wireguard-openbsd/libexec/spamd/grey.c, branch jd/histogram

When spamd(8) runs in greylist mode in the parent process (which runs

2018-10-25T06:42:35Z

greywatcher()) we know that the only files that it will ever access are PATH_SPAMD_DB in rw mode, alloweddomains_file in r and that it will need to execute PATH_PFCTL so we can unveil(2) them with those permissions. OK deraadt@ millert@ beck@

Make blacklist entries override the whitelist. When running spamd

2017-10-18T17:31:01Z

in greylisting mode, it is not uncommon for an IP to get whitelisted before it shows up on a spam blacklist. With this change, spamd will check its blacklists before adding a WHITE entry to the pf table. If the IP matches a blacklist, the WHITE entry will be removed. OK phessler@

- Remove useless var assignment

2016-10-20T21:09:46Z

- Use memset(*b, 0, len) instead of bzero(*b, len) - Use memcpy(*dst, *src, len) instead of bcopy(*src, *dst, len) - Use explicit_bzero(3) instead of bzero(3) to clean temporary HMAC Remarks from deraadt@ (duly noted!!), reviewed and OK by henning@ and tb@

- Both checks for pw are not needed since it was already done at the start of

2016-03-25T16:31:32Z

the program - Add error message to syslog if privdrop didn't succeed and then exit - Remove lint comments OK beck@ after his suggestion and also looks good to jca@

tighten the pledge for spamd, from Ricardo Mestre

2015-12-10T16:06:29Z

this loads the tls certificate files pre-pledge then does the bulk of the tls setup goo pledged.

Initially pledge spamd

2015-12-08T03:21:09Z

All the work done by Ricardo Mestre - Thanks.

Document that the pfdev check for 63 is /dev/fd/ only contains those nodes

2015-11-29T06:51:20Z

Change spamd to use divert-to instead of rdr-to.

2015-05-18T16:04:21Z

divert-to has many advantages over rdr-to for proxies. For example, it is much easier to use, requires less code, does not depend on /dev/pf, works in-band without the asynchronous lookup (DIOCNATLOOK ioctl), saves us from additional port allocations by the rdr/NAT code, and even avoids potential collisions and race conditions that could theoretically happen with the lookup. Heads up: users will have to update their spamd PF rules from rdr-to to divert-to. spamd now also listens to 127.0.0.1 instead of "any" (0.0.0.0) by default which should be fine with most setups but has to be considered for some special configurations. Based on a diff is almost two years old but got delayed several times ... beck@: "now is the time to get it in" :) Tested by many With help from okan@ OK okan@ beck@ millert@

Use address-family specific lists of addr/mask entries instead of

2015-01-13T21:42:59Z

a union that can store either ipv4 or ipv6. The old method used 4x as much memory as was really needed for ipv4. The spamd-setup protocol has changed from: tag;message;a/m;a/m;a/m...\n to :tag;message;af;count;a/m;a/m;a/m...[af;count;a/m;a/m;a/m]\n OK phessler@ "nice" beck@

Delete a bunch of unnecessary #includes

2014-11-23T21:19:47Z

Use instead of ok krw@