kernel/system: replace legacy iptables with nftables

kernel/configs/vamos.config

@@ -30,6 +30,10 @@ CONFIG_USB_SERIAL_OPTION=y
 
 # Networking
 CONFIG_IPV6=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NFT_CT=y
 
 # Bluetooth
 CONFIG_BT=y

tools/build/Dockerfile

@@ -91,7 +91,7 @@ RUN for svc in \
   qrtr-ns rmtfs tqftpserv pd-mapper \
   comma modemmanager bluetoothd magic \
   ssh-param-watcher ncm-param-watcher dnsmasq \
-  rsyslogd iptables polkitd \
+  rsyslogd nftables polkitd \
   agetty-ttyMSM0 agetty-ttyAMA0; do \
     ln -sf /etc/sv/$svc /etc/runit/runsvdir/default/; \
   done
@@ -115,9 +115,6 @@ RUN chmod +x /usr/local/sbin/poweroff && \
 # NetworkManager connection permissions
 RUN chmod 600 /usr/lib/NetworkManager/system-connections/*.nmconnection
 
-# Void's iptables service expects iptables.rules
-RUN ln -s /etc/iptables/rules.v4 /etc/iptables/iptables.rules
-
 # MOTD - profile.d runs update-motd.d scripts into /run/motd, pam_motd displays it
 RUN sed -i 's|motd=/etc/motd|motd=/run/motd|' /etc/pam.d/system-login
 
@@ -215,9 +212,6 @@ RUN echo '#!/bin/sh' > /etc/sv/sshd/run && \
     echo 'fi' >> /etc/sv/sshd/run && \
     echo 'exec /usr/bin/sshd -D' >> /etc/sv/sshd/run
 
-# DEBUG: Fix iptables to allow SSH (insert before wwan0 DROP rule)
-RUN sed -i '/-A INPUT -i wwan0 -j DROP/i -A INPUT -p tcp --dport 22 -j ACCEPT' /etc/iptables/rules.v4 || true
-
 RUN ldconfig
 
 # Note: /data mount is handled in runit stage 1 (/etc/runit/1)

userspace/base_setup.sh

@@ -76,6 +76,7 @@ xbps-install -y \
   net-tools \
   NetworkManager \
   nload \
+  nftables \
   opencl-headers \
   portaudio-devel \
   ppp \

userspace/root/etc/nftables.conf

@@ -0,0 +1,13 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+  chain input {
+    type filter hook input priority filter;
+    policy accept;
+
+    ct state established,related accept
+    iifname "wwan0" drop
+  }
+}