host_firewall: drop inbound traffic from internet-wide scanners (OpenFilters internet-scanners), v4 and v6, daily refresh

host_firewall/tasks/main.yml

@@ -43,7 +43,7 @@
     src: "{{ item }}"
     dest: "/etc/systemd/system/{{ item }}"
     mode: "0644"
-  loop: [nft-host.service, nft-host-geo.service, nft-host-geo.timer, nft-host-spamhaus.service, nft-host-spamhaus.timer, nft-host-firehol.service, nft-host-firehol.timer]
+  loop: [nft-host.service, nft-host-geo.service, nft-host-geo.timer, nft-host-spamhaus.service, nft-host-spamhaus.timer, nft-host-firehol.service, nft-host-firehol.timer, nft-host-scanners.service, nft-host-scanners.timer]
   register: firewall_units
 
 - name: Install the rollback script
@@ -211,6 +211,66 @@
         path: /etc/nftables.d/host-firehol.nft
         state: absent
 
+- name: Internet scanner sets
+  when: firewall.scanners
+  block:
+    - name: Install the internet scanner set updater
+      ansible.builtin.copy:
+        src: nft-host-scanners
+        dest: /usr/local/sbin/nft-host-scanners
+        mode: "0755"
+
+    # The updater leaves out entries overlapping these addresses.
+    - name: Install the internet scanner allowlist
+      ansible.builtin.template:
+        src: nft-host-scanners.allowlist.j2
+        dest: /etc/nft-host-scanners.allowlist
+        mode: "0644"
+
+    # The rule set includes this file, so a missing one would fail the load at boot.
+    - name: Build the internet scanner sets on first run
+      ansible.builtin.command: /usr/local/sbin/nft-host-scanners
+      args:
+        creates: /etc/nftables.d/host-scanners.nft
+
+    - name: Read the internet scanner sets file
+      ansible.builtin.stat:
+        path: /etc/nftables.d/host-scanners.nft
+      register: firewall_scanners
+
+    - name: Require non-empty internet scanner sets
+      ansible.builtin.assert:
+        that: firewall_scanners.stat.exists and firewall_scanners.stat.size > 0
+        fail_msg: /etc/nftables.d/host-scanners.nft is missing or empty, refusing to apply the firewall
+      # Check mode neither installs the updater nor builds the sets.
+      when: not ansible_check_mode
+
+    - name: Enable the internet scanner set timer
+      ansible.builtin.systemd:
+        name: nft-host-scanners.timer
+        enabled: true
+        state: started
+        daemon_reload: "{{ firewall_units is changed }}"
+      # Check mode does not install the unit.
+      ignore_errors: "{{ ansible_check_mode }}"
+
+- name: Stop the internet scanner set refresh
+  when: not firewall.scanners
+  block:
+    - name: Disable the internet scanner set timer
+      ansible.builtin.systemd:
+        name: nft-host-scanners.timer
+        enabled: false
+        state: stopped
+        daemon_reload: "{{ firewall_units is changed }}"
+      # Check mode does not install the unit.
+      ignore_errors: "{{ ansible_check_mode }}"
+
+    - name: Remove the internet scanner sets file
+      ansible.builtin.file:
+        path: /etc/nftables.d/host-scanners.nft
+        state: absent
+
 - name: Render the rule set
   ansible.builtin.template:
     src: host.nft.j2