WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): fixed invalid template generation for nft rules 02 and 03 when ipv6 addresses are specified in controllers ips list

Browse source
This commit is contained in:
NaeiKinDus 2024-08-08 00:00:00 +00:00
parent b83c6c1d4f
commit 3acdd804df
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2
View file

@ -50,7 +50,7 @@ table inet mangle {
{% if security_firewall_supervisors_ip6 -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
{%- endif %}
{% endif -%}
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
}

4
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2
View file

@ -5,7 +5,7 @@ table inet filter {
{% if security_firewall_supervisors_ip6 -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
{%- endif %}
{% endif -%}
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
iifname "lo" counter accept
@ -17,7 +17,7 @@ table inet filter {
type filter hook output priority 0; policy {{ security_firewall_filter_policy_output }};
{% if security_firewall_supervisors_ip6 -%}
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
{%- endif %}
{% endif -%}
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
oifname "lo" counter accept