root / spec / acceptance / default_spec.rb @ 3016d428
Historique | Voir | Annoter | Télécharger (8,67 ko)
| 1 | c82b960a | Steve Traylen | # frozen_string_literal: true
|
|---|---|---|---|
| 2 | |||
| 3 | bd5145ab | Steve Traylen | require 'spec_helper_acceptance'
|
| 4 | |||
| 5 | describe 'nftables class' do |
||
| 6 | context 'configure default nftables service' do |
||
| 7 | it 'works idempotently with no errors' do |
||
| 8 | pp = <<-EOS |
||
| 9 | a528bf59 | Steve Traylen |
|
| 10 | # Default ArchLinux rules contain "destroy" that requires kernel >= 6.3
|
||
| 11 | # https://gitlab.archlinux.org/archlinux/packaging/packages/nftables/-/commit/f26a7145b2885d298925819782a5302905332dbe
|
||
| 12 | # When running on docker this may not be the case.
|
||
| 13 | if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
||
| 14 | $_clobber_default_config = true
|
||
| 15 | } else {
|
||
| 16 | $_clobber_default_config = undef
|
||
| 17 | }
|
||
| 18 |
|
||
| 19 | bd5145ab | Steve Traylen | # default mask of firewalld service fails if service is not installed.
|
| 20 | # https://tickets.puppetlabs.com/browse/PUP-10814
|
||
| 21 | class { 'nftables':
|
||
| 22 | firewalld_enable => false,
|
||
| 23 | a528bf59 | Steve Traylen | clobber_default_config => $_clobber_default_config,
|
| 24 | bd5145ab | Steve Traylen | }
|
| 25 | 8842a597 | Tim Meusel | $config_path = $facts['os']['family'] ? {
|
| 26 | 'Archlinux' => '/etc/nftables.conf',
|
||
| 27 | 008c95d7 | Kienan Stewart | 'Debian' => '/etc/nftables.conf',
|
| 28 | 8842a597 | Tim Meusel | default => '/etc/sysconfig/nftables.conf',
|
| 29 | }
|
||
| 30 | $nft_path = $facts['os']['family'] ? {
|
||
| 31 | 'Archlinux' => '/usr/bin/nft',
|
||
| 32 | default => '/usr/sbin/nft',
|
||
| 33 | 0c9bc308 | hashworks | }
|
| 34 | bd5145ab | Steve Traylen | # nftables cannot be started in docker so replace service with a validation only.
|
| 35 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 36 | ensure => present,
|
||
| 37 | unit => "nftables.service",
|
||
| 38 | content => [
|
||
| 39 | "[Service]",
|
||
| 40 | "ExecStart=",
|
||
| 41 | 8842a597 | Tim Meusel | "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
|
| 42 | bd5145ab | Steve Traylen | "ExecReload=",
|
| 43 | 8842a597 | Tim Meusel | "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
|
| 44 | bd5145ab | Steve Traylen | "",
|
| 45 | ].join("\n"),
|
||
| 46 | notify => Service["nftables"],
|
||
| 47 | }
|
||
| 48 | EOS
|
||
| 49 | # Run it twice and test for idempotency
|
||
| 50 | apply_manifest(pp, catch_failures: true) |
||
| 51 | apply_manifest(pp, catch_changes: true) |
||
| 52 | end
|
||
| 53 | |||
| 54 | describe package('nftables') do |
||
| 55 | it { is_expected.to be_installed }
|
||
| 56 | end
|
||
| 57 | |||
| 58 | describe service('nftables') do |
||
| 59 | it { is_expected.to be_running }
|
||
| 60 | it { is_expected.to be_enabled }
|
||
| 61 | end
|
||
| 62 | |||
| 63 | b5874974 | Steve Traylen | describe file('/etc/nftables/puppet.nft', '/etc/systemd/system/nftables.service.d/puppet_nft.conf') do |
| 64 | ce22630b | Steve Traylen | it { is_expected.to be_file }
|
| 65 | end
|
||
| 66 | |||
| 67 | bd5145ab | Steve Traylen | describe file('/etc/nftables/puppet') do |
| 68 | it { is_expected.to be_directory }
|
||
| 69 | end
|
||
| 70 | end
|
||
| 71 | c82b960a | Steve Traylen | |
| 72 | d8752442 | Steve Traylen | context 'with bad invalid nft rules' do |
| 73 | it 'puppet fails but should leave nft service running' do |
||
| 74 | pp = <<-EOS |
||
| 75 | a528bf59 | Steve Traylen | if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
| 76 | $_clobber_default_config = true
|
||
| 77 | } else {
|
||
| 78 | $_clobber_default_config = undef
|
||
| 79 | }
|
||
| 80 | d8752442 | Steve Traylen | class{'nftables':
|
| 81 | firewalld_enable => false,
|
||
| 82 | a528bf59 | Steve Traylen | clobber_default_config => $_clobber_default_config,
|
| 83 | d8752442 | Steve Traylen | }
|
| 84 | nftables::rule{'default_out-junk':
|
||
| 85 | content => 'A load of junk',
|
||
| 86 | }
|
||
| 87 | 8842a597 | Tim Meusel | $config_path = $facts['os']['family'] ? {
|
| 88 | 'Archlinux' => '/etc/nftables.conf',
|
||
| 89 | 008c95d7 | Kienan Stewart | 'Debian' => '/etc/nftables.conf',
|
| 90 | 8842a597 | Tim Meusel | default => '/etc/sysconfig/nftables.conf',
|
| 91 | }
|
||
| 92 | $nft_path = $facts['os']['family'] ? {
|
||
| 93 | 'Archlinux' => '/usr/bin/nft',
|
||
| 94 | default => '/usr/sbin/nft',
|
||
| 95 | 0c9bc308 | hashworks | }
|
| 96 | d8752442 | Steve Traylen | # nftables cannot be started in docker so replace service with a validation only.
