Révision fa92e118
Pet rubocop
| spec/classes/bridges_spec.rb | ||
|---|---|---|
| 14 | 14 |
'lo' => {},
|
| 15 | 15 |
'br0' => {},
|
| 16 | 16 |
'br1-2' => {},
|
| 17 |
} },
|
|
| 17 |
} } |
|
| 18 | 18 |
) |
| 19 | 19 |
end |
| 20 | 20 |
|
| ... | ... | |
| 24 | 24 |
it {
|
| 25 | 25 |
is_expected.to contain_nftables__rule('default_fwd-bridge_br0_br0').with(
|
| 26 | 26 |
order: '08', |
| 27 |
content: 'iifname br0 oifname br0 accept',
|
|
| 27 |
content: 'iifname br0 oifname br0 accept' |
|
| 28 | 28 |
) |
| 29 | 29 |
} |
| 30 | 30 |
|
| ... | ... | |
| 32 | 32 |
it {
|
| 33 | 33 |
is_expected.to contain_nftables__rule('default_fwd-bridge_br1_br1').with(
|
| 34 | 34 |
order: '08', |
| 35 |
content: 'iifname br1 oifname br1 accept',
|
|
| 35 |
content: 'iifname br1 oifname br1 accept' |
|
| 36 | 36 |
) |
| 37 | 37 |
} |
| 38 | 38 |
end |
| spec/classes/dnat4_spec.rb | ||
|---|---|---|
| 56 | 56 |
owner: 'root', |
| 57 | 57 |
group: 'root', |
| 58 | 58 |
mode: '0640', |
| 59 |
ensure_newline: true,
|
|
| 59 |
ensure_newline: true |
|
| 60 | 60 |
) |
| 61 | 61 |
} |
| 62 | 62 |
it {
|
| 63 | 63 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
|
| 64 | 64 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 65 | 65 |
content: %r{^chain default_fwd \{$},
|
| 66 |
order: '00',
|
|
| 66 |
order: '00' |
|
| 67 | 67 |
) |
| 68 | 68 |
} |
| 69 | 69 |
it {
|
| 70 | 70 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-jump_ingoing').with(
|
| 71 | 71 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 72 | 72 |
content: %r{^ iifname eth0 oifname eth1 jump ingoing$},
|
| 73 |
order: '20-nftables-inet-filter-chain-default_fwd-rule-jump_ingoing-b',
|
|
| 73 |
order: '20-nftables-inet-filter-chain-default_fwd-rule-jump_ingoing-b' |
|
| 74 | 74 |
) |
| 75 | 75 |
} |
| 76 | 76 |
it {
|
| 77 | 77 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
|
| 78 | 78 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 79 | 79 |
content: %r{^\}$},
|
| 80 |
order: '99',
|
|
| 80 |
order: '99' |
|
| 81 | 81 |
) |
| 82 | 82 |
} |
| 83 | 83 |
|
| ... | ... | |
| 85 | 85 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-header').with(
|
| 86 | 86 |
target: 'nftables-inet-filter-chain-ingoing', |
| 87 | 87 |
content: %r{^chain ingoing \{$},
|
| 88 |
order: '00',
|
|
| 88 |
order: '00' |
|
| 89 | 89 |
) |
| 90 | 90 |
} |
| 91 | 91 |
it {
|
| 92 | 92 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-http').with(
|
| 93 | 93 |
target: 'nftables-inet-filter-chain-ingoing', |
| 94 | 94 |
content: %r{^ ip daddr 192.0.2.2 tcp dport http accept$},
|
| 95 |
order: '10-nftables-inet-filter-chain-ingoing-rule-http-b',
|
|
| 95 |
order: '10-nftables-inet-filter-chain-ingoing-rule-http-b' |
|
| 96 | 96 |
) |
| 97 | 97 |
} |
| 98 | 98 |
it {
|
| 99 | 99 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-https').with(
|
| 100 | 100 |
target: 'nftables-inet-filter-chain-ingoing', |
| 101 | 101 |
content: %r{^ ip daddr 192.0.2.2 tcp dport https accept$},
|
| 102 |
order: '10-nftables-inet-filter-chain-ingoing-rule-https-b',
|
|
| 102 |
order: '10-nftables-inet-filter-chain-ingoing-rule-https-b' |
|
| 103 | 103 |
) |
| 104 | 104 |
} |
| 105 | 105 |
it {
|
| 106 | 106 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-http_alt').with(
|
| 107 | 107 |
target: 'nftables-inet-filter-chain-ingoing', |
| 108 | 108 |
content: %r{^ iifname eth0 ip daddr 192.0.2.2 tcp dport 8000 accept$},
|
| 109 |
order: '10-nftables-inet-filter-chain-ingoing-rule-http_alt-b',
|
|
| 109 |
order: '10-nftables-inet-filter-chain-ingoing-rule-http_alt-b' |
|
| 110 | 110 |
) |
| 111 | 111 |
} |
| 112 | 112 |
it {
|
| 113 | 113 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-wireguard').with(
|
| 114 | 114 |
target: 'nftables-inet-filter-chain-ingoing', |
| 115 | 115 |
content: %r{^ iifname eth0 ip daddr 192.0.2.3 udp dport 51820 accept$},
|
| 116 |
order: '10-nftables-inet-filter-chain-ingoing-rule-wireguard-b',
|
|
| 116 |
order: '10-nftables-inet-filter-chain-ingoing-rule-wireguard-b' |
|
| 117 | 117 |
) |
| 118 | 118 |
} |
| 119 | 119 |
it {
|
| 120 | 120 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-footer').with(
|
| 121 | 121 |
target: 'nftables-inet-filter-chain-ingoing', |
| 122 | 122 |
content: %r{^\}$},
|
| 123 |
order: '99',
|
|
| 123 |
order: '99' |
|
| 124 | 124 |
) |
| 125 | 125 |
} |
| 126 | 126 |
|
| ... | ... | |
| 130 | 130 |
owner: 'root', |
| 131 | 131 |
group: 'root', |
| 132 | 132 |
mode: '0640', |
| 133 |
ensure_newline: true,
|
|
| 133 |
ensure_newline: true |
|
| 134 | 134 |
) |
| 135 | 135 |
} |
| 136 | 136 |
it {
|
| 137 | 137 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
|
| 138 | 138 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 139 | 139 |
content: %r{^chain PREROUTING \{$},
|
| 140 |
order: '00',
|
|
| 140 |
order: '00' |
|
| 141 | 141 |
) |
| 142 | 142 |
} |
| 143 | 143 |
it {
|
| 144 | 144 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
|
| 145 | 145 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 146 | 146 |
content: %r{^ type nat hook prerouting priority -100$},
|
| 147 |
order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b',
|
|
| 147 |
order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b' |
|
| 148 | 148 |
) |
| 149 | 149 |
} |
| 150 | 150 |
it {
|
| 151 | 151 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
|
| 152 | 152 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 153 | 153 |
content: %r{^ policy accept$},
|
| 154 |
order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b',
|
|
| 154 |
order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b' |
|
| 155 | 155 |
) |
| 156 | 156 |
} |
| 157 | 157 |
it {
|
| 158 | 158 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-http').with(
|
| 159 | 159 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 160 | 160 |
content: %r{^ tcp dport http dnat to 192.0.2.2$},
|
| 161 |
order: '10-nftables-ip-nat-chain-PREROUTING-rule-http-b',
|
|
| 161 |
order: '10-nftables-ip-nat-chain-PREROUTING-rule-http-b' |
|
| 162 | 162 |
) |
| 163 | 163 |
} |
| 164 | 164 |
it {
|
| 165 | 165 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-https').with(
|
| 166 | 166 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 167 | 167 |
content: %r{^ tcp dport https dnat to 192.0.2.2$},
|
| 168 |
order: '10-nftables-ip-nat-chain-PREROUTING-rule-https-b',
|
|
| 168 |
order: '10-nftables-ip-nat-chain-PREROUTING-rule-https-b' |
|
| 169 | 169 |
) |
| 170 | 170 |
} |
| 171 | 171 |
it {
|
| 172 | 172 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-http_alt').with(
|
| 173 | 173 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 174 | 174 |
content: %r{^ iifname eth0 tcp dport 8080 dnat to 192.0.2.2:8000$},
|
| 175 |
order: '10-nftables-ip-nat-chain-PREROUTING-rule-http_alt-b',
|
|
| 175 |
order: '10-nftables-ip-nat-chain-PREROUTING-rule-http_alt-b' |
|
| 176 | 176 |
) |
| 177 | 177 |
} |
| 178 | 178 |
it {
|
| 179 | 179 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-wireguard').with(
|
| 180 | 180 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 181 | 181 |
content: %r{^ iifname eth0 udp dport 51820 dnat to 192.0.2.3$},
|
| 182 |
order: '10-nftables-ip-nat-chain-PREROUTING-rule-wireguard-b',
|
|
| 182 |
order: '10-nftables-ip-nat-chain-PREROUTING-rule-wireguard-b' |
|
| 183 | 183 |
) |
| 184 | 184 |
} |
| 185 | 185 |
it {
|
