forge/pmaports
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions
pmaports/main/postmarketos-config-nftables/APKBUILD

145 lines
4.9 KiB
Text
Raw Normal View History

postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
# Maintainer: Clayton Craft <clayton@craftyguy.net>
pkgname=postmarketos-config-nftables
main/postmarketos-config-nftables: 50_*.nft: drop unused wwan rules (MR 3594) There is "iifname "wwan*" drop" defined in 01_wwan.nft, which drops any not "established, related" incoming packet from WWAN. [ci:skip-build]: already built successfully in CI
2022-10-28 00:41:32 +00:00
pkgver=0.13
pkgrel=0
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
pkgdesc="nftables firewall configuration for postmarketOS"
url="https://gitlab.com/postmarketos"
arch="noarch"
license="MIT"
depends="nftables-openrc"
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
subpackages="
$pkgname-openusb:openusb
$pkgname-log:log
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
$pkgname-chromecast:chromecast
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
$pkgname-docker:docker
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
$pkgname-mdns:mdns
main/postmarketos-config-nftables: add mosh config (MR 2725) https://social.linux.pizza/@jan_wagemakers/107393948283025525 [ci:skip-build] already built successfully in CI
2021-12-05 20:25:43 +00:00
$pkgname-moshserver:moshserver
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
$pkgname-networkmanager:networkmanager
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
$pkgname-upnp-client:upnp_client
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
$pkgname-vlc-chromecast:vlc_chromecast
main/postmarketos-config-nftables: subpackage vncserver (MR 2479) Co-authored-by: clayton craft <clayton@craftyguy.net>
2021-09-01 04:53:27 +00:00
$pkgname-vncserver:vncserver
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
"
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
source="
rules/00_log_all.nft
rules/01_wwan.nft
rules/10_dhcp.nft
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
rules/50_mdns.nft
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
rules/50_ssh.nft
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
rules/50_upnp_client.nft
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
rules/50_vlc_chromecast.nft
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
rules/50_vncserver.nft
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
rules/51_docker.nft
main/postmarketos-config-nftables: add mosh config (MR 2725) https://social.linux.pizza/@jan_wagemakers/107393948283025525 [ci:skip-build] already built successfully in CI
2021-12-05 20:25:43 +00:00
rules/51_moshserver.nft
postmarketos-config-nftables: allow DNS from wlan* (MR 2448) This fixes DNS when a system is connected to a pmOS device as a hotspot. The rule is in the default set of firewall rules, instead of a subpackage.. I think this is OK. I don't believe anything should be listening on port 53 except when the hotspot is running...
2021-08-18 00:06:56 +00:00
rules/51_hotspot.nft
config-nftables: add rules for allowing usb inet access (MR 2274) This rule is installed by default, since users that need usb inet won't have an easy way to install a subpackage. This is meant to facilitate: https://wiki.postmarketos.org/wiki/USB_Internet
2021-06-24 23:45:12 +00:00
rules/51_usb_inet.nft
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
rules/60_usb.nft
rules/99_drop_log.nft
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
networkmanager.conf
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
"
options="!check" # No tests
install="$pkgname.post-install"
package() {
cd rules
for _i in ./*; do
install -Dm644 "$_i" "$pkgdir"/etc/nftables.d/"$_i"
done
}
openusb() {
depends="$pkgname"
description="Adds a rule to accept all incoming connections to the usb* interface"
