Ensure a Table Exists for Nftables
Description
Tables in nftables hold chains. Each table only has one address family and only applies
to packets of this family. Tables can have one of six families.
Rationale
Nftables doesn’t have any default tables. Without a table being built, nftables will not filter
network traffic.
Note: adding rules to a running nftables can cause loss of connectivity to the system.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'nftables' 2>/dev/null | grep -q installed; then
#Set nftables family name
var\_nftables\_family='inet'
#Set nftables table name
var\_nftables\_table='filter'
IS\_TABLE=$(nft list tables)
if [ -z "$IS\_TABLE" ]
then
nft create table "$var\_nftables\_family" "$var\_nftables\_table"
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Gather the package facts
package\_facts:
manager: auto
tags:
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- restrict\_strategy
- set\_nftables\_table
- name: XCCDF Value var\_nftables\_family # promote to variable
set\_fact:
var\_nftables\_family: !!str inet
tags:
- always
- name: XCCDF Value var\_nftables\_table # promote to variable
set\_fact:
var\_nftables\_table: !!str filter
tags:
- always
- name: Collect Existing Nftables
ansible.builtin.command: nft list tables
register: existing\_nftables
when: '"nftables" in ansible\_facts.packages'
tags:
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- restrict\_strategy
- set\_nftables\_table
- name: Set Nftable Table
ansible.builtin.command: nft create table {{ var\_nftables\_family }} {{ var\_nftables\_table
}}
when:
- '"nftables" in ansible\_facts.packages'
- existing\_nftables.stdout\_lines | length == 0
tags:
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- restrict\_strategy
- set\_nftables\_table
Warning
Adding rules to a running nftables can cause loss of connectivity to the system.