Skip to content

Commit d2b633e

Browse files
martinpittrichm
martinpitt
authored and
richm
committed
ci: Move tests to firewall-offline-cmd
We are only interested in the permanent configuration anyway, so we can drop the "firewalld is running" assumption and use `firewall-offline-cmd` instead to query the on-disk state directly. This also works in container builds.
1 parent 07aa8b0 commit d2b633e

File tree

6 files changed

+67
-52
lines changed

6 files changed

+67
-52
lines changed

‎tests/tests_ansible.yml‎

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
name: linux-system-roles.firewall
1010

1111
- name: Get default zone
12-
command: firewall-cmd --get-default-zone
12+
command: firewall-offline-cmd --get-default-zone
1313
register: __default_zone
1414
changed_when: false
1515

@@ -19,53 +19,53 @@
1919
# INIT TEST
2020

2121
- name: Remove custom zone
22-
command: firewall-cmd --permanent --delete-zone=custom
22+
command: firewall-offline-cmd --delete-zone=custom
2323
register: result
2424
failed_when: result.failed and "INVALID_ZONE" not in result.stderr
2525
changed_when: false
2626

2727
- name: Reset internal zone to defaults
28-
command: firewall-cmd --permanent --load-zone-defaults=internal
28+
command: firewall-offline-cmd --load-zone-defaults=internal
2929
register: result
3030
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
3131
changed_when: false
3232

3333
- name: Reset trusted zone to defaults
34-
command: firewall-cmd --permanent --load-zone-defaults=trusted
34+
command: firewall-offline-cmd --load-zone-defaults=trusted
3535
register: result
3636
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
3737
changed_when: false
3838

3939
- name: Reset dmz zone to defaults
40-
command: firewall-cmd --permanent --load-zone-defaults=dmz
40+
command: firewall-offline-cmd --load-zone-defaults=dmz
4141
register: result
4242
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
4343
changed_when: false
4444

4545
- name: Reset drop zone to defaults
46-
command: firewall-cmd --permanent --load-zone-defaults=drop
46+
command: firewall-offline-cmd --load-zone-defaults=drop
4747
register: result
4848
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
4949
changed_when: false
5050

5151
- name: Reset public zone to defaults
52-
command: firewall-cmd --permanent --load-zone-defaults=public
52+
command: firewall-offline-cmd --load-zone-defaults=public
5353
register: result
5454
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
5555
changed_when: false
5656

5757
- name: Reset default zone to defaults
5858
shell:
5959
cmd: |
60-
zone=$(firewall-cmd --get-default-zone)
61-
firewall-cmd --permanent --load-zone-defaults=$zone
60+
zone=$(firewall-offline-cmd --get-default-zone)
61+
firewall-offline-cmd --load-zone-defaults=$zone
6262
register: result
6363
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
6464
changed_when: false
6565

6666
- name: Create custom zone
6767
# noqa no-changed-when
68-
command: firewall-cmd --permanent --new-zone=custom
68+
command: firewall-offline-cmd --new-zone=custom
6969
register: result
7070
failed_when: result.failed or not result.changed
7171

@@ -410,7 +410,12 @@
410410
failed_when: result is failed or result is changed
411411

412412
- name: Set the default zone to something other than dmz
413-
command: firewall-cmd --set-default-zone public
413+
# --set-default-zone not idempotent: https://bugzilla.redhat.com/show_bug.cgi?id=2363037
414+
shell: |
415+
cur_zone=$(firewall-offline-cmd --get-default-zone)
416+
if [ "$cur_zone" != public ]; then
417+
firewall-offline-cmd --set-default-zone public
418+
fi
414419
changed_when: false
415420

416421
- name: Set default zone
@@ -673,57 +678,60 @@
673678
# CLEANUP: RESET TO ZONE DEFAULTS
674679

675680
- name: Remove custom zone
676-
command: firewall-cmd --permanent --delete-zone=custom
681+
command: firewall-offline-cmd --delete-zone=custom
677682
register: result
678683
failed_when: result.failed and "INVALID_ZONE" not in result.stderr
679684
changed_when: false
680685

681686
- name: Remove customzone zone
682-
command: firewall-cmd --permanent --delete-zone=customzone
687+
command: firewall-offline-cmd --delete-zone=customzone
683688
register: result
684689
failed_when: result.failed and "INVALID_ZONE" not in result.stderr
685690
changed_when: false
686691

687692
- name: Reset internal zone to defaults
688-
command: firewall-cmd --permanent --load-zone-defaults=internal
693+
command: firewall-offline-cmd --load-zone-defaults=internal
689694
register: result
690695
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
691696
changed_when: false
692697

693698
- name: Reset trusted zone to defaults
694-
command: firewall-cmd --permanent --load-zone-defaults=trusted
699+
command: firewall-offline-cmd --load-zone-defaults=trusted
695700
register: result
696701
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
697702
changed_when: false
698703

699704
- name: Reset dmz zone to defaults
700-
command: firewall-cmd --permanent --load-zone-defaults=dmz
705+
command: firewall-offline-cmd --load-zone-defaults=dmz
701706
register: result
702707
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
703708
changed_when: false
704709