amove etc/nftables.d/60_usb.nft
}
log() {
depends="$pkgname"
description="Enables logging of nftable events"
amove etc/nftables.d/00_log_all.nft
amove etc/nftables.d/99_drop_log.nft
}
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
chromecast() {
depends="$pkgname $pkgname-mdns"
description="Enables networking for Chromium Chromecast"
main/postmarketos-config-nftables: use versioned constraints in install_if (MR 3536) Consistently use `install_if="$pkgname=$pkgver-r$pkgrel ...` everywhere, this is recommended upstream. See https://wiki.alpinelinux.org/wiki/APKBUILD_Reference#install_if
2022-10-16 05:15:59 +00:00
install_if="$pkgname=$pkgver-r$pkgrel chromium"
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
# meta package is empty
mkdir -p "$pkgdir"-chromecast
}
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
docker() {
depends="$pkgname"
description="Enables networking for Docker"
main/postmarketos-config-nftables: use versioned constraints in install_if (MR 3536) Consistently use `install_if="$pkgname=$pkgver-r$pkgrel ...` everywhere, this is recommended upstream. See https://wiki.alpinelinux.org/wiki/APKBUILD_Reference#install_if
2022-10-16 05:15:59 +00:00
install_if="$pkgname=$pkgver-r$pkgrel docker"
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
amove etc/nftables.d/51_docker.nft
}
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
mdns() {
depends="$pkgname"
description="Enables networking for mDNS"
amove etc/nftables.d/50_mdns.nft
}
main/postmarketos-config-nftables: add mosh config (MR 2725) https://social.linux.pizza/@jan_wagemakers/107393948283025525 [ci:skip-build] already built successfully in CI
2021-12-05 20:25:43 +00:00
moshserver() {
depends="$pkgname"
description="Enables networking for mosh server"
install_if="$pkgname=$pkgver-r$pkgrel mosh-server"
amove etc/nftables.d/51_moshserver.nft
}
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
upnp_client() {
depends="$pkgname"
description="Enables networking for SSDP/UPnP client"
main/postmarketos-config-nftables: use versioned constraints in install_if (MR 3536) Consistently use `install_if="$pkgname=$pkgver-r$pkgrel ...` everywhere, this is recommended upstream. See https://wiki.alpinelinux.org/wiki/APKBUILD_Reference#install_if
2022-10-16 05:15:59 +00:00
install_if="$pkgname=$pkgver-r$pkgrel libupnp"
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
amove etc/nftables.d/50_upnp_client.nft
}
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
vlc_chromecast() {
depends="$pkgname $pkgname-chromecast"
description="Enables networking for VLC Chromecast casting"
main/postmarketos-config-nftables: use versioned constraints in install_if (MR 3536) Consistently use `install_if="$pkgname=$pkgver-r$pkgrel ...` everywhere, this is recommended upstream. See https://wiki.alpinelinux.org/wiki/APKBUILD_Reference#install_if
2022-10-16 05:15:59 +00:00
install_if="$pkgname=$pkgver-r$pkgrel vlc"
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
amove etc/nftables.d/50_vlc_chromecast.nft
}
main/postmarketos-config-nftables: subpackage vncserver (MR 2479) Co-authored-by: clayton craft <clayton@craftyguy.net>
2021-09-01 04:53:27 +00:00
vncserver() {
depends="$pkgname"
description="Enables networking for VNC Server"
amove etc/nftables.d/50_vncserver.nft
}
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
networkmanager() {
depends="$pkgname"
description="Enables nftables backend in NetworkManager"
main/postmarketos-config-nftables: use versioned constraints in install_if (MR 3536) Consistently use `install_if="$pkgname=$pkgver-r$pkgrel ...` everywhere, this is recommended upstream. See https://wiki.alpinelinux.org/wiki/APKBUILD_Reference#install_if
2022-10-16 05:15:59 +00:00
install_if="$pkgname=$pkgver-r$pkgrel networkmanager"
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
