diff [both tcp and udp]
@@ -23,21 +23,21 @@ Patches to various daemons to add blacklisting capabilitiers are in the
 
 These patches have been applied to NetBSD-current.
 
-The network daemon (for example sshd) communicates to blacklistd, via
-a unix socket like syslog. The library calls are simple and everything
+The network daemon (for example sshd) communicates to blocklistd, via
+a Unix socket like syslog. The library calls are simple and everything
 is handled by the library. In the simplest form the only thing the
 daemon needs to do is to call:
 
-	blacklist(action, acceptedfd, message);
+	blocklist(action, acceptedfd, message);
 
 Where:
-	action = 0 -> successful login clear blacklist state
+	action = 0 -> successful login clear blocklist state
 		 1 -> failed login, add to the failed count
 	acceptedfd -> the file descriptor where the server is
 		      connected to the remote client. It is used
 		      to determine the listening socket, and the
 		      remote address. This allows any program to
-		      contact the blacklist daemon, since the verification
+		      contact the blocklist daemon, since the verification
 		      if the program has access to the listening
 		      socket is done by virtue that the port
 		      number is retrieved from the kernel.
@@ -46,13 +46,13 @@ Where:
 Unfortunately there is no way to get information about the "peer"
 from a udp socket, because there is no connection and that information
 is kept with the server. In that case the daemon can provide the
-peer information to blacklistd via:
+peer information to blocklistd via:
 
-	blacklist_sa(action, acceptedfd, sockaddr, sockaddr_len, message);
+	blocklist_sa(action, acceptedfd, sockaddr, sockaddr_len, message);
 
 The configuration file contains entries of the form:
 
-# Blacklist rule
+# Blocklist rule
 # host/Port	type	protocol	owner	name	nfail	disable
 192.168.1.1:ssh	stream	tcp		*	-int	10	1m
 8.8.8.8:ssh	stream	tcp		*	-ext	6	60m
@@ -60,18 +60,18 @@ ssh		stream	tcp6		*	*	6	60m
 http		stream	tcp		*	*	6	60m
 
 Here note that owner is * because the connection is done from the
-child ssh socket which runs with user privs. We treat ipv4 connections
+child ssh socket which runs with user privs. We treat IPv4 connections
 differently by maintaining two different rules one for the external
 interface and one from the internal We also register for both tcp
 and tcp6 since those are different listening sockets and addresses;
-we don't bother with ipv6 and separate rules. We use nfail = 6,
+we don't bother with IPv6 and separate rules. We use nfail = 6,
 because ssh allows 3 password attempts per connection, and this
 will let us have 2 connections before blocking. Finally we block
 for an hour; we could block forever too by specifying * in the
 duration column.
 
-blacklistd and the library use syslog(3) to report errors. The
-blacklist filter state is persisted automatically in /var/db/blacklistd.db
+blocklistd and the library use syslog(3) to report errors. The
+blocklist filter state is persisted automatically in /var/db/blocklistd.db
 so that if the daemon is restarted, it remembers what connections
 is currently handling. To start from a fresh state (if you restart
 npf too for example), you can use -f. To watch the daemon at work,
@@ -80,27 +80,27 @@ you can use -d.
 The current control file is designed for npf, and it uses the
 dynamic rule feature. You need to create a dynamic rule in your
 /etc/npf.conf on the group referring to the interface you want to block
-called blacklistd as follows:
+called blocklistd as follows:
 
 ext_if=bge0
 int_if=sk0
 	
 group "external" on $ext_if {
 	...
-        ruleset "blacklistd-ext" 
-        ruleset "blacklistd" 
+        ruleset "blocklistd-ext" 
+        ruleset "blocklistd" 
 	...
 }
 
 group "internal" on $int_if {
 	...
-        ruleset "blacklistd-int" 
+        ruleset "blocklistd-int" 
 	...
 }
 
-You can use 'blacklistctl dump -a' to list all the current entries
+You can use 'blocklistctl dump -a' to list all the current entries
 in the database; the ones that have nfail <c>/<t> where <c>urrent
->= <t>otal, should have an id assosiated with them; this means that
+>= <t>otal, should have an id associated with them; this means that
 there is a packet filter rule added for that entry. For npf, you
 can examine the packet filter dynamic rule entries using 'npfctl
 rule <rulename> list'.  The number of current entries can exceed

contrib/blocklist/TODO

@@ -1,4 +1,4 @@
-# $NetBSD: TODO,v 1.7 2015/01/23 21:34:01 christos Exp $
+# $NetBSD: TODO,v 1.3 2025/02/05 20:22:26 christos Exp $
 
 - don't poll periodically, find the next timeout
 - use the socket also for commands? Or separate socket?
@@ -17,5 +17,48 @@
 	-n
 	block
 	unblock
-- do we need an api in blacklistctl to perform maintenance
-- fix the blacklistctl output to be more user friendly
+- do we need an api in blocklistctl to perform maintenance
+- fix the blocklistctl output to be more user friendly
+
+- figure out some way to do distributed operation securely (perhaps with
+  a helper daemon that authenticates local sockets and then communicates
+  local DB changes to the central server over a secure channel --
+  perhaps blocklistd-helper can have a back-end that can send updates to
+  a central server)
+
+- add "blocklistd -l" to enable filter logging on all rules by default
+
+- add some new options in the config file
+
+	"/all"	- block both TCP and UDP (on the proto field?)
+
+	"/log"	- enable filter logging (if not the default) (on the name field?)
+	"/nolog"- disable filter logging (if not the default) (on the name field?)
+
+  The latter two probably require a new parameter for blocklistd-helper.
+
+- "blocklistd -f" should (also?) be a blocklistctl function!?!?!
+
+- if blocklistd was started with '-r' then a SIGHUP should also do a
+  "control flush $rulename" and then re-add all the filter rules?
+
+- should/could /etc/rc.conf.d/ipfilter be created with the following?
+
+	reload_postcmd=blocklistd_reload
+	start_postcmd=blocklistd_start
+	stop_precmd=blocklistd_stop
+	blocklistd_reload ()
+	{
+		/etc/rc.d/blocklistd reload	# IFF SIGHUP does flush/re-add
+		# /etc/rc.d/blocklistd restart
+	}
+	blocklistd_stop ()
+	{
+		/etc/rc.d/blocklistd stop
+	}
+	blocklistd_start ()
+	{
+		/etc/rc.d/blocklistd start
+	}
+
+  or is there a better way?

contrib/blocklist/bin/Makefile

@@ -1,12 +1,12 @@
-# $NetBSD: Makefile,v 1.11 2015/01/27 19:40:36 christos Exp $
+# $NetBSD: Makefile,v 1.1.1.1 2020/06/15 01:52:52 christos Exp $
 
 BINDIR=/sbin
 
-PROGS=blacklistd blacklistctl
-MAN.blacklistd=blacklistd.8 blacklistd.conf.5
-MAN.blacklistctl=blacklistctl.8
-SRCS.blacklistd = blacklistd.c conf.c run.c state.c support.c internal.c
-SRCS.blacklistctl = blacklistctl.c conf.c state.c support.c internal.c
+PROGS=blocklistd blocklistctl
+MAN.blocklistd=blocklistd.8 blocklistd.conf.5
+MAN.blocklistctl=blocklistctl.8
+SRCS.blocklistd = blocklistd.c conf.c run.c state.c support.c internal.c
+SRCS.blocklistctl = blocklistctl.c conf.c state.c support.c internal.c
 DBG=-g
 
 LDADD+=-lutil

contrib/blocklist/bin/blacklistctl.8

@@ -1,4 +1,4 @@
-.\" $NetBSD: blacklistctl.8,v 1.9 2016/06/08 12:48:37 wiz Exp $
+.\" $NetBSD: blocklistctl.8,v 1.4 2025/02/07 01:35:38 kre Exp $
 .\"
 .\" Copyright (c) 2015 The NetBSD Foundation, Inc.
 .\" All rights reserved.
@@ -27,27 +27,42 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd June 7, 2016
+.Dd January 27, 2025
 .Dt BLACKLISTCTL 8
 .Os
 .Sh NAME
 .Nm blacklistctl
-.Nd display and change the state of blacklistd
+.Nd display and change the state of the blacklistd database
 .Sh SYNOPSIS
 .Nm
 .Cm dump
 .Op Fl abdnrw
+.Op Fl D Ar dbname
 .Sh DESCRIPTION
 .Nm
-is a program used to display the state of
+is a program used to display and change the state of the
 .Xr blacklistd 8
-.Pp
-The following options are available:
+database.
+The following sub-commands are supported:
+.Ss dump
+The following options are available for the
+.Cm dump
+sub-command:
 .Bl -tag -width indent
 .It Fl a
-Show all database entries, by default it shows only the embryonic ones.
+Show all database entries, by default it shows only the active ones.
+Inactive entries will be shown with a last-access (or, with
+.Fl r ,
+the remaining) time of
+.Ql never .
 .It Fl b
 Show only the blocked entries.
+.It Fl D Ar dbname
+Specify the location of the
+.Ic blacklistd
+database file to use.
+The default is
+.Pa /var/db/blocklistd.db .
 .It Fl d
 Increase debugging level.
 .It Fl n
@@ -59,9 +74,43 @@ Normally the width of addresses is good for IPv4, the
 .Fl w
 flag, makes the display wide enough for IPv6 addresses.
 .El
+.Pp
+The output of the
+.Cm dump
+sub-command consists of a header (unless
+.Fl n
+was given) and one line for each record in the database, where each line
+has the following columns:
+.Bl -tag -width indent
+.It Ql address/ma:port
+The remote address, mask, and local port number of the client connection
+associated with the database entry.
+.It Ql id
+column will show the identifier for the packet filter rule associated
+with the database entry, though this may only be the word
+.Ql OK
+for packet filters which do not create a unique identifier for each rule.
+.It Ql nfail
+The number of
+.Em failures
+reported for the client on the noted port, as well as the number of
+failures allowed before blocking (or, with
+.Fl a ,
+an asterisk
+.Aq * )
+.It So last access Sc | So remaining time Sc
+The last time a the client was reported as attempting access, or, with
+.Fl r ,
+the time remaining before the rule blocking the client will be removed.
+.El
 .Sh SEE ALSO
 .Xr blacklistd 8
 .Sh NOTES
+The
+.Nm
+program has been renamed to
+.Xr blocklistctl 8 .
+.Pp
 Sometimes the reported number of failed attempts can exceed the number
 of attempts that
 .Xr blacklistd 8

contrib/blocklist/bin/blacklistctl.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: blacklistctl.c,v 1.23 2018/05/24 19:21:01 christos Exp $	*/
+/*	$NetBSD: blocklistctl.c,v 1.4 2025/02/11 17:48:30 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: blacklistctl.c,v 1.23 2018/05/24 19:21:01 christos Exp $");
+#endif
+__RCSID("$NetBSD: blocklistctl.c,v 1.4 2025/02/11 17:48:30 christos Exp $");
 
 #include <stdio.h>
 #include <time.h>
@@ -53,7 +55,7 @@ __RCSID("$NetBSD: blacklistctl.c,v 1.23 2018/05/24 19:21:01 christos Exp $");
 
 #include "conf.h"
 #include "state.h"
-#include "internal.h"
+#include "old_internal.h"
 #include "support.h"
 
 static __dead void
@@ -63,7 +65,8 @@ usage(int c)
 		warnx("Missing/unknown command");
 	else if (c != '?')
 		warnx("Unknown option `%c'", (char)c);
-	fprintf(stderr, "Usage: %s dump [-abdnrw]\n", getprogname());
+	fprintf(stderr,
+	    "Usage: %s dump [-abdnrw] [-D dbname]\n", getprogname());
 	exit(EXIT_FAILURE);
 }
 

contrib/blocklist/bin/blacklistd.8

@@ -1,4 +1,4 @@
-.\" $NetBSD: blacklistd.8,v 1.23 2020/04/21 13:57:12 christos Exp $
+.\" $NetBSD: blocklistd.8,v 1.8 2025/02/25 22:13:34 christos Exp $
 .\"
 .\" Copyright (c) 2015 The NetBSD Foundation, Inc.
 .\" All rights reserved.
@@ -27,7 +27,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd April 21, 2020
+.Dd February 25, 2025
 .Dt BLACKLISTD 8
 .Os
 .Sh NAME
@@ -53,18 +53,31 @@ for notifications from other daemons about successful or failed connection
 attempts.
 If no such file is specified, then it only listens to the socket path
 specified by
-.Ar sockspath
+.Ar sockpath
 or if that is not specified to
-.Pa /var/run/blacklistd.sock .
+.Pa /var/run/blocklistd.sock .
 Each notification contains an (action, port, protocol, address, owner) tuple
 that identifies the remote connection and the action.
-This tuple is consulted against entries in
-.Ar configfile
-with syntax specified in
+This tuple is consulted against entries from the
+.Ar configfile ,
+with the syntax specified in
 .Xr blacklistd.conf 5 .
 If an entry is matched, a state entry is created for that tuple.
 Each entry contains a number of tries limit and a duration.
 .Pp
+If
+.Ar configfile
+is a directory, or a directory exists with the same name as
+.Ar configfile
+with
+.Qq .d
+appended to it, each file in the directory will be read as configuration file.
+If
+.Ar configfile
+exists as a file it will be processed before the contents of the
+.Ar configfile Ns .d
+directory if that also exists.
+.Pp
 The way
 .Nm
 does configuration entry matching is by having the client side pass the
@@ -152,7 +165,7 @@ The following options are available:
 .It Fl C Ar controlprog
 Use
 .Ar controlprog
-to communicate with the packet filter, usually
+to communicate with the packet filter, instead of the default, which is
 .Pa /usr/libexec/blacklistd-helper .
 The following arguments are passed to the control program:
 .Bl -tag -width protocol
@@ -161,7 +174,7 @@ The action to perform:
 .Dv add ,
 .Dv rem ,
 or
-.Dv flush
+.Dv flush ;
 to add, remove or flush a firewall rule.
 .It name
 The rule name.
@@ -183,13 +196,17 @@ identifier of the rule to be removed.
 The add command is expected to return the rule identifier string to stdout.
 .El
 .It Fl c Ar configuration
-The name of the configuration file to read, usually
+The name of the configuration file to read.
+The default when
+.Fl c
+is not given is
 .Pa /etc/blacklistd.conf .
 .It Fl D Ar dbfile
 The Berkeley DB file where
 .Nm
-stores its state, usually
-.Pa /var/db/blacklistd.db .
+stores its state.
+It defaults to
+.Pa /var/db/blocklistd.db .
 .It Fl d
 Normally,
 .Nm
@@ -203,7 +220,7 @@ are deleted by invoking the control script as:
 .Bd -literal -offset indent
 control flush <rulename>
 .Ed
-.It Fl P Ar sockspathsfile
+.It Fl P Ar sockpathsfile
 A file containing a list of pathnames, one per line that
 .Nm
 will create sockets to listen to.
@@ -261,16 +278,23 @@ to decrease the internal debugging level by 1.
 Shell script invoked to interface with the packet filter.
 .It Pa /etc/blacklistd.conf
 Configuration file.
-.It Pa /var/db/blacklistd.db
+.It Pa /var/db/blocklistd.db
 Database of current connection entries.
-.It Pa /var/run/blacklistd.sock
+.It Pa /var/run/blocklistd.sock
 Socket to receive connection notifications.
 .El
 .Sh SEE ALSO
 .Xr blacklistd.conf 5 ,
 .Xr blacklistctl 8 ,
+.Xr ipf 8 ,
+.Xr ipfw 8 ,
 .Xr pfctl 8 ,
 .Xr syslogd 8
+.Sh NOTES
+The
+.Nm
+daemon has been renamed to
+.Xr blocklistd 8 .
 .Sh HISTORY
 .Nm
 first appeared in

contrib/blocklist/bin/blacklistd.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: blacklistd.c,v 1.38 2019/02/27 02:20:18 christos Exp $	*/
+/*	$NetBSD: blocklistd.c,v 1.12 2025/10/25 18:43:51 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -31,8 +31,11 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
+
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: blacklistd.c,v 1.38 2019/02/27 02:20:18 christos Exp $");
+#endif
+__RCSID("$NetBSD: blocklistd.c,v 1.12 2025/10/25 18:43:51 christos Exp $");
 
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -64,8 +67,8 @@ __RCSID("$NetBSD: blacklistd.c,v 1.38 2019/02/27 02:20:18 christos Exp $");
 #include <ifaddrs.h>
 #include <netinet/in.h>
 
-#include "bl.h"
-#include "internal.h"
+#include "old_bl.h"
+#include "old_internal.h"
 #include "conf.h"
 #include "run.h"
 #include "state.h"
@@ -175,6 +178,8 @@ process(bl_t bl)
 	struct dbinfo dbi;
 	struct timespec ts;
 
+	memset(&dbi, 0, sizeof(dbi));
+	memset(&c, 0, sizeof(c));
 	if (clock_gettime(CLOCK_REALTIME, &ts) == -1) {
 		(*lfun)(LOG_ERR, "clock_gettime failed (%m)");
 		return;
@@ -186,24 +191,25 @@ process(bl_t bl)
 	}
 
 	if (getremoteaddress(bi, &rss, &rsl) == -1)
-		goto out;
+		return;
 
-	if (debug) {
+	if (debug || bi->bi_msg[0]) {
 		sockaddr_snprintf(rbuf, sizeof(rbuf), "%a:%p", (void *)&rss);
-		(*lfun)(LOG_DEBUG, "processing type=%d fd=%d remote=%s msg=%s"
-		    " uid=%lu gid=%lu", bi->bi_type, bi->bi_fd, rbuf,
+		(*lfun)(bi->bi_msg[0] ? LOG_INFO : LOG_DEBUG,
+		    "processing type=%d fd=%d remote=%s msg=\"%s\" uid=%lu gid=%lu",
+		    bi->bi_type, bi->bi_fd, rbuf,
 		    bi->bi_msg, (unsigned long)bi->bi_uid,
 		    (unsigned long)bi->bi_gid);
 	}
 
 	if (conf_find(bi->bi_fd, bi->bi_uid, &rss, &c) == NULL) {
 		(*lfun)(LOG_DEBUG, "no rule matched");
-		goto out;
+		return;
 	}
 
 
 	if (state_get(state, &c, &dbi) == -1)
-		goto out;
+		return;
 
 	if (debug) {
 		char b1[128], b2[128];
@@ -220,7 +226,7 @@ process(bl_t bl)
 		 * set the number of fails to be one less than the
 		 * configured limit.  Fallthrough to the normal BL_ADD
 		 * processing, which will increment the failure count
-		 * to the threshhold, and block the abusive address.
+		 * to the threshold, and block the abusive address.
 		 */
 		if (c.c_nfail != -1)
 			dbi.count = c.c_nfail - 1;
@@ -263,8 +269,6 @@ process(bl_t bl)
 	state_put(state, &c, &dbi);
 
 out:
-	close(bi->bi_fd);
-
 	if (debug) {
 		char b1[128], b2[128];
 		(*lfun)(LOG_DEBUG, "%s: final db state for %s: count=%d/%d "
@@ -325,8 +329,8 @@ again:
 			(*lfun)(LOG_INFO, "released %s/%d:%d after %d seconds",
 			    buf, c.c_lmask, c.c_port, c.c_duration);
 		}
-		state_del(state, &c);
-		goto again;
+		if (state_del(state, &c) == 0)
+			goto again;
 	}
 }
 
@@ -334,7 +338,7 @@ static void
 addfd(struct pollfd **pfdp, bl_t **blp, size_t *nfd, size_t *maxfd,
     const char *path)
 {
-	bl_t bl = bl_create(true, path, vflag ? vdlog : vsyslog);
+	bl_t bl = bl_create(true, path, vflag ? vdlog : vsyslog_r);
 	if (bl == NULL || !bl_isconnected(bl))
 		exit(EXIT_FAILURE);
 	if (*nfd >= *maxfd) {
@@ -395,15 +399,25 @@ rules_flush(void)
 static void
 rules_restore(void)
 {
+	DB *db;
 	struct conf c;
 	struct dbinfo dbi;
 	unsigned int f;
 
-	for (f = 1; state_iterate(state, &c, &dbi, f) == 1; f = 0) {
+	db = state_open(dbfile, O_RDONLY, 0);
+	if (db == NULL) {
+		(*lfun)(LOG_ERR, "Can't open `%s' to restore state (%m)",
+			dbfile);
+		return;
+	}
+	for (f = 1; state_iterate(db, &c, &dbi, f) == 1; f = 0) {
 		if (dbi.id[0] == '\0')
 			continue;
 		(void)run_change("add", &c, dbi.id, sizeof(dbi.id));
+		state_put(state, &c, &dbi);
 	}
+	state_close(db);
+	state_sync(state);
 }
 
 int
@@ -549,7 +563,7 @@ main(int argc, char *argv[])
 			conf_parse(configfile);
 		}
 		ret = poll(pfd, (nfds_t)nfd, tout);
-		if (debug)
+		if (debug && ret != 0)
 			(*lfun)(LOG_DEBUG, "received %d from poll()", ret);
 		switch (ret) {
 		case -1:

contrib/blocklist/bin/blacklistd.conf.5

@@ -1,6 +1,6 @@
-.\" $NetBSD: blacklistd.conf.5,v 1.9 2019/11/06 20:33:30 para Exp $
+.\" $NetBSD: blocklistd.conf.5,v 1.7 2025/02/11 17:47:05 christos Exp $
 .\"
-.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
+.\" Copyright (c) 2015, 2025 The NetBSD Foundation, Inc.
 .\" All rights reserved.
 .\"
 .\" This code is derived from software contributed to The NetBSD Foundation
@@ -27,7 +27,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd May 18, 2020
+.Dd February 5, 2025
 .Dt BLACKLISTD.CONF 5
 .Os
 .Sh NAME
@@ -48,34 +48,34 @@ Comments are denoted by a
 at the beginning of a line.
 .Pp
 There are two kinds of configuration lines,
-.Va local
+.Va [local]
 and
-.Va remote .
+.Va [remote] .
 By default, configuration lines are
-.Va local ,
+.Va [local] ,
 i.e. the address specified refers to the addresses on the local machine.
 To switch to between
-.Va local
+.Va [local]
 and
-.Va remote
+.Va [remote]
 configuration lines you can specify the stanzas:
 .Dq [local]
 and
 .Dq [remote] .
 .Pp
 On
-.Va local
+.Va [local]
 and
-.Va remote
+.Va [remote]
 lines
 .Dq *
 means use the default, or wildcard match.
 In addition, for
-.Va remote
+.Va [remote]
 lines
 .Dq =
 means use the values from the matched
-.Va local
+.Va [local]
 configuration line.
 .Pp
 The first four fields,
@@ -85,9 +85,9 @@ The first four fields,
 and
 .Va owner
 are used to match the
-.Va local
+.Va [local]
 or
-.Va remote
+.Va [remote]
 addresses, whereas the last 3 fields
 .Va name ,
 .Va nfail ,
@@ -110,8 +110,8 @@ The
 can be an IPv4 address in numeric format, an IPv6 address
 in numeric format and enclosed by square brackets, or an interface name.
 Mask modifiers are not allowed on interfaces because interfaces
-can have multiple addresses in different protocols where the mask has a different
-size.
+can have multiple addresses in different protocols where the mask has a
+different size.
 .Pp
 The
 .Dv mask
@@ -143,8 +143,8 @@ The
 field, is the name of the packet filter rule to be used.
 If the
 .Va name
-starts with a
-.Dq - ,
+starts with a hyphen
+.Pq Dq - ,
 then the default rulename is prepended to the given name.
 If the
 .Dv name
@@ -160,13 +160,13 @@ field contains the number of failed attempts before access is blocked,
 defaulting to
 .Dq *
 meaning never, and the last field
-.Va disable
+.Va duration
 specifies the amount of time since the last access that the blocking
 rule should be active, defaulting to
 .Dq *
 meaning forever.
 The default unit for
-.Va disable
+.Va duration
 is seconds, but one can specify suffixes for different units, such as
 .Dq m
 for minutes
@@ -176,25 +176,31 @@ for hours and
 for days.
 .Pp
 Matching is done first by checking the
-.Va local
+.Va [local]
 rules individually, in the order of the most specific to the least specific.
-If a match is found, then the
-.Va remote
+If a match is found, then the matching
+.Va [remote]
 rules are applied.
 The
 .Va name ,
 .Va nfail ,
 and
-.Va disable
+.Va duration
 fields can be altered by the
-.Va remote
+.Va [remote]
 rule that matched.
 .Pp
 The
-.Va remote
+.Va [remote]
 rules can be used for allowing specific addresses, changing the mask
-size, the rule that the packet filter uses, the number of failed attempts,
-or the block duration.
+size (via
+.Va name ) ,
+the rule that the packet filter uses (also via
+.Va name ) ,
+the number of failed attempts (via
+.Va nfail ) ,
+or the duration to block (via
+.Va duration ) .
 .Sh FILES
 .Bl -tag -width /etc/blacklistd.conf -compact
 .It Pa /etc/blacklistd.conf
@@ -209,13 +215,20 @@ bnx0:ssh	*	*	*	*	3	6h
 [remote]
 # Never block 1.2.3.4
 1.2.3.4:ssh	*	*	*	*	*	*
-# For addresses coming from 8.8.0.0/16 block whole /24 networks instead of
+# Never block the example IPv6 subnet either
+[2001:db8::]/32:ssh	*	*	*	*	*	*
+# For addresses coming from 8.8.0.0/16 block whole /24 networks instead
 # individual hosts, but keep the rest of the blocking parameters the same.
 8.8.0.0/16:ssh	*	*	*	/24	=	=
 .Ed
 .Sh SEE ALSO
 .Xr blacklistctl 8 ,
 .Xr blacklistd 8
+.Sh NOTES
+The
+.Nm
+file has been renamed to
+.Xr blocklistd.conf 8 .
 .Sh HISTORY
 .Nm
 first appeared in

