root / spec / classes / ip_nat_spec.rb @ 20eaf3c2
Historique | Voir | Annoter | Télécharger (9,36 ko)
| 1 | 422b6851 | tr | require 'spec_helper'
|
|---|---|---|---|
| 2 | |||
| 3 | describe 'nftables' do |
||
| 4 | let(:pre_condition) { 'Exec{path => "/bin"}' } |
||
| 5 | |||
| 6 | on_supported_os.each do |os, os_facts|
|
||
| 7 | context "on #{os}" do |
||
| 8 | let(:facts) { os_facts }
|
||
| 9 | |||
| 10 | it { is_expected.to compile }
|
||
| 11 | |||
| 12 | 01d8a819 | tr | it {
|
| 13 | e4c32222 | Nacho Barrientos | is_expected.to contain_concat('nftables-ip-nat').with(
|
| 14 | 30462da1 | Steve Traylen | path: '/etc/nftables/puppet-preflight/ip-nat.nft', |
| 15 | e4c32222 | Nacho Barrientos | ensure: 'present', |
| 16 | 01d8a819 | tr | owner: 'root', |
| 17 | group: 'root', |
||
| 18 | fa92e118 | Romain Tartière | mode: '0640' |
| 19 | 01d8a819 | tr | ) |
| 20 | } |
||
| 21 | 422b6851 | tr | |
| 22 | 248ef9d5 | tr | it {
|
| 23 | e4c32222 | Nacho Barrientos | is_expected.to contain_concat__fragment('nftables-ip-nat-header').with(
|
| 24 | target: 'nftables-ip-nat', |
||
| 25 | content: %r{^table ip nat \{$}, |
||
| 26 | fa92e118 | Romain Tartière | order: '00' |
| 27 | e4c32222 | Nacho Barrientos | ) |
| 28 | } |
||
| 29 | |||
| 30 | it {
|
||
| 31 | is_expected.to contain_concat__fragment('nftables-ip-nat-body').with(
|
||
| 32 | target: 'nftables-ip-nat', |
||
| 33 | fcb1d356 | Nacho Barrientos | content: %r{^\s+include "ip-nat-chain-\*\.nft"$}, |
| 34 | fa92e118 | Romain Tartière | order: '98' |
| 35 | e4c32222 | Nacho Barrientos | ) |
| 36 | } |
||
| 37 | |||
| 38 | it {
|
||
| 39 | is_expected.to contain_concat__fragment('nftables-ip-nat-footer').with(
|
||
| 40 | target: 'nftables-ip-nat', |
||
| 41 | content: %r{^\}$}, |
||
| 42 | fa92e118 | Romain Tartière | order: '99' |
| 43 | e4c32222 | Nacho Barrientos | ) |
| 44 | } |
||
| 45 | |||
| 46 | it {
|
||
| 47 | is_expected.to contain_concat('nftables-ip6-nat').with(
|
||
| 48 | 30462da1 | Steve Traylen | path: '/etc/nftables/puppet-preflight/ip6-nat.nft', |
| 49 | e4c32222 | Nacho Barrientos | ensure: 'present', |
| 50 | 248ef9d5 | tr | owner: 'root', |
| 51 | group: 'root', |
||
| 52 | fa92e118 | Romain Tartière | mode: '0640' |
| 53 | 248ef9d5 | tr | ) |
| 54 | } |
||
| 55 | |||
| 56 | e4c32222 | Nacho Barrientos | it {
|
| 57 | is_expected.to contain_concat__fragment('nftables-ip6-nat-header').with(
|
||
| 58 | target: 'nftables-ip6-nat', |
||
| 59 | content: %r{^table ip6 nat \{$}, |
||
| 60 | fa92e118 | Romain Tartière | order: '00' |
| 61 | e4c32222 | Nacho Barrientos | ) |
| 62 | } |
||
| 63 | |||
| 64 | it {
|
||
| 65 | is_expected.to contain_concat__fragment('nftables-ip6-nat-body').with(
|
||
| 66 | target: 'nftables-ip6-nat', |
||
| 67 | fcb1d356 | Nacho Barrientos | content: %r{^\s+include "ip6-nat-chain-\*\.nft"$}, |
| 68 | fa92e118 | Romain Tartière | order: '98' |
| 69 | e4c32222 | Nacho Barrientos | ) |
| 70 | } |
||
| 71 | |||
| 72 | it {
|
||
