# Keeps the ytdlp user (Wren Linux extras/yt-dlp.sh: yt-dlp, and the QuickJS and
# ffmpeg it runs) off your computer and your local network. Only its traffic is
# touched; the rules are the sandboxed Firefox's (data/firefox-firewall.nft).
# A hacked yt-dlp, or the JavaScript a site makes it run, can still reach the
# internet, but not:
#   - programs on this machine that listen on the network (a local server,
#     the Tor Browser proxy, a printing service, ...)
#   - your router, printers, other computers, or your phone's hotspot
# DNS goes only to the resolver this computer uses (parts/sandbox-dns.sh).
#
# To download from a server on your own network for a while, run
#     sudo systemctl stop wren-ytdlp-firewall
# and  sudo systemctl start wren-ytdlp-firewall  to block it again.

table inet wren_ytdlp
delete table inet wren_ytdlp

table inet wren_ytdlp {
    # The resolver this computer uses (Unbound on 127.0.0.1 with secure DNS on, the
    # network's while it is off), kept up to date by wren-sandbox-dns
    # (parts/sandbox-dns.sh): DNS goes there only, not to any address
    set resolvers {
        type ipv4_addr
    }
    chain output {
        type filter hook output priority 0; policy accept;
        meta skuid "ytdlp" jump ytdlp
    }

    chain ytdlp {
        # Nothing lets answers out: it listens for nothing, so it can't stand in
        # for a service here (Tor's port, say, while Tor is down)
        ip daddr @resolvers udp dport 53 accept
        ip daddr @resolvers tcp dport 53 accept
        # Anything addressed to this computer itself goes out through "lo",
        # whichever of its addresses is used (127.0.0.1, its LAN address, its
        # public IPv4 or IPv6 address), so this catches them all
        # (admin-prohibited: how bin/sandbox-net-check tells this from a closed port)
        oifname "lo" reject with icmpx admin-prohibited
        ip daddr { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
                   169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16,
                   224.0.0.0/4, 255.255.255.255 } reject
        # No IPv6 at all: on a network with global addresses, the router and other
        # computers have addresses no fixed rule can tell from the internet's.
        # Sites fall back to IPv4 at once (an IPv6-only network wouldn't work)
        meta nfproto ipv6 reject
    }
}