#!/usr/sbin/nft -f
# felhom OOB belt — STATIC table (TASK H1). Installed by host-install; loaded on boot by
# felhom-oob-nft.service. The agent mutates ONLY the two SETS (@operator_ips, @ssh_port) via the
# narrow FELHOM_OOB sudoers — it NEVER touches the rules [trap 4], so the enforcement semantics are
# fixed here and cannot be changed by the agent.
#
# Enforcement (scoped to iifname "wg-felhom" — the offsite tunnel — so :22 and every other interface
# are UNTOUCHED [SF-3/OF-5]):
#   - ESTABLISHED,RELATED replies always pass (covers the PBS path + reply traffic; PMTU-safe).
#   - felhom-sshd's port is reachable from the operator /32 (in @operator_ips) over the tunnel ONLY.
#   - any other tunnel source to that port is DROPPED at the host (defense-in-depth vs the endpoint).
#   - the port is unreachable OFF the tunnel entirely.
# Empty sets (before the agent's first sync) = the port rules match nothing = no enforcement yet
# (felhom-sshd is not started until the agent renders its config either). priority -5 sits just above
# the default; policy accept so this table only ever ADDS drops for the felhom-sshd port.
#
# Idempotent load: create-then-delete-then-define (a re-run/boot yields a clean table with EMPTY sets;
# the agent refills them within one tick).

table inet felhom_oob
delete table inet felhom_oob

table inet felhom_oob {
	set operator_ips {
		type ipv4_addr
	}
	set ssh_port {
		type inet_service
	}
	chain input {
		type filter hook input priority -5; policy accept;
		ct state established,related accept
		iifname "wg-felhom" tcp dport @ssh_port ip saddr @operator_ips accept
		iifname "wg-felhom" tcp dport @ssh_port drop
		tcp dport @ssh_port iifname != "wg-felhom" drop
	}
}