| 73 | is_expected.to contain_concat__fragment('nftables-ip6-nat-footer').with(
|
||
| 74 | target: 'nftables-ip6-nat', |
||
| 75 | content: %r{^\}$}, |
||
| 76 | fa92e118 | Romain Tartière | order: '99' |
| 77 | e4c32222 | Nacho Barrientos | ) |
| 78 | } |
||
| 79 | |||
| 80 | 248ef9d5 | tr | context 'table ip nat chain prerouting' do |
| 81 | 01d8a819 | tr | it {
|
| 82 | is_expected.to contain_concat('nftables-ip-nat-chain-PREROUTING').with(
|
||
| 83 | 30462da1 | Steve Traylen | path: '/etc/nftables/puppet-preflight/ip-nat-chain-PREROUTING.nft', |
| 84 | 01d8a819 | tr | owner: 'root', |
| 85 | group: 'root', |
||
| 86 | mode: '0640', |
||
| 87 | fa92e118 | Romain Tartière | ensure_newline: true |
| 88 | 01d8a819 | tr | ) |
| 89 | } |
||
| 90 | it {
|
||
| 91 | is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
|
||
| 92 | target: 'nftables-ip-nat-chain-PREROUTING', |
||
| 93 | content: %r{^chain PREROUTING \{$}, |
||
| 94 | fa92e118 | Romain Tartière | order: '00' |
| 95 | 01d8a819 | tr | ) |
| 96 | } |
||
| 97 | it {
|
||
| 98 | is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
|
||
| 99 | target: 'nftables-ip-nat-chain-PREROUTING', |
||
| 100 | content: %r{^ type nat hook prerouting priority -100$}, |
||
| 101 | fa92e118 | Romain Tartière | order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b' |
| 102 | 01d8a819 | tr | ) |
| 103 | } |
||
| 104 | it {
|
||
| 105 | is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
|
||
| 106 | target: 'nftables-ip-nat-chain-PREROUTING', |
||
| 107 | content: %r{^ policy accept$}, |
||
| 108 | fa92e118 | Romain Tartière | order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b' |
| 109 | 01d8a819 | tr | ) |
| 110 | } |
||
| 111 | it {
|
||
| 112 | is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
|
||
| 113 | target: 'nftables-ip-nat-chain-PREROUTING', |
||
| 114 | content: %r{^\}$}, |
||
| 115 | fa92e118 | Romain Tartière | order: '99' |
| 116 | 01d8a819 | tr | ) |
| 117 | } |
||
| 118 | 422b6851 | tr | end
|
| 119 | |||
| 120 | 248ef9d5 | tr | context 'table ip nat chain postrouting' do |
| 121 | 01d8a819 | tr | it {
|
| 122 | is_expected.to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
|
||
| 123 | 30462da1 | Steve Traylen | path: '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft', |
| 124 | 01d8a819 | tr | owner: 'root', |
| 125 | group: 'root', |
||
| 126 | mode: '0640', |
||
| 127 | fa92e118 | Romain Tartière | ensure_newline: true |
| 128 | 01d8a819 | tr | ) |
| 129 | } |
||
| 130 | it {
|
||
| 131 | is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
|
||
| 132 | target: 'nftables-ip-nat-chain-POSTROUTING', |
||
| 133 | content: %r{^chain POSTROUTING \{$}, |
||
| 134 | fa92e118 | Romain Tartière | order: '00' |
| 135 | 01d8a819 | tr | ) |
| 136 | } |
||
| 137 | it {
|
||
| 138 | is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
|
||
| 139 | target: 'nftables-ip-nat-chain-POSTROUTING', |
||
