From 7cb5f1d3e45bf5fdd51c7789cf2c08e7be4ceda1 Mon Sep 17 00:00:00 2001 From: Hugo Osvaldo Barrera Date: Mon, 1 Sep 2025 18:08:30 +0200 Subject: [PATCH] main/postmarketos-config-nftables: rely on upstream nftrules Upstream is now shipping rules as individual subpackages for packages which require them. Rely on these by linking to them instead of duplicating them here. Note that the upstream packages only ship rules, but do not enable them by default. This patch retains this package's current behaviour and still automatically enables rules. See: https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/67137 See: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/3934 Part-of: --- main/postmarketos-config-nftables/APKBUILD | 14 +++++++------- main/postmarketos-config-nftables/rules/50_ssh.nft | 8 -------- .../rules/51_moshserver.nft | 10 ---------- 3 files changed, 7 insertions(+), 25 deletions(-) delete mode 100644 main/postmarketos-config-nftables/rules/50_ssh.nft delete mode 100644 main/postmarketos-config-nftables/rules/51_moshserver.nft diff --git a/main/postmarketos-config-nftables/APKBUILD b/main/postmarketos-config-nftables/APKBUILD index 6c8812f1b..9d0087bba 100644 --- a/main/postmarketos-config-nftables/APKBUILD +++ b/main/postmarketos-config-nftables/APKBUILD @@ -1,11 +1,12 @@ # Maintainer: Clayton Craft pkgname=postmarketos-config-nftables pkgver=0.16 -pkgrel=2 +pkgrel=3 pkgdesc="nftables firewall configuration for postmarketOS" url="https://gitlab.com/postmarketos" arch="noarch" license="MIT" +depends="openssh-nftrules" subpackages=" $pkgname-openusb:openusb $pkgname-log:log @@ -24,12 +25,10 @@ source=" rules/01_wwan.nft rules/10_dhcp.nft rules/50_mdns.nft - rules/50_ssh.nft rules/50_upnp_client.nft rules/50_vlc_chromecast.nft rules/50_vncserver.nft rules/51_docker.nft - rules/51_moshserver.nft rules/51_hotspot.nft rules/51_usb_inet.nft rules/51_wifi_display.nft @@ -44,6 +43,9 @@ package() { for _i in ./*; do install -Dm644 "$_i" "$pkgdir"/etc/nftables.d/"$_i" done + + ln -s ../../usr/share/nftables.avail/50_sshd.nft "$pkgdir/etc/nftables.d/50_sshd.nft" + ln -s ../../usr/share/nftables.avail/50_mosh.nft "$pkgdir/etc/nftables.d/50_mosh.nft" } openusb() { @@ -86,11 +88,11 @@ mdns() { } moshserver() { - depends="$pkgname" + depends="$pkgname mosh-nftrules" description="Enables networking for mosh server" install_if="$pkgname=$pkgver-r$pkgrel mosh-server" - amove etc/nftables.d/51_moshserver.nft + amove etc/nftables.d/50_mosh.nft } upnp_client() { @@ -137,12 +139,10 @@ sha512sums=" 10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf 01_wwan.nft ae6a8ac03d4643004f5ce9279083bc12a215ceb2ee66993a26ab5620bb1aab347541eb1729b38cc7ec9d232de07e0176bc59475669741dfa2588c9e1ec4a4958 10_dhcp.nft 597bf66783379691962f4b87a29e6219d5f87ef17d49b261c7b1eebe54561deafce4be77de3b39252c10b7b4452ac5b55870dd30605d7d0f074d27b06d1dfa6d 50_mdns.nft -136a95d2f21d2935dcd85d4c40d597fbddffb31126dbcbc78f1b286454b7623cf16f6059dea6040d35e8f14d8ac79e292cc51bd6675afedc6953a6793315c786 50_ssh.nft 5779bbcc55e411ec4da58e4e7eaaa6918cdcea5b8818cd72ab93be2d1108f020861457dbd8079a60b0912f84d05eb7b42274cc9a0577f66e8322f3596b89b411 50_upnp_client.nft 9207bef8d2df8d728521aef19f3c6ccb5c645a0295617b54722a6867c86b29c13502a01747eb3c91602f416f60bdc2bfa18dfb4906e17494923996596b6b1444 50_vlc_chromecast.nft c688e768c709ad17685641a6ba543f84e8466080356712073e06108fc1707109f590be45b8a0aca8d0d95171c5afe69887f71b78fe56444912dd0582a461f477 50_vncserver.nft 76ac156ee80f895ab4f574f70f4ee9f960dfd23a3381bbbf7c744bea919b98f69e91e2eaa10425dfeaf5dbe77b745ec1dd82cb94953835873baffd9e5d89e166 51_docker.nft -59d93d0006aadb6f699836895119cf49a2fbbc1159cad4ab98868610cd6796da7fe792e7c845df93303a4cfa77658e0687b6726a8b0bcf613563f1a33d5588ab 51_moshserver.nft 1ce70bb71c9008b6c727a2c26d11467be3b5a0cb9815a8bb0790150c7958457b22b110e35ba974973b9579d44bd14219985d85597c954b5fa8cf77bf206c959b 51_hotspot.nft ea7d8a652808ba6ae92de6dfc9f7d57415e411a04db3a41d1480f254b3a3a574558dbee2e7259e5d527527a11ca3aace7bb9edc7e023b0f4f67afceefeeb9e88 51_usb_inet.nft c243534219eca3ea31504eef9ea88f8c2e00f2340e9dec3d381459a84a09a7390c8327eac43ae38155f6d7a059327cb26be63451a1ba280664fc1da81b27f7be 51_wifi_display.nft diff --git a/main/postmarketos-config-nftables/rules/50_ssh.nft b/main/postmarketos-config-nftables/rules/50_ssh.nft deleted file mode 100644 index 5ff510ffc..000000000 --- a/main/postmarketos-config-nftables/rules/50_ssh.nft +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/sbin/nft -f - -table inet filter { - chain input { - # allow ssh - tcp dport 22 accept comment "accept SSH" - } -} diff --git a/main/postmarketos-config-nftables/rules/51_moshserver.nft b/main/postmarketos-config-nftables/rules/51_moshserver.nft deleted file mode 100644 index 8c98c3758..000000000 --- a/main/postmarketos-config-nftables/rules/51_moshserver.nft +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/sbin/nft -f - -table inet filter { - chain input { - - # allow mosh - udp dport 60000-60010 accept comment "accept mosh" - - } -}