Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-11-28 18:40:20 -05:00
Code Issues Projects Releases Packages Wiki Activity

nftables: replace magic numbers with constants

Browse source
This commit is contained in:
Daniel Micay 2025-09-15 16:48:51 -04:00
parent 8bf64de00d
commit 5f1b0c886d
1 changed files with 29 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

53
etc/nftables/nftables-releases.conf
View file

@ -13,32 +13,37 @@ table inet filter {
2a14:3f87:6920:250::100, # 0.releases.grapheneos.org 2a14:3f87:6920:250::100, # 0.releases.grapheneos.org
} }
define priority-besteffort = 0
define priority-bulk = 2
define priority-interactive-bulk = 4
define priority-interactive = 6
# based on CAKE diffserv4 # based on CAKE diffserv4
map dscp-to-priority { map dscp-to-priority {
typeof ip dscp : meta priority typeof ip dscp : meta priority
elements = { elements = {
cs1 : 2, cs1 : $priority-bulk,
lephb : 2, lephb : $priority-bulk,
af11 : 0, af11 : $priority-besteffort,
af12 : 0, af12 : $priority-besteffort,
af13 : 0, af13 : $priority-besteffort,
cs2 : 4, cs2 : $priority-interactive-bulk,
cs3 : 4, cs3 : $priority-interactive-bulk,
cs4 : 4, cs4 : $priority-interactive-bulk,
af21 : 4, af21 : $priority-interactive-bulk,
af22 : 4, af22 : $priority-interactive-bulk,
af23 : 4, af23 : $priority-interactive-bulk,
af31 : 4, af31 : $priority-interactive-bulk,
af32 : 4, af32 : $priority-interactive-bulk,
af33 : 4, af33 : $priority-interactive-bulk,
af41 : 4, af41 : $priority-interactive-bulk,
af42 : 4, af42 : $priority-interactive-bulk,
af43 : 4, af43 : $priority-interactive-bulk,
cs5 : 6, cs5 : $priority-interactive,
cs6 : 6, cs6 : $priority-interactive,
cs7 : 6, cs7 : $priority-interactive,
ef : 6, ef : $priority-interactive,
va : 6, va : $priority-interactive,
} }
} }
@ -88,8 +93,8 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
ip dscp set 0 ip dscp set cs0
ip6 dscp set 0 ip6 dscp set cs0
tcp dport { 22, 80, 443 } goto input-tcp-service tcp dport { 22, 80, 443 } goto input-tcp-service
ct state vmap { invalid : drop, established : accept, related : accept, new : drop, untracked: accept } ct state vmap { invalid : drop, established : accept, related : accept, new : drop, untracked: accept }