From 312be161b93395b93b2c1eeb22090de8607c3bc7 Mon Sep 17 00:00:00 2001
From: Ruakij <ruakij@ruekov.eu>
Date: Sat, 24 Oct 2026 17:20:11 +0000
Subject: [PATCH] host_firewall: check the Spamhaus and geo sets under another
 table name, a dry run against the live name made unlisted addresses match

---
 host_firewall/files/nft-host-spamhaus   | 10 +++++-----
 host_firewall/templates/nft-host-geo.j2 |  4 +++-
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/host_firewall/files/nft-host-spamhaus b/host_firewall/files/nft-host-spamhaus
index 407b8ff..9fe16db 100644
--- a/host_firewall/files/nft-host-spamhaus
+++ b/host_firewall/files/nft-host-spamhaus
@@ -102,10 +102,6 @@ def merge(family, *groups):
     return list(ipaddress.collapse_addresses(networks)), skipped
 
 
-def nft(*args):
-    return subprocess.run(["nft", *args], capture_output=True, text=True)
-
-
 def main():
     with tempfile.TemporaryDirectory() as tmp:
         drop4 = [r["cidr"] for r in spamhaus_records("drop_v4", tmp)]
@@ -134,7 +130,11 @@ def main():
         candidate = os.path.join(tmp, "host-spamhaus.nft")
         with open(candidate, "w", encoding="utf-8") as f:
             f.write("\n".join(persisted))
-        checked = nft("-c", "-f", candidate)
+        # Checked under another table name: a dry run against the live table
+        # name changes the live sets for its duration and unlisted addresses match.
+        with open(candidate, encoding="utf-8") as f:
+            check_rules = f.read().replace("table inet host {", "table inet host_spamhaus_check {")
+        checked = subprocess.run(["nft", "-c", "-f", "-"], input=check_rules, capture_output=True, text=True)
         if checked.returncode != 0:
             fail(f"nft rejects the sets: {checked.stderr.strip()}")
 
diff --git a/host_firewall/templates/nft-host-geo.j2 b/host_firewall/templates/nft-host-geo.j2
index ec8b832..fea8f85 100644
--- a/host_firewall/templates/nft-host-geo.j2
+++ b/host_firewall/templates/nft-host-geo.j2
@@ -37,7 +37,9 @@ elements() {
 	echo '}'
 } >"$tmp/host-geo.nft"
 
-nft -c -f "$tmp/host-geo.nft"
+# Checked under another table name: a dry run against the live table name
+# changes the live sets for its duration and unlisted addresses match.
+sed 's/^table inet host {/table inet host_geo_check {/' "$tmp/host-geo.nft" | nft -c -f -
 install -m 0644 "$tmp/host-geo.nft" "$out.new"
 mv -f "$out.new" "$out"