From 99ba7a6565259fd9170c70586ea367fbd868e704 Mon Sep 17 00:00:00 2001
From: Willem Melching <willem.melching@gmail.com>
Date: Mon, 7 Feb 2022 18:54:58 +0100
Subject: [PATCH] iptables: block incoming wwan0 traffic (#45)

---
 Dockerfile.agnos                |  3 +++
 userspace/base_setup.sh         |  1 +
 userspace/etc/iptables/rules.v4 | 38 +++++++++++++++++++++++++++++++++
 3 files changed, 42 insertions(+)
 create mode 100644 userspace/etc/iptables/rules.v4

diff --git a/Dockerfile.agnos b/Dockerfile.agnos
index 0019cdd..8b597fe 100644
--- a/Dockerfile.agnos
+++ b/Dockerfile.agnos
@@ -169,6 +169,9 @@ COPY ./userspace/files/disable_bootkick.py /lib/systemd/system-shutdown/
 # Remove qt network bearer plugins
 RUN rm -rf /usr/lib/aarch64-linux-gnu/qt5/plugins/bearer
 
+# Add iptable rules to block incoming traffic on wwan0
+COPY ./userspace/etc/iptables/rules.v4 /etc/iptables/rules.v4
+
 # HACK: get newer version of ModemManager and libqmi from 21.04
 # ModemManager 1.12.8 suffers from a bug with reconnecting: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/242
 # libqmi 1.24.8 segfaults when power cycling the modem: https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/37
diff --git a/userspace/base_setup.sh b/userspace/base_setup.sh
index 3da2b62..d65c924 100755
--- a/userspace/base_setup.sh
+++ b/userspace/base_setup.sh
@@ -64,6 +64,7 @@ apt-get install --no-install-recommends -yq \
     i2c-tools \
     ifmetric \
     ifupdown \
+    iptables-persistent \
     jq \
     landscape-common \
     libi2c-dev \
diff --git a/userspace/etc/iptables/rules.v4 b/userspace/etc/iptables/rules.v4
new file mode 100644
index 0000000..f429ee7
--- /dev/null
+++ b/userspace/etc/iptables/rules.v4
@@ -0,0 +1,38 @@
+# Generated by iptables-save v1.8.4 on Mon Feb  7 10:32:25 2022
+*security
+:INPUT ACCEPT [1423:898759]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [1107:236517]
+COMMIT
+# Completed on Mon Feb  7 10:32:25 2022
+# Generated by iptables-save v1.8.4 on Mon Feb  7 10:32:25 2022
+*raw
+:PREROUTING ACCEPT [1428:899551]
+:OUTPUT ACCEPT [1107:236517]
+COMMIT
+# Completed on Mon Feb  7 10:32:25 2022
+# Generated by iptables-save v1.8.4 on Mon Feb  7 10:32:25 2022
+*nat
+:PREROUTING ACCEPT [23:4024]
+:INPUT ACCEPT [18:3232]
+:OUTPUT ACCEPT [105:7766]
+:POSTROUTING ACCEPT [105:7766]
+COMMIT
+# Completed on Mon Feb  7 10:32:25 2022
+# Generated by iptables-save v1.8.4 on Mon Feb  7 10:32:25 2022
+*mangle
+:PREROUTING ACCEPT [1428:899551]
+:INPUT ACCEPT [1425:898847]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [1107:236517]
+:POSTROUTING ACCEPT [1107:236517]
+COMMIT
+# Completed on Mon Feb  7 10:32:25 2022
+# Generated by iptables-save v1.8.4 on Mon Feb  7 10:32:25 2022
+*filter
+:INPUT ACCEPT [947:820457]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [664:78649]
+-A INPUT -i wwan0 -j DROP
+COMMIT
+# Completed on Mon Feb  7 10:32:25 2022