postmarketos-config-nftables: add upnp-client rules (MR 3533)

Add rules to accept SSDP/UPnP Replies, which can be used for discovery
in VLC.

main/postmarketos-config-nftables/APKBUILD

 # Maintainer: Clayton Craft <clayton@craftyguy.net>
 pkgname=postmarketos-config-nftables
-pkgver=0.10
+pkgver=0.11
 pkgrel=0
 pkgdesc="nftables firewall configuration for postmarketOS"
 url="https://gitlab.com/postmarketos"
@@ -13,6 +13,7 @@ subpackages="
 	$pkgname-docker:docker
 	$pkgname-moshserver:moshserver
 	$pkgname-networkmanager:networkmanager
+	$pkgname-upnp-client:upnp_client
 	$pkgname-vncserver:vncserver
 "
 source="
@@ -20,11 +21,12 @@ source="
 	rules/01_wwan.nft
 	rules/10_dhcp.nft
 	rules/50_ssh.nft
+	rules/50_upnp_client.nft
+	rules/50_vncserver.nft
 	rules/51_docker.nft
 	rules/51_moshserver.nft
 	rules/51_hotspot.nft
 	rules/51_usb_inet.nft
-	rules/50_vncserver.nft
 	rules/60_usb.nft
 	rules/99_drop_log.nft
 	networkmanager.conf
@@ -70,6 +72,14 @@ moshserver() {
 	amove etc/nftables.d/51_moshserver.nft
 }
 
+upnp_client() {
+	depends="$pkgname"
+	description="Enables networking for SSDP/UPnP client"
+	install_if="$pkgname libupnp"
+
+	amove etc/nftables.d/50_upnp_client.nft
+}
+
 vncserver() {
 	depends="$pkgname"
 	description="Enables networking for VNC Server"
@@ -91,11 +101,12 @@ sha512sums="
 10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf  01_wwan.nft
 d5a7c7fc47924acfafee42d731e6a0109d83af6278053128deecbf3cf40e37447cb649360ee9ebddd2a5ea276888314b63ce7ef828708b5bf7dd1bface7fbc62  10_dhcp.nft
 6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7  50_ssh.nft
+54bd41a062c68f8cd2258c22d4313f43b27235ee1baa5d8f90de1d574ec3ef12d5adf47ac78d39d667b54a5d08c90f7cff1708231b7c699c93b2ef2feb72e85a  50_upnp_client.nft
+dfe0c8f7e86f187a9a69a35f1f4e9125dca385ad372777aab3d820886b26061214f3dc3f0d012690e981e0dec9bcacf154c69eab56dfa549d132555663b1f8e9  50_vncserver.nft
 76ac156ee80f895ab4f574f70f4ee9f960dfd23a3381bbbf7c744bea919b98f69e91e2eaa10425dfeaf5dbe77b745ec1dd82cb94953835873baffd9e5d89e166  51_docker.nft
 59d93d0006aadb6f699836895119cf49a2fbbc1159cad4ab98868610cd6796da7fe792e7c845df93303a4cfa77658e0687b6726a8b0bcf613563f1a33d5588ab  51_moshserver.nft
 1ce70bb71c9008b6c727a2c26d11467be3b5a0cb9815a8bb0790150c7958457b22b110e35ba974973b9579d44bd14219985d85597c954b5fa8cf77bf206c959b  51_hotspot.nft
 bceb1a12a9de044daa3a4ba647b0d69b257881151a912fc350d6a00fdf0c0903b51fb58c56cfc73e9a75f529bac841d41d466e0f210b1f516e124e69cbfd1feb  51_usb_inet.nft
-dfe0c8f7e86f187a9a69a35f1f4e9125dca385ad372777aab3d820886b26061214f3dc3f0d012690e981e0dec9bcacf154c69eab56dfa549d132555663b1f8e9  50_vncserver.nft
 0e86974602622c03f0b34acd048e3a31157c0226ab4b5ec093a19696af3fc9637ed84cecf0d190941e4bd3afeb0c76a37245fa850abef46778cd1235ad8106df  60_usb.nft
 1532899534d7432a7708620cf1053ab80635fffe038a2352eb890c35fba4247c3b9ab3d0b028da1be765e5feb9b5a5b3a8107f4aa79f790d17930d38535a2288  99_drop_log.nft
 ea738469e68b8a8038f301b0cb901cd305445321ee24c4b4025365b4b95d5c61113a5bb24ab4efaa73eda23c2e06984d3e58395584fcb8887cf1595ea99542da  networkmanager.conf

main/postmarketos-config-nftables/rules/50_upnp_client.nft

+#!/usr/sbin/nft -f
+
+table inet filter {
+        chain input {
+                iifname "wwan*" udp sport 1900 accept drop comment "drop SSDP/UPnP replies from wwan"
+                udp sport 1900 accept comment "accept SSDP/UPnP replies"
+        }
+}