Projet

Général

Profil

Paste
Télécharger au format
Statistiques
| Branche: | Révision:

root / spec / defines / simplerule_spec.rb @ 0ea401a5

Historique | Voir | Annoter | Télécharger (11,9 ko)

1 c82b960a Steve Traylen
# frozen_string_literal: true
2
3 83382bb5 Nacho Barrientos
require 'spec_helper'
4
5
describe 'nftables::simplerule' do
6
  let(:pre_condition) { 'include nftables' }
7
8
  let(:title) { 'my_default_rule_name' }
9
10
  on_supported_os.each do |os, os_facts|
11
    context "on #{os}" do
12
      let(:facts) { os_facts }
13
14
      describe 'minimum instantiation' do
15
        it { is_expected.to compile }
16 c82b960a Steve Traylen
17 83382bb5 Nacho Barrientos
        it {
18 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
19 83382bb5 Nacho Barrientos
            content: 'accept',
20 fa92e118 Romain Tartière
            order: '50'
21 83382bb5 Nacho Barrientos
          )
22
        }
23
      end
24
25 77abc10b Nacho Barrientos
      describe 'dport without protocol' do
26 d38aab5b Nacho Barrientos
        let(:params) do
27
          {
28
            dport: 333,
29
          }
30
        end
31
32
        it { is_expected.not_to compile }
33
      end
34
35 77abc10b Nacho Barrientos
      describe 'sport without protocol' do
36
        let(:params) do
37
          {
38
            sport: 333,
39
          }
40
        end
41
42
        it { is_expected.not_to compile }
43
      end
44
45 83382bb5 Nacho Barrientos
      describe 'all parameters provided' do
46
        let(:title) { 'my_big_rule' }
47
        let(:params) do
48
          {
49
            action: 'accept',
50
            comment: 'this is my rule',
51 d43ced4d Nacho Barrientos
            counter: true,
52 83382bb5 Nacho Barrientos
            dport: 333,
53 77abc10b Nacho Barrientos
            sport: 444,
54 83382bb5 Nacho Barrientos
            proto: 'udp',
55
            chain: 'default_out',
56 aaa37172 Nacho Barrientos
            daddr: '2001:1458::/32',
57 3a469f2b Nacho Barrientos
            saddr: '2001:145c::/32',
58 83382bb5 Nacho Barrientos
          }
59
        end
60
61
        it { is_expected.to compile }
62 c82b960a Steve Traylen
63 83382bb5 Nacho Barrientos
        it {
64 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_out-my_big_rule').with(
65 3a469f2b Nacho Barrientos
            content: 'udp sport {444} udp dport {333} ip6 saddr 2001:145c::/32 ip6 daddr 2001:1458::/32 counter accept comment "this is my rule"',
66 fa92e118 Romain Tartière
            order: '50'
67 3a52fb41 Nacho Barrientos
          )
68
        }
69
      end
70
71
      describe 'port range' do
72
        let(:params) do
73
          {
74
            dport: '333-334',
75 77abc10b Nacho Barrientos
            sport: '1-2',
76 3a52fb41 Nacho Barrientos
            proto: 'tcp',
77
          }
78
        end
79
80
        it { is_expected.to compile }
81 c82b960a Steve Traylen
82 3a52fb41 Nacho Barrientos
        it {
83 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
84 fa92e118 Romain Tartière
            content: 'tcp sport {1-2} tcp dport {333-334} accept'
85 3a52fb41 Nacho Barrientos
          )
86
        }
87
      end
88
89
      describe 'port array' do
90
        let(:params) do
91
          {
92
            dport: [333, 335],
93 77abc10b Nacho Barrientos
            sport: [433, 435],
94
            proto: 'tcp',
95
          }
96
        end
97
98
        it { is_expected.to compile }
99 c82b960a Steve Traylen
100 77abc10b Nacho Barrientos
        it {
101 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
102 fa92e118 Romain Tartière
            content: 'tcp sport {433, 435} tcp dport {333, 335} accept'
103 77abc10b Nacho Barrientos
          )
104
        }
105
      end
106
107 825f4eb1 Tim Skirvin
      describe 'port array and range' do
108
        let(:params) do
109
          {
110
            dport: [333, 335, '338-339'],
111
            sport: [433, 435, '438-439'],
112
            proto: 'tcp',
113
          }
114
        end
115
