# HG changeset patch
# User Matt Johnston <matt@ucc.asn.au>
# Date 1141972289 0
# Node ID 9d110777f3453971ff313448f78ee64f37161cb1
# Parent  c07de41b53d74b618d8039309b7dd5be32186638# Parent  55a99934db873be2e63b5968fb6532e5d9bd02e4
propagate from branch 'au.asn.ucc.matt.dropbear' (head 7ad1775ed65e75dbece27fe6b65bf1a234db386a)
            to branch 'au.asn.ucc.matt.dropbear.contrib.blacklist' (head 1d86a4f0a401cc68c2670d821a2f6366c37af143)

diff -r 55a99934db87 -r 9d110777f345 Makefile.in
--- a/Makefile.in	Thu Mar 09 15:03:22 2006 +0000
+++ b/Makefile.in	Fri Mar 10 06:31:29 2006 +0000
@@ -25,7 +25,7 @@
 SVROBJS=svr-kex.o svr-algo.o svr-auth.o sshpty.o \
 		svr-authpasswd.o svr-authpubkey.o svr-session.o svr-service.o \
 		svr-chansession.o svr-runopts.o svr-agentfwd.o svr-main.o svr-x11fwd.o\
-		svr-tcpfwd.o svr-authpam.o
+		svr-tcpfwd.o svr-authpam.o blacklist.o
 
 CLIOBJS=cli-algo.o cli-main.o cli-auth.o cli-authpasswd.o cli-kex.o \
 		cli-session.o cli-service.o cli-runopts.o cli-chansession.o \
diff -r 55a99934db87 -r 9d110777f345 blacklist.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/blacklist.c	Fri Mar 10 06:31:29 2006 +0000
@@ -0,0 +1,55 @@
+#include "includes.h"
+#include "options.h"
+#include "dbutil.h"
+
+#define LINE_LENGTH 50
+
+int is_blacklisted (char *remote_ip) {
+
+	char sz_tmp[LINE_LENGTH];
+	FILE *fp_blacklist = NULL;
+
+	fp_blacklist = fopen(BLACKLISTFILE, "r");
+	if (fp_blacklist == NULL) {
+		/* TODO: this could spew log messages. */
+		dropbear_log(LOG_INFO, "Could not open blacklist %s for reading.", BLACKLISTFILE);
+	} else {
+		while (fgets(sz_tmp, LINE_LENGTH - 1, fp_blacklist) != NULL) {
+			if (strlen(sz_tmp) > 0) {
+				sz_tmp[strlen(sz_tmp)-1] = '\0';
+				if (!strcmp(sz_tmp, remote_ip)) {
+					dropbear_log(LOG_INFO, "IP %s is forbidden!", remote_ip);
+					fclose (fp_blacklist);
+					return 1;
+				}
+			}
+		}
+		fclose (fp_blacklist);
+	}
+	return 0;
+}
+
+void blacklist (char *addrstring)
+{
+        int     i;
+        FILE    *fp_blacklist = NULL;
+        char    *remote_ip = NULL;
+
+        remote_ip = m_strdup (addrstring);
+        i = strlen (remote_ip);
+		/* This may not be IPv6 safe if addrstring doesn't have a :port suffix */
+        while (i--) {
+                if (remote_ip[i] == ':') {
+                        remote_ip[i] = '\0';
+                        break;
+                }
+        }
+        dropbear_log (LOG_INFO, "Blacklisting %s", remote_ip);
+        if ((fp_blacklist = fopen (BLACKLISTFILE, "a")) == NULL) {
+                dropbear_log (LOG_INFO, "Could not open blacklist %s for appending", BLACKLISTFILE);
+        } else {
+                fprintf (fp_blacklist, "%s\n", remote_ip);
+                fclose (fp_blacklist);
+        }
+        m_free (remote_ip);
+}
diff -r 55a99934db87 -r 9d110777f345 blacklist.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/blacklist.h	Fri Mar 10 06:31:29 2006 +0000
@@ -0,0 +1,7 @@
+#ifndef _BLACKLIST_H_
+#define _BLACKLIST_H_
+
+int is_blacklisted (char *remote_ip);
+void blacklist (char *addrstring);
+
+#endif
diff -r 55a99934db87 -r 9d110777f345 options.h
--- a/options.h	Thu Mar 09 15:03:22 2006 +0000
+++ b/options.h	Fri Mar 10 06:31:29 2006 +0000
@@ -22,6 +22,9 @@
 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
 #endif
 
+/* File to store blacklisted IPs */
+#define BLACKLISTFILE "/var/dropbear/blacklist"
+
 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
  * on chosen ports and keeps accepting connections. This is the default.
  *
@@ -174,7 +177,7 @@
 
 /* Maximum number of failed authentication tries (server option) */
 #ifndef MAX_AUTH_TRIES
-#define MAX_AUTH_TRIES 10
+#define MAX_AUTH_TRIES 2
 #endif
 
 /* The file to store the daemon's process ID, for shutdown scripts etc */
diff -r 55a99934db87 -r 9d110777f345 svr-auth.c
--- a/svr-auth.c	Thu Mar 09 15:03:22 2006 +0000
+++ b/svr-auth.c	Fri Mar 10 06:31:29 2006 +0000
@@ -33,6 +33,7 @@
 #include "packet.h"
 #include "auth.h"
 #include "runopts.h"
+#include "blacklist.h"
 
 static void authclear();
 static int checkusername(unsigned char *username, unsigned int userlen);
@@ -338,6 +339,7 @@
 		} else {
 			userstr = ses.authstate.printableuser;
 		}
+		blacklist(svr_ses.addrstring);
 		dropbear_exit("Max auth tries reached - user '%s' from %s",
 				userstr, svr_ses.addrstring);
 	}
diff -r 55a99934db87 -r 9d110777f345 svr-main.c
--- a/svr-main.c	Thu Mar 09 15:03:22 2006 +0000
+++ b/svr-main.c	Fri Mar 10 06:31:29 2006 +0000
@@ -28,6 +28,7 @@
 #include "buffer.h"
 #include "signkey.h"
 #include "runopts.h"
+#include "blacklist.h"
 
 static size_t listensockets(int *sock, size_t sockcount, int *maxfd);
 static void sigchld_handler(int dummy);
@@ -254,6 +255,11 @@
 				}
 			}
 
+			if (is_blacklisted(getaddrstring(&remoteaddr, 0)) == 1) {
+				close(childsock);
+				continue;
+			}
+
 			if (num_unauthed_total >= MAX_UNAUTH_CLIENTS
 					|| num_unauthed_for_addr >= MAX_UNAUTH_PER_IP) {
 				goto out;