|
| 97 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 98 | ensure => present,
|
||
| 99 | unit => "nftables.service",
|
||
| 100 | content => [
|
||
| 101 | "[Service]",
|
||
| 102 | "ExecStart=",
|
||
| 103 | 8842a597 | Tim Meusel | "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
|
| 104 | d8752442 | Steve Traylen | "ExecReload=",
|
| 105 | 8842a597 | Tim Meusel | "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
|
| 106 | d8752442 | Steve Traylen | "",
|
| 107 | ].join("\n"),
|
||
| 108 | notify => Service["nftables"],
|
||
| 109 | }
|
||
| 110 | EOS
|
||
| 111 | apply_manifest(pp, expect_failures: true) |
||
| 112 | end
|
||
| 113 | c82b960a | Steve Traylen | |
| 114 | d8752442 | Steve Traylen | describe service('nftables') do |
| 115 | it { is_expected.to be_running }
|
||
| 116 | it { is_expected.to be_enabled }
|
||
| 117 | end
|
||
| 118 | end
|
||
| 119 | c82b960a | Steve Traylen | |
| 120 | 7b9d6ffc | Nacho Barrientos | context 'with totally empty firewall' do |
| 121 | it 'no rules validate okay' do |
||
| 122 | pp = <<-EOS |
||
| 123 | a528bf59 | Steve Traylen | if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
| 124 | $_clobber_default_config = true
|
||
| 125 | } else {
|
||
| 126 | $_clobber_default_config = undef
|
||
| 127 | }
|
||
| 128 | 7b9d6ffc | Nacho Barrientos | class{'nftables':
|
| 129 | firewalld_enable => false,
|
||
| 130 | inet_filter => false,
|
||
| 131 | nat => false,
|
||
| 132 | a528bf59 | Steve Traylen | clobber_default_config => $_clobber_default_config,
|
| 133 | 7b9d6ffc | Nacho Barrientos | }
|
| 134 | 8842a597 | Tim Meusel | $config_path = $facts['os']['family'] ? {
|
| 135 | 'Archlinux' => '/etc/nftables.conf',
|
||
| 136 | 008c95d7 | Kienan Stewart | 'Debian' => '/etc/nftables.conf',
|
| 137 | 8842a597 | Tim Meusel | default => '/etc/sysconfig/nftables.conf',
|
| 138 | }
|
||
| 139 | $nft_path = $facts['os']['family'] ? {
|
||
| 140 | 'Archlinux' => '/usr/bin/nft',
|
||
| 141 | default => '/usr/sbin/nft',
|
||
| 142 | 0c9bc308 | hashworks | }
|
| 143 | 7b9d6ffc | Nacho Barrientos | # nftables cannot be started in docker so replace service with a validation only.
|
| 144 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 145 | ensure => present,
|
||
| 146 | unit => "nftables.service",
|
||
| 147 | content => [
|
||
| 148 | "[Service]",
|
||
| 149 | "ExecStart=",
|
||
| 150 | 8842a597 | Tim Meusel | "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
|
| 151 | 7b9d6ffc | Nacho Barrientos | "ExecReload=",
|
| 152 | 8842a597 | Tim Meusel | "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
|
| 153 | 7b9d6ffc | Nacho Barrientos | "",
|
| 154 | ].join("\n"),
|
||
| 155 | notify => Service["nftables"],
|
||
| 156 | }
|
||
| 157 | EOS
|
||
| 158 | apply_manifest(pp, catch_failures: true) |
||
| 159 | end
|
||
| 160 | c82b960a | Steve Traylen | |
| 161 | 7b9d6ffc | Nacho Barrientos | describe service('nftables') do |
| 162 | it { is_expected.to be_running }
|
||
| 163 | it { is_expected.to be_enabled }
|
||
| 164 | end
|
||
| 165 | end
|
||
| 166 | c82b960a | Steve Traylen | |
| 167 | fcb79d73 | Ben Morrice | context 'with custom nat_table_name' do |
| 168 | it 'no rules validate okay' do |
||
| 169 | pp = <<-EOS |
||
| 170 | a528bf59 | Steve Traylen | if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
| 171 | $_clobber_default_config = true
|
||
| 172 | } else {
|
||
| 173 | $_clobber_default_config = undef
|
||
| 174 | }
|
||
| 175 | fcb79d73 | Ben Morrice | class{'nftables':
|
| 176 | firewalld_enable => false,
|
||
| 177 | nat => true,
|
||
| 178 | nat_table_name => 'mycustomtablename',
|
||
| 179 | a528bf59 | Steve Traylen | clobber_default_config => $_clobber_default_config,
|
| 180 | fcb79d73 | Ben Morrice | }
|
| 181 | 8842a597 | Tim Meusel | $config_path = $facts['os']['family'] ? {
|
| 182 | 9e100a98 | Nacho Barrientos | 'Archlinux' => '/etc/nftables.conf',
|
| 183 | 'Debian' => '/etc/nftables.conf',
|
||
| 184 | default => '/etc/sysconfig/nftables.conf',
|
||
| 185 | }
|
||
| 186 | $nft_path = $facts['os']['family'] ? {
|
||
| 187 | 'Archlinux' => '/usr/bin/nft',
|
||
| 188 | default => '/usr/sbin/nft',
|
||
| 189 | }
|
||
| 190 | # nftables cannot be started in docker so replace service with a validation only.
