head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC4:1.1.1.1 netbsd-11-0-RC3:1.1.1.1 netbsd-11-0-RC2:1.1.1.1 netbsd-11-0-RC1:1.1.1.1 perseant-exfatfs-base-20250801:1.1.1.1 netbsd-11:1.1.1.1.0.50 netbsd-11-base:1.1.1.1 netbsd-10-1-RELEASE:1.1.1.1 perseant-exfatfs-base-20240630:1.1.1.1 perseant-exfatfs:1.1.1.1.0.48 perseant-exfatfs-base:1.1.1.1 netbsd-8-3-RELEASE:1.1.1.1 netbsd-9-4-RELEASE:1.1.1.1 netbsd-10-0-RELEASE:1.1.1.1 netbsd-10-0-RC6:1.1.1.1 netbsd-10-0-RC5:1.1.1.1 netbsd-10-0-RC4:1.1.1.1 netbsd-10-0-RC3:1.1.1.1 netbsd-10-0-RC2:1.1.1.1 netbsd-10-0-RC1:1.1.1.1 netbsd-10:1.1.1.1.0.46 netbsd-10-base:1.1.1.1 netbsd-9-3-RELEASE:1.1.1.1 cjep_sun2x-base1:1.1.1.1 cjep_sun2x:1.1.1.1.0.44 cjep_sun2x-base:1.1.1.1 cjep_staticlib_x-base1:1.1.1.1 netbsd-9-2-RELEASE:1.1.1.1 cjep_staticlib_x:1.1.1.1.0.42 cjep_staticlib_x-base:1.1.1.1 netbsd-9-1-RELEASE:1.1.1.1 phil-wifi-20200421:1.1.1.1 phil-wifi-20200411:1.1.1.1 is-mlppp:1.1.1.1.0.40 is-mlppp-base:1.1.1.1 phil-wifi-20200406:1.1.1.1 netbsd-8-2-RELEASE:1.1.1.1 netbsd-9-0-RELEASE:1.1.1.1 netbsd-9-0-RC2:1.1.1.1 netbsd-9-0-RC1:1.1.1.1 phil-wifi-20191119:1.1.1.1 netbsd-9:1.1.1.1.0.38 netbsd-9-base:1.1.1.1 phil-wifi-20190609:1.1.1.1 netbsd-8-1-RELEASE:1.1.1.1 netbsd-8-1-RC1:1.1.1.1 pgoyette-compat-merge-20190127:1.1.1.1 pgoyette-compat-20190127:1.1.1.1 pgoyette-compat-20190118:1.1.1.1 pgoyette-compat-1226:1.1.1.1 pgoyette-compat-1126:1.1.1.1 pgoyette-compat-1020:1.1.1.1 pgoyette-compat-0930:1.1.1.1 pgoyette-compat-0906:1.1.1.1 netbsd-7-2-RELEASE:1.1.1.1 pgoyette-compat-0728:1.1.1.1 netbsd-8-0-RELEASE:1.1.1.1 phil-wifi:1.1.1.1.0.36 phil-wifi-base:1.1.1.1 pgoyette-compat-0625:1.1.1.1 netbsd-8-0-RC2:1.1.1.1 pgoyette-compat-0521:1.1.1.1 pgoyette-compat-0502:1.1.1.1 pgoyette-compat-0422:1.1.1.1 netbsd-8-0-RC1:1.1.1.1 pgoyette-compat-0415:1.1.1.1 pgoyette-compat-0407:1.1.1.1 pgoyette-compat-0330:1.1.1.1 pgoyette-compat-0322:1.1.1.1 pgoyette-compat-0315:1.1.1.1 netbsd-7-1-2-RELEASE:1.1.1.1 pgoyette-compat:1.1.1.1.0.34 pgoyette-compat-base:1.1.1.1 netbsd-7-1-1-RELEASE:1.1.1.1 matt-nb8-mediatek:1.1.1.1.0.32 matt-nb8-mediatek-base:1.1.1.1 perseant-stdc-iso10646:1.1.1.1.0.30 perseant-stdc-iso10646-base:1.1.1.1 netbsd-8:1.1.1.1.0.28 netbsd-8-base:1.1.1.1 prg-localcount2-base3:1.1.1.1 prg-localcount2-base2:1.1.1.1 prg-localcount2-base1:1.1.1.1 prg-localcount2:1.1.1.1.0.26 prg-localcount2-base:1.1.1.1 pgoyette-localcount-20170426:1.1.1.1 bouyer-socketcan-base1:1.1.1.1 pgoyette-localcount-20170320:1.1.1.1 netbsd-7-1:1.1.1.1.0.24 netbsd-7-1-RELEASE:1.1.1.1 netbsd-7-1-RC2:1.1.1.1 netbsd-7-nhusb-base-20170116:1.1.1.1 bouyer-socketcan:1.1.1.1.0.22 bouyer-socketcan-base:1.1.1.1 pgoyette-localcount-20170107:1.1.1.1 netbsd-7-1-RC1:1.1.1.1 pgoyette-localcount-20161104:1.1.1.1 netbsd-7-0-2-RELEASE:1.1.1.1 localcount-20160914:1.1.1.1 netbsd-7-nhusb:1.1.1.1.0.20 netbsd-7-nhusb-base:1.1.1.1 pgoyette-localcount-20160806:1.1.1.1 pgoyette-localcount-20160726:1.1.1.1 pgoyette-localcount:1.1.1.1.0.18 pgoyette-localcount-base:1.1.1.1 netbsd-7-0-1-RELEASE:1.1.1.1 netbsd-7-0:1.1.1.1.0.16 netbsd-7-0-RELEASE:1.1.1.1 netbsd-7-0-RC3:1.1.1.1 netbsd-7-0-RC2:1.1.1.1 