forge/pmaports
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

config-nftables: add rules for allowing usb inet access (MR 2274)

Browse source 
This rule is installed by default, since users that need usb inet won't
have an easy way to install a subpackage.

This is meant to facilitate:
https://wiki.postmarketos.org/wiki/USB_Internet
This commit is contained in:
Clayton Craft 2021-06-24 16:45:12 -07:00
parent 2a1b69db00
commit 931ae03648
No known key found for this signature in database
GPG key ID: 8642571587897EA1
2 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
main/postmarketos-config-nftables/APKBUILD
View file

@ -1,6 +1,6 @@
# Maintainer: Clayton Craft <clayton@craftyguy.net>
pkgname=postmarketos-config-nftables
pkgver=0.2
pkgver=0.3
pkgrel=0
pkgdesc="nftables firewall configuration for postmarketOS"
url="https://gitlab.com/postmarketos"
@ -14,6 +14,7 @@ source="
rules/10_dhcp.nft
rules/50_ssh.nft
rules/51_anbox.nft
rules/51_usb_inet.nft
rules/60_usb.nft
rules/99_drop_log.nft
"
@ -55,6 +56,7 @@ sha512sums="
03ea8b54210e5c5627cfe26d50bc98355951ea81b9aa1a46dc4093b15b47b224ba1b2a95c5add65639478e47ca6e9d6f4ce4053a94622e832dc065f66d1fd6c8 10_dhcp.nft
6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7 50_ssh.nft
8322a8a5a5b1e98e1f44e2091b8b3a06db1e8309ebba5b8b6abe9d6fbb009dffb248af55e631f06f01bbced98b23c205462de73cd354b116dbaa7b6c72746bfd 51_anbox.nft
bceb1a12a9de044daa3a4ba647b0d69b257881151a912fc350d6a00fdf0c0903b51fb58c56cfc73e9a75f529bac841d41d466e0f210b1f516e124e69cbfd1feb 51_usb_inet.nft
0e86974602622c03f0b34acd048e3a31157c0226ab4b5ec093a19696af3fc9637ed84cecf0d190941e4bd3afeb0c76a37245fa850abef46778cd1235ad8106df 60_usb.nft
1532899534d7432a7708620cf1053ab80635fffe038a2352eb890c35fba4247c3b9ab3d0b028da1be765e5feb9b5a5b3a8107f4aa79f790d17930d38535a2288 99_drop_log.nft
"

11
main/postmarketos-config-nftables/rules/51_usb_inet.nft Normal file
View file

@ -0,0 +1,11 @@
#!/usr/sbin/nft -f
table inet filter {
chain input {
iifname "usb*" accept comment "Allow incoming network traffic from USB"
}
chain forward {
iifname "usb*" accept comment "Allow outgoing network traffic from USB"
ct state {established, related} counter accept comment "accept established connections"
}
}