116
        it { is_expected.to compile }
117
118
        it {
119
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
120
            content: 'tcp sport {433, 435, 438-439} tcp dport {333, 335, 338-339} accept'
121
          )
122
        }
123
      end
124
125 77abc10b Nacho Barrientos
      describe 'only sport TCP traffic' do
126
        let(:params) do
127
          {
128
            sport: 555,
129 3a52fb41 Nacho Barrientos
            proto: 'tcp',
130
          }
131
        end
132
133
        it { is_expected.to compile }
134 c82b960a Steve Traylen
135 3a52fb41 Nacho Barrientos
        it {
136 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
137 fa92e118 Romain Tartière
            content: 'tcp sport {555} accept'
138 83382bb5 Nacho Barrientos
          )
139
        }
140
      end
141 316bc3f8 Nacho Barrientos
142
      describe 'only IPv4 TCP traffic' do
143
        let(:params) do
144
          {
145
            dport: 333,
146
            proto: 'tcp4',
147
          }
148
        end
149
150
        it { is_expected.to compile }
151 c82b960a Steve Traylen
152 316bc3f8 Nacho Barrientos
        it {
153 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
154 fa92e118 Romain Tartière
            content: 'ip version 4 tcp dport {333} accept'
155 316bc3f8 Nacho Barrientos
          )
156
        }
157
      end
158
159
      describe 'only IPv6 UDP traffic' do
160
        let(:params) do
161
          {
162
            dport: 33,
163
            proto: 'udp6',
164
          }
165
        end
166
167
        it { is_expected.to compile }
168 c82b960a Steve Traylen
169 316bc3f8 Nacho Barrientos
        it {
170 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
171 fa92e118 Romain Tartière
            content: 'ip6 version 6 udp dport {33} accept'
172 316bc3f8 Nacho Barrientos
          )
173
        }
174
      end
175 aaa37172 Nacho Barrientos
176 14156fb6 Nacho Barrientos
      describe 'only IPv6 TCP traffic' do
177
        let(:params) do
178
          {
179
            dport: 35,
180
            proto: 'tcp6',
181
          }
182
        end
183
184
        it { is_expected.to compile }
185 c82b960a Steve Traylen
186 14156fb6 Nacho Barrientos
        it {
187 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
188 fa92e118 Romain Tartière
            content: 'ip6 version 6 tcp dport {35} accept'
189 14156fb6 Nacho Barrientos
          )
190
        }
191
      end
192
193 aaa37172 Nacho Barrientos
      describe 'with an IPv4 CIDR as daddr' do
194
        let(:params) do
195
          {
196
            daddr: '192.168.0.1/24',
197
            dport: 33,
198
            proto: 'tcp',
199
          }
200
        end
201
202
        it { is_expected.to compile }
203 c82b960a Steve Traylen
204 aaa37172 Nacho Barrientos
        it {
205 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
206 fa92e118 Romain Tartière
            content: 'tcp dport {33} ip daddr 192.168.0.1/24 accept'
207 aaa37172 Nacho Barrientos
          )
208
        }
209
      end
210
211 9d02e9f8 Stéphanie Jaumotte
      describe 'with an IPV4 array address as daddr' do
212
        let(:params) do
213
          {
214
            daddr: ['172.16.1.5', '172.16.1.10', '172.16.1.15'],
215
          }
216
        end
217
218
        it { is_expected.to compile }
219
220
        it {
221
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
222
            content: 'ip daddr {172.16.1.5, 172.16.1.10, 172.16.1.15} accept'
223
          )
224
        }
225
      end
226
227 aaa37172 Nacho Barrientos
      describe 'with an IPv6 address as daddr' do
228
        let(:params) do
229
          {
230
            daddr: '2001:1458::1',
231
          }
232
        end
233
234
        it { is_expected.to compile }
235 c82b960a Steve Traylen
236 aaa37172 Nacho Barrientos
        it {
237 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
238 fa92e118 Romain Tartière
            content: 'ip6 daddr 2001:1458::1 accept'
239 aaa37172 Nacho Barrientos
          )
240
