puppetlabs-firewall/spec/acceptance/firewall_uid_spec.rb at master · jonnytdevops/puppetlabs-firewall · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
require 'spec_helper_acceptance'

describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do

  describe 'reset' do
    it 'deletes all rules' do
      shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
    end
    it 'deletes all ip6tables rules' do
      shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
    end
  end

  describe "uid tests" do
    context 'uid set to root' do
      it 'applies' do
        pp = <<-EOS
          class { '::firewall': }
          firewall { '801 - test':
            chain => 'OUTPUT',
            action => accept,
            uid => 'root',
            proto => 'all',
          }
        EOS

        apply_manifest(pp, :catch_failures => true)
        unless fact('selinux') == 'true'
          apply_manifest(pp, :catch_changes => true)
        end
      end

      it 'should contain the rule' do
         shell('iptables-save') do |r|
           expect(r.stdout).to match(/-A OUTPUT -m owner --uid-owner (0|root) -m comment --comment "801 - test" -j ACCEPT/)
         end
      end
    end

    context 'uid set to !root' do
      it 'applies' do
        pp = <<-EOS
          class { '::firewall': }
          firewall { '802 - test':
            chain => 'OUTPUT',
            action => accept,
            uid => '!root',
            proto => 'all',
          }
        EOS

        apply_manifest(pp, :catch_failures => true)
        unless fact('selinux') == 'true'
          apply_manifest(pp, :catch_changes => true)
        end
      end

      it 'should contain the rule' do
         shell('iptables-save') do |r|
           expect(r.stdout).to match(/-A OUTPUT -m owner ! --uid-owner (0|root) -m comment --comment "802 - test" -j ACCEPT/)
         end
      end
    end

    context 'uid set to 0' do
      it 'applies' do
        pp = <<-EOS
          class { '::firewall': }
          firewall { '803 - test':
            chain => 'OUTPUT',
            action => accept,
            uid => '0',
            proto => 'all',
          }
        EOS

        apply_manifest(pp, :catch_failures => true)
        unless fact('selinux') == 'true'
          apply_manifest(pp, :catch_changes => true)
        end
      end

      it 'should contain the rule' do
         shell('iptables-save') do |r|
           expect(r.stdout).to match(/-A OUTPUT -m owner --uid-owner (0|root) -m comment --comment "803 - test" -j ACCEPT/)
         end
      end
    end

    context 'uid set to !0' do
      it 'applies' do
        pp = <<-EOS
          class { '::firewall': }
          firewall { '804 - test':
            chain => 'OUTPUT',
            action => accept,
            uid => '!0',
            proto => 'all',
          }
        EOS

        apply_manifest(pp, :catch_failures => true)
        unless fact('selinux') == 'true'
          apply_manifest(pp, :catch_changes => true)
        end
      end

      it 'should contain the rule' do
         shell('iptables-save') do |r|
           expect(r.stdout).to match(/-A OUTPUT -m owner ! --uid-owner (0|root) -m comment --comment "804 - test" -j ACCEPT/)
         end
      end
    end

  end

end