feat: add debian12 scripts (#293)

- nftables_is_enabled.sh 		-> 4.2.9
- nftables_has_table.sh 		-> 4.2.4
- nftables_has_base_chains.sh 		-> 4.2.5
- nftables_rules_permanent.sh		-> 4.2.10
- nftables_default_deniy_policy.sh	-> 4.2.8

Co-authored-by: damien cavagnini <damien.cavagnini@corp.ovh.com>

tests/hardening/nftables_default_deny_policy.sh

@@ -0,0 +1,16 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe Prepare test
+    apt install -y nftables
+
+    # running on a non privilieged container, wont test much...
+    describe Running on blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean test
+    apt remove -y nftables
+
+}

tests/hardening/nftables_has_base_chains.sh

@@ -0,0 +1,15 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe Prepare test
+    apt install -y nftables
+
+    # running on a non privilieged container, wont test much...
+    describe Running on blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean test
+    apt remove -y nftables
+}

tests/hardening/nftables_has_table.sh

@@ -0,0 +1,16 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe Prepare test
+    apt install -y nftables
+
+    # running on a non privilieged container, wont test much...
+    describe Running on blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean test
+    apt remove -y nftables
+
+}

tests/hardening/nftables_is_enabled.sh

@@ -0,0 +1,10 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe Running on blank host
+    register_test retvalshouldbe 0
+    dismiss_count_for_test
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}

tests/hardening/nftables_not_installed_with_iptables.sh

@@ -2,23 +2,23 @@
 # run-shellcheck
 test_audit() {
     describe set up successful check
-    apt remove -y nftables
-    apt install -y iptables
+    apt install -y iptables nftables
 
-    describe Running success test
-    register_test retvalshouldbe 0
-    # shellcheck disable=2154
-    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
-
-    describe set up failed check
-    DEBIAN_FRONTEND='noninteractive' apt -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install nftables apt-utils -y
-
-    describe running failed check
+    describe Running failed test
     register_test retvalshouldbe 1
     # shellcheck disable=2154
     run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
 
-    apt remove -y nftables iptables
+    describe Fixing first situation
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+    "${CIS_CHECKS_DIR}/${script}.sh" || true
+
+    describe running success check
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    apt remove -y iptables
     apt autoremove -y
 
 }

tests/hardening/nftables_rules_permanent.sh

@@ -0,0 +1,36 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe prepare failing test
+    rm -f /etc/nftables.conf
+    touch /etc/nftables.conf
+    touch /etc/nftables.rules
+
+    describe Running failed 'missing include'
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Fixing first situation
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+    "${CIS_CHECKS_DIR}/${script}.sh" || true
+
+    # the 'include' part is fixed, but configuration is missing
+    # this has to be fixed manually, so for now, sill a failing test
+    describe Running failed 'missing basic chains'
+    register_test retvalshouldbe 1
+    run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Fixing final situation
+    echo 'hook input' >/etc/nftables.rules
+    echo 'hook output' >>/etc/nftables.rules
+    echo 'hook forward' >>/etc/nftables.rules
+
+    describe Running success
+    register_test retvalshouldbe 0
+    run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean test
+    rm -f /etc/nftables.conf /etc/nftables.rules
+
+}