bundles/nftables: store rules in dedicated files instead of nftables.conf

bundles/nftables/files/nftables.conf

@@ -19,14 +19,6 @@ table inet filter {
         ip protocol icmp accept
 
         ip6 nexthdr ipv6-icmp accept
-% for ruleset, rules in sorted(node.metadata.get('nftables/rules/input', {}).items()):
-
-        # ${ruleset}
-%  for rule in rules:
-        ${rule}
-%  endfor
-        # / ${ruleset}
-% endfor
     }
 
     chain output {
@@ -40,32 +32,15 @@ table inet filter {
 
         icmp type timestamp-request drop
         icmp type timestamp-reply drop
-
-% for ruleset, rules in sorted(node.metadata.get('nftables/rules/forward', {}).items()):
-
-        # ${ruleset}
-%  for rule in rules:
-        ${rule}
-%  endfor
-        # / ${ruleset}
-% endfor
     }
 }
 
 table nat {
     chain prerouting {
         type nat hook prerouting priority -100
-
-% for rule in sorted(node.metadata.get('nftables/rules/nat_prerouting', [])):
-        ${rule}
-% endfor
     }
     chain postrouting {
         type nat hook postrouting priority 100
-
-% for rule in sorted(node.metadata.get('nftables/rules/nat_postrouting', [])):
-        ${rule}
-% endfor
     }
 }
 

bundles/nftables/files/rules-template

@@ -0,0 +1,3 @@
+% for rule in rules:
+add rule ${rule}
+% endfor

bundles/nftables/items.py

@@ -15,7 +15,6 @@ directories = {
 
 files = {
     '/etc/nftables.conf': {
-        'content_type': 'mako',
         'needs': {
             'directory:/etc/nftables-rules.d',
         },
@@ -30,9 +29,23 @@ files = {
             'svc_systemd:nftables:reload',
         },
     },
-
 }
 
+for ruleset, rules in node.metadata.get('nftables/rules', {}).items():
+    files[f'/etc/nftables-rules.d/{ruleset}'] = {
+        'source': 'rules-template',
+        'content_type': 'mako',
+        'context': {
+            'rules': rules,
+        },
+        'needed_by': {
+            'svc_systemd:nftables',
+        },
+        'triggers': {
+            'svc_systemd:nftables:reload',
+        },
+    }
+
 svc_systemd = {
     'nftables': {
         'needs': {

bundles/nftables/metadata.py

@@ -9,12 +9,13 @@ defaults = {
     'pacman': {
         'packages': {
             'nftables': {},
-            'iptables': {
-                'installed': False,
-                'needed_by': {
-                    'pkg_pacman:iptables-nft',
-                },
-            },
+# https://github.com/bundlewrap/bundlewrap/issues/688
+#            'iptables': {
+#                'installed': False,
+#                'needed_by': {
+#                    'pkg_pacman:iptables-nft',
+#                },
+#            },
             'iptables-nft': {
                 'needed_by': {
                     'pkg_pacman:nftables',
@@ -34,7 +35,7 @@ if not node.has_bundle('vmhost'):
     }
 
 @metadata_reactor.provides(
-    'nftables/rules/input/port_rules',
+    'nftables/rules/99-port_rules',
 )
 def port_rules_to_nftables(metadata):
     # Using this, bundles can simply set up port based rules. This
@@ -63,36 +64,33 @@ def port_rules_to_nftables(metadata):
             if port != '*':
                 if ':' in port:
                     parts = port.split(':')
-                    port_str = f'dport {{ {parts[0]}-{parts[1]} }} '
+                    port_str = f'{proto} dport {{ {parts[0]}-{parts[1]} }}'
                 else:
-                    port_str = f'dport {port} '
-                prefix = ''
+                    port_str = f'{proto} dport {port}'
             else:
-                port_str = ''
-                prefix = 'meta l4proto '
+                port_str = f'meta l4proto {proto}'
 
-            if target == '*':
-                ruleset.add(f'{prefix}{proto} {port_str}accept {comment}')
-            elif target == 'ipv4':
-                ruleset.add(f'{prefix}{proto} {port_str}ip version 4 accept {comment}')
-            elif target == 'ipv6':
-                ruleset.add(f'{prefix}{proto} {port_str}ip6 version 6 accept {comment}')
+            if target in ('ipv4', 'ipv6'):
+                version_str = f'meta nfproto {target}'
+            else:
+                version_str = ''
+
+            if target in ('*', 'ipv4', 'ipv6'):
+                ruleset.add(f'inet filter input {version_str} {port_str} accept {comment}')
             else:
                 resolved = repo.libs.tools.resolve_identifier(repo, target)
 
                 for address in resolved['ipv4']:
-                    ruleset.add(f'{prefix}{proto} {port_str}ip saddr {address} accept {comment}')
+                    ruleset.add(f'inet filter input meta nfproto ipv4 {port_str} ip saddr {address} accept {comment}')
 
                 for address in resolved['ipv6']:
-                    ruleset.add(f'{prefix}{proto} {port_str}ip6 saddr {address} accept {comment}')
+                    ruleset.add(f'inet filter input meta nfproto ipv6 {port_str} ip6 saddr {address} accept {comment}')
 
     return {
         'nftables': {
             'rules': {
                 # order does not matter here.
-                'input': {
-                    'port_rules': sorted(ruleset),
-                },
+                '99-port_rules': sorted(ruleset),
             },
         },
     }