{"header":{"message":"add a half-done lacrum configuration for routers in jails","description":null,"timestamp":"2025-11-06T05:05:55.960039526Z","authors":[{}]},"hash":"TV6XBGUBAOEZD65UD5VZAT4DD3BTKKPAXX6AJOKNE2HUODJVSIDQC","authors":[{"login":"jaredj","key":"3qqSdJRv6R3QNQvaGTyRYhLtRiCMVYPYhNJFh8CVy362"}],"deps":{"hashes":[["TV6XBGUBAOEZD65UD5VZAT4DD3BTKKPAXX6AJOKNE2HUODJVSIDQC","add a half-done lacrum configuration for routers in jails"],["AA",null],["BBIYSRJIDWDW2V2LCNZI5L3CL22ERTV7TNRHO2R5L6UB6XCBCYZAC","bugfixes from testing. perms have to have three digits to be idempotent. string-join must be applied to a list, not merely called with it."],["K4LTEIGQJM6YKQYDTIZCDRTVWG7SZHLY6QW2LCIEC3JSAAPVK2KAC","fix a bug where _load failed to close the file loaded after reading the whole thing. this would result in subsequent loads of the same filename doing nothing."]],"deps":["BBIYSRJIDWDW2V2LCNZI5L3CL22ERTV7TNRHO2R5L6UB6XCBCYZAC"],"known":["K4LTEIGQJM6YKQYDTIZCDRTVWG7SZHLY6QW2LCIEC3JSAAPVK2KAC"]},"hunks":[{"FileAdd":{"meta":{"basename":"vlans.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":"(setq ula-ipv6-48 \"fd74:1c54:7975\")"},{"Add":"(setq global-ipv6-48 \"2001:470:e10b\")"},{"Add":"(setq internal-ipv4-16 \"172.19\")"},{"Add":"(setq outside-mac-prefix \"02:8f:54:fb:58\")"},{"Add":""},{"Add":"(defun host-v6-subnet ()"},{"Add":" (cond"},{"Add":" ((equal *fact-short-hostname* \"aang\") \"6564\") ;; on EDna"},{"Add":" ((equal *fact-short-hostname* \"zuko\") \"6875\") ;; on HUph"},{"Add":" (true (error \"don't know per-host IPv6 subnet for %s\""},{"Add":" *fact-short-hostname*))))"},{"Add":""},{"Add":"(setq vlans"},{"Add":" (label"},{"Add":" ((t true)"},{"Add":" (f false))"},{"Add":" (list"},{"Add":" (list :kw :vid :name :radvp :v6s :v4s :fwp :carpp :hostp :fib :dhcpp :dnsp)"},{"Add":" ;; kw vid name radv? v6 v4 fw?carp?h? fib dhcp?dns?"},{"Add":" (list :mgmt 1 \"mgmt\" f \"fffe\" 254 t t t 0 f f)"},{"Add":" (list :dmz 68 \"dmz\" t \"0008\" 68 t t t 2 t t)"},{"Add":" (list :guest 71 \"guest\" t \"0002\" 71 t t f nil t t)"},{"Add":" ;; the host vlan, 72, is not treated by this table."},{"Add":" (list :inside 73 \"inside\" t \"0009\" 73 t t f nil t t)"},{"Add":" (list :local 76 \"local\" t \"004c\" 76 t t f nil t t)"},{"Add":" (list :pfsync 80 \"pfsync\" f nil nil t f f nil f f)"},{"Add":" (list :wan 87 \"wan\" f nil nil t f f nil f f))))"},{"Add":""},{"Add":"(defun mapc-table (kwthunk table)"},{"Add":" (let ((titles (car table))"},{"Add":" (rows (cdr table)))"},{"Add":" (dolist (row rows)"},{"Add":" (let ((alis (zip titles row)))"},{"Add":" (apply kwthunk alis)))))"},{"Add":""},{"Add":"(macro table-kw-lambda"},{"Add":" (lambda (args)"},{"Add":" `(lambda (:kw ,@(mapcar keyword-symbol (car (eval (car args)))))"},{"Add":" ,@(cdr args))))"},{"Add":""},{"Add":"(macro do-table"},{"Add":" (lambda (args)"},{"Add":" `(mapc-table (table-kw-lambda ,(car args) ,@(cdr args))"},{"Add":" ,(car args))))"},{"Add":""},{"Add":";; this macro runs over all the physical interfaces, and all the vlans"},{"Add":";; each interface uses, described by the list of all vlans above, and"},{"Add":";; the networking arrangement described by e.g. chromebox-networking."},{"Add":";; e.g."},{"Add":";;"},{"Add":";; (do-ifs-and-vlans chromebox-networking"},{"Add":";; (have-fun-with if vid carpp))"},{"Add":";;"},{"Add":";; that is to say, quite unhygienically, inside the body of this"},{"Add":";; macro, the current interface is bound to the symbol ~if~, also its"},{"Add":";; ~mtu~, and all the keywords from the first row of the vlan table"},{"Add":";; are bound as symbols, e.g. name, vid, fib, etc. also, quite"},{"Add":";; FreeBSD-ically, the interface name dot the vid is available as vif."},{"Add":"(macro do-ifs-and-vlans"},{"Add":" (lambda (args)"},{"Add":" `(let* ((networking ,(car args))"},{"Add":" (ifs (cadr (assoc :ethernet-interfaces networking))))"},{"Add":" (dolist (if ifs)"},{"Add":" (let ((mtu (assoc-path (list :mtus if) networking))"},{"Add":" (if-on-vlan (cadr (assoc :interface-on-vlan networking))))"},{"Add":" (do-table vlans"},{"Add":" (when (if-on-vlan if vid)"},{"Add":" (let ((vif (sprintf \"%s.%d\" if vid)))"},{"Add":" ,@(cdr args)))))))))"},{"Add":""},{"Add":""},{"Add":"(defun vlan-ula-host (vlan-kw octet)"},{"Add":" (let ((vlan (assoc vlan-kw vlan-rows)))"},{"Add":" (eval `(multilet (,vlan-columns vlan)"},{"Add":" (sprintf \"%s:%s::%s\" ula-ipv6-48 v6sub octet)))))"}]}},{"FileAdd":{"meta":{"basename":"templates","metadata":576},"context":[{"change":3,"pos":389}],"contents":[]}},{"FileAdd":{"meta":{"basename":"pf.conf.tmpl","metadata":0},"context":[{"change":0,"pos":2997}],"contents":[{"Add":"inside=\"INTERFACE_inside\""},{"Add":"guest=\"INTERFACE_guest\""},{"Add":"host=\"INTERFACE_host\""},{"Add":"dmz=\"INTERFACE_dmz\""},{"Add":"mgmt=\"INTERFACE_mgmt\""},{"Add":"local=\"INTERFACE_local\""},{"Add":"outside=\"INTERFACE_wan\""},{"Add":"pfsync=\"INTERFACE_pfsync\""},{"Add":"wg_dmz=\"\" # TODO"},{"Add":""},{"Add":"caddy_ipv4=\"192.168.68.51\""},{"Add":""},{"Add":"table const { 172.19.254.0/24, fd74:1c54:7975:fffe::/64 }"},{"Add":"table const { 192.168.68.0/24, fd74:1c54:7975:8::/64, 2001:470:e10b:8::/64 }"},{"Add":"table const { 192.168.71.0/24, fd74:1c54:7975:2::/64, 2001:470:e10b:2::/64 }"},{"Add":"table const { fd74:1c54:7975:8::7079 }"},{"Add":"# this is the Epson printer"},{"Add":"table const { 192.168.71.134, fd74:1c54:7975:2:e2bb:9eff:fe1f:82f1 }"},{"Add":"table const { 192.168.68.71, 2001:470:e10b:8::4841 }"},{"Add":" "},{"Add":"set skip on { lo, $pfsync }"},{"Add":"set block-policy return"},{"Add":"set syncookies adaptive"},{"Add":"set reassemble yes"},{"Add":""},{"Add":"nat on $outside inet from ! ($outside) to any -> ($outside)"},{"Add":"no nat on $outside inet proto udp from ! ($outside) port {domain, ntp}"},{"Add":"rdr pass on $outside proto {tcp, udp} to port https -> $caddy_ipv4"},{"Add":"rdr pass on $outside proto tcp to port http -> $caddy_ipv4 # ACME"},{"Add":""},{"Add":"match in on $outside scrub (random-id)"},{"Add":"block in all"},{"Add":"block out all"},{"Add":"block drop in log on $outside"},{"Add":"block return out log on $outside"},{"Add":""},{"Add":"# our ULA should stay inside"},{"Add":"pass in quick on $outside inet6 proto udp from fe80::/10 to fe80::/10 port dhcpv6-server"},{"Add":"block in quick on $outside inet6 from fc00::/7 to any"},{"Add":"block out quick on $outside inet6 from any to fc00::/7"},{"Add":"pass out on $outside proto udp from port bootpc to port bootps"},{"Add":"pass out on $outside proto udp from ($outside) to port 123"},{"Add":""},{"Add":"pass in on $host proto udp from ($host:network) to any port 123"},{"Add":"pass out on $outside proto udp from ($host:network) to any port 123"},{"Add":""},{"Add":"# by avoiding specifying `from ($outside)`, we should allow"},{"Add":"# inet6-forwarded client traffic on these ports in one swell foop."},{"Add":"# right?"},{"Add":"pass out on $outside proto {tcp, udp} to port https"},{"Add":"pass out on $outside proto tcp to port http"},{"Add":"pass out on $outside proto tcp to port ssh"},{"Add":"pass out on $outside proto {tcp, udp} from ($outside) to port domain"},{"Add":"pass out on $outside inet proto icmp all icmp-type echoreq"},{"Add":"# avoid advertising our routes to the outside. right?"},{"Add":"pass out on $outside inet6 proto icmp6 from ($outside) icmp6-type { unreach, toobig, timex, paramprob, echoreq, routersol, neighbrsol, neighbradv }"},{"Add":"pass in on $outside inet6 proto icmp6 to ($outside) icmp6-type { unreach, toobig, timex, paramprob, echorep, routeradv, neighbrsol, neighbradv }"},{"Add":"# see rdr passes above for incoming traffic from outside."},{"Add":"pass out on $outside inet proto 41 to 216.66.22.2 label \"HEnet 6in4\""},{"Add":""},{"Add":"# TODO: bittorrent"},{"Add":"# TODO: ipfs"},{"Add":"# TODO: ssb"},{"Add":""},{"Add":"pass in on $outside proto udp to ($outside) port 53280"},{"Add":""},{"Add":"pass in on $mgmt from "},{"Add":"pass in on $mgmt from fe00::/7"},{"Add":"pass out on $mgmt to "},{"Add":"pass out on $mgmt to fe00::/7"},{"Add":""},{"Add":"pass in on { $dmz, $guest, $inside, $local } proto udp to { ($dmz), ($guest), ($inside), ($local) } port { ntp, domain, bootps, dhcpv6-server }"},{"Add":"pass in on { $dmz, $guest, $inside, $local } proto tcp to { ($dmz), ($guest), ($inside), ($local) } port { domain }"},{"Add":"pass in on { $dmz, $guest, $inside, $local } inet6 proto icmp6 to { ($dmz), ($guest), ($inside), ($local) } icmp6-type { unreach, toobig, timex, paramprob, echorep, routersol, neighbrsol, neighbradv }"},{"Add":"pass out on { $dmz, $guest, $inside, $local } inet6 proto icmp6 icmp6-type { unreach, toobig, timex, paramprob, echorep, routeradv, neighbrsol, neighbradv }"},{"Add":""},{"Add":"pass in on { $inside, $local, $guest } proto tcp to port { ssh, http, https }"},{"Add":"pass in on { $inside, $local, guest } proto {tcp,udp} to port { ldap, kerberos, kpasswd }"},{"Add":"pass on { $inside, $local, $guest } inet proto igmp to 224.0.0.1"},{"Add":"# firefox tickle time"},{"Add":"pass in on { $inside, $local, $guest } proto udp to any port 4886"},{"Add":""},{"Add":"pass in on $inside proto tcp to port 1883"},{"Add":"pass out on $dmz proto tcp from ($dmz) to port 1883"},{"Add":"# TODO: metrics from wg_dmz"},{"Add":""},{"Add":"# no calling home, printer"},{"Add":"block in quick on $guest from to any"},{"Add":""},{"Add":"# octopi, printer"},{"Add":"pass in on { $inside, $local } proto tcp to port { ssh, http, https }"},{"Add":"pass in on { $inside, $local } proto tcp to port ipps"},{"Add":""},{"Add":""},{"Add":"pass in on { $inside, $guest } proto {tcp,udp} to any port { http, https }"},{"Add":"pass in on { $inside, $guest } proto tcp to any port { ssh, ftp, 1968 }"},{"Add":"# FIXME: lock down tv >_>"},{"Add":""},{"Add":"# TODO: ssh to dmz/inside from guest"}]}},{"FileAdd":{"meta":{"basename":"netflow-collect-rc-d.sh.tmpl","metadata":0},"context":[{"change":0,"pos":2997}],"contents":[{"Add":"#!/bin/sh"},{"Add":""},{"Add":"# netflow collector startup script"},{"Add":"#"},{"Add":"# PROVIDE: netflow_collect"},{"Add":"# REQUIRE: NETWORK"},{"Add":"#"},{"Add":"# Add the following to /etc/rc.conf[.local] to enable this service"},{"Add":"#"},{"Add":"# netflow_collect_enable=\"YES\""},{"Add":"#"},{"Add":""},{"Add":". /etc/rc.subr"},{"Add":""},{"Add":"name=\"netflow_collector\""},{"Add":"desc=\"Collect netflow data (src/dest addresses, ports, bytes) and send off\""},{"Add":"rcvar=netflow_collector_enable"},{"Add":"start_cmd=\"netflow_collector_start\""},{"Add":"stop_cmd=\"netflow_collector_stop\""},{"Add":""},{"Add":"netflow_collector_start()"},{"Add":"{"},{"Add":"NGCTL_SETUP_COMMANDS"},{"Add":"}"},{"Add":""},{"Add":"netflow_collector_stop()"},{"Add":"{"},{"Add":"NGCTL_TEARDOWN_COMMANDS"},{"Add":"}"},{"Add":""},{"Add":"run_rc_command \"$1\""}]}},{"FileAdd":{"meta":{"basename":"henet_gif_tunnel.tmpl","metadata":0},"context":[{"change":0,"pos":2997}],"contents":[{"Add":"# See dhclient-script(8)"},{"Add":""},{"Add":"hgt_interface=HGT_INTERFACE"},{"Add":"hgt_if_file=/var/run/dhclient/henet_gif_tunnel_interface"},{"Add":""},{"Add":""},{"Add":"hgt_start () {"},{"Add":" local far_ipv4=\"HGT_FAR_IPV4\""},{"Add":" local near_ipv4=$new_ip_address"},{"Add":" local username=\"HGT_USERNAME\""},{"Add":" local password=\"HGT_PASSWORD\""},{"Add":" local tunnelid=\"HGT_TUNNELID\""},{"Add":" local far_ipv6=\"HGT_FAR_IPV6\""},{"Add":" local near_ipv6=\"HGT_NEAR_IPV6\""},{"Add":" local endpoint=\"ipv4.tunnelbroker.net/nic/update\""},{"Add":""},{"Add":" # when we ask for a gif to be created we get its name back"},{"Add":" local g=$(/sbin/ifconfig gif create)"},{"Add":" echo $g > $hgt_if_file"},{"Add":" /sbin/ifconfig $g tunnel $near_ipv4 $far_ipv4"},{"Add":" /usr/bin/fetch -o - \"https://${username}:${password}@${endpoint}?hostname=${tunnelid}\""},{"Add":" /sbin/ifconfig $g inet6 ${near_ipv6}/128 $far_ipv6 "},{"Add":" /sbin/route add -inet6 default $far_ipv6"},{"Add":"}"},{"Add":""},{"Add":"hgt_stop () {"},{"Add":" local far_ipv6=\"HGT_FAR_IPV6\""},{"Add":" /sbin/route delete -inet6 default $far_ipv6"},{"Add":" if [ -f $hgt_if_file ]; then"},{"Add":" g=$(cat $hgt_if_file)"},{"Add":" /sbin/ifconfig $g destroy"},{"Add":" rm -f $hgt_if_file"},{"Add":" fi"},{"Add":"}"},{"Add":""},{"Add":""},{"Add":"# ---- active code ----"},{"Add":""},{"Add":"if [ \"$interface\" = \"$hgt_interface\" ]; then"},{"Add":" case \"$reason\" in"},{"Add":" BOUND|REBOOT) hgt_start ;;"},{"Add":" EXPIRE|FAIL) hgt_stop ;;"},{"Add":" esac"},{"Add":"fi"}]}},{"FileAdd":{"meta":{"basename":"henet_ddns.tmpl","metadata":0},"context":[{"change":0,"pos":2997}],"contents":[{"Add":"# See dhclient-script(8) and https://dns.he.net/docs.html."},{"Add":""},{"Add":"hedd_interface=\"HEDD_INTERFACE\""},{"Add":""},{"Add":"hedd_ext_lookup_ipv4 () {"},{"Add":" local name=\"$1\""},{"Add":" local ext_dns_ip=\"$2\""},{"Add":" /usr/bin/host -4 $name $ext_dns_ip | /usr/bin/awk '{print $NF}'"},{"Add":"}"},{"Add":""},{"Add":"hedd_update () {"},{"Add":" local name=\"HEDD_NAME\""},{"Add":" local pw=\"HEDD_PASSWORD\""},{"Add":" local ext_dns_ip=\"HEDD_EXT_DNS_IP\""},{"Add":" # WARNING: this has to be https because the password is in a query"},{"Add":" # parameter"},{"Add":" local url='https://dyn.dns.he.net/nic/update'"},{"Add":" local dns_says=\"$(hedd_ext_lookup_ipv4 $name $ext_dns_ip)\""},{"Add":" "},{"Add":" if [ \"$dns_says\" = \"$new_ip_address\" ]; then"},{"Add":" :"},{"Add":" else"},{"Add":" # What happens if this fails? ... OpenWRT's DDNS update"},{"Add":" # scripts are better developed, but also specialized for"},{"Add":" # OpenWRT's configuration and init systems. And GPLed."