Changeset 149 for trunk/src/sh_portcheck.c

Timestamp:

Jan 7, 2008, 8:52:13 PM (17 years ago)

Author:

katerina

Message:

Make sh_hash.c thread-safe, remove plenty of tiny allocations, improve sh_mem_dump, modify port check to run as thread, and fix unsetting of sh_thread_pause_flag (was too early).

File:

• trunk/src/sh_portcheck.c (modified) (53 diffs)

trunk/src/sh_portcheck.c

@@ -80 +80 @@
 #define SH_PORT_OPT 2
 #define SH_PORT_IGN 3
+#define SH_PORT_BLACKLIST 4
 
 #define SH_PORT_MISS 0
@@ -87 +88 @@
 #define SH_PORT_NOREPT 0
 #define SH_PORT_REPORT 1
+
+#define SH_PROTO_TCP 0
+#define SH_PROTO_UDP 1
+#define SH_PROTO_STR(a) (((a) == IPPROTO_TCP) ? _("tcp") : _("udp"))
 
 struct sh_portentry {
@@ -101 +106 @@
 static struct sh_portentry * portlist_udp = NULL;
 
+struct sh_port {
+  int              port;
+  struct in_addr   haddr;
+  struct sh_port * next;
+};
+
+static struct sh_port * blacklist_tcp = NULL;
+static struct sh_port * blacklist_udp = NULL;
+
 #define SH_PORTCHK_INTERVAL 300
 
@@ -117 +131 @@
 #include "sh_pthread.h"
 
+SH_MUTEX_STATIC(mutex_port_check, PTHREAD_MUTEX_INITIALIZER);
+
 static int sh_portchk_severity  = SH_ERR_SEVERE;
 #endif
@@ -132 +148 @@
 static int sh_portchk_add_optional (const char * str);
 
+/* Exported interface to add blacklisted ports as 'iface:portlist'
+ */
+static int sh_portchk_add_blacklist (const char * str);
+
 /* Exported interface to add an ethernet interface
  */
 static int sh_portchk_add_interface (const char * str);
 
+/* verify whether port/interface is blacklisted (do not check)
+ */
+static int sh_portchk_is_blacklisted(int port, struct in_addr haddr, int proto);
 
 #ifndef TEST_ONLY
@@ -148 +171 @@
   if (val <= 0)
     {
+      SH_MUTEX_LOCK(mutex_thread_nolog);
       sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
                        _("port check interval"), c);
+      SH_MUTEX_UNLOCK(mutex_thread_nolog);
       retval = -1;
     }
@@ -196 +221 @@
     },
     {
+        N_("portcheckskip"),
+        sh_portchk_add_blacklist,
+    },
+    {
         N_("portcheckactive"),
         sh_portchk_set_active,
@@ -232 +261 @@
 
 
-static char * check_services (int port, char * proto);
+static char * check_services (int port, int proto);
 
 #ifdef TEST_ONLY
@@ -249 +278 @@
 #endif
 
-static void sh_portchk_add_to_list (char * proto, 
+static void sh_portchk_add_to_list (int proto, 
                                     int port, struct in_addr haddr, char * service,
                                     int flag, int status)
@@ -257 +286 @@
   if (portchk_debug)
     fprintf(stderr, _("add to list: port %d/%s %d %d (%s)\n"),
-            port, proto, flag, status, service ? service : _("undef"));
+            port, SH_PROTO_STR(proto), flag, status, service ? service : _("undef"));
 
   new->port = port;
@@ -270 +299 @@
   else
     new->service = NULL;
-  if (0 == strcmp(proto, "tcp"))
+  if (proto == IPPROTO_TCP)
     {
       new->next = portlist_tcp;
@@ -322 +351 @@
 }
   
