postmarketos-config-nftables: add package for configuring nftables fw (MR 2060)

Installs nftables config useful for pmOS::

1) drop all connections to wwan* (wildcard matching supported, are there
   any other wwan iface names that wouldn't match this?)

2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but
   doesn't hurt..), allow DHCP on usb*

3) allow all incoming connections on usb* (with the -openusb subpackage)

4) enable logging all nftable events (with the -log subpackage), very
   useful for debugging

fixes #1024

main/postmarketos-config-nftables/APKBUILD

@@ -0,0 +1,51 @@
+# Maintainer: Clayton Craft <clayton@craftyguy.net>
+pkgname=postmarketos-config-nftables
+pkgver=0.1
+pkgrel=0
+pkgdesc="nftables firewall configuration for postmarketOS"
+url="https://gitlab.com/postmarketos"
+arch="noarch"
+license="MIT"
+depends="nftables-openrc"
+subpackages="$pkgname-openusb:openusb $pkgname-log:log"
+source="
+	rules/00_log_all.nft
+	rules/01_wwan.nft
+	rules/10_dhcp.nft
+	rules/50_ssh.nft
+	rules/60_usb.nft
+	rules/99_drop_log.nft
+"
+options="!check" # No tests
+install="$pkgname.post-install"
+
+package() {
+	cd rules
+	for _i in ./*; do
+		install -Dm644 "$_i" "$pkgdir"/etc/nftables.d/"$_i"
+	done
+}
+
+openusb() {
+	depends="$pkgname"
+	description="Adds a rule to accept all incoming connections to the usb* interface"
+
+	amove etc/nftables.d/60_usb.nft
+}
+
+log() {
+	depends="$pkgname"
+	description="Enables logging of nftable events"
+
+	amove etc/nftables.d/00_log_all.nft
+	amove etc/nftables.d/99_drop_log.nft
+}
+
+sha512sums="
+166d77bcccc85a3db24af85010d07241cf193bccd79064863fbf9da7be4426364e9f9a9e0668c2c8018ada470d0fda30fe8eba24d24a2d4150af1d78af31b9b7  00_log_all.nft
+10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf  01_wwan.nft
+03ea8b54210e5c5627cfe26d50bc98355951ea81b9aa1a46dc4093b15b47b224ba1b2a95c5add65639478e47ca6e9d6f4ce4053a94622e832dc065f66d1fd6c8  10_dhcp.nft
+6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7  50_ssh.nft
+0e86974602622c03f0b34acd048e3a31157c0226ab4b5ec093a19696af3fc9637ed84cecf0d190941e4bd3afeb0c76a37245fa850abef46778cd1235ad8106df  60_usb.nft
+1532899534d7432a7708620cf1053ab80635fffe038a2352eb890c35fba4247c3b9ab3d0b028da1be765e5feb9b5a5b3a8107f4aa79f790d17930d38535a2288  99_drop_log.nft
+"

main/postmarketos-config-nftables/postmarketos-config-nftables.post-install

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+rc-update add nftables default

main/postmarketos-config-nftables/rules/00_log_all.nft

@@ -0,0 +1,9 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		log
+
+	}
+}

main/postmarketos-config-nftables/rules/01_wwan.nft

@@ -0,0 +1,10 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		# drop all incoming connections on wwan
+		iifname "wwan*" drop comment "drop all connections on wwan"
+
+	}
+}

main/postmarketos-config-nftables/rules/10_dhcp.nft

@@ -0,0 +1,10 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		# Allow DHCP server on usb*
+		iifname "usb*" udp dport bootps accept comment "accept incoming DHCP on usb*"
+
+	}
+}

main/postmarketos-config-nftables/rules/50_ssh.nft

@@ -0,0 +1,13 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		# drop ssh from wwan
+		iifname "wwan*" tcp dport 22 drop comment "drop SSH from wwan"
+
+		# allow ssh
+		tcp dport 22 accept comment "accept SSH"
+
+	}
+}

main/postmarketos-config-nftables/rules/60_usb.nft

@@ -0,0 +1,13 @@
+#!/usr/sbin/nft -f
+
+# Allow all traffic from usb-ethernet interfaces for debugging
+# and porting.
+
+table inet filter {
+	chain input {
+
+		# allow all from USB net
+		iifname "usb*" accept comment "accept USB net"
+
+	}
+}

main/postmarketos-config-nftables/rules/99_drop_log.nft

@@ -0,0 +1,9 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		log prefix "DROP:  " flags all drop
+
+	}
+}