contrib/blocklist/bin/blocklistctl.8

@@ -0,0 +1,134 @@
+.\" $NetBSD: blocklistctl.8,v 1.6 2025/10/26 13:49:22 christos Exp $
+.\"
+.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
+.\" All rights reserved.
+.\"
+.\" This code is derived from software contributed to The NetBSD Foundation
+.\" by Christos Zoulas.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+.\" POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd October 25, 2025
+.Dt BLOCKLISTCTL 8
+.Os
+.Sh NAME
+.Nm blocklistctl
+.Nd display and change the state of the blocklistd database
+.Sh SYNOPSIS
+.Nm
+.Cm dump
+.Op Fl abdnrw
+.Op Fl D Ar dbname
+.Sh DESCRIPTION
+.Nm
+is a program used to display and change the state of the
+.Xr blocklistd 8
+database.
+The following sub-commands are supported:
+.Ss dump
+The following options are available for the
+.Cm dump
+sub-command:
+.Bl -tag -width indent
+.It Fl a
+Show all database entries, by default it shows only the active ones.
+Inactive entries will be shown with a last-access (or, with
+.Fl r ,
+the remaining) time of
+.Ql never .
+.It Fl b
+Show only the blocked entries.
+.It Fl D Ar dbname
+Specify the location of the
+.Ic blocklistd
+database file to use.
+The default is
+.Pa /var/db/blocklistd.db .
+.It Fl d
+Increase debugging level.
+.It Fl n
+Don't display a header.
+.It Fl r
+Show the remaining blocked time instead of the last activity time.
+.It Fl w
+Normally the width of addresses is good for IPv4, the
+.Fl w
+flag, makes the display wide enough for IPv6 addresses.
+.El
+.Pp
+The output of the
+.Cm dump
+sub-command consists of a header (unless
+.Fl n
+was given) and one line for each record in the database, where each line
+has the following columns:
+.Bl -tag -width indent
+.It Ql rulename
+The packet filter rule name associated with the database entry,
+usually
+.Dv blocklistd .
+.It Ql address/ma:port
+The remote address, mask, and local port number of the client connection
+associated with the database entry.
+.It Ql id
+column will show the identifier for the packet filter rule associated
+with the database entry, though this may only be the word
+.Ql OK
+for packet filters which do not create a unique identifier for each rule.
+.It Ql nfail
+The number of
+.Em failures
+reported for the client on the noted port, as well as the number of
+failures allowed before blocking (or, with
+.Fl a ,
+an asterisk
+.Aq * )
+.It So last access Sc | So remaining time Sc
+The last time a the client was reported as attempting access, or, with
+.Fl r ,
+the time remaining before the rule blocking the client will be removed.
+.El
+.Sh SEE ALSO
+.Xr blocklistd 8
+.Sh NOTES
+Sometimes the reported number of failed attempts can exceed the number
+of attempts that
+.Xr blocklistd 8
+is configured to block.
+This can happen either because the rule has been removed manually, or
+because there were more attempts in flight while the rule block was being
+added.
+This condition is normal; in that case
+.Xr blocklistd 8
+will first attempt to remove the existing rule, and then it will re-add
+it to make sure that there is only one rule active.
+.Sh HISTORY
+.Nm
+first appeared in
+.Nx 7 .
+.Fx
+support for
+.Nm
+was implemented in
+.Fx 11 .
+.Sh AUTHORS
+.An Christos Zoulas

contrib/blocklist/bin/blocklistctl.c

@@ -0,0 +1,170 @@
+/*	$NetBSD: blocklistctl.c,v 1.5 2025/10/25 16:56:10 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2015 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef HAVE_SYS_CDEFS_H
+#include <sys/cdefs.h>
+#endif
+__RCSID("$NetBSD: blocklistctl.c,v 1.5 2025/10/25 16:56:10 christos Exp $");
+
+#include <stdio.h>
+#include <time.h>
+#ifdef HAVE_LIBUTIL_H
+#include <libutil.h>
+#endif
+#ifdef HAVE_UTIL_H
+#include <util.h>
+#endif
+#include <fcntl.h>
+#include <string.h>
+#include <syslog.h>
+#include <err.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/socket.h>
+
+#include "conf.h"
+#include "state.h"
+#include "internal.h"
+#include "support.h"
+
+static __dead void
+usage(int c)
+{
+	if (c == 0)
+		warnx("Missing/unknown command");
+	else if (c != '?')
+		warnx("Unknown option `%c'", (char)c);
+	fprintf(stderr,
+	    "Usage: %s dump [-abdnrw] [-D dbname]\n", getprogname());
+	exit(EXIT_FAILURE);
+}
+
+static const char *
+star(char *buf, size_t len, int val)
+{
+	if (val == -1)
+		return "*";
+	snprintf(buf, len, "%d", val);
+	return buf;
+}
+
+int
+main(int argc, char *argv[])
+{
+	const char *dbname = _PATH_BLSTATE;
+	DB *db;
+	struct conf c;
+	struct dbinfo dbi;
+	unsigned int i;
+	struct timespec ts;
+	int all, blocked, remain, wide, noheader;
+	int o;
+
+	noheader = wide = blocked = all = remain = 0;
+	lfun = dlog;
+
+	if (argc == 1 || strcmp(argv[1], "dump") != 0)
+		usage(0);
+
+	argc--;
+	argv++;
+
+	while ((o = getopt(argc, argv, "abD:dnrw")) != -1)
+		switch (o) {
+		case 'a':
+			all = 1;
+			blocked = 0;
+			break;
+		case 'b':
+			blocked = 1;
+			break;
+		case 'D':
+			dbname = optarg;
+			break;
+		case 'd':
+			debug++;
+			break;
+		case 'n':
+			noheader = 1;
+			break;
+		case 'r':
+			remain = 1;
+			break;
+		case 'w':
+			wide = 1;
+			break;
+		default:
+			usage(o);
+		}
+
+	db = state_open(dbname, O_RDONLY, 0);
+	if (db == NULL)
+		err(EXIT_FAILURE, "Can't open `%s'", dbname);
+
+	clock_gettime(CLOCK_REALTIME, &ts);
+	wide = wide ? 8 * 4 + 7 : 4 * 3 + 3;
+	if (!noheader)
+		printf("rulename\t%*.*s/ma:port\tid\tnfail\t%s\n", wide, wide,
+		    "address", remain ? "remaining time" : "last access");
+	for (i = 1; state_iterate(db, &c, &dbi, i) != 0; i = 0) {
+		char buf[BUFSIZ];
+		char mbuf[64], pbuf[64];
+		if (!all) {
+			if (blocked) {
+				if (c.c_nfail == -1 || dbi.count < c.c_nfail)
+					continue;
+			} else {
+				if (dbi.count >= c.c_nfail)
+					continue;
+			}
+		}
+		sockaddr_snprintf(buf, sizeof(buf), "%a", (void *)&c.c_ss);
+		printf("%s\t%*.*s/%s:%s\t", c.c_name, wide, wide, buf,
+		    star(mbuf, sizeof(mbuf), c.c_lmask),
+		    star(pbuf, sizeof(pbuf), c.c_port));
+		if (c.c_duration == -1) {
+			strlcpy(buf, "never", sizeof(buf));
+		} else {
+			if (remain)
+				fmtydhms(buf, sizeof(buf),
+				    c.c_duration - (ts.tv_sec - dbi.last));
+			else
+				fmttime(buf, sizeof(buf), dbi.last);
+		}
+		printf("%s\t%d/%s\t%-s\n", dbi.id, dbi.count,
+		    star(mbuf, sizeof(mbuf), c.c_nfail), buf);
+	}
+	state_close(db);
+	return EXIT_SUCCESS;
+}

contrib/blocklist/bin/blocklistd.8

@@ -0,0 +1,303 @@
+.\" $NetBSD: blocklistd.8,v 1.8 2025/02/25 22:13:34 christos Exp $
+.\"
+.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
+.\" All rights reserved.
+.\"
+.\" This code is derived from software contributed to The NetBSD Foundation
+.\" by Christos Zoulas.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+.\" POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd February 25, 2025
+.Dt BLOCKLISTD 8
+.Os
+.Sh NAME
+.Nm blocklistd
+.Nd block and release ports on demand to avoid DoS abuse
+.Sh SYNOPSIS
+.Nm
+.Op Fl dfrv
+.Op Fl C Ar controlprog
+.Op Fl c Ar configfile
+.Op Fl D Ar dbfile
+.Op Fl P Ar sockpathsfile
+.Op Fl R Ar rulename
+.Op Fl s Ar sockpath
+.Op Fl t Ar timeout
+.Sh DESCRIPTION
+.Nm
+is a daemon similar to
+.Xr syslogd 8
+that listens to sockets at paths specified in the
+.Ar sockpathsfile
+for notifications from other daemons about successful or failed connection
+attempts.
+If no such file is specified, then it only listens to the socket path
+specified by
+.Ar sockpath
+or if that is not specified to
+.Pa /var/run/blocklistd.sock .
+Each notification contains an (action, port, protocol, address, owner) tuple
+that identifies the remote connection and the action.
+This tuple is consulted against entries from the
+.Ar configfile ,
+with the syntax specified in
+.Xr blocklistd.conf 5 .
+If an entry is matched, a state entry is created for that tuple.
+Each entry contains a number of tries limit and a duration.
+.Pp
+If
+.Ar configfile
+is a directory, or a directory exists with the same name as
+.Ar configfile
+with
+.Qq .d
+appended to it, each file in the directory will be read as configuration file.
+If
+.Ar configfile
+exists as a file it will be processed before the contents of the
+.Ar configfile Ns .d
+directory if that also exists.
+.Pp
+The way
+.Nm
+does configuration entry matching is by having the client side pass the
+file descriptor associated with the connection the client wants to blocklist
+as well as passing socket credentials.
+.Pp
+The file descriptor is used to retrieve information (address and port)
+about the remote side with
+.Xr getpeername 2
+and the local side with
+.Xr getsockname 2 .
+.Pp
+By examining the port of the local side,
+.Nm
+can determine if the client program
+.Dq owns
+the port.
+By examining the optional address portion on the local side, it can match
+interfaces.
+By examining the remote address, it can match specific allow or deny rules.
+.Pp
+Finally
+.Nm
+can examine the socket credentials to match the user in the configuration file.
+.Pp
+While this works well for TCP sockets, it cannot be relied on for unbound
+UDP sockets.
+It is also less meaningful when it comes to connections using non-privileged
+ports.
+On the other hand, if we receive a request that has a local endpoint indicating
+a UDP privileged port, we can presume that the client was privileged to be
+able to acquire that port.
+.Pp
+Once an entry is matched
+.Nm
+can perform various actions.
+If the action is
+.Dq add
+and the number of tries limit is reached, then a
+control script
+.Ar controlprog
+is invoked with arguments:
+.Bd -literal -offset indent
+control add <rulename> <proto> <address> <mask> <port>
+.Ed
+.Pp
+and should invoke a packet filter command to block the connection
+specified by the arguments.
+The
+.Ar rulename
+argument can be set from the command line (default
+.Dv blocklistd ) .
+The script could print a numerical id to stdout as a handle for
+the rule that can be used later to remove that connection, but
+that is not required as all information to remove the rule is
+kept.
+.Pp
+If the action is
+.Dq rem
+Then the same control script is invoked as:
+.Bd -literal -offset indent
+control rem <rulename> <proto> <address> <mask> <port> <id>
+.Ed
+.Pp
+where
+.Ar id
+is the number returned from the
+.Dq add
+action.
+.Pp
+.Nm
+maintains a database of known connections in
+.Ar dbfile .
+On startup it reads entries from that file, and updates its internal state.
+.Pp
+.Nm
+checks the list of active entries every
+.Ar timeout
+seconds (default
+.Dv 15 )
+and removes entries and block rules using the control program as necessary.
+.Pp
+The following options are available:
+.Bl -tag -width indent
+.It Fl C Ar controlprog
+Use
+.Ar controlprog
+to communicate with the packet filter, instead of the default, which is
+.Pa /usr/libexec/blocklistd-helper .
+The following arguments are passed to the control program:
+.Bl -tag -width protocol
+.It action
+The action to perform:
+.Dv add ,
+.Dv rem ,
+or
+.Dv flush ;
+to add, remove or flush a firewall rule.
+.It name
+The rule name.
+.It protocol
+The optional protocol name (can be empty):
+.Dv tcp ,
+.Dv tcp6 ,
+.Dv udp ,
+.Dv udp6 .
+.It address
+The IPv4 or IPv6 numeric address to be blocked or released.
+.It mask
+The numeric mask to be applied to the blocked or released address
+.It port
+The optional numeric port to be blocked (can be empty).
+.It id
+For packet filters that support removal of rules by rule identifier, the
+identifier of the rule to be removed.
+The add command is expected to return the rule identifier string to stdout.
+.El
+.It Fl c Ar configuration
+The name of the configuration file to read.
+The default when
+.Fl c
+is not given is
+.Pa /etc/blocklistd.conf .
+.It Fl D Ar dbfile
+The Berkeley DB file where
+.Nm
+stores its state.
+It defaults to
+.Pa /var/db/blocklistd.db .
+.It Fl d
+Normally,
+.Nm
+disassociates itself from the terminal unless the
+.Fl d
+flag is specified, in which case it stays in the foreground.
+.It Fl f
+Truncate the state database and flush all the rules named
+.Ar rulename
+are deleted by invoking the control script as:
+.Bd -literal -offset indent
+control flush <rulename>
+.Ed
+.It Fl P Ar sockpathsfile
+A file containing a list of pathnames, one per line that
+.Nm
+will create sockets to listen to.
+This is useful for chrooted environments.
+.It Fl R Ar rulename
+Specify the default rule name for the packet filter rules, usually
+.Dv blocklistd .
+.It Fl r
+Re-read the firewall rules from the internal database, then
+remove and re-add them.
+This helps for packet filters that do not retain state across reboots.
+.It Fl s Ar sockpath
+Add
+.Ar sockpath
+to the list of Unix sockets
+.Nm
+listens to.
+.It Fl t Ar timeout
+The interval in seconds
+.Nm
+polls the state file to update the rules.
+.It Fl v
+Cause
+.Nm
+to print
+diagnostic messages to
+.Dv stdout
+instead of
+.Xr syslogd 8 .
+.El
+.Sh SIGNAL HANDLING
+.Nm
+deals with the following signals:
+.Bl -tag -width "USR2"
+.It Dv HUP
+Receipt of this signal causes
+.Nm
+to re-read the configuration file.
+.It Dv INT , Dv TERM & Dv QUIT
+These signals tell
+.Nm
+to exit in an orderly fashion.
+.It Dv USR1
+This signal tells
+.Nm
+to increase the internal debugging level by 1.
+.It Dv USR2
+This signal tells
+.Nm
+to decrease the internal debugging level by 1.
+.El
+.Sh FILES
+.Bl -tag -width /usr/libexec/blocklistd-helper -compact
+.It Pa /usr/libexec/blocklistd-helper
+Shell script invoked to interface with the packet filter.
+.It Pa /etc/blocklistd.conf
+Configuration file.
+.It Pa /var/db/blocklistd.db
+Database of current connection entries.
+.It Pa /var/run/blocklistd.sock
+Socket to receive connection notifications.
+.El
+.Sh SEE ALSO
+.Xr blocklistd.conf 5 ,
+.Xr blocklistctl 8 ,
+.Xr ipf 8 ,
+.Xr ipfw 8 ,
+.Xr pfctl 8 ,
+.Xr syslogd 8
+.Sh HISTORY
+.Nm
+first appeared in
+.Nx 7 .
+.Fx
+support for
+.Nm
+was implemented in
+.Fx 11 .
+.Sh AUTHORS
+.An Christos Zoulas

contrib/blocklist/bin/blocklistd.c

@@ -0,0 +1,590 @@
+/*	$NetBSD: blocklistd.c,v 1.12 2025/10/25 18:43:51 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2015 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef HAVE_SYS_CDEFS_H
+#include <sys/cdefs.h>
+#endif
+__RCSID("$NetBSD: blocklistd.c,v 1.12 2025/10/25 18:43:51 christos Exp $");
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/queue.h>
+
+#ifdef HAVE_LIBUTIL_H
+#include <libutil.h>
+#endif
+#ifdef HAVE_UTIL_H
+#include <util.h>
+#endif
+#include <string.h>
+#include <signal.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include <inttypes.h>
+#include <syslog.h>
+#include <ctype.h>
+#include <limits.h>
+#include <errno.h>
+#include <poll.h>
+#include <fcntl.h>
+#include <err.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+#include <ifaddrs.h>
+#include <netinet/in.h>
+
+#include "bl.h"
+#include "internal.h"
+#include "conf.h"
+#include "run.h"
+#include "state.h"
+#include "support.h"
+
+static const char *configfile = _PATH_BLCONF;
+static DB *state;
+static const char *dbfile = _PATH_BLSTATE;
+static sig_atomic_t readconf;
+static sig_atomic_t done;
+static int vflag;
+
+static void
+sigusr1(int n __unused)
+{
+	debug++;
+}
+
+static void
+sigusr2(int n __unused)
+{
+	debug--;
+}
+
+static void
+sighup(int n __unused)
+{
+	readconf++;
+}
+
+static void
+sigdone(int n __unused)
+{
+	done++;
+}
+
+static __dead void
+usage(int c)
+{
+	if (c != '?')
+		warnx("Unknown option `%c'", (char)c);
+	fprintf(stderr, "Usage: %s [-vdfr] [-c <config>] [-R <rulename>] "
+	    "[-P <sockpathsfile>] [-C <controlprog>] [-D <dbfile>] "
+	    "[-s <sockpath>] [-t <timeout>]\n", getprogname());
+	exit(EXIT_FAILURE);
+}
+
+static int
+getremoteaddress(bl_info_t *bi, struct sockaddr_storage *rss, socklen_t *rsl)
+{
+	*rsl = sizeof(*rss);
+	memset(rss, 0, *rsl);
+
+	if (getpeername(bi->bi_fd, (void *)rss, rsl) != -1)
+		return 0;
+
+	if (errno != ENOTCONN) {
+		(*lfun)(LOG_ERR, "getpeername failed (%m)");
+		return -1;
+	}
+
+	if (bi->bi_slen == 0) {
+		(*lfun)(LOG_ERR, "unconnected socket with no peer in message");
+		return -1;
+	}
+
+	switch (bi->bi_ss.ss_family) {
+	case AF_INET:
+		*rsl = sizeof(struct sockaddr_in);
+		break;
+	case AF_INET6:
+		*rsl = sizeof(struct sockaddr_in6);
+		break;
+	default:
+		(*lfun)(LOG_ERR, "bad client passed socket family %u",
+		    (unsigned)bi->bi_ss.ss_family);
+		return -1;
+	}
+
+	if (*rsl != bi->bi_slen) {
+		(*lfun)(LOG_ERR, "bad client passed socket length %u != %u",
+		    (unsigned)*rsl, (unsigned)bi->bi_slen);
+		return -1;
+	}
+
+	memcpy(rss, &bi->bi_ss, *rsl);
+
+#ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
+	if (*rsl != rss->ss_len) {
+		(*lfun)(LOG_ERR,
+		    "bad client passed socket internal length %u != %u",
+		    (unsigned)*rsl, (unsigned)rss->ss_len);
+		return -1;
+	}
+#endif
+	return 0;
+}
+
+static void
+process(bl_t bl)
+{
+	struct sockaddr_storage rss;
+	socklen_t rsl;
+	char rbuf[BUFSIZ];
+	bl_info_t *bi;
+	struct conf c;
+	struct dbinfo dbi;
+	struct timespec ts;
+
+	memset(&dbi, 0, sizeof(dbi));
+	memset(&c, 0, sizeof(c));
+	if (clock_gettime(CLOCK_REALTIME, &ts) == -1) {
+		(*lfun)(LOG_ERR, "clock_gettime failed (%m)");
+		return;
+	}
+
+	if ((bi = bl_recv(bl)) == NULL) {
+		(*lfun)(LOG_ERR, "no message (%m)");
+		return;
+	}
+
+	if (getremoteaddress(bi, &rss, &rsl) == -1)
+		return;
+
+	if (debug || bi->bi_msg[0]) {
+		sockaddr_snprintf(rbuf, sizeof(rbuf), "%a:%p", (void *)&rss);
+		(*lfun)(bi->bi_msg[0] ? LOG_INFO : LOG_DEBUG,
+		    "processing type=%d fd=%d remote=%s msg=\"%s\" uid=%lu gid=%lu",
+		    bi->bi_type, bi->bi_fd, rbuf,
+		    bi->bi_msg, (unsigned long)bi->bi_uid,
+		    (unsigned long)bi->bi_gid);
+	}
+
+	if (conf_find(bi->bi_fd, bi->bi_uid, &rss, &c) == NULL) {
+		(*lfun)(LOG_DEBUG, "no rule matched");
+		return;
+	}
+
+
+	if (state_get(state, &c, &dbi) == -1)
+		return;
+
+	if (debug) {
+		char b1[128], b2[128];
+		(*lfun)(LOG_DEBUG, "%s: initial db state for %s: count=%d/%d "
+		    "last=%s now=%s", __func__, rbuf, dbi.count, c.c_nfail,
+		    fmttime(b1, sizeof(b1), dbi.last),
+		    fmttime(b2, sizeof(b2), ts.tv_sec));
+	}
+
+	switch (bi->bi_type) {
+	case BL_ABUSE:
+		/*
+		 * If the application has signaled abusive behavior,
+		 * set the number of fails to be one less than the
+		 * configured limit.  Fallthrough to the normal BL_ADD
+		 * processing, which will increment the failure count
+		 * to the threshold, and block the abusive address.
+		 */
+		if (c.c_nfail != -1)
+			dbi.count = c.c_nfail - 1;
+		/*FALLTHROUGH*/
+	case BL_ADD:
+		dbi.count++;
+		dbi.last = ts.tv_sec;
+		if (c.c_nfail != -1 && dbi.count >= c.c_nfail) {
+			/*
+			 * No point in re-adding the rule.
+			 * It might exist already due to latency in processing
+			 * and removing the rule is the wrong thing to do as
+			 * it allows a window to attack again.
+			 */
+			if (dbi.id[0] == '\0') {
+				int res = run_change("add", &c,
+				    dbi.id, sizeof(dbi.id));
+				if (res == -1)
+					goto out;
+			}
+			sockaddr_snprintf(rbuf, sizeof(rbuf), "%a",
+			    (void *)&rss);
+			(*lfun)(LOG_INFO,
+			    "blocked %s/%d:%d for %d seconds",
+			    rbuf, c.c_lmask, c.c_port, c.c_duration);
+		}
+		break;
+	case BL_DELETE:
+		if (dbi.last == 0)
+			goto out;
+		dbi.count = 0;
+		dbi.last = 0;
+		break;
+	case BL_BADUSER:
+		/* ignore for now */
+		break;
+	default:
+		(*lfun)(LOG_ERR, "unknown message %d", bi->bi_type);
+	}
+	state_put(state, &c, &dbi);
+
+out:
+	if (debug) {
+		char b1[128], b2[128];
+		(*lfun)(LOG_DEBUG, "%s: final db state for %s: count=%d/%d "
+		    "last=%s now=%s", __func__, rbuf, dbi.count, c.c_nfail,
+		    fmttime(b1, sizeof(b1), dbi.last),
+		    fmttime(b2, sizeof(b2), ts.tv_sec));
+	}
+}
+
+static void
+update_interfaces(void)
+{
+	struct ifaddrs *oifas, *nifas;
+
+	if (getifaddrs(&nifas) == -1)
+		return;
+
+	oifas = ifas;
+	ifas = nifas;
+
+	if (oifas)
+		freeifaddrs(oifas);
+}
+
+static void
+update(void)
+{
+	struct timespec ts;
+	struct conf c;
+	struct dbinfo dbi;
+	unsigned int f, n;
+	char buf[128];
+	void *ss = &c.c_ss;
+
+	if (clock_gettime(CLOCK_REALTIME, &ts) == -1) {
+		(*lfun)(LOG_ERR, "clock_gettime failed (%m)");
+		return;
+	}
+
+again:
+	for (n = 0, f = 1; state_iterate(state, &c, &dbi, f) == 1;
+	    f = 0, n++)
+	{
+		time_t when = c.c_duration + dbi.last;
+		if (debug > 1) {
+			char b1[64], b2[64];
+			sockaddr_snprintf(buf, sizeof(buf), "%a:%p", ss);
+			(*lfun)(LOG_DEBUG, "%s:[%u] %s count=%d duration=%d "
+			    "last=%s " "now=%s", __func__, n, buf, dbi.count,
+			    c.c_duration, fmttime(b1, sizeof(b1), dbi.last),
+			    fmttime(b2, sizeof(b2), ts.tv_sec));
+		}
+		if (c.c_duration == -1 || when >= ts.tv_sec)
+			continue;
+		if (dbi.id[0]) {
+			run_change("rem", &c, dbi.id, 0);
+			sockaddr_snprintf(buf, sizeof(buf), "%a", ss);
+			(*lfun)(LOG_INFO, "released %s/%d:%d after %d seconds",
+			    buf, c.c_lmask, c.c_port, c.c_duration);
+		}
+		if (state_del(state, &c) == 0)
+			goto again;
+	}
+}
+
+static void
+addfd(struct pollfd **pfdp, bl_t **blp, size_t *nfd, size_t *maxfd,
+    const char *path)
+{
+	bl_t bl = bl_create(true, path, vflag ? vdlog : vsyslog_r);
+	if (bl == NULL || !bl_isconnected(bl))
+		exit(EXIT_FAILURE);
+	if (*nfd >= *maxfd) {
+		*maxfd += 10;
+		*blp = realloc(*blp, sizeof(**blp) * *maxfd);
+		if (*blp == NULL)
+			err(EXIT_FAILURE, "malloc");
+		*pfdp = realloc(*pfdp, sizeof(**pfdp) * *maxfd);
+		if (*pfdp == NULL)
+			err(EXIT_FAILURE, "malloc");
+	}
+
+	(*pfdp)[*nfd].fd = bl_getfd(bl);
+	(*pfdp)[*nfd].events = POLLIN;
+	(*blp)[*nfd] = bl;
+	*nfd += 1;
+}
+
+static void
+uniqueadd(struct conf ***listp, size_t *nlist, size_t *mlist, struct conf *c)
+{
+	struct conf **list = *listp;
+
+	if (c->c_name[0] == '\0')
+		return;
+	for (size_t i = 0; i < *nlist; i++) {
+		if (strcmp(list[i]->c_name, c->c_name) == 0)
+			return;
+	}
+	if (*nlist == *mlist) {
+		*mlist += 10;
+		void *p = realloc(*listp, *mlist * sizeof(*list));
+		if (p == NULL)
+			err(EXIT_FAILURE, "Can't allocate for rule list");
+		list = *listp = p;
+	}
+	list[(*nlist)++] = c;
+}
+
+static void
+rules_flush(void)
+{
+	struct conf **list;
+	size_t nlist, mlist;
+
+	list = NULL;
+	mlist = nlist = 0;
+	for (size_t i = 0; i < rconf.cs_n; i++)
+		uniqueadd(&list, &nlist, &mlist, &rconf.cs_c[i]);
+	for (size_t i = 0; i < lconf.cs_n; i++)
+		uniqueadd(&list, &nlist, &mlist, &lconf.cs_c[i]);
+
+	for (size_t i = 0; i < nlist; i++)
+		run_flush(list[i]);
+	free(list);
+}
+
+static void
+rules_restore(void)
+{
+	DB *db;
+	struct conf c;
+	struct dbinfo dbi;
+	unsigned int f;
+
+	db = state_open(dbfile, O_RDONLY, 0);
+	if (db == NULL) {
+		(*lfun)(LOG_ERR, "Can't open `%s' to restore state (%m)",
+			dbfile);
+		return;
+	}
+	for (f = 1; state_iterate(db, &c, &dbi, f) == 1; f = 0) {
+		if (dbi.id[0] == '\0')
+			continue;
+		(void)run_change("add", &c, dbi.id, sizeof(dbi.id));
+		state_put(state, &c, &dbi);
+	}
+	state_close(db);
+	state_sync(state);
+}
+
+int
+main(int argc, char *argv[])
+{
+	int c, tout, flags, flush, restore, ret;
+	const char *spath, **blsock;
+	size_t nblsock, maxblsock;
+
+	setprogname(argv[0]);
+
+	spath = NULL;
+	blsock = NULL;
+	maxblsock = nblsock = 0;
+	flush = 0;
+	restore = 0;
+	tout = 0;
+	flags = O_RDWR|O_EXCL|O_CLOEXEC;
+	while ((c = getopt(argc, argv, "C:c:D:dfP:rR:s:t:v")) != -1) {
+		switch (c) {
+		case 'C':
+			controlprog = optarg;
+			break;
+		case 'c':
+			configfile = optarg;
+			break;
+		case 'D':
+			dbfile = optarg;
+			break;
+		case 'd':
+			debug++;
+			break;
+		case 'f':
+			flush++;
+			break;
+		case 'P':
+			spath = optarg;
+			break;
+		case 'R':
+			rulename = optarg;
+			break;
+		case 'r':
+			restore++;
+			break;
+		case 's':
+			if (nblsock >= maxblsock) {
+				maxblsock += 10;
+				void *p = realloc(blsock,
+				    sizeof(*blsock) * maxblsock);
+				if (p == NULL)
+				    err(EXIT_FAILURE,
+					"Can't allocate memory for %zu sockets",
+					maxblsock);
+				blsock = p;
+			}
+			blsock[nblsock++] = optarg;
+			break;
+		case 't':
+			tout = atoi(optarg) * 1000;
+			break;
+		case 'v':
+			vflag++;
+			break;
+		default:
+			usage(c);
+		}
+	}
+
+	argc -= optind;
+	if (argc)
+		usage('?');
+
+	signal(SIGHUP, sighup);
+	signal(SIGINT, sigdone);
+	signal(SIGQUIT, sigdone);
+	signal(SIGTERM, sigdone);
+	signal(SIGUSR1, sigusr1);
+	signal(SIGUSR2, sigusr2);
+
+	openlog(getprogname(), LOG_PID, LOG_DAEMON);
+
+	if (debug) {
+		lfun = dlog;
+		if (tout == 0)
+			tout = 5000;
+	} else {
+		if (tout == 0)
+			tout = 15000;
+	}
+
+	update_interfaces();
+	conf_parse(configfile);
+	if (flush) {
+		rules_flush();
+		if (!restore)
+			flags |= O_TRUNC;
+	}
+
+	struct pollfd *pfd = NULL;
+	bl_t *bl = NULL;
+	size_t nfd = 0;
+	size_t maxfd = 0;
+
+	for (size_t i = 0; i < nblsock; i++)
+		addfd(&pfd, &bl, &nfd, &maxfd, blsock[i]);
+	free(blsock);
+
+	if (spath) {
+		FILE *fp = fopen(spath, "r");
+		char *line;
+		if (fp == NULL)
+			err(EXIT_FAILURE, "Can't open `%s'", spath);
+		for (; (line = fparseln(fp, NULL, NULL, NULL, 0)) != NULL;
+		    free(line))
+			addfd(&pfd, &bl, &nfd, &maxfd, line);
+		fclose(fp);
+	}
+	if (nfd == 0)
+		addfd(&pfd, &bl, &nfd, &maxfd, _PATH_BLSOCK);
+
+	state = state_open(dbfile, flags, 0600);
+	if (state == NULL)
+		state = state_open(dbfile,  flags | O_CREAT, 0600);
+	if (state == NULL)
+		return EXIT_FAILURE;
+
+	if (restore) {
+		if (!flush)
+			rules_flush();
+		rules_restore();
+	}
+
+	if (!debug) {
+		if (daemon(0, 0) == -1)
+			err(EXIT_FAILURE, "daemon failed");
+		if (pidfile(NULL) == -1)
+			err(EXIT_FAILURE, "Can't create pidfile");
+	}
+
+	for (size_t t = 0; !done; t++) {
+		if (readconf) {
+			readconf = 0;
+			conf_parse(configfile);
+		}
+		ret = poll(pfd, (nfds_t)nfd, tout);
+		if (debug && ret != 0)
+			(*lfun)(LOG_DEBUG, "received %d from poll()", ret);
+		switch (ret) {
+		case -1:
+			if (errno == EINTR)
+				continue;
+			(*lfun)(LOG_ERR, "poll (%m)");
+			return EXIT_FAILURE;
+		case 0:
+			state_sync(state);
+			break;
+		default:
+			for (size_t i = 0; i < nfd; i++)
+				if (pfd[i].revents & POLLIN)
+					process(bl[i]);
+		}
+		if (t % 100 == 0)
+			state_sync(state);
+		if (t % 10000 == 0)
+			update_interfaces();
+		update();
+	}
+	state_close(state);
+	return 0;
+}

contrib/blocklist/bin/blocklistd.conf.5

@@ -0,0 +1,237 @@
+.\" $NetBSD: blocklistd.conf.5,v 1.7 2025/02/11 17:47:05 christos Exp $
+.\"
+.\" Copyright (c) 2015, 2025 The NetBSD Foundation, Inc.
+.\" All rights reserved.
+.\"
+.\" This code is derived from software contributed to The NetBSD Foundation
+.\" by Christos Zoulas.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+.\" POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd February 5, 2025
+.Dt BLOCKLISTD.CONF 5
+.Os
+.Sh NAME
+.Nm blocklistd.conf
+.Nd configuration file format for blocklistd
+.Sh DESCRIPTION
+The
+.Nm
+file contains configuration entries for
+.Xr blocklistd 8
+in a fashion similar to
+.Xr inetd.conf 5 .
+Only one entry per line is permitted.
+Every entry must have all fields populated.
+Each field can be separated by a tab or a space.
+Comments are denoted by a
+.Dq #
+at the beginning of a line.
+.Pp
+There are two kinds of configuration lines,
+.Va [local]
+and
+.Va [remote] .
+By default, configuration lines are
+.Va [local] ,
+i.e. the address specified refers to the addresses on the local machine.
+To switch to between
+.Va [local]
+and
+.Va [remote]
+configuration lines you can specify the stanzas:
+.Dq [local]
+and
+.Dq [remote] .
+.Pp
+On
+.Va [local]
+and
+.Va [remote]
+lines
+.Dq *
+means use the default, or wildcard match.
+In addition, for
+.Va [remote]
+lines
+.Dq =
+means use the values from the matched
+.Va [local]
+configuration line.
+.Pp
+The first four fields,
+.Va location ,
+.Va type ,
+.Va proto ,
+and
+.Va owner
+are used to match the
+.Va [local]
+or
+.Va [remote]
+addresses, whereas the last 3 fields
+.Va name ,
+.Va nfail ,
+and
+.Va disable
+are used to modify the filtering action.
+.Pp
+The first field denotes the
+.Va location
+as an address, mask, and port.
+The syntax for the
+.Va location
+is:
+.Bd -literal -offset indent
+	[<address>|<interface>][/<mask>][:<port>]
+.Ed
+.Pp
+The
+.Dv address
+can be an IPv4 address in numeric format, an IPv6 address
+in numeric format and enclosed by square brackets, or an interface name.
+Mask modifiers are not allowed on interfaces because interfaces
+can have multiple addresses in different protocols where the mask has a
+different size.
+.Pp
+The
+.Dv mask
+is always numeric, but the
+.Dv port
+can be either numeric or symbolic.
+.Pp
+The second field is the socket
+.Va type :
+.Dv stream ,
+.Dv dgram ,
+or numeric.
+The third field is the
+.Va protocol :
+.Dv tcp ,
+.Dv udp ,
+.Dv tcp6 ,
+.Dv udp6 ,
+or numeric.
+The fourth field is the effective user
+.Va ( owner )
+of the daemon process reporting the event,
+either as a username or a userid.
+.Pp
+The rest of the fields control the behavior of the filter.
+.Pp
+The
+.Va name
+field, is the name of the packet filter rule to be used.
+If the
+.Va name
+starts with a hyphen
+.Pq Dq - ,
+then the default rulename is prepended to the given name.
+If the
+.Dv name
+contains a
+.Dq / ,
+the remaining portion of the name is interpreted as the mask to be
+applied to the address specified in the rule, causing a single rule violation to
+block the entire subnet for the configured prefix.
+.Pp
+The
+.Va nfail
+field contains the number of failed attempts before access is blocked,
+defaulting to
+.Dq *
+meaning never, and the last field
+.Va duration
+specifies the amount of time since the last access that the blocking
+rule should be active, defaulting to
+.Dq *
+meaning forever.
+The default unit for
+.Va duration
+is seconds, but one can specify suffixes for different units, such as
+.Dq m
+for minutes
+.Dq h
+for hours and
+.Dq d
+for days.
+.Pp
+Matching is done first by checking the
+.Va [local]
+rules individually, in the order of the most specific to the least specific.
+If a match is found, then the matching
+.Va [remote]
+rules are applied.
+The
+.Va name ,
+.Va nfail ,
+and
+.Va duration
+fields can be altered by the
+.Va [remote]
+rule that matched.
+.Pp
+The
+.Va [remote]
+rules can be used for allowing specific addresses, changing the mask
+size (via
+.Va name ) ,
+the rule that the packet filter uses (also via
+.Va name ) ,
+the number of failed attempts (via
+.Va nfail ) ,
+or the duration to block (via
+.Va duration ) .
+.Sh FILES
+.Bl -tag -width /etc/blocklistd.conf -compact
+.It Pa /etc/blocklistd.conf
+Configuration file.
+.El
+.Sh EXAMPLES
+.Bd -literal -offset 8n
+# Block ssh, after 3 attempts for 6 hours on the bnx0 interface
+[local]
+# location	type	proto	owner	name	nfail	duration
+bnx0:ssh	*	*	*	*	3	6h
+[remote]
+# Never block 1.2.3.4
+1.2.3.4:ssh	*	*	*	*	*	*
+# Never block the example IPv6 subnet either
+[2001:db8::]/32:ssh	*	*	*	*	*	*
+# For addresses coming from 8.8.0.0/16 block whole /24 networks instead
+# individual hosts, but keep the rest of the blocking parameters the same.
+8.8.0.0/16:ssh	*	*	*	/24	=	=
+.Ed
+.Sh SEE ALSO
+.Xr blocklistctl 8 ,
+.Xr blocklistd 8
+.Sh HISTORY
+.Nm
+first appeared in
+.Nx 7 .
+.Fx
+support for
+.Nm
+was implemented in
+.Fx 11 .
+.Sh AUTHORS
+.An Christos Zoulas

contrib/blocklist/bin/conf.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: conf.c,v 1.24 2016/04/04 15:52:56 christos Exp $	*/
+/*	$NetBSD: conf.c,v 1.10 2025/02/11 17:48:30 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: conf.c,v 1.24 2016/04/04 15:52:56 christos Exp $");
+#endif
+__RCSID("$NetBSD: conf.c,v 1.10 2025/02/11 17:48:30 christos Exp $");
 
 #include <stdio.h>
 #ifdef HAVE_LIBUTIL_H
@@ -58,6 +60,7 @@ __RCSID("$NetBSD: conf.c,v 1.24 2016/04/04 15:52:56 christos Exp $");
 #include <net/if.h>
 #include <net/route.h>
 #include <sys/socket.h>
+#include <dirent.h>
 
 #include "bl.h"
 #include "internal.h"
@@ -261,7 +264,7 @@ conf_gethostport(const char *f, size_t l, bool local, struct conf *c,
 		if (debug)
 			(*lfun)(LOG_DEBUG, "%s: host6 %s", __func__, p);
 		if (strcmp(p, "*") != 0) {
-			if (inet_pton(AF_INET6, p, &sin6->sin6_addr) == -1)
+			if (inet_pton(AF_INET6, p, &sin6->sin6_addr) != 1)
 				goto out;
 			sin6->sin6_family = AF_INET6;
 #ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
@@ -269,6 +272,8 @@ conf_gethostport(const char *f, size_t l, bool local, struct conf *c,
 #endif
 			port = &sin6->sin6_port;
 		}
+		if (!*pstr)
+			pstr = "*";
 	} else if (pstr != p || strchr(p, '.') || conf_is_interface(p)) {
 		if (pstr == p)
 			pstr = "*";
@@ -311,7 +316,7 @@ conf_gethostport(const char *f, size_t l, bool local, struct conf *c,
 		*port = htons((in_port_t)c->c_port);
 	return 0;
 out:
-	(*lfun)(LOG_ERR, "%s: %s, %zu: Bad address [%s]", __func__, f, l, pstr);
+	(*lfun)(LOG_ERR, "%s: %s, %zu: Bad address [%s]", __func__, f, l, p);
 	return -1;
 out1:
 	(*lfun)(LOG_ERR, "%s: %s, %zu: Can't specify mask %d with "
@@ -407,6 +412,8 @@ conf_parseline(const char *f, size_t l, char *p, struct conf *c, bool local)
 {
 	int e;
 
+	c->c_lineno = l;
+
 	while (*p && isspace((unsigned char)*p))
 		p++;
 
@@ -471,7 +478,6 @@ conf_amask_eq(const void *v1, const void *v2, size_t len, int mask)
 	uint32_t m;
 	int omask = mask;
 
-	len >>= 2;
 	switch (mask) {
 	case FSTAR:
 		if (memcmp(v1, v2, len) == 0)
@@ -485,7 +491,7 @@ conf_amask_eq(const void *v1, const void *v2, size_t len, int mask)
 		break;
 	}
 
-	for (size_t i = 0; i < len; i++) {
+	for (size_t i = 0; i < (len >> 2); i++) {
 		if (mask > 32) {
 			m = htonl((uint32_t)~0);
 			mask -= 32;
@@ -501,7 +507,6 @@ conf_amask_eq(const void *v1, const void *v2, size_t len, int mask)
 out:
 	if (debug > 1) {
 		char b1[256], b2[256];
-		len <<= 2;
 		blhexdump(b1, sizeof(b1), "a1", v1, len);
 		blhexdump(b2, sizeof(b2), "a2", v2, len);
 		(*lfun)(LOG_DEBUG, "%s: %s != %s [0x%x]", __func__,
@@ -690,6 +695,25 @@ conf_addr_eq(const struct sockaddr_storage *s1,
 
 static int
 conf_eq(const struct conf *c1, const struct conf *c2)
+{
+	if (!conf_addr_eq(&c1->c_ss, &c2->c_ss, FSTAR))
+		return 0;
+
+#define	CMP(a, b, f) \
+	if ((a)->f != (b)->f) \
+		return 0;
+
+	CMP(c1, c2, c_port);
+	CMP(c1, c2, c_proto);
+	CMP(c1, c2, c_family);
+	CMP(c1, c2, c_uid);
+#undef CMP
+
+	return 1;
+}
+
+static int
+conf_match(const struct conf *c1, const struct conf *c2)
 {
 
 	if (!conf_addr_eq(&c1->c_ss, &c2->c_ss, c2->c_lmask))
@@ -953,13 +977,54 @@ confset_free(struct confset *cs)
 }
 
 static void
-confset_replace(struct confset *dc, struct confset *sc)
+confset_merge(struct confset *dc, struct confset *sc)
 {
-	struct confset tc;
-	tc = *dc;
-	*dc = *sc;
-	confset_init(sc);
-	confset_free(&tc);
+	size_t i, j;
+	char buf[BUFSIZ];
+
+	/* Check each rule of the src confset (sc) */
+	for (i = 0; i < sc->cs_n; i++) {
+		/* Compare to each rule in the dest confset (dc) */
+		for (j = 0; j < dc->cs_n; j++) {
+			if (conf_eq(&dc->cs_c[j], &sc->cs_c[i])) {
+				break;
+			}
+		}
+
+		if (j == dc->cs_n) {
+			/* This is a new rule to add to the dest confset. */
+			if (confset_full(dc) && confset_grow(dc) == -1)
+				return;
+
+			*confset_get(dc) = sc->cs_c[i];
+			confset_add(dc);
+			continue;
+		}
+
+		/* We had a match above. */
+		/*
+		 * Check whether the rule from the src confset is more
+		 * restrictive than the existing one. Adjust the
+		 * existing rule if necessary.
+		 */
+		if (sc->cs_c[i].c_nfail == dc->cs_c[j].c_nfail &&
+		    sc->cs_c[i].c_duration && dc->cs_c[j].c_duration) {
+			(*lfun)(LOG_DEBUG, "skipping existing rule: %s",
+			conf_print(buf, sizeof (buf), "", "\t", &sc->cs_c[i]));
+			continue;
+		}
+
+		if (sc->cs_c[i].c_nfail < dc->cs_c[j].c_nfail)
+			dc->cs_c[j].c_nfail = sc->cs_c[i].c_nfail;
+
+		if (sc->cs_c[i].c_duration > dc->cs_c[j].c_duration)
+			dc->cs_c[j].c_duration = sc->cs_c[i].c_duration;
+
+		(*lfun)(LOG_DEBUG, "adjusted existing rule: %s",
+		    conf_print(buf, sizeof (buf), "", "\t", &dc->cs_c[j]));
+	}
+
+	confset_free(sc);
 }
 
 static void
@@ -990,7 +1055,7 @@ confset_match(const struct confset *cs, struct conf *c,
 		if (debug)
 			(*lfun)(LOG_DEBUG, "%s", conf_print(buf, sizeof(buf),
 			    "check:\t", "", &cs->cs_c[i]));
-		if (conf_eq(c, &cs->cs_c[i])) {
+		if (conf_match(c, &cs->cs_c[i])) {
 			if (debug)
 				(*lfun)(LOG_DEBUG, "%s",
 				    conf_print(buf, sizeof(buf),
@@ -1160,21 +1225,14 @@ conf_find(int fd, uid_t uid, const struct sockaddr_storage *rss,
 	return cr;
 }
 
-
-void
-conf_parse(const char *f)
+static void
+conf_parsefile(FILE *fp, const char *config_file)
 {
-	FILE *fp;
 	char *line;
 	size_t lineno, len;
 	struct confset lc, rc, *cs;
 
-	if ((fp = fopen(f, "r")) == NULL) {
-		(*lfun)(LOG_ERR, "%s: Cannot open `%s' (%m)", __func__, f);
-		return;
-	}
-
-	lineno = 1;
+	lineno = 0;
 
 	confset_init(&rc);
 	confset_init(&lc);
@@ -1197,23 +1255,103 @@ conf_parse(const char *f)
 			if (confset_grow(cs) == -1) {
 				confset_free(&lc);
 				confset_free(&rc);
-				fclose(fp);
 				free(line);
 				return;
 			}
 		}
-		if (conf_parseline(f, lineno, line, confset_get(cs),
+		if (conf_parseline(config_file, lineno, line, confset_get(cs),
 		    cs == &lc) == -1)
 			continue;
 		confset_add(cs);
 	}
 
-	fclose(fp);
-	confset_sort(&lc);
-	confset_sort(&rc);
+	confset_merge(&rconf, &rc);
+	confset_merge(&lconf, &lc);
+}
 
-	confset_replace(&rconf, &rc);
-	confset_replace(&lconf, &lc);
+
+static void
+conf_parsedir(DIR *dir, const char *config_path)
+{
+	long path_max;
+	struct dirent *dent;
+	char *path;
+	FILE *fp;
+
+	if ((path_max = pathconf(config_path, _PC_PATH_MAX)) == -1)
+		path_max = 2048;
+
+	if ((path = malloc((size_t)path_max)) == NULL) {
+		(*lfun)(LOG_ERR, "%s: Failed to allocate memory for path (%m)",
+		    __func__);
+		return;
+	}
+
+	while ((dent = readdir(dir)) != NULL) {
+		if (strcmp(dent->d_name, ".") == 0 ||
+		    strcmp(dent->d_name, "..") == 0)
+			continue;
+
+		(void) snprintf(path, (size_t)path_max, "%s/%s", config_path,
+		    dent->d_name);
+		if ((fp = fopen(path, "r")) == NULL) {
+			(*lfun)(LOG_ERR, "%s: Cannot open `%s' (%m)", __func__,
+			    path);
+			continue;
+		}
+		conf_parsefile(fp, path);
+		fclose(fp);
+	}
+
+	free(path);
+}
+
+void
+conf_parse(const char *config_path)
+{
+	char *path;
+	DIR *dir;
+	FILE *fp;
+
+	if ((dir = opendir(config_path)) != NULL) {
+		/*
+		 * If config_path is a directory, parse the configuration files
+		 * in the directory. Then we're done here.
+		 */
+		conf_parsedir(dir, config_path);
+		closedir(dir);
+		goto out;
+	} else if ((fp = fopen(config_path, "r")) != NULL) {
+		/* If config_path is a file, parse it. */
+		conf_parsefile(fp, config_path);
+		fclose(fp);
+	}
+
+	/*
+	 * Append ".d" to config_path, and if that is a directory, parse the
+	 * configuration files in the directory.
+	 */
+	if (asprintf(&path, "%s.d", config_path) < 0) {
+		(*lfun)(LOG_ERR, "%s: Failed to allocate memory for path (%m)",
+		    __func__);
+		goto out;
+	}
+
+	if ((dir = opendir(path)) != NULL) {
+		conf_parsedir(dir, path);
+		closedir(dir);
+	}
+	free(path);
+
+out:
+	if (dir == NULL && fp == NULL) {
+		(*lfun)(LOG_ERR, "%s: Cannot open `%s' (%m)", __func__,
+		    config_path);
+		return;
+	}
+
+	confset_sort(&lconf);
+	confset_sort(&rconf);
 
 	if (debug) {
 		confset_list(&lconf, "local", "target");

contrib/blocklist/bin/conf.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: conf.h,v 1.6 2015/01/27 19:40:36 christos Exp $	*/
+/*	$NetBSD: conf.h,v 1.2 2025/02/05 20:09:33 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -34,6 +34,7 @@
 #include <sys/socket.h>
 
 struct conf {
+	size_t			c_lineno;
 	struct sockaddr_storage	c_ss;
 	int			c_lmask;
 	int			c_port;

contrib/blocklist/bin/internal.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: internal.c,v 1.5 2015/01/27 19:40:37 christos Exp $	*/
+/*	$NetBSD: internal.c,v 1.2 2025/02/11 17:48:30 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: internal.c,v 1.5 2015/01/27 19:40:37 christos Exp $");
+#endif
+__RCSID("$NetBSD: internal.c,v 1.2 2025/02/11 17:48:30 christos Exp $");
 
 #include <stdio.h>
 #include <syslog.h>
@@ -41,7 +43,7 @@ __RCSID("$NetBSD: internal.c,v 1.5 2015/01/27 19:40:37 christos Exp $");
 #include "internal.h"
 
 int debug;
-const char *rulename = "blacklistd";
+const char *rulename = "blocklistd";
 const char *controlprog = _PATH_BLCONTROL;
 struct confset lconf, rconf;
 struct ifaddrs *ifas;

contrib/blocklist/bin/internal.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: internal.h,v 1.14 2016/04/04 15:52:56 christos Exp $	*/
+/*	$NetBSD: internal.h,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,13 +32,13 @@
 #define _INTERNAL_H
 
 #ifndef _PATH_BLCONF
-#define	_PATH_BLCONF	"/etc/blacklistd.conf"
+#define	_PATH_BLCONF	"/etc/blocklistd.conf"
 #endif
 #ifndef _PATH_BLCONTROL
-#define	_PATH_BLCONTROL	"/libexec/blacklistd-helper"
+#define	_PATH_BLCONTROL	"/usr/libexec/blocklistd-helper"
 #endif
 #ifndef _PATH_BLSTATE
-#define	_PATH_BLSTATE	"/var/db/blacklistd.db"
+#define	_PATH_BLSTATE	"/var/db/blocklistd.db"
 #endif
 
 extern struct confset rconf, lconf;

contrib/blocklist/bin/old_internal.c

@@ -0,0 +1,50 @@
+/*	$NetBSD: internal.c,v 1.2 2025/02/11 17:48:30 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2015 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef HAVE_SYS_CDEFS_H
+#include <sys/cdefs.h>
+#endif
+__RCSID("$NetBSD: internal.c,v 1.2 2025/02/11 17:48:30 christos Exp $");
+
+#include <stdio.h>
+#include <syslog.h>
+#include "conf.h"
+#include "old_internal.h"
+
+int debug;
+const char *rulename = "blacklistd";
+const char *controlprog = _PATH_BLCONTROL;
+struct confset lconf, rconf;
+struct ifaddrs *ifas;
+void (*lfun)(int, const char *, ...) = syslog;

contrib/blocklist/bin/old_internal.h

@@ -0,0 +1,58 @@
+/*	$NetBSD: internal.h,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2015 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef _OLD_INTERNAL_H
+#define _OLD_INTERNAL_H
+
+#ifndef _PATH_BLCONF
+#define	_PATH_BLCONF	"/etc/blacklistd.conf"
+#endif
+#ifndef _PATH_BLCONTROL
+#define	_PATH_BLCONTROL	"/usr/libexec/blacklistd-helper"
+#endif
+#ifndef _PATH_BLSTATE
+/* We want the new name, the old one would be incompatible after 24932b6 */
+#define	_PATH_BLSTATE	"/var/db/blocklistd.db"
+#endif
+
+extern struct confset rconf, lconf;
+extern int debug;
+extern const char *rulename;
+extern const char *controlprog;
+extern struct ifaddrs *ifas;
+
+#if !defined(__syslog_attribute__) && !defined(__syslog__)
+#define __syslog__ __printf__
+#endif
+
+extern void (*lfun)(int, const char *, ...)
+    __attribute__((__format__(__syslog__, 2, 3)));
+
+#endif /* _OLD_INTERNAL_H */

contrib/blocklist/bin/run.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: run.c,v 1.14 2016/04/04 15:52:56 christos Exp $	*/
+/*	$NetBSD: run.c,v 1.3 2025/02/11 17:48:30 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: run.c,v 1.14 2016/04/04 15:52:56 christos Exp $");
+#endif
+__RCSID("$NetBSD: run.c,v 1.3 2025/02/11 17:48:30 christos Exp $");
 
 #include <stdio.h>
 #ifdef HAVE_LIBUTIL_H
@@ -131,7 +133,8 @@ run_change(const char *how, const struct conf *c, char *id, size_t len)
 		prname = "udp";
 		break;
 	default:
-		(*lfun)(LOG_ERR, "%s: bad protocol %d", __func__, c->c_proto);
+		(*lfun)(LOG_ERR, "%s: bad protocol %d (line %zu)", __func__,
+		     c->c_proto, c->c_lineno);
 		return -1;
 	}
 

contrib/blocklist/bin/run.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: run.h,v 1.5 2015/01/27 19:40:37 christos Exp $	*/
+/*	$NetBSD: run.h,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.

contrib/blocklist/bin/state.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: state.c,v 1.19 2016/09/26 19:43:43 christos Exp $	*/
+/*	$NetBSD: state.c,v 1.3 2025/10/25 18:43:51 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: state.c,v 1.19 2016/09/26 19:43:43 christos Exp $");
+#endif
+__RCSID("$NetBSD: state.c,v 1.3 2025/10/25 18:43:51 christos Exp $");
 
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -129,7 +131,7 @@ state_del(DB *db, const struct conf *c)
 			(*lfun)(LOG_DEBUG, "%s: returns %d", __func__, rv);
 			(*db->sync)(db, 0);
 		}
-		return 0;
+		return rv;
 	default:
 		(*lfun)(LOG_ERR, "%s: failed (%m)", __func__);
 		return -1;

contrib/blocklist/bin/state.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: state.h,v 1.5 2015/01/27 19:40:37 christos Exp $	*/
+/*	$NetBSD: state.h,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.

contrib/blocklist/bin/support.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: support.c,v 1.9 2018/09/18 22:12:19 christos Exp $	*/
+/*	$NetBSD: support.c,v 1.3 2025/02/11 17:48:30 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: support.c,v 1.9 2018/09/18 22:12:19 christos Exp $");
+#endif
+__RCSID("$NetBSD: support.c,v 1.3 2025/02/11 17:48:30 christos Exp $");
 
 #include <time.h>
 #include <string.h>
@@ -66,7 +68,8 @@ expandm(char *buf, size_t len, const char *fmt)
 }
 
 void
-vdlog(int level __unused, const char *fmt, va_list ap)
+vdlog(int level __unused, struct syslog_data *sd __unused,
+    const char *fmt, va_list ap)
 {
 	char buf[BUFSIZ];
 
@@ -81,7 +84,7 @@ dlog(int level, const char *fmt, ...)
 	va_list ap;
 
 	va_start(ap, fmt);
-	vdlog(level, fmt, ap);
+	vdlog(level, NULL, fmt, ap);
 	va_end(ap);
 }
 

contrib/blocklist/bin/support.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: support.h,v 1.7 2016/04/04 15:52:56 christos Exp $	*/
+/*	$NetBSD: support.h,v 1.2 2024/08/02 17:11:55 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -34,8 +34,9 @@
 __BEGIN_DECLS
 const char *fmttime(char *, size_t, time_t);
 const char *fmtydhms(char *, size_t, time_t);
-void vdlog(int, const char *, va_list)
-    __attribute__((__format__(__printf__, 2, 0)));
+struct syslog_data;
+void vdlog(int, struct syslog_data *, const char *, va_list)
+    __attribute__((__format__(__printf__, 3, 0)));
 void dlog(int, const char *, ...)
     __attribute__((__format__(__printf__, 2, 3)));
 ssize_t blhexdump(char *, size_t, const char *, const void *, size_t);

contrib/blocklist/diff/ftpd.diff

@@ -2,17 +2,17 @@
 +++ pfilter.c	2015-01-23 17:12:02.000000000 -0500
 @@ -0,0 +1,24 @@
 +#include <stdio.h>
-+#include <blacklist.h>
++#include <blocklist.h>
 +
 +#include "pfilter.h"
 +
-+static struct blacklist *blstate;
++static struct blocklist *blstate;
 +
 +void
 +pfilter_open(void)
 +{
 +	if (blstate == NULL)
-+		blstate = blacklist_open();
++		blstate = blocklist_open();
 +}
 +
 +void
@@ -23,7 +23,7 @@
 +	if (blstate == NULL)
 +		return;
 +
-+	blacklist_r(blstate, what, 0, msg);
++	blocklist_r(blstate, what, 0, msg);
 +}
 --- /dev/null	2015-01-23 17:30:40.000000000 -0500
 +++ pfilter.h	2015-01-23 17:07:25.000000000 -0500
@@ -42,8 +42,8 @@ diff -u -p -u -r1.63 Makefile
  MLINKS=	ftpusers.5 ftpchroot.5
  
 +SRCS+=	pfilter.c
-+LDADD+=	-lblacklist
-+DPADD+=	${LIBBLACKLIST}
++LDADD+=	-lblocklist
++DPADD+=	${LIBBLOCKLIST}
 +
  .if defined(NO_INTERNAL_LS)
  CPPFLAGS+=-DNO_INTERNAL_LS

contrib/blocklist/diff/named.diff

@@ -8,17 +8,17 @@
 +#include <named/types.h>
 +#include <named/client.h>
 +
-+#include <blacklist.h>
++#include <blocklist.h>
 +
 +#include "pfilter.h"
 +
-+static struct blacklist *blstate;
++static struct blocklist *blstate;
 +
 +void
 +pfilter_open(void)
 +{
 +	if (blstate == NULL)
-+		blstate = blacklist_open();
++		blstate = blocklist_open();
 +}
 +
 +#define TCP_CLIENT(c)  (((c)->attributes & NS_CLIENTATTR_TCP) != 0)
@@ -39,7 +39,7 @@
 +	}
 +	if (socket == NULL)
 +		return;
-+	blacklist_sa_r(blstate, 
++	blocklist_sa_r(blstate, 
 +	    res != ISC_R_SUCCESS, isc_socket_getfd(socket),
 +	    &client->peeraddr.type.sa, client->peeraddr.length, msg);
 +}
@@ -63,8 +63,8 @@ diff -u -u -r1.8 Makefile
 +	pfilter.c tkeyconf.c tsigconf.c \
  	update.c xfrout.c zoneconf.c ${SRCS_UNIX}
  
-+LDADD+=-lblacklist
-+DPADD+=${LIBBLACKLIST}
++LDADD+=-lblocklist
++DPADD+=${LIBBLOCKLIST}
  .include <bsd.prog.mk>
 Index: dist/bin/named/client.c
 ===================================================================

contrib/blocklist/diff/postfix.diff

@@ -0,0 +1,98 @@
+Index: dist/src/smtpd/pfilter.c
+===================================================================
+RCS file: dist/src/smtpd/pfilter.c
+diff -N dist/src/smtpd/pfilter.c
+--- /dev/null	1 Jan 1970 00:00:00 -0000
++++ dist/src/smtpd/pfilter.c	1 Feb 2018 03:29:09 -0000
+@@ -0,0 +1,19 @@
++#include "pfilter.h"
++#include <stdio.h>	/* for NULL */
++#include <blocklist.h>
++
++static struct blocklist *blstate;
++
++void
++pfilter_notify(int a, int fd)
++{
++	if (blstate == NULL)
++		blstate = blocklist_open();
++	if (blstate == NULL)
++		return;
++	(void)blocklist_r(blstate, a, fd, "smtpd");
++	if (a == 0) {
++		blocklist_close(blstate);
++		blstate = NULL;
++	}
++}
+Index: dist/src/smtpd/pfilter.h
+===================================================================
+RCS file: dist/src/smtpd/pfilter.h
+diff -N dist/src/smtpd/pfilter.h
+--- /dev/null	1 Jan 1970 00:00:00 -0000
++++ dist/src/smtpd/pfilter.h	1 Feb 2018 03:29:09 -0000
+@@ -0,0 +1,2 @@
++
++void pfilter_notify(int, int);
+Index: dist/src/smtpd/smtpd.c
+===================================================================
+RCS file: /cvsroot/src/external/ibm-public/postfix/dist/src/smtpd/smtpd.c,v
+retrieving revision 1.14
+diff -u -r1.14 smtpd.c
+--- dist/src/smtpd/smtpd.c	14 Feb 2017 01:16:48 -0000	1.14
++++ dist/src/smtpd/smtpd.c	1 Feb 2018 03:29:09 -0000
+@@ -1197,6 +1197,8 @@
+ #include <smtpd_milter.h>
+ #include <smtpd_expand.h>
+ 
++#include "pfilter.h"
++
+  /*
+   * Tunable parameters. Make sure that there is some bound on the length of
+   * an SMTP command, so that the mail system stays in control even when a
+@@ -5048,6 +5050,7 @@
+ 	    if (state->error_count >= var_smtpd_hard_erlim) {
+ 		state->reason = REASON_ERROR_LIMIT;
+ 		state->error_mask |= MAIL_ERROR_PROTOCOL;
++		pfilter_notify(1, vstream_fileno(state->client));
+ 		smtpd_chat_reply(state, "421 4.7.0 %s Error: too many errors",
+ 				 var_myhostname);
+ 		break;
+Index: libexec/smtpd/Makefile
+===================================================================
+RCS file: /cvsroot/src/external/ibm-public/postfix/libexec/smtpd/Makefile,v
+retrieving revision 1.6
+diff -u -r1.6 Makefile
+--- libexec/smtpd/Makefile	21 May 2017 15:28:40 -0000	1.6
++++ libexec/smtpd/Makefile	1 Feb 2018 03:29:09 -0000
+@@ -13,11 +13,14 @@
+ SRCS=	smtpd.c smtpd_token.c smtpd_check.c smtpd_chat.c smtpd_state.c \
+ 	smtpd_peer.c smtpd_sasl_proto.c smtpd_sasl_glue.c smtpd_proxy.c \
+ 	smtpd_xforward.c smtpd_dsn_fix.c smtpd_milter.c smtpd_resolve.c \
+-	smtpd_expand.c smtpd_haproxy.c
++	smtpd_expand.c smtpd_haproxy.c pfilter.c
+ 
+ DPADD+= ${LIBPMASTER} ${LIBPMILTER} ${LIBPGLOBAL} ${LIBPDNS} ${LIBPXSASL}
+ LDADD+= ${LIBPMASTER} ${LIBPMILTER} ${LIBPGLOBAL} ${LIBPDNS} ${LIBPXSASL}
+ 
++DPADD+=	${LIBBLOCKLIST}
++LDADD+=	-lblocklist
++
+ DPADD+=	${LIBPTLS} ${LIBSSL} ${LIBCRYPTO}
+ LDADD+=	${LIBPTLS} -lssl -lcrypto
+ 
+Index: dist/src/smtpd/smtpd.c
+===================================================================
+RCS file: /cvsroot/src/external/ibm-public/postfix/dist/src/smtpd/smtpd.c,v
+retrieving revision 1.17
+diff -u -u -r1.17 smtpd.c
+--- dist/src/smtpd/smtpd.c	18 Mar 2020 19:05:20 -0000	1.17
++++ dist/src/smtpd/smtpd.c	25 Sep 2020 12:51:52 -0000
+@@ -5795,6 +5795,8 @@
+ 		   || strcmp(state->reason, REASON_LOST_CONNECTION)) {
+ 	    msg_info("%s after %s from %s",
+ 		     state->reason, state->where, state->namaddr);
++	    if (strcmp(state->where, SMTPD_CMD_AUTH) == 0)
++		pfilter_notify(1, vstream_fileno(state->client));
+ 	}
+     }
+ 

contrib/blocklist/diff/proftpd.diff

@@ -1,12 +1,12 @@
 --- Make.rules.in.orig	2015-05-27 20:25:54.000000000 -0400
 +++ Make.rules.in	2016-01-25 21:48:47.000000000 -0500
 @@ -110,3 +110,8 @@
-
+ 
  FTPWHO_OBJS=ftpwho.o scoreboard.o misc.o
  BUILD_FTPWHO_OBJS=utils/ftpwho.o utils/scoreboard.o utils/misc.o
 +
-+CPPFLAGS+=-DHAVE_BLACKLIST
-+LIBS+=-lblacklist
++CPPFLAGS+=-DHAVE_BLOCKLIST
++LIBS+=-lblocklist
 +OBJS+= pfilter.o
 +BUILD_OBJS+= src/pfilter.o
 --- /dev/null	2016-01-22 17:30:55.000000000 -0500
@@ -84,25 +84,25 @@
 +#include "pfilter.h"
 +#include "conf.h"
 +#include "privs.h"
-+#ifdef HAVE_BLACKLIST
-+#include <blacklist.h>
++#ifdef HAVE_BLOCKLIST
++#include <blocklist.h>
 +#endif
 +
-+static struct blacklist *blstate;
++static struct blocklist *blstate;
 +
 +void
 +pfilter_init(void)
 +{
-+#ifdef HAVE_BLACKLIST
++#ifdef HAVE_BLOCKLIST
 +	if (blstate == NULL)
-+		blstate = blacklist_open();
++		blstate = blocklist_open();
 +#endif
 +}
 +
 +void
 +pfilter_notify(int a)
 +{
-+#ifdef HAVE_BLACKLIST
++#ifdef HAVE_BLOCKLIST
 +	conn_t *c = session.c;
 +	int fd;
 +
@@ -119,6 +119,6 @@
 +		pfilter_init();
 +	if (blstate == NULL)
 +		return;
-+	(void)blacklist_r(blstate, a, fd, "proftpd");
++	(void)blocklist_r(blstate, a, fd, "proftpd");
 +#endif
 +}

contrib/blocklist/diff/ssh.diff

@@ -7,14 +7,14 @@
 +#include "packet.h"
 +#include "log.h"
 +#include "pfilter.h"
-+#include <blacklist.h>
++#include <blocklist.h>
 +
-+static struct blacklist *blstate;
++static struct blocklist *blstate;
 +
 +void
 +pfilter_init(void)
 +{
-+	blstate = blacklist_open();
++	blstate = blocklist_open();
 +}
 +
 +void
@@ -27,9 +27,9 @@
 +		return;
 +	// XXX: 3?
 + 	fd = packet_connection_is_on_socket() ? packet_get_connection_in() : 3;
-+	(void)blacklist_r(blstate, a, fd, "ssh");
++	(void)blocklist_r(blstate, a, fd, "ssh");
 +	if (a == 0) {
-+		blacklist_close(blstate);
++		blocklist_close(blstate);
 +		blstate = NULL;
 +	}
 +}
@@ -60,8 +60,8 @@ diff -u -u -r1.10 Makefile
  LDADD+=	-lwrap
  DPADD+=	${LIBWRAP}
 +
-+LDADD+=	-lblacklist
-+DPADD+=	${LIBBLACKLIST}
++LDADD+=	-lblocklist
++DPADD+=	${LIBBLOCKLIST}
 diff -ru openssh-7.7p1/auth-pam.c dist/auth-pam.c
 --- openssh-7.7p1/auth-pam.c	2018-04-02 01:38:28.000000000 -0400
 +++ dist/auth-pam.c	2018-05-23 11:56:22.206661484 -0400

contrib/blocklist/etc/Makefile

@@ -1,10 +1,10 @@
-#	$NetBSD: Makefile,v 1.3 2015/01/26 00:18:40 christos Exp $
+#	$NetBSD: Makefile,v 1.2 2025/02/05 20:24:26 christos Exp $
 
-SUBDIR=rc.d
+SUBDIR=		rc.d
 
-FILESDIR=               /usr/share/examples/blacklist
-FILESMODE=    644
-FILES=	blacklistd.conf npf.conf
+FILESDIR=	/usr/share/examples/blocklist
+FILESMODE=	644
+FILES=		blocklistd.conf ipf.conf npf.conf
 
 .include <bsd.files.mk>
 .include <bsd.subdir.mk>

contrib/blocklist/etc/blocklistd.conf

@@ -1,5 +1,5 @@
-# Blacklist rule
-# adr/mask:port	type	proto	owner		name	nfail	disable
+# Blocklist rule
+# adr/mask:port	type	proto	owner		name	nfail	duration
 [local]
 ssh		stream	*	*		*	3	6h
 ftp		stream	*	*		*	3	6h
@@ -7,8 +7,9 @@ domain		*	*	named		*	3	12h
 #6161		stream	tcp6	christos	*	2	10m
 *		*	*	*		*	3	60
 
-# adr/mask:port	type	proto	owner		name	nfail	disable
+# adr/mask:port	type	proto	owner		name	nfail	duration
 [remote]
 #129.168.0.0/16	*	*	*		=	*	*
+#[2001:db8::]/32:ssh	*	*	*		=	*	*
 #6161		=	=	=		=/24	=	=
 #*		stream	tcp	*		=	=	=

contrib/blocklist/etc/ipf.conf

@@ -0,0 +1,45 @@
+#========================================
+#
+#	subsection for abuse blocking
+#
+#========================================
+#
+# This section should be included early in the main /etc/ipf.conf file, right
+# after any basic generic accounting ("count") rules, and any cleanup rules to
+# block invalid fragments, invalid options (e.g. "ssrr"), etc.
+#
+# Note these will not actually block anything since they don't include the
+# "quick" flag, and are thus part of a last-match group.  They simply set up a
+# group such that any connection logging rule further below won't also match if
+# one of the rules in the group matches, no matter when or where the subsequent
+# matching rule is added.  I.e. all rules in the group are checked for a match
+# (and a possible "first match" with "quick") before any subsequent rules
+# further below are used.  Note group rules can be added at any time, including
+# at runtime after all other rules have been added -- they will still belong to
+# the group and once added will be checked as part of the group.
+#
+#	head of "blocklistd" group:
+#
+# The "blocklistd" group will be used by blocklistd(8).
+#
+block in proto tcp/udp from any to any head blocklistd
+#
+#	head of "attackers" group to block all attackers:
+#
+# The "attackers" group is intended to be used for manually maintained rules
+# e.g. as could be added like this:
+#
+#	echo 'block return-rst in log quick proto tcp from 118.136.0.0/15 to any flags S/SAFR group attackers' >> /etc/ipf.conf
+#	/etc/rc.d/ipfliter reload
+#
+# Note the choice in this example is to return RST packets for blocked SYN
+# packets to help the other end close.  This is not necessary, but it better
+# mimics what the kernel does by default, thus perhaps hiding the fact a
+# firewall is present.
+#
+# XXX This example still allows UDP services, but we would need to duplicate
+# each rule with "proto udp" (and without "flags blah") due to IPF parsing
+# limitations....
+#
+block in proto tcp/udp from any to any head attackers
+#

contrib/blocklist/etc/npf.conf

@@ -1,4 +1,4 @@
-# Transparent firewall example for blacklistd
+# Transparent firewall example for blocklistd
 
 $ext_if = "bnx0"
 
@@ -6,7 +6,7 @@ set bpf.jit on;
 alg "icmp"
 
 group "external" on $ext_if {
-	ruleset "blacklistd"
+	ruleset "blocklistd"
 	pass final all
 }
 

contrib/blocklist/etc/rc.d/Makefile

@@ -1,6 +1,6 @@
-#	$NetBSD: Makefile,v 1.1 2015/01/22 17:49:41 christos Exp $
+#	$NetBSD: Makefile,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $
 
-SCRIPTS=blacklistd
+SCRIPTS=blocklistd
 SCRIPTSDIR=/etc/rc.d
 
 .include <bsd.prog.mk>

contrib/blocklist/etc/rc.d/blocklistd

@@ -1,15 +1,15 @@
 #!/bin/sh
 #
-# $NetBSD: blacklistd,v 1.2 2016/10/17 22:47:16 christos Exp $
+# $NetBSD: blocklistd,v 1.2 2021/03/07 00:46:39 christos Exp $
 #
 
-# PROVIDE: blacklistd
-# REQUIRE: npf
+# PROVIDE: blocklistd
+# REQUIRE: npf pf ipfilter
 # BEFORE:  SERVERS
 
 $_rc_subr_loaded . /etc/rc.subr
 
-name="blacklistd"
+name="blocklistd"
 rcvar=$name
 command="/sbin/${name}"
 pidfile="/var/run/${name}.pid"
@@ -18,17 +18,17 @@ start_precmd="${name}_precmd"
 extra_commands="reload"
 
 _sockfile="/var/run/${name}.sockets"
-_sockname="blacklistd.sock"
+_sockname="blocklistd.sock"
 
-blacklistd_precmd()
+blocklistd_precmd()
 {
-	#	Create default list of blacklistd sockets to watch
+	#	Create default list of blocklistd sockets to watch
 	#
 	( umask 022 ; > $_sockfile )
 
 	#	Find /etc/rc.d scripts with "chrootdir" rcorder(8) keyword,
 	#	and if $${app}_chrootdir is a directory, add appropriate
-	#	blacklistd socket to list of sockets to watch.
+	#	blocklistd socket to list of sockets to watch.
 	#
 	for _lr in $(rcorder -k chrootdir /etc/rc.d/*); do
 	    (
@@ -42,8 +42,8 @@ blacklistd_precmd()
 	done
 
 	#	If other sockets have been provided, change run_rc_command()'s
-	#	internal copy of $blacklistd_flags to force use of specific
-	#	blacklistd sockets.
+	#	internal copy of $blocklistd_flags to force use of specific
+	#	blocklistd sockets.
 	#
 	if [ -s $_sockfile ]; then
 		echo "/var/run/${_sockname}" >> $_sockfile

contrib/blocklist/include/Makefile

@@ -1,10 +1,10 @@
-#	$NetBSD: Makefile,v 1.1 2015/01/21 16:16:00 christos Exp $
+#	$NetBSD: Makefile,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $
 
 # Doing a make includes builds /usr/include
 
 NOOBJ=		# defined
 
-INCS=	blacklist.h
+INCS=	blocklist.h
 INCSDIR=	/usr/include
 
 .include <bsd.prog.mk>

contrib/blocklist/include/bl.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: bl.h,v 1.13 2016/03/11 17:16:40 christos Exp $	*/
+/*	$NetBSD: bl.h,v 1.2 2024/08/02 17:11:55 christos Exp $	*/
 
 /*-
  * Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -35,7 +35,7 @@
 #include <stdarg.h>
 #include <sys/param.h>
 #include <sys/socket.h>
-#include "blacklist.h"
+#include "blocklist.h"
 
 typedef enum {
 	BL_INVALID,
@@ -58,14 +58,15 @@ typedef struct {
 #define bi_cred bi_u._bi_cred
 
 #ifndef _PATH_BLSOCK
-#define _PATH_BLSOCK "/var/run/blacklistd.sock"
+#define _PATH_BLSOCK "/var/run/blocklistd.sock"
 #endif
 
 __BEGIN_DECLS
 
-typedef struct blacklist *bl_t;
+typedef struct blocklist *bl_t;
 
-bl_t bl_create(bool, const char *, void (*)(int, const char *, va_list));
+bl_t bl_create(bool, const char *,
+    void (*)(int, struct syslog_data *, const char *, va_list));
 void bl_destroy(bl_t);
 int bl_send(bl_t, bl_type_t, int, const struct sockaddr *, socklen_t,
     const char *);

contrib/blocklist/include/blacklist.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: blacklist.h,v 1.3 2015/01/23 18:48:56 christos Exp $	*/
+/*	$NetBSD: blocklist.h,v 1.4 2025/02/11 17:42:17 christos Exp $	*/
 
 /*-
  * Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -32,16 +32,26 @@
 #define _BLACKLIST_H
 
 #include <sys/socket.h>
+#include <syslog.h>
 
-__BEGIN_DECLS
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+struct syslog_data;
 struct blacklist *blacklist_open(void);
+struct blacklist *blacklist_open2(
+    void (*)(int, struct syslog_data *, const char *, va_list));
 void blacklist_close(struct blacklist *);
 int blacklist(int, int, const char *);
 int blacklist_r(struct blacklist *, int, int, const char *);
 int blacklist_sa(int, int, const struct sockaddr *, socklen_t, const char *);
 int blacklist_sa_r(struct blacklist *, int, int,
     const struct sockaddr *, socklen_t, const char *);
-__END_DECLS
+
+#if defined(__cplusplus)
+}
+#endif
 
 /* action values for user applications */
 #define BLACKLIST_API_ENUM	1

contrib/blocklist/include/blocklist.h

@@ -0,0 +1,65 @@
+/*	$NetBSD: blocklist.h,v 1.4 2025/02/11 17:42:17 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2014 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef _BLOCKLIST_H
+#define _BLOCKLIST_H
+
+#include <sys/socket.h>
+#include <syslog.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+struct syslog_data;
+struct blocklist *blocklist_open(void);
+struct blocklist *blocklist_open2(
+    void (*)(int, struct syslog_data *, const char *, va_list));
+void blocklist_close(struct blocklist *);
+int blocklist(int, int, const char *);
+int blocklist_r(struct blocklist *, int, int, const char *);
+int blocklist_sa(int, int, const struct sockaddr *, socklen_t, const char *);
+int blocklist_sa_r(struct blocklist *, int, int,
+    const struct sockaddr *, socklen_t, const char *);
+
+#if defined(__cplusplus)
+}
+#endif
+
+/* action values for user applications */
+#define BLOCKLIST_API_ENUM	1
+enum {
+        BLOCKLIST_AUTH_OK = 0,
+        BLOCKLIST_AUTH_FAIL,
+        BLOCKLIST_ABUSIVE_BEHAVIOR,
+        BLOCKLIST_BAD_USER
+};
+
+#endif /* _BLOCKLIST_H */

contrib/blocklist/include/old_bl.h

@@ -0,0 +1,80 @@
+/*	$NetBSD: bl.h,v 1.2 2024/08/02 17:11:55 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2014 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef _OLD_BL_H
+#define _OLD_BL_H
+
+#include <stdbool.h>
+#include <stdarg.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include "blacklist.h"
+
+typedef enum {
+	BL_INVALID,
+	BL_ADD,
+	BL_DELETE,
+	BL_ABUSE,
+	BL_BADUSER
+} bl_type_t;
+
+typedef struct {
+	bl_type_t bi_type;
+	int bi_fd;
+	uid_t bi_uid;
+	gid_t bi_gid;
+	socklen_t bi_slen;
+	struct sockaddr_storage bi_ss;
+	char bi_msg[1024];
+} bl_info_t;
+
+#define bi_cred bi_u._bi_cred
+
+/* We want the new name */
+#ifndef _PATH_BLSOCK
+#define _PATH_BLSOCK "/var/run/blocklistd.sock"
+#endif
+
+__BEGIN_DECLS
+
+typedef struct blacklist *bl_t;
+
+bl_t bl_create(bool, const char *,
+    void (*)(int, struct syslog_data *, const char *, va_list));
+void bl_destroy(bl_t);
+int bl_send(bl_t, bl_type_t, int, const struct sockaddr *, socklen_t,
+    const char *);
+int bl_getfd(bl_t);
+bl_info_t *bl_recv(bl_t);
+bool bl_isconnected(bl_t);
+
+__END_DECLS
+
+#endif /* _OLD_BL_H */

contrib/blocklist/lib/Makefile

@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.7 2019/03/08 20:40:05 christos Exp $
+# $NetBSD: Makefile,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $
 
 .include <bsd.own.mk>
 
@@ -6,14 +6,14 @@ USE_SHLIBDIR=   yes
 
 CPPFLAGS+=-D_REENTRANT
 #LIBDPLIBS+=pthread ${NETBSDSRCDIR}/lib/libpthread
-LIB=blacklist
-SRCS=bl.c blacklist.c
-MAN=libblacklist.3
-MLINKS+=libblacklist.3 blacklist_open.3
-MLINKS+=libblacklist.3 blacklist_close.3
-MLINKS+=libblacklist.3 blacklist.3
-MLINKS+=libblacklist.3 blacklist_r.3
-MLINKS+=libblacklist.3 blacklist_sa.3
-MLINKS+=libblacklist.3 blacklist_sa_r.3
+LIB=blocklist
+SRCS=bl.c blocklist.c
+MAN=libblocklist.3
+MLINKS+=libblocklist.3 blocklist_open.3
+MLINKS+=libblocklist.3 blocklist_close.3
+MLINKS+=libblocklist.3 blocklist.3
+MLINKS+=libblocklist.3 blocklist_r.3
+MLINKS+=libblocklist.3 blocklist_sa.3
+MLINKS+=libblocklist.3 blocklist_sa_r.3
 
 .include <bsd.lib.mk>

contrib/blocklist/lib/bl.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: bl.c,v 1.28 2016/07/29 17:13:09 christos Exp $	*/
+/*	$NetBSD: bl.c,v 1.9 2025/03/30 01:53:59 christos Exp $	*/
 
 /*-
  * Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: bl.c,v 1.28 2016/07/29 17:13:09 christos Exp $");
+#endif
+__RCSID("$NetBSD: bl.c,v 1.9 2025/03/30 01:53:59 christos Exp $");
 
 #include <sys/param.h>
 #include <sys/types.h>
@@ -57,6 +59,10 @@ __RCSID("$NetBSD: bl.c,v 1.28 2016/07/29 17:13:09 christos Exp $");
 #include <pthread.h>
 #endif
 
+#if defined(SO_RECVUCRED)
+#include <ucred.h>
+#endif
+
 #include "bl.h"
 
 typedef struct {
@@ -68,7 +74,7 @@ typedef struct {
 	char bl_data[];
 } bl_message_t;
 
