<commit_before>#!/bin/bash
#
# https://github.com/gavinhungry/combust
#

set -o pipefail

NFT=/usr/bin/nft
IP=/usr/bin/ip

declare -A IF
source /etc/combust.conf

ERRORS=0
for PARM in "$@"; do
  case $PARM in
    '-d'|'--dry-run') DRYRUN=1 ;&
    '-v'|'--verbose') VERBOSE=1 ;;
    '-f'|'--flush') FLUSH=1 ;;
  esac
done

# ---[ FUNCTIONS ]--------------------------------------------------------------
pref() {
  [ ${!1:-0} -eq 1 ] && return
}

msg() {
  pref VERBOSE && echo -e "\n\e[0;33;40m$@\e[0m"
}

finish() {
  pref DRYRUN && msg 'This was a dry run, no changes have been applied'
  exit $ERRORS
}

nftraw() {
  pref VERBOSE && echo "nft $@"

  if ! pref DRYRUN; then
    $NFT "$@" || let ERRORS++
  fi
}

nft() {
  FAMILY=$1; shift
  CMD=$1; shift
  SUBCMD=$1; shift

  nftraw "$CMD $SUBCMD $FAMILY $@"
}

nft4() {
  nft "ip" "$@"
}

nft6() {
  pref USE_IPV6 || return 0
  nft "ip6" "$@"
}

nft4chain() {
  nft4 add chain "$@"
}

nft6chain() {
  nft6 add chain "$@"
}

nftchain() {
  nft4chain "$@"
  nft6chain "$@"
}

nft4rule() {
  nft4 add rule "$@"
}

nft6rule() {
  nft6 add rule "$@"
}

nftrule() {
  nft4rule "$@"
  nft6rule "$@"
}

nftpolicy() {
  TABLE=$1
  CHAIN=$2
  POLICY=$3

  nft ip add rule $TABLE $CHAIN $POLICY

  pref USE_IPV6 || POLICY=drop
  nft ip6 add rule $TABLE $CHAIN $POLICY
}

_awksub_ip() {
  grep "\s${1}$" | awk '{sub(/\/.*/,"",$2); print $2}'
}

inet() {
  $IP -4 addr show $1 | grep '^\s*inet\s' | _awksub_ip $1
}

inet6() {
  $IP -6 addr show $1 | grep '^\s*inet6\s' | _awksub_ip $1
}

interfaces() {
  for I in ${IF[$1]}; do
    for IX in ${IF[$I]-$I}; do
      echo ${IF[$IX]-$IX}
    done
  done
}

# ---[ FLUSH ]------------------------------------------------------------------
msg 'Flushing existing rules'

nftraw flush ruleset

if pref FLUSH; then
  finish
fi

# input/output/forward chains on a filter table
nftraw -f /usr/share/nftables/ipv4-filter
nftraw -f /usr/share/nftables/ipv6-filter

if pref VPN_SERVER; then
  nftraw -f /usr/share/nftables/ipv4-nat
  nftraw -f /usr/share/nftables/ipv6-nat
fi

nftchain filter valid_src
nftchain filter valid_dst

# ---[ VALID ]------------------------------------------------------------------
msg 'External interface sources'
if [ -n "$IPV4_LAN" ]; then
  for RANGE in $IPV4_LAN; do
    nft4rule filter valid_src ip saddr $RANGE return
  done<commit_msg>Don't rely on external setup<commit_after>#!/bin/bash
#
# https://github.com/gavinhungry/combust
#

set -o pipefail

NFT=/usr/bin/nft
IP=/usr/bin/ip

declare -A IF
source /etc/combust.conf

ERRORS=0
for PARM in "$@"; do
  case $PARM in
    '-d'|'--dry-run') DRYRUN=1 ;&
    '-v'|'--verbose') VERBOSE=1 ;;
    '-f'|'--flush') FLUSH=1 ;;
  esac
done

# ---[ FUNCTIONS ]--------------------------------------------------------------
pref() {
  [ ${!1:-0} -eq 1 ] && return
}

msg() {
  pref VERBOSE && echo -e "\n\e[0;33;40m$@\e[0m"
}

finish() {
  pref DRYRUN && msg 'This was a dry run, no changes have been applied'
  exit $ERRORS
}

nftraw() {
  pref VERBOSE && echo "nft $@"

  if ! pref DRYRUN; then
    $NFT "$@" || let ERRORS++
  fi
}

nft() {
  FAMILY=$1; shift
  CMD=$1; shift
  SUBCMD=$1; shift

  nftraw "$CMD $SUBCMD $FAMILY $@"
}

nft4() {
  nft "ip" "$@"
}

nft6() {
  pref USE_IPV6 || return 0
  nft "ip6" "$@"
}

nft4table() {
  nft4 add table "$@"
}

nft6table() {
  nft6 add table "$@"
}

nfttable() {
  nft4table "$@"
  nft6table "$@"
}

nft4chain() {
  nft4 add chain "$@"
}

nft6chain() {
  nft6 add chain "$@"
}

nftchain() {
  nft4chain "$@"
  nft6chain "$@"
}

nft4rule() {
  nft4 add rule "$@"
}

nft6rule() {
  nft6 add rule "$@"
}

nftrule() {
  nft4rule "$@"
  nft6rule "$@"
}

nftpolicy() {
  TABLE=$1
  CHAIN=$2
  POLICY=$3

  nft ip add rule $TABLE $CHAIN $POLICY

  pref USE_IPV6 || POLICY=drop
  nft ip6 add rule $TABLE $CHAIN $POLICY
}

_awksub_ip() {
  grep "\s${1}$" | awk '{sub(/\/.*/,"",$2); print $2}'
}

inet() {
  $IP -4 addr show $1 | grep '^\s*inet\s' | _awksub_ip $1
}

inet6() {
  $IP -6 addr show $1 | grep '^\s*inet6\s' | _awksub_ip $1
}

interfaces() {
  for I in ${IF[$1]}; do
    for IX in ${IF[$I]-$I}; do
      echo ${IF[$IX]-$IX}
    done
  done
}

# ---[ FLUSH ]------------------------------------------------------------------
msg 'Flushing existing rules'

nftraw flush ruleset

if pref FLUSH; then
  finish
fi

nfttable filter
nftchain filter input '{ type filter hook input priority 0; }'
nftchain filter forward '{ type filter hook forward priority 0; }'
nftchain filter output '{ type filter hook output priority 0; }'

if pref VPN_SERVER; then
  nfttable nat
  nftchain nat prerouting '{ type nat hook prerouting priority -100; }'
  nftchain nat input '{ type nat hook input priority 100; }'
  nftchain nat output '{ type nat hook output priority -100; }'
  nftchain nat postrouting '{ type nat hook postrouting priority 100; }'
fi

nftchain filter valid_src
nftchain filter valid_dst

# ---[ VALID ]------------------------------------------------------------------
msg 'External interface sources'
if [ -n "$IPV4_LAN" ]; then
  for RANGE in $IPV4_LAN; do
    nft4rule filter valid_src ip saddr $RANGE return
  done
{'fraction_non_alphanumeric': 0.24166179052077238, 'fraction_numerical': 0.025551004486054223, 'mean_word_length': 2.255873015873016, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7072771', 'n_tokens_mistral': 2170, 'n_tokens_neox': 2079, 'n_words': 543}