},{"Add":" /usr/bin/fetch -o - \"${url}?hostname=${name}&password=${pw}&myip=${new_ip_address}\""},{"Add":" fi"},{"Add":"}"},{"Add":""},{"Add":"# ---- active code ----"},{"Add":""},{"Add":"if [ \"$interface\" = \"$hedd_interface\" ]; then"},{"Add":" case \"$reason\" in"},{"Add":" BOUND|REBOOT) hedd_update ;;"},{"Add":" esac"},{"Add":"fi"}]}},{"FileAdd":{"meta":{"basename":"firewall-jail.conf.tmpl","metadata":0},"context":[{"change":0,"pos":2997}],"contents":[{"Add":"NAME {"},{"Add":" host.hostname = NAME;"},{"Add":" vnet = new;"},{"Add":" vnet.interface = COMMA_DELIMITED_EPAIR_BS;"},{"Add":" path = \"JAILS/NAME/root\";"},{"Add":" mount.devfs;"},{"Add":" devfs_ruleset = 10;"},{"Add":" mount.fstab = \"JAILS/NAME/fstab\";"},{"Add":""},{"Add":" # QCOM. see doc/stable-epair-mac.org; note a's and b's"},{"Add":" exec.created += \"ifconfig OUTSIDE_EPAIR_A ether OUTSIDE_MAC_PREFIX:0a\";"},{"Add":" exec.created += \"ifconfig OUTSIDE_EPAIR_B ether OUTSIDE_MAC_PREFIX:0b\";"},{"Add":""},{"Add":" exec.start = \"/bin/sh /etc/rc\";"},{"Add":" exec.stop = \"/bin/sh /etc/rc.shutdown jail\";"},{"Add":""},{"Add":" persist;"},{"Add":"}"}]}},{"FileAdd":{"meta":{"basename":"dnsmasq.conf.tmpl","metadata":0},"context":[{"change":0,"pos":2997}],"contents":[{"Add":"bogus-priv # don't forward reverse lookups for local addresses"},{"Add":"stop-dns-rebind"},{"Add":"rebind-localhost-ok"},{"Add":"domain-needed # don't forward A queries for plain names"},{"Add":"local=/agrue.info/ # serve agrue.info, don't forward"},{"Add":"domain=agrue.info # for the DHCP server"},{"Add":"log-queries=extra"},{"Add":"log-dhcp"},{"Add":"log-async"},{"Add":"expand-hosts"},{"Add":"dhcp-authoritative"},{"Add":"read-ethers"},{"Add":"enable-ra"},{"Add":""},{"Add":"conf-file=/usr/local/share/dnsmasq/trust-anchors.conf"},{"Add":"dnssec"},{"Add":"dnssec-check-unsigned"},{"Add":""},{"Add":"interface=DNS_INTERFACES"},{"Add":"bind-interfaces"},{"Add":"# enable-tftp"},{"Add":"# tftp_root /srv/tftp"},{"Add":"DHCP_IPV4_RANGES"},{"Add":"DHCP_IPV6_RANGES"}]}},{"FileAdd":{"meta":{"basename":"carp_devd.conf.tmpl","metadata":0},"context":[{"change":0,"pos":2997}],"contents":[{"Add":"notify 0 {"},{"Add":" match \"system\" \"CARP\";"},{"Add":" match \"subsystem\" \"[0-9]+@[0-9a-z.]+\";"},{"Add":" match \"type\" \"(MASTER|BACKUP)\";"},{"Add":" action \"CARP_SCRIPTS_DIR/on-$subsystem-$type.sh\";"},{"Add":"};"}]}},{"FileAdd":{"meta":{"basename":"pf.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":";; implements QR4N, QR4R"},{"Add":"(defun pf ()"},{"Add":" (let ((template-inputs nil)"},{"Add":" ((ifs (assoc-path '(:ethernet-interfaces) chromebox-networking)))"},{"Add":" (if-on-vlan (assoc-path '(:interface-on-vlan)"},{"Add":" chromebox-networking)))"},{"Add":" (dolist (if ifs)"},{"Add":" (do-vlans"},{"Add":" (when on-firewall-p"},{"Add":" (when (interface-on-vlan if number)"},{"Add":" (push (list (sprintf \"INTERFACE_%d\" name)"},{"Add":" (sprintf \"%s.%d\" if number))"},{"Add":" template-inputs)))))"},{"Add":" (file-exists-with-entire-contents-gsubbed"},{"Add":" \"/etc/pf.conf\" \"644\" \"root\" \"wheel\""},{"Add":" \"templates/pf.conf.m4\""},{"Add":" template-inputs)"},{"Add":" ;; on a host running 14.2-RELEASE, building a jail for 15-CURRENT,"},{"Add":" ;; you can't run <={rooted /sbin/pfctl} because it links against"},{"Add":" ;; some different libraries than /sbin/pfctl does. but if you"},{"Add":" ;; chroot in to run it instead, then it needs device files. so we"},{"Add":" ;; just use the host's pfctl to check syntax here, hoping there is"},{"Add":" ;; not some new cool pf.conf syntax supported on the target."},{"Add":" ;; pf is pretty stable i think, so not too worried."},{"Add":" (cond"},{"Add":" ((probe-success \"/sbin/pfctl\" \"-n\" \"-f\" (*rooted* \"/etc/pf.conf\"))"},{"Add":" (sysrc-set \"pf_enable\" \"YES\"))"},{"Add":" (true"},{"Add":" (error \"pf.conf.m4 leads to a pf.conf with a syntax error\")))))"},{"Add":""}]}},{"FileAdd":{"meta":{"basename":"netflow_collect.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":""},{"Add":"(defun firewall-jail-netflow-collect-ngctl-script (ksocket-connect-string)"},{"Add":" (let ((ifs (assoc-path '(:ethernet-interfaces) chromebox-networking))"},{"Add":" (if-for-vlan (assoc-path '(:interface-for-vlan)"},{"Add":" chromebox-networking))"},{"Add":" (ifs-to-collect '())"},{"Add":" (first-if true)"},{"Add":" (nf-port 0)"},{"Add":" (ngc '()))"},{"Add":" (dolist (if ifs)"},{"Add":" (do-vlans"},{"Add":" (when fw"},{"Add":" (push (sprintf \"%s_%d\" if number) ifs-to-collect))))"},{"Add":" ;; https://framkant.org/2019/03/collect-and-save-netflow-data-with-freebsd/"},{"Add":" (dolist (if ifs-to-collect)"},{"Add":" (cond"},{"Add":" (first-if"},{"Add":" (push (sprintf \"mkpeer %s: netflow lower iface%d\" if nf-port) ngc)"},{"Add":" (push (sprintf \"name %s:lower netflow\" if) ngc)"},{"Add":" (push (sprintf \"connect %s: netflow: upper out%d\" if nf-port) ngc)"},{"Add":" (setq first-if false))"},{"Add":" (true"},{"Add":" (push (sprintf \"connect %s: netflow: lower iface%d\" if nf-port) ngc)"},{"Add":" (push (sprintf \"connect %s: netflow: upper out%d\" if nf-port) ngc)))"},{"Add":" ;; 7 = INGRESS | EGRESS | ONCE; log both incoming and outgoing packets."},{"Add":" (push (sprintf \"msg netflow: setconfig {iface=%d conf=7}\" nf-port) ngc)"},{"Add":" (setq nf-port (+ 1 nf-port)))"},{"Add":" (push \"mkpeer netflow: ksocket export9 inet/dgram/udp\" ngc)"},{"Add":" ;; export9 port: use NetFlow V9, which supports IPv6 accounting"},{"Add":" ;; and multiple FIBs"},{"Add":" (push \"name netflow:export9 exporter\" ngc)"},{"Add":" (push \"msg exporter connect %s\" ksocket-connect-string)"},{"Add":" (setq ngc (nreverse ngc))"},{"Add":" ngc))"},{"Add":""},{"Add":";; implements QNN"},{"Add":"(defun firewall-jail-netflow-collect-rc (ksocket-connect-string)"},{"Add":" (change \"add netflow_collect rc.d script\""},{"Add":" (lambda ()"},{"Add":" (dir-exists \"/usr/local/etc/rc.d\" \"755\" \"root\" \"wheel\")"},{"Add":" (file-exists \"/usr/local/etc/rc.d/netflow_collect\""},{"Add":" \"755\" \"root\" \"wheel\")"},{"Add":" (file-contents-from-gsubs-template"},{"Add":" \"/usr/local/etc/rc.d/netflow_collect\""},{"Add":" \"netflow_collect_rc.tmpl.m4\""},{"Add":" '((\"NGCTL_SETUP_COMMANDS\""},{"Add":" ;; the command will be shellquoted in order to be"},{"Add":" ;; passed to m4; we shellquote it again to be parsed"},{"Add":" ;; by the shell as part of the rc script."