From 0e74e2f70ceb291199499bcd7aa1828e1908fa65 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Tue, 7 Mar 2023 18:00:02 +0000
Subject: [PATCH] Rename firewall tables to avoid any clash with iptables

---
 cookbooks/networking/attributes/default.rb    |  2 +-
 cookbooks/networking/recipes/default.rb       |  6 ++++--
 .../templates/default/nftables.conf.erb       | 20 +++++++++----------
 roles/palulukon.rb                            |  2 +-
 4 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/cookbooks/networking/attributes/default.rb b/cookbooks/networking/attributes/default.rb
index ac47543f1..829a6465e 100644
--- a/cookbooks/networking/attributes/default.rb
+++ b/cookbooks/networking/attributes/default.rb
@@ -4,7 +4,7 @@ default[:networking][:firewall][:incoming] = []
 default[:networking][:firewall][:outgoing] = []
 default[:networking][:firewall][:http_rate_limit] = "-"
 default[:networking][:firewall][:http_connection_limit] = "-"
-default[:networking][:firewall][:whitelist] = []
+default[:networking][:firewall][:allowlist] = []
 default[:networking][:roles] = {}
 default[:networking][:interfaces] = {}
 default[:networking][:nameservers] = %w[8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844]
diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index 2ec9691a4..dccba7c7a 100644
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -413,10 +413,12 @@ template "/etc/nftables.conf" do
 end
 
 stop_commands = [
-  "/usr/sbin/nft delete table inet filter"
+  "-/usr/sbin/nft delete table inet filter",
+  "-/usr/sbin/nft delete table inet chef-filter"
 ]
 
-stop_commands << "/usr/sbin/nft delete table ip nat" if node[:roles].include?("gateway")
+stop_commands << "-/usr/sbin/nft delete table ip nat" if node[:roles].include?("gateway")
+stop_commands << "-/usr/sbin/nft delete table ip chef-nat" if node[:roles].include?("gateway")
 
 systemd_service "nftables-stop" do
   service "nftables"
diff --git a/cookbooks/networking/templates/default/nftables.conf.erb b/cookbooks/networking/templates/default/nftables.conf.erb
index 7fc46cff2..d98237d6e 100644
--- a/cookbooks/networking/templates/default/nftables.conf.erb
+++ b/cookbooks/networking/templates/default/nftables.conf.erb
@@ -7,7 +7,7 @@ define external-interfaces = { <%= @interfaces.sort.uniq.join(", ") %> }
 define ip-private-addresses = { 0.0.0.0, 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, 224.0.0.0/4 }
 define ip6-private-addresses = { 2001:db8::/32, fc00::/7, ff00::/8 }
 
-table inet filter {
+table inet chef-filter {
   set ip-osm-addresses {
     type ipv4_addr
 <%- unless Array(@hosts["inet"]).empty? %>
@@ -22,12 +22,12 @@ table inet filter {
 <%- end %>
   }
 
-  set ip-blacklist {
+  set ip-blocklist {
     type ipv4_addr
     flags dynamic
   }
 
-  set ip6-blacklist {
+  set ip6-blocklist {
     type ipv6_addr
     flags dynamic
   }
@@ -69,15 +69,15 @@ table inet filter {
   }
 
   chain incoming {
-<%- if node[:networking][:firewall][:whitelist].empty? %>
+<%- if node[:networking][:firewall][:allowlist].empty? %>
     ip saddr { $ip-private-addresses } jump log-and-drop
 <%- else %>
-    ip saddr { $ip-private-addresses } ip saddr != { <%= node[:networking][:firewall][:whitelist].sort.join(", ") %> } jump log-and-drop
+    ip saddr { $ip-private-addresses } ip saddr != { <%= node[:networking][:firewall][:allowlist].sort.join(", ") %> } jump log-and-drop
 <%- end %>
     ip6 saddr { $ip6-private-addresses } jump log-and-drop
 
-    ip saddr @ip-blacklist jump log-and-drop
-    ip6 saddr @ip6-blacklist jump log-and-drop
+    ip saddr @ip-blocklist jump log-and-drop
+    ip6 saddr @ip6-blocklist jump log-and-drop
 
     ct state { established, related } accept
 
@@ -107,10 +107,10 @@ table inet filter {
   }
 
   chain outgoing {
-<%- if node[:networking][:firewall][:whitelist].empty? %>
+<%- if node[:networking][:firewall][:allowlist].empty? %>
     ip daddr { $ip-private-addresses } jump log-and-drop
 <%- else %>
-    ip daddr { $ip-private-addresses } ip daddr != { <%= node[:networking][:firewall][:whitelist].sort.join(", ") %> } jump log-and-drop
+    ip daddr { $ip-private-addresses } ip daddr != { <%= node[:networking][:firewall][:allowlist].sort.join(", ") %> } jump log-and-drop
 <%- end %>
     ip6 daddr { $ip6-private-addresses } jump log-and-drop
 
@@ -154,7 +154,7 @@ table inet filter {
 }
 <%- if node[:roles].include?("gateway") %>
 
-table ip nat {
+table ip chef-nat {
   chain postrouting {
     type nat hook postrouting priority srcnat;
 
diff --git a/roles/palulukon.rb b/roles/palulukon.rb
index 9045e7bcc..4826bafaa 100644
--- a/roles/palulukon.rb
+++ b/roles/palulukon.rb
@@ -4,7 +4,7 @@ description "Master role applied to palulukon"
 default_attributes(
   :networking => {
     :firewall => {
-      :whitelist => ["172.31.0.2"]
+      :allowlist => ["172.31.0.2"]
     },
     :interfaces => {
       :external_ipv4 => {
-- 
2.43.2