freighthop 0.3.3 → 0.4.0

data/modules/firewall/spec/acceptance/firewallchain_spec.rb

@@ -0,0 +1,125 @@
+require 'spec_helper_acceptance'
+
+describe 'puppet resource firewallchain command:' do
+  before :all do
+    iptables_flush_all_tables
+  end
+  describe 'ensure' do
+    context 'present' do
+      it 'applies cleanly' do
+        pp = <<-EOS
+          firewallchain { 'MY_CHAIN:filter:IPv4':
+            ensure  => present,
+          }
+        EOS
+        # Run it twice and test for idempotency
+        apply_manifest(pp, :catch_failures => true)
+        apply_manifest(pp, :catch_changes => true)
+      end
+
+      it 'finds the chain' do
+        shell('iptables -S') do |r|
+          expect(r.stdout).to match(/-N MY_CHAIN/)
+        end
+      end
+    end
+
+    context 'absent' do
+      it 'applies cleanly' do
+        pp = <<-EOS
+          firewallchain { 'MY_CHAIN:filter:IPv4':
+            ensure  => absent,
+          }
+        EOS
+        # Run it twice and test for idempotency
+        apply_manifest(pp, :catch_failures => true)
+        apply_manifest(pp, :catch_changes => true)
+      end
+
+      it 'fails to find the chain' do
+        shell('iptables -S') do |r|
+          expect(r.stdout).to_not match(/-N MY_CHAIN/)
+        end
+      end
+    end
+  end
+
+  # XXX purge => false is not yet implemented
+  #context 'adding a firewall rule to a chain:' do
+  #  it 'applies cleanly' do
+  #    pp = <<-EOS
+  #      firewallchain { 'MY_CHAIN:filter:IPv4':
+  #        ensure  => present,
+  #      }
+  #      firewall { '100 my rule':
+  #        chain   => 'MY_CHAIN',
+  #        action  => 'accept',
+  #        proto   => 'tcp',
+  #        dport   => 5000,
+  #      }
+  #    EOS
+  #    # Run it twice and test for idempotency
+  #    apply_manifest(pp, :catch_failures => true)
+  #    apply_manifest(pp, :catch_changes => true)
+  #  end
+  #end
+
+  #context 'not purge firewallchain chains:' do
+  #  it 'does not purge the rule' do
+  #    pp = <<-EOS
+  #      firewallchain { 'MY_CHAIN:filter:IPv4':
+  #        ensure  => present,
+  #        purge   => false,
+  #        before  => Resources['firewall'],
+  #      }
+  #      resources { 'firewall':
+  #        purge => true,
+  #      }
+  #    EOS
+  #    # Run it twice and test for idempotency
+  #    apply_manifest(pp, :catch_failures => true) do |r|
+  #      expect(r.stdout).to_not match(/removed/)
+  #      expect(r.stderr).to eq('')
+  #    end
+  #    apply_manifest(pp, :catch_changes => true)
+  #  end
+
+  #  it 'still has the rule' do
+  #    pp = <<-EOS
+  #      firewall { '100 my rule':
+  #        chain   => 'MY_CHAIN',
+  #        action  => 'accept',
+  #        proto   => 'tcp',
+  #        dport   => 5000,
+  #      }
+  #    EOS
+  #    # Run it twice and test for idempotency
+  #    apply_manifest(pp, :catch_changes => true)
+  #  end
+  #end
+
+  describe 'policy' do
+    after :all do
+      shell('iptables -t filter -P FORWARD ACCEPT')
+    end
+
+    context 'DROP' do
+      it 'applies cleanly' do
+        pp = <<-EOS
+          firewallchain { 'FORWARD:filter:IPv4':
+            policy  => 'drop',
+          }
+        EOS
+        # Run it twice and test for idempotency
+        apply_manifest(pp, :catch_failures => true)
+        apply_manifest(pp, :catch_changes => true)
+      end
+
+      it 'finds the chain' do
+        shell('iptables -S') do |r|
+          expect(r.stdout).to match(/-P FORWARD DROP/)
+        end
+      end
+    end
+  end
+end

