clean tests for log mss

diff --git a/spec/acceptance/firewall_attributes_happy_path_spec.rb b/spec/acceptance/firewall_attributes_happy_path_spec.rb
index a95b5f809e85f100fd964a190405c63d010ae13d..89b8760b7c0e88c645dc125eb36371fd7ed6502b 100644 (file)
--- a/spec/acceptance/firewall_attributes_happy_path_spec.rb
+++ b/spec/acceptance/firewall_attributes_happy_path_spec.rb
@@ -10,6 +10,15 @@ describe 'firewall attribute testing, happy path' do
     before(:all) do
       pp = <<-PUPPETCODE
           class { '::firewall': }
+          firewall { '004 - log_level and log_prefix':
+            chain      => 'INPUT',
+            proto      => 'all',
+            ctstate    => 'INVALID',
+            jump       => 'LOG',
+            log_level  => '3',
+            log_prefix => 'IPTABLES dropped invalid: ',
+          }
+
           firewall { '501 - connlimit':
             proto           => tcp,
             dport           => '2222',
@@ -166,6 +175,24 @@ describe 'firewall attribute testing, happy path' do
             reject       => 'icmp-net-unreachable',
             table        => 'filter',
           }
+          firewall {
+            '600 - set_mss':
+              proto     => 'tcp',
+              tcp_flags => 'SYN,RST SYN',
+              jump      => 'TCPMSS',
+              set_mss   => '1360',
+              mss       => '1361:1541',
+              chain     => 'FORWARD',
+              table     => 'mangle',
+          }
+          firewall {
+            '601 - clamp_mss_to_pmtu':
+              proto             => 'tcp',
+              chain             => 'FORWARD',
+              tcp_flags         => 'SYN,RST SYN',
+              jump              => 'TCPMSS',
+              clamp_mss_to_pmtu => true,
+          }
           firewall { '700 - blah-A Test Rule':
             jump       => 'LOG',
             log_prefix => 'FW-A-INPUT: ',
@@ -228,6 +255,9 @@ describe 'firewall attribute testing, happy path' do
     end
     let(:result) { shell('iptables-save') }
 
+    it 'log_level and log_prefix' do
+      expect(result.stdout).to match(%r{A INPUT -m conntrack --ctstate INVALID -m comment --comment "004 - log_level and log_prefix" -j LOG --log-prefix "IPTABLES dropped invalid: " --log-level 3})
+    end
     it 'contains the connlimit and connlimit_mask rule' do
       expect(result.stdout).to match(
         %r{-A INPUT -p tcp -m multiport --dports 2222 -m connlimit --connlimit-above 10 --connlimit-mask 24 (--connlimit-saddr )?-m comment --comment "501 - connlimit" -j REJECT --reject-with icmp-port-unreachable}, # rubocop:disable Metrics/LineLength
@@ -302,6 +332,12 @@ describe 'firewall attribute testing, happy path' do
     it 'ipsec_policy none and dir in' do
       expect(result.stdout).to match(%r{-A INPUT -d 20.0.0.0\/(8|255\.0\.0\.0) -m policy --dir in --pol none -m comment --comment "596 - ipsec_policy none and in" -j REJECT --reject-with icmp-net-unreachable}) # rubocop:disable Metrics/LineLength
     end
+    it 'set_mss is set' do
+      expect(result.stdout).to match(%r{-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1541 -m comment --comment "600 - set_mss" -j TCPMSS --set-mss 1360})
+    end
+    it 'clamp_mss_to_pmtu is set' do
+      expect(result.stdout).to match(%r{-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "601 - clamp_mss_to_pmtu" -j TCPMSS --clamp-mss-to-pmtu})
+    end
     it 'comment containing "-A "' do
       expect(result.stdout).to match(%r{-A INPUT -p tcp -m comment --comment "700 - blah-A Test Rule" -j LOG --log-prefix "FW-A-INPUT: "})
     end

