OpenBSD中拒绝使用rsync打开套接字/连接的权限

Question

最近，我试图使用rsync从uceprotect.net检索UCE (垃圾邮件)发送者IP的副本，但遇到以下错误：

[user@host ucedata]$ rsync -rzv rsync-mirrors.uceprotect.net::RBLDNSD-ALL/ ./                                                                                                                                                            
rsync: failed to connect to rsync-mirrors.uceprotect.net (67.58.96.162): Permission denied (13)                                                                                                                                             
rsync: failed to connect to rsync-mirrors.uceprotect.net (69.30.193.210): Permission denied (13)                                                                                                                                            
rsync: failed to connect to rsync-mirrors.uceprotect.net (72.13.86.154): Permission denied (13)                                                                                                                                             
rsync: failed to connect to rsync-mirrors.uceprotect.net (88.198.110.110): Permission denied (13)                                                                                                                                           
rsync: failed to connect to rsync-mirrors.uceprotect.net (96.31.84.20): Permission denied (13)                                                                                                                                              
rsync: failed to connect to rsync-mirrors.uceprotect.net (185.248.148.6): Permission denied (13)                                                                                                                                            
rsync: failed to connect to rsync-mirrors.uceprotect.net (193.138.29.11): Permission denied (13)                                                                                                                                            
rsync: failed to connect to rsync-mirrors.uceprotect.net (199.48.69.42): Permission denied (13)                                                                                                                                             
rsync: failed to connect to rsync-mirrors.uceprotect.net (199.187.241.194): Permission denied (13)                                                                                                                                          
rsync: failed to connect to rsync-mirrors.uceprotect.net (209.44.102.199): Permission denied (13)                                                                                                                                           
rsync: failed to connect to rsync-mirrors.uceprotect.net (209.126.213.95): Permission denied (13)                                                                                                                                           
rsync: failed to connect to rsync-mirrors.uceprotect.net (217.23.49.207): Permission denied (13)                                                                                                                                            
rsync: failed to connect to rsync-mirrors.uceprotect.net (41.208.71.58): Permission denied (13)                                                                                                                                             
rsync: failed to connect to rsync-mirrors.uceprotect.net (66.240.236.50): Permission denied (13)                                                                                                                                            
rsync error: error in socket IO (code 10) at clientserver.c(127) [Receiver=3.1.3]                                                                                                                                                           

我能够写到当前目录；为什么“权限被拒绝(13)"？

Answer 1

起初，我认为这可能是由于其他用户权限或用户限制造成的。但是，在我的特定系统上，这个特定问题的答案很简单-- OpenBSD PF被配置为阻止所有未发送到端口53、80、123或443的传出通信量。由于加载了PF规则，OpenBSD首先不允许创建TCP。

使用netcat进行的测试表明，用户和根用户都无法使用PF禁止的目标创建套接字：

[user@host ucedata]$ nc -v 67.58.96.162 873
nc: connect to 67.58.96.162 port 873 (tcp) failed: Permission denied
[root@host ucedata]# nc -v 67.58.96.162 873
nc: connect to 67.58.96.162 port 873 (tcp) failed: Permission denied

以下内核跟踪摘录显示，拒绝权限是由于尝试连接：

 70602 rsync    CALL  connect(3,0xccece01e770,16)
 70602 rsync    STRU  struct sockaddr { AF_INET, 69.30.193.210:873 }
 70602 rsync    RET   connect -1 errno 13 Permission denied

通过将pass out log on $ext_if proto tcp to any port 873添加到/etc/pf.conf并重新加载防火墙规则(pfctl -f /etc/pf.conf)，我就能够连接。