mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 18:07:06 +01:00
Krzysztof kuhy Rudnicki
4f2b0ccdf7
Two levels of pure taxonomy carrying no information, and a 2-directory
cap leaves no room for them. Categories now sit directly under
linux_configuration/: features, fixes, utils, misc, fresh-install,
installers, diagnostics, gaming, boot_recovery, periodic_background, lib,
meta, tests. A script's own lib/ and tests/ are exempt from the cap, so
those stay put.
Depth violations 248 -> 139; roughly 40 of the remainder are inside
digital_wellbeing and hosts, deferred until the guard-lib repoint.
The moves are the easy half. What breaks is every path that counted
levels, and three classes of it had to be found by resolving paths rather
than reading diffs:
- 52 relative `source` lines for lib/common.sh and lib/android.sh. The
correct prefix differs per file: 40 were ../../ and 12 were ../../../,
so a blanket replace would have fixed one set and broken the other.
- REPO_ROOT in 7 fixes/lib/tests harnesses and setup_syncyomi_guard.sh,
each walking up four levels from a directory now two levels shallower.
This caused a real regression -- the fixes suite went red with
"log_warn: command not found" -- caught by running it and comparing
against the pre-move baseline worktree.
- conftest.py's sys.path entries, which took the pytest gate down with
14 collection errors, and the `# shellcheck source=` directives, which
took shellcheck down with SC1091.
16 symlinks in $HOME broke, including the entire i3blocks bar. All
repointed, and cpu_monitor/memory/disk/time/volume were run to confirm
they emit real output rather than merely resolving.
Verified: 1798 tests pass at 100% coverage, 8 of 9 lib/tests suites pass
(the ninth needs the coverage jail, identically at baseline), pre-commit
is clean, and the two untracked secret configs are still ignored after
their gitignore paths changed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
75 lines
2.6 KiB
Bash
Executable File
75 lines
2.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# nftables ruleset, its verification and sshd hardening.
|
|
#
|
|
# Sourced by setup_wireguard_ssh.sh; split out to keep wg_keys.sh under the
|
|
# 250-line cap. Sourced rather than run, so it inherits the caller's
|
|
# strict mode and the variables defined above the source line.
|
|
|
|
write_nftables_ruleset() {
|
|
detect_lan_subnet
|
|
if [[ -f $NFT_CONF ]]; then
|
|
cp "$NFT_CONF" "${NFT_CONF}.bak.$(date +%s)"
|
|
log_warn "Backed up existing ${NFT_CONF} before overwriting."
|
|
fi
|
|
local web_rule=""
|
|
if [[ $ALLOW_WEB == "true" ]]; then
|
|
web_rule=$'\n\t\ttcp dport { 80, 443 } accept'
|
|
fi
|
|
# DNS blocker (setup_dns_blocker.sh): serve DNS (53) -- and DHCP (67) when
|
|
# this PC is the LAN DHCP server -- to LAN clients only. Restricted to the
|
|
# LAN subnet so nothing is ever exposed to the internet.
|
|
local dns_rule="" dhcp_rule=""
|
|
if [[ $ALLOW_DNS == "true" ]]; then
|
|
dns_rule=$'\n\t\tip saddr '"${LAN_SUBNET}"$' udp dport 53 accept'
|
|
dns_rule+=$'\n\t\tip saddr '"${LAN_SUBNET}"$' tcp dport 53 accept'
|
|
# DHCP clients have no IP yet (saddr 0.0.0.0 -> 255.255.255.255) and the
|
|
# broadcast is classified INVALID by conntrack -- so this rule MUST sit
|
|
# BEFORE 'ct state invalid drop' and match the client source port, not a
|
|
# saddr. Link-local only: :67 broadcasts never route in from the internet.
|
|
dhcp_rule=$'\n\t\tudp sport 68 udp dport 67 accept'
|
|
fi
|
|
cat >"${NFT_CONF}.new" <<EOF
|
|
#!/usr/sbin/nft -f
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
iif "lo" accept
|
|
ct state established,related accept${dhcp_rule}
|
|
ct state invalid drop
|
|
|
|
icmp type { destination-unreachable, time-exceeded, parameter-problem, echo-request } accept
|
|
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-neighbor-solicit, nd-neighbor-advert, echo-request } accept
|
|
|
|
udp dport ${WG_PORT} accept
|
|
|
|
iifname "${WG_IFACE}" tcp dport 22 accept
|
|
ip saddr ${LAN_SUBNET} tcp dport 22 accept${web_rule}${dns_rule}
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
}
|
|
chain output {
|
|
type filter hook output priority 0; policy accept;
|
|
}
|
|
}
|
|
EOF
|
|
}
|
|
|
|
verify_nftables_then_apply() {
|
|
nft -c -f "${NFT_CONF}.new" || die "nftables ruleset failed syntax check -- not applying."
|
|
mv "${NFT_CONF}.new" "$NFT_CONF"
|
|
log_warn "Applying a default-drop firewall now."
|
|
nft -f "$NFT_CONF"
|
|
sleep 2
|
|
if ! is_service_active sshd; then
|
|
nft flush ruleset
|
|
die "sshd died after applying nftables -- rolled back. Investigate before retrying."
|
|
fi
|
|
log_ok "nftables applied; sshd is still active."
|
|
log_warn "Before closing this terminal, open a SECOND ssh session now and confirm it connects."
|
|
enable_service nftables
|
|
}
|