wireguard-openbsd/libexec/spamd/sdl.c, branch jd/simplify-queueing

Make blacklist entries override the whitelist. When running spamd

2017-10-18T17:31:01Z

in greylisting mode, it is not uncommon for an IP to get whitelisted before it shows up on a spam blacklist. With this change, spamd will check its blacklists before adding a WHITE entry to the pf table. If the IP matches a blacklist, the WHITE entry will be removed. OK phessler@

Use a binary search to speed up blacklist lookups. OK phessler@

2017-10-17T13:52:10Z

Change spamd to use divert-to instead of rdr-to.

2015-05-18T16:04:21Z

divert-to has many advantages over rdr-to for proxies. For example, it is much easier to use, requires less code, does not depend on /dev/pf, works in-band without the asynchronous lookup (DIOCNATLOOK ioctl), saves us from additional port allocations by the rdr/NAT code, and even avoids potential collisions and race conditions that could theoretically happen with the lookup. Heads up: users will have to update their spamd PF rules from rdr-to to divert-to. spamd now also listens to 127.0.0.1 instead of "any" (0.0.0.0) by default which should be fine with most setups but has to be considered for some special configurations. Based on a diff is almost two years old but got delayed several times ... beck@: "now is the time to get it in" :) Tested by many With help from okan@ OK okan@ beck@ millert@

Use address-family specific lists of addr/mask entries instead of

2015-01-13T21:42:59Z

a union that can store either ipv4 or ipv6. The old method used 4x as much memory as was really needed for ipv4. The spamd-setup protocol has changed from: tag;message;a/m;a/m;a/m...\n to :tag;message;af;count;a/m;a/m;a/m...[af;count;a/m;a/m;a/m]\n OK phessler@ "nice" beck@

Avoid a crash (free of bogus pointer) when there is a syntax error

2015-01-08T22:10:08Z

reading the config socket by clearing the entire blacklist struct instead of just the tag string. Also avoid holes in the blacklist array on error since the code can't cope with them. OK beck@

Userland reallocarray() audit.

2014-10-11T03:25:16Z

Avoid potential integer overflow in the size argument of malloc() and realloc() by using reallocarray() to avoid unchecked multiplication. ok deraadt@

PR 5621 - spamd doesn't clear the last entry from an empty TRAP list,

2007-11-03T19:16:07Z

noticed and patch from Piotr Sikora

use calloc() to avoid malloc(n * m) overflows; checked by djm canacar jsg

2007-09-02T15:19:07Z

use new license.

2007-03-26T16:36:18Z

spacing

2007-03-05T02:10:46Z