Add playbook for managing nftables

3 files changed, 86 insertions, 0 deletions

diff --git a/playbooks.d/fw-nftables/description.txt b/playbooks.d/fw-nftables/description.txt
new file mode 100644
index 0000000..38683d6
--- /dev/null
+++ b/playbooks.d/fw-nftables/description.txt
@@ -0,0 +1 @@
+Firewall through nftables
diff --git a/playbooks.d/fw-nftables/etc/defaults b/playbooks.d/fw-nftables/etc/defaults
new file mode 100644
index 0000000..10cc38b
--- /dev/null
+++ b/playbooks.d/fw-nftables/etc/defaults
@@ -0,0 +1,2 @@
+pkg.nftables=nftables
+svc.nftables=nftables
diff --git a/playbooks.d/fw-nftables/playbook.bash b/playbooks.d/fw-nftables/playbook.bash
new file mode 100644
index 0000000..748c177
--- /dev/null
+++ b/playbooks.d/fw-nftables/playbook.bash
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+
+playbook_add() {
+	pkg install nftables
+
+	playbook_sync
+
+	svc enable nftables
+	svc start nftables
+}
+
+playbook_sync() {
+	{
+		printf "#!%s -f\n\n" "$(config "$BASHTARD_PLAYBOOK.binpath" "/usr/sbin/nft")"
+		printf "flush ruleset\n\n"
+		printf "table inet filter {\n"
+		printf "\tchain input {\n"
+		printf "\t\ttype filter hook input priority filter;\n"
+
+		# Add conntrack state rules
+		info "$BASHTARD_PLAYBOOK/sync" "Adding input filter for conntrack state"
+		printf "\n"
+		printf "\t\tct state established %s;\n" \
+			"$(config "$BASHTARD_PLAYBOOK.input.state.established.policy" "accept")"
+		printf "\t\tct state related %s;\n" \
+			"$(config "$BASHTARD_PLAYBOOK.input.state.related.policy" "accept")"
+		printf "\t\tct state invalid %s;\n" \
+			"$(config "$BASHTARD_PLAYBOOK.input.state.invalid.policy" "drop")"
+
+		# Add ICMP rules
+		info "$BASHTARD_PLAYBOOK/sync" "Adding input filter for ICMP"
+		printf "\n"
+		printf "\t\tip protocol icmp icmp type echo-request" \ # IPv4
+		printf " limit rate %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv4.rate" "2/second")"
+		printf " %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv4.policy" "accept")"
+		printf ";\n"
+		printf "\t\tip6 nexthdr icmpv6 icmpv6 type echo-request" \ # IPv6
+		printf " limit rate %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv6.rate" "2/second")"
+		printf " %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv6.policy" "accept")"
+		printf ";\n"
+
+		# Add custom input rules
+		printf "\n"
+		while read -r rule
+		do
+			info "$BASHTARD_PLAYBOOK/sync" "Adding input filter for custom rule $rule"
+			printf "\t\t%s" "$(config "$BASHTARD_PLAYBOOK.input.rules.$rule.proto")"
+			printf " dport %s" "$(config "$BASHTARD_PLAYBOOK.input.rules.$rule.port")"
+			printf " %s" "$(config "$BASHTARD_PLAYBOOK.input.rules.$rule.policy" "accept")"
+			printf ";\n"
+		done < <(config_subkeys "$BASHTARD_PLAYBOOK.input.rules")
+
+		# Add fallback policy
+		printf "\n"
+		printf "\t\tpolicy %s;\n" "$(config "$BASHTARD_PLAYBOOK.input.policy" "drop")"
+
+		printf "\t}\n"
+		printf "\tchain forward {\n"
+		printf "\t\ttype filter hook forward priority filter;\n"
+
+		# TODO: Add forward rules
+
+		printf "\t}\n"
+		printf "\tchain output {\n"
+		printf "\t\ttype filter hook output priority filter;\n"
+
+		# TODO: Add output rules
+
+		printf "\t}\n"
+		printf "}\n"
+	} > "$(config "fs.etcdir")/nftables.conf"
+
+	[[ "$BASHTARD_COMMAND" == "add" ]] && return
+
+	svc restart nftables
+}
+
+playbook_del() {
+	svc stop nftables
+	svc disable nftables
+	pkg uninstall nftables
+	rm -fr -- "$(config "fs.etcdir")/nftables"
+}