root / spec / defines / simplerule_spec.rb @ 2ad7193b
Historique | Voir | Annoter | Télécharger (11,9 ko)
1 | c82b960a | Steve Traylen | # frozen_string_literal: true
|
---|---|---|---|
2 | |||
3 | 83382bb5 | Nacho Barrientos | require 'spec_helper'
|
4 | |||
5 | describe 'nftables::simplerule' do |
||
6 | let(:pre_condition) { 'include nftables' } |
||
7 | |||
8 | let(:title) { 'my_default_rule_name' } |
||
9 | |||
10 | on_supported_os.each do |os, os_facts|
|
||
11 | context "on #{os}" do |
||
12 | let(:facts) { os_facts }
|
||
13 | |||
14 | describe 'minimum instantiation' do |
||
15 | it { is_expected.to compile } |
||
16 | c82b960a | Steve Traylen | |
17 | 83382bb5 | Nacho Barrientos | it { |
18 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
19 | 83382bb5 | Nacho Barrientos | content: 'accept', |
20 | fa92e118 | Romain Tartière | order: '50' |
21 | 83382bb5 | Nacho Barrientos | ) |
22 | } |
||
23 | end
|
||
24 | |||
25 | 77abc10b | Nacho Barrientos | describe 'dport without protocol' do |
26 | d38aab5b | Nacho Barrientos | let(:params) do |
27 | { |
||
28 | dport: 333, |
||
29 | } |
||
30 | end
|
||
31 | |||
32 | it { is_expected.not_to compile } |
||
33 | end
|
||
34 | |||
35 | 77abc10b | Nacho Barrientos | describe 'sport without protocol' do |
36 | let(:params) do |
||
37 | { |
||
38 | sport: 333, |
||
39 | } |
||
40 | end
|
||
41 | |||
42 | it { is_expected.not_to compile } |
||
43 | end
|
||
44 | |||
45 | 83382bb5 | Nacho Barrientos | describe 'all parameters provided' do |
46 | let(:title) { 'my_big_rule' } |
||
47 | let(:params) do |
||
48 | { |
||
49 | action: 'accept', |
||
50 | comment: 'this is my rule', |
||
51 | d43ced4d | Nacho Barrientos | counter: true, |
52 | 83382bb5 | Nacho Barrientos | dport: 333, |
53 | 77abc10b | Nacho Barrientos | sport: 444, |
54 | 83382bb5 | Nacho Barrientos | proto: 'udp', |
55 | chain: 'default_out', |
||
56 | aaa37172 | Nacho Barrientos | daddr: '2001:1458::/32', |
57 | 3a469f2b | Nacho Barrientos | saddr: '2001:145c::/32', |
58 | 83382bb5 | Nacho Barrientos | } |
59 | end
|
||
60 | |||
61 | it { is_expected.to compile } |
||
62 | c82b960a | Steve Traylen | |
63 | 83382bb5 | Nacho Barrientos | it { |
64 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_out-my_big_rule').with(
|
65 | 3a469f2b | Nacho Barrientos | content: 'udp sport {444} udp dport {333} ip6 saddr 2001:145c::/32 ip6 daddr 2001:1458::/32 counter accept comment "this is my rule"', |
66 | fa92e118 | Romain Tartière | order: '50' |
67 | 3a52fb41 | Nacho Barrientos | ) |
68 | } |
||
69 | end
|
||
70 | |||
71 | describe 'port range' do |
||
72 | let(:params) do |
||
73 | { |
||
74 | dport: '333-334', |
||
75 | 77abc10b | Nacho Barrientos | sport: '1-2', |
76 | 3a52fb41 | Nacho Barrientos | proto: 'tcp', |
77 | } |
||
78 | end
|
||
79 | |||
80 | it { is_expected.to compile } |
||
81 | c82b960a | Steve Traylen | |
82 | 3a52fb41 | Nacho Barrientos | it { |
83 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
84 | fa92e118 | Romain Tartière | content: 'tcp sport {1-2} tcp dport {333-334} accept' |
85 | 3a52fb41 | Nacho Barrientos | ) |
86 | } |
||
87 | end
|
||
88 | |||
89 | describe 'port array' do |
||
90 | let(:params) do |