| 186 | 186 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
|
| 187 | 187 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 188 | 188 |
content: %r{^\}$},
|
| 189 |
order: '99',
|
|
| 189 |
order: '99' |
|
| 190 | 190 |
) |
| 191 | 191 |
} |
| 192 | 192 |
end |
| spec/classes/inet_filter_spec.rb | ||
|---|---|---|
| 15 | 15 |
ensure: 'present', |
| 16 | 16 |
owner: 'root', |
| 17 | 17 |
group: 'root', |
| 18 |
mode: '0640',
|
|
| 18 |
mode: '0640' |
|
| 19 | 19 |
) |
| 20 | 20 |
} |
| 21 | 21 |
|
| ... | ... | |
| 23 | 23 |
is_expected.to contain_concat__fragment('nftables-inet-filter-header').with(
|
| 24 | 24 |
target: 'nftables-inet-filter', |
| 25 | 25 |
content: %r{^table inet filter \{$},
|
| 26 |
order: '00',
|
|
| 26 |
order: '00' |
|
| 27 | 27 |
) |
| 28 | 28 |
} |
| 29 | 29 |
|
| 30 | 30 |
it {
|
| 31 | 31 |
is_expected.to contain_concat__fragment('nftables-inet-filter-body').with(
|
| 32 | 32 |
target: 'nftables-inet-filter', |
| 33 |
order: '98',
|
|
| 33 |
order: '98' |
|
| 34 | 34 |
) |
| 35 | 35 |
} |
| 36 | 36 |
|
| ... | ... | |
| 38 | 38 |
is_expected.to contain_concat__fragment('nftables-inet-filter-footer').with(
|
| 39 | 39 |
target: 'nftables-inet-filter', |
| 40 | 40 |
content: %r{^\}$},
|
| 41 |
order: '99',
|
|
| 41 |
order: '99' |
|
| 42 | 42 |
) |
| 43 | 43 |
} |
| 44 | 44 |
|
| ... | ... | |
| 49 | 49 |
owner: 'root', |
| 50 | 50 |
group: 'root', |
| 51 | 51 |
mode: '0640', |
| 52 |
ensure_newline: true,
|
|
| 52 |
ensure_newline: true |
|
| 53 | 53 |
) |
| 54 | 54 |
} |
| 55 | 55 |
it {
|
| 56 | 56 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-header').with(
|
| 57 | 57 |
target: 'nftables-inet-filter-chain-INPUT', |
| 58 | 58 |
content: %r{^chain INPUT \{$},
|
| 59 |
order: '00',
|
|
| 59 |
order: '00' |
|
| 60 | 60 |
) |
| 61 | 61 |
} |
| 62 | 62 |
it {
|
| 63 | 63 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-type').with(
|
| 64 | 64 |
target: 'nftables-inet-filter-chain-INPUT', |
| 65 | 65 |
content: %r{^ type filter hook input priority 0$},
|
| 66 |
order: '01-nftables-inet-filter-chain-INPUT-rule-type-b',
|
|
| 66 |
order: '01-nftables-inet-filter-chain-INPUT-rule-type-b' |
|
| 67 | 67 |
) |
| 68 | 68 |
} |
| 69 | 69 |
it {
|
| 70 | 70 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-policy').with(
|
| 71 | 71 |
target: 'nftables-inet-filter-chain-INPUT', |
| 72 | 72 |
content: %r{^ policy drop$},
|
| 73 |
order: '02-nftables-inet-filter-chain-INPUT-rule-policy-b',
|
|
| 73 |
order: '02-nftables-inet-filter-chain-INPUT-rule-policy-b' |
|
| 74 | 74 |
) |
| 75 | 75 |
} |
| 76 | 76 |
it {
|
| 77 | 77 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-lo').with(
|
| 78 | 78 |
target: 'nftables-inet-filter-chain-INPUT', |
| 79 | 79 |
content: %r{^ iifname lo accept$},
|
| 80 |
order: '03-nftables-inet-filter-chain-INPUT-rule-lo-b',
|
|
| 80 |
order: '03-nftables-inet-filter-chain-INPUT-rule-lo-b' |
|
| 81 | 81 |
) |
| 82 | 82 |
} |
| 83 | 83 |
it {
|
| 84 | 84 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_global').with(
|
| 85 | 85 |
target: 'nftables-inet-filter-chain-INPUT', |
| 86 | 86 |
content: %r{^ jump global$},
|
| 87 |
order: '04-nftables-inet-filter-chain-INPUT-rule-jump_global-b',
|
|
| 87 |
order: '04-nftables-inet-filter-chain-INPUT-rule-jump_global-b' |
|
| 88 | 88 |
) |
| 89 | 89 |
} |
| 90 | 90 |
it {
|
| 91 | 91 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-accept_established_related').with(
|
| 92 | 92 |
target: 'nftables-inet-filter-chain-INPUT', |
| 93 | 93 |
content: %r{^ ct state established,related accept$},
|
| 94 |
order: '05-nftables-inet-filter-chain-INPUT-rule-accept_established_related-b',
|
|
| 94 |
order: '05-nftables-inet-filter-chain-INPUT-rule-accept_established_related-b' |
|
| 95 | 95 |
) |
| 96 | 96 |
} |
| 97 | 97 |
it {
|
| 98 | 98 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-drop_invalid').with(
|
| 99 | 99 |
target: 'nftables-inet-filter-chain-INPUT', |
| 100 | 100 |
content: %r{^ ct state invalid drop$},
|
| 101 |
order: '06-nftables-inet-filter-chain-INPUT-rule-drop_invalid-b',
|
|
| 101 |
order: '06-nftables-inet-filter-chain-INPUT-rule-drop_invalid-b' |
|
| 102 | 102 |
) |
| 103 | 103 |
} |
| 104 | 104 |
it {
|
| 105 | 105 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_default_in').with(
|
| 106 | 106 |
target: 'nftables-inet-filter-chain-INPUT', |
| 107 | 107 |
content: %r{^ jump default_in$},
|
| 108 |
order: '10-nftables-inet-filter-chain-INPUT-rule-jump_default_in-b',
|
|
| 108 |
order: '10-nftables-inet-filter-chain-INPUT-rule-jump_default_in-b' |
|
| 109 | 109 |
) |
| 110 | 110 |
} |
| 111 | 111 |
it {
|
| 112 | 112 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
|
| 113 | 113 |
target: 'nftables-inet-filter-chain-INPUT', |
| 114 | 114 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},
|
| 115 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',
|
|
| 115 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b' |
|
| 116 | 116 |
) |
| 117 | 117 |
} |
| 118 | 118 |
it {
|
| 119 | 119 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-reject').with(
|
| 120 | 120 |
target: 'nftables-inet-filter-chain-INPUT', |
| 121 | 121 |
content: %r{^ reject with icmpx type port-unreachable$},
|
| 122 |
order: '98-nftables-inet-filter-chain-INPUT-rule-reject-b',
|
|
| 122 |
order: '98-nftables-inet-filter-chain-INPUT-rule-reject-b' |
|
| 123 | 123 |
) |
| 124 | 124 |
} |
| 125 | 125 |
it {
|
| 126 | 126 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-footer').with(
|
| 127 | 127 |
target: 'nftables-inet-filter-chain-INPUT', |
| 128 | 128 |
content: %r{^\}$},
|
| 129 |
order: '99',
|
|
| 129 |
order: '99' |
|
| 130 | 130 |
) |
| 131 | 131 |
} |
| 132 | 132 |
|
| ... | ... | |
| 136 | 136 |
owner: 'root', |
| 137 | 137 |
group: 'root', |
| 138 | 138 |
mode: '0640', |
| 139 |
ensure_newline: true,
|
|
| 139 |
ensure_newline: true |
|
| 140 | 140 |
) |
| 141 | 141 |
} |
| 142 | 142 |
it {
|
| 143 | 143 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-header').with(
|
| 144 | 144 |
target: 'nftables-inet-filter-chain-default_in', |
| 145 | 145 |
content: %r{^chain default_in \{$},
|
| 146 |
order: '00',
|
|
| 146 |
order: '00' |
|
| 147 | 147 |
) |
| 148 | 148 |
} |
| 149 | 149 |
it {
|
| 150 | 150 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-footer').with(
|
| 151 | 151 |
target: 'nftables-inet-filter-chain-default_in', |
| 152 | 152 |
content: %r{^\}$},
|
| 153 |
order: '99',
|
|
| 153 |
order: '99' |
|
| 154 | 154 |
) |
| 155 | 155 |
} |
| 156 | 156 |
it {
|
| 157 | 157 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-rule-ssh').with(
|
| 158 | 158 |
target: 'nftables-inet-filter-chain-default_in', |
| 159 | 159 |
content: %r{^ tcp dport \{22\} accept$},
|
| 160 |
order: '50-nftables-inet-filter-chain-default_in-rule-ssh-b',
|
|
| 160 |
order: '50-nftables-inet-filter-chain-default_in-rule-ssh-b' |
|
| 161 | 161 |
) |
| 162 | 162 |
} |
| 163 | 163 |
it {
|
| ... | ... | |
| 172 | 172 |
owner: 'root', |
| 173 | 173 |
group: 'root', |
| 174 | 174 |
mode: '0640', |
| 175 |
ensure_newline: true,
|
|
| 175 |
ensure_newline: true |
|
| 176 | 176 |
) |
| 177 | 177 |
} |
| 178 | 178 |
it {
|
| 179 | 179 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-header').with(
|
| 180 | 180 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 181 | 181 |
content: %r{^chain OUTPUT \{$},
