Skip to content

Commit 15c2ac5

Browse files
author
Ashley Penney
committed
Merge pull request #324 from apenney/socket-owner-sles-madness
Socket owner sles madness
2 parents 54d7d08 + 4e7e233 commit 15c2ac5

File tree

4 files changed

+127
-131
lines changed

4 files changed

+127
-131
lines changed

‎README.markdown

+10-10
Original file line numberDiff line numberDiff line change
@@ -362,20 +362,20 @@ Retrieves the version of iptables-persistent from your OS. This is a Debian/Ubun
362362

363363
##Limitations
364364

365-
While we aim to support as low as Puppet 2.6.x (for now), we recommend installing the latest Puppet version from the Puppetlabs official repos.
365+
###SLES
366366

367-
Please note, we only aim support for the following distributions and versions - that is, we actually do ongoing system tests on these platforms:
367+
The `socket` parameter is not supported on SLES. In this release it will cause
368+
the catalog to fail with iptables failures, rather than correctly warn you that
369+
the features are unusable.
368370

369-
* Redhat 5.9 and 6.4
370-
* Debian 6.0 and 7.0
371-
* Ubuntu 10.04 and 12.04
371+
###Oracle Linux 5
372372

373-
If you want a new distribution supported feel free to raise a ticket and we'll consider it. If you want an older revision supported we'll also consider it, but don't get insulted if we reject it. Specifically, we will not consider Redhat 4.x support - its just too old.
373+
The `socket` and `owner` parameters are unsupported on Oracle Linux 5, when the
374+
"Unbreakable" kernel is used. If you switch to the stock Redhat 5 kernel these
375+
work. In this release it will cause the catalog to fail with iptables
376+
failures, rather than correct ly warn you that the features are unusable.
374377

375-
If you really want to get support for your OS we suggest writing any patch fix yourself, and for continual system testing if you can provide a sufficient trusted Veewee template we could consider adding such an OS to our ongoing continuous integration tests.
376-
377-
Also, as this is a 0.x release the API is still in flux and may change. Make sure
378-
you read the release notes before upgrading.
378+
###Other
379379

380380
Bugs can be reported using Github Issues:
381381

‎spec/acceptance/firewall_spec.rb

+41-43
Original file line numberDiff line numberDiff line change
@@ -1337,56 +1337,54 @@ class { '::firewall': }
13371337
end
13381338
end
13391339

1340-
# RHEL5 does not support -m socket
1341-
if default['platform'] !~ /el-5/
1342-
describe 'socket' do
1343-
context 'true' do
1344-
it 'applies' do
1345-
pp = <<-EOS
1346-
class { '::firewall': }
1347-
firewall { '585 - test':
1348-
ensure => present,
1349-
proto => tcp,
1350-
port => '585',
1351-
action => accept,
1352-
chain => 'PREROUTING',
1353-
table => 'nat',
1354-
socket => true,
1355-
}
1356-
EOS
1340+
# RHEL5/SLES does not support -m socket
1341+
describe 'socket', :unless => (default['platform'] =~ /el-5/ or fact('operatingsystem') == 'SLES') do
1342+
context 'true' do
1343+
it 'applies' do
1344+
pp = <<-EOS
1345+
class { '::firewall': }
1346+
firewall { '585 - test':
1347+
ensure => present,
1348+
proto => tcp,
1349+
port => '585',
1350+
action => accept,
1351+
chain => 'PREROUTING',
1352+
table => 'nat',
1353+
socket => true,
1354+
}
1355+
EOS
13571356

1358-
apply_manifest(pp, :catch_failures => true)
1359-
end
1357+
apply_manifest(pp, :catch_failures => true)
1358+
end
13601359

1361-
it 'should contain the rule' do
1362-
shell('iptables-save -t nat') do |r|
1363-
expect(r.stdout).to match(/-A PREROUTING -p tcp -m multiport --ports 585 -m socket -m comment --comment "585 - test" -j ACCEPT/)
1364-
end
1360+
it 'should contain the rule' do
1361+
shell('iptables-save -t nat') do |r|
1362+
expect(r.stdout).to match(/-A PREROUTING -p tcp -m multiport --ports 585 -m socket -m comment --comment "585 - test" -j ACCEPT/)
13651363
end
13661364
end
1365+
end
13671366

