feat: add debian12 scripts

- nftables_is_enabled.sh 	-> 4.2.9
- nftables_has_table.sh 	-> 4.2.4
- nftables_has_base_chains.sh 	-> 4.2.5
- nftables_rules_permanent.sh	-> 4.2.10

tests/hardening/nftables_has_base_chains.sh

@@ -0,0 +1,15 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe Prepare test
+    apt install -y nftables
+
+    # running on a non privilieged container, wont test much...
+    describe Running on blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean test
+    apt remove -y nftables
+}

tests/hardening/nftables_has_table.sh

@@ -0,0 +1,16 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe Prepare test
+    apt install -y nftables
+
+    # running on a non privilieged container, wont test much...
+    describe Running on blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean test
+    apt remove -y nftables
+
+}

tests/hardening/nftables_is_enabled.sh

@@ -0,0 +1,10 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe Running on blank host
+    register_test retvalshouldbe 0
+    dismiss_count_for_test
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}

tests/hardening/nftables_rules_permanent.sh

@@ -0,0 +1,36 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe prepare failing test
+    rm -f /etc/nftables.conf
+    touch /etc/nftables.conf
+    touch /etc/nftables.rules
+
+    describe Running failed 'missing include'
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Fixing first situation
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+    "${CIS_CHECKS_DIR}/${script}.sh" || true
+
+    # the 'include' part is fixed, but configuration is missing
+    # this has to be fixed manually, so for now, sill a failing test
+    describe Running failed 'missing basic chains'
+    register_test retvalshouldbe 1
+    run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Fixing final situation
+    echo 'hook input' >/etc/nftables.rules
+    echo 'hook output' >>/etc/nftables.rules
+    echo 'hook forward' >>/etc/nftables.rules
+
+    describe Running success
+    register_test retvalshouldbe 0
+    run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean test
+    rm -f /etc/nftables.conf /etc/nftables.rules
+
+}