data/modules/firewall/spec/acceptance/ip6_fragment_spec.rb

@@ -0,0 +1,94 @@
+require 'spec_helper_acceptance'
+
+describe 'firewall ishasmorefrags/islastfrag/isfirstfrag properties' do
+  before :all do
+    ip6tables_flush_all_tables
+  end
+
+  shared_examples "is idempotent" do |values, line_match|
+    it "changes the values to #{values}" do
+      pp = <<-EOS
+          class { '::firewall': }
+          firewall { '599 - test':
+            ensure   => present,
+            proto    => 'tcp',
+            provider => 'ip6tables',
+            #{values}
+          }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+
+      shell('ip6tables -S') do |r|
+        expect(r.stdout).to match(/#{line_match}/)
+      end
+    end
+  end
+  shared_examples "doesn't change" do |values, line_match|
+    it "doesn't change the values to #{values}" do
+      pp = <<-EOS
+          class { '::firewall': }
+          firewall { '599 - test':
+            ensure   => present,
+            proto    => 'tcp',
+            provider => 'ip6tables',
+            #{values}
+          }
+      EOS
+
+      apply_manifest(pp, :catch_changes => true)
+
+      shell('ip6tables -S') do |r|
+        expect(r.stdout).to match(/#{line_match}/)
+      end
+    end
+  end
+
+  describe 'adding a rule' do
+    context 'when unset' do
+      before :all do
+        ip6tables_flush_all_tables
+      end
+      it_behaves_like 'is idempotent', '', /-A INPUT -p tcp -m comment --comment "599 - test"/
+    end
+    context 'when set to true' do
+      before :all do
+        ip6tables_flush_all_tables
+      end
+      it_behaves_like "is idempotent", 'ishasmorefrags => true, islastfrag => true, isfirstfrag => true', /-A INPUT -p tcp -m frag --fragid 0 --fragmore -m frag --fragid 0 --fraglast -m frag --fragid 0 --fragfirst -m comment --comment "599 - test"/
+    end
+    context 'when set to false' do
+      before :all do
+        ip6tables_flush_all_tables
+      end
+      it_behaves_like "is idempotent", 'ishasmorefrags => false, islastfrag => false, isfirstfrag => false', /-A INPUT -p tcp -m comment --comment "599 - test"/
+    end
+  end
+  describe 'editing a rule' do
+    context 'when unset or false' do
+      before :each do
+        ip6tables_flush_all_tables
+        shell('/sbin/ip6tables -A INPUT -p tcp -m comment --comment "599 - test"')
+      end
+      context 'and current value is false' do
+        it_behaves_like "doesn't change", 'ishasmorefrags => false, islastfrag => false, isfirstfrag => false', /-A INPUT -p tcp -m comment --comment "599 - test"/
+      end
+      context 'and current value is true' do
+        it_behaves_like "is idempotent", 'ishasmorefrags => true, islastfrag => true, isfirstfrag => true', /-A INPUT -p tcp -m frag --fragid 0 --fragmore -m frag --fragid 0 --fraglast -m frag --fragid 0 --fragfirst -m comment --comment "599 - test"/
+      end
+    end
+    context 'when set to true' do
+      before :each do
+        ip6tables_flush_all_tables
+        shell('/sbin/ip6tables -A INPUT -p tcp -m frag --fragid 0 --fragmore -m frag --fragid 0 --fraglast -m frag --fragid 0 --fragfirst -m comment --comment "599 - test"')
+      end
+      context 'and current value is false' do
+        it_behaves_like "is idempotent", 'ishasmorefrags => false, islastfrag => false, isfirstfrag => false', /-A INPUT -p tcp -m comment --comment "599 - test"/
+      end
+      context 'and current value is true' do
+        it_behaves_like "doesn't change", 'ishasmorefrags => true, islastfrag => true, isfirstfrag => true', /-A INPUT -p tcp -m frag --fragid 0 --fragmore -m frag --fragid 0 --fraglast -m frag --fragid 0 --fragfirst -m comment --comment "599 - test"/
+      end
+    end
+  end
+end

