/spec/classes/masquerade_spec.rb - Annoter - puppet nftables - Koumbit's Redmine

2a3b45ec

tr

require 'spec_helper'

2

3

describe 'nftables' do

4

  let(:pre_condition) { 'Exec{path => "/bin"}' }

5

6

  on_supported_os.each do |os, os_facts|

7

    context "on #{os}" do

8

      let(:facts) { os_facts }

9

10

      context 'with masquerade' do

11

        let(:pre_condition) do

12

"""

13

          nftables::rules::masquerade{

14

            'masquerade_eth0':

15

              oif => 'eth0';

16

            'masquerade_eth1_vpn':

17

              oif   => 'eth1',

18

              saddr => '192.0.2.0/24';

19

            'masquerade_ssh_gitlab':

20

              saddr => '192.0.2.0/24',

21

              daddr => '198.51.100.2',

22

              proto => 'tcp',

23

              dport => '22';

24

            'masquerade_wireguard':

25

              proto => 'udp',

26

              dport => '51820';

27

28

"""

29

end

30

31

        it { is_expected.to compile }

32

33

        it { is_expected.to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(

34

          :path           => '/etc/nftables/puppet/ip-nat-chain-POSTROUTING.nft',

35

          :owner          => 'root',

36

          :group          => 'root',

37

          :mode           => '0640',

38

          :ensure_newline => true,

39

)}

40

        it { is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(

41

          :target  => 'nftables-ip-nat-chain-POSTROUTING',

42

          :content => /^chain POSTROUTING {$/,

43

          :order   => '00',

44

)}

45

        it { is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(

46

          :target  => 'nftables-ip-nat-chain-POSTROUTING',

47

          :content => /^  type nat hook postrouting priority 100$/,

48

          :order   => '01',

49

)}

50

        it { is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(

51

          :target  => 'nftables-ip-nat-chain-POSTROUTING',

52

          :content => /^  policy accept$/,

53

          :order   => '02',

54

)}

55

        it { is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0').with(

56

          :target  => 'nftables-ip-nat-chain-POSTROUTING',

57

          :content => /^  oifname eth0 masquerade$/,

58

          :order   => '70',

59

)}

60

        it { is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn').with(

61

          :target  => 'nftables-ip-nat-chain-POSTROUTING',

62

          :content => /^  oifname eth1 ip saddr 192\.0\.2\.0\/24 masquerade$/,

63

          :order   => '70',

64

)}

65

        it { is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab').with(

66

          :target  => 'nftables-ip-nat-chain-POSTROUTING',

67

          :content => /^  ip saddr 192\.0\.2\.0\/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$/,

68

          :order   => '70',

69

)}

70

        it { is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard').with(

71

          :target  => 'nftables-ip-nat-chain-POSTROUTING',

72

          :content => /^  udp dport 51820 masquerade$/,

73

          :order   => '70',

74

)}

75

        it { is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(

76

          :target  => 'nftables-ip-nat-chain-POSTROUTING',

77

          :content => /^}$/,

78

          :order   => '99',

79

)}

80

end

81

end

82

end

83

end

Projet

Général

Profil

puppet nftables

root / spec / classes / masquerade_spec.rb @ 2a3b45ec