+static struct sh_port * sh_portchk_kill_blacklist (struct sh_port * head)
+{
+  if (head)
+    {
+      if (head->next)
+        sh_portchk_kill_blacklist (head->next);
+
+      SH_FREE(head);
+    }
+  return NULL;
+}
+  
 /* check the list of open ports for any that are marked as UNKN
  */
-static void sh_portchk_check_list (struct sh_portentry ** head, char * proto, int report)
+static void sh_portchk_check_list (struct sh_portentry ** head, int proto, int report)
 {
   struct sh_portentry * ptr = *head;
@@ -334 +375 @@
       if (portchk_debug && report)
         fprintf(stderr, _("check list: port %d/%s %d %d\n"),
-                ptr->port, proto, ptr->flag, ptr->status);
+                ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
 
       if (ptr->status == SH_PORT_UNKN)
@@ -343 +384 @@
             {
               snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceMissing] port %s:%d/%s (%s)"), 
-                        ptr->interface, ptr->port, proto, 
+                        ptr->interface, ptr->port, SH_PROTO_STR(proto), 
                         ptr->service ? ptr->service : check_services(ptr->port, proto));
 #ifdef TEST_ONLY
@@ -350 +391 @@
 #else
               if (report == SH_PORT_REPORT)
-                sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
-                                MSG_PORT_REPORT, errbuf);
+                {
+                  SH_MUTEX_LOCK(mutex_thread_nolog);
+                  sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
+                                  MSG_PORT_REPORT, errbuf);
+                  SH_MUTEX_UNLOCK(mutex_thread_nolog);
+                }
 #endif
             }
@@ -361 +406 @@
               if (portchk_debug && report)
                 fprintf(stderr, _("removing: port %d/%s %d %d\n"),
-                        ptr->port, proto, ptr->flag, ptr->status);
+                        ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
               
               if (ptr == *head)
@@ -399 +444 @@
 
 
-static struct sh_portentry * sh_portchk_get_from_list (char * proto, int port, 
+static struct sh_portentry * sh_portchk_get_from_list (int proto, int port, 
                                                        struct in_addr haddr, char * service)
 {
@@ -407 +452 @@
   sl_strlcpy (iface_all, _("0.0.0.0"), sizeof(iface_all));
   
-  if (0 == strcmp(proto, "tcp"))
+  if (proto == IPPROTO_TCP)
     portlist = portlist_tcp;
   else
@@ -439 +484 @@
       
 
-static void sh_portchk_cmp_to_list (char * proto, int port, struct in_addr haddr, char * service)
+static void sh_portchk_cmp_to_list (int proto, int port, struct in_addr haddr, char * service)
 {
   struct sh_portentry * portent;
@@ -452 +497 @@
         {
           snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceNew] port %s:%d/%s (%s)"), 
-                    inet_ntoa(haddr), port, proto, service);
+                    inet_ntoa(haddr), port, SH_PROTO_STR(proto), service);
 #ifdef TEST_ONLY
           fprintf(stderr, _("open port: %s:%d/%s (%s)\n"), 
-                  inet_ntoa(haddr), port, proto, service);
-#else
+                  inet_ntoa(haddr), port, SH_PROTO_STR(proto), service);
+#else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
                           MSG_PORT_REPORT, errbuf);
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
           /* 
@@ -468 +515 @@
         {
           snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceRestarted] port %s:%d/%s to %d/%s (%s)"), 
-                    inet_ntoa(haddr), portent->port, proto, port, proto, service);
+                    inet_ntoa(haddr), portent->port, SH_PROTO_STR(proto), port, SH_PROTO_STR(proto), service);
 #ifdef TEST_ONLY
           fprintf(stderr, _("service: %s\n"), errbuf);
 #else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
                           MSG_PORT_REPORT, errbuf);
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
 
@@ -481 +530 @@
         {
           snprintf (errbuf, sizeof(errbuf), _("POLICY [ServicePortSwitch] port %s:%d/%s to %d/%s (%s)"), 
-                    inet_ntoa(haddr), portent->port, proto, port, proto, service);
+                    inet_ntoa(haddr), portent->port, SH_PROTO_STR(proto), port, SH_PROTO_STR(proto), service);
 #ifdef TEST_ONLY
           fprintf(stderr, _("service: %s\n"), errbuf);
 #else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
                           MSG_PORT_REPORT, errbuf);
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
           portent->port   = port;
@@ -501 +552 @@
         {
           snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceNew] port %s:%d/%s (%s)"), 
-                    inet_ntoa(haddr), port, proto, check_services(port, proto));
+                    inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
 #ifdef TEST_ONLY
           fprintf(stderr, _("open port: %s:%d/%s (%s)\n"), 
-                  inet_ntoa(haddr), port, proto, check_services(port, proto));
-#else
+                  inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
+#else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
                           MSG_PORT_REPORT, errbuf);
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
 