|
| 182 |
order: '00',
|
|
| 182 |
order: '00' |
|
| 183 | 183 |
) |
| 184 | 184 |
} |
| 185 | 185 |
it {
|
| 186 | 186 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-type').with(
|
| 187 | 187 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 188 | 188 |
content: %r{^ type filter hook output priority 0$},
|
| 189 |
order: '01-nftables-inet-filter-chain-OUTPUT-rule-type-b',
|
|
| 189 |
order: '01-nftables-inet-filter-chain-OUTPUT-rule-type-b' |
|
| 190 | 190 |
) |
| 191 | 191 |
} |
| 192 | 192 |
it {
|
| 193 | 193 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-policy').with(
|
| 194 | 194 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 195 | 195 |
content: %r{^ policy drop$},
|
| 196 |
order: '02-nftables-inet-filter-chain-OUTPUT-rule-policy-b',
|
|
| 196 |
order: '02-nftables-inet-filter-chain-OUTPUT-rule-policy-b' |
|
| 197 | 197 |
) |
| 198 | 198 |
} |
| 199 | 199 |
it {
|
| 200 | 200 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-lo').with(
|
| 201 | 201 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 202 | 202 |
content: %r{^ oifname lo accept$},
|
| 203 |
order: '03-nftables-inet-filter-chain-OUTPUT-rule-lo-b',
|
|
| 203 |
order: '03-nftables-inet-filter-chain-OUTPUT-rule-lo-b' |
|
| 204 | 204 |
) |
| 205 | 205 |
} |
| 206 | 206 |
it {
|
| 207 | 207 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_global').with(
|
| 208 | 208 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 209 | 209 |
content: %r{^ jump global$},
|
| 210 |
order: '04-nftables-inet-filter-chain-OUTPUT-rule-jump_global-b',
|
|
| 210 |
order: '04-nftables-inet-filter-chain-OUTPUT-rule-jump_global-b' |
|
| 211 | 211 |
) |
| 212 | 212 |
} |
| 213 | 213 |
it {
|
| 214 | 214 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-accept_established_related').with(
|
| 215 | 215 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 216 | 216 |
content: %r{^ ct state established,related accept$},
|
| 217 |
order: '05-nftables-inet-filter-chain-OUTPUT-rule-accept_established_related-b',
|
|
| 217 |
order: '05-nftables-inet-filter-chain-OUTPUT-rule-accept_established_related-b' |
|
| 218 | 218 |
) |
| 219 | 219 |
} |
| 220 | 220 |
it {
|
| 221 | 221 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-drop_invalid').with(
|
| 222 | 222 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 223 | 223 |
content: %r{^ ct state invalid drop$},
|
| 224 |
order: '06-nftables-inet-filter-chain-OUTPUT-rule-drop_invalid-b',
|
|
| 224 |
order: '06-nftables-inet-filter-chain-OUTPUT-rule-drop_invalid-b' |
|
| 225 | 225 |
) |
| 226 | 226 |
} |
| 227 | 227 |
it {
|
| 228 | 228 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_default_out').with(
|
| 229 | 229 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 230 | 230 |
content: %r{^ jump default_out$},
|
| 231 |
order: '10-nftables-inet-filter-chain-OUTPUT-rule-jump_default_out-b',
|
|
| 231 |
order: '10-nftables-inet-filter-chain-OUTPUT-rule-jump_default_out-b' |
|
| 232 | 232 |
) |
| 233 | 233 |
} |
| 234 | 234 |
it {
|
| 235 | 235 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
|
| 236 | 236 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 237 | 237 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},
|
| 238 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',
|
|
| 238 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b' |
|
| 239 | 239 |
) |
| 240 | 240 |
} |
| 241 | 241 |
it {
|
| 242 | 242 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-reject').with(
|
| 243 | 243 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 244 | 244 |
content: %r{^ reject with icmpx type port-unreachable$},
|
| 245 |
order: '98-nftables-inet-filter-chain-OUTPUT-rule-reject-b',
|
|
| 245 |
order: '98-nftables-inet-filter-chain-OUTPUT-rule-reject-b' |
|
| 246 | 246 |
) |
| 247 | 247 |
} |
| 248 | 248 |
it {
|
| 249 | 249 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-footer').with(
|
| 250 | 250 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 251 | 251 |
content: %r{^\}$},
|
| 252 |
order: '99',
|
|
| 252 |
order: '99' |
|
| 253 | 253 |
) |
| 254 | 254 |
} |
| 255 | 255 |
|
| ... | ... | |
| 259 | 259 |
owner: 'root', |
| 260 | 260 |
group: 'root', |
| 261 | 261 |
mode: '0640', |
| 262 |
ensure_newline: true,
|
|
| 262 |
ensure_newline: true |
|
| 263 | 263 |
) |
| 264 | 264 |
} |
| 265 | 265 |
it {
|
| 266 | 266 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-header').with(
|
| 267 | 267 |
target: 'nftables-inet-filter-chain-default_out', |
| 268 | 268 |
content: %r{^chain default_out \{$},
|
| 269 |
order: '00',
|
|
| 269 |
order: '00' |
|
| 270 | 270 |
) |
| 271 | 271 |
} |
| 272 | 272 |
it {
|
| 273 | 273 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-footer').with(
|
| 274 | 274 |
target: 'nftables-inet-filter-chain-default_out', |
| 275 | 275 |
content: %r{^\}$},
|
| 276 |
order: '99',
|
|
| 276 |
order: '99' |
|
| 277 | 277 |
) |
| 278 | 278 |
} |
| 279 | 279 |
it {
|
| 280 | 280 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp').with(
|
| 281 | 281 |
target: 'nftables-inet-filter-chain-default_out', |
| 282 | 282 |
content: %r{^ udp dport 53 accept$},
|
| 283 |
order: '50-nftables-inet-filter-chain-default_out-rule-dnsudp-b',
|
|
| 283 |
order: '50-nftables-inet-filter-chain-default_out-rule-dnsudp-b' |
|
| 284 | 284 |
) |
| 285 | 285 |
} |
| 286 | 286 |
it {
|
| 287 | 287 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp').with(
|
| 288 | 288 |
target: 'nftables-inet-filter-chain-default_out', |
| 289 | 289 |
content: %r{^ tcp dport 53 accept$},
|
| 290 |
order: '50-nftables-inet-filter-chain-default_out-rule-dnstcp-b',
|
|
| 290 |
order: '50-nftables-inet-filter-chain-default_out-rule-dnstcp-b' |
|
| 291 | 291 |
) |
| 292 | 292 |
} |
| 293 | 293 |
it {
|
| 294 | 294 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony').with(
|
| 295 | 295 |
target: 'nftables-inet-filter-chain-default_out', |
| 296 | 296 |
content: %r{^ udp dport 123 accept$},
|
| 297 |
order: '50-nftables-inet-filter-chain-default_out-rule-chrony-b',
|
|
| 297 |
order: '50-nftables-inet-filter-chain-default_out-rule-chrony-b' |
|
| 298 | 298 |
) |
| 299 | 299 |
} |
| 300 | 300 |
it {
|
| 301 | 301 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-http').with(
|
| 302 | 302 |
target: 'nftables-inet-filter-chain-default_out', |
| 303 | 303 |
content: %r{^ tcp dport 80 accept$},
|
| 304 |
order: '50-nftables-inet-filter-chain-default_out-rule-http-b',
|
|
| 304 |
order: '50-nftables-inet-filter-chain-default_out-rule-http-b' |
|
| 305 | 305 |
) |
| 306 | 306 |
} |
| 307 | 307 |
it {
|
| 308 | 308 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-https').with(
|
| 309 | 309 |
target: 'nftables-inet-filter-chain-default_out', |
| 310 | 310 |
content: %r{^ tcp dport 443 accept$},
|
| 311 |
order: '50-nftables-inet-filter-chain-default_out-rule-https-b',
|
|
| 311 |
order: '50-nftables-inet-filter-chain-default_out-rule-https-b' |
|
| 312 | 312 |
) |
| 313 | 313 |
} |
| 314 | 314 |
it {
|
| ... | ... | |
| 323 | 323 |
owner: 'root', |
| 324 | 324 |
group: 'root', |
| 325 | 325 |
mode: '0640', |
| 326 |
ensure_newline: true,
|
|
| 326 |
ensure_newline: true |
|
| 327 | 327 |
) |
| 328 | 328 |
} |
| 329 | 329 |
it {
|
| 330 | 330 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-header').with(
|
| 331 | 331 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 332 | 332 |
