| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| class firewall::linux::archlinux ( | ||
| $ensure = 'running', | ||
| $enable = true | ||
| ) { | ||
| service { 'iptables': | ||
| ensure => $ensure, | ||
| enable => $enable, | ||
| } | ||
|
|
||
| service { 'ip6tables': | ||
| ensure => $ensure, | ||
| enable => $enable, | ||
| } | ||
|
|
||
| file { '/etc/iptables/iptables.rules': | ||
| ensure => present, | ||
| before => Service['iptables'], | ||
| } | ||
|
|
||
| file { '/etc/iptables/ip6tables.rules': | ||
| ensure => present, | ||
| before => Service['ip6tables'], | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,27 @@ | ||
| class firewall::linux::debian ( | ||
| $ensure = running, | ||
| $enable = true | ||
| ) { | ||
| package { 'iptables-persistent': | ||
| ensure => present, | ||
| } | ||
|
|
||
| if($operatingsystemrelease =~ /^6\./ and $enable == true) { | ||
| # This fixes a bug in the iptables-persistent LSB headers in 6.x, without it | ||
| # we lose idempotency | ||
| exec { 'iptables-persistent-enable': | ||
| logoutput => on_failure, | ||
| command => '/usr/sbin/update-rc.d iptables-persistent enable', | ||
| unless => '/usr/bin/test -f /etc/rcS.d/S*iptables-persistent', | ||
| require => Package['iptables-persistent'], | ||
| } | ||
| } else { | ||
| # This isn't a real service/daemon. The start action loads rules, so just | ||
| # needs to be called on system boot. | ||
| service { 'iptables-persistent': | ||
| ensure => undef, | ||
| enable => $enable, | ||
| require => Package['iptables-persistent'], | ||
| } | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,9 @@ | ||
| class firewall::linux::redhat ( | ||
| $ensure = running, | ||
| $enable = true | ||
| ) { | ||
| service { 'iptables': | ||
| ensure => $ensure, | ||
| enable => $enable, | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| # This helper file is specific to the system tests for puppetlabs-firewall | ||
| # and should be included by all tests under spec/system | ||
| require 'rspec-system/spec_helper' | ||
| require 'rspec-system-puppet/helpers' | ||
|
|
||
| # Just some helpers specific to this module | ||
| module LocalHelpers | ||
| # This helper flushes all tables on the default machine. | ||
| # | ||
| # It checks that the flush command returns with no errors. | ||
| # | ||
| # @return [void] | ||
| # @todo Need to optionally do the newer tables | ||
| # @example | ||
| # it 'should flush tables' do | ||
| # iptables_flush_all_tables | ||
| # end | ||
| def iptables_flush_all_tables | ||
| ['filter', 'nat', 'mangle', 'raw'].each do |t| | ||
| system_run("/sbin/iptables -t #{t} -F") do |r| | ||
| r[:exit_code].should == 0 | ||
| r[:stderr].should == '' | ||
| end | ||
| end | ||
| end | ||
| end | ||
|
|
||
| RSpec.configure do |c| | ||
| # Project root for the firewall code | ||
| proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) | ||
|
|
||
| # Enable colour in Jenkins | ||
| c.tty = true | ||
|
|
||
| # Import in our local helpers | ||
| c.include ::LocalHelpers | ||
|
|
||
| # This is where we 'setup' the nodes before running our tests | ||
| c.system_setup_block = proc do | ||
| # TODO: find a better way of importing this into this namespace | ||
| include RSpecSystemPuppet::Helpers | ||
|
|
||
| # Install puppet | ||
| puppet_install | ||
|
|
||
| # Copy this module into the module path of the test node | ||
| puppet_module_install(:source => proj_root, :module_name => 'firewall') | ||
| end | ||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| require 'spec_helper_system' | ||
|
|
||
| # Here we put the more basic fundamental tests, ultra obvious stuff. | ||
| describe "basic tests:" do | ||
| it 'make sure we have copied the module across' do | ||
| # No point diagnosing any more if the module wasn't copied properly | ||
| system_run("ls /etc/puppet/modules/firewall") do |r| | ||
| r[:exit_code].should == 0 | ||
| r[:stdout].should =~ /Modulefile/ | ||
| r[:stderr].should == '' | ||
| end | ||
| end | ||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| require 'spec_helper_system' | ||
|
|
||