},{"Add":" (mapcar (lambda (cmd) (sprintf \"\\tngctl %s\\n\" (shellquote cmd)))"},{"Add":" (firewall-jail-netflow-collect-ngctl-script"},{"Add":" ksocket-connect-string)))"},{"Add":" (\"NGCTL_TEARDOWN_COMMANDS\""},{"Add":" \"\\"},{"Add":"\\tngctlshutdown exporter:\\n\\"},{"Add":"\\tngctl shutdown netflow:\\n\"))))"},{"Add":" nil))"}]}},{"Edit":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":1,"atom":{"NewVertex":{"up_context":[{"change":3,"pos":429}],"down_context":[{"change":3,"pos":510}],"flag":"BLOCK","start":15716,"end":16089,"inode":{"change":3,"pos":429}}},"contents":[{"Add":";; implemets QRO4B"},{"Add":"(defun FreeBSD-devfs-firewall-jail-rules ()"},{"Add":" (file-exists-with-entire-contents"},{"Add":" \"/etc/devfs.rules\" \"600\" \"root\" \"wheel\""},{"Add":" \"devfs ruleset with bpf, pf, login\""},{"Add":" \"\\"},{"Add":"[devfsrules_firewall_jail_vnet=10]"},{"Add":"add include $devfsrules_hide_all"},{"Add":"add include $devfsrules_unhide_basic"},{"Add":"add include $devfsrules_unhide_login"},{"Add":"add path bpf* unhide"},{"Add":"add path pf unhide"},{"Add":"\"))"}]}},{"Replacement":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":15,"ins":{"up_context":[{"change":3,"pos":511}],"down_context":[{"change":2,"pos":37}],"flag":"BLOCK","start":16090,"end":16167,"inode":{"change":3,"pos":429}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":511},"to":{"change":3,"start":511,"end":529},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":529},"to":{"change":2,"start":17,"end":37},"introduced_by":2}],"inode":{"change":3,"pos":429}},"ins_contents":[{"Add":"(defun add-local-user (name ssh-authorized-keys-contents)"},{"Add":" (let* ((me name)"}],"del_contents":[{"Del":"(defun add-jjl ()\n"},{"Del":" (let* ((me \"jjl\")\n"}]}},{"Edit":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":32,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":938},"to":{"change":3,"start":938,"end":1053},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1053},"to":{"change":2,"start":305,"end":363},"introduced_by":2},{"previous":"","flag":"DELETED","from":{"change":2,"pos":363},"to":{"change":3,"start":1112,"end":1326},"introduced_by":2},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1112},"to":{"change":3,"start":1112,"end":1326},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1326},"to":{"change":2,"start":364,"end":421},"introduced_by":2},{"previous":"","flag":"DELETED","from":{"change":2,"pos":421},"to":{"change":3,"start":1377,"end":1479},"introduced_by":2},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1377},"to":{"change":3,"start":1377,"end":1479},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1479},"to":{"change":2,"start":422,"end":519},"introduced_by":2},{"previous":"","flag":"DELETED","from":{"change":2,"pos":519},"to":{"change":3,"start":1571,"end":1674},"introduced_by":2},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1571},"to":{"change":3,"start":1571,"end":1674},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1674},"to":{"change":2,"start":520,"end":563},"introduced_by":2},{"previous":"","flag":"DELETED","from":{"change":2,"pos":563},"to":{"change":3,"start":1718,"end":1949},"introduced_by":2},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1718},"to":{"change":3,"start":1718,"end":1949},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1949},"to":{"change":2,"start":564,"end":892},"introduced_by":2}],"inode":{"change":3,"pos":429}}},"contents":[{"Del":"\n(defun FreeBSD-boot-fibs (n)\n (let ((directive (sprintf \"net.fibs=%d\" n)))\n (file-exists-with-entire-contents\n"},{"Del":" \"/boot/loader.conf.d/fibs.conf\" \"644\" \"root\" \"wheel\"\n"},{"Del":" directive directive)))\n\n(defun FreeBSD-boot-load-modules (purpose-identifier module-names)\n (let* ((loads (mapcar\n (lambda (na) (sprintf \"%s_load=\\\"YES\\\"\" na))\n module-names))\n"},{"Del":" (file-contents (apply string-join \"\\n\" loads)))\n"},{"Del":" (file-exists-with-entire-contents\n (sprintf \"/boot/loader.conf.d/%s.conf\" purpose-identifier)\n"},{"Del":" \"644\" \"root\" \"wheel\"\n (sprintf \"load modules: %s\" (apply string-join \" \" module-names))\n"},{"Del":" file-contents)))\n\n(defun FreeBSD-devfs-firewall-jail-rules ()\n (file-exists-with-entire-contents\n"},{"Del":" \"/etc/devfs.rules\" \"600\" \"root\" \"wheel\"\n"},{"Del":" \"devfs ruleset with bpf, pf, login\"\n \"\\\n[devfsrules_firewall_jail_vnet=10]\nadd include $devfsrules_hide_all\nadd include $devfsrules_unhide_basic\nadd include $devfsrules_unhide_login\nadd path bpf* unhide\nadd path pf unhide\n\"))\n"},{"Del":"\n(defun openssh-listen-only-on ips\n (let ((c \"/etc/ssh/sshd_config\")\n (lines\n (string-join \"\\n\" (mapcar\n (lambda (a) (sprintf \"ListenAddress %s\" a))\n ips))))\n (delete-lines-matching c \"^ListenAddress\")\n (insert-line-before c lines \"^#ListenAddress\")))\n"}]}},{"Edit":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":33,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":1950},"to":{"change":3,"start":1950,"end":1951},"introduced_by":3}],"inode":{"change":3,"pos":429}}},"contents":[{"Del":"\n"}]}},{"Replacement":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":34,"ins":{"up_context":[{"change":2,"pos":920}],"down_context":[{"change":2,"pos":951}],"flag":"BLOCK","start":16168,"end":16362,"inode":{"change":3,"pos":429}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":920},"to":{"change":2,"start":920,"end":951},"introduced_by":2}],"inode":{"change":3,"pos":429}},"ins_contents":[{"Add":" (change \"add suitable local user\""},{"Add":" (lambda ()"},{"Add":" (add-local-user \"jjl\" ssh-authorized-keys-contents))"},{"Add":" nil)"},{"Add":" (change \"let wheel group use doas\" doas-for-wheel nil)"}],"del_contents":[{"Del":" (add-jjl)\n (doas-for-wheel)\n"}]}},{"Edit":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":41,"atom":{"NewVertex":{"up_context":[{"change":2,"pos":1037}],"down_context":[{"change":2,"pos":1037}],"flag":"BLOCK","start":16363,"end":16676,"inode":{"change":3,"pos":429}}},"contents":[{"Add":" ;; how should this be written elsewhere? and for that matter the"},{"Add":" ;; above? a host which contains a firewall jail must ___. that's the"},{"Add":" ;; only kind of host we're talking about yet -- but it won't be long."