||
91 | { |
||
92 | dport: [333, 335], |
||
93 | 77abc10b | Nacho Barrientos | sport: [433, 435], |
94 | proto: 'tcp', |
||
95 | } |
||
96 | end
|
||
97 | |||
98 | it { is_expected.to compile } |
||
99 | c82b960a | Steve Traylen | |
100 | 77abc10b | Nacho Barrientos | it { |
101 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
102 | fa92e118 | Romain Tartière | content: 'tcp sport {433, 435} tcp dport {333, 335} accept' |
103 | 77abc10b | Nacho Barrientos | ) |
104 | } |
||
105 | end
|
||
106 | |||
107 | 825f4eb1 | Tim Skirvin | describe 'port array and range' do |
108 | let(:params) do |
||
109 | { |
||
110 | dport: [333, 335, '338-339'], |
||
111 | sport: [433, 435, '438-439'], |
||
112 | proto: 'tcp', |
||
113 | } |
||
114 | end
|
||
115 | |||
116 | it { is_expected.to compile } |
||
117 | |||
118 | it { |
||
119 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
120 | content: 'tcp sport {433, 435, 438-439} tcp dport {333, 335, 338-339} accept' |
||
121 | ) |
||
122 | } |
||
123 | end
|
||
124 | |||
125 | 77abc10b | Nacho Barrientos | describe 'only sport TCP traffic' do |
126 | let(:params) do |
||
127 | { |
||
128 | sport: 555, |
||
129 | 3a52fb41 | Nacho Barrientos | proto: 'tcp', |
130 | } |
||
131 | end
|
||
132 | |||
133 | it { is_expected.to compile } |
||
134 | c82b960a | Steve Traylen | |
135 | 3a52fb41 | Nacho Barrientos | it { |
136 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
137 | fa92e118 | Romain Tartière | content: 'tcp sport {555} accept' |
138 | 83382bb5 | Nacho Barrientos | ) |
139 | } |
||
140 | end
|
||
141 | 316bc3f8 | Nacho Barrientos | |
142 | describe 'only IPv4 TCP traffic' do |
||
143 | let(:params) do |
||
144 | { |
||
145 | dport: 333, |
||
146 | proto: 'tcp4', |
||
147 | } |
||
148 | end
|
||
149 | |||
150 | it { is_expected.to compile } |
||
151 | c82b960a | Steve Traylen | |
152 | 316bc3f8 | Nacho Barrientos | it { |
153 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
154 | fa92e118 | Romain Tartière | content: 'ip version 4 tcp dport {333} accept' |
155 | 316bc3f8 | Nacho Barrientos | ) |
156 | } |
||
157 | end
|
||
158 | |||
159 | describe 'only IPv6 UDP traffic' do |
||
160 | let(:params) do |
||
161 | { |
||
162 | dport: 33, |
||
163 | proto: 'udp6', |
||
164 | } |
||
165 | end
|
||
166 | |||
167 | it { is_expected.to compile } |
||
168 | c82b960a | Steve Traylen | |
169 | 316bc3f8 | Nacho Barrientos | it { |
170 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
171 | fa92e118 | Romain Tartière | content: 'ip6 version 6 udp dport {33} accept' |
172 | 316bc3f8 | Nacho Barrientos | ) |
173 | } |
||
174 | end
|
||
175 | aaa37172 | Nacho Barrientos | |
176 | 14156fb6 | Nacho Barrientos | describe 'only IPv6 TCP traffic' do |
177 | let(:params) do |
||
178 | { |
||
179 | dport: 35, |
||
180 | proto: 'tcp6', |
||
181 | } |
||
182 | end
|
||
183 | |||
184 | it { is_expected.to compile } |
||
185 | c82b960a | Steve Traylen | |
186 | 14156fb6 | Nacho Barrientos | it { |
187 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
188 | fa92e118 | Romain Tartière | content: 'ip6 version 6 tcp dport {35} accept' |
189 | 14156fb6 | Nacho Barrientos | ) |
190 | } |
||
191 | end
|
||
