From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=0.2 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.4 Received: (qmail 27910 invoked from network); 11 Dec 2023 19:24:17 -0000 Received: from 9front.inri.net (168.235.81.73) by inbox.vuxu.org with ESMTPUTF8; 11 Dec 2023 19:24:17 -0000 Received: from mail.posixcafe.org ([45.76.19.58]) by 9front; Mon Dec 11 14:22:21 -0500 2023 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=posixcafe.org; s=20200506; t=1702322591; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mfCaEuNkjncnIoPKLTi7C3+JuLRThyVuyIELW1iokKY=; b=SQxebbgiIsN0OztDwWtg5xL7V1oD81lR5V2+x+q4/phi1mOhbkMl0iyHhcPrjASHSLaygP Oi0l+lSEZ7VZIJYU3WriIQaajax0FlN9uYMWKxauJaJDk5xCKLTyNbHNNjkmnYXsiMHWml XPpxi1cOr38/qv0uW9Eh+iLyYKkFCCc= Received: from [192.168.168.200] ( [207.45.82.38]) by mail.posixcafe.org (OpenSMTPD) with ESMTPSA id 60ffa2c7 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO) for <9front@9front.org>; Mon, 11 Dec 2023 13:23:11 -0600 (CST) Message-ID: <9d4caff6-b6a8-4eac-aa16-6de8f6cc38fd@posixcafe.org> Date: Mon, 11 Dec 2023 13:22:20 -0600 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: 9front@9front.org References: <0C0E7B64F2E5A67D8B1525C4B2EF8C7A@smtp.pobox.com> <5a980207-39e8-4a47-8b1c-6e9810946c8a@posixcafe.org> From: Jacob Moody In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit List-ID: <9front.9front.org> List-Help: X-Glyph: ➈ X-Bullshit: overflow-preventing basic hypervisor hypervisor Subject: Re: [9front] [PITCH] ip/null Reply-To: 9front@9front.org Precedence: bulk On 12/11/23 13:17, hiro wrote: > is your example more fine-grained than routing tables? > in that case i misread the example. My example was not, but ipmux allows you to index arbitrarily in to the ip data portion to do matching. > > On 12/11/23, Jacob Moody wrote: >> Indeed, but right now ipmux is the only tool we have for doing any >> filtering more fine grained then routing tables as far as I know. >> >> I would like our own pf-like but that would require going back to >> the drawing board. >> >> On 12/11/23 13:05, hiro wrote: >>> it would be good if it wouldn't need to get all the way to userland >>> before being dropped. >>> >>> On 12/11/23, Jacob Moody wrote: >>>> This as obsoleted by cinap's aux/dial(1). >>>> It functionally works the same here except you would >>>> need an explicit direction to /dev/null. >>>> >>>> ie. >>>> >>>> aux/dial >>>> 'ipmux!ifc=my.external.ip;dst=192.168.0.0&255.255.0.0|10.0.0.0&255.0.0.0' >>>>> >>>> /dev/null >>>> >>>> On 12/11/23 12:54, unobe@cpan.org wrote: >>>>> FWIW, I haven't seen anyone else comment on this, but I like it. >>>>> >>>>> Quoth Jacob Moody : >>>>>> As I play around more with 9front as my router, I found myself >>>>>> reaching >>>>>> for some >>>>>> kind of 'firewall'. I find that we already have a pretty good >>>>>> interface >>>>>> in the kernel >>>>>> in the form of ipmux. But there isn't too many ways of making use of >>>>>> it >>>>>> as is. I hacked up >>>>>> something quick to just drop packets matching a filter on to the >>>>>> floor. >>>>>> If others find it >>>>>> useful I can make up a man page and present again with a bit more >>>>>> polish. >>>>>> >>>>>> Some examples: >>>>>> # Drop inbound private range >>>>>> ip/null >>>>>> 'ifc=my.external.ip;dst=192.168.0.0&255.255.0.0|10.0.0.0&255.0.0.0' >>>>>> >>>>>> # google verboden >>>>>> ip/null 'ifc=my.internal.ip;dst=8.8.8.8;src=192.168.0.0&255.255.0.0' >>>>>> >>>>>> thanks, >>>>>> moody >>>>>> >>>>>> --- /dev/null >>>>>> +++ b//sys/src/cmd/ip/null.c >>>>>> @@ -1,0 +1,36 @@ >>>>>> +#include >>>>>> +#include >>>>>> + >>>>>> +void >>>>>> +usage(void) >>>>>> +{ >>>>>> + fprint(2, "usage: %s filter\n", argv0); >>>>>> + exits("usage"); >>>>>> +} >>>>>> + >>>>>> +void >>>>>> +main(int argc, char **argv) >>>>>> +{ >>>>>> + char buf[64 * 1024]; >>>>>> + int fd; >>>>>> + >>>>>> + ARGBEGIN{ >>>>>> + default: >>>>>> + usage(); >>>>>> + break; >>>>>> + }ARGEND >>>>>> + if(argc < 1) >>>>>> + usage(); >>>>>> + >>>>>> + fd = dial(smprint("ipmux!%s", argv[0]), nil, nil, nil); >>>>>> + if(fd < 0) >>>>>> + sysfatal("dial: %r"); >>>>>> + >>>>>> + for(;;) >>>>>> + switch(read(fd, buf, sizeof buf)){ >>>>>> + case -1: >>>>>> + sysfatal("read: %r"); >>>>>> + case 0: >>>>>> + return; >>>>>> + } >>>>>> +} >>>>> >>>> >>>> >> >>