nftables: Fix table name scoping issue.

Signed-off-by: James Antill <james@and.org>

roles/base/templates/nftables/_nft_accept_beg

@@ -2,12 +2,6 @@
 # _nft_accept_beg
 # Setup an ip filter table with default accept policy, and the std. allow rules.
 
-# Set small Table Names.
-# We need the big global ones so we can use them in *_rules but, that would be
-# a lot in these files.
-{% set _tn = nft_table_filter %}
-{% set _tnat = nft_table_nat %}
-
 add table {{_tn}}
 add chain {{_tn}}   INPUT { type filter hook input priority 0; policy accept; }
 add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; }

roles/base/templates/nftables/_nft_drop_beg

@@ -5,12 +5,6 @@
 # Note that there's no _nft_drop_end because _nft_accept_end drops everything
 # and we don't need that.
 
-# Set small Table Names.
-# We need the big global ones so we can use them in *_rules but, that would be
-# a lot in these files.
-{% set _tn = nft_table_filter %}
-{% set _tnat = nft_table_nat %}
-
 add table {{_tn}}
 add chain {{_tn}}   INPUT { type filter hook input priority 0; policy drop; }
 add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy drop; }

roles/base/templates/nftables/nftables

@@ -1,6 +1,15 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+# NOTE: This needs to be done at the top level because include inherits
+#       variables, but set variables don't escape.
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+
 {% include '_nft_accept_beg' %}
 
 {% include '_nft_accept_std' %}

roles/base/templates/nftables/nftables.bastion

@@ -1,6 +1,13 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+
 {% include '_nft_accept_beg' %}
 
 {% include '_nft_accept_std' %}

roles/base/templates/nftables/nftables.kojibuilder

@@ -1,6 +1,13 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+
 {% include '_nft_drop_beg' %}
 
 {% include '_nft_drop_std' %}

roles/base/templates/nftables/nftables.osuosl

@@ -1,6 +1,13 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+
 {% include '_nft_accept_beg' %}
 
 {% include '_nft_accept_std' %}

roles/base/templates/nftables/nftables.sign

@@ -1,6 +1,13 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+
 {% include '_nft_accept_beg' %}
 
 {% include '_nft_accept_std' %}

roles/base/templates/nftables/nftables.staging

@@ -1,6 +1,13 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+
 {% include '_nft_accept_beg' %}
 
 {% include '_nft_accept_std' %}

roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org

@@ -1,6 +1,13 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+
 {% include '_nft_accept_beg' %}
 
 {% include '_nft_accept_std' %}

roles/base/templates/nftables/nftables.torrent02.fedoraproject.org

@@ -1,6 +1,13 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+# Set small Table Names.
+# We need the big global ones so we can use them in *_rules but, that would be
+# a lot in these files.
+{% set _tn = nft_table_filter %}
+{% set _tnat = nft_table_nat %}
+
+
 {% include '_nft_accept_beg' %}
 
 {% include '_nft_accept_std' %}