- update to 1.3.6
- add blacklistd support.


(christos)

--- Make.rules.in.orig	2015-05-27 20:25:54.000000000 -0400
+++ Make.rules.in	2016-01-25 21:48:47.000000000 -0500
@@ -110,3 +110,8 @@
 
 FTPWHO_OBJS=ftpwho.o scoreboard.o misc.o
 BUILD_FTPWHO_OBJS=utils/ftpwho.o utils/scoreboard.o utils/misc.o
+
+CPPFLAGS+=-DHAVE_BLACKLIST
+LIBS+=-lblacklist
+OBJS+= pfilter.o
+BUILD_OBJS+= src/pfilter.o

--- /dev/null	2016-01-22 17:30:55.000000000 -0500
+++ include/pfilter.h	2016-01-22 16:18:33.000000000 -0500
@@ -0,0 +1,3 @@
+
+void pfilter_notify(int);
+void pfilter_init(void);

$NetBSD: patch-modules_mod__auth.c,v 1.1 2019/10/07 19:29:47 christos Exp $

Add packet filter

--- modules/mod_auth.c.orig	2017-04-09 22:31:02.000000000 -0400
+++ modules/mod_auth.c	2019-10-07 15:10:42.316419545 -0400
@@ -28,6 +28,7 @@
 
 #include "conf.h"
 #include "privs.h"
+#include "pfilter.h"
 
 #ifdef HAVE_USERSEC_H
 # include <usersec.h>
@@ -97,6 +98,8 @@
     _("Login timeout (%d %s): closing control connection"), TimeoutLogin,
     TimeoutLogin != 1 ? "seconds" : "second");
 
+  pfilter_notify(1);
+
   /* It's possible that any listeners of this event might terminate the
    * session process themselves (e.g. mod_ban).  So write out that the
    * TimeoutLogin has been exceeded to the log here, in addition to the
@@ -1095,6 +1098,7 @@
         pr_memscrub(pass, strlen(pass));
       }
 
+      pfilter_notify(1);
       pr_log_auth(PR_LOG_NOTICE, "SECURITY VIOLATION: Root login attempted");
       return 0;
     }
@@ -1952,6 +1956,7 @@
   return 1;
 
 auth_failure:
+  pfilter_notify(1);
   if (pass)
     pr_memscrub(pass, strlen(pass));
   session.user = session.group = NULL;

$NetBSD: patch-src_main.c,v 1.1 2019/10/07 19:29:47 christos Exp $

Add packet filter

--- src/main.c.orig	2017-04-09 22:31:02.000000000 -0400
+++ src/main.c	2019-10-07 15:09:12.516004304 -0400
@@ -41,6 +41,7 @@
 #endif
 
 #include "privs.h"
+#include "pfilter.h"
 
 int (*cmd_auth_chk)(cmd_rec *);
 void (*cmd_handler)(server_rec *, conn_t *);
@@ -1089,6 +1090,7 @@
   pid_t pid;
   sigset_t sig_set;
 
+  pfilter_init();
   if (no_fork == FALSE) {
 
     /* A race condition exists on heavily loaded servers where the parent
@@ -1206,7 +1208,8 @@
 
   /* Reseed pseudo-randoms */
   srand((unsigned int) (time(NULL) * getpid()));
-
+#else
+  pfilter_init();
 #endif /* PR_DEVEL_NO_FORK */
 
   /* Child is running here */

--- /dev/null	2016-01-22 17:30:55.000000000 -0500
+++ src/pfilter.c	2016-01-22 16:37:55.000000000 -0500
@@ -0,0 +1,41 @@
+#include "pfilter.h"
+#include "conf.h"
+#include "privs.h"
+#ifdef HAVE_BLACKLIST
+#include <blacklist.h>
+#endif
+
+static struct blacklist *blstate;
+
+void
+pfilter_init(void)
+{
+#ifdef HAVE_BLACKLIST
+	if (blstate == NULL)
+		blstate = blacklist_open();
+#endif
+}
+
+void
+pfilter_notify(int a)
+{
+#ifdef HAVE_BLACKLIST
+	conn_t *c = session.c;
+	int fd;
+
+	if (c == NULL)
+		return;
+	if (c->rfd != -1)
+		fd = c->rfd;
+	else if (c->wfd != -1)
+		fd = c->wfd;
+	else
+		return;
+
+	if (blstate == NULL)
+		pfilter_init();
+	if (blstate == NULL)
+		return;
+	(void)blacklist_r(blstate, a, fd, "proftpd");
+#endif
+}