puppetlabs-firewall/spec/acceptance/params_spec.rb at master · jonnytdevops/puppetlabs-firewall · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
require 'spec_helper_acceptance'

describe "param based tests:", :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
  it 'test various params', :unless => (default['platform'].match(/el-5/) || fact('operatingsystem') == 'SLES') do
    iptables_flush_all_tables

    ppm = <<-EOS
    firewall { '100 test':
      table     => 'raw',
      socket    => 'true',
      chain     => 'PREROUTING',
      jump      => 'LOG',
      log_level => 'debug',
    }
    EOS

    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero
  end

  it 'test log rule' do
    iptables_flush_all_tables

    ppm = <<-EOS
    firewall { '998 log all':
      proto     => 'all',
      jump      => 'LOG',
      log_level => 'debug',
    }
    EOS
    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero
  end

  it 'test log rule - changing names' do
    iptables_flush_all_tables

    ppm1 = <<-EOS
    firewall { '004 log all INVALID packets':
      chain      => 'INPUT',
      proto      => 'all',
      ctstate    => 'INVALID',
      jump       => 'LOG',
      log_level  => '3',
      log_prefix => 'IPTABLES dropped invalid: ',
    }
    EOS

    ppm2 = <<-EOS
    firewall { '003 log all INVALID packets':
      chain      => 'INPUT',
      proto      => 'all',
      ctstate    => 'INVALID',
      jump       => 'LOG',
      log_level  => '3',
      log_prefix => 'IPTABLES dropped invalid: ',
    }
    EOS

    expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to eq(2)

    ppm = <<-EOS + "\n" + ppm2
      resources { 'firewall':
        purge => true,
      }
    EOS
    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
  end

  it 'test chain - changing names' do
    iptables_flush_all_tables

    ppm1 = <<-EOS
    firewall { '004 with a chain':
      chain => 'INPUT',
      proto => 'all',
    }
    EOS

    ppm2 = <<-EOS
    firewall { '004 with a chain':
      chain => 'OUTPUT',
      proto => 'all',
    }
    EOS

    apply_manifest(ppm1, :expect_changes => true)

    ppm = <<-EOS + "\n" + ppm2
      resources { 'firewall':
        purge => true,
      }
    EOS
    expect(apply_manifest(ppm2, :expect_failures => true).stderr).to match(/is not supported/)
  end

  it 'test log rule - idempotent' do
    iptables_flush_all_tables

    ppm1 = <<-EOS
    firewall { '004 log all INVALID packets':
      chain      => 'INPUT',
      proto      => 'all',
      ctstate    => 'INVALID',
      jump       => 'LOG',
      log_level  => '3',
      log_prefix => 'IPTABLES dropped invalid: ',
    }
    EOS

    expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to eq(2)
    expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to be_zero
  end

  it 'test src_range rule' do
    iptables_flush_all_tables

    ppm = <<-EOS
    firewall { '997 block src ip range':
      chain     => 'INPUT',
      proto     => 'all',
      action    => 'drop',
      src_range => '10.0.0.1-10.0.0.10',
    }
    EOS

    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero
  end

  it 'test dst_range rule' do
    iptables_flush_all_tables

    ppm = <<-EOS
    firewall { '998 block dst ip range':
      chain     => 'INPUT',
      proto     => 'all',
      action    => 'drop',
      dst_range => '10.0.0.2-10.0.0.20',
    }
    EOS

    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero
  end

end