documentation_complete: true


title: 'Ensure nftables Rules are Permanent'

description: |-
    nftables is a subsystem of the Linux kernel providing filtering and classification of
    network packets/datagrams/frames. The nftables service reads the
    {{{ xccdf_value("var_nftables_master_config_file") }}} file for a nftables file or files to
    include in the nftables ruleset. A nftables ruleset containing the input, forward, and output
    base chains allow network traffic to be filtered.

rationale: |-
    Changes made to nftables ruleset only affect the live system, you will also need to configure
    the nftables ruleset to apply on boot

severity: medium

platform: package[nftables] and service_disabled[firewalld]

identifiers:
    cce@sle15: CCE-92485-2
    cce@slmicro5: CCE-93980-1

references:
    cis@sle15: 3.5.2.10

ocil_clause: 'no nftables configuration exist'

ocil: |-
    Run the following commands to verify that input, forward, and output base chains are
    configured to be applied to a nftables ruleset on boot.
    Run the following command to verify the input base chain:
    <pre>
    # awk '/hook input/,/}/' $(awk '$1 ~ /^\s*include/ { gsub("\"","",$2);print $2 }' \
    {{{ xccdf_value("var_nftables_master_config_file") }}})
    </pre>
    or for forward base chain:
    <pre>
    # awk '/hook forward/,/}/' $(awk '$1 ~ /^\s*include/ { gsub("\"","",$2);print $2 }' \
    {{{ xccdf_value("var_nftables_master_config_file") }}})
    </pre>
    Review the base chains to ensure that they follow local site policy

fixtext: |-
    Edit the {{{ xccdf_value("var_nftables_master_config_file") }}} file and un-comment or add
    a line with include absolute path to nftables rules file for each nftables file you want
    included in the nftables ruleset on boot.
    For example the  {{{ xccdf_value("var_nftables_master_config_file") }}} should contain
    <pre>include "/etc/nftables/nftables.rules"</pre>
