root / spec / acceptance / default_spec.rb @ 20eaf3c2
Historique | Voir | Annoter | Télécharger (4,54 ko)
| 1 | bd5145ab | Steve Traylen | require 'spec_helper_acceptance'
|
|---|---|---|---|
| 2 | |||
| 3 | describe 'nftables class' do |
||
| 4 | context 'configure default nftables service' do |
||
| 5 | it 'works idempotently with no errors' do |
||
| 6 | pp = <<-EOS |
||
| 7 | # default mask of firewalld service fails if service is not installed.
|
||
| 8 | # https://tickets.puppetlabs.com/browse/PUP-10814
|
||
| 9 | class { 'nftables':
|
||
| 10 | firewalld_enable => false,
|
||
| 11 | }
|
||
| 12 | # nftables cannot be started in docker so replace service with a validation only.
|
||
| 13 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 14 | ensure => present,
|
||
| 15 | unit => "nftables.service",
|
||
| 16 | content => [
|
||
| 17 | "[Service]",
|
||
| 18 | "ExecStart=",
|
||
| 19 | "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
|
||
| 20 | "ExecReload=",
|
||
| 21 | "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
|
||
| 22 | "",
|
||
| 23 | ].join("\n"),
|
||
| 24 | notify => Service["nftables"],
|
||
| 25 | }
|
||
| 26 | EOS
|
||
| 27 | # Run it twice and test for idempotency
|
||
| 28 | apply_manifest(pp, catch_failures: true) |
||
| 29 | apply_manifest(pp, catch_changes: true) |
||
| 30 | end
|
||
| 31 | |||
| 32 | describe package('nftables') do |
||
| 33 | it { is_expected.to be_installed }
|
||
| 34 | end
|
||
| 35 | |||
| 36 | describe service('nftables') do |
||
| 37 | it { is_expected.to be_running }
|
||
| 38 | it { is_expected.to be_enabled }
|
||
| 39 | end
|
||
| 40 | |||
| 41 | describe file('/etc/nftables/puppet.nft') do |
||
| 42 | it { is_expected.to be_file }
|
||
| 43 | end
|
||
| 44 | |||
| 45 | ce22630b | Steve Traylen | describe file('/etc/systemd/system/nftables.service.d/puppet_nft.conf') do |
| 46 | it { is_expected.to be_file }
|
||
| 47 | end
|
||
| 48 | |||
| 49 | bd5145ab | Steve Traylen | describe file('/etc/nftables/puppet') do |
| 50 | it { is_expected.to be_directory }
|
||
| 51 | end
|
||
| 52 | end
|
||
| 53 | d8752442 | Steve Traylen | context 'with bad invalid nft rules' do |
| 54 | it 'puppet fails but should leave nft service running' do |
||
| 55 | pp = <<-EOS |
||
| 56 | class{'nftables':
|
||
| 57 | firewalld_enable => false,
|
||
| 58 | }
|
||
| 59 | nftables::rule{'default_out-junk':
|
||
| 60 | content => 'A load of junk',
|
||
| 61 | }
|
||
| 62 | # nftables cannot be started in docker so replace service with a validation only.
|
||
| 63 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 64 | ensure => present,
|
||
| 65 | unit => "nftables.service",
|
||
| 66 | content => [
|
||
| 67 | "[Service]",
|
||
| 68 | "ExecStart=",
|
||
| 69 | "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
|
||
| 70 | "ExecReload=",
|
||
| 71 | "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
|
||
| 72 | "",
|
||
| 73 | ].join("\n"),
|
||
| 74 | notify => Service["nftables"],
|
||
| 75 | }
|
||
| 76 | EOS
|
||
| 77 | apply_manifest(pp, expect_failures: true) |
||
| 78 | end
|
||
| 79 | describe service('nftables') do |
||
| 80 | it { is_expected.to be_running }
|
||
| 81 | it { is_expected.to be_enabled }
|
||
| 82 | end
|
||
| 83 | end
|
||
| 84 | 7b9d6ffc | Nacho Barrientos | context 'with totally empty firewall' do |
| 85 | it 'no rules validate okay' do |
||
| 86 | pp = <<-EOS |
||
| 87 | class{'nftables':
|
||
| 88 | firewalld_enable => false,
|
||
| 89 | inet_filter => false,
|
||
| 90 | nat => false,
|
||
| 91 | }
|
||
| 92 | # nftables cannot be started in docker so replace service with a validation only.
|
||
| 93 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 94 | ensure => present,
|
||
| 95 | unit => "nftables.service",
|
||
| 96 | content => [
|
||
| 97 | "[Service]",
|
||
| 98 | "ExecStart=",
|
||
| 99 | "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
|
||
| 100 | "ExecReload=",
|
||
| 101 | "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
|
||
| 102 | "",
|
||
| 103 | ].join("\n"),
|
||
| 104 | notify => Service["nftables"],
|
||
| 105 | }
|
||
| 106 | EOS
|
||
| 107 | apply_manifest(pp, catch_failures: true) |
||
| 108 | end
|
||
| 109 | describe service('nftables') do |
||
| 110 | it { is_expected.to be_running }
|
||
| 111 | it { is_expected.to be_enabled }
|
||
| 112 | end
|
||
| 113 | end
|
||
| 114 | fcb79d73 | Ben Morrice | context 'with custom nat_table_name' do |
| 115 | it 'no rules validate okay' do |
||
| 116 | pp = <<-EOS |
||
| 117 | class{'nftables':
|
||
| 118 | firewalld_enable => false,
|
||
| 119 | nat => true,
|
||
| 120 | nat_table_name => 'mycustomtablename',
|
||
| 121 | }
|
||
| 122 | # nftables cannot be started in docker so replace service with a validation only.
|
||
| 123 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 124 | ensure => present,
|
||
| 125 | unit => "nftables.service",
|
||
| 126 | content => [
|
||
| 127 | "[Service]",
|
||
| 128 | "ExecStart=",
|
||
| 129 | "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
|
||
| 130 | "ExecReload=",
|
||
| 131 | "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf",
|
||
| 132 | "",
|
||
| 133 | ].join("\n"),
|
||
| 134 | notify => Service["nftables"],
|
||
| 135 | }
|
||
| 136 | EOS
|
||
| 137 | apply_manifest(pp, catch_failures: true) |
||
| 138 | end
|
||
| 139 | describe service('nftables') do |
||
| 140 | it { is_expected.to be_running }
|
||
| 141 | it { is_expected.to be_enabled }
|
||
| 142 | end
|
||
| 143 | end
|
||
| 144 | bd5145ab | Steve Traylen | end |