data/modules/firewall/spec/acceptance/isfragment_spec.rb

@@ -0,0 +1,92 @@
+require 'spec_helper_acceptance'
+
+describe 'firewall isfragment property' do
+  before :all do
+    iptables_flush_all_tables
+  end
+
+  shared_examples "is idempotent" do |value, line_match|
+    it "changes the value to #{value}" do
+      pp = <<-EOS
+          class { '::firewall': }
+          firewall { '597 - test':
+            ensure => present,
+            proto  => 'tcp',
+            #{value}
+          }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+
+      shell('iptables -S') do |r|
+        expect(r.stdout).to match(/#{line_match}/)
+      end
+    end
+  end
+  shared_examples "doesn't change" do |value, line_match|
+    it "doesn't change the value to #{value}" do
+      pp = <<-EOS
+          class { '::firewall': }
+          firewall { '597 - test':
+            ensure => present,
+            proto  => 'tcp',
+            #{value}
+          }
+      EOS
+
+      apply_manifest(pp, :catch_changes => true)
+
+      shell('iptables -S') do |r|
+        expect(r.stdout).to match(/#{line_match}/)
+      end
+    end
+  end
+
+  describe 'adding a rule' do
+    context 'when unset' do
+      before :all do
+        iptables_flush_all_tables
+      end
+      it_behaves_like 'is idempotent', '', /-A INPUT -p tcp -m comment --comment "597 - test"/
+    end
+    context 'when set to true' do
+      before :all do
+        iptables_flush_all_tables
+      end
+      it_behaves_like 'is idempotent', 'isfragment => true,', /-A INPUT -p tcp -f -m comment --comment "597 - test"/
+    end
+    context 'when set to false' do
+      before :all do
+        iptables_flush_all_tables
+      end
+      it_behaves_like "is idempotent", 'isfragment => false,', /-A INPUT -p tcp -m comment --comment "597 - test"/
+    end
+  end
+  describe 'editing a rule' do
+    context 'when unset or false' do
+      before :each do
+        iptables_flush_all_tables
+        shell('/sbin/iptables -A INPUT -p tcp -m comment --comment "597 - test"')
+      end
+      context 'and current value is false' do
+        it_behaves_like "doesn't change", 'isfragment => false,', /-A INPUT -p tcp -m comment --comment "597 - test"/
+      end
+      context 'and current value is true' do
+        it_behaves_like "is idempotent", 'isfragment => true,', /-A INPUT -p tcp -f -m comment --comment "597 - test"/
+      end
+    end
+    context 'when set to true' do
+      before :each do
+        iptables_flush_all_tables
+        shell('/sbin/iptables -A INPUT -p tcp -f -m comment --comment "597 - test"')
+      end
+      context 'and current value is false' do
+        it_behaves_like "is idempotent", 'isfragment => false,', /-A INPUT -p tcp -m comment --comment "597 - test"/
+      end
+      context 'and current value is true' do
+        it_behaves_like "doesn't change", 'isfragment => true,', /-A INPUT -p tcp -f -m comment --comment "597 - test"/
+      end
+    end
+  end
+end

data/modules/firewall/spec/acceptance/nodesets/centos-59-x64.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  centos-59-x64:
+    roles:
+      - master
+    platform: el-5-x86_64
+    box : centos-59-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-59-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss

data/modules/firewall/spec/acceptance/nodesets/centos-64-x64-fusion.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-64-x64-fusion503-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-fusion503-nocm.box
+    hypervisor : fusion
+CONFIG:
+  type: foss

data/modules/firewall/spec/acceptance/nodesets/centos-64-x64-pe.yml

@@ -0,0 +1,12 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: el-6-x86_64
+    box : centos-64-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: pe

data/modules/firewall/spec/acceptance/nodesets/centos-64-x64.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-64-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss

data/modules/firewall/spec/acceptance/nodesets/debian-607-x64.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  debian-607-x64:
+    roles:
+      - master
+    platform: debian-6-amd64
+    box : debian-607-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/debian-607-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: git

data/modules/firewall/spec/acceptance/nodesets/debian-70rc1-x64.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  debian-70rc1-x64:
+    roles:
+      - master
+    platform: debian-7-amd64
+    box : debian-70rc1-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/debian-70rc1-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: git

data/modules/firewall/spec/acceptance/nodesets/default.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-64-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss

data/modules/firewall/spec/acceptance/nodesets/fedora-18-x64.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  fedora-18-x64:
+    roles:
+      - master
+    platform: fedora-18-x86_64
+    box : fedora-18-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/fedora-18-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: git

data/modules/firewall/spec/acceptance/nodesets/sles-11sp1-x64.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  sles-11sp1-x64:
+    roles:
+      - master
+    platform: sles-11-x86_64
+    box : sles-11sp1-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/sles-11sp1-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: git

data/modules/firewall/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-server-10044-x64:
+    roles:
+      - master
+    platform: ubuntu-10.04-amd64
+    box : ubuntu-server-10044-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/ubuntu-server-10044-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: git

data/modules/firewall/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml

@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-server-12042-x64:
+    roles:
+      - master
+    platform: ubuntu-12.04-amd64
+    box : ubuntu-server-12042-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/ubuntu-server-12042-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss

data/modules/firewall/spec/{system → acceptance}/params_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_system'
+require 'spec_helper_acceptance'
 
 describe "param based tests:" do
   # Takes a hash and converts it into a firewall resource
@@ -8,7 +8,7 @@ describe "param based tests:" do
 firewall { '#{name}':
     EOS
 
-    params.each do |k,v| 
+    params.each do |k,v|
       pm += <<-EOS
   #{k} => #{v},
       EOS
@@ -23,10 +23,8 @@ firewall { '#{name}':
   it 'test various params' do
     iptables_flush_all_tables
 