|
||
| 191 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 192 | ensure => present,
|
||
| 193 | unit => "nftables.service",
|
||
| 194 | content => [
|
||
| 195 | "[Service]",
|
||
| 196 | "ExecStart=",
|
||
| 197 | "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
|
||
| 198 | "ExecReload=",
|
||
| 199 | "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
|
||
| 200 | "",
|
||
| 201 | ].join("\n"),
|
||
| 202 | notify => Service["nftables"],
|
||
| 203 | }
|
||
| 204 | EOS
|
||
| 205 | apply_manifest(pp, catch_failures: true) |
||
| 206 | end
|
||
| 207 | |||
| 208 | describe service('nftables') do |
||
| 209 | it { is_expected.to be_running }
|
||
| 210 | it { is_expected.to be_enabled }
|
||
| 211 | end
|
||
| 212 | end
|
||
| 213 | |||
| 214 | context 'with only an empty netdev table' do |
||
| 215 | it 'rules validate okay' do |
||
| 216 | pp = <<-EOS |
||
| 217 | a528bf59 | Steve Traylen | if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
| 218 | $_clobber_default_config = true
|
||
| 219 | } else {
|
||
| 220 | $_clobber_default_config = undef
|
||
| 221 | }
|
||
| 222 | 9e100a98 | Nacho Barrientos | class{'nftables':
|
| 223 | firewalld_enable => false,
|
||
| 224 | inet_filter => false,
|
||
| 225 | nat => false,
|
||
| 226 | a528bf59 | Steve Traylen | clobber_default_config => $_clobber_default_config,
|
| 227 | 9e100a98 | Nacho Barrientos | }
|
| 228 | nftables::config {
|
||
| 229 | 'netdev-filter':
|
||
| 230 | prefix => '',
|
||
| 231 | }
|
||
| 232 | nftables::chain {
|
||
| 233 | [
|
||
| 234 | 'INPUT',
|
||
| 235 | 'OUTPUT',
|
||
| 236 | 'FORWARD',
|
||
| 237 | ]:
|
||
| 238 | table => 'netdev-filter';
|
||
| 239 | }
|
||
| 240 | $config_path = $facts['os']['family'] ? {
|
||
| 241 | 8842a597 | Tim Meusel | 'Archlinux' => '/etc/nftables.conf',
|
| 242 | 008c95d7 | Kienan Stewart | 'Debian' => '/etc/nftables.conf',
|
| 243 | 8842a597 | Tim Meusel | default => '/etc/sysconfig/nftables.conf',
|
| 244 | }
|
||
| 245 | $nft_path = $facts['os']['family'] ? {
|
||
| 246 | 'Archlinux' => '/usr/bin/nft',
|
||
| 247 | default => '/usr/sbin/nft',
|
||
| 248 | 0c9bc308 | hashworks | }
|
| 249 | fcb79d73 | Ben Morrice | # nftables cannot be started in docker so replace service with a validation only.
|
| 250 | systemd::dropin_file{"zzz_docker_nft.conf":
|
||
| 251 | ensure => present,
|
||
| 252 | unit => "nftables.service",
|
||
| 253 | content => [
|
||
| 254 | "[Service]",
|
||
| 255 | "ExecStart=",
|
||
| 256 | 8842a597 | Tim Meusel | "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
|
| 257 | fcb79d73 | Ben Morrice | "ExecReload=",
|
| 258 | 8842a597 | Tim Meusel | "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
|
| 259 | fcb79d73 | Ben Morrice | "",
|
| 260 | ].join("\n"),
|
||
| 261 | notify => Service["nftables"],
|
||
| 262 | }
|
||
| 263 | EOS
|
||
| 264 | apply_manifest(pp, catch_failures: true) |
||
| 265 | end
|
||
| 266 | c82b960a | Steve Traylen | |
| 267 | fcb79d73 | Ben Morrice | describe service('nftables') do |
| 268 | it { is_expected.to be_running }
|
||
| 269 | it { is_expected.to be_enabled }
|
||
| 270 | end
|
||
| 271 | end
|
||
| 272 | bd5145ab | Steve Traylen | end |