WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): fixed an issue leading to an invalid nftables.conf file being generated using provisioners ip addresses

Browse source
This commit is contained in:
NaeiKinDus 2024-07-27 00:00:00 +00:00
parent 9914c7921a
commit 068a2e2790
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
4 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
collections/ansible_collections/nullified/infrastructure/roles/security/tasks/firewall.yml
View file

@ -30,7 +30,8 @@
- name: set firewall templates facts
ansible.builtin.set_fact:
security_firewall_supervisors_ip4: '{{ provisioner_facts.controllers_list.values() }}'
security_firewall_supervisors_ip4: '{{ provisioner_facts.controllers_list.values() | list | ansible.utils.ipv4 }}'
security_firewall_supervisors_ip6: '{{ provisioner_facts.controllers_list.values() | list | ansible.utils.ipv6 }}'
security_firewall_dns4_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns4'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv4, true) }}"
security_firewall_dns6_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns6'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv6, true) }}"

6
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2
View file

@ -5,7 +5,11 @@ flush ruleset
define ansible_controllers_ip4 = {
{{ security_firewall_supervisors_ip4 | join(", ") | wordwrap(40, wrapstring="\n ") }}
}
define ansible_controllers_ip6 = { }
{% if security_firewall_supervisors_ip6 %}
define ansible_controllers_ip6 = {
{{ security_firewall_supervisors_ip6 | join(", ") | wordwrap(40, wrapstring="\n ") }}
}
{% endif %}
{% if security_firewall_dns4_servers -%}
define dns_servers = {
{{ security_firewall_dns4_servers | join(", ") | wordwrap(40, wrapstring="\n\t") }}

4
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2
View file

@ -22,8 +22,10 @@ table inet mangle {
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|psh|urg counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack|urg counter drop
{% if security_firewall_supervisors_ip6 -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
{% endif -%}
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
@ -45,8 +47,10 @@ table inet mangle {
chain postrouting {
type filter hook postrouting priority -150; policy {{ security_firewall_mangle_policy_postrouting }};
{% if security_firewall_supervisors_ip6 -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
{%- endif %}
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
}

4
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2
View file

@ -3,7 +3,9 @@ table inet filter {
chain input {
type filter hook input priority 0; policy {{ security_firewall_filter_policy_input }};
{% if security_firewall_supervisors_ip6 -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
{%- endif %}
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
iifname "lo" counter accept
@ -13,7 +15,9 @@ table inet filter {
chain output {
type filter hook output priority 0; policy {{ security_firewall_filter_policy_output }};
{% if security_firewall_supervisors_ip6 -%}
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
{%- endif %}
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
oifname "lo" counter accept