@@ -517 +570 @@
         {
           snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceRestarted] port %s:%d/%s (%s)"), 
-                    inet_ntoa(haddr), port, proto, check_services(port, proto));
+                    inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
 #ifdef TEST_ONLY
           fprintf(stderr, _("port   : %s\n"), errbuf);
 #else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
                           MSG_PORT_REPORT, errbuf);
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
 
@@ -541 +596 @@
  * Returns NULL on failure
  */
-static char * check_services (int port, char * proto)
+static char * check_services (int port, int proto)
 {
   static char buf[256];
-  struct servent * service = getservbyport(htons(port), proto);
+  struct servent * service = getservbyport(htons(port), SH_PROTO_STR(proto));
 
   if (service && service->s_name && service->s_name[0] != '\0')
@@ -630 +685 @@
       sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/udp on %15s: %s"),
                   port, inet_ntoa(haddr), sh_error_message(errno, errbuf, sizeof(errbuf)));
+      SH_MUTEX_LOCK(mutex_thread_nolog);
       sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN, 
                       errmsg, _("connect"));
+      SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
     }
@@ -666 +723 @@
               p = check_rpc_list (port, &sinr, IPPROTO_UDP);
               
-              sh_portchk_cmp_to_list ("udp", port, haddr, p ? p : NULL);
+              sh_portchk_cmp_to_list (IPPROTO_UDP, port, haddr, p ? p : NULL);
               
               /* If not an RPC service, try to get name from /etc/services
                */
               if (!p)
-                p = check_services(port, "udp");
+                p = check_services(port, IPPROTO_UDP);
               
               if (portchk_debug)
@@ -722 +779 @@
       sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/tcp on %15s: %s"),
                   port, inet_ntoa(haddr), sh_error_message(errno, errbuf, sizeof(errbuf)));
+      SH_MUTEX_LOCK(mutex_thread_nolog);
       sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN, 
                       errmsg, _("connect"));
+      SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
     }
@@ -732 +791 @@
       p = check_rpc_list (port, &sinr, IPPROTO_TCP);
 
-      sh_portchk_cmp_to_list ("tcp", port, haddr, p ? p : NULL);
+      sh_portchk_cmp_to_list (IPPROTO_TCP, port, haddr, p ? p : NULL);
 
       /* If not an RPC service, try to get name from /etc/services
        */
       if (!p)
-        p = check_services(port, "tcp");
+        p = check_services(port, IPPROTO_TCP);
 
       if (portchk_debug)
@@ -815 +874 @@
 #endif
 
-int sh_portchk_init (struct mod_type * arg)
+static int sh_portchk_init_internal (void)
 {
   struct hostent * hent;
   int              i = 0;
   char errbuf[256];
-  (void) arg;
 
   if (portchk_debug)
@@ -831 +889 @@
     return -1;
 
+  SH_MUTEX_LOCK(mutex_port_check);
   if (iface_initialized == 0)
     {
@@ -852 +911 @@
       sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), 
                   inet_ntoa(iface_list.iface[i]));
+      SH_MUTEX_LOCK(mutex_thread_nolog);
       sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN, 
                       errbuf, _("sh_portchk_init"));
-    }
+      SH_MUTEX_UNLOCK(mutex_thread_nolog);
+    }
+  SH_MUTEX_UNLOCK(mutex_port_check);
 
   return 0;
 }
+
+int sh_portchk_init (struct mod_type * arg)
+{
+  if (sh_portchk_active == S_FALSE)
+    return SH_MOD_FAILED;
+  if (!portchk_hostname)
+    return SH_MOD_FAILED;
+
+#ifdef HAVE_PTHREAD
+  if (arg != NULL && arg->initval < 0 &&
+      (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE))
+    {
+      if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
+        return SH_MOD_THREAD;
+      else
+        return SH_MOD_FAILED;
+    }
+#endif
+  return sh_portchk_init_internal();
+}
+
+
 
