Added 2 rules for 15 related to nftables

controls/cis_sle15.yml

@@ -965,6 +965,16 @@ controls:
     rules:
       - package_firewalld_installed
 
+  - id: 3.5.1.2
+    title: Ensure nftables is not installed or stopped and masked (Automated)
+    levels:
+      - l1_server
+      - l1_workstation
+    status: automated
+    rules:
+      - package_nftables_removed
+      - service_nftables_disabled
+
   - id: 3.5.2.1
     title: Ensure nftables is installed (Automated)
     levels:

linux_os/guide/system/network/network-nftables/package_nftables_removed/rule.yml

@@ -0,0 +1,31 @@
+documentation_complete: true
+
+prodtype: sle15
+
+title: 'Uninstall nftables package'
+
+description: |-
+    nftables is a subsystem of the Linux kernel providing filtering and classification of network
+    packets/datagrams/frames and is the successor to iptables.
+    {{{ describe_package_remove(package="nftables") }}}
+
+rationale: |-
+    Running both <tt>firewalld</tt> and <tt>nftables</tt> may lead to conflict.
+
+severity: medium
+
+identifiers:
+    cce@sle15: CCE-92518-0
+
+references:
+    cis@sle15: 3.5.1.2
+
+
+{{{ complete_ocil_entry_package(package="nftables") }}}
+
+fixtext: '{{{ fixtext_package_removed("nftables") }}}'
+
+template:
+    name: package_removed
+    vars:
+        pkgname: nftables

linux_os/guide/system/network/network-nftables/service_nftables_disabled/rule.yml

@@ -0,0 +1,38 @@
+documentation_complete: true
+
+prodtype: sle15
+
+title: 'Verify nftables service disabled'
+
+description: |-
+    nftables is a subsystem of the Linux kernel providing filtering and classification of network
+    packets/datagrams/frames and is the successor to iptables.
+    {{{ describe_package_remove(package="nftables") }}}
+
+rationale: |-
+    Running both <tt>firewalld</tt> and <tt>nftables</tt> may lead to conflict.
+
+severity: medium
+
+identifiers:
+    cce@sle15: CCE-92529-7
+
+references:
+    cis@sle15: 3.5.1.2
+
+
+ocil_clause: |-
+    {{{ ocil_clause_service_disabled(service="nftables") }}}
+
+ocil: |-
+    {{{ ocil_service_disabled(service="nftables") }}}
+
+fixtext: '{{{ fixtext_service_disabled("nftables") }}}'
+
+platform: machine
+
+template:
+    name: service_disabled
+    vars:
+        servicename: nftables
+        packagename: nftables

shared/references/cce-sle15-avail.txt

@@ -39,7 +39,6 @@ CCE-92514-9
 CCE-92515-6
 CCE-92516-4
 CCE-92517-2
-CCE-92518-0
 CCE-92519-8
 CCE-92520-6
 CCE-92521-4
@@ -50,7 +49,6 @@ CCE-92525-5
 CCE-92526-3
 CCE-92527-1
 CCE-92528-9
-CCE-92529-7
 CCE-92530-5
 CCE-92531-3
 CCE-92532-1