705710
- name: Reset drop zone to defaults
706-
command: firewall-cmd --permanent --load-zone-defaults=drop
711+
command: firewall-offline-cmd --load-zone-defaults=drop
707712
register: result
708713
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
709714
changed_when: false
710715

711716
- name: Reset public zone to defaults
712-
command: firewall-cmd --permanent --load-zone-defaults=public
717+
command: firewall-offline-cmd --load-zone-defaults=public
713718
register: result
714719
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
715720
changed_when: false
716721

717722
- name: Reset default zone to defaults
718-
command: firewall-cmd --permanent --load-zone-defaults=public
723+
command: firewall-offline-cmd --load-zone-defaults=public
719724
register: result
720725
failed_when: result.failed and "NO_DEFAULTS" not in result.stderr
721726
changed_when: false
722727

723728
- name: Reset default zone
724-
command: >-
725-
firewall-cmd
726-
--set-default-zone={{ __default_zone.stdout | quote }}
729+
# --set-default-zone not idempotent: https://bugzilla.redhat.com/show_bug.cgi?id=2363037
730+
shell: |
731+
cur_zone=$(firewall-offline-cmd --get-default-zone)
732+
if [ "$cur_zone" != {{ __default_zone.stdout | quote }} ]; then
733+
firewall-offline-cmd --set-default-zone={{ __default_zone.stdout | quote }}
734+
fi
727735
changed_when: false
728736

729737
- name: Reload firewalld

‎tests/tests_firewall_fact.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
- previous: replaced
1414

1515
- name: Get default zone
16-
command: firewall-cmd --get-default-zone
16+
command: firewall-offline-cmd --get-default-zone
1717
changed_when: false
1818
register: __default_zone
1919

@@ -64,8 +64,12 @@
6464
- name: Modify firewalld configuration
6565
shell:
6666
cmd: |
67-
firewall-cmd --permanent --add-service https
68-
firewall-cmd --permanent --new-service custom
67+
firewall-offline-cmd --add-service https
68+
firewall-offline-cmd --new-service custom
69+
changed_when: false
70+
71+
- name: Reload firewalld in booted systems
72+
command: firewall-cmd --reload
6973
changed_when: false
7074

7175
- name: Refetch firewall_config

‎tests/tests_ipsets.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
shell:
2121
cmd: |
2222
set -o pipefail
23-
firewall-cmd --permanent --get-ipsets | grep customipset
23+
firewall-offline-cmd --get-ipsets | grep customipset
2424
register: result
2525
changed_when: false
2626
failed_when: result.rc != 1
@@ -46,14 +46,14 @@
4646
shell:
4747
cmd: |
4848
set -o pipefail
49-
firewall-cmd --permanent --get-ipsets | grep "customipset"
49+
firewall-offline-cmd --get-ipsets | grep "customipset"
5050
changed_when: false
5151
register: result
5252
failed_when: result.rc == 1
5353

5454
- name: Fail if entry not added to ipset
5555
command: |
56-
firewall-cmd --permanent --ipset customipset --query-entry 8.8.8.8
56+
firewall-offline-cmd --ipset customipset --query-entry 8.8.8.8
5757
changed_when: false
5858

5959
- name: Redefine new ipset
@@ -89,14 +89,14 @@
8989
shell:
9090
cmd: |
9191
set -o pipefail
92-
firewall-cmd --permanent --get-ipsets | grep customipset
92+
firewall-offline-cmd --get-ipsets | grep customipset
9393
changed_when: false
9494
register: result
9595
failed_when: result.rc != 0
9696

9797
- name: Check that entry has been removed
9898
command: >-
99-
firewall-cmd --permanent --ipset customipset --query-entry 8.8.8.8
99+
firewall-offline-cmd --ipset customipset --query-entry 8.8.8.8
100100
changed_when: false
101101
register: result
102102
failed_when: result.rc != 1
@@ -118,10 +118,10 @@
118118
register: result
119119
loop:
120120
- command: |
121-
firewall-cmd --permanent --ipset customipset --get-description
121+
firewall-offline-cmd --ipset customipset --get-description
122122
expected: "Custom IPSet for testing purposes (changed)"
123123
- command: |
124-
firewall-cmd --permanent --ipset customipset --get-short
124+
firewall-offline-cmd --ipset customipset --get-short
125125
expected: "CustomChanged"
126126
failed_when: result.stdout != item["expected"]
127127

@@ -196,7 +196,7 @@
196196
shell:
197197
cmd: |
198198
set -o pipefail
199-
firewall-cmd --permanent --get-ipsets | grep "customipset"
199+
firewall-offline-cmd --get-ipsets | grep "customipset"
200200
changed_when: false
201201
register: result
202202
failed_when: result.rc != 1

‎tests/tests_service.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
# Verify service states are as intended
1919

2020
- name: Get all services
21-
command: firewall-cmd --permanent --get-services
21+
command: firewall-offline-cmd --get-services
2222
register: result
2323
changed_when: false
2424

@@ -136,7 +136,7 @@
136136
# Verify that custom service is added to permanent configuration
137137