 #if !defined(TEST_ONLY)
 int sh_portchk_reconf ()
 {
+  SH_MUTEX_LOCK(mutex_port_check);
   iface_initialized    = 0;
-
   sh_portchk_active    = 1;
   sh_portchk_check_udp = 1;
+  sh_portchk_interval  = SH_PORTCHK_INTERVAL;
 
   portlist_udp = sh_portchk_kill_list (portlist_udp);
   portlist_tcp = sh_portchk_kill_list (portlist_tcp);
+
+  blacklist_udp = sh_portchk_kill_blacklist (blacklist_udp);
+  blacklist_tcp = sh_portchk_kill_blacklist (blacklist_tcp);
+  SH_MUTEX_UNLOCK(mutex_port_check);
   return 0;
 }
@@ -903 +992 @@
   while (i < iface_list.used)
     {
+      haddr.s_addr = iface_list.iface[i].s_addr;
+
+      if (0 != sh_portchk_is_blacklisted(port, haddr, protocol))
+        {
+          ++i; continue;
+        }
+
       if ((sock = socket(AF_INET, type, protocol)) < 0 )
         {
@@ -909 +1005 @@
             perror(_("socket"));
 #else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN, 
                           sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
+          ++i;
+          continue;
 #endif
         }
@@ -920 +1020 @@
             perror(_("setsockopt"));
 #else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN, 
                           sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
-#endif
-        }
-
-      memcpy (&(haddr.s_addr), &(iface_list.iface[i].s_addr), sizeof(in_addr_t));
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
+#endif
+          ++i;
+          continue;
+        }
+
 
       if (protocol == IPPROTO_TCP)
@@ -982 +1085 @@
             perror(_("socket"));
 #else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN, 
                           sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
-#endif
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
+#endif
+          continue;
         }
       if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
@@ -993 +1099 @@
             perror(_("setsockopt"));
 #else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN, 
                           sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
-#endif
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
+#endif
+          continue;
         }
 
@@ -1027 +1136 @@
                 perror(_("bind"));
 #else
+              SH_MUTEX_LOCK(mutex_thread_nolog);
               sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN, 
                               sh_error_message(errno, errbuf, sizeof(errbuf)), _("bind"));
+              SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
             }
@@ -1067 +1178 @@
 
   sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), inet_ntoa(haddr));
+  SH_MUTEX_LOCK(mutex_thread_nolog);
   sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN, 
                   errbuf, _("sh_portchk_add_interface"));
+  SH_MUTEX_UNLOCK(mutex_thread_nolog);
 
   memcpy (&(iface_list.iface[iface_list.used].s_addr), &(haddr.s_addr), sizeof(in_addr_t));
@@ -1076 +1189 @@
 }
 
+/* verify whether port/interface is blacklisted (do not check)
+ */
+static int sh_portchk_is_blacklisted(int port, struct in_addr haddr, int proto)
+{
+  struct sh_port * head;
+
+  if (proto == IPPROTO_TCP)
+    head = blacklist_tcp;
+  else
+    head = blacklist_udp;
+
+  while (head)
+    {
+      if (head->port == port)
+        {
+          if ((head->haddr.s_addr == 0) || (head->haddr.s_addr == haddr.s_addr))
+            return 1;
+          else
+            return 0;
+        }
+      head = head->next;
+    }
+  return 0;
+}
+
+
+static int sh_portchk_blacklist(int port, struct in_addr haddr, int proto)
+{
+  struct sh_port * black;
+  struct sh_port * head;
+
+  if (proto == IPPROTO_TCP)
+    head = blacklist_tcp;
+  else
+    head = blacklist_udp;
+
+  black = head;
+
+  while (black)
+    {
+      if (black->port == port && head->haddr.s_addr == haddr.s_addr)
+        return -1;
+      black = black->next;
+    }
+  black = SH_ALLOC (sizeof(struct sh_port));
+  black->port  = port;
+  black->haddr.s_addr = haddr.s_addr;
+  black->next  = head;
+
+  if (proto == IPPROTO_TCP)
+    blacklist_tcp = black;
+  else
+    blacklist_udp = black;
+  return 0;
+}
+  
  