| 140 | content: %r{^ type nat hook postrouting priority 100$}, |
||
| 141 | fa92e118 | Romain Tartière | order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b' |
| 142 | 01d8a819 | tr | ) |
| 143 | } |
||
| 144 | it {
|
||
| 145 | is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
|
||
| 146 | target: 'nftables-ip-nat-chain-POSTROUTING', |
||
| 147 | content: %r{^ policy accept$}, |
||
| 148 | fa92e118 | Romain Tartière | order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b' |
| 149 | 01d8a819 | tr | ) |
| 150 | } |
||
| 151 | it {
|
||
| 152 | is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
|
||
| 153 | target: 'nftables-ip-nat-chain-POSTROUTING', |
||
| 154 | content: %r{^\}$}, |
||
| 155 | fa92e118 | Romain Tartière | order: '99' |
| 156 | 01d8a819 | tr | ) |
| 157 | } |
||
| 158 | 422b6851 | tr | end
|
| 159 | 248ef9d5 | tr | |
| 160 | context 'table ip6 nat chain prerouting' do |
||
| 161 | it {
|
||
| 162 | is_expected.to contain_concat('nftables-ip6-nat-chain-PREROUTING6').with(
|
||
| 163 | 30462da1 | Steve Traylen | path: '/etc/nftables/puppet-preflight/ip6-nat-chain-PREROUTING6.nft', |
| 164 | 248ef9d5 | tr | owner: 'root', |
| 165 | group: 'root', |
||
| 166 | mode: '0640', |
||
| 167 | fa92e118 | Romain Tartière | ensure_newline: true |
| 168 | 248ef9d5 | tr | ) |
| 169 | } |
||
| 170 | it {
|
||
| 171 | is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-header').with(
|
||
| 172 | target: 'nftables-ip6-nat-chain-PREROUTING6', |
||
| 173 | content: %r{^chain PREROUTING6 \{$}, |
||
| 174 | fa92e118 | Romain Tartière | order: '00' |
| 175 | 248ef9d5 | tr | ) |
| 176 | } |
||
| 177 | it {
|
||
| 178 | is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-type').with(
|
||
| 179 | target: 'nftables-ip6-nat-chain-PREROUTING6', |
||
| 180 | content: %r{^ type nat hook prerouting priority -100$}, |
||
| 181 | fa92e118 | Romain Tartière | order: '01-nftables-ip6-nat-chain-PREROUTING6-rule-type-b' |
| 182 | 248ef9d5 | tr | ) |
| 183 | } |
||
| 184 | it {
|
||
| 185 | is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-policy').with(
|
||
| 186 | target: 'nftables-ip6-nat-chain-PREROUTING6', |
||
| 187 | content: %r{^ policy accept$}, |
||
| 188 | fa92e118 | Romain Tartière | order: '02-nftables-ip6-nat-chain-PREROUTING6-rule-policy-b' |
| 189 | 248ef9d5 | tr | ) |
| 190 | } |
||
| 191 | it {
|
||
| 192 | is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-footer').with(
|
||
| 193 | target: 'nftables-ip6-nat-chain-PREROUTING6', |
||
| 194 | content: %r{^\}$}, |
||
| 195 | fa92e118 | Romain Tartière | order: '99' |
| 196 | 248ef9d5 | tr | ) |
| 197 | } |
||
| 198 | end
|
||
| 199 | |||
| 200 | context 'table ip nat chain postrouting' do |
||
| 201 | it {
|
||
| 202 | is_expected.to contain_concat('nftables-ip6-nat-chain-POSTROUTING6').with(
|
||
| 203 | 30462da1 | Steve Traylen | path: '/etc/nftables/puppet-preflight/ip6-nat-chain-POSTROUTING6.nft', |
| 204 | 248ef9d5 | tr | owner: 'root', |
| 205 | group: 'root', |