},{"Add":" (FreeBSD-boot-load-modules \"netgraph\" '(\"ng_ether\" \"ng_eiface\" \"ng_netflow\" \"ng_ksocket\" \"ng_vlan\"))"}]}},{"Replacement":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":46,"ins":{"up_context":[{"change":2,"pos":1075}],"down_context":[{"change":2,"pos":1145}],"flag":"BLOCK","start":16677,"end":16745,"inode":{"change":3,"pos":429}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":1075},"to":{"change":2,"start":1075,"end":1145},"introduced_by":2}],"inode":{"change":3,"pos":429}},"ins_contents":[{"Add":" (sysrc-set \"sshd_enable\" \"YES\")"},{"Add":" (sysrc-set \"ntpd_enable\" \"YES\")"}],"del_contents":[{"Del":" (sysrc :set \"sshd_enable\" \"YES\")\n (sysrc :set \"ntpd_enable\" \"YES\")\n"}]}},{"Replacement":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":50,"ins":{"up_context":[{"change":2,"pos":1265}],"down_context":[{"change":2,"pos":1382}],"flag":"BLOCK","start":16746,"end":16860,"inode":{"change":3,"pos":429}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":1265},"to":{"change":2,"start":1265,"end":1382},"introduced_by":2}],"inode":{"change":3,"pos":429}},"ins_contents":[{"Add":" (sysrc-set \"powerd_enable\" \"YES\")"},{"Add":" (sysrc-set \"jail_enable\" \"YES\")"},{"Add":" (sysrc-set \"cloned_interfaces\" \"epair72\")"}],"del_contents":[{"Del":" (sysrc :set \"powerd_enable\" \"YES\")\n (sysrc :set \"jail_enable\" \"YES\")\n (sysrc :set \"cloned_interfaces\" \"epair72\")\n"}]}},{"Replacement":{"inode":{"change":3,"pos":429},"path":"lacrum/routers/hosts.glotawk","line":55,"ins":{"up_context":[{"change":2,"pos":1473}],"down_context":[],"flag":"BLOCK","start":16861,"end":16915,"inode":{"change":3,"pos":429}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":1473},"to":{"change":2,"start":1473,"end":1528},"introduced_by":2}],"inode":{"change":3,"pos":429}},"ins_contents":[{"Add":" (sysrc-set \"ifconfig_epair72_ipv6\" \"accept_rtadv\"))"}],"del_contents":[{"Del":" (sysrc :set \"ifconfig_epair72_ipv6\" \"accept_rtadv\"))\n"}]}},{"FileAdd":{"meta":{"basename":"he-ddns.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":"(setq he-ddns-external-dns-ip \"8.8.8.8\")"},{"Add":""},{"Add":"(setq he-ddns-columns"},{"Add":" '(kw str name password))"},{"Add":""},{"Add":"(setq he-ddns-rows"},{"Add":" '((:ebagi \"ebagi\" \"eatenby.agrue.info\" \"yvavpFv0iPpYSWq0\")))"},{"Add":""},{"Add":";; implements QROD"},{"Add":"(defun he-ddns-updating (interface unique-id)"},{"Add":" (do-table (he-ddns-columns he-ddns-rows)"},{"Add":" (file-exists-with-contents-gsubbed"},{"Add":" (sprintf \"/etc/dhclient-exit-hooks.d/20-henet_ddns_%s\" str)"},{"Add":" \"644\" \"root\" \"wheel\""},{"Add":" \"templates/henet_ddns.tmpl\""},{"Add":" `((\"HEDD_INTERFACE\" interface)"},{"Add":" (\"HEDD_NAME\" name)"},{"Add":" (\"HEDD_PASSWORD\" password)"},{"Add":" (\"HEDD_EXT_DNS_IP\" he-ddns-external-dns-ip)))))"}]}},{"FileAdd":{"meta":{"basename":"he-6in4.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":"(setq he-6in4s"},{"Add":" '((\"re0.87\""},{"Add":" ((:agi"},{"Add":" ((:name \"agi\") ;; not that kind gosh"},{"Add":" (:far-ipv4 \"216.66.22.2\")"},{"Add":" (:ipv6-48 e\"U2FsdGVkX1+z/ql2oFGgZLHS/8AB3iiW53oesBM=\")"},{"Add":" (:near-ipv6 e\"U2FsdGVkX19R8GZ/BwDc+KqHSi5huYvgdZ74vljVXxUM\")"},{"Add":" (:far-ipv6 e\"U2FsdGVkX1+p/oOSDxekiEEiFQZJRWAIgtiFiOCa/mu+\")"},{"Add":" (:username e\"U2FsdGVkX19hru20Wug8k5BIduP6ZA==\")"},{"Add":" (:password e\"U2FsdGVkX1+Ii2fpG3BRR7HZGOB1p7g9sWa2vTvgMWM=\")"},{"Add":" (:tunnel-id e\"U2FsdGVkX18DAOH46iqJdiCQLKjfcQ==\")))))))"},{"Add":""},{"Add":";; https://wiki.zs64.net/Tunnelbroker.net_and_dynamic_IP_address_on_FreeBSD.html"},{"Add":""},{"Add":";; implements QROH"},{"Add":"(defun he-gif-tunnels (interface)"},{"Add":" ;; We'll make a script for the tunnel, rather than using the"},{"Add":" ;; gif_interfaces and gifconfig_IF rc.conf variables, so that if"},{"Add":" ;; our external IPv4 address changes, we can change the tunnel to"},{"Add":" ;; match."},{"Add":" ;;"},{"Add":" ;; ASSUMPTION: our IPv4 address on the external interface is our"},{"Add":" ;; public IPv4 address. If this firewall is behind an ISP-provided"},{"Add":" ;; gateway or router, that may not be the case. But mine is"},{"Add":" ;; bridged."},{"Add":" (let ((ifs (assoc-path '(:ethernet-interfaces) chromebox-networking))"},{"Add":" (if-on-vlan (assoc-path '(:interface-on-vlan)"},{"Add":" chromebox-networking)))"},{"Add":" (dolist (if ifs)"},{"Add":" (dolist (he6 he-6in4s)"},{"Add":" (let ((v (cadr he6)))"},{"Add":" (file-exists-templated-from"},{"Add":" (sprintf \"/etc/dhclient-exit-hooks.d/20-henet_gif_%s\""},{"Add":" (cadr (assoc :name v)))"},{"Add":" \"644\" \"root\" \"wheel\""},{"Add":" \"templates/henet_gif_tunnel.tmpl\""},{"Add":" `((\"HGT_INTERFACE\" interface)"},{"Add":" (\"HGT_FAR_IPV4\" (cadr (assoc :far-ipv4 v)))"},{"Add":" (\"HGT_USERNAME\" (cadr (assoc :username v)))"},{"Add":" (\"HGT_PASSWORD\" (cadr (assoc :password v)))"},{"Add":" (\"HGT_TUNNELID\" (cadr (assoc :tunnel-id v)))"},{"Add":" (\"HGT_NEAR_IPV6\" (cadr (assoc :near-ipv6 v)))"},{"Add":" (\"HGT_FAR_IPV6\" (cadr (assoc :far-ipv6 v))))))))))"}]}},{"FileAdd":{"meta":{"basename":"hardware.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":"(setq chromebox-networking"},{"Add":" '((:ethernet-interfaces (\"re0\"))"},{"Add":" (:mtus (\"re0\" 9193))"},{"Add":" ;; all vlans live on the re0 interface"},{"Add":" (:interface-on-vlan"},{"Add":" (lambda (if vid)"},{"Add":" (cond ((equal if \"re0\") true)"},{"Add":" (true false))))))"},{"Add":""}]}},{"FileAdd":{"meta":{"basename":"firewall.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":""},{"Add":"(defun firewall-jail-exists (name host-v6sub carp-advskew)"},{"Add":" ;; create zfs filesystem"},{"Add":" ;; bsdinstall jail, or untar an occambsd, or pkg-base it"},{"Add":" ;; write jail.conf; vnet=new; hand ethernet interface in"},{"Add":" ;; share epair72 with the host"},{"Add":" ;; inside jail, configure epair72b"},{"Add":" ) "},{"Add":""},{"Add":";; implements QNV, QNJ"},{"Add":"(defun firewall-jail-vlan-setup (my-octet)"},{"Add":" (let ((mtus-set nil))"},{"Add":" ;; for emacs: (put 'do-ifs-and-vlans 'lisp-indent-function 1)"},{"Add":" ;;"},{"Add":" ;; "},{"Add":" (do-ifs-and-vlans chromebox-networking"},{"Add":" ;; this happens per-interface, not per-vlan, but i didn't want"},{"Add":" ;; to make a do-ifs, it doesn't get rid of enough boilerplate."},{"Add":" (when (not (member if mtus-set)) "},{"Add":" (change (sprintf \"set mtu for %s\" if)"},{"Add":" (lambda ()"},{"Add":" (sysrc-set (sprintf \"ifconfig_%s\" if)"},{"Add":" (sprintf \"up mtu %d\" mtu))))"},{"Add":" (push if mtus-set))"},{"Add":" (when fwp"},{"Add":" ;; our Ethernet adapter can do hardware VLAN tagging and"},{"Add":" ;; checksums; let's let it do them"},{"Add":" (change"},{"Add":" (sprintf \"add vlan %d to if %s\" vid if)"},{"Add":" (lambda () (sysrc-add"},{"Add":" (sprintf \"vlans_%s\" if)"},{"Add":" ;; the leading space clues sysrc in on what"},{"Add":" ;; separates values in this variable"},{"Add":" (sprintf \" %d\" vid)))"},{"Add":" nil)"},{"Add":" (when v6s"},{"Add":" (let* ((ula-ip (sprintf \"%s:%s::%d\" ula-ipv6-48 v6s my-octet))"},{"Add":" (global-ip (sprintf \"%s:%s::%d\" global-ipv6-48 v6s my-octet)))"},{"Add":" (change (sprintf \"ULA IP for %s\" vif)"},{"Add":" (lambda ()"},{"Add":" (sysrc-set (sprintf \"ifconfig_%s_%d_ipv6\" if vid)"},{"Add":" (sprintf \"inet6 %s/%d\" ula-ip 64)))"},{"Add":" nil)"},{"Add":" (change (sprintf \"Global IP for %s\" vif)"},{"Add":" (lambda ()"},{"Add":" (sysrc-add (sprintf \"ifconfig_%s_%d_aliases\" if vid)"},{"Add":" (sprintf \" inet6 %s/%d\" global-ip 64)))"},{"Add":" nil)))"},{"Add":" (when v4sub"},{"Add":" (let ((ipv4 (sprintf \"%s.