# Keeps the wifi-signin user off this computer (Wren Linux parts/incognito.sh).
# Only that user's traffic is touched. It runs the Wi-Fi sign-in window
# (bin/wifi-signin), a throwaway Firefox that lives only while you sign in.
# Unlike incognito it may reach the local network: a café's or hotel's sign-in
# page is often there (http://192.168.1.1/login, http://10.0.0.1/...). It may
# not reach:
#   - programs on this machine that listen on the network (a local server,
#     the Tor Browser proxy, a printing service, ...); DNS to the resolver
#     this computer uses (the network's, while the window has secure DNS
#     off) is let through, since it is what the window is for
#   - multicast and broadcast addresses (no sign-in page lives there)

table inet wren_wifi_signin
delete table inet wren_wifi_signin

table inet wren_wifi_signin {
    # The resolver this computer uses (Unbound on 127.0.0.1 with secure DNS on, the
    # network's while it is off), kept up to date by wren-sandbox-dns
    # (parts/sandbox-dns.sh): DNS goes there only, not to any address
    set resolvers {
        type ipv4_addr
    }
    chain output {
        type filter hook output priority 0; policy accept;
        meta skuid "wifi-signin" jump wifi_signin
    }

    chain wifi_signin {
        # Nothing lets answers out: it listens for nothing, so it can't stand in
        # for a service here (Tor's port, say, while Tor is down)
        # DNS, the network's own: the window is there to use it
        ip daddr @resolvers udp dport 53 accept
        ip daddr @resolvers tcp dport 53 accept
        # Anything addressed to this computer itself goes out through "lo",
        # whichever of its addresses is used, so this catches them all
        # (admin-prohibited: how bin/sandbox-net-check tells this from a closed port)
        oifname "lo" reject with icmpx admin-prohibited
        ip daddr { 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/4, 255.255.255.255 } reject
        ip6 daddr { ::1, ff00::/8 } reject
    }
}