netbsd-7-0-RC1:1.1.1.1 netbsd-7:1.1.1.1.0.14 netbsd-7-base:1.1.1.1 yamt-pagecache-base9:1.1.1.1 yamt-pagecache-tag8:1.1.1.1.2.2 tls-earlyentropy:1.1.1.1.0.12 tls-earlyentropy-base:1.1.1.1 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.1 riastradh-drm2-base3:1.1.1.1 riastradh-drm2-base2:1.1.1.1 riastradh-drm2-base1:1.1.1.1 riastradh-drm2:1.1.1.1.0.6 riastradh-drm2-base:1.1.1.1 khorben-n900:1.1.1.1.0.10 agc-symver:1.1.1.1.0.8 agc-symver-base:1.1.1.1 yamt-pagecache-base8:1.1.1.1 yamt-pagecache-base7:1.1.1.1 yamt-pagecache-base6:1.1.1.1 tls-maxphys:1.1.1.1.0.4 tls-maxphys-base:1.1.1.1 v5-1-2:1.1.1.1 yamt-pagecache-base5:1.1.1.1 yamt-pagecache:1.1.1.1.0.2 yamt-pagecache-base4:1.1.1.1 v5-1-1:1.1.1.1 DARRENR:1.1.1; locks; strict; comment @# @; 1.1 date 2012.03.23.21.20.01; author christos; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2012.03.23.21.20.01; author christos; state Exp; branches 1.1.1.1.2.1; next ; 1.1.1.1.2.1 date 2012.03.23.21.20.01; author yamt; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2012.04.17.00.03.13; author yamt; state Exp; branches; next ; desc @@ 1.1 log @Initial revision @ text @#!/usr/local/bin/perl # for best results, bring up all your interfaces before running this if ($^O =~ m/^irix/i) { &irix_mkfilters || regular_mkfilters || die $!; } else { ®ular_mkfilters || irix_mkfilters || die $!; } foreach $i (keys %ifaces) { $net{$i} = $inet{$i}."/".$netmask{$i} if (defined($inet{$i})); } # # print out route suggestions # print "#\n"; print "# The following routes should be configured, if not already:\n"; print "#\n"; foreach $i (keys %ifaces) { next if (($i =~ /lo/) || !defined($net{$i}) || defined($ppp{$i})); print "# route add $inet{$i} localhost 0\n"; } print "#\n"; # # print out some generic filters which people should use somewhere near the top # print "block in log quick from any to any with ipopts\n"; print "block in log quick proto tcp from any to any with short\n"; $grpi = 0; foreach $i (keys %ifaces) { if (!defined($inet{$i})) { next; } $grpi += 100; $grpo = $grpi + 50; if ($i !~ /lo/) { print "pass out on $i all head $grpo\n"; print "block out from 127.0.0.0/8 to any group $grpo\n"; print "block out from any to 127.0.0.0/8 group $grpo\n"; print "block out from any to $inet{$i}/32 group $grpo\n"; print "pass in on $i all head $grpi\n"; print "block in from 127.0.0.0/8 to any group $grpi\n"; print "block in from $inet{$i}/32 to any group $grpi\n"; foreach $j (keys %ifaces) { if ($i ne $j && $j !~ /^lo/ && defined($net{$j})) { print "block in from $net{$j} to any group $grpi\n"; } } } } sub irix_mkfilters { open(NETSTAT, "/usr/etc/netstat -i|") || return 0; while (defined($line = )) { if ($line =~ m/^Name/) { next; } elsif ($line =~ m/^(\S+)/) { open(I, "/usr/etc/ifconfig $1|") || return 0; &scan_ifconfig; close I; # being neat... - Allen } } close NETSTAT; # again, being neat... - Allen return 1; } sub regular_mkfilters { open(I, "ifconfig -a|") || return 0; &scan_ifconfig; close I; # being neat... - Allen return 1; } sub scan_ifconfig { while () { chop; if (/^[a-zA-Z]+\d+:/) { ($iface = $_) =~ s/^([a-zA-Z]+\d+).