1368-
context 'false' do
1369-
it 'applies' do
1370-
pp = <<-EOS
1371-
class { '::firewall': }
1372-
firewall { '586 - test':
1373-
ensure => present,
1374-
proto => tcp,
1375-
port => '586',
1376-
action => accept,
1377-
chain => 'PREROUTING',
1378-
table => 'nat',
1379-
socket => false,
1380-
}
1381-
EOS
1367+
context 'false' do
1368+
it 'applies' do
1369+
pp = <<-EOS
1370+
class { '::firewall': }
1371+
firewall { '586 - test':
1372+
ensure => present,
1373+
proto => tcp,
1374+
port => '586',
1375+
action => accept,
1376+
chain => 'PREROUTING',
1377+
table => 'nat',
1378+
socket => false,
1379+
}
1380+
EOS
13821381

1383-
apply_manifest(pp, :catch_failures => true)
1384-
end
1382+
apply_manifest(pp, :catch_failures => true)
1383+
end
13851384

1386-
it 'should contain the rule' do
1387-
shell('iptables-save -t nat') do |r|
1388-
expect(r.stdout).to match(/-A PREROUTING -p tcp -m multiport --ports 586 -m comment --comment "586 - test" -j ACCEPT/)
1389-
end
1385+
it 'should contain the rule' do
1386+
shell('iptables-save -t nat') do |r|
1387+
expect(r.stdout).to match(/-A PREROUTING -p tcp -m multiport --ports 586 -m comment --comment "586 - test" -j ACCEPT/)
13901388
end
13911389
end
13921390
end

‎spec/acceptance/params_spec.rb

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def pp(params)
2020
pm
2121
end
2222

23-
it 'test various params', :unless => default['platform'].match(/el-5/) do
23+
it 'test various params', :unless => (default['platform'].match(/el-5/) || fact('operatinsystem') == 'SLES') do
2424
iptables_flush_all_tables
2525

2626
ppm = pp({

‎spec/acceptance/socket_spec.rb

+75-77
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,96 @@
11
require 'spec_helper_acceptance'
22

33
# RHEL5 does not support -m socket
4-
if default['platform'] !~ /el-5/
5-
describe 'firewall socket property' do
6-
before :all do
7-
iptables_flush_all_tables
8-
end
4+
describe 'firewall socket property', :unless => (default['platform'] =~ /el-5/ || fact('operatingsystem') == 'SLES') do
5+
before :all do
6+
iptables_flush_all_tables
7+
end
98

10-
shared_examples "is idempotent" do |value, line_match|
11-
it "changes the value to #{value}" do
12-
pp = <<-EOS
13-
class { '::firewall': }
14-
firewall { '598 - test':
15-
ensure => present,
16-
proto => 'tcp',
17-
chain => 'PREROUTING',
18-
table => 'raw',
19-
#{value}
20-
}
21-
EOS
9+
shared_examples "is idempotent" do |value, line_match|
10+
it "changes the value to #{value}" do
11+
pp = <<-EOS
12+
class { '::firewall': }
13+
firewall { '598 - test':
14+
ensure => present,
15+
proto => 'tcp',
16+
chain => 'PREROUTING',
17+
table => 'raw',
18+
#{value}
19+
}
20+
EOS
2221

23-
apply_manifest(pp, :catch_failures => true)
24-
apply_manifest(pp, :catch_changes => true)
22+
apply_manifest(pp, :catch_failures => true)
23+
apply_manifest(pp, :catch_changes => true)
2524

