From 9328d456fc85be19506fa13d872da22146708afa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emmanuel=20Fr=C3=A9con?= Date: Wed, 2 Sep 2026 12:50:46 +0000 Subject: [PATCH 1/3] =?UTF-8?q?=E2=9C=A8=20Add=20firewall=20relays?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- libexec/net.sh | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/libexec/net.sh b/libexec/net.sh index 0a29b2f..ad93cfb 100644 --- a/libexec/net.sh +++ b/libexec/net.sh @@ -65,6 +65,72 @@ primer_net_urlenc() { # Return the hostname of the current machine. primer_net_hostname() { uname -n; } +primer_net_active_firewall() { + if primer_utils_syscmd_exists ufw && + $PRIMER_OS_SUDO ufw status 2>/dev/null | grep -q '^Status: active$'; then + printf '%s\n' ufw + elif primer_utils_syscmd_exists firewall-cmd && + $PRIMER_OS_SUDO firewall-cmd --state 2>/dev/null | grep -qx running; then + printf '%s\n' firewalld + elif primer_utils_syscmd_exists nft && + { primer_utils_syscmd_exists systemctl && + $PRIMER_OS_SUDO systemctl is-active --quiet nftables || + primer_utils_syscmd_exists rc-service && + $PRIMER_OS_SUDO rc-service nftables status >/dev/null 2>&1; }; then + printf '%s\n' nftables + fi +} + +_primer_net_port_allow() { + _firewall=$1 + _port=$2 + _proto=$3 + case "$_firewall" in + ufw) + $PRIMER_OS_SUDO ufw allow "${_port}/${_proto}";; + firewalld) + $PRIMER_OS_SUDO firewall-cmd --permanent --add-port="${_port}/${_proto}" + $PRIMER_OS_SUDO firewall-cmd --add-port="${_port}/${_proto}";; + nftables) + $PRIMER_OS_SUDO nft add rule inet filter input "$_proto" dport "$_port" accept;; + esac +} + +# Allow incoming traffic for one or more port[/protocol] rules. A protocol-less +# rule opens both TCP and UDP. Supported protocols are TCP and UDP. +primer_net_port_allow() { + _firewall=$(primer_net_active_firewall) + if [ -z "$_firewall" ]; then + yush_warn "No active UFW, firewalld, or nftables firewall found" + return 1 + fi + + for _rule in "$@"; do + _port=${_rule%%/*} + _proto=${_rule#*/} + [ "$_port" = "$_proto" ] && _proto= + if ! printf '%s\n' "$_port" | grep -Eq '^[0-9]+$' || + [ "$_port" -lt 1 ] || [ "$_port" -gt 65535 ]; then + yush_warn "Invalid port rule: $_rule" + continue + fi + if [ -n "$_proto" ]; then + _proto=$(printf '%s\n' "$_proto" | tr '[:upper:]' '[:lower:]') + case "$_proto" in + tcp|udp) _primer_net_port_allow "$_firewall" "$_port" "$_proto";; + *) yush_warn "Invalid port protocol in rule: $_rule";; + esac + else + _primer_net_port_allow "$_firewall" "$_port" tcp + _primer_net_port_allow "$_firewall" "$_port" udp + fi + done + + if [ "$_firewall" = nftables ]; then + yush_warn "nftables rules are not persistent; add them to the managed nftables configuration" + fi +} + _primer_net_curlopts() { if [ -n "$PRIMER_CURL_OPTIONS" ] && [ -f "$PRIMER_CURL_OPTIONS" ]; then yush_debug "Looking for curl options for $1" From 94a553be8fd76bd289cb2f5dd18974e431e378f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emmanuel=20Fr=C3=A9con?= Date: Wed, 2 Sep 2026 12:50:58 +0000 Subject: [PATCH 2/3] =?UTF-8?q?=E2=9C=A8=20Open=20relevant=20ports=20at=20?= =?UTF-8?q?firewall?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- libexec/steps/announce.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libexec/steps/announce.sh b/libexec/steps/announce.sh index 5baf488..3df98d7 100644 --- a/libexec/steps/announce.sh +++ b/libexec/steps/announce.sh @@ -31,9 +31,11 @@ primer_step_announce() { # Daemon implementing the method, and package providing it. _daemon= _pkg= + _ports= case "$(printf %s\\n "$method" | tr '[:upper:]' '[:lower:]')" in mdns) _daemon=avahi-daemon + _ports=5353/udp case "$lsb_dist" in *buntu|*bian) _pkg=avahi-daemon;; @@ -43,6 +45,7 @@ primer_step_announce() { ;; netbios) _daemon=nmbd + _ports="137/udp 138/udp" case "$lsb_dist" in *buntu|*bian|fedora*|clear*linux*) _pkg=samba;; @@ -59,6 +62,10 @@ primer_step_announce() { elif [ "$1" = "install" ]; then yush_info "Announcing using method: $method" _primer_step_announce_install "$_daemon" "$_pkg" + if [ -n "$(primer_net_active_firewall)" ]; then + # shellcheck disable=SC2086 + primer_net_port_allow $_ports + fi else yush_info "Cleaning announcements for method: $method" _primer_step_announce_uninstall "$_daemon" "$_pkg" From 364173ee22d5259d222a47669061e0336ea64da3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emmanuel=20Fr=C3=A9con?= Date: Wed, 2 Sep 2026 13:00:57 +0000 Subject: [PATCH 3/3] =?UTF-8?q?=F0=9F=A9=B9=20No=20port=20modif.=20when=20?= =?UTF-8?q?failed=20to=20install?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- libexec/steps/announce.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libexec/steps/announce.sh b/libexec/steps/announce.sh index 3df98d7..8a529c6 100644 --- a/libexec/steps/announce.sh +++ b/libexec/steps/announce.sh @@ -62,7 +62,7 @@ primer_step_announce() { elif [ "$1" = "install" ]; then yush_info "Announcing using method: $method" _primer_step_announce_install "$_daemon" "$_pkg" - if [ -n "$(primer_net_active_firewall)" ]; then + if primer_utils_syscmd_exists "$_daemon" && [ -n "$(primer_net_active_firewall)" ]; then # shellcheck disable=SC2086 primer_net_port_allow $_ports fi