content: %r{^chain FORWARD \{$},
|
| 333 |
order: '00',
|
|
| 333 |
order: '00' |
|
| 334 | 334 |
) |
| 335 | 335 |
} |
| 336 | 336 |
it {
|
| 337 | 337 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-type').with(
|
| 338 | 338 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 339 | 339 |
content: %r{^ type filter hook forward priority 0$},
|
| 340 |
order: '01-nftables-inet-filter-chain-FORWARD-rule-type-b',
|
|
| 340 |
order: '01-nftables-inet-filter-chain-FORWARD-rule-type-b' |
|
| 341 | 341 |
) |
| 342 | 342 |
} |
| 343 | 343 |
it {
|
| 344 | 344 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-policy').with(
|
| 345 | 345 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 346 | 346 |
content: %r{^ policy drop$},
|
| 347 |
order: '02-nftables-inet-filter-chain-FORWARD-rule-policy-b',
|
|
| 347 |
order: '02-nftables-inet-filter-chain-FORWARD-rule-policy-b' |
|
| 348 | 348 |
) |
| 349 | 349 |
} |
| 350 | 350 |
it {
|
| 351 | 351 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-jump_global').with(
|
| 352 | 352 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 353 | 353 |
content: %r{^ jump global$},
|
| 354 |
order: '03-nftables-inet-filter-chain-FORWARD-rule-jump_global-b',
|
|
| 354 |
order: '03-nftables-inet-filter-chain-FORWARD-rule-jump_global-b' |
|
| 355 | 355 |
) |
| 356 | 356 |
} |
| 357 | 357 |
it {
|
| ... | ... | |
| 364 | 364 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-jump_default_fwd').with(
|
| 365 | 365 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 366 | 366 |
content: %r{^ jump default_fwd$},
|
| 367 |
order: '10-nftables-inet-filter-chain-FORWARD-rule-jump_default_fwd-b',
|
|
| 367 |
order: '10-nftables-inet-filter-chain-FORWARD-rule-jump_default_fwd-b' |
|
| 368 | 368 |
) |
| 369 | 369 |
} |
| 370 | 370 |
it {
|
| 371 | 371 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
|
| 372 | 372 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 373 | 373 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},
|
| 374 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',
|
|
| 374 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b' |
|
| 375 | 375 |
) |
| 376 | 376 |
} |
| 377 | 377 |
it {
|
| 378 | 378 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-reject').with(
|
| 379 | 379 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 380 | 380 |
content: %r{^ reject with icmpx type port-unreachable$},
|
| 381 |
order: '98-nftables-inet-filter-chain-FORWARD-rule-reject-b',
|
|
| 381 |
order: '98-nftables-inet-filter-chain-FORWARD-rule-reject-b' |
|
| 382 | 382 |
) |
| 383 | 383 |
} |
| 384 | 384 |
it {
|
| 385 | 385 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-footer').with(
|
| 386 | 386 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 387 | 387 |
content: %r{^\}$},
|
| 388 |
order: '99',
|
|
| 388 |
order: '99' |
|
| 389 | 389 |
) |
| 390 | 390 |
} |
| 391 | 391 |
|
| ... | ... | |
| 395 | 395 |
owner: 'root', |
| 396 | 396 |
group: 'root', |
| 397 | 397 |
mode: '0640', |
| 398 |
ensure_newline: true,
|
|
| 398 |
ensure_newline: true |
|
| 399 | 399 |
) |
| 400 | 400 |
} |
| 401 | 401 |
it {
|
| 402 | 402 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
|
| 403 | 403 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 404 | 404 |
content: %r{^chain default_fwd \{$},
|
| 405 |
order: '00',
|
|
| 405 |
order: '00' |
|
| 406 | 406 |
) |
| 407 | 407 |
} |
| 408 | 408 |
it {
|
| 409 | 409 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
|
| 410 | 410 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 411 | 411 |
content: %r{^\}$},
|
| 412 |
order: '99',
|
|
| 412 |
order: '99' |
|
| 413 | 413 |
) |
| 414 | 414 |
} |
| 415 | 415 |
end |
| ... | ... | |
| 421 | 421 |
owner: 'root', |
| 422 | 422 |
group: 'root', |
| 423 | 423 |
mode: '0640', |
| 424 |
ensure_newline: true,
|
|
| 424 |
ensure_newline: true |
|
| 425 | 425 |
) |
| 426 | 426 |
} |
| 427 | 427 |
it {
|
| 428 | 428 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-global-header').with(
|
| 429 | 429 |
target: 'nftables-inet-filter-chain-global', |
| 430 | 430 |
content: %r{^chain global \{$},
|
| 431 |
order: '00',
|
|
| 431 |
order: '00' |
|
| 432 | 432 |
) |
| 433 | 433 |
} |
| 434 | 434 |
end |
| ... | ... | |
| 440 | 440 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
|
| 441 | 441 |
target: 'nftables-inet-filter-chain-INPUT', |
| 442 | 442 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},
|
| 443 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',
|
|
| 443 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b' |
|
| 444 | 444 |
) |
| 445 | 445 |
} |
| 446 | 446 |
it {
|
| 447 | 447 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
|
| 448 | 448 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 449 | 449 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},
|
| 450 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',
|
|
| 450 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b' |
|
| 451 | 451 |
) |
| 452 | 452 |
} |
| 453 | 453 |
it {
|
| 454 | 454 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
|
| 455 | 455 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 456 | 456 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},
|
| 457 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',
|
|
| 457 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b' |
|
| 458 | 458 |
) |
| 459 | 459 |
} |
| 460 | 460 |
end |
| ... | ... | |
| 466 | 466 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
|
| 467 | 467 |
target: 'nftables-inet-filter-chain-INPUT', |
| 468 | 468 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \" bar \[INPUT\] " flags all counter$},
|
| 469 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',
|
|
| 469 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b' |
|
| 470 | 470 |
) |
| 471 | 471 |
} |
| 472 | 472 |
it {
|
| 473 | 473 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
|
| 474 | 474 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 475 | 475 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \" bar \[OUTPUT\] " flags all counter$},
|
| 476 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',
|
|
| 476 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b' |
|
| 477 | 477 |
) |
| 478 | 478 |
} |
| 479 | 479 |
it {
|
| 480 | 480 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
|
| 481 | 481 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 482 | 482 |
content: %r{^ limit rate 3/minute burst 5 packets log prefix \" bar \[FORWARD\] " flags all counter$},
|
| 483 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',
|
|
| 483 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b' |
|
| 484 | 484 |
) |
| 485 | 485 |
} |
| 486 | 486 |
end |
| ... | ... | |
| 496 | 496 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
|
| 497 | 497 |
target: 'nftables-inet-filter-chain-INPUT', |
| 498 | 498 |
content: %r{^ log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},
|
| 499 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',
|
|
| 499 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b' |
|
| 500 | 500 |
) |
| 501 | 501 |
} |
| 502 | 502 |
it {
|
| 503 | 503 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
|
| 504 | 504 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 505 | 505 |