192 | |||
193 | aaa37172 | Nacho Barrientos | describe 'with an IPv4 CIDR as daddr' do |
194 | let(:params) do |
||
195 | { |
||
196 | daddr: '192.168.0.1/24', |
||
197 | dport: 33, |
||
198 | proto: 'tcp', |
||
199 | } |
||
200 | end
|
||
201 | |||
202 | it { is_expected.to compile } |
||
203 | c82b960a | Steve Traylen | |
204 | aaa37172 | Nacho Barrientos | it { |
205 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
206 | fa92e118 | Romain Tartière | content: 'tcp dport {33} ip daddr 192.168.0.1/24 accept' |
207 | aaa37172 | Nacho Barrientos | ) |
208 | } |
||
209 | end
|
||
210 | |||
211 | 9d02e9f8 | Stéphanie Jaumotte | describe 'with an IPV4 array address as daddr' do |
212 | let(:params) do |
||
213 | { |
||
214 | daddr: ['172.16.1.5', '172.16.1.10', '172.16.1.15'], |
||
215 | } |
||
216 | end
|
||
217 | |||
218 | it { is_expected.to compile } |
||
219 | |||
220 | it { |
||
221 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
222 | content: 'ip daddr {172.16.1.5, 172.16.1.10, 172.16.1.15} accept' |
||
223 | ) |
||
224 | } |
||
225 | end
|
||
226 | |||
227 | aaa37172 | Nacho Barrientos | describe 'with an IPv6 address as daddr' do |
228 | let(:params) do |
||
229 | { |
||
230 | daddr: '2001:1458::1', |
||
231 | } |
||
232 | end
|
||
233 | |||
234 | it { is_expected.to compile } |
||
235 | c82b960a | Steve Traylen | |
236 | aaa37172 | Nacho Barrientos | it { |
237 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
238 | fa92e118 | Romain Tartière | content: 'ip6 daddr 2001:1458::1 accept' |
239 | aaa37172 | Nacho Barrientos | ) |
240 | } |
||
241 | end
|
||
242 | |||
243 | 9d02e9f8 | Stéphanie Jaumotte | describe 'with an IPV6 array address as daddr' do |
244 | 3a469f2b | Nacho Barrientos | let(:params) do |
245 | { |
||
246 | 9d02e9f8 | Stéphanie Jaumotte | daddr: ['2001:1458:0000:0000:0000:0000:0000:0003', '8896:d5d9:e6f4:dd8f:af69:f5c0:0131:264f'], |
247 | 3a469f2b | Nacho Barrientos | } |
248 | end
|
||
249 | |||
250 | it { is_expected.to compile } |
||
251 | c82b960a | Steve Traylen | |
252 | 3a469f2b | Nacho Barrientos | it { |
253 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
254 | 9d02e9f8 | Stéphanie Jaumotte | content: 'ip6 daddr {2001:1458:0000:0000:0000:0000:0000:0003, 8896:d5d9:e6f4:dd8f:af69:f5c0:0131:264f} accept' |
255 | ) |
||
256 | } |
||
257 | end
|
||
258 | |||
259 | describe 'with a @addr IPV4 set as daddr' do |
||
260 | let(:params) do |
||
261 | { |
||
262 | daddr: '@my4_set', |
||
263 | set_type: 'ip', |
||
264 | } |
||
265 | end
|
||
266 | |||
267 | it { is_expected.to compile } |
||
268 | |||
269 | it { |
||
270 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
271 | content: 'ip daddr @my4_set accept' |
||
272 | ) |
||
273 | } |
||
274 | end
|
||
275 | |||
276 | describe 'with a @addr IPV4 array set as daddr' do |
||
277 | let(:params) do |
||
278 | { |
||
279 | daddr: ['@my4_1_set', '@my4_2_set'], |
||
280 | set_type: 'ip', |
||
281 | } |
||
282 | end
|
||
283 | |||
284 | it { is_expected.to compile } |
||
285 | |||
286 | it { |
||
287 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
288 | content: 'ip daddr {@my4_1_set, @my4_2_set} accept' |
||
289 | ) |
||
290 | } |
||
291 | end
|
||