-    facts = node.facts
-
-    unless (facts['operatingsystem'] == 'CentOS') && \
-      facts['operatingsystemrelease'] =~ /^5\./ then
+    unless (fact('operatingsystem') == 'CentOS') && \
+      fact('operatingsystemrelease') =~ /^5\./ then
 
       ppm = pp({
         'table' => "'raw'",
@@ -36,13 +34,8 @@ firewall { '#{name}':
         'log_level' => 'debug',
       })
 
-      puppet_apply(ppm) do |r|
-        r.exit_code.should == 2
-        r.stderr.should be_empty
-        r.refresh
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
-      end
+      expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
+      expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero
     end
   end
 
@@ -55,13 +48,8 @@ firewall { '#{name}':
       'jump' => 'LOG',
       'log_level' => 'debug',
     })
-    puppet_apply(ppm) do |r|
-      r.exit_code.should == 2
-      r.stderr.should be_empty
-      r.refresh
-      r.stderr.should be_empty
-      r.exit_code.should be_zero
-    end
+    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
+    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero
   end
 
   it 'test log rule - changing names' do
@@ -71,7 +59,7 @@ firewall { '#{name}':
       'name' => '004 log all INVALID packets',
       'chain' => 'INPUT',
       'proto' => 'all',
-      'state' => 'INVALID',
+      'ctstate' => 'INVALID',
       'jump' => 'LOG',
       'log_level' => '3',
       'log_prefix' => '"IPTABLES dropped invalid: "',
@@ -81,26 +69,45 @@ firewall { '#{name}':
       'name' => '003 log all INVALID packets',
       'chain' => 'INPUT',
       'proto' => 'all',
-      'state' => 'INVALID',
+      'ctstate' => 'INVALID',
       'jump' => 'LOG',
       'log_level' => '3',
       'log_prefix' => '"IPTABLES dropped invalid: "',
     })
 
-    puppet_apply(ppm1) do |r|
-      r.stderr.should be_empty
-      r.exit_code.should == 2
-    end
+    expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to eq(2)
 
     ppm = <<-EOS + "\n" + ppm2
       resources { 'firewall':
         purge => true,
       }
     EOS
-    puppet_apply(ppm) do |r|
-      r.stderr.should be_empty
-      r.exit_code.should == 2
-    end
+    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
+  end
+
+  it 'test chain - changing names' do
+    iptables_flush_all_tables
+
+    ppm1 = pp({
+      'name'  => '004 with a chain',
+      'chain' => 'INPUT',
+      'proto' => 'all',
+    })
+
+    ppm2 = pp({
+      'name'  => '004 with a chain',
+      'chain' => 'OUTPUT',
+      'proto' => 'all',
+    })
+
+    apply_manifest(ppm1, :expect_changes => true)
+
+    ppm = <<-EOS + "\n" + ppm2
+      resources { 'firewall':
+        purge => true,
+      }
+    EOS
+    expect(apply_manifest(ppm2, :expect_failures => true).stderr).to match(/is not supported/)
   end
 
   it 'test log rule - idempotent' do
@@ -110,19 +117,14 @@ firewall { '#{name}':
       'name' => '004 log all INVALID packets',
       'chain' => 'INPUT',
       'proto' => 'all',
-      'state' => 'INVALID',
+      'ctstate' => 'INVALID',
       'jump' => 'LOG',
       'log_level' => '3',
       'log_prefix' => '"IPTABLES dropped invalid: "',
     })
 
-    puppet_apply(ppm1) do |r|
-      r.exit_code.should == 2
-      r.stderr.should be_empty
-      r.refresh
-      r.stderr.should be_empty
-      r.exit_code.should be_zero
-    end
+    expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to eq(2)
+    expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to be_zero
   end
 
   it 'test src_range rule' do
@@ -135,13 +137,8 @@ firewall { '#{name}':
       'action'    => 'drop',
       'src_range' => '"10.0.0.1-10.0.0.10"',
     })
-    puppet_apply(ppm) do |r|
-      r.exit_code.should == 2
-      r.stderr.should be_empty
-      r.refresh
-      r.stderr.should be_empty
-      r.exit_code.should be_zero
-    end
+    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
+    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero
   end
 
   it 'test dst_range rule' do
@@ -154,13 +151,8 @@ firewall { '#{name}':
       'action'    => 'drop',
       'dst_range' => '"10.0.0.2-10.0.0.20"',
     })
-    puppet_apply(ppm) do |r|
-      r.exit_code.should == 2
-      r.stderr.should be_empty
-      r.refresh
-      r.stderr.should be_empty
-      r.exit_code.should be_zero
-    end
+    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2)
+    expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero
   end
 
 end