content: %r{^ log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},
|
| 506 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',
|
|
| 506 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b' |
|
| 507 | 507 |
) |
| 508 | 508 |
} |
| 509 | 509 |
it {
|
| 510 | 510 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
|
| 511 | 511 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 512 | 512 |
content: %r{^ log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},
|
| 513 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',
|
|
| 513 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b' |
|
| 514 | 514 |
) |
| 515 | 515 |
} |
| 516 | 516 |
end |
| ... | ... | |
| 526 | 526 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
|
| 527 | 527 |
target: 'nftables-inet-filter-chain-INPUT', |
| 528 | 528 |
content: %r{^ limit rate 5/minute log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},
|
| 529 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',
|
|
| 529 |
order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b' |
|
| 530 | 530 |
) |
| 531 | 531 |
} |
| 532 | 532 |
it {
|
| 533 | 533 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
|
| 534 | 534 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 535 | 535 |
content: %r{^ limit rate 5/minute log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},
|
| 536 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',
|
|
| 536 |
order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b' |
|
| 537 | 537 |
) |
| 538 | 538 |
} |
| 539 | 539 |
it {
|
| 540 | 540 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
|
| 541 | 541 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 542 | 542 |
content: %r{^ limit rate 5/minute log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},
|
| 543 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',
|
|
| 543 |
order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b' |
|
| 544 | 544 |
) |
| 545 | 545 |
} |
| 546 | 546 |
end |
| ... | ... | |
| 583 | 583 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-reject').with(
|
| 584 | 584 |
target: 'nftables-inet-filter-chain-INPUT', |
| 585 | 585 |
content: %r{^ reject with tcp reset$},
|
| 586 |
order: '98-nftables-inet-filter-chain-INPUT-rule-reject-b',
|
|
| 586 |
order: '98-nftables-inet-filter-chain-INPUT-rule-reject-b' |
|
| 587 | 587 |
) |
| 588 | 588 |
} |
| 589 | 589 |
it {
|
| 590 | 590 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-reject').with(
|
| 591 | 591 |
target: 'nftables-inet-filter-chain-OUTPUT', |
| 592 | 592 |
content: %r{^ reject with tcp reset$},
|
| 593 |
order: '98-nftables-inet-filter-chain-OUTPUT-rule-reject-b',
|
|
| 593 |
order: '98-nftables-inet-filter-chain-OUTPUT-rule-reject-b' |
|
| 594 | 594 |
) |
| 595 | 595 |
} |
| 596 | 596 |
it {
|
| 597 | 597 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-reject').with(
|
| 598 | 598 |
target: 'nftables-inet-filter-chain-FORWARD', |
| 599 | 599 |
content: %r{^ reject with tcp reset$},
|
| 600 |
order: '98-nftables-inet-filter-chain-FORWARD-rule-reject-b',
|
|
| 600 |
order: '98-nftables-inet-filter-chain-FORWARD-rule-reject-b' |
|
| 601 | 601 |
) |
| 602 | 602 |
} |
| 603 | 603 |
end |
| spec/classes/ip_nat_spec.rb | ||
|---|---|---|
| 15 | 15 |
ensure: 'present', |
| 16 | 16 |
owner: 'root', |
| 17 | 17 |
group: 'root', |
| 18 |
mode: '0640',
|
|
| 18 |
mode: '0640' |
|
| 19 | 19 |
) |
| 20 | 20 |
} |
| 21 | 21 |
|
| ... | ... | |
| 23 | 23 |
is_expected.to contain_concat__fragment('nftables-ip-nat-header').with(
|
| 24 | 24 |
target: 'nftables-ip-nat', |
| 25 | 25 |
content: %r{^table ip nat \{$},
|
| 26 |
order: '00',
|
|
| 26 |
order: '00' |
|
| 27 | 27 |
) |
| 28 | 28 |
} |
| 29 | 29 |
|
| ... | ... | |
| 31 | 31 |
is_expected.to contain_concat__fragment('nftables-ip-nat-body').with(
|
| 32 | 32 |
target: 'nftables-ip-nat', |
| 33 | 33 |
content: %r{^\s+include "ip-nat-chain-\*\.nft"$},
|
| 34 |
order: '98',
|
|
| 34 |
order: '98' |
|
| 35 | 35 |
) |
| 36 | 36 |
} |
| 37 | 37 |
|
| ... | ... | |
| 39 | 39 |
is_expected.to contain_concat__fragment('nftables-ip-nat-footer').with(
|
| 40 | 40 |
target: 'nftables-ip-nat', |
| 41 | 41 |
content: %r{^\}$},
|
| 42 |
order: '99',
|
|
| 42 |
order: '99' |
|
| 43 | 43 |
) |
| 44 | 44 |
} |
| 45 | 45 |
|
| ... | ... | |
| 49 | 49 |
ensure: 'present', |
| 50 | 50 |
owner: 'root', |
| 51 | 51 |
group: 'root', |
| 52 |
mode: '0640',
|
|
| 52 |
mode: '0640' |
|
| 53 | 53 |
) |
| 54 | 54 |
} |
| 55 | 55 |
|
| ... | ... | |
| 57 | 57 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-header').with(
|
| 58 | 58 |
target: 'nftables-ip6-nat', |
| 59 | 59 |
content: %r{^table ip6 nat \{$},
|
| 60 |
order: '00',
|
|
| 60 |
order: '00' |
|
| 61 | 61 |
) |
| 62 | 62 |
} |
| 63 | 63 |
|
| ... | ... | |
| 65 | 65 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-body').with(
|
| 66 | 66 |
target: 'nftables-ip6-nat', |
| 67 | 67 |
content: %r{^\s+include "ip6-nat-chain-\*\.nft"$},
|
| 68 |
order: '98',
|
|
| 68 |
order: '98' |
|
| 69 | 69 |
) |
| 70 | 70 |
} |
| 71 | 71 |
|
| ... | ... | |
| 73 | 73 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-footer').with(
|
| 74 | 74 |
target: 'nftables-ip6-nat', |
| 75 | 75 |
content: %r{^\}$},
|
| 76 |
order: '99',
|
|
| 76 |
order: '99' |
|
| 77 | 77 |
) |
| 78 | 78 |
} |
| 79 | 79 |
|
| ... | ... | |
| 84 | 84 |
owner: 'root', |
| 85 | 85 |
group: 'root', |
| 86 | 86 |
mode: '0640', |
| 87 |
ensure_newline: true,
|
|
| 87 |
ensure_newline: true |
|
| 88 | 88 |
) |
| 89 | 89 |
} |
| 90 | 90 |
it {
|
| 91 | 91 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
|
| 92 | 92 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 93 | 93 |
content: %r{^chain PREROUTING \{$},
|
| 94 |
order: '00',
|
|
| 94 |
order: '00' |
|
| 95 | 95 |
) |
| 96 | 96 |
} |
| 97 | 97 |
it {
|
| 98 | 98 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
|
| 99 | 99 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 100 | 100 |
content: %r{^ type nat hook prerouting priority -100$},
|
| 101 |
order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b',
|
|
| 101 |
order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b' |
|
| 102 | 102 |
) |
| 103 | 103 |
} |
| 104 | 104 |
it {
|
| 105 | 105 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
|
| 106 | 106 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 107 | 107 |
content: %r{^ policy accept$},
|
| 108 |
order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b',
|
|
| 108 |
order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b' |
|
| 109 | 109 |
) |
| 110 | 110 |
} |
| 111 | 111 |
it {
|
| 112 | 112 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
|
| 113 | 113 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 114 | 114 |
content: %r{^\}$},
|
| 115 |
order: '99',
|
|
| 115 |
order: '99' |
|
| 116 | 116 |
) |
| 117 | 117 |
} |
| 118 | 118 |
end |
| ... | ... | |
| 124 | 124 |
owner: 'root', |
| 125 | 125 |
group: 'root', |
| 126 | 126 |
mode: '0640', |
| 127 |
ensure_newline: true,
|
|
| 127 |
ensure_newline: true |
|
| 128 | 128 |
) |
| 129 | 129 |
} |
| 130 | 130 |
it {
|
| 131 | 131 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
|
| 132 | 132 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 133 | 133 |
content: %r{^chain POSTROUTING \{$},
|
| 134 |
order: '00',
|
|
| 134 |
order: '00' |
|
| 135 | 135 |
) |
| 136 | 136 |
} |