*/$1/; $ifaces{$iface} = $iface; next; } if (/inet/) { if (/\-\-\>/) { # PPP, (SLIP?) ($inet{$iface} = $_) =~ s/.*inet ([^ ]+) \-\-\> ([^ ]+).*/$1/; ($ppp{$iface} = $_) =~ s/.*inet ([^ ]+) \-\-\> ([^ ]+).*/$2/; } else { ($inet{$iface} = $_) =~ s/.*inet ([^ ]+).*/$1/; } } if (/netmask/) { ($mask = $_) =~ s/.*netmask ([^ ]+).*/$1/; $mask =~ s/^/0x/ if ($mask =~ /^[0-9a-f]*$/); $netmask{$iface} = $mask; } if (/broadcast/) { ($bcast{$iface} = $_) =~ s/.*broadcast ([^ ]+).*/$1/; } } } @ 1.1.1.1 log @import 5.1.1 @ text @@ 1.1.1.1.2.1 log @file mkfilters was added on branch yamt-pagecache on 2012-04-17 00:03:13 +0000 @ text @d1 116 @ 1.1.1.1.2.2 log @sync with head @ text @a0 116 #!/usr/local/bin/perl # for best results, bring up all your interfaces before running this if ($^O =~ m/^irix/i) { &irix_mkfilters || regular_mkfilters || die $!; } else { ®ular_mkfilters || irix_mkfilters || die $!; } foreach $i (keys %ifaces) { $net{$i} = $inet{$i}."/".$netmask{$i} if (defined($inet{$i})); } # # print out route suggestions # print "#\n"; print "# The following routes should be configured, if not already:\n"; print "#\n"; foreach $i (keys %ifaces) { next if (($i =~ /lo/) || !defined($net{$i}) || defined($ppp{$i})); print "# route add $inet{$i} localhost 0\n"; } print "#\n"; # # print out some generic filters which people should use somewhere near the top # print "block in log quick from any to any with ipopts\n"; print "block in log quick proto tcp from any to any with short\n"; $grpi = 0; foreach $i (keys %ifaces) { if (!defined($inet{$i})) { next; } $grpi += 100; $grpo = $grpi + 50; if ($i !~ /lo/) { print "pass out on $i all head $grpo\n"; print "block out from 127.0.0.0/8 to any group $grpo\n"; print "block out from any to 127.0.0.0/8 group $grpo\n"; print "block out from any to $inet{$i}/32 group $grpo\n"; print "pass in on $i all head $grpi\n"; print "block in from 127.0.0.0/8 to any group $grpi\n"; print "block in from $inet{$i}/32 to any group $grpi\n"; foreach $j (keys %ifaces) { if ($i ne $j && $j !~ /^lo/ && defined($net{$j})) { print "block in from $net{$j} to any group $grpi\n"; } } } } sub irix_mkfilters { open(NETSTAT, "/usr/etc/netstat -i|") || return 0; while (defined($line = )) { if ($line =~ m/^Name/) { next; } elsif ($line =~ m/^(\S+)/) { open(I, "/usr/etc/ifconfig $1|") || return 0; &scan_ifconfig; close I; # being neat... - Allen } } close NETSTAT; # again, being neat... - Allen return 1; } sub regular_mkfilters { open(I, "ifconfig -a|") || return 0; &scan_ifconfig; close I; # being neat... - Allen return 1; } sub scan_ifconfig { while () { chop; if (/^[a-zA-Z]+\d+:/) { ($iface = $_) =~ s/^([a-zA-Z]+\d+).*/$1/; $ifaces{$iface} = $iface; next; } if (/inet/) { if (/\-\-\>/) { # PPP, (SLIP?) ($inet{$iface} = $_) =~ s/.*inet ([^ ]+) \-\-\> ([^ ]+).*/$1/; ($ppp{$iface} = $_) =~ s/.*inet ([^ ]+) \-\-\> ([^ ]+).*/$2/; } else { ($inet{$iface} = $_) =~ s/.*inet ([^ ]+).*/$1/; } } if (/netmask/) { ($mask = $_) =~ s/.*netmask ([^ ]+).*/$1/; $mask =~ s/^/0x/ if ($mask =~ /^[0-9a-f]*$/); $netmask{$iface} = $mask; } if (/broadcast/) { ($bcast{$iface} = $_) =~ s/.*broadcast ([^ ]+).*/$1/; } } } @