        }
241
      end
242
243 9d02e9f8 Stéphanie Jaumotte
      describe 'with an IPV6 array address as daddr' do
244 3a469f2b Nacho Barrientos
        let(:params) do
245
          {
246 9d02e9f8 Stéphanie Jaumotte
            daddr: ['2001:1458:0000:0000:0000:0000:0000:0003', '8896:d5d9:e6f4:dd8f:af69:f5c0:0131:264f'],
247 3a469f2b Nacho Barrientos
          }
248
        end
249
250
        it { is_expected.to compile }
251 c82b960a Steve Traylen
252 3a469f2b Nacho Barrientos
        it {
253 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
254 9d02e9f8 Stéphanie Jaumotte
            content: 'ip6 daddr {2001:1458:0000:0000:0000:0000:0000:0003, 8896:d5d9:e6f4:dd8f:af69:f5c0:0131:264f} accept'
255
          )
256
        }
257
      end
258
259
      describe 'with a @addr IPV4 set as daddr' do
260
        let(:params) do
261
          {
262
            daddr: '@my4_set',
263
            set_type: 'ip',
264
          }
265
        end
266
267
        it { is_expected.to compile }
268
269
        it {
270
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
271
            content: 'ip daddr @my4_set accept'
272
          )
273
        }
274
      end
275
276
      describe 'with a @addr IPV4 array set as daddr' do
277
        let(:params) do
278
          {
279
            daddr: ['@my4_1_set', '@my4_2_set'],
280
            set_type: 'ip',
281
          }
282
        end
283
284
        it { is_expected.to compile }
285
286
        it {
287
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
288
            content: 'ip daddr {@my4_1_set, @my4_2_set} accept'
289
          )
290
        }
291
      end
292
293
      describe 'with an @addr IPV6 set as daddr, default set_type' do
294
        let(:params) do
295
          {
296
            daddr: '@my6_set',
297
          }
298
        end
299
300
        it { is_expected.to compile }
301
302
        it {
303
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
304
            content: 'ip6 daddr @my6_set accept'
305
          )
306
        }
307
      end
308
309
      describe 'with an @addr IPV6 array set as daddr, default set_type' do
310
        let(:params) do
311
          {
312
            daddr: ['@my6_1_set', '@my6_2_set'],
313
          }
314
        end
315
316
        it { is_expected.to compile }
317
318
        it {
319
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
320
            content: 'ip6 daddr {@my6_1_set, @my6_2_set} accept'
321 3a469f2b Nacho Barrientos
          )
322
        }
323
      end
324
325 bd8baa0f Nacho Barrientos
      describe 'with an IPv4 address as saddr' do
326
        let(:params) do
327
          {
328
            saddr: '172.16.1.5',
329
          }
330
        end
331
332
        it { is_expected.to compile }
333 c82b960a Steve Traylen
334 bd8baa0f Nacho Barrientos
        it {
335 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
336 fa92e118 Romain Tartière
            content: 'ip saddr 172.16.1.5 accept'
337 bd8baa0f Nacho Barrientos
          )
338
        }
339
      end
340
341 9d02e9f8 Stéphanie Jaumotte
      describe 'with an IPV4 array address as saddr' do
342 aaa37172 Nacho Barrientos
        let(:params) do
343
          {
344 9d02e9f8 Stéphanie Jaumotte
            saddr: ['172.16.1.5', '172.16.1.10', '172.16.1.15'],
345 aaa37172 Nacho Barrientos
          }
346
        end
347
348
        it { is_expected.to compile }
349 c82b960a Steve Traylen
350 aaa37172 Nacho Barrientos
        it {
351 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
352 9d02e9f8 Stéphanie Jaumotte
            content: 'ip saddr {172.16.1.5, 172.16.1.10, 172.16.1.15} accept'
353 aaa37172 Nacho Barrientos
          )
354
        }
355
      end
356
357 9d02e9f8 Stéphanie Jaumotte
      describe 'with an IPv6 address as saddr' do
358 aaa37172 Nacho Barrientos
        let(:params) do
359
          {
360 9d02e9f8 Stéphanie Jaumotte
            saddr: '2001:1458:0000:0000:0000:0000:0000:0003',
361
          }
362
        end
363
364
