mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 15:34:06 +01:00
Krzysztof kuhy Rudnicki
ef892eb162
The focus system only ever filtered this phone's own traffic: /system/etc/hosts
via the system resolver, dns_enforcer and the curfew net layer via OUTPUT. A
tethered second phone's packets are FORWARDed + NAT'd through us on a path none
of that covers, so a second phone on the hotspot browses freely on our mobile
data and defeats focus mode.
Add tether_enforcer.sh: an always-on daemon that acts while focus mode is ON
(at home) or a force-test file is present, converging three levers each tick:
1. disable Android tether offload (settings global tether_offload_disabled=1,
snapshot/restore) so forwarded traffic goes through netfilter;
2. blanket REJECT of the FORWARD chain (iptables + ip6tables, FOCUS_TETHER_BLOCK
pinned at position 1), rebuilt only when tampered via a chain_intact gate so
it does not fork an `iptables -L` every second (that overheated the phone
during curfew-net tuning). Covers WiFi, USB and BT tethering;
3. best-effort `cmd wifi stop-softap` (Android 11+) so the hotspot visibly
flips off.
Reverts offload + tears down FORWARD on transition away from home / on SIGTERM.
Wiring: config.sh flags, focus_ctl.sh (tether-status/start/stop/log/test-on/off),
magisk_service.sh boot autostart, deploy.sh push/cp/restart. README section and
a working subprocess regression test (lib/tests/test_tether_enforcer.sh, 17/17).
Verified on-device (BL9000, Android 13): our REJECT jump sits ABOVE Android's
tetherctrl_FORWARD chain, tether_offload_disabled=1 took effect, and
`cmd wifi stop-softap` reports "Soft AP stopped successfully".
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q6i3cdhKBoUrKxy4rmx6hH
|
||
|---|---|---|
| .. | ||
| agent-automation-bootstrap.json | ||
| bucket-catch-2026-06-27.json | ||
| cloud-gallery-2026-07-12.json | ||
| cloud-gallery-coverage-lint-deploy-2026-07-12.json | ||
| code-tutor-2026-07-10.json | ||
| diet-guard-gatelock-migration-2026-06.json | ||
| diet-guard-meal-and-trigger-fix-2026-06-10.json | ||
| digital-wellbeing-bypass-hardening-2026-05.json | ||
| extract-dufs-cloud-repo-2026-07-12.json | ||
| extract-inline-python-2026-06-06.json | ||
| file-length-split-2026-06-14.json | ||
| guard-lib-migration-2026-07-04.json | ||
| import-media-archives-2026-07-12.json | ||
| keepass-multidevice-sync-2026-07-12.json | ||
| linux-config-cleanup-2026-05.json | ||
| linux-config-polling-hardening-2026-05-14.json | ||
| linux-config-runtime-hardening-2026-05-08.json | ||
| linux-config-scripts-split-2026-05.json | ||
| media-cloud-sync-2026-07-12.json | ||
| morning-routine-unified-2026-05-25.json | ||
| pc-polling-runtime-validation-2026-05-10.json | ||
| phone-curfew-demo-net-stopgap-2026-06-13.json | ||
| phone-focus-cpu-hardening-2026-07-10.json | ||
| phone-focus-mode-fresh-install-2026-05-31.json | ||
| phone-focus-mode-netd-cache-fix-2026-05.json | ||
| phone-night-curfew-2026-06-13.json | ||
| protondb-gold-silver-fix.json | ||
| pylint10-r0801-schema-validation-2026-06.json | ||
| root-cleanup-2026-05-14.json | ||
| run-sh-wrapper-smoke.json | ||
| screen-locker-scheduled-skip-2026-05.json | ||
| screen-locker-sick-tracker-2026-05-14.json | ||
| screen-locker-weekly-check-2026-05-28.json | ||
| shutdown-override-i3blocks-sync-2026-07-10.json | ||
| stats-hltb-fixes-2026-05-28.json | ||
| steam-backlog-cache-refetch-reduction-2026-05-08.json | ||
| steam-backlog-finished-only-next-pick-2026-05.json | ||
| steam-backlog-module-split-2026-05.json | ||
| steam-backlog-protected-ids-2026-05-14.json | ||
| steam-backlog-whitelist-hardening-2026-05.json | ||
| steam-library-hide-fix-2026-05-17.json | ||
| sync-tests-fix-coverage-2026-05.json | ||
| template.json | ||
| tether-enforcer-hotspot-bypass-2026-07-13.json | ||
| usage-report-hz-cpu-fix-20260604.json | ||
| vendor-agent-skills-import.json | ||
| wake-alarm-gatelock-migration-2026-06-22.json | ||
| wake-alarm-hibernate-2026-05.json | ||
| wake-alarm-loudness-typeable-2026-05.json | ||
| wake-alarm-plug-fans-warnings-2026-05.json | ||
| wake-alarm-refactor-2026-05-30.json | ||
| wake-alarm-restore-display-test-gap-2026-06-22.json | ||