%d.%d\" internal-ipv4-16 v4sub my-octet)))"},{"Add":" (change (sprintf \"IPv4 for %s\" vif)"},{"Add":" (lambda ()"},{"Add":" (sysrc-set (sprintf \"ifconfig_%s_%d\" if vid)"},{"Add":" (sprintf \"inet %s/%d\" ipv4 24)))"},{"Add":" nil)))"},{"Add":" (change (sprintf \"add description to %s.%d\" if vid)"},{"Add":" (lambda ()"},{"Add":" (sysrc-add (sprintf \"ifconfig_%s_%d\" if vid)"},{"Add":" (sprintf \" descr %s\" name))))))))"},{"Add":""},{"Add":";; implements QA for firewall jail"},{"Add":"(defun firewall-jail-common-bits ()"},{"Add":" (change \"add suitable jjl user\" add-jjl nil)"},{"Add":" (change \"let wheel group use doas\" doas-for-wheel nil)"},{"Add":" (change \"enable sshd\" (lambda () (sysrc-set \"sshd_enable\" \"YES\")) nil)"},{"Add":" ;;(change \"ssh access only via key\" openssh-keys-only nil)"},{"Add":" (firewall-jail-netflow-collect-rc"},{"Add":" (sprintf \"inet6/[%s]:4444\" (vlan-ula-host :mgmt \"6e66\")))"},{"Add":" (change \"enable netflow collector\""},{"Add":" (lambda () (sysrc-set \"netflow_collect_enable\" \"YES\"))"},{"Add":" nil))"},{"Add":""},{"Add":"(defun firewall-jail (host-v6sub my-octet)"},{"Add":" (firewall-jail-common-bits)"},{"Add":" (firewall-jail-vlan-setup my-octet))"},{"Add":""}]}},{"FileAdd":{"meta":{"basename":"files","metadata":576},"context":[{"change":3,"pos":389}],"contents":[]}},{"FileAdd":{"meta":{"basename":"hosts","metadata":0},"context":[{"change":0,"pos":23218}],"contents":[{"Add":"U2FsdGVkX18z4MePwAMsmKxxV3uGPuKCQvJDMpruW/ek9zAZ6Yk95jD4TbJj9jx9"},{"Add":"yWYQ7ry+y4KeCr6Gj3rTjj4x7LF9QHALN+JhI/mcT0EKva1UC4dLeEcEknbiLhbO"},{"Add":"XbQN2pEZ4iJAzRq06ZbDUgLx9OiGjHBNHT35hsw6ZsZz4/IPgwSH+wlksf/3ojsk"},{"Add":"xozfyl3Ugcx016TNSWQdb98IraKwUBJ4sJKIi/6R1l9bFHMGbCeD0yLDNszKoP6k"},{"Add":"zoz7GeBgGrXyuOztI/gNpw2GLRKmMhVMbll4Hpmj77N4g+yayIB/Yn7ShPDRCpkd"},{"Add":"OLS+PorCWHdLgrchcXzbiCJYbUdwiGzPLaaolq0X+sAXONOBYsKmA6b/OL2kE04d"},{"Add":"Z1mU9blcgDArH0FRVnPSLf0g0jt3JPVMYeRMhV24w0tPdhZwVGfWbgyDHUTsPeFC"},{"Add":"MW96rrSOH0IafXJdxGohQ9eElMqGYl1M8Eh1TrS4xEHVkTsaL0Yq7egmVOSzW+Sr"},{"Add":"xbssI0EfvThalCDbcW79GMdUMOIC4W7gznETa+qApSjTen/mu6SEBYNWLnB1X9ve"},{"Add":"fD8p7L2GuP5JbOqDQfkTI1QZTTFuf0JsAXDQOxMObAOaMSFRgVXlLCmkwi0t5/Zy"},{"Add":"+VtG399Bkj48RaQ1UprkZeO8DUHhbaA+92QvOzI25uXYrfeyGB/rFQpMRg5k2pJn"},{"Add":"4b/PZ50xzVYd4gcPnW7DDGGnH2u5jnMfGT2PrKCr4IcTuJQIFVQmPLSkSbpnl/E/"},{"Add":"WjmKMKxTNwcpSG7B9SIqQQfijEwjwdBUwbZmDd7+0YkwporCooIBgIlyuWa/KolO"},{"Add":"mumuTbH5CTuvksseyLsztGmuselegQRIYx/BXcVLmVBYMBqUvEMqvHg/SV/7LgXQ"},{"Add":"ENz+8xcWddZqeiEcGmLKdlz6+M/F+AgElD1dmxONbXWEdHZ6ZyFCME5r8O5r8yt1"},{"Add":"9pK9GDieWHw56G5ue+F+em1dzdrIlQO37//dwg5NHAbFXhHlqL+WNqkQIq2J+boV"},{"Add":"3+0zC566zqBFcAb+6b/AFDKr/f82eip2pt7Q4Kt/YwHTNrmJ6ybbCt0sDl+kJkv9"},{"Add":"xupxHZWUorZCLR4hM5WunSt7baWSrx3tDhAsavjKVngwyVmQfB27f/k0fdVUtR+Z"},{"Add":"NfGUHjMJ/jqM05xQ1hOlTdZGRzShOApilH2iGTINqOHU4YtbX5byT4y6zuc+X+Gb"},{"Add":"UJuengr16HXz0DY0ZZ6dIeweCShP5W7/RUj5UloMPlEO8F8cVI156x9IaJYfB44e"},{"Add":"pAMocOvuzD+ZfKYcwQDG3d7GXgavlK4iFcNCj9QCPpJ2dqlHMJw2Fw8vb3F+k8Kx"},{"Add":"mqENO8n8a4sz1hXXT7uGFOe+b/URRUnG4ryMJOLSE2dO2LqNSjNvWuWu2iXoK9gc"},{"Add":"NUDBI/fzax2Wpw6x2+bRWBf/cm3kfnVpVR4Lmllo3Ur5wKWm+SL2ORiXFXf8wBID"},{"Add":"6BbUr9Z/z93X30gkj8x7fcO/hoTpoH115I1Y8iDDUCGq8x3AnaBVS4ZT4fEIyTE1"},{"Add":"g+egXKHUFZWDbZbQEj0c6TkwY/UmzGbfyXrkzh/o8H3e8DtzAzNE2pQN8OKSaiO8"},{"Add":"A4JwGzXlcBiIJHnDyPTQQGokhOCL7vG8khOuX8inEcvyMjybHTtsAye01eQRxNuz"},{"Add":"SA0jQ+u4q1tqJSMtlNEGUF8+G1rHW86oraoiz6H4rdahwN3r2O7D7hKU9JDnqDjc"},{"Add":"X9IsTY7dhY0UE/Gp47TLKvAVr+fpP1kwJM3SAKF/z+jbLu/12Sc0Nlo/HT7pB83b"},{"Add":"Ho8JNlmdXsnbXhlt6rJ2kjw/Bjo0qc8CrNnisKxDm07mq94WtcuePcaTmSt/JdcZ"},{"Add":"UGlBfxEJa9BCp8V1BI5Swussb0Eqphs2Q+pI5wkvg6I0+xiQnY+0cqbt69niSzgc"},{"Add":"9PJ6wwAoP8x1NpPQgPbYOm2Z6g87jvd+I4/u4RdDhuCpIqe4BKJB9oI/RUocT/Oz"},{"Add":"TRZ7FWanMksEUzuoR+gHL6+0IPGGIsUSzXJAVi0Dee3hqBz0nOvRvHhhjnFUHigh"},{"Add":"SxQcWAt0HkD4h7r2GPSOhnRdtoM2YO2wvSdRzT6icpN5ORHDBR60XbIGgzgwauoA"},{"Add":"ZLK+MDl7y4QuaHr8p2POpNrn3KZ4Hl4viQ8gBtrribEymeERRgZyc/nmpP3oW2ao"},{"Add":"2W8cPmOW1Ry/8rDV6UUQngG6rpcAHHNZ6S9oVboTvSKh1Xa+vU1eCvdj1UVJKQTv"},{"Add":"nrFFrcyV6wC4n1lgg3z2ogASlnjgUB3TF6V3iEp29hYKqy693tTc9UdSkZw0ujyI"},{"Add":"e1b5gyQLzxna0GnY35Y7DofmkJvDueEO21DLf+PRXEOf5W9Q9Yn8lWvkTKmgNIwn"},{"Add":"oPZiz4c8CPFEgg0FtXtoHCiUuRyo69YycpYUOSTYUg8ggBOni/M9LoTx3bW5yjYe"},{"Add":"mgZzXNyKyvor/coUzDngiYIMsYafMLkSoBpGHGxynAw8bdCqNTQqG287zRFA8wzF"},{"Add":"UzzT0pKYRoRS9W7IXHWPD7XGdSm9MNTAQjOOnN9uKJZjV5ioG8EgzvVgVfkr4zug"},{"Add":"22Arup/43ORBQ8QSE+seOBvMEuqBWY5KhLb3wvvlGLm/eAAiIGridrXohpmLmHl/"},{"Add":"0mrtqQGqSICS/agR4H0V42g8ZPodvbRskZx5NSE5BwSOMFYCzO7wT8yf7LakT9uP"},{"Add":"ZoL8c1WgdKdjSnIihyfZDm1Tg86vw2Di2nygabzQJhkSptxdWGA1O4b15MvBQgOx"},{"Add":"0TrnOxJ3upuPZaRVeucV8d4QM+pIc/Qlb1hrPob/MSHq+UxDZeuSph0xZKJsgMQF"},{"Add":"61qZd51t9iwyI0+IHgCbh38Xlc0i4uAG4TrVR9+/S3/wkdUI+QC+ALLTNX/9XT4i"},{"Add":"0l//wzXAO7SBqrfoYyqLBrj48XbT8hvs9Fr4OjemySXhc27oRsNEstax97iHsBtR"},{"Add":"3CgHB8TYCvUvI0PX9Cdi2qk1woMMwCrcgmkeyMHDrt9b1LuiUzKMeOP9l1PxNxik"},{"Add":"3icpDavTRERbat+fTqeLCknVbXgwoHPeRWJ5xLfUs7Ug8JpKcSjWEmvyulZthIyJ"},{"Add":"cjxNuQ=="}]}},{"FileAdd":{"meta":{"basename":"ethers","metadata":0},"context":[{"change":0,"pos":23218}],"contents":[{"Add":"U2FsdGVkX1+VAYVExLGlGT8mXy8gk8+wljpa7sWk+RYrUEc3dagmTey+yuCYIoe8"},{"Add":"jvCBmvYcMfEP+C8HLqdR+tpIt4oQ/hCFvNf64KbHFnmlXXy1agHpBGAzY1cUA5jZ"},{"Add":"Uqb688vXLN8V5DFe8ttZAXEbhx+SKnlkL7SYxzXMCnnHRcVPRXdG2jBPF9NZPMaZ"},{"Add":"Klo43NOXbpY="}]}},{"FileAdd":{"meta":{"basename":"doc","metadata":576},"context":[{"change":3,"pos":389}],"contents":[]}},{"FileAdd":{"meta":{"basename":"requirements.org","metadata":0},"context":[{"change":0,"pos":26637}],"contents":[{"Add":"** DONE QA: access"},{"Add":"*** QAS: SSH via mgmt network"},{"Add":"*** QAK: Key-only SSH"},{"Add":"*** QAD: doas"},{"Add":"** QN: networking"},{"Add":"*** DONE QNV: on all VLANs"},{"Add":"*** DONE QNJ: jumbo frames"},{"Add":"*** DONE QNN: with netflow monitoring"},{"Add":"*** QNM: with mirror ports"},{"Add":"for zeek. more netgraph conjuration, no big"},{"Add":"** [7/7] QR: routing"},{"Add":"*** [3/3] QRO: connect to outside"},{"Add":"**** QRO4: connect to outside IPv4"},{"Add":""},{"Add":"use dhcp