Configure Proper Policies for INPUT of nftables

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

# ------------------------------------------------------------------
# METADATA
# ------------------------------------------------------------------

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.130361");
  script_version("2025-11-21T05:40:28+0000");
  script_tag(name:"last_modification", value:"2025-11-21 05:40:28 +0000 (Fri, 21 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-05-07 11:44:20 +0000 (Wed, 07 May 2025)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Configure Proper Policies for INPUT of nftables");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "compliance_os_check.nasl");

  script_mandatory_keys("Compliance/Launch", "policy/ssh/login/euleros_openeuler");

  script_add_preference(name:"Table", type:"entry", value:"test", id:1);
  script_add_preference(name:"Chain", type:"entry", value:"input", id:2);
  script_add_preference(name:"Protocol", type:"entry", value:"tcp", id:3);
  script_add_preference(name:"Port", type:"entry", value:"22", id:4);

  script_xref(name:"Policy", value:"EulerOS Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.2 Firewall: 3.2.14 Configure Proper Policies for INPUT of nftables (Recommendation)");
  script_xref(name:"Policy", value:"openEuler Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.2 Firewall: 3.2.14 Configure Proper Policies for INPUT of nftables (Recommendation)");

  script_tag(name:"summary", value:"The INPUT chain is used to filter packets received from
external systems. For any service provided for external systems, configure the corresponding INPUT
policy and enable the related port so that external clients can access the service through the port.

If the policy is not set, all packets that attempt to access related services are discarded because
the default policy is DROP.");

  exit(0);
}

include("ssh_func.inc");
include("host_details.inc");
include("policy_reporting_module.inc");

table = script_get_preference("Table");
chain = script_get_preference("Chain");
protocol = script_get_preference("Protocol");
port = script_get_preference("Port");

title = "Configure Proper Policies for INPUT of nftables";

solution = "Run the following command to add the ACCEPT policy to the INPUT chain:

# nft add rule inet dport accept

Example:

# nft add rule inet test input tcp dport ssh accept

Save the currently configured policy to the configuration file as follows so that it can be
automatically loaded after the system restarts.

# nft list ruleset > /etc/sysconfig/nftables.conf

Note that saving the configuration file using the preceding method will overwrite the original
configuration. You can also export the current rule to an independent file or compile a new rule in
the original file and load the rule in include mode in the /etc/sysconfig/nftables.conf
configuration file. If you use this method, avoid duplicate rules in multiple include rule files.

# nft list ruleset > /etc/nftables/new_test_rules.nft
# echo <quote>include \\<quote>/etc/nftables/new_test_rules.nft\\<quote><quote> >> /etc/sysconfig/nftables.conf";

check_type = "SSH_Cmd";

action = 'Run the command in the terminal:
# nft list chain inet '+table+' '+chain+' 2>/dev/null | grep "'+protocol+' dport '+port+' accept"';

expected_value = 'The output should not be empty';

# ------------------------------------------------------------------
# CONNECTION CHECK
# ------------------------------------------------------------------

if(!get_kb_item("login/SSH/success") || !sock = ssh_login_or_reuse_connection()){

  report_ssh_error(title: title,
                   solution: solution,
                   action: action,
                   expected_value: expected_value,
                   check_type: check_type);
  exit(0);
}

# ------------------------------------------------------------------
# CHECK : Check nft list chain
# ------------------------------------------------------------------

step_cmd = 'nft list chain inet '+table+' '+chain+' 2>/dev/null | grep "'+protocol+' dport '+port+' accept"';
actual_value = ssh_cmd(socket:sock, cmd:step_cmd, return_errors:TRUE, return_linux_errors_only:TRUE);

if(eregmatch(string: actual_value, pattern:"(No such file or directory|Permission denied|Command not found|Segmentation fault|service not found|is not running|syntax error near unexpected token|syntax error: unexpected end of file)", icase: TRUE)){
  compliant = "incomplete";
  comment = "Something went wrong during the audit check. Please try again.";
}else if(actual_value){
  compliant = "yes";
  comment = "Check passed";
}else{
  compliant = "no";
  comment = "Check failed";
}

# ------------------------------------------------------------------
# REPORT
# ------------------------------------------------------------------

target = get_kb_item("policy/ssh/login/os-release");
comment = "Target: " + target + "\n" + comment;

report_audit(action: action,
             actual_value: actual_value,
             expected_value: expected_value,
             is_compliant: compliant,
             solution: solution,
             check_type: check_type,
             title: title,
             comment: comment);

exit(0);