 /* Subroutine to add a required or optional port/service
@@ -1082 +1251 @@
 {
   char buf[256];
-  char proto[4];
+  int proto;
   char * p;
   char * endptr;
@@ -1098 +1267 @@
     return -1;
   if (0 == strcmp(p, _("/tcp")))
-    sl_strlcpy(proto, _("tcp"), sizeof(proto));
-  else if  (0 == strcmp(p, _("/udp")))   
-    sl_strlcpy(proto, _("udp"), sizeof(proto));
+    proto = IPPROTO_TCP;
+  else if  (0 == strcmp(p, _("/udp")))
+    proto = IPPROTO_UDP;
   else
     return -1;
@@ -1106 +1275 @@
   *p = '\0';
   port = strtoul(buf, &endptr, 0);
+
+  /* Blacklisted ports
+   */
+  if (*endptr == '\0' && port <= 65535 && type == SH_PORT_BLACKLIST)
+    return (sh_portchk_blacklist(port, haddr, proto));
 
   if (*endptr != '\0')
@@ -1115 +1289 @@
         {
 #ifdef TEST_ONLY
-          fprintf(stderr, "** WARNING: duplicate port definition %s/%s\n", buf, proto);
-#else
+          fprintf(stderr, "** WARNING: duplicate port definition %s/%s\n", buf, SH_PROTO_STR(proto));
+#else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN, 
                           _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
           return -1;
@@ -1131 +1307 @@
         {
 #ifdef TEST_ONLY
-          fprintf(stderr, "** WARNING: duplicate port definition %lu/%s\n", port, proto);
-#else
+          fprintf(stderr, "** WARNING: duplicate port definition %lu/%s\n", port, SH_PROTO_STR(proto));
+#else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN, 
                           _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
           return -1;
@@ -1151 +1329 @@
   size_t len;
   size_t ll = 0;
+  int    status;
 
   char * interface = NULL;
@@ -1213 +1392 @@
   while (p)
     {
-      if (-1 == sh_portchk_add_required_port_generic (p, interface, type))
+      status = sh_portchk_add_required_port_generic (p, interface, type);
+
+      if (-1 == status)
         {
           SH_FREE(interface);
@@ -1251 +1432 @@
 }
 
+/* User interface to add ports that should not be checked as 'iface:portlist'
+ */
+static int sh_portchk_add_blacklist (const char * str)
+{
+  return sh_portchk_add_required_generic (str, SH_PORT_BLACKLIST); 
+}
+
 /* Interface to run port check
  */
@@ -1257 +1445 @@
   int min_port = 0;
 
+  SH_MUTEX_LOCK(mutex_port_check);
   if (sh_portchk_active != S_FALSE)
     {
@@ -1266 +1455 @@
           fprintf(stderr, "** WARNING not scanning ports < 1024\n");
 #else
+          SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN, 
                           _("not scanning ports below 1024"), _("sh_portchk_check"));
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
         }
@@ -1273 +1464 @@
         sh_portchk_scan_ports_udp(min_port, -1);
       sh_portchk_scan_ports_tcp(min_port, -1);
-      sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_REPORT);
+      sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_REPORT);
       if (sh_portchk_check_udp == 1)
-        sh_portchk_check_list (&portlist_udp, "udp", SH_PORT_REPORT);
-    }
+        sh_portchk_check_list (&portlist_udp, IPPROTO_UDP, SH_PORT_REPORT);
+    }
+  SH_MUTEX_UNLOCK(mutex_port_check);
   return 0;
 }
@@ -1292 +1484 @@
   CuAssertTrue(tc, 0 != inet_aton("127.0.0.1", &haddr_local));
 
-  sh_portchk_add_to_list ("tcp",  8000, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
-
-  portent = sh_portchk_get_from_list("tcp",  8000, haddr_local, NULL);
+  sh_portchk_add_to_list (IPPROTO_TCP,  8000, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
+
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8000, haddr_local, NULL);
   CuAssertPtrNotNull(tc, portent);
 
@@ -1302 +1494 @@
   CuAssertTrue(tc, portent->flag == SH_PORT_NOT);
 
-  sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_NOREPT);
+  sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
 
   CuAssertTrue(tc, NULL == portlist_tcp);
 