| 137 | 137 |
it {
|
| 138 | 138 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
|
| 139 | 139 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 140 | 140 |
content: %r{^ type nat hook postrouting priority 100$},
|
| 141 |
order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b',
|
|
| 141 |
order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b' |
|
| 142 | 142 |
) |
| 143 | 143 |
} |
| 144 | 144 |
it {
|
| 145 | 145 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
|
| 146 | 146 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 147 | 147 |
content: %r{^ policy accept$},
|
| 148 |
order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b',
|
|
| 148 |
order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b' |
|
| 149 | 149 |
) |
| 150 | 150 |
} |
| 151 | 151 |
it {
|
| 152 | 152 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
|
| 153 | 153 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 154 | 154 |
content: %r{^\}$},
|
| 155 |
order: '99',
|
|
| 155 |
order: '99' |
|
| 156 | 156 |
) |
| 157 | 157 |
} |
| 158 | 158 |
end |
| ... | ... | |
| 164 | 164 |
owner: 'root', |
| 165 | 165 |
group: 'root', |
| 166 | 166 |
mode: '0640', |
| 167 |
ensure_newline: true,
|
|
| 167 |
ensure_newline: true |
|
| 168 | 168 |
) |
| 169 | 169 |
} |
| 170 | 170 |
it {
|
| 171 | 171 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-header').with(
|
| 172 | 172 |
target: 'nftables-ip6-nat-chain-PREROUTING6', |
| 173 | 173 |
content: %r{^chain PREROUTING6 \{$},
|
| 174 |
order: '00',
|
|
| 174 |
order: '00' |
|
| 175 | 175 |
) |
| 176 | 176 |
} |
| 177 | 177 |
it {
|
| 178 | 178 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-type').with(
|
| 179 | 179 |
target: 'nftables-ip6-nat-chain-PREROUTING6', |
| 180 | 180 |
content: %r{^ type nat hook prerouting priority -100$},
|
| 181 |
order: '01-nftables-ip6-nat-chain-PREROUTING6-rule-type-b',
|
|
| 181 |
order: '01-nftables-ip6-nat-chain-PREROUTING6-rule-type-b' |
|
| 182 | 182 |
) |
| 183 | 183 |
} |
| 184 | 184 |
it {
|
| 185 | 185 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-policy').with(
|
| 186 | 186 |
target: 'nftables-ip6-nat-chain-PREROUTING6', |
| 187 | 187 |
content: %r{^ policy accept$},
|
| 188 |
order: '02-nftables-ip6-nat-chain-PREROUTING6-rule-policy-b',
|
|
| 188 |
order: '02-nftables-ip6-nat-chain-PREROUTING6-rule-policy-b' |
|
| 189 | 189 |
) |
| 190 | 190 |
} |
| 191 | 191 |
it {
|
| 192 | 192 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-footer').with(
|
| 193 | 193 |
target: 'nftables-ip6-nat-chain-PREROUTING6', |
| 194 | 194 |
content: %r{^\}$},
|
| 195 |
order: '99',
|
|
| 195 |
order: '99' |
|
| 196 | 196 |
) |
| 197 | 197 |
} |
| 198 | 198 |
end |
| ... | ... | |
| 204 | 204 |
owner: 'root', |
| 205 | 205 |
group: 'root', |
| 206 | 206 |
mode: '0640', |
| 207 |
ensure_newline: true,
|
|
| 207 |
ensure_newline: true |
|
| 208 | 208 |
) |
| 209 | 209 |
} |
| 210 | 210 |
it {
|
| 211 | 211 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-header').with(
|
| 212 | 212 |
target: 'nftables-ip6-nat-chain-POSTROUTING6', |
| 213 | 213 |
content: %r{^chain POSTROUTING6 \{$},
|
| 214 |
order: '00',
|
|
| 214 |
order: '00' |
|
| 215 | 215 |
) |
| 216 | 216 |
} |
| 217 | 217 |
it {
|
| 218 | 218 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-type').with(
|
| 219 | 219 |
target: 'nftables-ip6-nat-chain-POSTROUTING6', |
| 220 | 220 |
content: %r{^ type nat hook postrouting priority 100$},
|
| 221 |
order: '01-nftables-ip6-nat-chain-POSTROUTING6-rule-type-b',
|
|
| 221 |
order: '01-nftables-ip6-nat-chain-POSTROUTING6-rule-type-b' |
|
| 222 | 222 |
) |
| 223 | 223 |
} |
| 224 | 224 |
it {
|
| 225 | 225 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-policy').with(
|
| 226 | 226 |
target: 'nftables-ip6-nat-chain-POSTROUTING6', |
| 227 | 227 |
content: %r{^ policy accept$},
|
| 228 |
order: '02-nftables-ip6-nat-chain-POSTROUTING6-rule-policy-b',
|
|
| 228 |
order: '02-nftables-ip6-nat-chain-POSTROUTING6-rule-policy-b' |
|
| 229 | 229 |
) |
| 230 | 230 |
} |
| 231 | 231 |
it {
|
| 232 | 232 |
is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-footer').with(
|
| 233 | 233 |
target: 'nftables-ip6-nat-chain-POSTROUTING6', |
| 234 | 234 |
content: %r{^\}$},
|
| 235 |
order: '99',
|
|
| 235 |
order: '99' |
|
| 236 | 236 |
) |
| 237 | 237 |
} |
| 238 | 238 |
end |
| ... | ... | |
| 251 | 251 |
ensure: 'present', |
| 252 | 252 |
owner: 'root', |
| 253 | 253 |
group: 'root', |
| 254 |
mode: '0640',
|
|
| 254 |
mode: '0640' |
|
| 255 | 255 |
) |
| 256 | 256 |
} |
| 257 | 257 |
end |
| spec/classes/masquerade_spec.rb | ||
|---|---|---|
| 40 | 40 |
owner: 'root', |
| 41 | 41 |
group: 'root', |
| 42 | 42 |
mode: '0640', |
| 43 |
ensure_newline: true,
|
|
| 43 |
ensure_newline: true |
|
| 44 | 44 |
) |
| 45 | 45 |
} |
| 46 | 46 |
it {
|
| 47 | 47 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
|
| 48 | 48 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 49 | 49 |
content: %r{^chain POSTROUTING \{$},
|
| 50 |
order: '00',
|
|
| 50 |
order: '00' |
|
| 51 | 51 |
) |
| 52 | 52 |
} |
| 53 | 53 |
it {
|
| 54 | 54 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
|
| 55 | 55 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 56 | 56 |
content: %r{^ type nat hook postrouting priority 100$},
|
| 57 |
order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b',
|
|
| 57 |
order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b' |
|
| 58 | 58 |
) |
| 59 | 59 |
} |
| 60 | 60 |
it {
|
| 61 | 61 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
|
| 62 | 62 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 63 | 63 |
content: %r{^ policy accept$},
|
| 64 |
order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b',
|
|
| 64 |
order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b' |
|
| 65 | 65 |
) |
| 66 | 66 |
} |
| 67 | 67 |
it {
|
| 68 | 68 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0').with(
|
| 69 | 69 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 70 | 70 |
content: %r{^ oifname eth0 masquerade$},
|
| 71 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0-b',
|
|
| 71 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0-b' |
|
| 72 | 72 |
) |
| 73 | 73 |
} |
| 74 | 74 |
it {
|
| 75 | 75 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn').with(
|
| 76 | 76 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 77 | 77 |
content: %r{^ oifname eth1 ip saddr 192\.0\.2\.0\/24 masquerade$},
|
| 78 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn-b',
|
|
| 78 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn-b' |
|
| 79 | 79 |
) |
| 80 | 80 |
} |
| 81 | 81 |
it {
|
| 82 | 82 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh').with(
|
| 83 | 83 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 84 | 84 |
content: %r{^ ip saddr 192\.0\.2\.0\/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$},
|
| 85 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh-b',
|
|
| 85 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh-b' |
|
| 86 | 86 |
) |
| 87 | 87 |
} |
| 88 | 88 |
it {
|
| 89 | 89 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab').with(
|
| 90 | 90 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 91 | 91 |
content: %r{^ ip saddr 192\.0\.2\.0\/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$},
|
| 92 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab-b',
