diff options
Diffstat (limited to 'spec/classes/tripleo_firewall_spec.rb')
| -rw-r--r-- | spec/classes/tripleo_firewall_spec.rb | 87 |
1 files changed, 72 insertions, 15 deletions
diff --git a/spec/classes/tripleo_firewall_spec.rb b/spec/classes/tripleo_firewall_spec.rb index 3116a51..92b51e5 100644 --- a/spec/classes/tripleo_firewall_spec.rb +++ b/spec/classes/tripleo_firewall_spec.rb @@ -34,35 +34,65 @@ describe 'tripleo::firewall' do end it 'configure basic pre firewall rules' do - is_expected.to contain_firewall('000 accept related established rules').with( + is_expected.to contain_firewall('000 accept related established rules ipv4').with( :proto => 'all', :state => ['RELATED', 'ESTABLISHED'], :action => 'accept', ) - is_expected.to contain_firewall('001 accept all icmp').with( + is_expected.to contain_firewall('000 accept related established rules ipv6').with( + :proto => 'all', + :state => ['RELATED', 'ESTABLISHED'], + :action => 'accept', + :provider => 'ip6tables', + ) + is_expected.to contain_firewall('001 accept all icmp ipv4').with( :proto => 'icmp', :action => 'accept', :state => ['NEW'], ) - is_expected.to contain_firewall('002 accept all to lo interface').with( + is_expected.to contain_firewall('001 accept all icmp ipv6').with( + :proto => 'ipv6-icmp', + :action => 'accept', + :state => ['NEW'], + :provider => 'ip6tables', + ) + is_expected.to contain_firewall('002 accept all to lo interface ipv4').with( :proto => 'all', :iniface => 'lo', :action => 'accept', :state => ['NEW'], ) - is_expected.to contain_firewall('003 accept ssh').with( + is_expected.to contain_firewall('002 accept all to lo interface ipv6').with( + :proto => 'all', + :iniface => 'lo', + :action => 'accept', + :state => ['NEW'], + :provider => 'ip6tables', + ) + is_expected.to contain_firewall('003 accept ssh ipv4').with( :dport => '22', :proto => 'tcp', :action => 'accept', :state => ['NEW'], ) + is_expected.to contain_firewall('003 accept ssh ipv6').with( + :dport => '22', + :proto => 'tcp', + :action => 'accept', + :state => ['NEW'], + :provider => 'ip6tables', + ) end it 'configure basic post firewall rules' do - is_expected.to contain_firewall('999 drop all').with( + is_expected.to contain_firewall('999 drop all ipv4').with( :proto => 'all', :action => 'drop', - :source => '0.0.0.0/0', + ) + is_expected.to contain_firewall('999 drop all ipv6').with( + :proto => 'all', + :action => 'drop', + :provider => 'ip6tables', ) end end @@ -74,44 +104,71 @@ describe 'tripleo::firewall' do :firewall_rules => { '300 add custom application 1' => {'port' => '999', 'proto' => 'udp', 'action' => 'accept'}, '301 add custom application 2' => {'port' => '8081', 'proto' => 'tcp', 'action' => 'accept'}, - '302 fwd custom cidr 1' => {'chain' => 'FORWARD', 'destination' => '192.0.2.0/24'}, + '302 fwd custom cidr 1' => {'port' => 'all', 'chain' => 'FORWARD', 'destination' => '192.0.2.0/24'}, '303 add custom application 3' => {'dport' => '8081', 'proto' => 'tcp', 'action' => 'accept'}, '304 add custom application 4' => {'sport' => '1000', 'proto' => 'tcp', 'action' => 'accept'}, - '305 add gre rule' => {'proto' => 'gre'} + '305 add gre rule' => {'proto' => 'gre'}, + '306 add custom cidr 2' => {'port' => 'all', 'destination' => '::1/24'}, } ) end it 'configure custom firewall rules' do - is_expected.to contain_firewall('300 add custom application 1').with( + is_expected.to contain_firewall('300 add custom application 1 ipv4').with( :port => '999', :proto => 'udp', :action => 'accept', :state => ['NEW'], ) - is_expected.to contain_firewall('301 add custom application 2').with( + is_expected.to contain_firewall('301 add custom application 2 ipv4').with( :port => '8081', :proto => 'tcp', :action => 'accept', :state => ['NEW'], ) - is_expected.to contain_firewall('302 fwd custom cidr 1').with( + is_expected.to contain_firewall('302 fwd custom cidr 1 ipv4').with( :chain => 'FORWARD', - :destination => '192.0.2.0/24', + :proto => 'tcp', + :destination => '192.0.2.0/24', ) - is_expected.to contain_firewall('303 add custom application 3').with( + is_expected.to_not contain_firewall('302 fwd custom cidr 1 ipv6') + is_expected.to contain_firewall('303 add custom application 3 ipv4').with( :dport => '8081', :proto => 'tcp', :action => 'accept', :state => ['NEW'], ) - is_expected.to contain_firewall('304 add custom application 4').with( + is_expected.to contain_firewall('304 add custom application 4 ipv4').with( :sport => '1000', :proto => 'tcp', :action => 'accept', :state => ['NEW'], ) - is_expected.to contain_firewall('305 add gre rule').without(:state) + is_expected.to contain_firewall('304 add custom application 4 ipv6').with( + :sport => '1000', + :proto => 'tcp', + :action => 'accept', + :state => ['NEW'], + ) + is_expected.to contain_firewall('305 add gre rule ipv4').without(:state) + is_expected.to contain_firewall('306 add custom cidr 2 ipv6').with( + :proto => 'tcp', + :destination => '::1/24', + :action => 'accept', + :provider => 'ip6tables', + ) + end + end + + context 'with TCP rule without port or dport or sport specified' do + before :each do + params.merge!( + :manage_firewall => true, + :firewall_rules => { + '500 wrong tcp rule' => {'proto' => 'tcp', 'action' => 'accept'}, + } + ) end + it_raises 'a Puppet::Error', /500 wrong tcp rule firewall rule cannot be created. TCP or UDP rules for INPUT or OUTPUT need port or sport or dport./ end end |