From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 29065 invoked from network); 11 Dec 2023 19:49:05 -0000 Received: from 9front.inri.net (168.235.81.73) by inbox.vuxu.org with ESMTPUTF8; 11 Dec 2023 19:49:05 -0000 Received: from pb-smtp21.pobox.com ([173.228.157.53]) by 9front; Mon Dec 11 14:45:35 -0500 2023 Received: from pb-smtp21.pobox.com (unknown [127.0.0.1]) by pb-smtp21.pobox.com (Postfix) with ESMTP id 4B4AA29345 for <9front@9front.org>; Mon, 11 Dec 2023 14:45:30 -0500 (EST) (envelope-from unobe@cpan.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=pobox.com; h=message-id :to:subject:date:from:in-reply-to:mime-version:content-type :content-transfer-encoding; s=sasl; bh=CkS+yJIcJq6qfSg72h/3LgSm9 AmJZyXqcx8UbN2nymk=; b=QuUdBjc5l1EM24ExjVxjsMVDwfiQnMiueYdqnHL6k X8M+AgkMXXjrDjjlTucd40yL9rG5k6nT4j/xL3znIfVjsQasda68AyMX2AcQalYZ i0h02rE/wI6yoP0W5S391m3YVJie0+TTbQghon2+nN8KinnF8O1kysnZKah1KpXs gQ= Received: from pb-smtp21.sea.icgroup.com (unknown [127.0.0.1]) by pb-smtp21.pobox.com (Postfix) with ESMTP id 4484529344 for <9front@9front.org>; Mon, 11 Dec 2023 14:45:30 -0500 (EST) (envelope-from unobe@cpan.org) Received: from strider.localdomain (unknown [24.205.13.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pb-smtp21.pobox.com (Postfix) with ESMTPSA id B451829343 for <9front@9front.org>; Mon, 11 Dec 2023 14:45:26 -0500 (EST) (envelope-from unobe@cpan.org) Message-ID: To: 9front@9front.org Date: Mon, 11 Dec 2023 11:45:25 -0800 From: unobe@cpan.org In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Pobox-Relay-ID: D4FE6FB8-985D-11EE-BBE6-A19503B9AAD1-09620299!pb-smtp21.pobox.com List-ID: <9front.9front.org> List-Help: X-Glyph: ➈ X-Bullshit: shader-scale database replication DOM-aware framework Subject: Re: [9front] [PITCH] ip/null Reply-To: 9front@9front.org Precedence: bulk Splendid! Quoth Jacob Moody : > This as obsoleted by cinap's aux/dial(1). > It functionally works the same here except you would > need an explicit direction to /dev/null. > > ie. > > aux/dial 'ipmux!ifc=my.external.ip;dst=192.168.0.0&255.255.0.0|10.0.0.0&255.0.0.0' > /dev/null > > On 12/11/23 12:54, unobe@cpan.org wrote: > > FWIW, I haven't seen anyone else comment on this, but I like it. > > > > Quoth Jacob Moody : > >> As I play around more with 9front as my router, I found myself reaching for some > >> kind of 'firewall'. I find that we already have a pretty good interface in the kernel > >> in the form of ipmux. But there isn't too many ways of making use of it as is. I hacked up > >> something quick to just drop packets matching a filter on to the floor. If others find it > >> useful I can make up a man page and present again with a bit more polish. > >> > >> Some examples: > >> # Drop inbound private range > >> ip/null 'ifc=my.external.ip;dst=192.168.0.0&255.255.0.0|10.0.0.0&255.0.0.0' > >> > >> # google verboden > >> ip/null 'ifc=my.internal.ip;dst=8.8.8.8;src=192.168.0.0&255.255.0.0' > >> > >> thanks, > >> moody > >> > >> --- /dev/null > >> +++ b//sys/src/cmd/ip/null.c > >> @@ -1,0 +1,36 @@ > >> +#include > >> +#include > >> + > >> +void > >> +usage(void) > >> +{ > >> + fprint(2, "usage: %s filter\n", argv0); > >> + exits("usage"); > >> +} > >> + > >> +void > >> +main(int argc, char **argv) > >> +{ > >> + char buf[64 * 1024]; > >> + int fd; > >> + > >> + ARGBEGIN{ > >> + default: > >> + usage(); > >> + break; > >> + }ARGEND > >> + if(argc < 1) > >> + usage(); > >> + > >> + fd = dial(smprint("ipmux!%s", argv[0]), nil, nil, nil); > >> + if(fd < 0) > >> + sysfatal("dial: %r"); > >> + > >> + for(;;) > >> + switch(read(fd, buf, sizeof buf)){ > >> + case -1: > >> + sysfatal("read: %r"); > >> + case 0: > >> + return; > >> + } > >> +} > > >