| describe "firewall class:" do | ||
| context 'no params:' do | ||
| let(:pp) do | ||
| pp = <<-EOS.gsub(/^\s{8}/,'') | ||
| class { 'firewall': } | ||
| EOS | ||
| end | ||
|
|
||
| it "should run without event" do | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should_not eq(1) | ||
| end | ||
| end | ||
|
|
||
| it "should be idempotent" do | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should == 0 | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'ensure => stopped:' do | ||
| let(:pp) do | ||
| pp = <<-EOS.gsub(/^\s{8}/,'') | ||
| class { 'firewall': | ||
| ensure => stopped, | ||
| } | ||
| EOS | ||
| end | ||
|
|
||
| it "should run without event" do | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should_not eq(1) | ||
| end | ||
| end | ||
|
|
||
| it "should be idempotent" do | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should == 0 | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'ensure => running:' do | ||
| let(:pp) do | ||
| pp = <<-EOS.gsub(/^\s{8}/,'') | ||
| class { 'firewall': | ||
| ensure => running, | ||
| } | ||
| EOS | ||
| end | ||
|
|
||
| it "should run without event" do | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should_not eq(1) | ||
| end | ||
| end | ||
|
|
||
| it "should be idempotent" do | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should == 0 | ||
| end | ||
| end | ||
| end | ||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| require 'spec_helper_system' | ||
|
|
||
| describe "param based tests:" do | ||
| def pp(params) | ||
| pm = <<-EOS | ||
| firewall { '100 test': | ||
| EOS | ||
|
|
||
| params.each do |k,v| | ||
| pm += <<-EOS | ||
| #{k} => #{v}, | ||
| EOS | ||
| end | ||
|
|
||
| pm += <<-EOS | ||
| } | ||
| EOS | ||
| pm | ||
| end | ||
|
|
||
| it 'test socket param' do | ||
| facts = system_node.facts | ||
|
|
||
| unless (facts['operatingsystem'] == 'CentOS') && \ | ||
| facts['operatingsystemrelease'] =~ /^5\./ then | ||
|
|
||
| iptables_flush_all_tables | ||
|
|
||
| param = { | ||
| 'table' => "'raw'", | ||
| 'socket' => 'true', | ||
| 'chain' => "'PREROUTING'", | ||
| } | ||
| ppm = pp(param) | ||
| puppet_apply(ppm) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should == 2 | ||
| end | ||
|
|
||
| # check idempotency | ||
| puppet_apply(ppm) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should == 0 | ||
| end | ||
| end | ||
| end | ||
|
|
||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| require 'spec_helper_system' | ||
|
|
||
| describe "purge tests:" do | ||
| it 'make sure duplicate existing rules get purged' do | ||
| iptables_flush_all_tables | ||
|
|
||
| system_run('/sbin/iptables -A INPUT -s 1.2.1.2') | ||
| system_run('/sbin/iptables -A INPUT -s 1.2.1.2') | ||
| pp = <<-EOS | ||
| class { 'firewall': } | ||
| resources { 'firewall': | ||
| purge => true, | ||
| } | ||
| EOS | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should == 2 | ||
| end | ||
|
|
||
| system_run('/sbin/iptables-save') do |r| | ||
| r[:stdout].should_not =~ /1\.2\.1\.2/ | ||
| r[:stderr].should == '' | ||
| end | ||
| end | ||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| require 'spec_helper_system' | ||
|
|
||
| # Here we want to test the the resource commands ability to work with different | ||
| # existing ruleset scenarios. This will give the parsing capabilities of the | ||
| # code a good work out. | ||
| describe 'puppet resource firewall command:' do | ||
| it 'make sure it returns no errors when executed on a clean machine' do | ||
| puppet_resource('firewall') do |r| | ||
| r[:exit_code].should == 0 | ||
| # don't check stdout, some boxes come with rules, that is normal | ||
| r[:stderr].should == '' | ||
| end | ||
| end | ||
|
|
||
| it 'flush iptables and make sure it returns nothing afterwards' do | ||
| iptables_flush_all_tables | ||
|
|
||
| # No rules, means no output thanks. And no errors as well. | ||
| puppet_resource('firewall') do |r| | ||
| r[:exit_code].should == 0 | ||
| r[:stderr].should == '' | ||
| r[:stdout].should == "\n" | ||
| end | ||
| end | ||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| require 'spec_helper_system' | ||
