From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=0.2 required=5.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.4 Received: (qmail 27597 invoked from network); 11 Dec 2023 19:19:08 -0000 Received: from 9front.inri.net (168.235.81.73) by inbox.vuxu.org with ESMTPUTF8; 11 Dec 2023 19:19:08 -0000 Received: from mail-pj1-f45.google.com ([209.85.216.45]) by 9front; Mon Dec 11 14:17:52 -0500 2023 Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-28aa4456ffdso195494a91.0 for <9front@9front.org>; Mon, 11 Dec 2023 11:17:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702322269; x=1702927069; darn=9front.org; h=to:subject:message-id:date:from:references:in-reply-to:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=7U7Au0Wvph1POx4TW85b2C9risTiI5GicKvj6qWbhBg=; b=Z5tpuy18rt+k3jsOvbRSTUgNzpJ8vGPUJjPf9kVNncuiUh9vJwHXPUuHx/F/yU7yqe EVfgaFHwrPBBh2ukihb/vZc+uRCndWSObZab8pCEIqbgKqPI2fduZhtg7QB9VdgsXzvP 3Vf1VPMMlEOe5shVTR0uY2sKUk2BHb0nkG9pWT3SwlO2JcFjc01ia73tG1+1XoACgosO NUC9NXQXO3MYizJ3zFjFS7celRBipQPlatij69eHUDlg/xWHs++rGjW4kf+D+X7zq0Vd npxiegPc+uUfcBpa/E0VSnce2hbrSsOCnd4f06Xh3EHG8g/2n4xWTLhOchGhzvsyL34o vriA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702322269; x=1702927069; h=to:subject:message-id:date:from:references:in-reply-to:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=7U7Au0Wvph1POx4TW85b2C9risTiI5GicKvj6qWbhBg=; b=rShEZkKCWtTyAnNwahIQBT2NX0WLNEarxS7N+1ChNEzomS8gUdgZuRmEmBaoPDBenp 88Hd4MmYy7gHM/IRtp5u4/ZR6ml3bZi7RLw6Bd/nzf0o3RdlY+W1xfbxZ6uocGKTMBPm 8cUEr4T+SnBp7BMPGkDlD5Vu8P2aaf1Dt0BY1qNOdsq9a3HIBrr04GiaIMOhlsl27hAB RfIOJ5YbFpBMxQHKxIkvNqSnyuDhMUEpGkgvNQ8A+DOg+HKn+mRD0e9gpy85c8aG9Y6G fnbCD4A7XVzB1uWZzuZ4CBJTZZ+dSW+HRXmsTr4aE5OhYooqmGVQdGnIZ5SfQogA9ajS cPNQ== X-Gm-Message-State: AOJu0YxbHyfQZkausmrCOnbt4A8LexHeRYvNb8IQmoArF2Y2aY4ZDmzV gpL8eF39CoweBmwE5vN6KRxj0XHF6fqxpe8FoXmgxtSE8RVQSA== X-Google-Smtp-Source: AGHT+IHAk4IRSpzLOn+v5DyZJ60gPDBH2Xk+lz/khNIijdtD6Jm4lWrEZTMu3+Ugesmy8+gVWMTH21KvyANLzouXhPM= X-Received: by 2002:a17:90b:3a82:b0:283:5405:9e90 with SMTP id om2-20020a17090b3a8200b0028354059e90mr8305181pjb.3.1702322269538; Mon, 11 Dec 2023 11:17:49 -0800 (PST) MIME-Version: 1.0 Received: by 2002:a05:7300:7315:b0:fb:64f3:3b3d with HTTP; Mon, 11 Dec 2023 11:17:49 -0800 (PST) In-Reply-To: <5a980207-39e8-4a47-8b1c-6e9810946c8a@posixcafe.org> References: <0C0E7B64F2E5A67D8B1525C4B2EF8C7A@smtp.pobox.com> <5a980207-39e8-4a47-8b1c-6e9810946c8a@posixcafe.org> From: hiro <23hiro@gmail.com> Date: Mon, 11 Dec 2023 20:17:49 +0100 Message-ID: To: 9front@9front.org Content-Type: text/plain; charset="UTF-8" List-ID: <9front.9front.org> List-Help: X-Glyph: ➈ X-Bullshit: generic factory hardware descriptor Subject: Re: [9front] [PITCH] ip/null Reply-To: 9front@9front.org Precedence: bulk is your example more fine-grained than routing tables? in that case i misread the example. On 12/11/23, Jacob Moody wrote: > Indeed, but right now ipmux is the only tool we have for doing any > filtering more fine grained then routing tables as far as I know. > > I would like our own pf-like but that would require going back to > the drawing board. > > On 12/11/23 13:05, hiro wrote: >> it would be good if it wouldn't need to get all the way to userland >> before being dropped. >> >> On 12/11/23, Jacob Moody wrote: >>> This as obsoleted by cinap's aux/dial(1). >>> It functionally works the same here except you would >>> need an explicit direction to /dev/null. >>> >>> ie. >>> >>> aux/dial >>> 'ipmux!ifc=my.external.ip;dst=192.168.0.0&255.255.0.0|10.0.0.0&255.0.0.0' >>> > >>> /dev/null >>> >>> On 12/11/23 12:54, unobe@cpan.org wrote: >>>> FWIW, I haven't seen anyone else comment on this, but I like it. >>>> >>>> Quoth Jacob Moody : >>>>> As I play around more with 9front as my router, I found myself >>>>> reaching >>>>> for some >>>>> kind of 'firewall'. I find that we already have a pretty good >>>>> interface >>>>> in the kernel >>>>> in the form of ipmux. But there isn't too many ways of making use of >>>>> it >>>>> as is. I hacked up >>>>> something quick to just drop packets matching a filter on to the >>>>> floor. >>>>> If others find it >>>>> useful I can make up a man page and present again with a bit more >>>>> polish. >>>>> >>>>> Some examples: >>>>> # Drop inbound private range >>>>> ip/null >>>>> 'ifc=my.external.ip;dst=192.168.0.0&255.255.0.0|10.0.0.0&255.0.0.0' >>>>> >>>>> # google verboden >>>>> ip/null 'ifc=my.internal.ip;dst=8.8.8.8;src=192.168.0.0&255.255.0.0' >>>>> >>>>> thanks, >>>>> moody >>>>> >>>>> --- /dev/null >>>>> +++ b//sys/src/cmd/ip/null.c >>>>> @@ -1,0 +1,36 @@ >>>>> +#include >>>>> +#include >>>>> + >>>>> +void >>>>> +usage(void) >>>>> +{ >>>>> + fprint(2, "usage: %s filter\n", argv0); >>>>> + exits("usage"); >>>>> +} >>>>> + >>>>> +void >>>>> +main(int argc, char **argv) >>>>> +{ >>>>> + char buf[64 * 1024]; >>>>> + int fd; >>>>> + >>>>> + ARGBEGIN{ >>>>> + default: >>>>> + usage(); >>>>> + break; >>>>> + }ARGEND >>>>> + if(argc < 1) >>>>> + usage(); >>>>> + >>>>> + fd = dial(smprint("ipmux!%s", argv[0]), nil, nil, nil); >>>>> + if(fd < 0) >>>>> + sysfatal("dial: %r"); >>>>> + >>>>> + for(;;) >>>>> + switch(read(fd, buf, sizeof buf)){ >>>>> + case -1: >>>>> + sysfatal("read: %r"); >>>>> + case 0: >>>>> + return; >>>>> + } >>>>> +} >>>> >>> >>> > >