From 060465a1b17e345df80797db7df2ccfe44028ec8 Mon Sep 17 00:00:00 2001
From: Paul Lecuq <paul@paulbsd.com>
Date: Sun, 2 Jan 2022 18:01:47 +0100
Subject: [PATCH] updated nftables state

---
 states/_modules/bl.py            | 15 +++++++++++++++
 states/nftables/blacklist.nft.j2 |  6 ++++++
 states/nftables/config.sls       |  2 --
 3 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 states/_modules/bl.py

diff --git a/states/_modules/bl.py b/states/_modules/bl.py
new file mode 100644
index 0000000..7d169d7
--- /dev/null
+++ b/states/_modules/bl.py
@@ -0,0 +1,15 @@
+#!/usr/bin/python3
+
+import json
+from urllib.request import urlopen, Request
+
+
+def get_ips(url="https://ipbl.paulbsd.com"):
+    """get_jobs fetch jobs from dkron"""
+    fullurl = f"{url}/ips"
+    req = Request(method="GET", url=fullurl)
+    res = urlopen(req)
+    results = json.loads(res.read())
+    if res.status == 200:
+        return results
+    return None
diff --git a/states/nftables/blacklist.nft.j2 b/states/nftables/blacklist.nft.j2
index a48ac11..d6a8354 100644
--- a/states/nftables/blacklist.nft.j2
+++ b/states/nftables/blacklist.nft.j2
@@ -1,2 +1,8 @@
 ## {{ salt['pillar.get']('salt_managed', default='Salt Managed') }}
+{% set blackips = salt["bl.get_ips"]() %}
+
+{% if len(blackips) > 0 %}
+define blacklist = { {% blackips.join(",") %} }
+{% else %}
 define blacklist = { 127.255.255.255 }
+{% endif %}
\ No newline at end of file
diff --git a/states/nftables/config.sls b/states/nftables/config.sls
index 1a28738..e847a7f 100644
--- a/states/nftables/config.sls
+++ b/states/nftables/config.sls
@@ -4,7 +4,6 @@ nftables-config-dir:
   file.directory:
     - name: {{ nftables.config_dir }}
 
-{%- if not salt['file.file_exists'](nftables.config_dir + "/blacklist.nft") %}
 nftables-blacklist-config:
   file.managed:
     - name: {{ nftables.config_dir }}/blacklist.nft
@@ -15,7 +14,6 @@ nftables-blacklist-config:
     - require:
       - pkg: nftables-pkg
       - file: nftables-config-dir
-{%- endif %}
 
 nftables-rules-config:
   file.managed: