| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,182 @@ | ||
| require 'spec_helper_acceptance' | ||
|
|
||
| describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do | ||
|
|
||
| describe 'reset' do | ||
| it 'deletes all iptables rules' do | ||
| shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush') | ||
| end | ||
| it 'deletes all ip6tables rules' do | ||
| shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush') | ||
| end | ||
| end | ||
|
|
||
| describe 'iptables physdev tests' do | ||
| context 'physdev_in eth0' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '701 - test': | ||
| chain => 'FORWARD', | ||
| proto => tcp, | ||
| port => '701', | ||
| action => accept, | ||
| physdev_in => 'eth0', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('iptables-save') do |r| | ||
| expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 -m multiport --ports 701 -m comment --comment "701 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'physdev_out eth1' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '702 - test': | ||
| chain => 'FORWARD', | ||
| proto => tcp, | ||
| port => '702', | ||
| action => accept, | ||
| physdev_out => 'eth1', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('iptables-save') do |r| | ||
| expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-out eth1 -m multiport --ports 702 -m comment --comment "702 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'physdev_in eth0 and physdev_out eth1' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '703 - test': | ||
| chain => 'FORWARD', | ||
| proto => tcp, | ||
| port => '703', | ||
| action => accept, | ||
| physdev_in => 'eth0', | ||
| physdev_out => 'eth1', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('iptables-save') do |r| | ||
| expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 -m multiport --ports 703 -m comment --comment "703 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
| end | ||
|
|
||
| #iptables version 1.3.5 is not suppored by the ip6tables provider | ||
| if default['platform'] !~ /el-5/ | ||
| describe 'ip6tables physdev tests' do | ||
| context 'physdev_in eth0' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '701 - test': | ||
| provider => 'ip6tables', | ||
| chain => 'FORWARD', | ||
| proto => tcp, | ||
| port => '701', | ||
| action => accept, | ||
| physdev_in => 'eth0', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('ip6tables-save') do |r| | ||
| expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 -m multiport --ports 701 -m comment --comment "701 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'physdev_out eth1' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '702 - test': | ||
| provider => 'ip6tables', | ||
| chain => 'FORWARD', | ||
| proto => tcp, | ||
| port => '702', | ||
| action => accept, | ||
| physdev_out => 'eth1', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('ip6tables-save') do |r| | ||
| expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-out eth1 -m multiport --ports 702 -m comment --comment "702 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'physdev_in eth0 and physdev_out eth1' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '703 - test': | ||
| provider => 'ip6tables', | ||
| chain => 'FORWARD', | ||
| proto => tcp, | ||
| port => '703', | ||
| action => accept, | ||
| physdev_in => 'eth0', | ||
| physdev_out => 'eth1', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('ip6tables-save') do |r| | ||
| expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 -m multiport --ports 703 -m comment --comment "703 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
| end | ||
| end | ||
|
|
||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| require 'spec_helper_acceptance' | ||
|
|
||
| describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do | ||
|
|
||
| describe 'reset' do | ||
| it 'deletes all rules' do | ||
| shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush') | ||
| end | ||
| it 'deletes all ip6tables rules' do | ||
| shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush') | ||
| end | ||
| end | ||
|
|
||
| describe "uid tests" do | ||
| context 'uid set to root' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '801 - test': | ||
| chain => 'OUTPUT', | ||
| action => accept, | ||
| uid => 'root', | ||
| proto => 'all', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('iptables-save') do |r| | ||
| expect(r.stdout).to match(/-A OUTPUT -m owner --uid-owner (0|root) -m comment --comment "801 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'uid set to !root' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '802 - test': | ||
| chain => 'OUTPUT', | ||
| action => accept, | ||
| uid => '!root', | ||
| proto => 'all', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('iptables-save') do |r| | ||
| expect(r.stdout).to match(/-A OUTPUT -m owner ! --uid-owner (0|root) -m comment --comment "802 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'uid set to 0' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '803 - test': | ||
| chain => 'OUTPUT', | ||
| action => accept, | ||
| uid => '0', | ||
| proto => 'all', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('iptables-save') do |r| | ||
| expect(r.stdout).to match(/-A OUTPUT -m owner --uid-owner (0|root) -m comment --comment "803 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
|
|
||
| context 'uid set to !0' do | ||
| it 'applies' do | ||
| pp = <<-EOS | ||
| class { '::firewall': } | ||
| firewall { '804 - test': | ||
| chain => 'OUTPUT', | ||
| action => accept, | ||
| uid => '!0', | ||
| proto => 'all', | ||
| } | ||
| EOS | ||
|
|
||
| apply_manifest(pp, :catch_failures => true) | ||
| unless fact('selinux') == 'true' | ||
| apply_manifest(pp, :catch_changes => true) | ||
| end | ||
| end | ||
|
|
||
| it 'should contain the rule' do | ||
| shell('iptables-save') do |r| | ||
| expect(r.stdout).to match(/-A OUTPUT -m owner ! --uid-owner (0|root) -m comment --comment "804 - test" -j ACCEPT/) | ||
| end | ||
| end | ||
| end | ||
|
|
||
| end | ||
|
|
||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,100 @@ | ||
| require 'spec_helper' | ||
|
|
||
| describe "Facter::Util::Fact iptables_persistent_version" do | ||
|
|
||
|
|
||
| context "iptables-persistent applicable" do | ||
| before { Facter.clear } | ||
|
|
||
| let(:dpkg_cmd) { "dpkg-query -Wf '${Version}' iptables-persistent 2>/dev/null" } | ||
|
|
||
| { | ||
| "Debian" => "0.0.20090701", | ||
| "Ubuntu" => "0.5.3ubuntu2", | ||
| }.each do |os, ver| | ||
|
|
||
| if os == "Debian" | ||
| os_release = "7.0" | ||
| elsif os == "Ubuntu" | ||
| os_release = "14.04" | ||
| end | ||
|
|
||
| describe "#{os} package installed" do | ||
| before { | ||
| allow(Facter.fact(:operatingsystem)).to receive(:value).and_return(os) | ||
| allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return(os_release) | ||
| allow(Facter::Util::Resolution).to receive(:exec).with(dpkg_cmd). | ||
| and_return(ver) | ||
| } | ||
| it { Facter.fact(:iptables_persistent_version).value.should == ver } | ||
| end | ||
| end | ||
|
|
||
| describe 'Ubuntu package not installed' do | ||
| before { | ||
| allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Ubuntu') | ||
| allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return('14.04') | ||
| allow(Facter::Util::Resolution).to receive(:exec).with(dpkg_cmd). | ||
| and_return(nil) | ||
| } | ||
| it { Facter.fact(:iptables_persistent_version).value.should be_nil } | ||
| end | ||
|
|
||
| describe 'CentOS not supported' do | ||
| before { allow(Facter.fact(:operatingsystem)).to receive(:value). | ||
| and_return("CentOS") } | ||
| it { Facter.fact(:iptables_persistent_version).value.should be_nil } | ||
| end | ||
|
|
||
| end | ||
|
|
||
| context "netfilter-persistent applicable" do | ||
| before { Facter.clear } | ||
|
|
||
| let(:dpkg_cmd) { "dpkg-query -Wf '${Version}' netfilter-persistent 2>/dev/null" } | ||
|
|
||
| { | ||
| "Debian" => "0.0.20090701", | ||
| "Ubuntu" => "0.5.3ubuntu2", | ||
| }.each do |os, ver| | ||
|
|
||
| if os == "Debian" | ||
| os_release = "8.0" | ||
| elsif os == "Ubuntu" | ||
| os_release = "14.10" | ||
| end | ||
|
|
||
| describe "#{os} package installed" do | ||
| before { | ||
| allow(Facter.fact(:operatingsystem)).to receive(:value).and_return(os) | ||
| allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return(os_release) | ||
| allow(Facter::Util::Resolution).to receive(:exec).with(dpkg_cmd). | ||
| and_return(ver) | ||
| } | ||
| it { Facter.fact(:iptables_persistent_version).value.should == ver } | ||
| end | ||
| end | ||
|
|
||
| describe 'Ubuntu package not installed' do | ||
| os_release = "14.10" | ||
| before { | ||
| allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Ubuntu') | ||
| allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return(os_release) | ||
| allow(Facter::Util::Resolution).to receive(:exec).with(dpkg_cmd). | ||
| and_return(nil) | ||
| } | ||
| it { Facter.fact(:iptables_persistent_version).value.should be_nil } | ||
| end | ||
|
|
||
| describe 'CentOS not supported' do | ||
| before { allow(Facter.fact(:operatingsystem)).to receive(:value). | ||
| and_return("CentOS") } | ||
| it { Facter.fact(:iptables_persistent_version).value.should be_nil } | ||
| end | ||
|
|
||
| end | ||
|
|
||
|
|
||
|
|
||
|
|
||
| end |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| #!/usr/bin/env rspec | ||
|
|
||
| require 'spec_helper' | ||
| if Puppet.version < '3.4.0' | ||
| require 'puppet/provider/confine/exists' | ||
| else | ||
| require 'puppet/confine/exists' | ||
| end | ||
| provider_class = Puppet::Type.type(:firewall).provider(:ip6tables) | ||
| describe 'ip6tables' do | ||
| let(:params) { {:name => '000 test foo', :action => 'accept'} } | ||
| let(:provider) { provider_class } | ||
| let(:resource) { Puppet::Type.type(:firewall) } | ||
| let(:ip6tables_version) { '1.4.0' } | ||
|
|
||
| before :each do | ||
|
|
||
| end | ||
|
|
||
| def stub_iptables | ||
| allow(Puppet::Type::Firewall).to receive(:defaultprovider).and_return provider | ||
| # Stub confine facts | ||
| allow(provider).to receive(:command).with(:iptables_save).and_return "/sbin/iptables-save" | ||
|
|
||
| allow(Facter.fact(:kernel)).to receive(:value).and_return('Linux') | ||
| allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Debian') | ||
| allow(Facter.fact('ip6tables_version')).to receive(:value).and_return(ip6tables_version) | ||
| allow(Puppet::Util::Execution).to receive(:execute).and_return "" | ||
| allow(Puppet::Util).to receive(:which).with("iptables-save"). | ||
| and_return "/sbin/iptables-save" | ||
| end | ||
|
|
||
| shared_examples 'raise error' do | ||
| it { | ||
| stub_iptables | ||
| expect { | ||
| provider.new(resource.new(params)) | ||
| }.to raise_error(Puppet::DevError, error_message) | ||
| } | ||
| end | ||
| shared_examples 'run' do | ||
| it { | ||
| stub_iptables | ||
| provider.new(resource.new(params)) | ||
| } | ||
| end | ||
| context 'iptables 1.3' do | ||
| let(:params) { {:name => '000 test foo', :action => 'accept'} } | ||
| let(:error_message) { /The ip6tables provider is not supported on version 1\.3 of iptables/ } | ||
| let(:ip6tables_version) { '1.3.10' } | ||
| it_should_behave_like 'raise error' | ||
| end | ||
| context 'ip6tables nil' do | ||
| let(:params) { {:name => '000 test foo', :action => 'accept'} } | ||
| let(:error_message) { /The ip6tables provider is not supported on version 1\.3 of iptables/ } | ||
| let(:ip6tables_version) { nil } | ||
| it_should_behave_like 'run' | ||
| end | ||
|
|
||
|
|
||
| end |