-struct blacklist {
+struct blocklist {
 #ifdef _REENTRANT
 	pthread_mutex_t b_mutex;
 # define BL_INIT(b)	pthread_mutex_init(&b->b_mutex, NULL)
@@ -82,7 +88,8 @@ struct blacklist {
 	int b_fd;
 	int b_connected;
 	struct sockaddr_un b_sun;
-	void (*b_fun)(int, const char *, va_list);
+	struct syslog_data b_syslog_data;
+	void (*b_fun)(int, struct syslog_data *, const char *, va_list);
 	bl_info_t b_info;
 };
 
@@ -115,14 +122,16 @@ bl_reset(bl_t b, bool locked)
 }
 
 static void
-bl_log(void (*fun)(int, const char *, va_list), int level,
-    const char *fmt, ...)
+bl_log(bl_t b, int level, const char *fmt, ...)
 {
 	va_list ap;
 	int serrno = errno;
 
+	if (b->b_fun == NULL)
+		return;
+
 	va_start(ap, fmt);
-	(*fun)(level, fmt, ap);
+	(*b->b_fun)(level, &b->b_syslog_data, fmt, ap);
 	va_end(ap);
 	errno = serrno;
 }
@@ -152,7 +161,7 @@ bl_init(bl_t b, bool srv)
 		b->b_fd = socket(PF_LOCAL,
 		    SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK|SOCK_NOSIGPIPE, 0);
 		if (b->b_fd == -1) {
-			bl_log(b->b_fun, LOG_ERR, "%s: socket failed (%s)",
+			bl_log(b, LOG_ERR, "%s: socket failed (%s)",
 			    __func__, strerror(errno));
 			BL_UNLOCK(b);
 			return -1;
@@ -186,7 +195,7 @@ bl_init(bl_t b, bool srv)
 	rv = connect(b->b_fd, (const void *)sun, (socklen_t)sizeof(*sun));
 	if (rv == 0) {
 		if (srv) {
-			bl_log(b->b_fun, LOG_ERR,
+			bl_log(b, LOG_ERR,
 			    "%s: another daemon is handling `%s'",
 			    __func__, sun->sun_path);
 			goto out;
@@ -199,7 +208,7 @@ bl_init(bl_t b, bool srv)
 			 * and only log once.
 			 */
 			if (b->b_connected != 1) {
-				bl_log(b->b_fun, LOG_DEBUG,
+				bl_log(b, LOG_DEBUG,
 				    "%s: connect failed for `%s' (%s)",
 				    __func__, sun->sun_path, strerror(errno));
 				b->b_connected = 1;
@@ -207,8 +216,7 @@ bl_init(bl_t b, bool srv)
 			BL_UNLOCK(b);
 			return -1;
 		}
-		bl_log(b->b_fun, LOG_DEBUG, "Connected to blacklist server",
-		    __func__);
+		bl_log(b, LOG_DEBUG, "Connected to blocklist server", __func__);
 	}
 
 	if (srv) {
@@ -219,8 +227,7 @@ bl_init(bl_t b, bool srv)
 		(void)umask(om);
 		errno = serrno;
 		if (rv == -1) {
-			bl_log(b->b_fun, LOG_ERR,
-			    "%s: bind failed for `%s' (%s)",
+			bl_log(b, LOG_ERR, "%s: bind failed for `%s' (%s)",
 			    __func__, sun->sun_path, strerror(errno));
 			goto out;
 		}
@@ -231,8 +238,8 @@ bl_init(bl_t b, bool srv)
 #if defined(LOCAL_CREDS)
 #define CRED_LEVEL	0
 #define	CRED_NAME	LOCAL_CREDS
-#define CRED_SC_UID	sc_euid
-#define CRED_SC_GID	sc_egid
+#define CRED_SC_UID(x)	(x)->sc_euid
+#define CRED_SC_GID(x)	(x)->sc_egid
 #define CRED_MESSAGE	SCM_CREDS
 #define CRED_SIZE	SOCKCREDSIZE(NGROUPS_MAX)
 #define CRED_TYPE	struct sockcred
@@ -240,12 +247,21 @@ bl_init(bl_t b, bool srv)
 #elif defined(SO_PASSCRED)
 #define CRED_LEVEL	SOL_SOCKET
 #define	CRED_NAME	SO_PASSCRED
-#define CRED_SC_UID	uid
-#define CRED_SC_GID	gid
+#define CRED_SC_UID(x)	(x)->uid
+#define CRED_SC_GID(x)	(x)->gid
 #define CRED_MESSAGE	SCM_CREDENTIALS
 #define CRED_SIZE	sizeof(struct ucred)
 #define CRED_TYPE	struct ucred
 #define GOT_CRED	2
+#elif defined(SO_RECVUCRED)
+#define CRED_LEVEL	SOL_SOCKET
+#define CRED_NAME	SO_RECVUCRED
+#define CRED_SC_UID(x)	ucred_geteuid(x)
+#define CRED_SC_GID(x)	ucred_getegid(x)
+#define CRED_MESSAGE	SCM_UCRED
+#define CRED_SIZE	ucred_size()
+#define CRED_TYPE	ucred_t
+#define GOT_CRED	2
 #else
 #define GOT_CRED	0
 /*
@@ -259,7 +275,7 @@ bl_init(bl_t b, bool srv)
 #ifdef CRED_LEVEL
 	if (setsockopt(b->b_fd, CRED_LEVEL, CRED_NAME,
 	    &one, (socklen_t)sizeof(one)) == -1) {
-		bl_log(b->b_fun, LOG_ERR, "%s: setsockopt %s "
+		bl_log(b, LOG_ERR, "%s: setsockopt %s "
 		    "failed (%s)", __func__, __STRING(CRED_NAME),
 		    strerror(errno));
 		goto out;
@@ -275,12 +291,15 @@ out:
 }
 
 bl_t
-bl_create(bool srv, const char *path, void (*fun)(int, const char *, va_list))
+bl_create(bool srv, const char *path,
+    void (*fun)(int, struct syslog_data *, const char *, va_list))
 {
+	static struct syslog_data sd = SYSLOG_DATA_INIT;
 	bl_t b = calloc(1, sizeof(*b));
 	if (b == NULL)
-		goto out;
-	b->b_fun = fun == NULL ? vsyslog : fun;
+		return NULL;
+	b->b_fun = fun;
+	b->b_syslog_data = sd;
 	b->b_fd = -1;
 	b->b_connected = -1;
 	BL_INIT(b);
@@ -295,11 +314,6 @@ bl_create(bool srv, const char *path, void (*fun)(int, const char *, va_list))
 
 	bl_init(b, srv);
 	return b;
-out:
-	free(b);
-	bl_log(fun, LOG_ERR, "%s: malloc failed (%s)", __func__,
-	    strerror(errno));
-	return NULL;
 }
 
 void
@@ -327,7 +341,7 @@ bl_getsock(bl_t b, struct sockaddr_storage *ss, const struct sockaddr *sa,
 		family = AF_INET6;
 		break;
 	default:
-		bl_log(b->b_fun, LOG_ERR, "%s: invalid socket len %u (%s)",
+		bl_log(b, LOG_ERR, "%s: invalid socket len %u (%s)",
 		    __func__, (unsigned)slen, ctx);
 		errno = EINVAL;
 		return -1;
@@ -336,7 +350,7 @@ bl_getsock(bl_t b, struct sockaddr_storage *ss, const struct sockaddr *sa,
 	memcpy(ss, sa, slen);
 
 	if (ss->ss_family != family) {
-		bl_log(b->b_fun, LOG_INFO,
+		bl_log(b, LOG_INFO,
 		    "%s: correcting socket family %d to %d (%s)",
 		    __func__, ss->ss_family, family, ctx);
 		ss->ss_family = family;
@@ -344,7 +358,7 @@ bl_getsock(bl_t b, struct sockaddr_storage *ss, const struct sockaddr *sa,
 
 #ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
 	if (ss->ss_len != slen) {
-		bl_log(b->b_fun, LOG_INFO,
+		bl_log(b, LOG_INFO,
 		    "%s: correcting socket len %u to %u (%s)",
 		    __func__, ss->ss_len, (unsigned)slen, ctx);
 		ss->ss_len = (uint8_t)slen;
@@ -424,10 +438,11 @@ bl_recv(bl_t b)
 	union {
 		char ctrl[CMSG_SPACE(sizeof(int)) + CMSG_SPACE(CRED_SIZE)];
 		uint32_t fd;
-		CRED_TYPE sc;
 	} ua;
 	struct cmsghdr *cmsg;
+#if GOT_CRED != 0
 	CRED_TYPE *sc;
+#endif
 	union {
 		bl_message_t bl;
 		char buf[512];
@@ -450,18 +465,18 @@ bl_recv(bl_t b)
 	msg.msg_flags = 0;
 
 	msg.msg_control = ua.ctrl;
-	msg.msg_controllen = sizeof(ua.ctrl) + 100;
+	msg.msg_controllen = sizeof(ua.ctrl);
 
         rlen = recvmsg(b->b_fd, &msg, 0);
         if (rlen == -1) {
-		bl_log(b->b_fun, LOG_ERR, "%s: recvmsg failed (%s)", __func__,
+		bl_log(b, LOG_ERR, "%s: recvmsg failed (%s)", __func__,
 		    strerror(errno));
 		return NULL;
         }
 
 	for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
 		if (cmsg->cmsg_level != SOL_SOCKET) {
-			bl_log(b->b_fun, LOG_ERR,
+			bl_log(b, LOG_ERR,
 			    "%s: unexpected cmsg_level %d",
 			    __func__, cmsg->cmsg_level);
 			continue;
@@ -469,10 +484,15 @@ bl_recv(bl_t b)
 		switch (cmsg->cmsg_type) {
 		case SCM_RIGHTS:
 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
-				bl_log(b->b_fun, LOG_ERR,
+				int *fd = (void *)CMSG_DATA(cmsg);
+				size_t len = cmsg->cmsg_len / sizeof(int);
+				bl_log(b, LOG_ERR,
 				    "%s: unexpected cmsg_len %d != %zu",
 				    __func__, cmsg->cmsg_len,
-				    CMSG_LEN(2 * sizeof(int)));
+				    CMSG_LEN(sizeof(int)));
+
+				for (size_t i = 0;  i < len; i++)
+					(void)close(fd[i]);
 				continue;
 			}
 			memcpy(&bi->bi_fd, CMSG_DATA(cmsg), sizeof(bi->bi_fd));
@@ -481,13 +501,13 @@ bl_recv(bl_t b)
 #ifdef CRED_MESSAGE
 		case CRED_MESSAGE:
 			sc = (void *)CMSG_DATA(cmsg);
-			bi->bi_uid = sc->CRED_SC_UID;
-			bi->bi_gid = sc->CRED_SC_GID;
+			bi->bi_uid = CRED_SC_UID(sc);
+			bi->bi_gid = CRED_SC_GID(sc);
 			got |= GOT_CRED;
 			break;
 #endif
 		default:
-			bl_log(b->b_fun, LOG_ERR,
+			bl_log(b, LOG_ERR,
 			    "%s: unexpected cmsg_type %d",
 			    __func__, cmsg->cmsg_type);
 			continue;
@@ -496,7 +516,7 @@ bl_recv(bl_t b)
 	}
 
 	if (got != (GOT_CRED|GOT_FD)) {
-		bl_log(b->b_fun, LOG_ERR, "message missing %s %s",
+		bl_log(b, LOG_ERR, "message missing %s %s",
 #if GOT_CRED != 0
 		    (got & GOT_CRED) == 0 ? "cred" :
 #endif
@@ -506,13 +526,13 @@ bl_recv(bl_t b)
 
 	rem = (size_t)rlen;
 	if (rem < sizeof(ub.bl)) {
-		bl_log(b->b_fun, LOG_ERR, "message too short %zd", rlen);
+		bl_log(b, LOG_ERR, "message too short %zd", rlen);
 		return NULL;
 	}
 	rem -= sizeof(ub.bl);
 
 	if (ub.bl.bl_version != BL_VERSION) {
-		bl_log(b->b_fun, LOG_ERR, "bad version %d", ub.bl.bl_version);
+		bl_log(b, LOG_ERR, "bad version %d", ub.bl.bl_version);
 		return NULL;
 	}
 
@@ -523,10 +543,12 @@ bl_recv(bl_t b)
 	bi->bi_uid = -1;
 	bi->bi_gid = -1;
 #endif
-	rem = MIN(sizeof(bi->bi_msg), rem);
 	if (rem == 0)
 		bi->bi_msg[0] = '\0';
-	else
-		strlcpy(bi->bi_msg, ub.bl.bl_data, rem);
+	else {
+		rem = MIN(sizeof(bi->bi_msg) - 1, rem);
+		memcpy(bi->bi_msg, ub.bl.bl_data, rem);
+		bi->bi_msg[rem] = '\0';
+	}
 	return bi;
 }

contrib/blocklist/lib/blacklist.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: blacklist.c,v 1.5 2015/01/22 16:19:53 christos Exp $	*/
+/*	$NetBSD: blocklist.c,v 1.4 2025/02/11 17:48:30 christos Exp $	*/
 
 /*-
  * Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -32,11 +32,13 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: blacklist.c,v 1.5 2015/01/22 16:19:53 christos Exp $");
+#endif
+__RCSID("$NetBSD: blocklist.c,v 1.4 2025/02/11 17:48:30 christos Exp $");
 
 #include <stdio.h>
-#include <bl.h>
+#include <old_bl.h>
 
 #include <stdarg.h>
 #include <errno.h>
@@ -98,7 +100,14 @@ blacklist_r(struct blacklist *bl, int action, int rfd, const char *msg)
 
 struct blacklist *
 blacklist_open(void) {
-	return bl_create(false, NULL, vsyslog);
+	return bl_create(false, NULL, vsyslog_r);
+}
+
+struct blacklist *
+blacklist_open2(
+    void (*logger)(int, struct syslog_data *, const char *, va_list))
+{
+	return bl_create(false, NULL, logger);
 }
 
 void

contrib/blocklist/lib/blocklist.c

@@ -0,0 +1,117 @@
+/*	$NetBSD: blocklist.c,v 1.4 2025/02/11 17:48:30 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2014 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef HAVE_SYS_CDEFS_H
+#include <sys/cdefs.h>
+#endif
+__RCSID("$NetBSD: blocklist.c,v 1.4 2025/02/11 17:48:30 christos Exp $");
+
+#include <stdio.h>
+#include <bl.h>
+
+#include <stdarg.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <syslog.h>
+
+int
+blocklist_sa(int action, int rfd, const struct sockaddr *sa, socklen_t salen,
+    const char *msg)
+{
+	struct blocklist *bl;
+	int rv;
+	if ((bl = blocklist_open()) == NULL)
+		return -1;
+	rv = blocklist_sa_r(bl, action, rfd, sa, salen, msg);
+	blocklist_close(bl);
+	return rv;
+}
+
+int
+blocklist_sa_r(struct blocklist *bl, int action, int rfd,
+	const struct sockaddr *sa, socklen_t slen, const char *msg)
+{
+	bl_type_t internal_action;
+
+	/* internal values are not the same as user application values */
+	switch (action) {
+	case BLOCKLIST_AUTH_FAIL:
+		internal_action = BL_ADD;
+		break;
+	case BLOCKLIST_AUTH_OK:
+		internal_action = BL_DELETE;
+		break;
+	case BLOCKLIST_ABUSIVE_BEHAVIOR:
+		internal_action = BL_ABUSE;
+		break;
+	case BLOCKLIST_BAD_USER:
+		internal_action = BL_BADUSER;
+		break;
+	default:
+		internal_action = BL_INVALID;
+		break;
+	}
+	return bl_send(bl, internal_action, rfd, sa, slen, msg);
+}
+
+int
+blocklist(int action, int rfd, const char *msg)
+{
+	return blocklist_sa(action, rfd, NULL, 0, msg);
+}
+
+int
+blocklist_r(struct blocklist *bl, int action, int rfd, const char *msg)
+{
+	return blocklist_sa_r(bl, action, rfd, NULL, 0, msg);
+}
+
+struct blocklist *
+blocklist_open(void) {
+	return bl_create(false, NULL, vsyslog_r);
+}
+
+struct blocklist *
+blocklist_open2(
+    void (*logger)(int, struct syslog_data *, const char *, va_list))
+{
+	return bl_create(false, NULL, logger);
+}
+
+void
+blocklist_close(struct blocklist *bl)
+{
+	bl_destroy(bl);
+}

contrib/blocklist/lib/libblacklist.3

@@ -1,4 +1,4 @@
-.\" $NetBSD: libblacklist.3,v 1.10 2020/03/30 15:47:15 christos Exp $
+.\" $NetBSD: libblocklist.3,v 1.7 2025/02/05 20:14:30 christos Exp $
 .\"
 .\" Copyright (c) 2015 The NetBSD Foundation, Inc.
 .\" All rights reserved.
@@ -27,11 +27,12 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd March 30, 2020
+.Dd February 5, 2025
 .Dt LIBBLACKLIST 3
 .Os
 .Sh NAME
 .Nm blacklist_open ,
+.Nm blacklist_open2 ,
 .Nm blacklist_close ,
 .Nm blacklist_r ,
 .Nm blacklist ,
@@ -44,6 +45,8 @@
 .In blacklist.h
 .Ft struct blacklist *
 .Fn blacklist_open "void"
+.Ft struct blacklist *
+.Fn blacklist_open2 "void (*logger)(int, struct syslog_data *, va_list)"
 .Ft void
 .Fn blacklist_close "struct blacklist *cookie"
 .Ft int
@@ -68,6 +71,19 @@ and returns a pointer to it, or
 .Dv NULL
 on failure.
 .Pp
+The function
+.Fn blacklist_open2
+is similar to
+.Fn blacklist_open
+but allows a
+.Fa logger
+to be specified.
+If the
+.Fa logger
+is
+.Dv NULL ,
+then no logging is performed.
+.Pp
 The
 .Fn blacklist_close
 function frees all memory and resources used.
@@ -89,17 +105,17 @@ argument.
 The
 .Ar action
 parameter can take these values:
-.Bl -tag -width ".Va BLACKLIST_ABUSIVE_BEHAVIOR"
-.It Va BLACKLIST_AUTH_FAIL
+.Bl -tag -width ".Dv BLACKLIST_ABUSIVE_BEHAVIOR"
+.It Dv BLACKLIST_AUTH_FAIL
 There was an unsuccessful authentication attempt.
-.It Va BLACKLIST_AUTH_OK
+.It Dv BLACKLIST_AUTH_OK
 A user successfully authenticated.
-.It Va BLACKLIST_ABUSIVE_BEHAVIOR
+.It Dv BLACKLIST_ABUSIVE_BEHAVIOR
 The sending daemon has detected abusive behavior
 from the remote system.
 The remote address should
 be blocked as soon as possible.
-.It Va BLACKLIST_BAD_USER
+.It Dv BLACKLIST_BAD_USER
 The sending daemon has determined the username
 presented for authentication is invalid.
 The
@@ -108,7 +124,7 @@ daemon compares the username to a configured list of forbidden
 usernames and
 blocks the address immediately if a forbidden username matches.
 (The
-.Ar BLACKLIST_BAD_USER
+.Dv BLACKLIST_BAD_USER
 support is not currently available.)
 .El
 .Pp
@@ -160,6 +176,11 @@ on success and
 on failure setting
 .Dv errno
 to an appropriate value.
+.Sh NOTES
+The
+.Lb libblacklist
+has been renamed to
+.Xr libblocklist 3 .
 .Sh SEE ALSO
 .Xr blacklistd.conf 5 ,
 .Xr blacklistd 8

contrib/blocklist/lib/libblocklist.3

@@ -0,0 +1,183 @@
+.\" $NetBSD: libblocklist.3,v 1.7 2025/02/05 20:14:30 christos Exp $
+.\"
+.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
+.\" All rights reserved.
+.\"
+.\" This code is derived from software contributed to The NetBSD Foundation
+.\" by Christos Zoulas.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+.\" POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd February 5, 2025
+.Dt LIBBLOCKLIST 3
+.Os
+.Sh NAME
+.Nm blocklist_open ,
+.Nm blocklist_open2 ,
+.Nm blocklist_close ,
+.Nm blocklist_r ,
+.Nm blocklist ,
+.Nm blocklist_sa ,
+.Nm blocklist_sa_r
+.Nd Blocklistd notification library
+.Sh LIBRARY
+.Lb libblocklist
+.Sh SYNOPSIS
+.In blocklist.h
+.Ft struct blocklist *
+.Fn blocklist_open "void"
+.Ft struct blocklist *
+.Fn blocklist_open2 "void (*logger)(int, struct syslog_data *, va_list)"
+.Ft void
+.Fn blocklist_close "struct blocklist *cookie"
+.Ft int
+.Fn blocklist "int action" "int fd" "const char *msg"
+.Ft int
+.Fn blocklist_r "struct blocklist *cookie" "int action" "int fd" "const char *msg"
+.Ft int
+.Fn blocklist_sa "int action" "int fd" "const struct sockaddr *sa" "socklen_t salen" "const char *msg"
+.Ft int
+.Fn blocklist_sa_r "struct blocklist *cookie" "int action" "int fd" "const struct sockaddr *sa" "socklen_t salen" "const char *msg"
+.Sh DESCRIPTION
+These functions can be used by daemons to notify
+.Xr blocklistd 8
+about successful and failed remote connections so that blocklistd can
+block or release port access to prevent Denial of Service attacks.
+.Pp
+The function
+.Fn blocklist_open
+creates the necessary state to communicate with
+.Xr blocklistd 8
+and returns a pointer to it, or
+.Dv NULL
+on failure.
+.Pp
+The function
+.Fn blocklist_open2
+is similar to
+.Fn blocklist_open
+but allows a
+.Fa logger
+to be specified.
+If the
+.Fa logger
+is
+.Dv NULL ,
+then no logging is performed.
+.Pp
+The
+.Fn blocklist_close
+function frees all memory and resources used.
+.Pp
+The
+.Fn blocklist
+function sends a message to
+.Xr blocklistd 8 ,
+with an integer
+.Ar action
+argument specifying the type of notification,
+a file descriptor
+.Ar fd
+specifying the accepted file descriptor connected to the client,
+and an optional message in the
+.Ar msg
+argument.
+.Pp
+The
+.Ar action
+parameter can take these values:
+.Bl -tag -width ".Dv BLOCKLIST_ABUSIVE_BEHAVIOR"
+.It Dv BLOCKLIST_AUTH_FAIL
+There was an unsuccessful authentication attempt.
+.It Dv BLOCKLIST_AUTH_OK
+A user successfully authenticated.
+.It Dv BLOCKLIST_ABUSIVE_BEHAVIOR
+The sending daemon has detected abusive behavior
+from the remote system.
+The remote address should
+be blocked as soon as possible.
+.It Dv BLOCKLIST_BAD_USER
+The sending daemon has determined the username
+presented for authentication is invalid.
+The
+.Xr blocklistd 8
+daemon compares the username to a configured list of forbidden
+usernames and
+blocks the address immediately if a forbidden username matches.
+(The
+.Dv BLOCKLIST_BAD_USER
+support is not currently available.)
+.El
+.Pp
+The
+.Fn blocklist_r
+function is more efficient because it keeps the blocklist state around.
+.Pp
+The
+.Fn blocklist_sa
+and
+.Fn blocklist_sa_r
+functions can be used with unconnected sockets, where
+.Xr getpeername 2
+will not work, the server will pass the peer name in the message.
+.Pp
+In all cases the file descriptor passed in the
+.Fa fd
+argument must be pointing to a valid socket so that
+.Xr blocklistd 8
+can establish ownership of the local endpoint
+using
+.Xr getsockname 2 .
+.Pp
+By default,
+.Xr syslogd 8
+is used for message logging.
+The internal
+.Fn bl_create
+function can be used to create the required internal
+state and specify a custom logging function.
+.Sh RETURN VALUES
+The function
+.Fn blocklist_open
+returns a cookie on success and
+.Dv NULL
+on failure setting
+.Dv errno
+to an appropriate value.
+.Pp
+The functions
+.Fn blocklist ,
+.Fn blocklist_sa ,
+and
+.Fn blocklist_sa_r
+return
+.Dv 0
+on success and
+.Dv \-1
+on failure setting
+.Dv errno
+to an appropriate value.
+.Sh SEE ALSO
+.Xr blocklistd.conf 5 ,
+.Xr blocklistd 8
+.Sh AUTHORS
+.An Christos Zoulas