||
| 206 | mode: '0640', |
||
| 207 | fa92e118 | Romain Tartière | ensure_newline: true |
| 208 | 248ef9d5 | tr | ) |
| 209 | } |
||
| 210 | it {
|
||
| 211 | is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-header').with(
|
||
| 212 | target: 'nftables-ip6-nat-chain-POSTROUTING6', |
||
| 213 | content: %r{^chain POSTROUTING6 \{$}, |
||
| 214 | fa92e118 | Romain Tartière | order: '00' |
| 215 | 248ef9d5 | tr | ) |
| 216 | } |
||
| 217 | it {
|
||
| 218 | is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-type').with(
|
||
| 219 | target: 'nftables-ip6-nat-chain-POSTROUTING6', |
||
| 220 | content: %r{^ type nat hook postrouting priority 100$}, |
||
| 221 | fa92e118 | Romain Tartière | order: '01-nftables-ip6-nat-chain-POSTROUTING6-rule-type-b' |
| 222 | 248ef9d5 | tr | ) |
| 223 | } |
||
| 224 | it {
|
||
| 225 | is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-policy').with(
|
||
| 226 | target: 'nftables-ip6-nat-chain-POSTROUTING6', |
||
| 227 | content: %r{^ policy accept$}, |
||
| 228 | fa92e118 | Romain Tartière | order: '02-nftables-ip6-nat-chain-POSTROUTING6-rule-policy-b' |
| 229 | 248ef9d5 | tr | ) |
| 230 | } |
||
| 231 | it {
|
||
| 232 | is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-footer').with(
|
||
| 233 | target: 'nftables-ip6-nat-chain-POSTROUTING6', |
||
| 234 | content: %r{^\}$}, |
||
| 235 | fa92e118 | Romain Tartière | order: '99' |
| 236 | 248ef9d5 | tr | ) |
| 237 | } |
||
| 238 | end
|
||
| 239 | 82d10659 | Nacho Barrientos | |
| 240 | fcb79d73 | Ben Morrice | context 'custom ip nat table name' do |
| 241 | let(:params) do |
||
| 242 | {
|
||
| 243 | 'nat_table_name' => 'mycustomtablename', |
||
| 244 | } |
||
| 245 | end
|
||
| 246 | |||
| 247 | it { is_expected.to compile }
|
||
| 248 | it {
|
||
| 249 | is_expected.to contain_concat('nftables-ip-mycustomtablename').with(
|
||
| 250 | path: '/etc/nftables/puppet-preflight/ip-mycustomtablename.nft', |
||
| 251 | ensure: 'present', |
||
| 252 | owner: 'root', |
||
| 253 | group: 'root', |
||
| 254 | fa92e118 | Romain Tartière | mode: '0640' |
| 255 | fcb79d73 | Ben Morrice | ) |
| 256 | } |
||
| 257 | end
|
||
| 258 | |||
| 259 | 82d10659 | Nacho Barrientos | context 'all nat tables disabled' do |
| 260 | let(:params) do |
||
| 261 | {
|
||
| 262 | 'nat' => false, |
||
| 263 | } |
||
| 264 | end
|
||
| 265 | |||
| 266 | it { is_expected.not_to contain_class('nftables::ip_nat') }
|
||
| 267 | it { is_expected.not_to contain_nftables__config('ip-nat') }
|
||
| 268 | it { is_expected.not_to contain_nftables__config('ip6-nat') }
|
||
| 269 | it { is_expected.not_to contain_nftables__chain('PREROUTING') }
|
||
| 270 | it { is_expected.not_to contain_nftables__chain('POSTROUTING') }
|
||
| 271 | it { is_expected.not_to contain_nftables__chain('PREROUTING6') }
|
||
| 272 | it { is_expected.not_to contain_nftables__chain('POSTROUTING6') }
|
||
| 273 | end
|
||
| 274 | 422b6851 | tr | end
|
| 275 | end
|
||
| 276 | end |