|
| 1 | +# Set defaults, use debian as base |
| 2 | + |
| 3 | +conf_user = 'bind' |
| 4 | +conf_group = 'bind' |
| 5 | +keys_user = 'root' |
| 6 | +keys_group = conf_group |
| 7 | +logs_user = 'root' |
| 8 | +logs_group = conf_group |
| 9 | +named_directory = '/var/cache/bind' |
| 10 | +zones_directory = '/var/cache/bind/zones' |
| 11 | +keys_directory = '/etc/bind/keys' |
| 12 | +log_directory = '/var/log/bind9' |
| 13 | +keys_mode = '02755' |
| 14 | +conf_mode = '0644' |
| 15 | +config = '/etc/bind/named.conf' |
| 16 | + |
| 17 | +# Override by OS |
| 18 | +case os[:name] |
| 19 | +when 'arch','redhat', 'centos', 'fedora' |
| 20 | + conf_user = 'named' |
| 21 | + conf_group = 'named' |
| 22 | + keys_group = 'root' |
| 23 | + logs_group = conf_group |
| 24 | + named_directory = '/var/named' |
| 25 | + zones_directory = named_directory |
| 26 | + keys_directory = '/etc/named.keys' |
| 27 | + log_directory = '/var/log/named' |
| 28 | + keys_mode = '0755' |
| 29 | + conf_mode = '0640' |
| 30 | + config = '/etc/named.conf' |
| 31 | +when 'ubuntu' |
| 32 | + log_directory = '/var/log/named' |
| 33 | +end |
| 34 | + |
| 35 | +# Check main config dir |
| 36 | +control 'Directory ' + named_directory do |
| 37 | + title 'should exist' |
| 38 | + describe directory(named_directory) do |
| 39 | + its('owner') { should eq conf_user } |
| 40 | + its('group') { should eq conf_group } |
| 41 | + its('mode') { should cmp '0775' } |
| 42 | + end |
| 43 | +end |
| 44 | + |
| 45 | +# Check DNSSEC keys dir |
| 46 | +control 'Directory ' + keys_directory do |
| 47 | + title 'should exist' |
| 48 | + describe directory(keys_directory) do |
| 49 | + its('owner') { should eq keys_user } |
| 50 | + its('group') { should eq keys_group } |
| 51 | + its('mode') { should cmp keys_mode } |
| 52 | + end |
| 53 | +end |
| 54 | + |
| 55 | +# Check Logs dir |
| 56 | +control 'Directory ' + log_directory do |
| 57 | + title 'should exist' |
| 58 | + describe directory(log_directory) do |
| 59 | + its('owner') { should eq logs_user } |
| 60 | + its('group') { should eq logs_group } |
| 61 | + its('mode') { should cmp '0775' } |
| 62 | + end |
| 63 | +end |
| 64 | + |
| 65 | +# Check zones dir if on debian based OS |
| 66 | +control 'Directory ' + zones_directory do |
| 67 | + title 'should exist' |
| 68 | + only_if do |
| 69 | + os.debian? |
| 70 | + end |
| 71 | + describe directory(zones_directory) do |
| 72 | + its('owner') { should eq conf_user } |
| 73 | + its('group') { should eq conf_group } |
| 74 | + its('mode') { should cmp '0775' } |
| 75 | + end |
| 76 | +end |
| 77 | + |
| 78 | +# Check main config |
| 79 | +# RHEL: Doesn't use .options and has rfc1912.zones |
| 80 | +# Debian: Uses .options |
| 81 | +case os[:name] |
| 82 | +when 'arch','redhat', 'centos', 'fedora' |
| 83 | + control 'File ' + config do |
| 84 | + title 'should exist' |
| 85 | + describe file(config) do |
| 86 | + its('owner') { should eq conf_user } |
| 87 | + its('group') { should eq conf_group } |
| 88 | + its('mode') { should cmp conf_mode } |
| 89 | + its('content') { should match /^include\ "\/etc\/named\.rfc1912\.zones";/ } |
| 90 | + its('content') { should match /^include\ "\/etc\/named\.conf\.local";/ } |
| 91 | + end |
| 92 | + end |
| 93 | +when 'ubuntu', 'debian' |
| 94 | + control 'File ' + config do |
| 95 | + title 'should exist' |
| 96 | + describe file(config) do |
| 97 | + its('owner') { should eq conf_user } |