26-
shell('iptables-save -t raw') do |r|
27-
expect(r.stdout).to match(/#{line_match}/)
28-
end
25+
shell('iptables-save -t raw') do |r|
26+
expect(r.stdout).to match(/#{line_match}/)
2927
end
3028
end
31-
shared_examples "doesn't change" do |value, line_match|
32-
it "doesn't change the value to #{value}" do
33-
pp = <<-EOS
34-
class { '::firewall': }
35-
firewall { '598 - test':
36-
ensure => present,
37-
proto => 'tcp',
38-
chain => 'PREROUTING',
39-
table => 'raw',
40-
#{value}
41-
}
42-
EOS
29+
end
30+
shared_examples "doesn't change" do |value, line_match|
31+
it "doesn't change the value to #{value}" do
32+
pp = <<-EOS
33+
class { '::firewall': }
34+
firewall { '598 - test':
35+
ensure => present,
36+
proto => 'tcp',
37+
chain => 'PREROUTING',
38+
table => 'raw',
39+
#{value}
40+
}
41+
EOS
4342

44-
apply_manifest(pp, :catch_changes => true)
43+
apply_manifest(pp, :catch_changes => true)
4544

46-
shell('iptables-save -t raw') do |r|
47-
expect(r.stdout).to match(/#{line_match}/)
48-
end
45+
shell('iptables-save -t raw') do |r|
46+
expect(r.stdout).to match(/#{line_match}/)
4947
end
5048
end
49+
end
5150

52-
describe 'adding a rule' do
53-
context 'when unset' do
54-
before :all do
55-
iptables_flush_all_tables
56-
end
57-
it_behaves_like 'is idempotent', '', /-A PREROUTING -p tcp -m comment --comment "598 - test"/
51+
describe 'adding a rule' do
52+
context 'when unset' do
53+
before :all do
54+
iptables_flush_all_tables
5855
end
59-
context 'when set to true' do
60-
before :all do
61-
iptables_flush_all_tables
62-
end
63-
it_behaves_like 'is idempotent', 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/
56+
it_behaves_like 'is idempotent', '', /-A PREROUTING -p tcp -m comment --comment "598 - test"/
57+
end
58+
context 'when set to true' do
59+
before :all do
60+
iptables_flush_all_tables
6461
end
65-
context 'when set to false' do
66-
before :all do
67-
iptables_flush_all_tables
68-
end
69-
it_behaves_like "is idempotent", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/
62+
it_behaves_like 'is idempotent', 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/
63+
end
64+
context 'when set to false' do
65+
before :all do
66+
iptables_flush_all_tables
7067
end
68+
it_behaves_like "is idempotent", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/
7169
end
72-
describe 'editing a rule' do
73-
context 'when unset or false' do
74-
before :each do
75-
iptables_flush_all_tables
76-
shell('iptables -t raw -A PREROUTING -p tcp -m comment --comment "598 - test"')
77-
end
78-
context 'and current value is false' do
79-
it_behaves_like "doesn't change", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/
80-
end
81-
context 'and current value is true' do
82-
it_behaves_like "is idempotent", 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/
83-
end
70+
end
71+
describe 'editing a rule' do
72+
context 'when unset or false' do
73+
before :each do
74+
iptables_flush_all_tables
75+
shell('iptables -t raw -A PREROUTING -p tcp -m comment --comment "598 - test"')
76+
end
77+
context 'and current value is false' do
78+
it_behaves_like "doesn't change", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/
79+
end
80+
context 'and current value is true' do
81+
it_behaves_like "is idempotent", 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/
82+
end
83+
end
84+
context 'when set to true' do
85+
before :each do
86+
iptables_flush_all_tables
87+
shell('iptables -t raw -A PREROUTING -p tcp -m socket -m comment --comment "598 - test"')
88+
end
89+
context 'and current value is false' do
90+
it_behaves_like "is idempotent", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/
8491
end
85-
context 'when set to true' do
86-
before :each do
87-
iptables_flush_all_tables
88-
shell('iptables -t raw -A PREROUTING -p tcp -m socket -m comment --comment "598 - test"')
89-
end
90-
context 'and current value is false' do
91-
it_behaves_like "is idempotent", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/
92-
end
93-
context 'and current value is true' do
94-
it_behaves_like "doesn't change", 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/
95-
end
92+
context 'and current value is true' do
93+
it_behaves_like "doesn't change", 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/
9694
end
9795
end
9896
end

0 commit comments

Comments
 (0)