-  sh_portchk_add_to_list ("tcp",  8000, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",  8001, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",  8002, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",  8003, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",  8004, haddr_local, NULL, SH_PORT_IGN, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",    -1, haddr_local, "foo1", SH_PORT_NOT, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",    -1, haddr_local, "foo2", SH_PORT_REQ, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",    -1, haddr_local, "foo3", SH_PORT_NOT, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",    -1, haddr_local, "foo4", SH_PORT_REQ, SH_PORT_UNKN);
-  sh_portchk_add_to_list ("tcp",    -1, haddr_local, "foo5", SH_PORT_IGN, SH_PORT_UNKN);
-
-  sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_NOREPT);
+  sh_portchk_add_to_list (IPPROTO_TCP,  8000, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,  8001, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,  8002, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,  8003, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,  8004, haddr_local, NULL, SH_PORT_IGN, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,    -1, haddr_local, "foo1", SH_PORT_NOT, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,    -1, haddr_local, "foo2", SH_PORT_REQ, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,    -1, haddr_local, "foo3", SH_PORT_NOT, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,    -1, haddr_local, "foo4", SH_PORT_REQ, SH_PORT_UNKN);
+  sh_portchk_add_to_list (IPPROTO_TCP,    -1, haddr_local, "foo5", SH_PORT_IGN, SH_PORT_UNKN);
+
+  sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
 
   CuAssertPtrNotNull(tc, portlist_tcp);
 
-  portent = sh_portchk_get_from_list("tcp",  8000, haddr_local, NULL);
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8000, haddr_local, NULL);
   CuAssertPtrNotNull(tc, portent);
 
-  portent = sh_portchk_get_from_list("tcp",  8001, haddr_local, NULL);
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8001, haddr_local, NULL);
   CuAssertTrue(tc, NULL == portent);
 
-  portent = sh_portchk_get_from_list("tcp",  8002, haddr_local, NULL);
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8002, haddr_local, NULL);
   CuAssertPtrNotNull(tc, portent);
 
-  portent = sh_portchk_get_from_list("tcp",  8003, haddr_local, NULL);
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8003, haddr_local, NULL);
   CuAssertTrue(tc, NULL == portent);
 
-  portent = sh_portchk_get_from_list("tcp",  8004, haddr_local, NULL);
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8004, haddr_local, NULL);
   CuAssertPtrNotNull(tc, portent);
 
-  portent = sh_portchk_get_from_list("tcp",  8000, haddr_local, "foo1");
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8000, haddr_local, "foo1");
   CuAssertTrue(tc, NULL == portent);
 
-  portent = sh_portchk_get_from_list("tcp",  8000, haddr_local, "foo2");
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8000, haddr_local, "foo2");
   CuAssertPtrNotNull(tc, portent);
   CuAssertTrue(tc, 0 == strcmp(portent->service, "foo2"));
 
-  portent = sh_portchk_get_from_list("tcp",  8000, haddr_local, "foo3");
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8000, haddr_local, "foo3");
   CuAssertTrue(tc, NULL == portent);
 
-  portent = sh_portchk_get_from_list("tcp",  8000, haddr_local, "foo4");
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8000, haddr_local, "foo4");
   CuAssertPtrNotNull(tc, portent);
   CuAssertTrue(tc, 0 == strcmp(portent->service, "foo4"));
 
-  portent = sh_portchk_get_from_list("tcp",  8000, haddr_local, "foo5");
+  portent = sh_portchk_get_from_list(IPPROTO_TCP,  8000, haddr_local, "foo5");
   CuAssertPtrNotNull(tc, portent);
   CuAssertTrue(tc, 0 == strcmp(portent->service, "foo5"));
+
+  CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, haddr_local, IPPROTO_TCP));
+  CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, haddr_local, IPPROTO_TCP));
+  CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, haddr_local, IPPROTO_TCP));
+  CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, haddr_local, IPPROTO_TCP));
+  CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, haddr_local, IPPROTO_UDP));
+  CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, haddr_local, IPPROTO_UDP));
+  CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, haddr_local, IPPROTO_UDP));
+  CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, haddr_local, IPPROTO_UDP));
+
+  CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, haddr_local, IPPROTO_UDP));
+  CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, haddr_local, IPPROTO_UDP));
+  CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, haddr_local, IPPROTO_UDP));
+  CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, haddr_local, IPPROTO_UDP));
+
+  CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, haddr_local, IPPROTO_TCP));
+  CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, haddr_local, IPPROTO_TCP));
+  CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, haddr_local, IPPROTO_TCP));
+  CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, haddr_local, IPPROTO_TCP));
 #else
   (void) tc; /* fix compiler warning */