For installing openrc-specific dependencies, specifically
nftables-openrc which is needed because the post-install enables the
openrc service and expects the initd script to be available then
[ci:skip-build] already built successfully in CI
The port 7236 for TCP is registered with IANA by the
Wi-Fi Alliance for use for the Wi-Fi Display Protocol,
a.k.a. Miracast.
To establish the connection, the local DHCP server has to
be allowed to respond to requests on peer-to-peer Wi-Fi
networks.
Signed-off-by: Markus Göllnitz <camelcasenick@bewares.it>
[ci:skip-build]: already built successfully in CI
1. Move all configs from /etc/NetworkManager/conf.d to
/usr/lib/NetworkManager/conf.d since the latter is more appropriate for
distribution-provided config files. In particular this means apk will
update them when the package file is changed rather than creating
`.apk-new` files. If a user wants to override such a file, they can create
a file with the same name under /etc/NetworkManager/conf.d
2. Move all dispatcher scripts from /etc/NetworkManager/dispatcher.d to
/usr/lib/NetworkManager/dispatcher.d for the same reason.
3. Rename all configs to have a "50-" prefix so that users can add their own
"99-" overrides with a guarantee that they'll be processed after
distribution-provided configs.
4. Rename dispatcher scripts to have a "50-" prefix instead of "85-" and "99-"
since they're distribution-provided files.
5. Move 50-tethering.conf from the base-ui package to
the base-ui-networkmanager package.
There are also some device packages that put config files without a numeric
prefix in /etc/NetworkManager/conf.d . This MR doesn't change those.
[ci:skip-build] already built successfully in CI
mDNS queries and replies are sent to port 5353.
Update firewall rule in order to make it as tight as possible.
[ci:skip-build]: already built successfully in CI
There is "iifname "wwan*" drop" defined in 01_wwan.nft, which drops
any not "established, related" incoming packet from WWAN.
[ci:skip-build]: already built successfully in CI
Prepare to drop anbox from pmaports in favor of waydroid. For waydroid,
there's an nftables rule packaged as waydroid-nftables subpackage of the
waydroid package in Alpine (see pmaports issue 1280).
This seems to fix the last missing piece to getting the hotspot stuff
working, at least when it's set up with networkmanager (I haven't tested
other methods, but assume this rule is still needed there too...)
fixes#1198
This fixes DNS when a system is connected to a pmOS device as a hotspot.
The rule is in the default set of firewall rules, instead of a
subpackage.. I think this is OK. I don't believe anything should be
listening on port 53 except when the hotspot is running...
The networkmanager hotspot needs to have DHCP input enabled on the wifi
interfaces so the temporary dnsmasq instance can work. The
networkmanager backend is also switched to the nftables one so it can
create the ad-hoc hotspot forwarding/masquerade table.
This rule is installed by default, since users that need usb inet won't
have an easy way to install a subpackage.
This is meant to facilitate:
https://wiki.postmarketos.org/wiki/USB_Internet
The old rule would result in nftables failing to load if the iface
doesn't exist. Using `iifname` will match on any future ifaces if they
don't exist when the firewall starts.
Anbox needs a specific set of nftables rules to allow incoming and
outgoing traffic. Anbox makes it easy to allow the specific traffic due
to the established `anbox0` bridge network interface.
Installs nftables config useful for pmOS::
1) drop all connections to wwan* (wildcard matching supported, are there
any other wwan iface names that wouldn't match this?)
2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but
doesn't hurt..), allow DHCP on usb*
3) allow all incoming connections on usb* (with the -openusb subpackage)
4) enable logging all nftable events (with the -log subpackage), very
useful for debugging
fixes#1024