client"},{"Add":""},{"Add":"***** DONE QRO4B: bpf device in jail"},{"Add":""},{"Add":"write some devfs.rules"},{"Add":""},{"Add":"**** QRO6: connect to outside IPv6"},{"Add":"**** DONE QROX: run scripts upon receiving an address"},{"Add":"**** DONE QROD: update dns.he.net DDNS"},{"Add":"**** DONE QROH: connect to he.net over 6in4"},{"Add":"*** [2/2] QR4: route IPv4"},{"Add":"**** DONE QR4N: NAT"},{"Add":"**** DONE QR4R: incoming port redirection"},{"Add":"*** DONE QR6: route IPv6"},{"Add":"(run rtadvd) (or dnsmasq)"},{"Add":"*** DONE QRF: firewall"},{"Add":"** [3/3] QC: CARP redundancy"},{"Add":""},{"Add":"For"},{"Add":"- Availability"},{"Add":"- Ease of change/upgrade"},{"Add":""},{"Add":"*** DONE QCP: pfsync"},{"Add":"*** DONE QCX: run scripts upon carp state changes"},{"Add":"*** [1/1] QCO: sync outside dhcp client state"},{"Add":"**** QCOM: make the interfaces exposed to the ISP have the same MAC address"},{"Add":"i'm not sure whether this is necessary"},{"Add":"**** QCOI: make DHCP host identifiers the same?"},{"Add":"ditto"},{"Add":"**** DONE QCOD: start/stop dhclient upon pfsync state change"},{"Add":"** [0/1] QV: Wireguard VPNs"},{"Add":"*** TODO QVT: to Tornado VPS"},{"Add":"*** QVM: to mobile devices"},{"Add":"** [5/6] QS: local services"},{"Add":""},{"Add":"extra points for separate jails. since these chromeboxes are redundant"},{"Add":"they should probably replace hanuman."},{"Add":""},{"Add":"*** DONE QSD: DHCPv4 and DHCPv6"},{"Add":"*** DONE QSN: DNS"},{"Add":"**** DONE QSNI: authoritative internal DNS"},{"Add":""},{"Add":"DHCP has to update DNS; this happens over a Unix socket iirc. If you"},{"Add":"squint, this may belong with LDAP and Kerberos."},{"Add":""},{"Add":"Mneh, dnsmasq for the first try."},{"Add":""},{"Add":"**** DONE QSNR: recursive DNS"},{"Add":"***** DONE QSNRL: logging"},{"Add":"*** TODO QST: NTP (time)"},{"Add":""},{"Add":"Hum. A FreeBSD forum thread seems to indicate that ntpd running inside"},{"Add":"a jail can't modify the system's time. That means the physical host"},{"Add":"has to reach out to NTP servers on the internet. I didn't want the"},{"Add":"host to have any internet connectivity."},{"Add":""},{"Add":"*** QSL: LDAP"},{"Add":"*** QSK: Kerberos"},{"Add":"** QD: detection/monitoring"},{"Add":""},{"Add":"This could be done on a different machine, with suitable mirror port"},{"Add":"config on the switch. Or maybe on the firewalls using netgraph."},{"Add":""},{"Add":"*** QDC: collectd stats"},{"Add":"*** QDI: ids/ips"},{"Add":"*** QDN: netflow"},{"Add":""},{"Add":"behold, netgraph supports it natively! just needs collection and"},{"Add":"stats. hmm."},{"Add":"https://framkant.org/2019/03/collect-and-save-netflow-data-with-freebsd/"},{"Add":"so i just did a bunch of stuff /not/ with netgraph."},{"Add":""},{"Add":"**** QDNC: collector"},{"Add":"**** QDNE: exporter"},{"Add":"**** QDNS: stats"},{"Add":""},{"Add":"nfcapd/nfdump, or SiLK"},{"Add":""},{"Add":"*** QDZ: nsm (zeek)"},{"Add":"*** QDL: forwarded logs"},{"Add":"**** QDLS: send logs"},{"Add":"***** QDLSF: from firewalls"},{"Add":"***** QDLSH: and underlying hosts"},{"Add":"***** QDLSD: other DMZ jails"},{"Add":"***** QDLST: Tornado VPS"},{"Add":"**** QDLR: receive logs"},{"Add":"**** QDLP: process logs"},{"Add":"**** QDLI: index logs"},{"Add":"**** QDLV: view logs"},{"Add":"** QZ: Routing speed"},{"Add":""},{"Add":"for fast traffic to dmz (nextcloud, photoprism, jellyfin). with a"},{"Add":"single GbE you can only theoretically get 500Mbps routed. not sure how"},{"Add":"to get more wired network interfaces in a chromebox. usb3 i guess."},{"Add":"later."},{"Add":""},{"Add":"** QB: Build/update process"},{"Add":"*** DONE QBH: configure host"},{"Add":"*** DONE QBJ: create jail image"},{"Add":"*** DONE QBC: make jail.conf"},{"Add":"*** QBR: make a repo accessible to mgmt"},{"Add":"*** QBS: sign upgrades and verify signatures"},{"Add":"*** QBU: automate upgrades"},{"Add":""},{"Add":"- detect new version"},{"Add":"- fetch new version"},{"Add":"- only run on BACKUP node"},{"Add":"- wait until PRIMARY is certified ok"},{"Add":"- verify upgrade signature"},{"Add":"- stop jail"},{"Add":"- snap jail"},{"Add":"- remove jail files"},{"Add":"- untar new version"},{"Add":"- start jail"},{"Add":""},{"Add":"Not automated: promoting BACKUP node, testing function, moving on to"},{"Add":"upgrade the other node."},{"Add":""},{"Add":"*** QBX: delete old snapshots"},{"Add":"*** QBI: make install media"}]}},{"FileAdd":{"meta":{"basename":"dnsmasq.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":";; implements QSD, QSN, QSNI, QSNR, QR6"},{"Add":"(defun dnsmasq ()"},{"Add":" (package-installed \"dnsmasq\")"},{"Add":" (let ((ipv4-ranges nil)"},{"Add":" (ipv6-ranges nil)"},{"Add":" (no-dhcp-interfaces nil)"},{"Add":" (dns-listen-interfaces nil)"},{"Add":" (v6opts '(\"ra-stateless\" \"ra-names\"))"},{"Add":" (template-inputs nil)"},{"Add":" (ifs (assoc-path '(:ethernet-interfaces) chromebox-networking))"},{"Add":" (if-on-vlan (assoc-path '(:interface-on-vlan)"},{"Add":" chromebox-networking)))"},{"Add":" (dolist (if ifs)"},{"Add":" (do-vlans"},{"Add":" (if dnsmasq-dhcp-p"},{"Add":" (progn"},{"Add":" (let ((min 100) (max 250))"},{"Add":" (push (sprintf \"dhcp-range=set:%s,%s.%d.%d,%s.%d.%d\""},{"Add":" name"},{"Add":" internal-ipv4-16 v4sub min"},{"Add":" internal-ipv4-16 v4sub max)"},{"Add":" ipv4-ranges))"},{"Add":" (push (sprintf \"dhcp-range=set:%s,::,constructor:%s%s\""},{"Add":" name (sprintf \"%s.%d\" if number)"},{"Add":" (strcat \",\" (apply string-join \",\" v6opts)))"},{"Add":" ipv6-ranges))"},{"Add":" (push (sprintf \"%s.%d\" if number) no-dhcp-interfaces))"},{"Add":" (when dnsmasq-dns-p"},{"Add":" (push (sprintf \"%s.%d\" if number) dns-listen-interfaces))))"},{"Add":" (file-exists-with-contents-gsubbed"},{"Add":" \"/usr/local/etc/dnsmasq.conf\" \"644\" \"root\" \"wheel\""},{"Add":" \"templates/dnsmasq.conf.m4\""},{"Add":" `((\"DHCP_IPV4_RANGES\" ,(apply string-join \"\\n\" ipv4-ranges))"},{"Add":" (\"DHCP_IPV6_RANGES\" ,(apply string-join \"\\n\" ipv6-ranges))"},{"Add":" (\"NO_DHCP_INTERFACES\" ,(apply string-join \",\" no-dhcp-interfaces))"},{"Add":" (\"DNS_INTERFACES\" ,(apply string-join \",\" dns-listen-interfaces))))"},{"Add":" (sysrc-set \"dnsmasq_enable\" \"YES\")"},{"Add":" (file-exists-with-text-copied-from"},{"Add":" \"/etc/hosts\" \"644\" \"root\" \"wheel\" \"files/hosts\")"},{"Add":" (file-exists-with-text-copied-from"},{"Add":" \"/etc/ethers\" \"644\" \"root\" \"wheel\" \"files/ethers\")))"},{"Add":""}]}},{"FileAdd":{"meta":{"basename":"dhcp-client.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":";; implements QROX"},{"Add":"(defun set-up-dhclient-hooks ()"},{"Add":" ;; ... I'm not going to do the /usr/local/etc treatment for this."