contrib/blocklist/lib/old_bl.c

@@ -0,0 +1,554 @@
+/*	$NetBSD: bl.c,v 1.9 2025/03/30 01:53:59 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2014 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef HAVE_SYS_CDEFS_H
+#include <sys/cdefs.h>
+#endif
+__RCSID("$NetBSD: bl.c,v 1.9 2025/03/30 01:53:59 christos Exp $");
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <syslog.h>
+#include <signal.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <netinet/in.h>
+#ifdef _REENTRANT
+#include <pthread.h>
+#endif
+
+#if defined(SO_RECVUCRED)
+#include <ucred.h>
+#endif
+
+#include "old_bl.h"
+
+typedef struct {
+	uint32_t bl_len;
+	uint32_t bl_version;
+	uint32_t bl_type;
+	uint32_t bl_salen;
+	struct sockaddr_storage bl_ss;
+	char bl_data[];
+} bl_message_t;
+
+struct blacklist {
+#ifdef _REENTRANT
+	pthread_mutex_t b_mutex;
+# define BL_INIT(b)	pthread_mutex_init(&b->b_mutex, NULL)
+# define BL_LOCK(b)	pthread_mutex_lock(&b->b_mutex)
+# define BL_UNLOCK(b)	pthread_mutex_unlock(&b->b_mutex)
+#else
+# define BL_INIT(b)	do {} while(/*CONSTCOND*/0)
+# define BL_LOCK(b)	BL_INIT(b)
+# define BL_UNLOCK(b)	BL_INIT(b)
+#endif
+	int b_fd;
+	int b_connected;
+	struct sockaddr_un b_sun;
+	struct syslog_data b_syslog_data;
+	void (*b_fun)(int, struct syslog_data *, const char *, va_list);
+	bl_info_t b_info;
+};
+
+#define BL_VERSION	1
+
+bool
+bl_isconnected(bl_t b)
+{
+	return b->b_connected == 0;
+}
+
+int
+bl_getfd(bl_t b)
+{
+	return b->b_fd;
+}
+
+static void
+bl_reset(bl_t b, bool locked)
+{
+	int serrno = errno;
+	if (!locked)
+		BL_LOCK(b);
+	close(b->b_fd);
+	errno = serrno;
+	b->b_fd = -1;
+	b->b_connected = -1;
+	if (!locked)
+		BL_UNLOCK(b);
+}
+
+static void
+bl_log(bl_t b, int level, const char *fmt, ...)
+{
+	va_list ap;
+	int serrno = errno;
+
+	if (b->b_fun == NULL)
+		return;
+
+	va_start(ap, fmt);
+	(*b->b_fun)(level, &b->b_syslog_data, fmt, ap);
+	va_end(ap);
+	errno = serrno;
+}
+
+static int
+bl_init(bl_t b, bool srv)
+{
+	static int one = 1;
+	/* AF_UNIX address of local logger */
+	mode_t om;
+	int rv, serrno;
+	struct sockaddr_un *sun = &b->b_sun;
+
+#ifndef SOCK_NONBLOCK
+#define SOCK_NONBLOCK 0
+#endif
+#ifndef SOCK_CLOEXEC
+#define SOCK_CLOEXEC 0
+#endif
+#ifndef SOCK_NOSIGPIPE
+#define SOCK_NOSIGPIPE 0
+#endif
+
+	BL_LOCK(b);
+
+	if (b->b_fd == -1) {
+		b->b_fd = socket(PF_LOCAL,
+		    SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK|SOCK_NOSIGPIPE, 0);
+		if (b->b_fd == -1) {
+			bl_log(b, LOG_ERR, "%s: socket failed (%s)",
+			    __func__, strerror(errno));
+			BL_UNLOCK(b);
+			return -1;
+		}
+#if SOCK_CLOEXEC == 0
+		fcntl(b->b_fd, F_SETFD, FD_CLOEXEC);
+#endif
+#if SOCK_NONBLOCK == 0
+		fcntl(b->b_fd, F_SETFL, fcntl(b->b_fd, F_GETFL) | O_NONBLOCK);
+#endif
+#if SOCK_NOSIGPIPE == 0
+#ifdef SO_NOSIGPIPE
+		int o = 1;
+		setsockopt(b->b_fd, SOL_SOCKET, SO_NOSIGPIPE, &o, sizeof(o));
+#else
+		signal(SIGPIPE, SIG_IGN);
+#endif
+#endif
+	}
+
+	if (bl_isconnected(b)) {
+		BL_UNLOCK(b);
+		return 0;
+	}
+
+	/*
+	 * We try to connect anyway even when we are a server to verify
+	 * that no other server is listening to the socket. If we succeed
+	 * to connect and we are a server, someone else owns it.
+	 */
+	rv = connect(b->b_fd, (const void *)sun, (socklen_t)sizeof(*sun));
+	if (rv == 0) {
+		if (srv) {
+			bl_log(b, LOG_ERR,
+			    "%s: another daemon is handling `%s'",
+			    __func__, sun->sun_path);
+			goto out;
+		}
+	} else {
+		if (!srv) {
+			/*
+			 * If the daemon is not running, we just try a
+			 * connect, so leave the socket alone until it does
+			 * and only log once.
+			 */
+			if (b->b_connected != 1) {
+				bl_log(b, LOG_DEBUG,
+				    "%s: connect failed for `%s' (%s)",
+				    __func__, sun->sun_path, strerror(errno));
+				b->b_connected = 1;
+			}
+			BL_UNLOCK(b);
+			return -1;
+		}
+		bl_log(b, LOG_DEBUG, "Connected to blacklist server", __func__);
+	}
+
+	if (srv) {
+		(void)unlink(sun->sun_path);
+		om = umask(0);
+		rv = bind(b->b_fd, (const void *)sun, (socklen_t)sizeof(*sun));
+		serrno = errno;
+		(void)umask(om);
+		errno = serrno;
+		if (rv == -1) {
+			bl_log(b, LOG_ERR, "%s: bind failed for `%s' (%s)",
+			    __func__, sun->sun_path, strerror(errno));
+			goto out;
+		}
+	}
+
+	b->b_connected = 0;
+#define GOT_FD		1
+#if defined(LOCAL_CREDS)
+#define CRED_LEVEL	0
+#define	CRED_NAME	LOCAL_CREDS
+#define CRED_SC_UID(x)	(x)->sc_euid
+#define CRED_SC_GID(x)	(x)->sc_egid
+#define CRED_MESSAGE	SCM_CREDS
+#define CRED_SIZE	SOCKCREDSIZE(NGROUPS_MAX)
+#define CRED_TYPE	struct sockcred
+#define GOT_CRED	2
+#elif defined(SO_PASSCRED)
+#define CRED_LEVEL	SOL_SOCKET
+#define	CRED_NAME	SO_PASSCRED
+#define CRED_SC_UID(x)	(x)->uid
+#define CRED_SC_GID(x)	(x)->gid
+#define CRED_MESSAGE	SCM_CREDENTIALS
+#define CRED_SIZE	sizeof(struct ucred)
+#define CRED_TYPE	struct ucred
+#define GOT_CRED	2
+#elif defined(SO_RECVUCRED)
+#define CRED_LEVEL	SOL_SOCKET
+#define CRED_NAME	SO_RECVUCRED
+#define CRED_SC_UID(x)	ucred_geteuid(x)
+#define CRED_SC_GID(x)	ucred_getegid(x)
+#define CRED_MESSAGE	SCM_UCRED
+#define CRED_SIZE	ucred_size()
+#define CRED_TYPE	ucred_t
+#define GOT_CRED	2
+#else
+#define GOT_CRED	0
+/*
+ * getpeereid() and LOCAL_PEERCRED don't help here
+ * because we are not a stream socket!
+ */
+#define	CRED_SIZE	0
+#define CRED_TYPE	void * __unused
+#endif
+
+#ifdef CRED_LEVEL
+	if (setsockopt(b->b_fd, CRED_LEVEL, CRED_NAME,
+	    &one, (socklen_t)sizeof(one)) == -1) {
+		bl_log(b, LOG_ERR, "%s: setsockopt %s "
+		    "failed (%s)", __func__, __STRING(CRED_NAME),
+		    strerror(errno));
+		goto out;
+	}
+#endif
+
+	BL_UNLOCK(b);
+	return 0;
+out:
+	bl_reset(b, true);
+	BL_UNLOCK(b);
+	return -1;
+}
+
+bl_t
+bl_create(bool srv, const char *path,
+    void (*fun)(int, struct syslog_data *, const char *, va_list))
+{
+	static struct syslog_data sd = SYSLOG_DATA_INIT;
+	bl_t b = calloc(1, sizeof(*b));
+	if (b == NULL)
+		return NULL;
+	b->b_fun = fun;
+	b->b_syslog_data = sd;
+	b->b_fd = -1;
+	b->b_connected = -1;
+	BL_INIT(b);
+
+	memset(&b->b_sun, 0, sizeof(b->b_sun));
+	b->b_sun.sun_family = AF_LOCAL;
+#ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
+	b->b_sun.sun_len = sizeof(b->b_sun);
+#endif
+	strlcpy(b->b_sun.sun_path,
+	    path ? path : _PATH_BLSOCK, sizeof(b->b_sun.sun_path));
+
+	bl_init(b, srv);
+	return b;
+}
+
+void
+bl_destroy(bl_t b)
+{
+	bl_reset(b, false);
+	free(b);
+}
+
+static int
+bl_getsock(bl_t b, struct sockaddr_storage *ss, const struct sockaddr *sa,
+    socklen_t slen, const char *ctx)
+{
+	uint8_t family;
+
+	memset(ss, 0, sizeof(*ss));
+
+	switch (slen) {
+	case 0:
+		return 0;
+	case sizeof(struct sockaddr_in):
+		family = AF_INET;
+		break;
+	case sizeof(struct sockaddr_in6):
+		family = AF_INET6;
+		break;
+	default:
+		bl_log(b, LOG_ERR, "%s: invalid socket len %u (%s)",
+		    __func__, (unsigned)slen, ctx);
+		errno = EINVAL;
+		return -1;
+	}
+
+	memcpy(ss, sa, slen);
+
+	if (ss->ss_family != family) {
+		bl_log(b, LOG_INFO,
+		    "%s: correcting socket family %d to %d (%s)",
+		    __func__, ss->ss_family, family, ctx);
+		ss->ss_family = family;
+	}
+
+#ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
+	if (ss->ss_len != slen) {
+		bl_log(b, LOG_INFO,
+		    "%s: correcting socket len %u to %u (%s)",
+		    __func__, ss->ss_len, (unsigned)slen, ctx);
+		ss->ss_len = (uint8_t)slen;
+	}
+#endif
+	return 0;
+}
+
+int
+bl_send(bl_t b, bl_type_t e, int pfd, const struct sockaddr *sa,
+    socklen_t slen, const char *ctx)
+{
+	struct msghdr   msg;
+	struct iovec    iov;
+	union {
+		char ctrl[CMSG_SPACE(sizeof(int))];
+		uint32_t fd;
+	} ua;
+	struct cmsghdr *cmsg;
+	union {
+		bl_message_t bl;
+		char buf[512];
+	} ub;
+	size_t ctxlen, tried;
+#define NTRIES	5
+
+	ctxlen = strlen(ctx);
+	if (ctxlen > 128)
+		ctxlen = 128;
+
+	iov.iov_base = ub.buf;
+	iov.iov_len = sizeof(bl_message_t) + ctxlen;
+	ub.bl.bl_len = (uint32_t)iov.iov_len;
+	ub.bl.bl_version = BL_VERSION;
+	ub.bl.bl_type = (uint32_t)e;
+
+	if (bl_getsock(b, &ub.bl.bl_ss, sa, slen, ctx) == -1)
+		return -1;
+
+
+	ub.bl.bl_salen = slen;
+	memcpy(ub.bl.bl_data, ctx, ctxlen);
+
+	msg.msg_name = NULL;
+	msg.msg_namelen = 0;
+	msg.msg_iov = &iov;
+	msg.msg_iovlen = 1;
+	msg.msg_flags = 0;
+
+	msg.msg_control = ua.ctrl;
+	msg.msg_controllen = sizeof(ua.ctrl);
+
+	cmsg = CMSG_FIRSTHDR(&msg);
+	cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+	cmsg->cmsg_level = SOL_SOCKET;
+	cmsg->cmsg_type = SCM_RIGHTS;
+
+	memcpy(CMSG_DATA(cmsg), &pfd, sizeof(pfd));
+
+	tried = 0;
+again:
+	if (bl_init(b, false) == -1)
+		return -1;
+
+	if ((sendmsg(b->b_fd, &msg, 0) == -1) && tried++ < NTRIES) {
+		bl_reset(b, false);
+		goto again;
+	}
+	return tried >= NTRIES ? -1 : 0;
+}
+
+bl_info_t *
+bl_recv(bl_t b)
+{
+        struct msghdr   msg;
+        struct iovec    iov;
+	union {
+		char ctrl[CMSG_SPACE(sizeof(int)) + CMSG_SPACE(CRED_SIZE)];
+		uint32_t fd;
+	} ua;
+	struct cmsghdr *cmsg;
+#if GOT_CRED != 0
+	CRED_TYPE *sc;
+#endif
+	union {
+		bl_message_t bl;
+		char buf[512];
+	} ub;
+	int got;
+	ssize_t rlen;
+	size_t rem;
+	bl_info_t *bi = &b->b_info;
+
+	got = 0;
+	memset(bi, 0, sizeof(*bi));
+
+	iov.iov_base = ub.buf;
+	iov.iov_len = sizeof(ub);
+
+	msg.msg_name = NULL;
+	msg.msg_namelen = 0;
+	msg.msg_iov = &iov;
+	msg.msg_iovlen = 1;
+	msg.msg_flags = 0;
+
+	msg.msg_control = ua.ctrl;
+	msg.msg_controllen = sizeof(ua.ctrl);
+
+        rlen = recvmsg(b->b_fd, &msg, 0);
+        if (rlen == -1) {
+		bl_log(b, LOG_ERR, "%s: recvmsg failed (%s)", __func__,
+		    strerror(errno));
+		return NULL;
+        }
+
+	for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+		if (cmsg->cmsg_level != SOL_SOCKET) {
+			bl_log(b, LOG_ERR,
+			    "%s: unexpected cmsg_level %d",
+			    __func__, cmsg->cmsg_level);
+			continue;
+		}
+		switch (cmsg->cmsg_type) {
+		case SCM_RIGHTS:
+			if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
+				int *fd = (void *)CMSG_DATA(cmsg);
+				size_t len = cmsg->cmsg_len / sizeof(int);
+				bl_log(b, LOG_ERR,
+				    "%s: unexpected cmsg_len %d != %zu",
+				    __func__, cmsg->cmsg_len,
+				    CMSG_LEN(sizeof(int)));
+
+				for (size_t i = 0;  i < len; i++)
+					(void)close(fd[i]);
+				continue;
+			}
+			memcpy(&bi->bi_fd, CMSG_DATA(cmsg), sizeof(bi->bi_fd));
+			got |= GOT_FD;
+			break;
+#ifdef CRED_MESSAGE
+		case CRED_MESSAGE:
+			sc = (void *)CMSG_DATA(cmsg);
+			bi->bi_uid = CRED_SC_UID(sc);
+			bi->bi_gid = CRED_SC_GID(sc);
+			got |= GOT_CRED;
+			break;
+#endif
+		default:
+			bl_log(b, LOG_ERR,
+			    "%s: unexpected cmsg_type %d",
+			    __func__, cmsg->cmsg_type);
+			continue;
+		}
+
+	}
+
+	if (got != (GOT_CRED|GOT_FD)) {
+		bl_log(b, LOG_ERR, "message missing %s %s",
+#if GOT_CRED != 0
+		    (got & GOT_CRED) == 0 ? "cred" :
+#endif
+		    "", (got & GOT_FD) == 0 ? "fd" : "");
+		return NULL;
+	}
+
+	rem = (size_t)rlen;
+	if (rem < sizeof(ub.bl)) {
+		bl_log(b, LOG_ERR, "message too short %zd", rlen);
+		return NULL;
+	}
+	rem -= sizeof(ub.bl);
+
+	if (ub.bl.bl_version != BL_VERSION) {
+		bl_log(b, LOG_ERR, "bad version %d", ub.bl.bl_version);
+		return NULL;
+	}
+
+	bi->bi_type = ub.bl.bl_type;
+	bi->bi_slen = ub.bl.bl_salen;
+	bi->bi_ss = ub.bl.bl_ss;
+#ifndef CRED_MESSAGE
+	bi->bi_uid = -1;
+	bi->bi_gid = -1;
+#endif
+	if (rem == 0)
+		bi->bi_msg[0] = '\0';
+	else {
+		rem = MIN(sizeof(bi->bi_msg) - 1, rem);
+		memcpy(bi->bi_msg, ub.bl.bl_data, rem);
+		bi->bi_msg[rem] = '\0';
+	}
+	return bi;
+}

contrib/blocklist/lib/shlib_version

@@ -1,2 +1,2 @@
 major=0
-minor=0
+minor=1

contrib/blocklist/libexec/Makefile

@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.1 2015/01/22 17:49:41 christos Exp $
+# $NetBSD: Makefile,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $
 
-SCRIPTS=        blacklistd-helper
+SCRIPTS=        blocklistd-helper
 SCRIPTSDIR=     /libexec
 
 .include <bsd.prog.mk>

contrib/blocklist/libexec/blacklistd-helper

@@ -1,134 +0,0 @@
-#!/bin/sh
-#echo "run $@" 1>&2
-#set -x
-# $1 command
-# $2 rulename
-# $3 protocol
-# $4 address
-# $5 mask
-# $6 port
-# $7 id
-
-pf=
-if [ -f "/etc/ipfw-blacklist.rc" ]; then
-	pf="ipfw"
-	. /etc/ipfw-blacklist.rc
-	ipfw_offset=${ipfw_offset:-2000}
-fi
-
-if [ -z "$pf" ]; then
-	for f in npf pf ipf; do
-		if [ -f "/etc/$f.conf" ]; then
-			pf="$f"
-			break
-		fi
-	done
-fi
-
-if [ -z "$pf" ]; then
-	echo "$0: Unsupported packet filter" 1>&2
-	exit 1
-fi
-
-if [ -n "$3" ]; then
-	proto="proto $3"
-fi
-
-if [ -n "$6" ]; then
-	port="port $6"
-fi
-
-addr="$4"
-mask="$5"
-case "$4" in
-::ffff:*.*.*.*)
-	if [ "$5" = 128 ]; then
-		mask=32
-		addr=${4#::ffff:}
-	fi;;
-esac
-
-case "$1" in
-add)
-	case "$pf" in
-	ipf)
-		/sbin/ipfstat -io | /sbin/ipf -I -f - >/dev/null 2>&1
-		echo block in quick $proto from $addr/$mask to \
-		    any port=$6 head port$6 | \
-		    /sbin/ipf -I -f - -s >/dev/null 2>&1 && echo OK
-		;;
-	ipfw)
-		# use $ipfw_offset+$port for rule number
-		rule=$(($ipfw_offset + $6))
-		tname="port$6"
-		/sbin/ipfw table $tname create type addr 2>/dev/null
-		/sbin/ipfw -q table $tname add "$addr/$mask"
-		# if rule number $rule does not already exist, create it
-		/sbin/ipfw show $rule >/dev/null 2>&1 || \
-			/sbin/ipfw add $rule drop $3 from \
-			table"("$tname")" to any dst-port $6 >/dev/null && \
-			echo OK
-		;;
-	npf)
-		/sbin/npfctl rule "$2" add block in final $proto from \
-		    "$addr/$mask" to any $port
-		;;
-	pf)
-		# if the filtering rule does not exist, create it
-		/sbin/pfctl -a "$2/$6" -sr 2>/dev/null | \
-		    grep -q "<port$6>" || \
-		    echo "block in quick $proto from <port$6> to any $port" | \
-		    /sbin/pfctl -a "$2/$6" -f -
-		# insert $ip/$mask into per-protocol/port anchored table
-		/sbin/pfctl -qa "$2/$6" -t "port$6" -T add "$addr/$mask" && \
-		    /sbin/pfctl -qk "$addr" && echo OK
-		;;
-	esac
-	;;
-rem)
-	case "$pf" in
-	ipf)
-		/sbin/ipfstat -io | /sbin/ipf -I -f - >/dev/null 2>&1
-		echo block in quick $proto from $addr/$mask to \
-		    any port=$6 head port$6 | \
-		    /sbin/ipf -I -r -f - -s >/dev/null 2>&1 && echo OK
-		;;
-	ipfw)
-		/sbin/ipfw table "port$6" delete "$addr/$mask" 2>/dev/null && \
-		    echo OK
-		;;
-	npf)
-		/sbin/npfctl rule "$2" rem-id "$7"
-		;;
-	pf)
-		/sbin/pfctl -qa "$2/$6" -t "port$6" -T delete "$addr/$mask" && \
-		    echo OK
-		;;
-	esac
-	;;
-flush)
-	case "$pf" in
-	ipf)
-		/sbin/ipf -Z -I -Fi -s > /dev/null && echo OK
-		;;
-	ipfw)
-		/sbin/ipfw table "port$6" flush 2>/dev/null && echo OK
-		;;
-	npf)
-		/sbin/npfctl rule "$2" flush
-		;;
-	pf)
-		# dynamically determine which anchors exist
-		for anchor in $(/sbin/pfctl -a "$2" -s Anchors); do
-			/sbin/pfctl -a $anchor -t "port${anchor##*/}" -T flush
-			/sbin/pfctl -a $anchor -F rules
-		done
-		echo OK
-		;;
-	esac
-	;;
-*)
-	echo "$0: Unknown command '$1'" 1>&2
-	exit 1
-	;;
-esac

contrib/blocklist/libexec/blocklistd-helper

@@ -0,0 +1,272 @@
+#!/bin/sh
+#echo "run $@" 1>&2
+#set -x
+# $1 command
+# $2 rulename
+# $3 protocol
+# $4 address
+# $5 mask
+# $6 port
+# $7 id
+
+pf=
+if [ -f "/etc/ipfw-blocklist.rc" ]; then
+	pf="ipfw"
+	. /etc/ipfw-blocklist.rc
+	ipfw_offset=${ipfw_offset:-2000}
+fi
+
+if [ -z "$pf" ]; then
+	for f in npf pf ipfilter ipfw; do
+		if [ -x /etc/rc.d/$f ]; then
+			if /etc/rc.d/$f status >/dev/null 2>&1; then
+				pf="$f"
+				break
+			fi
+		elif [ -f "/etc/$f.conf" ]; then
+			# xxx assume a config file means it can be enabled --
+			# and the first one wins!
+			pf="$f"
+			break
+		fi
+	done
+fi
+
+if [ -z "$pf" -a -x "/sbin/iptables" ]; then
+	pf="iptables"
+fi
+
+if [ -z "$pf" ]; then
+	echo "$0: Unsupported packet filter" 1>&2
+	exit 1
+fi
+
+flags=
+if [ -n "$3" ]; then
+	raw_proto="$3"
+	proto="proto $3"
+	if [ $3 = "tcp" ]; then
+		flags="flags S/SAFR"
+	fi
+fi
+
+if [ -n "$6" ]; then
+	raw_port="$6"
+	port="port $6"
+fi
+
+addr="$4"
+mask="$5"
+case "$4" in
+::ffff:*.*.*.*)
+	if [ "$5" = 128 ]; then
+		mask=32
+		addr=${4#::ffff:}
+	fi;;
+esac
+
+case "$1" in
+add)
+	case "$pf" in
+	ipfilter)
+		# N.B.:  If you reload /etc/ipf.conf then you need to stop and
+		# restart blocklistd (and make sure blocklistd_flags="-r").
+		# This should normally already be implemented in
+		# /etc/rc.d/ipfilter, but if then not add the following lines to
+		# the end of the ipfilter_reload() function:
+		#
+		#	if checkyesnox blocklistd; then
+		#		/etc/rc.d/blocklistd restart
+		#	fi
+		#
+		# XXX we assume the following rule is present in /etc/ipf.conf:
+		# (should we check? -- it probably cannot be added dynamically)
+		#
+		#	block in proto tcp/udp from any to any head blocklistd
+		#
+		# where "blocklistd" is the default rulename (i.e. "$2")
+		#
+		# This rule can come before any rule that logs connections,
+		# etc., and should be followed by final rules such as:
+		#
+		#	# log all as-yet unblocked incoming TCP connection
+		#	# attempts
+		#	log in proto tcp from any to any flags S/SAFR
+		#	# last "pass" match wins for all non-blocked packets
+		#	pass in all
+		#	pass out all
+		#
+		# I.e. a "pass" rule which will be the final match and override
+		# the "block".  This way the rules added by blocklistd will
+		# actually block packets, and prevent logging of them as
+		# connections, because they include the "quick" flag.
+		#
+		# N.b.:  $port is not included/used in rules -- abusers are cut
+		# off completely from all services!
+		#
+		# Note RST packets are not returned for blocked SYN packets of
+		# active attacks, so the port will not appear to be closed.
+		# This will probably give away the fact that a firewall has been
+		# triggered to block connections, but it prevents generating
+		# extra outbound traffic, and it may also slow down the attacker
+		# somewhat.
+		#
+		# Note also that we don't block all packets, just new attempts
+		# to open connections (see $flags above).  This allows us to do
+		# counterespionage against the attacker (or continue to make use
+		# of any other services that might be on the same subnet as the
+		# supposed attacker).  However it does not kill any active
+		# connections -- we rely on the reporting daemon to do its own
+		# protection and cleanup.
+		#
+		# N.B.:  The rule generated here must exactly match the
+		# corresponding rule generated for the "rem" command below!
+		#
+		echo block in log quick $proto \
+		    from $addr/$mask to any $flags group $2 | \
+		    /sbin/ipf -A -f - >/dev/null 2>&1 && echo OK
+		;;
+
+	ipfw)
+		# use $ipfw_offset+$port for rule number
+		rule=$(($ipfw_offset + $6))
+		tname="port$6"
+		/sbin/ipfw table $tname create type addr 2>/dev/null
+		/sbin/ipfw -q table $tname add "$addr/$mask"
+		# if rule number $rule does not already exist, create it
+		/sbin/ipfw show $rule >/dev/null 2>&1 || \
+			/sbin/ipfw add $rule drop $3 from \
+			table"("$tname")" to any dst-port $6 >/dev/null && \
+			echo OK
+		;;
+
+	iptables)
+		if ! /sbin/iptables --list "$2" >/dev/null 2>&1; then
+			/sbin/iptables --new-chain "$2"
+		fi
+		/sbin/iptables --append INPUT --proto "$raw_proto" \
+		    --dport "$raw_port" --jump "$2"
+		/sbin/iptables --append "$2" --proto "$raw_proto" \
+		    --source "$addr/$mask" --dport "$raw_port" --jump DROP
+		echo OK
+		;;
+
+	npf)
+		/sbin/npfctl rule "$2" add block in final $proto from \
+		    "$addr/$mask" to any $port
+		;;
+
+	pf)
+		# if the filtering rule does not exist, create it
+		/sbin/pfctl -a "$2/$6" -sr 2>/dev/null | \
+		    grep -q "<port$6>" || \
+		    echo "block in quick $proto from <port$6> to any $port" | \
+		    /sbin/pfctl -a "$2/$6" -f -
+		# insert $ip/$mask into per-protocol/port anchored table
+		/sbin/pfctl -qa "$2/$6" -t "port$6" -T add "$addr/$mask" && \
+		    /sbin/pfctl -qk "$addr" && echo OK
+		;;
+
+	esac
+	;;
+rem)
+	case "$pf" in
+	ipfilter)
+		# N.B.:  The rule generated here must exactly match the
+		# corresponding rule generated for the "add" command above!
+		#
+		echo block in log quick $proto \
+		    from $addr/$mask to any $flags group $2 | \
+		    /sbin/ipf -A -r -f - >/dev/null 2>&1 && echo OK
+		;;
+
+	ipfw)
+		/sbin/ipfw table "port$6" delete "$addr/$mask" 2>/dev/null && \
+		    echo OK
+		;;
+
+	iptables)
+		if /sbin/iptables --list "$2" >/dev/null 2>&1; then
+			/sbin/iptables --delete "$2" --proto "$raw_proto" \
+			    --source "$addr/$mask" --dport "$raw_port" \
+			    --jump DROP
+		fi
+		echo OK
+		;;
+
+	npf)
+		/sbin/npfctl rule "$2" rem-id "$7"
+		;;
+
+	pf)
+		/sbin/pfctl -qa "$2/$6" -t "port$6" -T delete "$addr/$mask" && \
+		    echo OK
+		;;
+
+	esac
+	;;
+flush)
+	case "$pf" in
+	ipfilter)
+		#
+		# N.B. WARNING:  This is obviously not reentrant!
+		#
+		# First we flush all the rules from the inactive set, then we
+		# reload the ones that do not belong to the group "$2", and
+		# finally we swap the active and inactive rule sets.
+		#
+		/sbin/ipf -I -F a
+		#
+		# "ipf -I -F a" also flushes active accounting rules!
+		#
+		# Note that accounting rule groups are unique to accounting
+		# rules and have nothing to do with filter rules, though of
+		# course theoretically one could use the same group name for
+		# them too.
+		#
+		# In theory anyone using any such accounting rules should have a
+		# wrapper /etc/rc.conf.d/blocklistd script (and corresponding
+		# /etc/rc.conf.d/ipfilter script) that will record and
+		# consolidate the values accumulated by such accounting rules
+		# before they are flushed, since otherwise their counts will be
+		# lost forever.
+		#
+		/usr/sbin/ipfstat -io | fgrep -v "group $2" | \
+		    /sbin/ipf -I -f - >/dev/null 2>&1
+		#
+		# This MUST be done last and separately as "-s" is executed
+		# _while_ the command arguments are being processed!
+		#
+		/sbin/ipf -s && echo OK
+		;;
+
+	ipfw)
+		/sbin/ipfw table "port$6" flush 2>/dev/null && echo OK
+		;;
+
+	iptables)
+		if /sbin/iptables --list "$2" >/dev/null 2>&1; then
+			/sbin/iptables --flush "$2"
+		fi
+		echo OK
+		;;
+
+	npf)
+		/sbin/npfctl rule "$2" flush
+		;;
+
+	pf)
+		# dynamically determine which anchors exist
+		for anchor in $(/sbin/pfctl -a "$2" -s Anchors 2> /dev/null); do
+			/sbin/pfctl -a "$anchor" -t "port${anchor##*/}" -T flush 2> /dev/null
+			/sbin/pfctl -a "$anchor" -F rules
+		done
+		echo OK
+		;;
+	esac
+	;;
+*)
+	echo "$0: Unknown command '$1'" 1>&2
+	exit 1
+	;;
+esac

contrib/blocklist/port/Makefile.am

@@ -1,25 +1,39 @@
 #
 ACLOCAL_AMFLAGS = -I m4
-lib_LTLIBRARIES = libblacklist.la
-include_HEADERS = ../include/blacklist.h
+lib_LTLIBRARIES = libblocklist.la
+include_HEADERS = $(srcdir)/../include/blocklist.h
 
