From a772f7a5d4dc603d4bbdd63ec133da7718394bcf Mon Sep 17 00:00:00 2001 From: Clayton Craft Date: Thu, 25 Mar 2021 19:59:23 -0700 Subject: [PATCH] postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024 --- main/postmarketos-config-nftables/APKBUILD | 51 +++++++++++++++++++ .../postmarketos-config-nftables.post-install | 3 ++ .../rules/00_log_all.nft | 9 ++++ .../rules/01_wwan.nft | 10 ++++ .../rules/10_dhcp.nft | 10 ++++ .../rules/50_ssh.nft | 13 +++++ .../rules/60_usb.nft | 13 +++++ .../rules/99_drop_log.nft | 9 ++++ 8 files changed, 118 insertions(+) create mode 100644 main/postmarketos-config-nftables/APKBUILD create mode 100644 main/postmarketos-config-nftables/postmarketos-config-nftables.post-install create mode 100644 main/postmarketos-config-nftables/rules/00_log_all.nft create mode 100644 main/postmarketos-config-nftables/rules/01_wwan.nft create mode 100644 main/postmarketos-config-nftables/rules/10_dhcp.nft create mode 100644 main/postmarketos-config-nftables/rules/50_ssh.nft create mode 100644 main/postmarketos-config-nftables/rules/60_usb.nft create mode 100644 main/postmarketos-config-nftables/rules/99_drop_log.nft diff --git a/main/postmarketos-config-nftables/APKBUILD b/main/postmarketos-config-nftables/APKBUILD new file mode 100644 index 000000000..db8c303df --- /dev/null +++ b/main/postmarketos-config-nftables/APKBUILD @@ -0,0 +1,51 @@ +# Maintainer: Clayton Craft +pkgname=postmarketos-config-nftables +pkgver=0.1 +pkgrel=0 +pkgdesc="nftables firewall configuration for postmarketOS" +url="https://gitlab.com/postmarketos" +arch="noarch" +license="MIT" +depends="nftables-openrc" +subpackages="$pkgname-openusb:openusb $pkgname-log:log" +source=" + rules/00_log_all.nft + rules/01_wwan.nft + rules/10_dhcp.nft + rules/50_ssh.nft + rules/60_usb.nft + rules/99_drop_log.nft +" +options="!check" # No tests +install="$pkgname.post-install" + +package() { + cd rules + for _i in ./*; do + install -Dm644 "$_i" "$pkgdir"/etc/nftables.d/"$_i" + done +} + +openusb() { + depends="$pkgname" + description="Adds a rule to accept all incoming connections to the usb* interface" + + amove etc/nftables.d/60_usb.nft +} + +log() { + depends="$pkgname" + description="Enables logging of nftable events" + + amove etc/nftables.d/00_log_all.nft + amove etc/nftables.d/99_drop_log.nft +} + +sha512sums=" +166d77bcccc85a3db24af85010d07241cf193bccd79064863fbf9da7be4426364e9f9a9e0668c2c8018ada470d0fda30fe8eba24d24a2d4150af1d78af31b9b7 00_log_all.nft +10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf 01_wwan.nft +03ea8b54210e5c5627cfe26d50bc98355951ea81b9aa1a46dc4093b15b47b224ba1b2a95c5add65639478e47ca6e9d6f4ce4053a94622e832dc065f66d1fd6c8 10_dhcp.nft +6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7 50_ssh.nft +0e86974602622c03f0b34acd048e3a31157c0226ab4b5ec093a19696af3fc9637ed84cecf0d190941e4bd3afeb0c76a37245fa850abef46778cd1235ad8106df 60_usb.nft +1532899534d7432a7708620cf1053ab80635fffe038a2352eb890c35fba4247c3b9ab3d0b028da1be765e5feb9b5a5b3a8107f4aa79f790d17930d38535a2288 99_drop_log.nft +" diff --git a/main/postmarketos-config-nftables/postmarketos-config-nftables.post-install b/main/postmarketos-config-nftables/postmarketos-config-nftables.post-install new file mode 100644 index 000000000..9c6afeb4b --- /dev/null +++ b/main/postmarketos-config-nftables/postmarketos-config-nftables.post-install @@ -0,0 +1,3 @@ +#!/bin/sh + +rc-update add nftables default diff --git a/main/postmarketos-config-nftables/rules/00_log_all.nft b/main/postmarketos-config-nftables/rules/00_log_all.nft new file mode 100644 index 000000000..2bdf5ebf2 --- /dev/null +++ b/main/postmarketos-config-nftables/rules/00_log_all.nft @@ -0,0 +1,9 @@ +#!/usr/sbin/nft -f + +table inet filter { + chain input { + + log + + } +} diff --git a/main/postmarketos-config-nftables/rules/01_wwan.nft b/main/postmarketos-config-nftables/rules/01_wwan.nft new file mode 100644 index 000000000..9b9374482 --- /dev/null +++ b/main/postmarketos-config-nftables/rules/01_wwan.nft @@ -0,0 +1,10 @@ +#!/usr/sbin/nft -f + +table inet filter { + chain input { + + # drop all incoming connections on wwan + iifname "wwan*" drop comment "drop all connections on wwan" + + } +} diff --git a/main/postmarketos-config-nftables/rules/10_dhcp.nft b/main/postmarketos-config-nftables/rules/10_dhcp.nft new file mode 100644 index 000000000..5f7bf3469 --- /dev/null +++ b/main/postmarketos-config-nftables/rules/10_dhcp.nft @@ -0,0 +1,10 @@ +#!/usr/sbin/nft -f + +table inet filter { + chain input { + + # Allow DHCP server on usb* + iifname "usb*" udp dport bootps accept comment "accept incoming DHCP on usb*" + + } +} diff --git a/main/postmarketos-config-nftables/rules/50_ssh.nft b/main/postmarketos-config-nftables/rules/50_ssh.nft new file mode 100644 index 000000000..08fb9338f --- /dev/null +++ b/main/postmarketos-config-nftables/rules/50_ssh.nft @@ -0,0 +1,13 @@ +#!/usr/sbin/nft -f + +table inet filter { + chain input { + + # drop ssh from wwan + iifname "wwan*" tcp dport 22 drop comment "drop SSH from wwan" + + # allow ssh + tcp dport 22 accept comment "accept SSH" + + } +} diff --git a/main/postmarketos-config-nftables/rules/60_usb.nft b/main/postmarketos-config-nftables/rules/60_usb.nft new file mode 100644 index 000000000..f9779b8ee --- /dev/null +++ b/main/postmarketos-config-nftables/rules/60_usb.nft @@ -0,0 +1,13 @@ +#!/usr/sbin/nft -f + +# Allow all traffic from usb-ethernet interfaces for debugging +# and porting. + +table inet filter { + chain input { + + # allow all from USB net + iifname "usb*" accept comment "accept USB net" + + } +} diff --git a/main/postmarketos-config-nftables/rules/99_drop_log.nft b/main/postmarketos-config-nftables/rules/99_drop_log.nft new file mode 100644 index 000000000..7a8fe20f1 --- /dev/null +++ b/main/postmarketos-config-nftables/rules/99_drop_log.nft @@ -0,0 +1,9 @@ +#!/usr/sbin/nft -f + +table inet filter { + chain input { + + log prefix "DROP: " flags all drop + + } +}