292 | |||
293 | describe 'with an @addr IPV6 set as daddr, default set_type' do |
||
294 | let(:params) do |
||
295 | { |
||
296 | daddr: '@my6_set', |
||
297 | } |
||
298 | end
|
||
299 | |||
300 | it { is_expected.to compile } |
||
301 | |||
302 | it { |
||
303 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
304 | content: 'ip6 daddr @my6_set accept' |
||
305 | ) |
||
306 | } |
||
307 | end
|
||
308 | |||
309 | describe 'with an @addr IPV6 array set as daddr, default set_type' do |
||
310 | let(:params) do |
||
311 | { |
||
312 | daddr: ['@my6_1_set', '@my6_2_set'], |
||
313 | } |
||
314 | end
|
||
315 | |||
316 | it { is_expected.to compile } |
||
317 | |||
318 | it { |
||
319 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
320 | content: 'ip6 daddr {@my6_1_set, @my6_2_set} accept' |
||
321 | 3a469f2b | Nacho Barrientos | ) |
322 | } |
||
323 | end
|
||
324 | |||
325 | bd8baa0f | Nacho Barrientos | describe 'with an IPv4 address as saddr' do |
326 | let(:params) do |
||
327 | { |
||
328 | saddr: '172.16.1.5', |
||
329 | } |
||
330 | end
|
||
331 | |||
332 | it { is_expected.to compile } |
||
333 | c82b960a | Steve Traylen | |
334 | bd8baa0f | Nacho Barrientos | it { |
335 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
336 | fa92e118 | Romain Tartière | content: 'ip saddr 172.16.1.5 accept' |
337 | bd8baa0f | Nacho Barrientos | ) |
338 | } |
||
339 | end
|
||
340 | |||
341 | 9d02e9f8 | Stéphanie Jaumotte | describe 'with an IPV4 array address as saddr' do |
342 | aaa37172 | Nacho Barrientos | let(:params) do |
343 | { |
||
344 | 9d02e9f8 | Stéphanie Jaumotte | saddr: ['172.16.1.5', '172.16.1.10', '172.16.1.15'], |
345 | aaa37172 | Nacho Barrientos | } |
346 | end
|
||
347 | |||
348 | it { is_expected.to compile } |
||
349 | c82b960a | Steve Traylen | |
350 | aaa37172 | Nacho Barrientos | it { |
351 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
352 | 9d02e9f8 | Stéphanie Jaumotte | content: 'ip saddr {172.16.1.5, 172.16.1.10, 172.16.1.15} accept' |
353 | aaa37172 | Nacho Barrientos | ) |
354 | } |
||
355 | end
|
||
356 | |||
357 | 9d02e9f8 | Stéphanie Jaumotte | describe 'with an IPv6 address as saddr' do |
358 | aaa37172 | Nacho Barrientos | let(:params) do |
359 | { |
||
360 | 9d02e9f8 | Stéphanie Jaumotte | saddr: '2001:1458:0000:0000:0000:0000:0000:0003', |
361 | } |
||
362 | end
|
||
363 | |||
364 | it { is_expected.to compile } |
||
365 | |||
366 | it { |
||
367 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
368 | content: 'ip6 saddr 2001:1458:0000:0000:0000:0000:0000:0003 accept' |
||
369 | ) |
||
370 | } |
||
371 | end
|
||
372 | |||
373 | describe 'with an IPV6 array address as saddr' do |
||
374 | let(:params) do |
||
375 | { |
||
376 | saddr: ['2001:1458:0000:0000:0000:0000:0000:0003', '8896:d5d9:e6f4:dd8f:af69:f5c0:0131:264f'], |
||
377 | } |
||
378 | end
|
||
379 | |||
380 | it { is_expected.to compile } |
||
381 | |||
382 | it { |
||
383 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
384 | content: 'ip6 saddr {2001:1458:0000:0000:0000:0000:0000:0003, 8896:d5d9:e6f4:dd8f:af69:f5c0:0131:264f} accept' |
||
385 | ) |
||
386 | } |
||
387 | end
|
||
388 | |||
389 | describe 'with a @addr IPV4 set as saddr' do |