-bin_PROGRAMS = blacklistd blacklistctl srvtest cltest
+exampledir = $(datarootdir)/examples
+example_DATA = $(srcdir)/../etc/blocklistd.conf $(srcdir)/../etc/npf.conf $(srcdir)/../etc/ipf.conf
 
-VPATH = ../bin:../lib:../test:../include
+sbin_PROGRAMS = blocklistd blocklistctl
+noinst_PROGRAMS = srvtest cltest
+libexec_SCRIPTS = $(srcdir)/../libexec/blocklistd-helper
 
-AM_CPPFLAGS = -I../include  -DDOT="."
+man5_MANS = $(srcdir)/../bin/blocklistd.conf.5
+man8_MANS = $(srcdir)/../bin/blocklistd.8 $(srcdir)/../bin/blocklistctl.8
+
+VPATH = $(srcdir)/../port:$(srcdir)/../bin:$(srcdir)/../lib:$(srcdir)/../test:$(srcdir)/../include
+
+AM_CPPFLAGS = -I$(srcdir)/../include  -DDOT="."
+AM_CPPFLAGS += -D_PATH_BLCONF=\"$(sysconfdir)/blocklistd.conf\"
+AM_CPPFLAGS += -D_PATH_BLCONTROL=\"$(libexecdir)/blocklistd-helper\"
+AM_CPPFLAGS += -D_PATH_BLSOCK=\"$(runstatedir)/blocklistd.sock\"
+AM_CPPFLAGS += -D_PATH_BLSTATE=\"$(localstatedir)/db/blocklistd.db\"
+AM_CPPFLAGS += -std=c99 -D_POSIX_C_SOURCE=200809L -D__EXTENSIONS__
+AM_CPPFLAGS += -D__BSD_VISIBLE=1
 AM_CFLAGS = @WARNINGS@
 
-libblacklist_la_SOURCES = bl.c blacklist.c
-libblacklist_la_LDFLAGS = -no-undefined -version-info 0:0:0
-libblacklist_la_LIBADD = $(LTLIBOBJS)
+libblocklist_la_SOURCES = bl.c blocklist.c
+libblocklist_la_LDFLAGS = -no-undefined -version-info 0:0:0
+libblocklist_la_LIBADD = $(LTLIBOBJS)
 
 SRCS = internal.c support.c run.c conf.c state.c
-blacklistd_SOURCES = blacklistd.c ${SRCS}
-blacklistd_LDADD = libblacklist.la
-blacklistctl_SOURCES = blacklistctl.c ${SRCS}
-blacklistctl_LDADD = libblacklist.la
+blocklistd_SOURCES = blocklistd.c ${SRCS}
+blocklistd_LDADD = libblocklist.la
+blocklistctl_SOURCES = blocklistctl.c ${SRCS}
+blocklistctl_LDADD = libblocklist.la
 srvtest_SOURCES = srvtest.c ${SRCS}
-srvtest_LDADD = libblacklist.la
+srvtest_LDADD = libblocklist.la
 cltest_SOURCES = cltest.c ${SRCS}
-cltest_LDADD = libblacklist.la
+cltest_LDADD = libblocklist.la

contrib/blocklist/port/_strtoi.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: _strtoi.h,v 1.1 2015/01/22 02:15:59 christos Exp $	*/
+/*	$NetBSD: _strtoi.h,v 1.1.1.1 2020/06/15 01:52:53 christos Exp $	*/
 
 /*-
  * Copyright (c) 1990, 1993

contrib/blocklist/port/configure.ac

@@ -1,5 +1,5 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_INIT([blacklistd],[0.1],[[email protected]])
+AC_INIT([blocklistd],[0.1],[[email protected]])
 AM_INIT_AUTOMAKE([subdir-objects foreign])
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
@@ -7,9 +7,10 @@ AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 
 AC_SUBST(WARNINGS)
+AC_SUBST(LINK_NTOA)
 
 dnl Checks for programs.
-AC_PROG_CC_STDC
+AC_PROG_CC
 AC_USE_SYSTEM_EXTENSIONS
 AM_PROG_CC_C_O
 AC_C_BIGENDIAN
@@ -18,18 +19,19 @@ AC_PROG_LN_S
 LT_INIT([disable-static pic-only])
 gl_VISIBILITY
 dnl Checks for headers
-AC_HEADER_STDC
 AC_HEADER_MAJOR
 AC_HEADER_SYS_WAIT
 AC_CHECK_HEADERS(stdint.h fcntl.h stdint.h inttypes.h unistd.h)
 AC_CHECK_HEADERS(sys/un.h sys/socket.h limits.h)
 AC_CHECK_HEADERS(arpa/inet.h getopt.h err.h)
 AC_CHECK_HEADERS(sys/types.h util.h sys/time.h time.h)
-AC_CHECK_HEADERS(netatalk/at.h net/if_dl.h db.h db_185.h)
+AC_CHECK_HEADERS(netatalk/at.h db.h db_185.h)
+AC_CHECK_HEADERS(sys/cdefs.h)
 AC_CHECK_LIB(rt, clock_gettime)
 AC_CHECK_LIB(db, __db185_open)
 AC_CHECK_LIB(util, pidfile)
 AC_CHECK_LIB(util, sockaddr_snprintf)
+AC_SEARCH_LIBS(__xnet_connect, socket)
 
 AH_BOTTOM([
 #ifndef __NetBSD__
@@ -82,7 +84,7 @@ dnl Checks for functions
 AC_CHECK_FUNCS(strerror)
 
 dnl Provide implementation of some required functions if necessary
-AC_REPLACE_FUNCS(strtoi sockaddr_snprintf popenve clock_gettime strlcpy strlcat getprogname fparseln fgetln pidfile)
+AC_REPLACE_FUNCS(strtoi sockaddr_snprintf popenve clock_gettime strlcpy strlcat getprogname fparseln fgetln pidfile vsyslog_r)
 
 dnl See if we are cross-compiling
 AM_CONDITIONAL(IS_CROSS_COMPILE, test "$cross_compiling" = yes)

contrib/blocklist/port/fgetln.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: fgetln.c,v 1.1 2015/01/22 03:48:07 christos Exp $	*/
+/*	$NetBSD: fgetln.c,v 1.1.1.1 2020/06/15 01:52:54 christos Exp $	*/
 
 /*-
  * Copyright (c) 1998 The NetBSD Foundation, Inc.

contrib/blocklist/port/fparseln.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: fparseln.c,v 1.1 2015/01/22 03:48:07 christos Exp $	*/
+/*	$NetBSD: fparseln.c,v 1.2 2025/02/11 17:48:30 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Christos Zoulas.  All rights reserved.
@@ -27,9 +27,11 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
+#endif
 #if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: fparseln.c,v 1.1 2015/01/22 03:48:07 christos Exp $");
+__RCSID("$NetBSD: fparseln.c,v 1.2 2025/02/11 17:48:30 christos Exp $");
 #endif /* LIBC_SCCS and not lint */
 
 #include <assert.h>

contrib/blocklist/port/pidfile.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: pidfile.c,v 1.2 2016/04/05 12:28:57 christos Exp $	*/
+/*	$NetBSD: pidfile.c,v 1.2 2025/02/11 17:48:30 christos Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -32,9 +32,11 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
+#endif
 #if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: pidfile.c,v 1.2 2016/04/05 12:28:57 christos Exp $");
+__RCSID("$NetBSD: pidfile.c,v 1.2 2025/02/11 17:48:30 christos Exp $");
 #endif
 
 #include <sys/param.h>

contrib/blocklist/port/popenve.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: popenve.c,v 1.2 2015/01/22 03:10:50 christos Exp $	*/
+/*	$NetBSD: popenve.c,v 1.2 2025/02/11 17:48:30 christos Exp $	*/
 
 /*
  * Copyright (c) 1988, 1993
@@ -36,12 +36,14 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
+#endif
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
 static char sccsid[] = "@(#)popen.c	8.3 (Berkeley) 5/3/95";
 #else
-__RCSID("$NetBSD: popenve.c,v 1.2 2015/01/22 03:10:50 christos Exp $");
+__RCSID("$NetBSD: popenve.c,v 1.2 2025/02/11 17:48:30 christos Exp $");
 #endif
 #endif /* LIBC_SCCS and not lint */
 

contrib/blocklist/port/port.h

@@ -1,6 +1,7 @@
 #ifndef _GNU_SOURCE
 #define _GNU_SOURCE
 #endif
+#include <sys/param.h>
 #include <stdio.h>
 #include <inttypes.h>
 #include <time.h>
@@ -15,6 +16,22 @@
 #define __dead __attribute__((__noreturn__))
 #endif
 
+#ifndef __BEGIN_DECLS
+#define __BEGIN_DECLS
+#endif
+
+#ifndef __END_DECLS
+#define __END_DECLS
+#endif
+
+#ifndef MIN
+#define MIN(a,b) ((a) < (b) ? (a) : (b))
+#endif
+
+#ifndef MAX
+#define MAX(a,b) ((a) > (b) ? (a) : (b))
+#endif
+
 #ifndef __RCSID
 #define __RCSID(a)
 #endif
@@ -27,6 +44,10 @@
 #define __arraycount(a) (sizeof(a) / sizeof(a[0]))
 #endif
 
+#ifndef __STRING
+#define __STRING(x)	#x
+#endif
+
 #ifndef HAVE_STRLCPY
 size_t strlcpy(char *, const char *, size_t);
 #endif
@@ -78,9 +99,10 @@ int clock_gettime(int, struct timespec *);
 #define CLOCK_REALTIME 0
 #endif
 
-#if !defined(__FreeBSD__)
-#define _PATH_BLCONF "conf"
-#define _PATH_BLCONTROL "control"
-#define _PATH_BLSOCK "blacklistd.sock"
-#define _PATH_BLSTATE "blacklistd.db"
+#ifndef HAVE_VSYSLOG_R
+#define	SYSLOG_DATA_INIT	{ 0 }
+struct syslog_data {
+        int dummy;
+};
+void vsyslog_r(int, struct syslog_data *, const char *, va_list);
 #endif

contrib/blocklist/port/sockaddr_snprintf.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: sockaddr_snprintf.c,v 1.11 2016/06/01 22:57:51 christos Exp $	*/
+/*	$NetBSD: sockaddr_snprintf.c,v 1.2 2025/02/11 17:48:30 christos Exp $	*/
 
 /*-
  * Copyright (c) 2004 The NetBSD Foundation, Inc.
@@ -32,9 +32,11 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
+#endif
 #if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: sockaddr_snprintf.c,v 1.11 2016/06/01 22:57:51 christos Exp $");
+__RCSID("$NetBSD: sockaddr_snprintf.c,v 1.2 2025/02/11 17:48:30 christos Exp $");
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/param.h>

contrib/blocklist/port/strlcat.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: strlcat.c,v 1.2 2015/01/22 03:48:07 christos Exp $	*/
+/*	$NetBSD: strlcat.c,v 1.2 2025/02/11 17:48:30 christos Exp $	*/
 /*	$OpenBSD: strlcat.c,v 1.10 2003/04/12 21:56:39 millert Exp $	*/
 
 /*
@@ -22,9 +22,12 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
+#endif
+
 #if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: strlcat.c,v 1.2 2015/01/22 03:48:07 christos Exp $");
+__RCSID("$NetBSD: strlcat.c,v 1.2 2025/02/11 17:48:30 christos Exp $");
 #endif /* LIBC_SCCS and not lint */
 
 #ifdef _LIBC

contrib/blocklist/port/strlcpy.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: strlcpy.c,v 1.2 2015/01/22 03:48:07 christos Exp $	*/
+/*	$NetBSD: strlcpy.c,v 1.2 2025/02/11 17:48:30 christos Exp $	*/
 /*	$OpenBSD: strlcpy.c,v 1.7 2003/04/12 21:56:39 millert Exp $	*/
 
 /*
@@ -22,9 +22,12 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
+#endif
+
 #if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: strlcpy.c,v 1.2 2015/01/22 03:48:07 christos Exp $");
+__RCSID("$NetBSD: strlcpy.c,v 1.2 2025/02/11 17:48:30 christos Exp $");
 #endif /* LIBC_SCCS and not lint */
 
 #ifdef _LIBC

contrib/blocklist/port/strtoi.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: strtoi.c,v 1.3 2015/01/22 03:10:50 christos Exp $	*/
+/*	$NetBSD: strtoi.c,v 1.2 2025/02/11 17:48:31 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 The DragonFly Project.  All rights reserved.
@@ -33,8 +33,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: strtoi.c,v 1.3 2015/01/22 03:10:50 christos Exp $");
+#endif
+__RCSID("$NetBSD: strtoi.c,v 1.2 2025/02/11 17:48:31 christos Exp $");
 
 #if defined(_KERNEL)
 #include <sys/param.h>

contrib/blocklist/port/vsyslog_r.c

@@ -0,0 +1,13 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <syslog.h>
+#include <stdarg.h>
+
+void
+vsyslog_r(int priority, struct syslog_data *sd __unused, const char *fmt, va_list ap)
+{
+	vsyslog(priority, fmt, ap);
+}
+

contrib/blocklist/test/Makefile

@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.3 2015/05/30 22:40:38 christos Exp $
+# $NetBSD: Makefile,v 1.1.1.1 2020/06/15 01:52:54 christos Exp $
 
 MKMAN=no
 

contrib/blocklist/test/cltest.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: cltest.c,v 1.6 2015/01/22 05:44:28 christos Exp $	*/
+/*	$NetBSD: cltest.c,v 1.2 2025/02/11 17:48:31 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: cltest.c,v 1.6 2015/01/22 05:44:28 christos Exp $");
+#endif
+__RCSID("$NetBSD: cltest.c,v 1.2 2025/02/11 17:48:31 christos Exp $");
 
 #include <sys/types.h> 
 #include <sys/socket.h>

contrib/blocklist/test/srvtest.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: srvtest.c,v 1.10 2015/05/30 22:40:38 christos Exp $	*/
+/*	$NetBSD: srvtest.c,v 1.2 2025/02/11 17:43:16 christos Exp $	*/
 
 /*-
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
@@ -32,8 +32,10 @@
 #include "config.h"
 #endif
 
+#ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: srvtest.c,v 1.10 2015/05/30 22:40:38 christos Exp $");
+#endif
+__RCSID("$NetBSD: srvtest.c,v 1.2 2025/02/11 17:43:16 christos Exp $");
 
 #include <sys/types.h> 
 #include <sys/socket.h>
@@ -48,7 +50,7 @@ __RCSID("$NetBSD: srvtest.c,v 1.10 2015/05/30 22:40:38 christos Exp $");
 #include <poll.h>
 #include <err.h>
 
-#include "blacklist.h"
+#include "blocklist.h"
 #ifdef BLDEBUG
 #include "bl.h"
 static void *b;
@@ -71,9 +73,9 @@ process_tcp(int afd)
 	buffer[sizeof(buffer) - 1] = '\0';
 	printf("%s: sending %d %s\n", getprogname(), afd, buffer);
 #ifdef BLDEBUG
-	blacklist_r(b, 1, afd, buffer);
+	blocklist_r(b, 1, afd, buffer);
 #else
-	blacklist(1, afd, buffer);
+	blocklist(1, afd, buffer);
 #endif
 	exit(0);
 }
@@ -95,7 +97,7 @@ process_udp(int afd)
 		err(1, "recvfrom");
 	buffer[sizeof(buffer) - 1] = '\0';
 	printf("%s: sending %d %s\n", getprogname(), afd, buffer);
-	blacklist_sa(1, afd, (void *)&ss, slen, buffer);
+	blocklist_sa(1, afd, (void *)&ss, slen, buffer);
 	exit(0);
 }
 static int
@@ -167,7 +169,11 @@ static __dead void
 usage(int c)
 {
 	warnx("Unknown option `%c'", (char)c);
-	fprintf(stderr, "Usage: %s [-u] [-p <num>]\n", getprogname());
+	fprintf(stderr, "Usage: %s [-u] [-p <num>]"
+#ifdef BLDEBUG
+	    " [-s <sockpath>]"
+#endif
+	    "\n", getprogname());
 	exit(EXIT_FAILURE);
 }
 
@@ -182,14 +188,16 @@ main(int argc, char *argv[])
 	struct pollfd pfd[NUMFD];
 	int type = SOCK_STREAM, c;
 	in_port_t port = 6161;
+#ifdef BLDEBUG
+	char *sockpath = "blsock";
+	const char *optstr = "up:s:";
+#else
+	const char *optstr = "up:";
+#endif
 
 	signal(SIGCHLD, SIG_IGN);
 
-#ifdef BLDEBUG
-	b = bl_create(false, "blsock", vsyslog);
-#endif
-
-	while ((c = getopt(argc, argv, "up:")) != -1)
+	while ((c = getopt(argc, argv, optstr)) != -1)
 		switch (c) {
 		case 'u':
 			type = SOCK_DGRAM;
@@ -197,10 +205,20 @@ main(int argc, char *argv[])
 		case 'p':
 			port = (in_port_t)atoi(optarg);
 			break;
+#ifdef BLDEBUG
+		case 's':
+			sockpath = (char *)optarg;
+			break;
+#endif
 		default:
 			usage(c);
 		}
 
+#ifdef BLDEBUG
+	b = bl_create(false, sockpath, vsyslog_r);
+#endif
+
+
 	pfd[0].fd = cr(AF_INET, type, port);
 	pfd[0].events = POLLIN;
 #if NUMFD > 1

contrib/bsddialog/.gitignore

@@ -21,6 +21,7 @@ examples_library/msgbox
 examples_library/pause
 examples_library/radiolist
 examples_library/rangebox
+examples_library/textbox
 examples_library/theme
 examples_library/timebox
 examples_library/yesno

contrib/bsddialog/CHANGELOG

@@ -1,11 +1,57 @@
-2024-07-01 1.0.4
+2025-06-22 Version 1.0.5
+
+	Manual:
+	* fix: "User-friendly documentation for alternate screen"
+	  https://bugs.freebsd.org/285459.
+	  Improve bsddialog.1: --alternate-screen and --normal-screen.
+
+	NetBSD (tested on amd64) refactoring, no function changes:
+	* https://gitlab.com/alfix/bsddialog/-/merge_requests/4
+	  lib: include <stdarg.h> in lib_util.c.
+	* https://gitlab.com/alfix/bsddialog/-/merge_requests/5
+	  a call to curses' refresh() is performed, while a local
+	  variable is also called refresh.
+	* Makefiles: add install and uninstall targets (both GND and BSD)
+	  https://gitlab.com/alfix/bsddialog/-/merge_requests/3
+
+	MacOS (tested on amd64) refactoring, no function changes:
+	* https://gitlab.com/alfix/bsddialog/-/merge_requests/6
+	  utility: replace u_int with unsigned int.
+
+	Library:
+	* fix: useless refreshes, https://gitlab.com/alfix/bsddialog/-/issues/8:
+	  "It takes lot of time when running over a 115200 UART".
+	  Not fixed for bsddialog_gauge() because it has to be rewritten.
+	* change: bsddialog_backtitle() does not update the screen so the
+	  backtitle is not printed. To use if a dialog is built later.
+	  Rationale: see "115200 UART" problem above.
+	* add: bsddialog_backtitle_rf() to print a top title refreshing the
+	  screen like bsddialog_backtitle() was previously.
+	* change: forms, ENTER is also a navigation keys in forms fields.
+	  Request: https://bugs.freebsd.org/287592
+	  If conf.button.always_active is true the form is closes immediatly.
+
+	Library and implicitly utility:
+	* fix: textbox buttons returned values (was always OK).
+	  Thanks to https://reviews.freebsd.org/D48668.
+	* change: TAB is a navigation keys in forms. Previously it directly
+	  switched form-fields <-> buttons.
+	  Request: https://bugs.freebsd.org/287592
+
+	Utility:
+	* change: forms, ENTER is a also navigation keys in forms fields.
+	  Previously it directly closed the form except with --switch-buttons
+	  Request: https://bugs.freebsd.org/287592
+
+
+2024-07-01 Version 1.0.4
 
 	Utility internal refactoring (no functional change):
 	* change: rename an internal constant to avoid a future conflict
 	    because FreeBSD is changing headers files for _FORTIFY_SOURCE.
 	    Reported and fixed by Kyle Evans.
 
-2024-05-27 1.0.3
+2024-05-27 Version 1.0.3
 
 	Utility:
 	change: --form and --mixedform do not print field value to output fd if

contrib/bsddialog/LICENSE

@@ -1,6 +1,6 @@
 BSD 2-Clause License
 
-Copyright (c) 2021-2024, Alfonso Sabato Siciliano
+Copyright (c) 2021-2025, Alfonso Sabato Siciliano
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:

contrib/bsddialog/Makefile

@@ -4,7 +4,7 @@
 # Written in 2023 by Alfonso Sabato Siciliano
 
 OUTPUT = bsddialog
-export VERSION=1.0.4
+export VERSION=1.0.5
 .CURDIR ?= ${CURDIR}
 LIBPATH = ${.CURDIR}/lib
 LIBBSDDIALOG = ${LIBPATH}/libbsddialog.so
@@ -22,7 +22,15 @@ DEBUG ?=
 export ENABLEDEBUG=${DEBUG}
 ###################
 
-all : ${OUTPUT}
+all: ${OUTPUT}
+
+install: all
+	${MAKE} -C ${LIBPATH} install
+	${MAKE} -C ${UTILITYPATH} install
+
+uninstall:
+	${MAKE} -C ${UTILITYPATH} uninstall
+	${MAKE} -C ${LIBPATH} uninstall
 
 ${OUTPUT}: ${LIBBSDDIALOG}
 	${MAKE} -C ${UTILITYPATH} LIBPATH=${LIBPATH}
@@ -36,3 +44,4 @@ clean:
 	${MAKE} -C ${UTILITYPATH} clean
 	${RM} ${OUTPUT} *.core
 
+.PHONY: all install uninstall clean

contrib/bsddialog/README.md

@@ -1,4 +1,4 @@
-# BSDDialog 1.0.4
+# BSDDialog 1.0.5
 
 This project provides **bsddialog** and **libbsddialog**, an utility
 and a library to build scripts and tools with TUI dialogs and widgets.
@@ -129,7 +129,6 @@ in the _Public Domain_ to build new projects:
  - implement global buttons handler.
  - doc: external tutorial, theming guide.
  - implement menutype.min\_on.
- - improve refresh at startup, avoid dialog refresh before drawing text.
  - add debug API: bsddialog\_debug(y,x,refresh,"fmt",...).
  - add mouse support.
  - use alarm(2) for bsddialog\_pause.
@@ -139,4 +138,4 @@ in the _Public Domain_ to build new projects:
  - fix --mixedform "" 0 0 0 Label 1 0 Init 1 12 0 0 2 (with 0 editable field).
  - add *text* customization to --hmsg *help-message*
  - check --passwordform *fieldlen* like --form and --mixedform.
-
+ - add manuals to Makefiles installe and uninstall targets.

contrib/bsddialog/examples_library/compile

@@ -8,14 +8,16 @@
 # worldwide. This software is distributed without any warranty, see:
 #     <http://creativecommons.org/publicdomain/zero/1.0/>.
 
