From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=0.2 required=5.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.4 Received: (qmail 28468 invoked from network); 11 Dec 2023 19:35:19 -0000 Received: from 9front.inri.net (168.235.81.73) by inbox.vuxu.org with ESMTPUTF8; 11 Dec 2023 19:35:19 -0000 Received: from mail-pf1-f171.google.com ([209.85.210.171]) by 9front; Mon Dec 11 14:32:16 -0500 2023 Received: by mail-pf1-f171.google.com with SMTP id d2e1a72fcca58-6ce6f4d3dafso1128672b3a.0 for <9front@9front.org>; Mon, 11 Dec 2023 11:32:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702323134; x=1702927934; darn=9front.org; h=to:subject:message-id:date:from:references:in-reply-to:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=5tcL8kE8ghfFSOhgUYa+xVDGQYOdxq7CnJrm/HLLtX0=; b=brsHwiwlai/T0U7GMtsJJ1EgL+umNlzqiAmuC2oidkwkwCmaA6g+8o/DD63oimgaib M/kc+dwi3b1kvW2eCwM1xpNmRBjvc+twyxu8yKr9jzu0MeCoe+ZytTqf/vOsSajJA6oA tTWPDXpBXn094pwAWyTcry3bx+AEYuWY0S525m9Ky+TSj6STzDYOZYuPk2d8rvx3vAg8 SNvb3lEHu4WSRFPhYrxM4O4yyaWj9DykwSFd0ANQCTAsFP54uzty8Os6WH/ephb6TfnV dafijfYggIZWfYXjHwTirlEIS+MKk+XiRGcOQVE9/8gDqaERBKtZBGmF5S/3gtnHPaOd XDyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702323134; x=1702927934; h=to:subject:message-id:date:from:references:in-reply-to:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=5tcL8kE8ghfFSOhgUYa+xVDGQYOdxq7CnJrm/HLLtX0=; b=bpfhuzbqvQd0mThANps8UDGm+AhyrNriiXZCFaxr37lopPvsENcmIHsNgLwwhyNkve rF5jCqdD3QLPOzFMNBSYsljNHF3nZT1a2sZG6RH+XfB1C8jvVllBFcyRc6P+hzAnxwF9 E3fl2T22El17YOF55OSo+5sxQCccR7Py98QPmZdz2qgswVcxeYb8zltET5gafkv2u+5V tnTdeXhA/2QKj5tTXTMzXv2vahgPNH3UtrWRAcEnUmVzTkIrNXTlLd40sV7h+ctMYd+n GaSDC3D5yZLCAhuuwTarFgdAVEhjJZRXu1P6wfsUkjLqKNA+v3mQ6+5XB5xHXgRiAPwc fCdw== X-Gm-Message-State: AOJu0YzG8TtQIMkAWrQz7y651TPPk4XSBGV8hAyU24d37sY3iVADxrom CT5cTx7eDPBkUjAP8jeN5WhJkpEid3iZ6NGLWd2J3SI6JyYMDQ== X-Google-Smtp-Source: AGHT+IHMY7q7t2Vtc9BlwLwM1W0mtAcO3EYC8C4x4iYQ81FXUBYAQdJysZ53jJk2J//0uLiw+nOfgchWTCNpzY1QsPs= X-Received: by 2002:a05:6a20:3c8d:b0:18b:2020:8cd1 with SMTP id b13-20020a056a203c8d00b0018b20208cd1mr11481371pzj.3.1702323134390; Mon, 11 Dec 2023 11:32:14 -0800 (PST) MIME-Version: 1.0 Received: by 2002:a05:7300:7315:b0:fb:64f3:3b3d with HTTP; Mon, 11 Dec 2023 11:32:13 -0800 (PST) In-Reply-To: <9d4caff6-b6a8-4eac-aa16-6de8f6cc38fd@posixcafe.org> References: <0C0E7B64F2E5A67D8B1525C4B2EF8C7A@smtp.pobox.com> <5a980207-39e8-4a47-8b1c-6e9810946c8a@posixcafe.org> <9d4caff6-b6a8-4eac-aa16-6de8f6cc38fd@posixcafe.org> From: hiro <23hiro@gmail.com> Date: Mon, 11 Dec 2023 20:32:13 +0100 Message-ID: To: 9front@9front.org Content-Type: text/plain; charset="UTF-8" List-ID: <9front.9front.org> List-Help: X-Glyph: ➈ X-Bullshit: optimized agile content-driven event storage Subject: Re: [9front] [PITCH] ip/null Reply-To: 9front@9front.org Precedence: bulk in that case, the routing logic should allow routing to a null route in the kernel, preferably. at least for the source/destination IP based filters that's good enough. port-based (L4) firewalls should