[Bug 297312] [NEW PORT] mail/tarpitd: SMTP tarpit for hosts supplied by an external blocklist

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297312

            Bug ID: 297312
           Summary: [NEW PORT] mail/tarpitd: SMTP tarpit for hosts
                    supplied by an external blocklist
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: [email protected]
          Reporter: [email protected]

Created attachment 273504
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273504&action=edit
git diff adding mail/tarpitd

tarpitd answers SMTP connections and holds them open for as long as the peer
can be persuaded to wait. It is meant to sit behind a packet filter rule that
redirects known spam sources to it, in the manner of spamd(8) on OpenBSD, and
it never accepts or delivers anything.

Every reply is a syntactically valid SMTP response, so the sender has no
reason to give up, but it is written out one byte at a time and commands are
read back at the same rate. Every terminal answer is a temporary failure, so
the message stays in the sender's queue and it comes back later to be
tarpitted again. The intent is to occupy a slot in the sending botnet's
delivery queue for hours rather than to reject mail quickly.

Unlike spamd(8) it carries no blocklist and applies no heuristics of its own.
The addresses come from an external source such as fail2ban or blacklistd(8),
and the only thing that decides whose traffic arrives here is the firewall
rule that redirects it.

It is a single kqueue(2) process with one timer per connection; a held
session costs a descriptor and roughly 1 KB of user memory, so a few thousand
concurrent sessions are unremarkable.

Port notes:
- Category: mail
- Licence: BSD-2-Clause
- No dependencies outside the base system
- Builds on the upstream bsd.prog.mk makefile through USES=uidfix
- The CAPSICUM option is off by default: capability mode works, but it
  forbids reopening /var/run/log, so a syslogd restart would leave the
  daemon running and permanently silent. Documented in the manual page.

QA on 14.4-RELEASE-p8 amd64:
- make makesum, stage, check-plist: no issues
- DEVELOPER=yes make stage-qa: no issues
- portlint -A: 0 fatal errors
- make package, pkg install, service start and stop, pkg delete: clean,
  no files left behind
- Both the default and the CAPSICUM build were exercised at runtime

Not built under poudriere.

-- 
You are receiving this mail because:
You are the assignee for the bug.