puppetlabs-firewall/spec/acceptance/connlimit_spec.rb at master · karmix/puppetlabs-firewall · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
require 'spec_helper_acceptance'

describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do

  describe 'connlimit_above' do
    context '10' do
      it 'applies' do
        pp = <<-EOS
          class { '::firewall': }
          firewall { '500 - test':
            proto           => tcp,
	    dport           => '22',
	    connlimit_above => '10',
            action          => reject,
          }
        EOS

        apply_manifest(pp, :catch_failures => true)
      end

      it 'should contain the rule' do
        shell('iptables-save') do |r|
          #connlimit-saddr is added in Ubuntu 14.04.
          expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --dports 22 -m comment --comment "500 - test" -m connlimit --connlimit-above 10 --connlimit-mask 32 (--connlimit-saddr )?-j REJECT --reject-with icmp-port-unreachable/)
        end
      end
    end
  end

  describe 'connlimit_mask' do
    context '24' do
      it 'applies' do
        pp = <<-EOS
          class { '::firewall': }
          firewall { '501 - test':
            proto           => tcp,
            dport           => '22',
            connlimit_above => '10',
            connlimit_mask  => '24',
            action          => reject,
          }
        EOS

        apply_manifest(pp, :catch_failures => true)
      end

      it 'should contain the rule' do
        shell('iptables-save') do |r|
          #connlimit-saddr is added in Ubuntu 14.04.
          expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --dports 22 -m comment --comment "501 - test" -m connlimit --connlimit-above 10 --connlimit-mask 24 (--connlimit-saddr )?-j REJECT --reject-with icmp-port-unreachable/)
        end
      end
    end
  end
end