forge/pmaports
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

main/postmarketos-config-nftables: 50_*.nft: drop unused wwan rules (MR 3594)

Browse source 
There is "iifname "wwan*" drop" defined in 01_wwan.nft, which drops
any not "established, related" incoming packet from WWAN.

[ci:skip-build]: already built successfully in CI
This commit is contained in:
Raymond Hackley 2022-10-28 00:41:32 +00:00 committed by Oliver Smith
parent 259e8cc44f
commit db00e85baf
No known key found for this signature in database
GPG key ID: 5AE7F5513E0885CB
5 changed files with 6 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
main/postmarketos-config-nftables/APKBUILD
View file

@ -1,7 +1,7 @@
# Maintainer: Clayton Craft <clayton@craftyguy.net>
pkgname=postmarketos-config-nftables
pkgver=0.12
pkgrel=1
pkgver=0.13
pkgrel=0
pkgdesc="nftables firewall configuration for postmarketOS"
url="https://gitlab.com/postmarketos"
arch="noarch"
@ -129,11 +129,11 @@ sha512sums="
166d77bcccc85a3db24af85010d07241cf193bccd79064863fbf9da7be4426364e9f9a9e0668c2c8018ada470d0fda30fe8eba24d24a2d4150af1d78af31b9b7 00_log_all.nft
10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf 01_wwan.nft
d5a7c7fc47924acfafee42d731e6a0109d83af6278053128deecbf3cf40e37447cb649360ee9ebddd2a5ea276888314b63ce7ef828708b5bf7dd1bface7fbc62 10_dhcp.nft
8baf7562ff4c04a9733d71db2987292b4c3d6b2a2f8dcd65d2c0521323a0b92eaf137e3f0311c5547e99a13b42069c50867058897e75a430975a2d5184c7d18f 50_mdns.nft
6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7 50_ssh.nft
19f3b7887ed4754d7b0fe9cd1fce9369338520e0598004a0c56ac46c73bc2f721b1bb551689f9b614de6891ca99833ce4586b51a0903c2d00df278c902d11ffa 50_upnp_client.nft
2d6ad24b1beede8c9df6d9fe9ac3338a90691c5a964e1aaa5d6e85b4a7db96e9303c26a595836b247a1e1c1ede6b40de120c2fdfb7ab7d30b33140c4b43ce206 50_mdns.nft
136a95d2f21d2935dcd85d4c40d597fbddffb31126dbcbc78f1b286454b7623cf16f6059dea6040d35e8f14d8ac79e292cc51bd6675afedc6953a6793315c786 50_ssh.nft
5779bbcc55e411ec4da58e4e7eaaa6918cdcea5b8818cd72ab93be2d1108f020861457dbd8079a60b0912f84d05eb7b42274cc9a0577f66e8322f3596b89b411 50_upnp_client.nft
9207bef8d2df8d728521aef19f3c6ccb5c645a0295617b54722a6867c86b29c13502a01747eb3c91602f416f60bdc2bfa18dfb4906e17494923996596b6b1444 50_vlc_chromecast.nft
528d474a19bb9dd9f88213d75a0cc2521f6393ba8762a1aed4f79a49ba75a551047b83950f9effa5d6c928952b88f6c642a087ce4d9696457967a86f52ae5632 50_vncserver.nft
c688e768c709ad17685641a6ba543f84e8466080356712073e06108fc1707109f590be45b8a0aca8d0d95171c5afe69887f71b78fe56444912dd0582a461f477 50_vncserver.nft
76ac156ee80f895ab4f574f70f4ee9f960dfd23a3381bbbf7c744bea919b98f69e91e2eaa10425dfeaf5dbe77b745ec1dd82cb94953835873baffd9e5d89e166 51_docker.nft
59d93d0006aadb6f699836895119cf49a2fbbc1159cad4ab98868610cd6796da7fe792e7c845df93303a4cfa77658e0687b6726a8b0bcf613563f1a33d5588ab 51_moshserver.nft
1ce70bb71c9008b6c727a2c26d11467be3b5a0cb9815a8bb0790150c7958457b22b110e35ba974973b9579d44bd14219985d85597c954b5fa8cf77bf206c959b 51_hotspot.nft

1
main/postmarketos-config-nftables/rules/50_mdns.nft
View file

@ -2,7 +2,6 @@
table inet filter {
chain input {
iifname "wwan*" udp sport 5353 drop comment "drop mDNS replies from wwan"
udp sport 5353 accept comment "accept mDNS replies"
}
}

5
main/postmarketos-config-nftables/rules/50_ssh.nft
View file

@ -2,12 +2,7 @@
table inet filter {
chain input {
# drop ssh from wwan
iifname "wwan*" tcp dport 22 drop comment "drop SSH from wwan"
# allow ssh
tcp dport 22 accept comment "accept SSH"
}
}

1
main/postmarketos-config-nftables/rules/50_upnp_client.nft
View file

@ -2,7 +2,6 @@
table inet filter {
chain input {
iifname "wwan*" udp sport 1900 drop comment "drop SSDP/UPnP replies from wwan"
udp sport 1900 accept comment "accept SSDP/UPnP replies"
}
}

1
main/postmarketos-config-nftables/rules/50_vncserver.nft
View file

@ -2,7 +2,6 @@
table inet filter {
chain input {
iifname "wwan*" tcp dport 5900 drop comment "drop VNC from wwan"
tcp dport 5900 accept comment "accept VNC"
}
}