|
|
||
| # Some tests for the standard recommended usage | ||
| describe "standard usage:" do | ||
| let(:pp) do | ||
| pp = <<-EOS | ||
| class my_fw::pre { | ||
| Firewall { | ||
| require => undef, | ||
| } | ||
| # Default firewall rules | ||
| firewall { '000 accept all icmp': | ||
| proto => 'icmp', | ||
| action => 'accept', | ||
| }-> | ||
| firewall { '001 accept all to lo interface': | ||
| proto => 'all', | ||
| iniface => 'lo', | ||
| action => 'accept', | ||
| }-> | ||
| firewall { '002 accept related established rules': | ||
| proto => 'all', | ||
| state => ['RELATED', 'ESTABLISHED'], | ||
| action => 'accept', | ||
| } | ||
| } | ||
| class my_fw::post { | ||
| firewall { '999 drop all': | ||
| proto => 'all', | ||
| action => 'drop', | ||
| before => undef, | ||
| } | ||
| } | ||
| resources { "firewall": | ||
| purge => true | ||
| } | ||
| Firewall { | ||
| before => Class['my_fw::post'], | ||
| require => Class['my_fw::pre'], | ||
| } | ||
| class { ['my_fw::pre', 'my_fw::post']: } | ||
| class { 'firewall': } | ||
| firewall { '500 open up port 22': | ||
| action => 'accept', | ||
| proto => 'tcp', | ||
| dport => 22, | ||
| } | ||
| EOS | ||
| end | ||
|
|
||
| it 'make sure it runs without error' do | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should_not eq(1) | ||
| end | ||
| end | ||
|
|
||
| it 'should be idempotent' do | ||
| puppet_apply(pp) do |r| | ||
| r[:stderr].should == '' | ||
| r[:exit_code].should == 0 | ||
| end | ||
| end | ||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| require 'spec_helper' | ||
|
|
||
| describe 'firewall::linux::archlinux', :type => :class do | ||
| it { should contain_service('iptables').with( | ||
| :ensure => 'running', | ||
| :enable => 'true' | ||
| )} | ||
| it { should contain_service('ip6tables').with( | ||
| :ensure => 'running', | ||
| :enable => 'true' | ||
| )} | ||
|
|
||
| context 'ensure => stopped' do | ||
| let(:params) {{ :ensure => 'stopped' }} | ||
| it { should contain_service('iptables').with( | ||
| :ensure => 'stopped' | ||
| )} | ||
| it { should contain_service('ip6tables').with( | ||
| :ensure => 'stopped' | ||
| )} | ||
| end | ||
|
|
||
| context 'enable => false' do | ||
| let(:params) {{ :enable => 'false' }} | ||
| it { should contain_service('iptables').with( | ||
| :enable => 'false' | ||
| )} | ||
| it { should contain_service('ip6tables').with( | ||
| :enable => 'false' | ||
| )} | ||
| end | ||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| require 'spec_helper' | ||
|
|
||
| describe 'firewall::linux::redhat', :type => :class do | ||
| it { should contain_service('iptables').with( | ||
| :ensure => 'running', | ||
| :enable => 'true' | ||
| )} | ||
|
|
||
| context 'ensure => stopped' do | ||
| let(:params) {{ :ensure => 'stopped' }} | ||
| it { should contain_service('iptables').with( | ||
| :ensure => 'stopped' | ||
| )} | ||
| end | ||
|
|
||
| context 'enable => false' do | ||
| let(:params) {{ :enable => 'false' }} | ||
| it { should contain_service('iptables').with( | ||
| :enable => 'false' | ||
| )} | ||
| end | ||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| require 'spec_helper' | ||
|
|
||
| describe 'firewall', :type => :class do | ||
| context 'kernel => Linux' do | ||
| let(:facts) {{ :kernel => 'Linux' }} | ||
| it { should contain_class('firewall::linux').with_ensure('running') } | ||
| end | ||
|
|
||
| context 'kernel => Windows' do | ||
| let(:facts) {{ :kernel => 'Windows' }} | ||
| it { expect { should include_class('firewall::linux') }.to raise_error(Puppet::Error) } | ||
| end | ||
|
|
||
| context 'ensure => stopped' do | ||
| let(:facts) {{ :kernel => 'Linux' }} | ||
| let(:params) {{ :ensure => 'stopped' }} | ||
| it { should contain_class('firewall::linux').with_ensure('stopped') } | ||
| end | ||
|
|
||
| context 'ensure => test' do | ||
| let(:facts) {{ :kernel => 'Linux' }} | ||
| let(:params) {{ :ensure => 'test' }} | ||
| it { expect { should include_class('firewall::linux') }.to raise_error(Puppet::Error) } | ||
| end | ||
| end |