},{"Add":" ;; This dhclient is part of the base system and our configuration"},{"Add":" ;; for it is too."},{"Add":" (dir-exists \"/etc/dhclient-enter-hooks.d\" \"755\" \"root\" \"wheel\")"},{"Add":" (dir-exists \"/etc/dhclient-exit-hooks.d\" \"755\" \"root\" \"wheel\")"},{"Add":" ;; note: these scripts may need to run without /usr/bin being"},{"Add":" ;; mounted first"},{"Add":" (file-exists-with-entire-contents"},{"Add":" \"/etc/dhclient-enter-hooks\" \"644\" \"root\" \"wheel\""},{"Add":" \"source everything in /etc/dhclient-enter-hooks.d\""},{"Add":" \"\\"},{"Add":"for x in $(/bin/ls /etc/dhclient-enter-hooks.d/* 2>/dev/null); do"},{"Add":". $x"},{"Add":"done"},{"Add":"\")"},{"Add":" (file-exists-with-entire-contents"},{"Add":" \"/etc/dhclient-exit-hooks\" \"644\" \"root\" \"wheel\""},{"Add":" \"source everything in /etc/dhclient-exit-hooks.d\""},{"Add":" \"\\"},{"Add":"for x in $(/bin/ls /etc/dhclient-exit-hooks.d/* 2>/dev/null); do"},{"Add":". $x"},{"Add":"done"},{"Add":"\"))"},{"Add":""},{"Add":";; implements QCOD"},{"Add":";; implements QRO4, i think"},{"Add":"(defun dhcp-only-on-carp-primary (vhid interface)"},{"Add":" ;; this default configuration starts dhclient when the link goes up"},{"Add":" ;; and assumes the link will go down and so does not stop dhclient"},{"Add":" (file-does-not-exist \"/etc/devd/dhclient.conf\")"},{"Add":""},{"Add":" (carp-state-change-script"},{"Add":" vhid interface \"MASTER\" \"dhclient\""},{"Add":" (sprintf \"service dhclient quietstart %s\\n\" interface))"},{"Add":" (carp-state-change-script"},{"Add":" vhid interface \"BACKUP\" \"dhclient\""},{"Add":" (sprintf \"service dhclient quietstop %s\\n\" interface)))"}]}},{"FileAdd":{"meta":{"basename":"carp.glotawk","metadata":0},"context":[{"change":3,"pos":389}],"contents":[{"Add":"(setq carp-passphrases"},{"Add":" '((:mgmt e\"U2FsdGVkX1/wRrkK7cLv1djnzBtddFDqjda6M+/DgO25w6JE2PRPDVaFux9UVJIpHAtcupLOcM0PhQ==\")"},{"Add":" (:dmz e\"U2FsdGVkX1+X2Ji0/CCfvHiuB6KOrUl1Hu0BifTVCCc8mxyvbNviogU/2rZ5hoJZfMaULxtaCgOFppCoRSzJRg==\")"},{"Add":" (:guest e\"U2FsdGVkX1/4COXc+mEGZBvVTnMzQpvE5NUz04brb6+t0ikIl5CwKalrt/3qnpc8oHn9rMCa5x187PzR\")"},{"Add":" (:inside e\"U2FsdGVkX1/avLdcg1Ri7XymD3aD1gXiDp3ethsD9gVd8Elgoh4zPsUbcRJWTLIJ8oA2VGqPeHBtk1k=\")"},{"Add":" (:local e\"U2FsdGVkX1+KK2hsz/LBivFGlLK37q5Iqg8C//M4eNtOktQqVvlCJmtneM0mYLIahOF61Urlxw==\")))"},{"Add":""},{"Add":";; implements QC"},{"Add":"(defun carp-ips-configured (my-octet carp-octet advskew)"},{"Add":" (do-ifs-and-vlans chromebox-networking"},{"Add":" (when (and fwp carpp)"},{"Add":" (let ((my-addr"},{"Add":" (sprintf \"%s:%s::%s\" ula-ipv6-48 v6sub my-octet))"},{"Add":" (shared-addr"},{"Add":" (sprintf \"%s:%s::%s\" ula-ipv6-48 v6sub carp-octet))"},{"Add":" (passphrase (cadr (assoc kw carp-passphrases))))"},{"Add":" ;; As far as I read, the CARPing happens with multicast by"},{"Add":" ;; default and I don't need to address the individual"},{"Add":" ;; members of my CARP pair. But everybody's tutorial has"},{"Add":" ;; the CARP address as an alias on an interface with a"},{"Add":" ;; per-host address as its primary: the FreeBSD Handbook,"},{"Add":" ;; the CARP article by Mariusz Zaborski, and this other"},{"Add":" ;; person from earlier this year."},{"Add":" ;;"},{"Add":" ;; https://docs.freebsd.org/en/books/handbook/advanced-networking/#carp"},{"Add":" ;;"},{"Add":" ;; https://freebsdfoundation.org/wp-content/uploads/2022/11/zaborski_CARP.pdf"},{"Add":" ;;"},{"Add":" ;; https://www.subnetspider.com/2025/01/22/building-a-fault-tolerant-reverse-proxy-with-freebsd.html"},{"Add":" (sysrc-add (sprintf \"ifconfig_%s_%d_aliases\" if vid)"},{"Add":" (sprintf \" vhid %d advskew %d pass %s alias %s/%d\""},{"Add":" vid advskew"},{"Add":" (unsafe-reveal passphrase)"},{"Add":" shared-addr))))))"},{"Add":""},{"Add":"(setq carp-script-dir \"/usr/local/etc/carp-scripts\")"},{"Add":""},{"Add":";; implements QCX"},{"Add":"(defun run-scripts-on-carp-state-changes (vhid interface)"},{"Add":" (dir-exists carp-script-dir \"755\" \"root\" \"wheel\")"},{"Add":" (file-exists-with-entire-contents-gsubbed ;; because of all the \"'s therein"},{"Add":" \"/etc/devd/carp.conf\" \"644\" \"root\" \"wheel\""},{"Add":" \"templates/carp_devd.conf.m4\""},{"Add":" `((\"CARP_SCRIPTS_DIR\" ,carp-script-dir)))"},{"Add":" (let ((subsys (sprintf \"%d@%s\" vhid interface)))"},{"Add":" (dolist (state '(\"MASTER\" \"BACKUP\"))"},{"Add":" (let* ((event (sprintf \"on-%s-%s\" subsys state))"},{"Add":" (this-event-dir"},{"Add":" (sprintf \"%s/%s.d\" carp-script-dir event))"},{"Add":" (this-event-runner-script"},{"Add":" (sprintf \"%s/%s.sh\" carp-script-dir event)))"},{"Add":" (dir-exists this-event-dir \"755\" \"root\" \"wheel\")"},{"Add":" (file-exists-with-entire-contents"},{"Add":" this-event-runner-script \"755\" \"root\" \"wheel\""},{"Add":" (sprintf \"run everything in %s\" this-event-dir)"},{"Add":" ;; this file's contents, by contrast with the above, don't"},{"Add":" ;; have anything we need to escape when expressing as a"},{"Add":" ;; string literal here."},{"Add":" (sprintf \"\\"},{"Add":"#!/bin/sh"},{"Add":"for f in $(ls '%s'); do $f; done"},{"Add":"\" this-event-dir)))))"},{"Add":" ;; and now, make scripts like, for example,"},{"Add":" ;; /usr/local/etc/carp-scripts/on-87@re0.87-BACKUP.d/dhcp, which"},{"Add":" ;; will run when we become the BACKUP for the :wan vlan's carp ip"},{"Add":" ;; (which has vhid 87 and belongs to interface re0.87)."},{"Add":" )"},{"Add":""},{"Add":";; you make such scripts using this function."},{"Add":"(defun carp-state-change-script (vhid interface state name contents)"},{"Add":" (let* ((subsys (sprintf \"%d@%s\" vhid interface))"},{"Add":" (event (sprintf \"on-%s-%s\" subsys state))"},{"Add":" (event-dir (path-join carp-script-dir (strcat event \".d\")))"},{"Add":" (script-filename (path-join event-dir identifier)))"},{"Add":" (file-exists-with-entire-contents"},{"Add":" script-filename \"755\" \"root\" \"wheel\""},{"Add":" (sprintf \"when %s goes to %s, deal with aspect %s\" subsys state name))))"},{"Add":""},{"Add":";; implements QCP"},{"Add":"(defun pfsync ()"},{"Add":" (let ((ifs (assoc-path '(:ethernet-interfaces) chromebox-networking))"},{"Add":" (if-for-vlan (assoc-path '(:interface-for-vlan)"},{"Add":" chromebox-networking)))"},{"Add":" (dolist (if ifs)"},{"Add":" (do-vlans"},{"Add":" (when (and fw (eq kw :pfsync))"},{"Add":" (sysrc-set \"pfsync_enable\" \"YES\")"},{"Add":" (sysrc-set \"pfsync_syncdev\" if)"},{"Add":" (sysrc-set \"pfsync_syncpeer\" \"ff12::f0\"))))))"}]}}],"owner":"jaredj","repo":"glotawk","token":"5xN71SySyWzJ3g5OENfLOT+C4D+7xDWsn9oOibtujsQ=","login":null}

…

Dependencies

Change contents