        it { is_expected.to compile }
365
366
        it {
367
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
368
            content: 'ip6 saddr 2001:1458:0000:0000:0000:0000:0000:0003 accept'
369
          )
370
        }
371
      end
372
373
      describe 'with an IPV6 array address as saddr' do
374
        let(:params) do
375
          {
376
            saddr: ['2001:1458:0000:0000:0000:0000:0000:0003', '8896:d5d9:e6f4:dd8f:af69:f5c0:0131:264f'],
377
          }
378
        end
379
380
        it { is_expected.to compile }
381
382
        it {
383
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
384
            content: 'ip6 saddr {2001:1458:0000:0000:0000:0000:0000:0003, 8896:d5d9:e6f4:dd8f:af69:f5c0:0131:264f} accept'
385
          )
386
        }
387
      end
388
389
      describe 'with a @addr IPV4 set as saddr' do
390
        let(:params) do
391
          {
392
            saddr: '@my4_set',
393 aaa37172 Nacho Barrientos
            set_type: 'ip',
394
          }
395
        end
396
397
        it { is_expected.to compile }
398 c82b960a Steve Traylen
399 aaa37172 Nacho Barrientos
        it {
400 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
401 9d02e9f8 Stéphanie Jaumotte
            content: 'ip saddr @my4_set accept'
402 aaa37172 Nacho Barrientos
          )
403
        }
404
      end
405
406 9d02e9f8 Stéphanie Jaumotte
      describe 'with a @addr IPV4 array set as saddr' do
407
        let(:params) do
408
          {
409
            saddr: ['@my4_1_set', '@my4_2_set'],
410
            set_type: 'ip',
411
          }
412
        end
413
414
        it { is_expected.to compile }
415
416
        it {
417
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
418
            content: 'ip saddr {@my4_1_set, @my4_2_set} accept'
419
          )
420
        }
421
      end
422
423
      describe 'with an @addr IPV6 set as saddr, default set_type' do
424 3a469f2b Nacho Barrientos
        let(:params) do
425
          {
426
            saddr: '@my6_set',
427
          }
428
        end
429
430
        it { is_expected.to compile }
431 c82b960a Steve Traylen
432 3a469f2b Nacho Barrientos
        it {
433 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
434 fa92e118 Romain Tartière
            content: 'ip6 saddr @my6_set accept'
435 3a469f2b Nacho Barrientos
          )
436
        }
437
      end
438
439 9d02e9f8 Stéphanie Jaumotte
      describe 'with an @addr IPV6 array set as saddr, default set_type' do
440
        let(:params) do
441
          {
442
            saddr: ['@my6_1_set', '@my6_2_set'],
443
          }
444
        end
445
446
        it { is_expected.to compile }
447
448
        it {
449
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
450
            content: 'ip6 saddr {@my6_1_set, @my6_2_set} accept'
451
          )
452
        }
453
      end
454
455 d43ced4d Nacho Barrientos
      describe 'with counter enabled' do
456
        let(:params) do
457
          {
458
            counter: true,
459
          }
460
        end
461
462
        it { is_expected.to compile }
463 c82b960a Steve Traylen
464 d43ced4d Nacho Barrientos
        it {
465 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
466 fa92e118 Romain Tartière
            content: 'counter accept'
467 d43ced4d Nacho Barrientos
          )
468
        }
469
      end
470 5944b9cb Nacho Barrientos
471
      describe 'counter and continue sport' do
472
        let(:params) do
473
          {
474
            proto: 'tcp',
475
            sport: 80,
476
            counter: true,
477
            action: 'continue',
478
          }
479
        end
480
481
        it { is_expected.to compile }
482 c82b960a Steve Traylen
483 5944b9cb Nacho Barrientos
        it {
484 c82b960a Steve Traylen
          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
485 fa92e118 Romain Tartière
            content: 'tcp sport {80} counter continue'
486 5944b9cb Nacho Barrientos
          )
487
        }
488
      end
489 83382bb5 Nacho Barrientos
    end
490
  end
491
end