diff --git a/spec/acceptance/firewall_log_spec.rb b/spec/acceptance/firewall_log_spec.rb
deleted file mode 100644 (file)
index 4693221..0000000
--- a/spec/acceptance/firewall_log_spec.rb
+++ /dev/null
@@ -1,75 +0,0 @@
-require 'spec_helper_acceptance'
-
-describe 'log based tests' do
-  before :all do
-    iptables_flush_all_tables
-    ip6tables_flush_all_tables
-  end
-
-  ppm2 = <<-PUPPETCODE
-    firewall { '998 log all':
-      proto     => 'all',
-      jump      => 'LOG',
-      log_level => 'debug',
-    }
-  PUPPETCODE
-  values = [2, 0]
-  it 'test log rule' do
-    iptables_flush_all_tables
-
-    values.each do |value|
-      expect(apply_manifest(ppm2, catch_failures: true).exit_code).to eq(value)
-    end
-  end
-
-  ppm3 = <<-PUPPETCODE
-    firewall { '004 log all INVALID packets':
-      chain      => 'INPUT',
-      proto      => 'all',
-      ctstate    => 'INVALID',
-      jump       => 'LOG',
-      log_level  => '3',
-      log_prefix => 'IPTABLES dropped invalid: ',
-    }
-  PUPPETCODE
-  ppm4 = <<-PUPPETCODE
-    firewall { '003 log all INVALID packets':
-      chain      => 'INPUT',
-      proto      => 'all',
-      ctstate    => 'INVALID',
-      jump       => 'LOG',
-      log_level  => '3',
-      log_prefix => 'IPTABLES dropped invalid: ',
-    }
-  PUPPETCODE
-  ppm5 = <<-PUPPETCODE + "\n" + ppm4
-      resources { 'firewall':
-        purge => true,
-      }
-  PUPPETCODE
-  it 'test log rule - changing names' do
-    iptables_flush_all_tables
-
-    expect(apply_manifest(ppm3, catch_failures: true).exit_code).to eq(2)
-    expect(apply_manifest(ppm5, catch_failures: true).exit_code).to eq(2)
-  end
-
-  ppm9 = <<-PUPPETCODE
-    firewall { '004 log all INVALID packets':
-      chain      => 'INPUT',
-      proto      => 'all',
-      ctstate    => 'INVALID',
-      jump       => 'LOG',
-      log_level  => '3',
-      log_prefix => 'IPTABLES dropped invalid: ',
-    }
-  PUPPETCODE
-  values = [2, 0]
-  it 'test log rule - idempotent' do
-    iptables_flush_all_tables
-
-    values.each do |value|
-      expect(apply_manifest(ppm9, catch_failures: true).exit_code).to eq(value)
-    end
-  end
-end

diff --git a/spec/acceptance/firewall_mss_spec.rb b/spec/acceptance/firewall_mss_spec.rb
index 2648fe52458349e33348e2fcdf245fb3e9f551e4..d389b1715d540c9cb678618a9261dcfc2612b3c9 100644 (file)
--- a/spec/acceptance/firewall_mss_spec.rb
+++ b/spec/acceptance/firewall_mss_spec.rb
@@ -6,56 +6,6 @@ describe 'firewall MSS' do
     ip6tables_flush_all_tables
   end
 
-  describe 'mss ipv4 tests' do
-    context 'when 1360' do
-      pp1 = <<-PUPPETCODE
-          class { '::firewall': }
-          firewall {
-            '502 - set_mss':
-              proto     => 'tcp',
-              tcp_flags => 'SYN,RST SYN',
-              jump      => 'TCPMSS',
-              set_mss   => '1360',
-              mss       => '1361:1541',
-              chain     => 'FORWARD',
-              table     => 'mangle',
-          }
-      PUPPETCODE
-      it 'applies' do
-        apply_manifest(pp1, catch_failures: true)
-      end
-
-      it 'contains the rule' do
-        shell('iptables-save -t mangle') do |r|
-          expect(r.stdout).to match(%r{-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1541 -m comment --comment "502 - set_mss" -j TCPMSS --set-mss 1360})
-        end
-      end
-    end
-
-    context 'when clamp_mss_to_pmtu' do
-      pp2 = <<-PUPPETCODE
-          class { '::firewall': }
-          firewall {
-            '503 - clamp_mss_to_pmtu':
-              proto             => 'tcp',
-              chain             => 'FORWARD',
-              tcp_flags         => 'SYN,RST SYN',
-              jump              => 'TCPMSS',
-              clamp_mss_to_pmtu => true,
-          }
-      PUPPETCODE
-      it 'applies' do
-        apply_manifest(pp2, catch_failures: true)
-      end
-
-      it 'contains the rule' do
-        shell('iptables-save') do |r|
-          expect(r.stdout).to match(%r{-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "503 - clamp_mss_to_pmtu" -j TCPMSS --clamp-mss-to-pmtu})
-        end
-      end
-    end
-  end
-
   if default['platform'] !~ %r{el-5} && default['platform'] !~ %r{sles-10}
     describe 'mss ipv6 tests' do
       context 'when 1360' do