1+ require 'spec_helper_acceptance'
2+
3+ describe 'firewall type' , :unless => UNSUPPORTED_PLATFORMS . include? ( fact ( 'osfamily' ) ) do
4+
5+ describe 'reset' do
6+ it 'deletes all iptables rules' do
7+ shell ( 'iptables --flush; iptables -t nat --flush; iptables -t mangle --flush' )
8+ end
9+ it 'deletes all ip6tables rules' do
10+ shell ( 'ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush' )
11+ end
12+ end
13+
14+ describe 'iptables physdev tests' do
15+ context 'physdev_in eth0' do
16+ it 'applies' do
17+ pp = <<-EOS
18+ class { '::firewall': }
19+ firewall { '701 - test':
20+ chain => 'FORWARD',
21+ proto => tcp,
22+ port => '701',
23+ action => accept,
24+ physdev_in => 'eth0',
25+ }
26+ EOS
27+
28+ apply_manifest ( pp , :catch_failures => true )
29+ unless fact ( 'selinux' ) == 'true'
30+ apply_manifest ( pp , :catch_changes => true )
31+ end
32+ end
33+
34+ it 'should contain the rule' do
35+ shell ( 'iptables-save' ) do |r |
36+ expect ( r . stdout ) . to match ( /-A FORWARD -p tcp -m physdev\s +--physdev-in eth0 -m multiport --ports 701 -m comment --comment "701 - test" -j ACCEPT/ )
37+ end
38+ end
39+ end
40+
41+ context 'physdev_out eth1' do
42+ it 'applies' do
43+ pp = <<-EOS
44+ class { '::firewall': }
45+ firewall { '702 - test':
46+ chain => 'FORWARD',
47+ proto => tcp,
48+ port => '702',
49+ action => accept,
50+ physdev_out => 'eth1',
51+ }
52+ EOS
53+
54+ apply_manifest ( pp , :catch_failures => true )
55+ unless fact ( 'selinux' ) == 'true'
56+ apply_manifest ( pp , :catch_changes => true )
57+ end
58+ end
59+
60+ it 'should contain the rule' do
61+ shell ( 'iptables-save' ) do |r |
62+ expect ( r . stdout ) . to match ( /-A FORWARD -p tcp -m physdev\s +--physdev-out eth1 -m multiport --ports 702 -m comment --comment "702 - test" -j ACCEPT/ )
63+ end
64+ end
65+ end
66+
67+ context 'physdev_in eth0 and physdev_out eth1' do
68+ it 'applies' do
69+ pp = <<-EOS
70+ class { '::firewall': }
71+ firewall { '703 - test':
72+ chain => 'FORWARD',
73+ proto => tcp,
74+ port => '703',
75+ action => accept,
76+ physdev_in => 'eth0',
77+ physdev_out => 'eth1',
78+ }
79+ EOS
80+
81+ apply_manifest ( pp , :catch_failures => true )
82+ unless fact ( 'selinux' ) == 'true'
83+ apply_manifest ( pp , :catch_changes => true )
84+ end
85+ end
86+
87+ it 'should contain the rule' do
88+ shell ( 'iptables-save' ) do |r |
89+ expect ( r . stdout ) . to match ( /-A FORWARD -p tcp -m physdev\s +--physdev-in eth0 --physdev-out eth1 -m multiport --ports 703 -m comment --comment "703 - test" -j ACCEPT/ )
90+ end
91+ end
92+ end
93+ end
94+
95+ #iptables version 1.3.5 is not suppored by the ip6tables provider
96+ if default [ 'platform' ] !~ /el-5/
97+ describe 'ip6tables physdev tests' do
98+ context 'physdev_in eth0' do
99+ it 'applies' do
100+ pp = <<-EOS
101+ class { '::firewall': }
102+ firewall { '701 - test':
103+ provider => 'ip6tables',
104+ chain => 'FORWARD',
105+ proto => tcp,
106+ port => '701',
107+ action => accept,
108+ physdev_in => 'eth0',
109+ }
110+ EOS
111+
112+ apply_manifest ( pp , :catch_failures => true )
113+ unless fact ( 'selinux' ) == 'true'
114+ apply_manifest ( pp , :catch_changes => true )
115+ end
116+ end
117+
118+ it 'should contain the rule' do
119+ shell ( 'ip6tables-save' ) do |r |
120+ expect ( r . stdout ) . to match ( /-A FORWARD -p tcp -m physdev\s +--physdev-in eth0 -m multiport --ports 701 -m comment --comment "701 - test" -j ACCEPT/ )
121+ end
122+ end
123+ end
124+
125+ context 'physdev_out eth1' do
126+ it 'applies' do
127+ pp = <<-EOS
128+ class { '::firewall': }
129+ firewall { '702 - test':
130+ provider => 'ip6tables',
131+ chain => 'FORWARD',
132+ proto => tcp,
133+ port => '702',
134+ action => accept,
135+ physdev_out => 'eth1',
136+ }
137+ EOS
138+
139+ apply_manifest ( pp , :catch_failures => true )
140+ unless fact ( 'selinux' ) == 'true'
141+ apply_manifest ( pp , :catch_changes => true )
142+ end
143+ end
144+
145+ it 'should contain the rule' do
146+ shell ( 'ip6tables-save' ) do |r |
147+ expect ( r . stdout ) . to match ( /-A FORWARD -p tcp -m physdev\s +--physdev-out eth1 -m multiport --ports 702 -m comment --comment "702 - test" -j ACCEPT/ )
148+ end
149+ end
150+ end
151+
152+ context 'physdev_in eth0 and physdev_out eth1' do
153+ it 'applies' do
154+ pp = <<-EOS
155+ class { '::firewall': }
156+ firewall { '703 - test':
157+ provider => 'ip6tables',
158+ chain => 'FORWARD',
159+ proto => tcp,
160+ port => '703',
161+ action => accept,
162+ physdev_in => 'eth0',
163+ physdev_out => 'eth1',
164+ }
165+ EOS
166+
167+ apply_manifest ( pp , :catch_failures => true )
168+ unless fact ( 'selinux' ) == 'true'
169+ apply_manifest ( pp , :catch_changes => true )
170+ end
171+ end
172+
173+ it 'should contain the rule' do
174+ shell ( 'ip6tables-save' ) do |r |
175+ expect ( r . stdout ) . to match ( /-A FORWARD -p tcp -m physdev\s +--physdev-in eth0 --physdev-out eth1 -m multiport --ports 703 -m comment --comment "703 - test" -j ACCEPT/ )
176+ end
177+ end
178+ end
179+ end
180+ end
181+
182+ end
0 commit comments