Project: Chef InSpec (Provisioning / Security & Compliance)
File: nftables.md

+++ title = "nftables resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "nftables" identifier = "inspec/resources/os/nftables.md nftables resource" parent = "inspec/resources/os" +++ Use the `nftables` Chef InSpec audit resource to test rules and sets that are defined using `nftables`, which maintains tables of IP packet filtering rules. There may be more than one table. Each table contains one (or more) chains. A chain is a list of rules that match packets. When a rule matches a packet, the rule defines what target to assign to the packet. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v5.21.30 of InSpec. A `nftables` resource block declares tests for rules in IP tables: ```ruby describe nftables(family:'name', table:'name', chain: 'name') do its('PROPERTY') { should eq 'value' } it { should have_rule('RULE') } end describe nftables(family:'name', table:'name', set: 'name') do its('PROPERTY') { should eq 'value' } it { should have_element('ELEMENT') } end ``` where `nftables()` has to specify `family` and `table`. It also has to specify one of `chain` or `set` (exclusively). `family:'name'` is the name of the `family` the table belongs to, one of `ip`, `ip6`, `inet`, `arp`, `bridge`, `netdev`. `table:'name'` is the packet matching table against which the test is run. `chain: 'name'` is the name of a user-defined chain. `set: 'name'` is the name of a user-defined named set. `have_rule('RULE')` tests that the chain has a given rule in the nftables ruleset. This must match the entire line taken from `nftables -nn list chain FAMILY TABLE CHAIN`. `have_element('ELEMENT')` tests that element is a member of the nftables named set. See the and for more information about nftables. `hook` : The hook type. Possible values: `ingress`, `prerouting`, `forward`, `input`, `output`, `postrouting`, and `egress`. `prio` : The numerical chain priority. `policy` : The policy type. Possible values: `accept`, `drop`. `type` : The chain type. Possible values: `filter`, `nat`, and `route`. `flags` : The set flags. Possible values: `constant`, `dynamic`, `interval`, and `timeout`. `size` : The maximum number of elements in the set. `type` : The data type of set elements. Possible values: `ipv4addr`, `ipv6addr`, `etheraddr`, `inetproto`, `inet_service`, and `mark`. The following examples show how to use this Chef InSpec audit resource. ```ruby describe nftables(family: 'inet', table: 'TABLENAME', chain: 'CHAINNAME') do its('policy') { should eq 'accept' } end ``` ```ruby describe nftables(family: 'inet', table: 'mangle', chain: 'INPUT') do its('type') { should eq 'filter' } its('hook') { should eq 'input' } its('prio') { should eq (-150) } # mangle its('policy') { should eq 'accept' } end ``` ```ruby describe nftables(family: 'inet', table: 'TABLENAME', chain: 'CHAINNAME') do it { should have_rule('tcp dport 5432 comment "postgres" accept') } end ``` Note that the rule specification must exactly match what's in the output of `nftables -nn list chain inet TABLENAME CHAINNAME`, which will depend on how you've built your rules. ```ruby describe nftables(family: 'inet', table: 'TABLENAME', set: 'SETNAME') do it { should have_element('1.1.1.1') } end ``` {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `have_rule` matcher tests the named rule against the information in the `nftables` ruleset: ```ruby it { should have_rule('RULE') } ``` The `have_element` matcher tests the named set against the information in the `nftables` ruleset: ```ruby it { should haveelement('SETELEMENT') } ```