+set -x
+
 libpath=../lib
 examples="menu checklist radiolist mixedlist theme infobox yesno msgbox \
-	datebox form timebox rangebox pause calendar gauge mixedgauge"
+datebox form timebox rangebox pause calendar gauge mixedgauge textbox"
 
 rm -f $examples
 
 for e in $examples
 do
-	cc -g -Wall -Wextra -I$libpath ${e}.c -o $e -L$libpath -lbsddialog \
-	-Wl,-rpath=$libpath
+	cc -g -Wall -Wextra -I$libpath ${e}.c -o $e \
+	-Wl,-rpath=$libpath -L$libpath -lbsddialog
 done

contrib/bsddialog/examples_library/textbox.c

@@ -0,0 +1,38 @@
+/*-
+ * SPDX-License-Identifier: CC0-1.0
+ *
+ * Written in 2025 by Alfonso Sabato Siciliano.
+ * To the extent possible under law, the author has dedicated all copyright
+ * and related and neighboring rights to this software to the public domain
+ * worldwide. This software is distributed without any warranty, see:
+ *   <http://creativecommons.org/publicdomain/zero/1.0/>.
+ */
+
+#include <bsddialog.h>
+#include <stdio.h>
+
+int main()
+{
+	int output;
+	struct bsddialog_conf conf;
+
+	if (bsddialog_init() == BSDDIALOG_ERROR) {
+		printf("Error: %s\n", bsddialog_geterror());
+		return (1);
+	}
+	bsddialog_initconf(&conf);
+	conf.title = "textbox";
+	output = bsddialog_textbox(&conf, "./textbox.c", 20, 80);
+	bsddialog_end();
+
+	switch (output) {
+	case BSDDIALOG_ERROR:
+		printf("Error %s\n", bsddialog_geterror());
+		return (1);
+	case BSDDIALOG_OK:
+		printf("[Exit]\n");
+		break;
+	}
+
+	return (0);
+}

contrib/bsddialog/lib/GNUmakefile

@@ -9,6 +9,7 @@ HEADERS = bsddialog.h bsddialog_theme.h bsddialog_progressview.h
 SOURCES = barbox.c datebox.c formbox.c libbsddialog.c lib_util.c \
 	menubox.c messagebox.c textbox.c theme.c timebox.c
 OBJECTS = $(SOURCES:.c=.o)
+PREFIX = /usr/local
 
 ifneq ($(ENABLEDEBUG),)
 CFLAGS += -g
@@ -21,7 +22,21 @@ LIBFLAG = -shared
 RM = rm -f
 LN = ln -s -f
 
-all : $(LIBRARY)
+all: $(LIBRARY)
+
+install: all
+	${INSTALL} -m 0644 bsddialog.h ${DESTDIR}${PREFIX}/include/bsddialog.h
+	${INSTALL} -m 0644 bsddialog_progressview.h ${DESTDIR}${PREFIX}/include/bsddialog_progressview.h
+	${INSTALL} -m 0644 bsddialog_theme.h ${DESTDIR}${PREFIX}/include/bsddialog_theme.h
+	${INSTALL} -m 0755 ${LIBRARY_SO}.${VERSION} ${DESTDIR}${PREFIX}/lib/${LIBRARY_SO}.${VERSION}
+	${LN} ${LIBRARY_SO}.${VERSION} ${DESTDIR}${PREFIX}/lib/${LIBRARY_SO}
+
+uninstall:
+	${RM} ${DESTDIR}${PREFIX}/include/bsddialog.h
+	${RM} ${DESTDIR}${PREFIX}/include/bsddialog_progressview.h
+	${RM} ${DESTDIR}${PREFIX}/include/bsddialog_theme.h
+	${RM} ${DESTDIR}${PREFIX}/lib/${LIBRARY_SO}.${VERSION}
+	${RM} ${DESTDIR}${PREFIX}/lib/${LIBRARY_SO}
 
 $(LIBRARY): $(OBJECTS)
 	$(CC) $(LIBFLAG) $^ -o $(LIBRARY_SO).$(VERSION) $(LDFLAGS)
@@ -32,3 +47,5 @@ $(LIBRARY): $(OBJECTS)
 
 clean:
 	$(RM) $(LIBRARY_SO)* *.o *~
+
+.PHONY: all install uninstall ${LIBRARY} clean

contrib/bsddialog/lib/Makefile

@@ -10,6 +10,7 @@ HEADERS = bsddialog.h bsddialog_theme.h bsddialog_progressview.h
 SOURCES = barbox.c datebox.c formbox.c libbsddialog.c lib_util.c \
 	menubox.c messagebox.c textbox.c theme.c timebox.c
 OBJECTS = ${SOURCES:.c=.o}
+PREFIX = /usr/local
 
 .if defined(DEBUG)
 CFLAGS += -g
@@ -23,7 +24,23 @@ LDFLAGS += -fstack-protector-strong -shared -Wl,-x -Wl,--fatal-warnings \
 LN = ln -s -f
 RM = rm -f
 
-all : ${LIBRARY}
+all: ${LIBRARY}
+
+install: all
+	${INSTALL} -m 0644 bsddialog.h ${DESTDIR}${PREFIX}/include/bsddialog.h
+	${INSTALL} -m 0644 bsddialog_progressview.h ${DESTDIR}${PREFIX}/include/bsddialog_progressview.h
+	${INSTALL} -m 0644 bsddialog_theme.h ${DESTDIR}${PREFIX}/include/bsddialog_theme.h
+	${INSTALL} -m 0644 ${LIBRARY_A} ${DESTDIR}${PREFIX}/lib/${LIBRARY_A}
+	${INSTALL} -m 0755 ${LIBRARY_SO}.${VERSION} ${DESTDIR}${PREFIX}/lib/${LIBRARY_SO}.${VERSION}
+	${LN} ${LIBRARY_SO}.${VERSION} ${DESTDIR}${PREFIX}/lib/${LIBRARY_SO}
+
+uninstall:
+	${RM} ${DESTDIR}${PREFIX}/include/bsddialog.h
+	${RM} ${DESTDIR}${PREFIX}/include/bsddialog_progressview.h
+	${RM} ${DESTDIR}${PREFIX}/include/bsddialog_theme.h
+	${RM} ${DESTDIR}${PREFIX}/lib/${LIBRARY_A}
+	${RM} ${DESTDIR}${PREFIX}/lib/${LIBRARY_SO}.${VERSION}
+	${RM} ${DESTDIR}${PREFIX}/lib/${LIBRARY_SO}
 
 ${LIBRARY}: ${LIBRARY_SO} ${LIBRARY_A}
 
@@ -42,3 +59,5 @@ ${LIBRARY_A}: ${OBJECTS}
 
 clean:
 	${RM} ${LIBRARY_SO}* *.o *~ *.gz ${LIBRARY_A}
+
+.PHONY: all install uninstall ${LIBRARY} clean

contrib/bsddialog/lib/barbox.c

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2024 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -371,7 +371,7 @@ bsddialog_progressview (struct bsddialog_conf *conf, const char *text, int rows,
 	unsigned int i, mainperc, totaltodo;
 	float readforsec;
 	const char **minilabels;
-	time_t tstart, told, tnew, refresh;
+	time_t tstart, told, tnew, trefresh;
 
 	if ((minilabels = calloc(nminibar, sizeof(char*))) == NULL)
 		RETURN_ERROR("Cannot allocate memory for minilabels");
@@ -385,7 +385,7 @@ bsddialog_progressview (struct bsddialog_conf *conf, const char *text, int rows,
 		minipercs[i] = minibar[i].status;
 	}
 
-	refresh = pvconf->refresh == 0 ? 0 : pvconf->refresh - 1;
+	trefresh = pvconf->refresh == 0 ? 0 : pvconf->refresh - 1;
 	retval = BSDDIALOG_OK;
 	i = 0;
 	update = true;
@@ -398,7 +398,7 @@ bsddialog_progressview (struct bsddialog_conf *conf, const char *text, int rows,
 			mainperc = (bsddialog_total_progview * 100) / totaltodo;
 
 		time(&tnew);
-		if (update || tnew > told + refresh) {
+		if (update || tnew > told + trefresh) {
 			retval = do_mixedgauge(conf, text, rows, cols, mainperc,
 			    nminibar, minilabels, minipercs, true);
 			if (retval == BSDDIALOG_ERROR)
@@ -440,17 +440,18 @@ bsddialog_progressview (struct bsddialog_conf *conf, const char *text, int rows,
 	return (retval);
 }
 
-static int rangebox_redraw(struct dialog *d, struct bar *b, int *bigchange)
+static int
+rangebox_redraw(struct dialog *d, bool redraw, struct bar *b, int *bigchange)
 {
-	if (d->built) {
+	if (redraw) {
 		hide_dialog(d);
 		refresh(); /* Important for decreasing screen */
 	}
 	if (dialog_size_position(d, HBOX, MIN_WBOX, NULL) != 0)
 		return (BSDDIALOG_ERROR);
-	if (draw_dialog(d) != 0)
+	if (draw_dialog(d) != 0) /* doupdate() in main loop */
 		return (BSDDIALOG_ERROR);
-	if (d->built)
+	if (redraw)
 		refresh(); /* Important to fix grey lines expanding screen */
 	TEXTPAD(d, HBOX + HBUTTONS);
 
@@ -490,7 +491,7 @@ bsddialog_rangebox(struct bsddialog_conf *conf, const char *text, int rows,
 		RETURN_ERROR("Cannot build WINDOW bar");
 	b.y = b.x = 1;
 	b.fmt = "%d";
-	if (rangebox_redraw(&d, &b, &bigchange) != 0)
+	if (rangebox_redraw(&d, false, &b, &bigchange) != 0)
 		return (BSDDIALOG_ERROR);
 
 	loop = true;
@@ -568,12 +569,12 @@ bsddialog_rangebox(struct bsddialog_conf *conf, const char *text, int rows,
 				break;
 			if (f1help_dialog(conf) != 0)
 				return (BSDDIALOG_ERROR);
-			if (rangebox_redraw(&d, &b, &bigchange) != 0)
+			if (rangebox_redraw(&d, true, &b, &bigchange) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		case KEY_CTRL('l'):
 		case KEY_RESIZE:
-			if (rangebox_redraw(&d, &b, &bigchange) != 0)
+			if (rangebox_redraw(&d, true, &b, &bigchange) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		default:
@@ -594,17 +595,17 @@ bsddialog_rangebox(struct bsddialog_conf *conf, const char *text, int rows,
 	return (retval);
 }
 
-static int pause_redraw(struct dialog *d, struct bar *b)
+static int pause_redraw(struct dialog *d, bool redraw, struct bar *b)
 {
-	if (d->built) {
+	if (redraw) {
 		hide_dialog(d);
 		refresh(); /* Important for decreasing screen */
 	}
 	if (dialog_size_position(d, HBOX, MIN_WBOX, NULL) != 0)
 		return (BSDDIALOG_ERROR);
-	if (draw_dialog(d) != 0)
+	if (draw_dialog(d) != 0) /* doupdate() in main loop */
 		return (BSDDIALOG_ERROR);
-	if (d->built)
+	if (redraw)
 		refresh(); /* Important to fix grey lines expanding screen */
 	TEXTPAD(d, HBOX + HBUTTONS);
 
@@ -633,7 +634,7 @@ bsddialog_pause(struct bsddialog_conf *conf, const char *text, int rows,
 		RETURN_ERROR("Cannot build WINDOW bar");
 	b.y = b.x = 1;
 	b.fmt = "%d";
-	if (pause_redraw(&d, &b) != 0)
+	if (pause_redraw(&d, false, &b) != 0)
 		return (BSDDIALOG_ERROR);
 
 	tout = *seconds;
@@ -687,12 +688,12 @@ bsddialog_pause(struct bsddialog_conf *conf, const char *text, int rows,
 				break;
 			if (f1help_dialog(conf) != 0)
 				return (BSDDIALOG_ERROR);
-			if (pause_redraw(&d, &b) != 0)
+			if (pause_redraw(&d, true, &b) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		case KEY_CTRL('l'):
 		case KEY_RESIZE:
-			if (pause_redraw(&d, &b) != 0)
+			if (pause_redraw(&d, true, &b) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		default:

contrib/bsddialog/lib/bsddialog.3

@@ -1,5 +1,5 @@
 .\"
-.\" Copyright (c) 2021-2024 Alfonso Sabato Siciliano
+.\" Copyright (c) 2021-2025 Alfonso Sabato Siciliano
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
@@ -22,11 +22,12 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd March 16, 2024
+.Dd June 22, 2025
 .Dt BSDDIALOG 3
 .Os
 .Sh NAME
 .Nm bsddialog_backtitle ,
+.Nm bsddialog_backtitle_rf ,
 .Nm bsddialog_calendar ,
 .Nm bsddialog_clear ,
 .Nm bsddialog_color ,
@@ -65,6 +66,8 @@
 .Ft int
 .Fn bsddialog_backtitle "struct bsddialog_conf *conf" "const char *backtitle"
 .Ft int
+.Fn bsddialog_backtitle_rf "struct bsddialog_conf *conf" "const char *backtitle"
+.Ft int
 .Fo bsddialog_calendar
 .Fa "struct bsddialog_conf *conf"
 .Fa "const char *text"
@@ -292,7 +295,7 @@ and before
 .Dv false
 otherwise.
 .Pp
-.Fn bsddialog_backtitle
+.Fn bsddialog_backtitle_rf
 prints
 .Fa backtitle
 on the top of the screen.
@@ -302,6 +305,11 @@ and
 .Fa conf.no_lines
 described later.
 .Pp
+.Fn bsddialog_backtitle
+is like
+.Fn bsddialog_backtitle_rf
+but it does not update the screen, using if a dialog is built later.
+.Pp
 .Fn bsddialog_error
 returns a string to describe the last error.
 The function should be called after a
@@ -902,7 +910,7 @@ provides a dialog for a
 the labels on buttons are
 .Dq Yes
 and
-.Dq No .
+.Dq &No .
 .Ss Keys
 .Bl -tag -width Ds
 .It Ctrl-l

contrib/bsddialog/lib/bsddialog.h

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2024 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,7 +30,7 @@
 
 #include <stdbool.h>
 
-#define LIBBSDDIALOG_VERSION     "1.0.4"
+#define LIBBSDDIALOG_VERSION     "1.0.5"
 
 /* Return values */
 #define BSDDIALOG_ERROR          -1
@@ -179,6 +179,7 @@ int bsddialog_init_notheme(void);
 bool bsddialog_inmode(void);
 int bsddialog_end(void);
 int bsddialog_backtitle(struct bsddialog_conf *conf, const char *backtitle);
+int bsddialog_backtitle_rf(struct bsddialog_conf *conf, const char *backtitle);
 int bsddialog_initconf(struct bsddialog_conf *conf);
 void bsddialog_clear(unsigned int y);
 void bsddialog_refresh(void);

contrib/bsddialog/lib/bsddialog_theme.h

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2023 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions

contrib/bsddialog/lib/datebox.c

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2022-2024 Alfonso Sabato Siciliano
+ * Copyright (c) 2022-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -296,20 +296,20 @@ print_calendar(struct bsddialog_conf *conf, WINDOW *win, int yy, int mm, int dd,
 }
 
 static int
-calendar_redraw(struct dialog *d, WINDOW *yy_win, WINDOW *mm_win,
+calendar_draw(struct dialog *d, bool redraw, WINDOW *yy_win, WINDOW *mm_win,
     WINDOW *dd_win)
 {
 	int ycal, xcal;
 
-	if (d->built) {
+	if (redraw) {
 		hide_dialog(d);
 		refresh(); /* Important for decreasing screen */
 	}
 	if (dialog_size_position(d, MINHCAL, MINWCAL, NULL) != 0)
 		return (BSDDIALOG_ERROR);
-	if (draw_dialog(d) != 0)
+	if (draw_dialog(d) != 0) /* doupdate in main loop */
 		return (BSDDIALOG_ERROR);
-	if (d->built)
+	if (redraw)
 		refresh(); /* Important to fix grey lines expanding screen */
 	TEXTPAD(d, MINHCAL + HBUTTONS);
 
@@ -354,7 +354,7 @@ bsddialog_calendar(struct bsddialog_conf *conf, const char *text, int rows,
 	if ((dd_win = newwin(1, 1, 1, 1)) == NULL)
 		RETURN_ERROR("Cannot build WINDOW for dd");
 	wbkgd(dd_win, t.dialog.color);
-	if (calendar_redraw(&d, yy_win, mm_win, dd_win) != 0)
+	if (calendar_draw(&d, false, yy_win, mm_win, dd_win) != 0)
 		return (BSDDIALOG_ERROR);
 
 	sel = -1;
@@ -503,12 +503,12 @@ bsddialog_calendar(struct bsddialog_conf *conf, const char *text, int rows,
 				break;
 			if (f1help_dialog(conf) != 0)
 				return (BSDDIALOG_ERROR);
-			if (calendar_redraw(&d, yy_win, mm_win, dd_win) != 0)
+			if (calendar_draw(&d, true, yy_win, mm_win, dd_win) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		case KEY_CTRL('l'):
 		case KEY_RESIZE:
-			if (calendar_redraw(&d, yy_win, mm_win, dd_win) != 0)
+			if (calendar_draw(&d, true, yy_win, mm_win, dd_win) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		default:
@@ -533,11 +533,11 @@ bsddialog_calendar(struct bsddialog_conf *conf, const char *text, int rows,
 	return (retval);
 }
 
-static int datebox_redraw(struct dialog *d, struct dateitem *di)
+static int datebox_draw(struct dialog *d, bool redraw, struct dateitem *di)
 {
 	int y, x;
 
-	if (d->built) {
+	if (redraw) {
 		hide_dialog(d);
 		refresh(); /* Important for decreasing screen */
 	}
@@ -545,7 +545,7 @@ static int datebox_redraw(struct dialog *d, struct dateitem *di)
 		return (BSDDIALOG_ERROR);
 	if (draw_dialog(d) != 0)
 		return (BSDDIALOG_ERROR);
-	if (d->built)
+	if (redraw)
 		refresh(); /* Important to fix grey lines expanding screen */
 	TEXTPAD(d, 3 /*windows*/ + HBUTTONS);
 
@@ -624,7 +624,7 @@ bsddialog_datebox(struct bsddialog_conf *conf, const char *text, int rows,
 	set_buttons(&d, true, OK_LABEL, CANCEL_LABEL);
 	if (build_dateitem(conf->date.format, &yy, &mm, &dd, di) != 0)
 		return (BSDDIALOG_ERROR);
-	if (datebox_redraw(&d, di) != 0)
+	if (datebox_draw(&d, false, di) != 0)
 		return (BSDDIALOG_ERROR);
 
 	sel = -1;
@@ -716,12 +716,12 @@ bsddialog_datebox(struct bsddialog_conf *conf, const char *text, int rows,
 				break;
 			if (f1help_dialog(conf) != 0)
 				return (BSDDIALOG_ERROR);
-			if (datebox_redraw(&d, di) != 0)
+			if (datebox_draw(&d, true, di) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		case KEY_CTRL('l'):
 		case KEY_RESIZE:
-			if (datebox_redraw(&d, di) != 0)
+			if (datebox_draw(&d, true, di) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		default:

contrib/bsddialog/lib/formbox.c

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2024 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -601,11 +601,11 @@ static int form_size_position(struct dialog *d, struct privateform *f)
 }
 
 static int
-form_redraw(struct dialog *d, struct privateform *f, bool focusinform)
+form_draw(struct dialog *d, bool redraw, struct privateform *f, bool focusinform)
 {
 	unsigned int i;
 
-	if (d->built) {
+	if (redraw) {
 		hide_dialog(d);
 		refresh(); /* Important for decreasing screen */
 	}
@@ -613,9 +613,9 @@ form_redraw(struct dialog *d, struct privateform *f, bool focusinform)
 	f->w = f->wmin;
 	if (form_size_position(d, f) != 0)
 		return (BSDDIALOG_ERROR);
-	if (draw_dialog(d) != 0)
+	if (draw_dialog(d) != 0) /* doupdate() in main loop */
 		return (BSDDIALOG_ERROR);
-	if (d->built)
+	if (redraw)
 		refresh(); /* Important to fix grey lines expanding screen */
 	TEXTPAD(d, 2 /* box borders */ + f->viewrows + HBUTTONS);
 
@@ -707,7 +707,7 @@ bsddialog_form(struct bsddialog_conf *conf, const char *text, int rows,
 	}
 
 	form.formheight = formheight;
-	if (form_redraw(&d, &form, focusinform) != 0)
+	if (form_draw(&d, false, &form, focusinform) != 0)
 		return (BSDDIALOG_ERROR);
 
 	changeitem = switchfocus = false;
@@ -719,10 +719,16 @@ bsddialog_form(struct bsddialog_conf *conf, const char *text, int rows,
 		switch(input) {
 		case KEY_ENTER:
 		case 10: /* Enter */
-			if (focusinform && conf->button.always_active == false)
-				break;
-			retval = BUTTONVALUE(d.bs);
-			loop = false;
+			if (focusinform && conf->button.always_active == false) {
+				next = nextitem(form.nitems, form.pritems, form.sel);
+				if (next > form.sel)
+					changeitem = true; /* needs next */
+				else
+					switchfocus = true;
+			} else {
+				retval = BUTTONVALUE(d.bs);
+				loop = false;
+			}
 			break;
 		case 27: /* Esc */
 			if (conf->key.enable_esc) {
@@ -732,7 +738,12 @@ bsddialog_form(struct bsddialog_conf *conf, const char *text, int rows,
 			break;
 		case '\t': /* TAB */
 			if (focusinform) {
-				switchfocus = true;
+				next = nextitem(form.nitems, form.pritems,
+				    form.sel);
+				if (next > form.sel)
+					changeitem = true;  /* needs next */
+				else
+					switchfocus = true;
 			} else {
 				if (d.bs.curr + 1 < (int)d.bs.nbuttons) {
 					d.bs.curr++;
@@ -839,12 +850,12 @@ bsddialog_form(struct bsddialog_conf *conf, const char *text, int rows,
 				retval = BSDDIALOG_ERROR;
 				loop = false;
 			}
-			if (form_redraw(&d, &form, focusinform) != 0)
+			if (form_draw(&d, true, &form, focusinform) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		case KEY_CTRL('l'):
 		case KEY_RESIZE:
-			if (form_redraw(&d, &form, focusinform) != 0)
+			if (form_draw(&d, true, &form, focusinform) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		default:
@@ -884,11 +895,20 @@ bsddialog_form(struct bsddialog_conf *conf, const char *text, int rows,
 			    conf->button.always_active || !focusinform,
 			    !focusinform);
 			wnoutrefresh(d.widget);
-			DRAWITEM_TRICK(&form, form.sel, focusinform);
+			if (focusinform == false)
+				DRAWITEM_TRICK(&form, form.sel, false);
+			else {
+				next = firstitem(form.nitems, form.pritems);
+				if (next == form.sel)
+					DRAWITEM_TRICK(&form, form.sel, true);
+				else
+					changeitem = true;
+			}
 			switchfocus = false;
 		}
 
 		if (changeitem) {
+			/* useless after if(switchfocus) */
 			DRAWITEM_TRICK(&form, form.sel, false);
 			form.sel = next;
 			item = &form.pritems[form.sel];

contrib/bsddialog/lib/lib_util.c

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2023 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,6 +25,7 @@
  * SUCH DAMAGE.
  */
 
+#include <stdarg.h>
 #include <curses.h>
 #include <stdlib.h>
 #include <string.h>

contrib/bsddialog/lib/lib_util.h

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2024 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -62,7 +62,7 @@ extern bool hastermcolors;
 		RETURN_ERROR("*" #p " is NULL");                               \
 } while (0)
 #define CHECK_ARRAY(nitem, a) do {                                             \
-	if (nitem > 0 && a == NULL)                                             \
+	if (nitem > 0 && a == NULL)                                            \
 		RETURN_FMTERROR(#nitem " is %d but *" #a " is NULL", nitem);   \
 } while (0)
 /* widget utils */

contrib/bsddialog/lib/libbsddialog.c

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2023 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -114,11 +114,21 @@ int bsddialog_backtitle(struct bsddialog_conf *conf, const char *backtitle)
 			mvhline_set(1, 1, WACS_HLINE, SCREENCOLS - 2);
 	}
 
-	refresh();
+	wnoutrefresh(stdscr);
 
 	return (BSDDIALOG_OK);
 }
 
+int bsddialog_backtitle_rf(struct bsddialog_conf *conf, const char *backtitle)
+{
+	int rv;
+
+	rv = bsddialog_backtitle(conf, backtitle);
+	doupdate();
+
+	return (rv);
+}
+
 bool bsddialog_inmode(void)
 {
 	return (in_bsddialog_mode);

contrib/bsddialog/lib/menubox.c

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2024 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -391,7 +391,7 @@ drawitem(struct bsddialog_conf *conf, struct privatemenu *m, int y, bool focus)
 			attron(t.menu.bottomdesccolor);
 			addstr(pritem->bottomdesc);
 			attroff(t.menu.bottomdesccolor);
-			refresh();
+			wnoutrefresh(stdscr);
 		}
 	}
 }
@@ -454,18 +454,18 @@ static int menu_size_position(struct dialog *d, struct privatemenu *m)
 	return (0);
 }
 
-static int mixedlist_redraw(struct dialog *d, struct privatemenu *m)
+static int mixedlist_draw(struct dialog *d, bool redraw, struct privatemenu *m)
 {
-	if (d->built) {
+	if (redraw) {
 		hide_dialog(d);
 		refresh(); /* Important for decreasing screen */
 	}
 	m->menurows = m->apimenurows;
 	if (menu_size_position(d, m) != 0)
 		return (BSDDIALOG_ERROR);
-	if (draw_dialog(d) != 0)
+	if (draw_dialog(d) != 0) /* doupdate() in main loop */
 		return (BSDDIALOG_ERROR);
-	if (d->built)
+	if (redraw)
 		refresh(); /* Important to fix grey lines expanding screen */
 	TEXTPAD(d, 2/*bmenu*/ + m->menurows + HBUTTONS);
 
@@ -532,7 +532,7 @@ do_mixedlist(struct bsddialog_conf *conf, const char *text, int rows, int cols,
 		drawitem(d.conf, &m, m.sel, true);
 	m.ypad = 0;
 	m.apimenurows = menurows;
-	if (mixedlist_redraw(&d, &m) != 0)
+	if (mixedlist_draw(&d, false, &m) != 0)
 		return (BSDDIALOG_ERROR);
 
 	changeitem = false;
@@ -575,12 +575,12 @@ do_mixedlist(struct bsddialog_conf *conf, const char *text, int rows, int cols,
 				break;
 			if (f1help_dialog(conf) != 0)
 				return (BSDDIALOG_ERROR);
-			if (mixedlist_redraw(&d, &m) != 0)
+			if (mixedlist_draw(&d, true, &m) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		case KEY_CTRL('l'):
 		case KEY_RESIZE:
-			if (mixedlist_redraw(&d, &m) != 0)
+			if (mixedlist_draw(&d, true, &m) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		}

contrib/bsddialog/lib/messagebox.c

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2024 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -69,19 +69,19 @@ static int message_size_position(struct dialog *d, int *htext)
 	return (0);
 }
 
-static int message_draw(struct dialog *d, struct scroll *s)
+static int message_draw(struct dialog *d, bool redraw, struct scroll *s)
 {
 	int unused;
 
-	if (d->built) {
+	if (redraw) { /* redraw: RESIZE or F1 */
 		hide_dialog(d);
 		refresh(); /* Important for decreasing screen */
 	}
 	if (message_size_position(d, &s->htext) != 0)
 		return (BSDDIALOG_ERROR);
-	if (draw_dialog(d) != 0)
+	if (draw_dialog(d) != 0) /* doupdate() in main loop */
 		return (BSDDIALOG_ERROR);
-	if (d->built)
+	if (redraw)
 		refresh(); /* Important to fix grey lines expanding screen */
 
 	s->printrows = d->h - BORDER - HBUTTONS - BORDER;
@@ -106,7 +106,7 @@ do_message(struct bsddialog_conf *conf, const char *text, int rows, int cols,
 		return (BSDDIALOG_ERROR);
 	set_buttons(&d, true, oklabel, cancellabel);
 	s.htext = -1;
-	if (message_draw(&d, &s) != 0)
+	if (message_draw(&d, false, &s) != 0)
 		return (BSDDIALOG_ERROR);
 
 	loop = true;
@@ -170,12 +170,12 @@ do_message(struct bsddialog_conf *conf, const char *text, int rows, int cols,
 				break;
 			if (f1help_dialog(d.conf) != 0)
 				return (BSDDIALOG_ERROR);
-			if (message_draw(&d, &s) != 0)
+			if (message_draw(&d, true, &s) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		case KEY_CTRL('l'):
 		case KEY_RESIZE:
-			if (message_draw(&d, &s) != 0)
+			if (message_draw(&d, true, &s) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		default:

contrib/bsddialog/lib/textbox.c

@@ -1,7 +1,7 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
- * Copyright (c) 2021-2024 Alfonso Sabato Siciliano
+ * Copyright (c) 2021-2025 Alfonso Sabato Siciliano
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -101,17 +101,17 @@ static int textbox_size_position(struct dialog *d, struct scrolltext *st)
 	return (0);
 }
 
-static int textbox_draw(struct dialog *d, struct scrolltext *st)
+static int textbox_draw(struct dialog *d, bool redraw, struct scrolltext *st)
 {
-	if (d->built) {
+	if (redraw) {
 		hide_dialog(d);
 		refresh(); /* Important for decreasing screen */
 	}
 	if (textbox_size_position(d, st) != 0)
 		return (BSDDIALOG_ERROR);
-	if (draw_dialog(d) != 0)
+	if (draw_dialog(d) != 0) /* wrefresh() and prefresh() in main loop */
 		return (BSDDIALOG_ERROR);
-	if (d->built)
+	if (redraw)
 		refresh(); /* Important to fix grey lines expanding screen */
 
 	st->ys = d->y + 1;
@@ -175,7 +175,7 @@ bsddialog_textbox(struct bsddialog_conf *conf, const char *file, int rows,
 	fclose(fp);
 	set_tabsize(defaulttablen); /* reset because it is curses global */
 
-	if (textbox_draw(&d, &st) != 0)
+	if (textbox_draw(&d, false, &st) != 0)
 		return (BSDDIALOG_ERROR);
 
 	loop = true;
@@ -254,12 +254,12 @@ bsddialog_textbox(struct bsddialog_conf *conf, const char *file, int rows,
 				break;
 			if (f1help_dialog(conf) != 0)
 				return (BSDDIALOG_ERROR);
-			if (textbox_draw(&d, &st) != 0)
+			if (textbox_draw(&d, true, &st) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		case KEY_CTRL('l'):
 		case KEY_RESIZE:
-			if (textbox_draw(&d, &st) != 0)
+			if (textbox_draw(&d, true, &st) != 0)
 				return (BSDDIALOG_ERROR);
 			break;
 		}