postmarketos-config-nftables: Add nftables rules for anbox (MR 2271)

Anbox needs a specific set of nftables rules to allow incoming and
outgoing traffic. Anbox makes it easy to allow the specific traffic due
to the established `anbox0` bridge network interface.

main/postmarketos-config-nftables/APKBUILD

 # Maintainer: Clayton Craft <clayton@craftyguy.net>
 pkgname=postmarketos-config-nftables
 pkgver=0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="nftables firewall configuration for postmarketOS"
 url="https://gitlab.com/postmarketos"
 arch="noarch"
 license="MIT"
 depends="nftables-openrc"
-subpackages="$pkgname-openusb:openusb $pkgname-log:log"
+subpackages="$pkgname-openusb:openusb $pkgname-log:log $pkgname-anbox:anbox"
 source="
 	rules/00_log_all.nft
 	rules/01_wwan.nft
 	rules/10_dhcp.nft
 	rules/50_ssh.nft
+	rules/51_anbox.nft
 	rules/60_usb.nft
 	rules/99_drop_log.nft
 "
@@ -41,11 +42,19 @@ log() {
 	amove etc/nftables.d/99_drop_log.nft
 }
 
+anbox() {
+	depends="$pkgname"
+	description="Enables networking for Anbox"
+
+	amove etc/nftables.d/51_anbox.nft
+}
+
 sha512sums="
 166d77bcccc85a3db24af85010d07241cf193bccd79064863fbf9da7be4426364e9f9a9e0668c2c8018ada470d0fda30fe8eba24d24a2d4150af1d78af31b9b7  00_log_all.nft
 10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf  01_wwan.nft
 03ea8b54210e5c5627cfe26d50bc98355951ea81b9aa1a46dc4093b15b47b224ba1b2a95c5add65639478e47ca6e9d6f4ce4053a94622e832dc065f66d1fd6c8  10_dhcp.nft
 6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7  50_ssh.nft
+49d217a62b3bf2fb5555cf51db0bf0887d5a79722cffcd3b17fc85628ac26f3384e42ef28526746c754b071afa82fd13d02dd0876014d44fbfa20295a515060c  51_anbox.nft
 0e86974602622c03f0b34acd048e3a31157c0226ab4b5ec093a19696af3fc9637ed84cecf0d190941e4bd3afeb0c76a37245fa850abef46778cd1235ad8106df  60_usb.nft
 1532899534d7432a7708620cf1053ab80635fffe038a2352eb890c35fba4247c3b9ab3d0b028da1be765e5feb9b5a5b3a8107f4aa79f790d17930d38535a2288  99_drop_log.nft
 "

main/postmarketos-config-nftables/rules/51_anbox.nft

+#!/usr/sbin/nft -f
+table inet filter {
+    chain input {
+        iif anbox0 accept comment "Allow incomming network traffic from Anbox"
+    }
+    chain forward {
+        iif anbox0 accept comment "Allow outgoing network traffic from Anbox"
+        ct state {established, related} counter accept comment "accept established connections"
+    }
+}
+