| 98 | + its('group') { should eq conf_group } |
| 99 | + its('mode') { should cmp conf_mode } |
| 100 | + its('content') { should match /^include\ "\/etc\/bind\/named\.conf\.local";/ } |
| 101 | + its('content') { should match /^include\ "\/etc\/bind\/named\.conf\.options";/ } |
| 102 | + end |
| 103 | + end |
| 104 | +end |
| 105 | + |
| 106 | +# If debian check the .options file |
| 107 | +control 'File ' + config + '.options' do |
| 108 | + title 'should exist' |
| 109 | + only_if do |
| 110 | + os.debian? |
| 111 | + end |
| 112 | + describe file(config + '.options') do |
| 113 | + its('owner') { should eq conf_user } |
| 114 | + its('group') { should eq conf_group } |
| 115 | + its('mode') { should cmp '0644' } |
| 116 | + its('content') { should match /\ {8}directory\ "#{named_directory}"/ } |
| 117 | + its('content') { should match /\ {8}key-directory\ "#{keys_directory}"/ } |
| 118 | + end |
| 119 | +end |
| 120 | + |
| 121 | +# Check config.local |
| 122 | +control 'File ' + config + '.local' do |
| 123 | + title 'should exist' |
| 124 | + describe file(config + '.local') do |
| 125 | + its('owner') { should eq conf_user } |
| 126 | + its('group') { should eq conf_group } |
| 127 | + its('mode') { should cmp '0644' } |
| 128 | + # Multi line regex to match the various zones |
| 129 | + # If you're here to update the pillar/tests I would highly reccommend |
| 130 | + # using an online miltiline regex editor to do this: |
| 131 | + # https://www.regextester.com/ |
| 132 | + # the #{foo} is a ruby string expansion so we can use the variables |
| 133 | + # defined above |
| 134 | + # Match example.com zone from the pillar |
| 135 | + its('content') { should match /^zone\ "example\.com"\ {\n\ \ type\ master;\n\ \ file\ "#{zones_directory}\/example\.com";\n\ \ \n\ \ update-policy\ {\n\ \ \ \ grant\ core_dhcp\ name\ dns_entry_allowed_to_update\.\ ANY;\n\ \ \};\n\ \ notify\ no;\n\};/ } |
| 136 | + # Match example.net from pillar |
| 137 | + its('content') { should match /^zone\ "example\.net"\ {\n\ \ type\ master;\n\ \ file\ "#{zones_directory}\/example\.net";\n\ \ \n\ \ notify\ no;\n\};/ } |
| 138 | + # Match example.org from pillar |
| 139 | + its('content') { should match /^zone\ "example\.org"\ {\n\ \ type\ slave;\n\ \ file\ "#{zones_directory}\/";\n\ \ \n\ \ notify\ no;\n\ \ masters\ \{\n\ \ \ \ 192\.0\.2\.1;\n\ \ \ \ 192\.0\.2\.2;\n\ \ \};\n\};/ } |
| 140 | + # Match 113.0.203 reverse zone from pillar |
| 141 | + its('content') { should match /^zone\ "113\.0\.203\.in-addr\.arpa"\ {\n\ \ type\ master;\n\ \ file\ "#{zones_directory}\/113\.0\.203\.in-addr\.arpa";\n\ \ \n\ \ notify\ no;\n\};/ } |
| 142 | + # Match 100.51.198 reverse zone from pillar |
| 143 | + its('content') { should match /^zone\ "100\.51\.198\.in-addr\.arpa"\ {\n\ \ type\ master;\n\ \ file\ "#{zones_directory}\/100\.51\.198\.in-addr\.arpa";\n\ \ \n\ \ notify\ no;\n\};/ } |
| 144 | + # Match logging |
| 145 | + its('content') { should match /^logging\ \{\n\ \ channel\ "querylog"\ {\n\ \ \ \ file\ "#{log_directory}\/query\.log";\n\ \ \ \ print-time\ yes;\n\ \ \};\n\ \ category\ queries\ \{\ querylog;\ \};\n\};/ } |
| 146 | + # Match acl1 |
| 147 | + its('content') { should match /acl\ client1\ \{\n\ \ 127\.0\.0\.0\/8;\n\ \ 10\.20\.0\.0\/16;\n\};/ } |
| 148 | + # Match acl2 |
| 149 | + its('content') { should match /^acl\ client2\ \{\n\ \ 10\.30\.0\.0\/8;\n\};/ } |
| 150 | + end |
| 151 | +end |
0 commit comments