|
|
| 92 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab-b' |
|
| 93 | 93 |
) |
| 94 | 94 |
} |
| 95 | 95 |
it {
|
| 96 | 96 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard').with(
|
| 97 | 97 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 98 | 98 |
content: %r{^ udp dport 51820 masquerade$},
|
| 99 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard-b',
|
|
| 99 |
order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard-b' |
|
| 100 | 100 |
) |
| 101 | 101 |
} |
| 102 | 102 |
it {
|
| 103 | 103 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
|
| 104 | 104 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 105 | 105 |
content: %r{^\}$},
|
| 106 |
order: '99',
|
|
| 106 |
order: '99' |
|
| 107 | 107 |
) |
| 108 | 108 |
} |
| 109 | 109 |
end |
| spec/classes/nftables_spec.rb | ||
|---|---|---|
| 17 | 17 |
owner: 'root', |
| 18 | 18 |
group: 'root', |
| 19 | 19 |
mode: '0640', |
| 20 |
content: %r{flush ruleset},
|
|
| 20 |
content: %r{flush ruleset}
|
|
| 21 | 21 |
) |
| 22 | 22 |
} |
| 23 | 23 |
|
| ... | ... | |
| 29 | 29 |
mode: '0750', |
| 30 | 30 |
purge: true, |
| 31 | 31 |
force: true, |
| 32 |
recurse: true,
|
|
| 32 |
recurse: true |
|
| 33 | 33 |
) |
| 34 | 34 |
} |
| 35 | 35 |
|
| ... | ... | |
| 39 | 39 |
owner: 'root', |
| 40 | 40 |
group: 'root', |
| 41 | 41 |
mode: '0640', |
| 42 |
content: %r{flush ruleset},
|
|
| 42 |
content: %r{flush ruleset}
|
|
| 43 | 43 |
) |
| 44 | 44 |
} |
| 45 | 45 |
|
| ... | ... | |
| 51 | 51 |
mode: '0750', |
| 52 | 52 |
purge: true, |
| 53 | 53 |
force: true, |
| 54 |
recurse: true,
|
|
| 54 |
recurse: true |
|
| 55 | 55 |
) |
| 56 | 56 |
} |
| 57 | 57 |
|
| 58 | 58 |
it {
|
| 59 | 59 |
is_expected.to contain_exec('nft validate').with(
|
| 60 | 60 |
refreshonly: true, |
| 61 |
command: %r{^/usr/sbin/nft -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft.*},
|
|
| 61 |
command: %r{^/usr/sbin/nft -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft.*}
|
|
| 62 | 62 |
) |
| 63 | 63 |
} |
| 64 | 64 |
|
| ... | ... | |
| 67 | 67 |
ensure: 'running', |
| 68 | 68 |
enable: true, |
| 69 | 69 |
hasrestart: true, |
| 70 |
restart: %r{/usr/bin/systemctl reload nft.*},
|
|
| 70 |
restart: %r{/usr/bin/systemctl reload nft.*}
|
|
| 71 | 71 |
) |
| 72 | 72 |
} |
| 73 | 73 |
|
| 74 | 74 |
it {
|
| 75 | 75 |
is_expected.to contain_systemd__dropin_file('puppet_nft.conf').with(
|
| 76 |
content: %r{^ExecReload=/sbin/nft -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf$},
|
|
| 76 |
content: %r{^ExecReload=/sbin/nft -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf$}
|
|
| 77 | 77 |
) |
| 78 | 78 |
} |
| 79 | 79 |
|
| 80 | 80 |
it {
|
| 81 | 81 |
is_expected.to contain_service('firewalld').with(
|
| 82 | 82 |
ensure: 'stopped', |
| 83 |
enable: 'mask',
|
|
| 83 |
enable: 'mask' |
|
| 84 | 84 |
) |
| 85 | 85 |
} |
| 86 | 86 |
it { is_expected.to contain_class('nftables::inet_filter') }
|
| ... | ... | |
| 124 | 124 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-web_accept').with(
|
| 125 | 125 |
target: 'nftables-inet-filter-chain-INPUT', |
| 126 | 126 |
content: %r{^ iifname eth0 tcp dport \{ 80, 443 \} accept$},
|
| 127 |
order: '50-nftables-inet-filter-chain-INPUT-rule-web_accept-b',
|
|
| 127 |
order: '50-nftables-inet-filter-chain-INPUT-rule-web_accept-b' |
|
| 128 | 128 |
) |
| 129 | 129 |
} |
| 130 | 130 |
end |
| ... | ... | |
| 149 | 149 |
is_expected.to contain_nftables__set('testset1').with(
|
| 150 | 150 |
type: 'ipv4_addr', |
| 151 | 151 |
gc_interval: 2, |
| 152 |
table: 'inet-filter',
|
|
| 152 |
table: 'inet-filter' |
|
| 153 | 153 |
) |
| 154 | 154 |
} |
| 155 | 155 |
it {
|
| 156 | 156 |
is_expected.to contain_nftables__set('testset2').with(
|
| 157 | 157 |
type: 'ipv6_addr', |
| 158 | 158 |
elements: ['2a02:62:c601::dead:beef'], |
| 159 |
table: 'inet-filter',
|
|
| 159 |
table: 'inet-filter' |
|
| 160 | 160 |
) |
| 161 | 161 |
} |
| 162 | 162 |
end |
| ... | ... | |
| 171 | 171 |
it {
|
| 172 | 172 |
is_expected.to contain_service('firewalld').with(
|
| 173 | 173 |
ensure: 'stopped', |
| 174 |
enable: false,
|
|
| 174 |
enable: false |
|
| 175 | 175 |
) |
| 176 | 176 |
} |
| 177 | 177 |
end |
| spec/classes/router_spec.rb | ||
|---|---|---|
| 36 | 36 |
owner: 'root', |
| 37 | 37 |
group: 'root', |
| 38 | 38 |
mode: '0640', |
| 39 |
ensure_newline: true,
|
|
| 39 |
ensure_newline: true |
|
| 40 | 40 |
) |
| 41 | 41 |
} |
| 42 | 42 |
it {
|
| 43 | 43 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
|
| 44 | 44 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 45 | 45 |
content: %r{^chain default_fwd \{$},
|
| 46 |
order: '00',
|
|
| 46 |
order: '00' |
|
| 47 | 47 |
) |
| 48 | 48 |
} |
| 49 | 49 |
it {
|
| 50 | 50 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-out').with(
|
| 51 | 51 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 52 | 52 |
content: %r{^ iifname eth1 oifname eth0 accept$},
|
| 53 |
order: '20-nftables-inet-filter-chain-default_fwd-rule-out-b',
|
|
| 53 |
order: '20-nftables-inet-filter-chain-default_fwd-rule-out-b' |
|
| 54 | 54 |
) |
| 55 | 55 |
} |
| 56 | 56 |
it {
|
| 57 | 57 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-drop').with(
|
| 58 | 58 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 59 | 59 |
content: %r{^ iifname eth0 drop$},
|
| 60 |
order: '90-nftables-inet-filter-chain-default_fwd-rule-drop-b',
|
|
| 60 |
order: '90-nftables-inet-filter-chain-default_fwd-rule-drop-b' |
|
| 61 | 61 |
) |
| 62 | 62 |
} |
| 63 | 63 |
it {
|
| 64 | 64 |
is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
|
| 65 | 65 |
target: 'nftables-inet-filter-chain-default_fwd', |
| 66 | 66 |
content: %r{^\}$},
|
| 67 |
order: '99',
|
|
| 67 |
order: '99' |
|
| 68 | 68 |
) |
| 69 | 69 |
} |
| 70 | 70 |
|
| ... | ... | |
| 74 | 74 |
owner: 'root', |
| 75 | 75 |
group: 'root', |
| 76 | 76 |
mode: '0640', |
| 77 |
ensure_newline: true,
|
|
| 77 |
ensure_newline: true |
|
| 78 | 78 |
) |
| 79 | 79 |
} |
| 80 | 80 |
it {
|
| 81 | 81 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
|
| 82 | 82 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 83 | 83 |
content: %r{^chain PREROUTING \{$},
|
| 84 |
order: '00',
|
|
| 84 |
order: '00' |
|
| 85 | 85 |
) |
| 86 | 86 |
} |
| 87 | 87 |
it {
|
| 88 | 88 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
|
| 89 | 89 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 90 | 90 |
content: %r{^ type nat hook prerouting priority -100$},
|
| 91 |
order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b',
|
|
| 91 |
order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b' |
|
| 92 | 92 |
) |
| 93 | 93 |
} |
| 94 | 94 |
it {
|
| 95 | 95 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
|
| 96 | 96 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 97 | 97 |
content: %r{^ policy accept$},
|
| 98 |
order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b',
|
|
| 98 |
order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b' |
|
| 99 | 99 |
) |
| 100 | 100 |
} |
| 101 | 101 |
it {
|
| 102 | 102 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
|
| 103 | 103 |
target: 'nftables-ip-nat-chain-PREROUTING', |
| 104 | 104 |
content: %r{^\}$},
|
| 105 |
order: '99',
|
|
| 105 |
order: '99' |
|
| 106 | 106 |
) |
| 107 | 107 |
} |
| 108 | 108 |
|
| ... | ... | |
| 112 | 112 |
owner: 'root', |