138138
- name: Get all services
139-
command: firewall-cmd --permanent --get-services
139+
command: firewall-offline-cmd --get-services
140140
register: result
141141
changed_when: false
142142

@@ -185,7 +185,7 @@
185185
# Verify that custom service not a part of default zone for some reason
186186

187187
- name: Query if default zone has custom service added
188-
command: firewall-cmd --query-service systemroletest
188+
command: firewall-offline-cmd --query-service systemroletest
189189
ignore_errors: true # noqa ignore-errors
190190
register: result
191191
changed_when: false
@@ -215,7 +215,7 @@
215215
# Verify that custom service in zone permanent configuration
216216

217217
- name: Query if service has been added to default zone
218-
command: firewall-cmd --query-service systemroletest
218+
command: firewall-offline-cmd --query-service systemroletest
219219
register: result
220220
changed_when: false
221221

@@ -289,7 +289,7 @@
289289
when: firewall_lib_result.changed # noqa no-handler
290290

291291
- name: Get all services
292-
command: firewall-cmd --permanent --get-services
292+
command: firewall-offline-cmd --get-services
293293
register: result
294294
changed_when: false
295295

@@ -312,7 +312,7 @@
312312
state: absent
313313

314314
- name: Get all services
315-
command: firewall-cmd --permanent --get-services
315+
command: firewall-offline-cmd --get-services
316316
register: result
317317
changed_when: false
318318

‎tests/tests_target.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
permanent: true
1717

1818
- name: Get target setting
19-
command: firewall-cmd --info-zone=public
19+
command: firewall-offline-cmd --info-zone=public
2020
changed_when: false
2121
register: __result
2222

@@ -36,7 +36,7 @@
3636
permanent: true
3737

3838
- name: Get target setting
39-
command: firewall-cmd --info-zone=public
39+
command: firewall-offline-cmd --info-zone=public
4040
changed_when: false
4141
register: __result
4242

‎tests/tests_zone.yml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -106,23 +106,23 @@
106106
# VERIFY
107107

108108
- name: Verify firewalld zone internal services
109-
command: firewall-cmd --permanent --zone=internal --list-services
109+
command: firewall-offline-cmd --zone=internal --list-services
110110
register: result
111111
changed_when: false
112112
failed_when: result.failed
113113
or "tftp" not in result.stdout
114114
or "ftp" not in result.stdout
115115

116116
- name: Verify firewalld zone internal ports
117-
command: firewall-cmd --permanent --zone=internal --list-ports
117+
command: firewall-offline-cmd --zone=internal --list-ports
118118
register: result
119119
changed_when: false
120120
failed_when: result.failed
121121
or "443/tcp" not in result.stdout
122122
or "443/udp" not in result.stdout
123123

124124
- name: Verify firewalld zone internal forward ports
125-
command: firewall-cmd --permanent --zone=internal --list-forward-ports
125+
command: firewall-offline-cmd --zone=internal --list-forward-ports
126126
register: result
127127
changed_when: false
128128
failed_when: result.failed
@@ -132,21 +132,21 @@
132132
not in result.stdout
133133

134134
- name: Verify custom zone has masquerade added to it
135-
command: firewall-cmd --permanent --zone=customzone --query-masquerade
135+
command: firewall-offline-cmd --zone=customzone --query-masquerade
136136
register: result
137137
changed_when: false
138138
failed_when: result is failed
139139
or "yes" not in result.stdout
140140

141141
- name: Verify custom zone has masquerade added to it
142-
command: firewall-cmd --get-default-zone
142+
command: firewall-offline-cmd --get-default-zone
143143
register: result
144144
changed_when: false
145145
failed_when: result is failed
146146
or "dmz" not in result.stdout
147147

148148
- name: Verify that service http has been added to the default zone dmz
149-
command: firewall-cmd --zone=dmz --query-service=http
149+
command: firewall-offline-cmd --zone=dmz --query-service=http
150150
register: result
151151
changed_when: false
152152
failed_when: result is failed
@@ -159,16 +159,19 @@
159159
# CLEANUP: RESET TO ZONE DEFAULTS
160160

161161
- name: Remove customzone zone
162-
command: firewall-cmd --permanent --delete-zone=customzone
162+
command: firewall-offline-cmd --delete-zone=customzone
163163
register: result
164164
failed_when: result.failed and "INVALID_ZONE" not in result.stderr
165165
changed_when: false
166166

167167
- name: Reset to zone defaults
168168
shell:
169169
cmd: |
170-
firewall-cmd --permanent --load-zone-defaults=internal
171-
firewall-cmd --permanent --load-zone-defaults=external
172-
firewall-cmd --permanent --load-zone-defaults=trusted
173-
firewall-cmd --reload
170+
firewall-offline-cmd --load-zone-defaults=internal
171+
firewall-offline-cmd --load-zone-defaults=external
172+
firewall-offline-cmd --load-zone-defaults=trusted || true
173+
changed_when: false
174+
175+
- name: Reload firewall
176+
command: firewall-cmd --reload
174177
changed_when: false

0 commit comments

Comments
 (0)