From 3f297ae6f8c84f5988a9e322c6407a53033725d1 Mon Sep 17 00:00:00 2001 From: Morgan Haskel Date: Mon, 13 Oct 2014 16:54:01 -0700 Subject: [PATCH] Fix for RHEL5 iptables-save output is in a different order for RHEL5 systems. Make the tests check that ordering. --- spec/acceptance/firewall_spec.rb | 6 +++++- spec/acceptance/invert_spec.rb | 9 +++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/spec/acceptance/firewall_spec.rb b/spec/acceptance/firewall_spec.rb index bb508d9..7d993dc 100644 --- a/spec/acceptance/firewall_spec.rb +++ b/spec/acceptance/firewall_spec.rb @@ -1626,7 +1626,11 @@ describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfami it 'should contain the rule' do shell('iptables-save') do |r| - expect(r.stdout).to match(/-A INPUT -s 10.1.5.28\/(32|255\.255\.255\.255) -p tcp -m mac --mac-source 0A:1B:3C:4D:5E:6F -m comment --comment "610 - test"/) + if (fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') == '5') + expect(r.stdout).to match(/-A INPUT -s 10.1.5.28 -p tcp -m mac --mac-source 0A:1B:3C:4D:5E:6F -m comment --comment "610 - test"/) + else + expect(r.stdout).to match(/-A INPUT -s 10.1.5.28\/(32|255\.255\.255\.255) -p tcp -m mac --mac-source 0A:1B:3C:4D:5E:6F -m comment --comment "610 - test"/) + end end end end diff --git a/spec/acceptance/invert_spec.rb b/spec/acceptance/invert_spec.rb index aa04912..ade319f 100644 --- a/spec/acceptance/invert_spec.rb +++ b/spec/acceptance/invert_spec.rb @@ -30,8 +30,13 @@ describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfami it 'should contain the rules' do shell('iptables-save') do |r| - expect(r.stdout).to match(/-A INPUT ! -p esp -m comment --comment "601 disallow esp protocol" -j ACCEPT/) - expect(r.stdout).to match(/-A INPUT ! -s 10\.0\.0\.0\/8 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m multiport ! --sports 80,443 -m comment --comment "602 drop NEW external website packets with FIN\/RST\/ACK set and SYN unset" -m state --state NEW -j DROP/) + if (fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') == '5') + expect(r.stdout).to match(/-A INPUT -p ! esp -m comment --comment "601 disallow esp protocol" -j ACCEPT/) + expect(r.stdout).to match(/-A INPUT -s ! 10\.0\.0\.0\/255\.0\.0\.0 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --sports ! 80,443 -m comment --comment "602 drop NEW external website packets with FIN\/RST\/ACK set and SYN unset" -m state --state NEW -j DROP/) + else + expect(r.stdout).to match(/-A INPUT ! -p esp -m comment --comment "601 disallow esp protocol" -j ACCEPT/) + expect(r.stdout).to match(/-A INPUT ! -s 10\.0\.0\.0\/8 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m multiport ! --sports 80,443 -m comment --comment "602 drop NEW external website packets with FIN\/RST\/ACK set and SYN unset" -m state --state NEW -j DROP/) + end end end end -- 2.45.2