install -Dm644 "$srcdir"/networkmanager.conf \
"$subpkgdir"/etc/NetworkManager/conf.d/nftables.conf
}
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
sha512sums="
166d77bcccc85a3db24af85010d07241cf193bccd79064863fbf9da7be4426364e9f9a9e0668c2c8018ada470d0fda30fe8eba24d24a2d4150af1d78af31b9b7 00_log_all.nft
10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf 01_wwan.nft
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
d5a7c7fc47924acfafee42d731e6a0109d83af6278053128deecbf3cf40e37447cb649360ee9ebddd2a5ea276888314b63ce7ef828708b5bf7dd1bface7fbc62 10_dhcp.nft
main/postmarketos-config-nftables: 50_*.nft: drop unused wwan rules (MR 3594) There is "iifname "wwan*" drop" defined in 01_wwan.nft, which drops any not "established, related" incoming packet from WWAN. [ci:skip-build]: already built successfully in CI
2022-10-28 00:41:32 +00:00
2d6ad24b1beede8c9df6d9fe9ac3338a90691c5a964e1aaa5d6e85b4a7db96e9303c26a595836b247a1e1c1ede6b40de120c2fdfb7ab7d30b33140c4b43ce206 50_mdns.nft
136a95d2f21d2935dcd85d4c40d597fbddffb31126dbcbc78f1b286454b7623cf16f6059dea6040d35e8f14d8ac79e292cc51bd6675afedc6953a6793315c786 50_ssh.nft
5779bbcc55e411ec4da58e4e7eaaa6918cdcea5b8818cd72ab93be2d1108f020861457dbd8079a60b0912f84d05eb7b42274cc9a0577f66e8322f3596b89b411 50_upnp_client.nft
main/postmarketos-config-nftables: add VLC chromecast rules (MR 3536)
2022-10-14 11:56:38 +00:00
9207bef8d2df8d728521aef19f3c6ccb5c645a0295617b54722a6867c86b29c13502a01747eb3c91602f416f60bdc2bfa18dfb4906e17494923996596b6b1444 50_vlc_chromecast.nft
main/postmarketos-config-nftables: 50_*.nft: drop unused wwan rules (MR 3594) There is "iifname "wwan*" drop" defined in 01_wwan.nft, which drops any not "established, related" incoming packet from WWAN. [ci:skip-build]: already built successfully in CI
2022-10-28 00:41:32 +00:00
c688e768c709ad17685641a6ba543f84e8466080356712073e06108fc1707109f590be45b8a0aca8d0d95171c5afe69887f71b78fe56444912dd0582a461f477 50_vncserver.nft
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
76ac156ee80f895ab4f574f70f4ee9f960dfd23a3381bbbf7c744bea919b98f69e91e2eaa10425dfeaf5dbe77b745ec1dd82cb94953835873baffd9e5d89e166 51_docker.nft
main/postmarketos-config-nftables: add mosh config (MR 2725) https://social.linux.pizza/@jan_wagemakers/107393948283025525 [ci:skip-build] already built successfully in CI
2021-12-05 20:25:43 +00:00
59d93d0006aadb6f699836895119cf49a2fbbc1159cad4ab98868610cd6796da7fe792e7c845df93303a4cfa77658e0687b6726a8b0bcf613563f1a33d5588ab 51_moshserver.nft
postmarketos-config-nftables: add forward rule to accept traffic on wlan (MR 2622) This seems to fix the last missing piece to getting the hotspot stuff working, at least when it's set up with networkmanager (I haven't tested other methods, but assume this rule is still needed there too...) fixes #1198
2021-10-22 06:33:30 +00:00
1ce70bb71c9008b6c727a2c26d11467be3b5a0cb9815a8bb0790150c7958457b22b110e35ba974973b9579d44bd14219985d85597c954b5fa8cf77bf206c959b 51_hotspot.nft
postmarketos-config-nftables: fix syntax errors and coding styles (MR 3535)
2022-10-13 20:08:54 +00:00
ea7d8a652808ba6ae92de6dfc9f7d57415e411a04db3a41d1480f254b3a3a574558dbee2e7259e5d527527a11ca3aace7bb9edc7e023b0f4f67afceefeeb9e88 51_usb_inet.nft
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
0e86974602622c03f0b34acd048e3a31157c0226ab4b5ec093a19696af3fc9637ed84cecf0d190941e4bd3afeb0c76a37245fa850abef46778cd1235ad8106df 60_usb.nft
1532899534d7432a7708620cf1053ab80635fffe038a2352eb890c35fba4247c3b9ab3d0b028da1be765e5feb9b5a5b3a8107f4aa79f790d17930d38535a2288 99_drop_log.nft
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
ea738469e68b8a8038f301b0cb901cd305445321ee24c4b4025365b4b95d5c61113a5bb24ab4efaa73eda23c2e06984d3e58395584fcb8887cf1595ea99542da networkmanager.conf
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
"
Reference in a new issue Copy permalink