||
390 | let(:params) do |
||
391 | { |
||
392 | saddr: '@my4_set', |
||
393 | aaa37172 | Nacho Barrientos | set_type: 'ip', |
394 | } |
||
395 | end
|
||
396 | |||
397 | it { is_expected.to compile } |
||
398 | c82b960a | Steve Traylen | |
399 | aaa37172 | Nacho Barrientos | it { |
400 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
401 | 9d02e9f8 | Stéphanie Jaumotte | content: 'ip saddr @my4_set accept' |
402 | aaa37172 | Nacho Barrientos | ) |
403 | } |
||
404 | end
|
||
405 | |||
406 | 9d02e9f8 | Stéphanie Jaumotte | describe 'with a @addr IPV4 array set as saddr' do |
407 | let(:params) do |
||
408 | { |
||
409 | saddr: ['@my4_1_set', '@my4_2_set'], |
||
410 | set_type: 'ip', |
||
411 | } |
||
412 | end
|
||
413 | |||
414 | it { is_expected.to compile } |
||
415 | |||
416 | it { |
||
417 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
418 | content: 'ip saddr {@my4_1_set, @my4_2_set} accept' |
||
419 | ) |
||
420 | } |
||
421 | end
|
||
422 | |||
423 | describe 'with an @addr IPV6 set as saddr, default set_type' do |
||
424 | 3a469f2b | Nacho Barrientos | let(:params) do |
425 | { |
||
426 | saddr: '@my6_set', |
||
427 | } |
||
428 | end
|
||
429 | |||
430 | it { is_expected.to compile } |
||
431 | c82b960a | Steve Traylen | |
432 | 3a469f2b | Nacho Barrientos | it { |
433 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
434 | fa92e118 | Romain Tartière | content: 'ip6 saddr @my6_set accept' |
435 | 3a469f2b | Nacho Barrientos | ) |
436 | } |
||
437 | end
|
||
438 | |||
439 | 9d02e9f8 | Stéphanie Jaumotte | describe 'with an @addr IPV6 array set as saddr, default set_type' do |
440 | let(:params) do |
||
441 | { |
||
442 | saddr: ['@my6_1_set', '@my6_2_set'], |
||
443 | } |
||
444 | end
|
||
445 | |||
446 | it { is_expected.to compile } |
||
447 | |||
448 | it { |
||
449 | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
||
450 | content: 'ip6 saddr {@my6_1_set, @my6_2_set} accept' |
||
451 | ) |
||
452 | } |
||
453 | end
|
||
454 | |||
455 | d43ced4d | Nacho Barrientos | describe 'with counter enabled' do |
456 | let(:params) do |
||
457 | { |
||
458 | counter: true, |
||
459 | } |
||
460 | end
|
||
461 | |||
462 | it { is_expected.to compile } |
||
463 | c82b960a | Steve Traylen | |
464 | d43ced4d | Nacho Barrientos | it { |
465 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
466 | fa92e118 | Romain Tartière | content: 'counter accept' |
467 | d43ced4d | Nacho Barrientos | ) |
468 | } |
||
469 | end
|
||
470 | 5944b9cb | Nacho Barrientos | |
471 | describe 'counter and continue sport' do |
||
472 | let(:params) do |
||
473 | { |
||
474 | proto: 'tcp', |
||
475 | sport: 80, |
||
476 | counter: true, |
||
477 | action: 'continue', |
||
478 | } |
||
479 | end
|
||
480 | |||
481 | it { is_expected.to compile } |
||
482 | c82b960a | Steve Traylen | |
483 | 5944b9cb | Nacho Barrientos | it { |
484 | c82b960a | Steve Traylen | expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
|
485 | fa92e118 | Romain Tartière | content: 'tcp sport {80} counter continue' |
486 | 5944b9cb | Nacho Barrientos | ) |
487 | } |
||
488 | end
|
||
489 | 83382bb5 | Nacho Barrientos | end
|
490 | end
|
||
491 | end |