From 1efe44bb361ef5f65896e872fb97ace986b283dd Mon Sep 17 00:00:00 2001
From: Raymond Hackley <raymondhackley@protonmail.com>
Date: Fri, 14 Oct 2022 11:56:38 +0000
Subject: [PATCH] main/postmarketos-config-nftables: add VLC chromecast rules
 (MR 3536)

---
 main/postmarketos-config-nftables/APKBUILD    | 35 +++++++++++++++++--
 .../rules/50_mdns.nft                         |  8 +++++
 .../rules/50_vlc_chromecast.nft               |  7 ++++
 3 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 main/postmarketos-config-nftables/rules/50_mdns.nft
 create mode 100644 main/postmarketos-config-nftables/rules/50_vlc_chromecast.nft

diff --git a/main/postmarketos-config-nftables/APKBUILD b/main/postmarketos-config-nftables/APKBUILD
index e248173fa..450caf23d 100644
--- a/main/postmarketos-config-nftables/APKBUILD
+++ b/main/postmarketos-config-nftables/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Clayton Craft <clayton@craftyguy.net>
 pkgname=postmarketos-config-nftables
-pkgver=0.11
-pkgrel=1
+pkgver=0.12
+pkgrel=0
 pkgdesc="nftables firewall configuration for postmarketOS"
 url="https://gitlab.com/postmarketos"
 arch="noarch"
@@ -10,18 +10,23 @@ depends="nftables-openrc"
 subpackages="
 	$pkgname-openusb:openusb
 	$pkgname-log:log
+	$pkgname-chromecast:chromecast
 	$pkgname-docker:docker
+	$pkgname-mdns:mdns
 	$pkgname-moshserver:moshserver
 	$pkgname-networkmanager:networkmanager
 	$pkgname-upnp-client:upnp_client
+	$pkgname-vlc-chromecast:vlc_chromecast
 	$pkgname-vncserver:vncserver
 "
 source="
 	rules/00_log_all.nft
 	rules/01_wwan.nft
 	rules/10_dhcp.nft
+	rules/50_mdns.nft
 	rules/50_ssh.nft
 	rules/50_upnp_client.nft
+	rules/50_vlc_chromecast.nft
 	rules/50_vncserver.nft
 	rules/51_docker.nft
 	rules/51_moshserver.nft
@@ -56,6 +61,15 @@ log() {
 	amove etc/nftables.d/99_drop_log.nft
 }
 
+chromecast() {
+	depends="$pkgname $pkgname-mdns"
+	description="Enables networking for Chromium Chromecast"
+	install_if="$pkgname chromium"
+
+	# meta package is empty
+	mkdir -p "$pkgdir"-chromecast
+}
+
 docker() {
 	depends="$pkgname"
 	description="Enables networking for Docker"
@@ -64,6 +78,13 @@ docker() {
 	amove etc/nftables.d/51_docker.nft
 }
 
+mdns() {
+	depends="$pkgname"
+	description="Enables networking for mDNS"
+
+	amove etc/nftables.d/50_mdns.nft
+}
+
 moshserver() {
 	depends="$pkgname"
 	description="Enables networking for mosh server"
@@ -80,6 +101,14 @@ upnp_client() {
 	amove etc/nftables.d/50_upnp_client.nft
 }
 
+vlc_chromecast() {
+	depends="$pkgname $pkgname-chromecast"
+	description="Enables networking for VLC Chromecast casting"
+	install_if="$pkgname vlc"
+
+	amove etc/nftables.d/50_vlc_chromecast.nft
+}
+
 vncserver() {
 	depends="$pkgname"
 	description="Enables networking for VNC Server"
@@ -100,8 +129,10 @@ sha512sums="
 166d77bcccc85a3db24af85010d07241cf193bccd79064863fbf9da7be4426364e9f9a9e0668c2c8018ada470d0fda30fe8eba24d24a2d4150af1d78af31b9b7  00_log_all.nft
 10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf  01_wwan.nft
 d5a7c7fc47924acfafee42d731e6a0109d83af6278053128deecbf3cf40e37447cb649360ee9ebddd2a5ea276888314b63ce7ef828708b5bf7dd1bface7fbc62  10_dhcp.nft
+8baf7562ff4c04a9733d71db2987292b4c3d6b2a2f8dcd65d2c0521323a0b92eaf137e3f0311c5547e99a13b42069c50867058897e75a430975a2d5184c7d18f  50_mdns.nft
 6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7  50_ssh.nft
 19f3b7887ed4754d7b0fe9cd1fce9369338520e0598004a0c56ac46c73bc2f721b1bb551689f9b614de6891ca99833ce4586b51a0903c2d00df278c902d11ffa  50_upnp_client.nft
+9207bef8d2df8d728521aef19f3c6ccb5c645a0295617b54722a6867c86b29c13502a01747eb3c91602f416f60bdc2bfa18dfb4906e17494923996596b6b1444  50_vlc_chromecast.nft
 528d474a19bb9dd9f88213d75a0cc2521f6393ba8762a1aed4f79a49ba75a551047b83950f9effa5d6c928952b88f6c642a087ce4d9696457967a86f52ae5632  50_vncserver.nft
 76ac156ee80f895ab4f574f70f4ee9f960dfd23a3381bbbf7c744bea919b98f69e91e2eaa10425dfeaf5dbe77b745ec1dd82cb94953835873baffd9e5d89e166  51_docker.nft
 59d93d0006aadb6f699836895119cf49a2fbbc1159cad4ab98868610cd6796da7fe792e7c845df93303a4cfa77658e0687b6726a8b0bcf613563f1a33d5588ab  51_moshserver.nft
diff --git a/main/postmarketos-config-nftables/rules/50_mdns.nft b/main/postmarketos-config-nftables/rules/50_mdns.nft
new file mode 100644
index 000000000..7ff9ab593
--- /dev/null
+++ b/main/postmarketos-config-nftables/rules/50_mdns.nft
@@ -0,0 +1,8 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		iifname "wwan*" udp sport 5353 drop comment "drop mDNS replies from wwan"
+		udp sport 5353 accept comment "accept mDNS replies"
+	}
+}
diff --git a/main/postmarketos-config-nftables/rules/50_vlc_chromecast.nft b/main/postmarketos-config-nftables/rules/50_vlc_chromecast.nft
new file mode 100644
index 000000000..a9db8b598
--- /dev/null
+++ b/main/postmarketos-config-nftables/rules/50_vlc_chromecast.nft
@@ -0,0 +1,7 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		tcp dport 8010 accept comment "accept VLC Chromecast"
+	}
+}