Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: check the Spamhaus and geo sets under another table name, a dry run against the live name made unlisted addresses match

Browse Source
This commit is contained in:
Ruakij
2026-10-24 17:20:11 +00:00
parent 49834b858b
commit 312be161b9
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/files/nft-host-spamhaus
+5 -5
View File
@@ -102,10 +102,6 @@ def merge(family, *groups):
return list(ipaddress.collapse_addresses(networks)), skipped return list(ipaddress.collapse_addresses(networks)), skipped
def nft(*args):
return subprocess.run(["nft", *args], capture_output=True, text=True)
def main(): def main():
with tempfile.TemporaryDirectory() as tmp: with tempfile.TemporaryDirectory() as tmp:
drop4 = [r["cidr"] for r in spamhaus_records("drop_v4", tmp)] drop4 = [r["cidr"] for r in spamhaus_records("drop_v4", tmp)]
@@ -134,7 +130,11 @@ def main():
candidate = os.path.join(tmp, "host-spamhaus.nft") candidate = os.path.join(tmp, "host-spamhaus.nft")
with open(candidate, "w", encoding="utf-8") as f: with open(candidate, "w", encoding="utf-8") as f:
f.write("\n".join(persisted)) f.write("\n".join(persisted))
checked = nft("-c", "-f", candidate) # Checked under another table name: a dry run against the live table
# name changes the live sets for its duration and unlisted addresses match.
with open(candidate, encoding="utf-8") as f:
check_rules = f.read().replace("table inet host {", "table inet host_spamhaus_check {")
checked = subprocess.run(["nft", "-c", "-f", "-"], input=check_rules, capture_output=True, text=True)
if checked.returncode != 0: if checked.returncode != 0:
fail(f"nft rejects the sets: {checked.stderr.strip()}") fail(f"nft rejects the sets: {checked.stderr.strip()}")
host_firewall/templates/nft-host-geo.j2
+3 -1
View File
@@ -37,7 +37,9 @@ elements() {
echo '}' echo '}'
} >"$tmp/host-geo.nft" } >"$tmp/host-geo.nft"
nft -c -f "$tmp/host-geo.nft" # Checked under another table name: a dry run against the live table name
# changes the live sets for its duration and unlisted addresses match.
sed 's/^table inet host {/table inet host_geo_check {/' "$tmp/host-geo.nft" | nft -c -f -
install -m 0644 "$tmp/host-geo.nft" "$out.new" install -m 0644 "$tmp/host-geo.nft" "$out.new"
mv -f "$out.new" "$out" mv -f "$out.new" "$out"