become less necessary over time that we just assign ip addresses to individual services instead. that's my utopia at least ;) On 12/11/23, Jacob Moody wrote: > On 12/11/23 13:17, hiro wrote: >> is your example more fine-grained than routing tables? >> in that case i misread the example. > > My example was not, but ipmux allows you to index > arbitrarily in to the ip data portion to do matching. > >> >> On 12/11/23, Jacob Moody wrote: >>> Indeed, but right now ipmux is the only tool we have for doing any >>> filtering more fine grained then routing tables as far as I know. >>> >>> I would like our own pf-like but that would require going back to >>> the drawing board. >>> >>> On 12/11/23 13:05, hiro wrote: >>>> it would be good if it wouldn't need to get all the way to userland >>>> before being dropped. >>>> >>>> On 12/11/23, Jacob Moody wrote: >>>>> This as obsoleted by cinap's aux/dial(1). >>>>> It functionally works the same here except you would >>>>> need an explicit direction to /dev/null. >>>>> >>>>> ie. >>>>> >>>>> aux/dial >>>>> 'ipmux!ifc=my.external.ip;dst=192.168.0.0&255.255.0.0|10.0.0.0&255.0.0.0' >>>>>> >>>>> /dev/null >>>>> >>>>> On 12/11/23 12:54, unobe@cpan.org wrote: >>>>>> FWIW, I haven't seen anyone else comment on this, but I like it. >>>>>> >>>>>> Quoth Jacob Moody : >>>>>>> As I play around more with 9front as my router, I found myself >>>>>>> reaching >>>>>>> for some >>>>>>> kind of 'firewall'. I find that we already have a pretty good >>>>>>> interface >>>>>>> in the kernel >>>>>>> in the form of ipmux. But there isn't too many ways of making use of >>>>>>> it >>>>>>> as is. I hacked up >>>>>>> something quick to just drop packets matching a filter on to the >>>>>>> floor. >>>>>>> If others find it >>>>>>> useful I can make up a man page and present again with a bit more >>>>>>> polish. >>>>>>> >>>>>>> Some examples: >>>>>>> # Drop inbound private range >>>>>>> ip/null >>>>>>> 'ifc=my.external.ip;dst=192.168.0.0&255.255.0.0|10.0.0.0&255.0.0.0' >>>>>>> >>>>>>> # google verboden >>>>>>> ip/null 'ifc=my.internal.ip;dst=8.8.8.8;src=192.168.0.0&255.255.0.0' >>>>>>> >>>>>>> thanks, >>>>>>> moody >>>>>>> >>>>>>> --- /dev/null >>>>>>> +++ b//sys/src/cmd/ip/null.c >>>>>>> @@ -1,0 +1,36 @@ >>>>>>> +#include >>>>>>> +#include >>>>>>> + >>>>>>> +void >>>>>>> +usage(void) >>>>>>> +{ >>>>>>> + fprint(2, "usage: %s filter\n", argv0); >>>>>>> + exits("usage"); >>>>>>> +} >>>>>>> + >>>>>>> +void >>>>>>> +main(int argc, char **argv) >>>>>>> +{ >>>>>>> + char buf[64 * 1024]; >>>>>>> + int fd; >>>>>>> + >>>>>>> + ARGBEGIN{ >>>>>>> + default: >>>>>>> + usage(); >>>>>>> + break; >>>>>>> + }ARGEND >>>>>>> + if(argc < 1) >>>>>>> + usage(); >>>>>>> + >>>>>>> + fd = dial(smprint("ipmux!%s", argv[0]), nil, nil, nil); >>>>>>> + if(fd < 0) >>>>>>> + sysfatal("dial: %r"); >>>>>>> + >>>>>>> + for(;;) >>>>>>> + switch(read(fd, buf, sizeof buf)){ >>>>>>> + case -1: >>>>>>> + sysfatal("read: %r"); >>>>>>> + case 0: >>>>>>> + return; >>>>>>> + } >>>>>>> +} >>>>>> >>>>> >>>>> >>> >>> > >