From 068a2e27904c38af2d235ba684685754ba8aeb7f Mon Sep 17 00:00:00 2001 From: NaeiKinDus Date: Sat, 27 Jul 2024 00:00:00 +0000 Subject: [PATCH] fix(security): fixed an issue leading to an invalid nftables.conf file being generated using provisioners ip addresses --- .../infrastructure/roles/security/tasks/firewall.yml | 3 ++- .../roles/security/templates/system/debian/nftables.conf.j2 | 6 +++++- .../security/templates/system/nftables/02-mangle.table.j2 | 4 ++++ .../security/templates/system/nftables/03-filter.table.j2 | 4 ++++ 4 files changed, 15 insertions(+), 2 deletions(-) diff --git a/collections/ansible_collections/nullified/infrastructure/roles/security/tasks/firewall.yml b/collections/ansible_collections/nullified/infrastructure/roles/security/tasks/firewall.yml index 5cec9a0..1640854 100644 --- a/collections/ansible_collections/nullified/infrastructure/roles/security/tasks/firewall.yml +++ b/collections/ansible_collections/nullified/infrastructure/roles/security/tasks/firewall.yml @@ -30,7 +30,8 @@ - name: set firewall templates facts ansible.builtin.set_fact: - security_firewall_supervisors_ip4: '{{ provisioner_facts.controllers_list.values() }}' + security_firewall_supervisors_ip4: '{{ provisioner_facts.controllers_list.values() | list | ansible.utils.ipv4 }}' + security_firewall_supervisors_ip6: '{{ provisioner_facts.controllers_list.values() | list | ansible.utils.ipv6 }}' security_firewall_dns4_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns4'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv4, true) }}" security_firewall_dns6_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns6'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv6, true) }}" diff --git a/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2 b/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2 index 6d40be6..9316b1e 100644 --- a/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2 +++ b/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2 @@ -5,7 +5,11 @@ flush ruleset define ansible_controllers_ip4 = { {{ security_firewall_supervisors_ip4 | join(", ") | wordwrap(40, wrapstring="\n ") }} } -define ansible_controllers_ip6 = { } +{% if security_firewall_supervisors_ip6 %} +define ansible_controllers_ip6 = { + {{ security_firewall_supervisors_ip6 | join(", ") | wordwrap(40, wrapstring="\n ") }} +} +{% endif %} {% if security_firewall_dns4_servers -%} define dns_servers = { {{ security_firewall_dns4_servers | join(", ") | wordwrap(40, wrapstring="\n\t") }} diff --git a/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2 b/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2 index 1fdae0f..9abe332 100644 --- a/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2 +++ b/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2 @@ -22,8 +22,10 @@ table inet mangle { tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|psh|urg counter drop tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack|urg counter drop + {% if security_firewall_supervisors_ip6 -%} ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept + {% endif -%} ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept @@ -45,8 +47,10 @@ table inet mangle { chain postrouting { type filter hook postrouting priority -150; policy {{ security_firewall_mangle_policy_postrouting }}; + {% if security_firewall_supervisors_ip6 -%} ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept + {%- endif %} ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept } diff --git a/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2 b/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2 index 6942bb3..fad4648 100644 --- a/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2 +++ b/collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2 @@ -3,7 +3,9 @@ table inet filter { chain input { type filter hook input priority 0; policy {{ security_firewall_filter_policy_input }}; + {% if security_firewall_supervisors_ip6 -%} ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept + {%- endif %} ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept iifname "lo" counter accept @@ -13,7 +15,9 @@ table inet filter { chain output { type filter hook output priority 0; policy {{ security_firewall_filter_policy_output }}; + {% if security_firewall_supervisors_ip6 -%} ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept + {%- endif %} ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept oifname "lo" counter accept