| 113 | 113 |
group: 'root', |
| 114 | 114 |
mode: '0640', |
| 115 |
ensure_newline: true,
|
|
| 115 |
ensure_newline: true |
|
| 116 | 116 |
) |
| 117 | 117 |
} |
| 118 | 118 |
it {
|
| 119 | 119 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
|
| 120 | 120 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 121 | 121 |
content: %r{^chain POSTROUTING \{$},
|
| 122 |
order: '00',
|
|
| 122 |
order: '00' |
|
| 123 | 123 |
) |
| 124 | 124 |
} |
| 125 | 125 |
it {
|
| 126 | 126 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
|
| 127 | 127 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 128 | 128 |
content: %r{^ type nat hook postrouting priority 100$},
|
| 129 |
order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b',
|
|
| 129 |
order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b' |
|
| 130 | 130 |
) |
| 131 | 131 |
} |
| 132 | 132 |
it {
|
| 133 | 133 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
|
| 134 | 134 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 135 | 135 |
content: %r{^ policy accept$},
|
| 136 |
order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b',
|
|
| 136 |
order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b' |
|
| 137 | 137 |
) |
| 138 | 138 |
} |
| 139 | 139 |
it {
|
| 140 | 140 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade').with(
|
| 141 | 141 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 142 | 142 |
content: %r{^ oifname eth0 masquerade$},
|
| 143 |
order: '20-nftables-ip-nat-chain-POSTROUTING-rule-masquerade-b',
|
|
| 143 |
order: '20-nftables-ip-nat-chain-POSTROUTING-rule-masquerade-b' |
|
| 144 | 144 |
) |
| 145 | 145 |
} |
| 146 | 146 |
it {
|
| 147 | 147 |
is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
|
| 148 | 148 |
target: 'nftables-ip-nat-chain-POSTROUTING', |
| 149 | 149 |
content: %r{^\}$},
|
| 150 |
order: '99',
|
|
| 150 |
order: '99' |
|
| 151 | 151 |
) |
| 152 | 152 |
} |
| 153 | 153 |
end |
| spec/classes/rules/docker_ce_spec.rb | ||
|---|---|---|
| 17 | 17 |
it {
|
| 18 | 18 |
is_expected.to contain_nftables__chain('DOCKER-nat').with(
|
| 19 | 19 |
chain: 'DOCKER', |
| 20 |
table: 'ip-nat',
|
|
| 20 |
table: 'ip-nat' |
|
| 21 | 21 |
) |
| 22 | 22 |
} |
| 23 | 23 |
it {
|
| 24 | 24 |
is_expected.to contain_nftables__chain('OUTPUT-nat').with(
|
| 25 | 25 |
chain: 'OUTPUT', |
| 26 |
table: 'ip-nat',
|
|
| 26 |
table: 'ip-nat' |
|
| 27 | 27 |
) |
| 28 | 28 |
} |
| 29 | 29 |
it {
|
| 30 | 30 |
is_expected.to contain_nftables__chain('INPUT-nat').with(
|
| 31 | 31 |
chain: 'INPUT', |
| 32 |
table: 'ip-nat',
|
|
| 32 |
table: 'ip-nat' |
|
| 33 | 33 |
) |
| 34 | 34 |
} |
| 35 | 35 |
it { is_expected.to contain_nftables__rule('DOCKER_ISOLATION_STAGE_1-iifname').with_content('iifname "docker0" oifname != "docker0" counter jump DOCKER_ISOLATION_STAGE_2') }
|
| ... | ... | |
| 47 | 47 |
it {
|
| 48 | 48 |
is_expected.to contain_nftables__rule('POSTROUTING-docker').with(
|
| 49 | 49 |
content: 'oifname != "docker0" ip saddr 172.17.0.0/16 counter masquerade', |
| 50 |
table: 'ip-nat',
|
|
| 50 |
table: 'ip-nat' |
|
| 51 | 51 |
) |
| 52 | 52 |
} |
| 53 | 53 |
it {
|
| 54 | 54 |
is_expected.to contain_nftables__rule('PREROUTING-docker').with(
|
| 55 | 55 |
content: 'fib daddr type local counter jump DOCKER', |
| 56 |
table: 'ip-nat',
|
|
| 56 |
table: 'ip-nat' |
|
| 57 | 57 |
) |
| 58 | 58 |
} |
| 59 | 59 |
it {
|
| 60 | 60 |
is_expected.to contain_nftables__rule('OUTPUT-jump_docker@ip-nat').with(
|
| 61 | 61 |
rulename: 'OUTPUT-jump_docker', |
| 62 | 62 |
content: 'ip daddr != 127.0.0.0/8 fib daddr type local counter jump DOCKER', |
| 63 |
table: 'ip-nat',
|
|
| 63 |
table: 'ip-nat' |
|
| 64 | 64 |
) |
| 65 | 65 |
} |
| 66 | 66 |
it {
|
| 67 | 67 |
is_expected.to contain_nftables__rule('DOCKER-counter').with(
|
| 68 | 68 |
content: 'iifname "docker0" counter return', |
| 69 |
table: 'ip-nat',
|
|
| 69 |
table: 'ip-nat' |
|
| 70 | 70 |
) |
| 71 | 71 |
} |
| 72 | 72 |
it {
|
| 73 | 73 |
is_expected.to contain_nftables__rule('INPUT-type@ip-nat').with(
|
| 74 | 74 |
rulename: 'INPUT-type', |
| 75 | 75 |
content: 'type nat hook input priority 100', |
| 76 |
table: 'ip-nat',
|
|
| 76 |
table: 'ip-nat' |
|
| 77 | 77 |
) |
| 78 | 78 |
} |
| 79 | 79 |
it {
|
| 80 | 80 |
is_expected.to contain_nftables__rule('INPUT-policy@ip-nat').with(
|
| 81 | 81 |
rulename: 'INPUT-policy', |
| 82 | 82 |
content: 'policy accept', |
| 83 |
table: 'ip-nat',
|
|
| 83 |
table: 'ip-nat' |
|
| 84 | 84 |
) |
| 85 | 85 |
} |
| 86 | 86 |
end |
| ... | ... | |
| 142 | 142 |
it {
|
| 143 | 143 |
is_expected.to contain_nftables__rule('POSTROUTING-docker').with(
|
| 144 | 144 |
content: 'oifname != "ifdo0" ip saddr 192.168.4.0/24 counter masquerade', |
| 145 |
table: 'ip-nat',
|
|
| 145 |
table: 'ip-nat' |
|
| 146 | 146 |
) |
| 147 | 147 |
} |
| 148 | 148 |
it {
|
| 149 | 149 |
is_expected.to contain_nftables__rule('DOCKER-counter').with(
|
| 150 | 150 |
content: 'iifname "ifdo0" counter return', |
| 151 |
table: 'ip-nat',
|
|
| 151 |
table: 'ip-nat' |
|
| 152 | 152 |
) |
| 153 | 153 |
} |
| 154 | 154 |
end |
| spec/classes/rules/icmp_spec.rb | ||
|---|---|---|
| 10 | 10 |
it {
|
| 11 | 11 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv4').with(
|
| 12 | 12 |
content: 'ip protocol icmp accept', |
| 13 |
order: '10',
|
|
| 13 |
order: '10' |
|
| 14 | 14 |
) |
| 15 | 15 |
} |
| 16 | 16 |
it {
|
| 17 | 17 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv6').with(
|
| 18 | 18 |
content: 'ip6 nexthdr ipv6-icmp accept', |
| 19 |
order: '10',
|
|
| 19 |
order: '10' |
|
| 20 | 20 |
) |
| 21 | 21 |
} |
| 22 | 22 |
end |
| ... | ... | |
| 32 | 32 |
it {
|
| 33 | 33 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv4_echo_request').with(
|
| 34 | 34 |
content: 'ip protocol icmp icmp type echo-request limit rate 4/second accept', |
| 35 |
order: '10',
|
|
| 35 |
order: '10' |
|
| 36 | 36 |
) |
| 37 | 37 |
} |
| 38 | 38 |
it {
|
| 39 | 39 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv4_echo_reply').with(
|
| 40 | 40 |
content: 'ip protocol icmp icmp type echo-reply accept', |
| 41 |
order: '10',
|
|
| 41 |
order: '10' |
|
| 42 | 42 |
) |
| 43 | 43 |
} |
| 44 | 44 |
it {
|
| 45 | 45 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv6').with(
|
| 46 | 46 |
content: 'ip6 nexthdr ipv6-icmp accept', |
| 47 |
order: '10',
|
|
| 47 |
order: '10' |
|
| 48 | 48 |
) |
| 49 | 49 |
} |
| 50 | 50 |
end |
| ... | ... | |
| 61 | 61 |
it {
|
| 62 | 62 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv4_echo_request').with(
|
| 63 | 63 |
content: 'ip protocol icmp icmp type echo-request limit rate 4/second accept', |
| 64 |
order: '10',
|
|
| 64 |
order: '10' |
|
| 65 | 65 |
) |
| 66 | 66 |
} |
| 67 | 67 |
it {
|
| 68 | 68 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv4_echo_reply').with(
|
| 69 | 69 |
content: 'ip protocol icmp icmp type echo-reply accept', |
| 70 |
order: '10',
|
|
| 70 |
order: '10' |
|
| 71 | 71 |
) |
| 72 | 72 |
} |
| 73 | 73 |
it {
|
| 74 | 74 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv6_echo_reply').with(
|
| 75 | 75 |
content: 'ip6 nexthdr ipv6-icmp icmpv6 type echo-reply accept', |
| 76 |
order: '10',
|
|
| 76 |
order: '10' |
|
| 77 | 77 |
) |
| 78 | 78 |
} |
| 79 | 79 |
it {
|
| 80 | 80 |
is_expected.to contain_nftables__rule('default_in-accept_icmpv6_nd_router_advert').with(
|
Formats disponibles : Unified diff