search

chr4-cookbooks / iptables-ng

Cookbook to maintain iptables rules and policies on different platforms, respecting the way the os handles these settings.
GNU General Public License v3.0
38 stars 33 forks source link

Remove foodcritic, enable unified_mode, move tests to Inspec #73

Closed hrak closed 2 years ago

hrak commented 2 years ago

This PR contains several fixes:

Together with a move to Github Actions like in the sshd cookbook this should bring everything into a state that works with recent chef infra clients (>= 15.3)

hrak commented 2 years ago

I haven't fully checked whether all test functionality was migrated 100% so far - this might take a bit more time.

I have converted every minitest to Inspec so it should cover all the original tests.

Regarding Github Actions: I'm fully for it, last time I checked I had some issues with low-level tasks like iptables rules, so it wasn't easily adopted for this cookbook iirc - but I think it's worth another try!

Hmm, you may have a point there, not sure if iptables works in that environment.

chr4 commented 2 years ago

I have converted every minitest to Inspec so it should cover all the original tests.

Awesome!

chr4 commented 2 years ago

I've been trying out Github actions, it seems like it's working due to your changes!

It seems like quite a few tests work, but also a lot of them fail. Are they all green when you run the tests locally?

I think there are some typos, e.g. this one should check for won't match instead of match for the port 80 rule. Compare:

chr4 commented 2 years ago

Besides the mentioned won't mixup, it seems like it's running on the newest versions of all distributions, while it fails on the older ones. I haven't investigated fully, but I think it might be ok to only run Github Actions on the newest versions, while the older ones are kept for manual runs as a compromise.

hrak commented 2 years ago

I've been trying out Github actions, it seems like it's working due to your changes!

That's great news!

It seems like quite a few tests work, but also a lot of them fail. Are they all green when you run the tests locally?

I think there are some typos, e.g. this one should check for won't match instead of match for the port 80 rule. Compare:

You are right, i will push some changes in a bit to fix the failing tests.

hrak commented 2 years ago

Besides the mentioned won't mixup, it seems like it's running on the newest versions of all distributions, while it fails on the older ones. I haven't investigated fully, but I think it might be ok to only run Github Actions on the newest versions, while the older ones are kept for manual runs as a compromise.

Seems like there are some issues with loading ip6tables on the older distro's. My guess is that this is GH Actions related, since on my workstation all the tests pass now. Maybe limit the test to the newest distros indeed.

chr4 commented 2 years ago

If you want, feel free to add yourself to the Contributors list (or let me know if/ how you want to appear there so I can add you).

I've removed the non-working older systems in https://github.com/chr4-cookbooks/iptables-ng/pull/74. When this is done I'll rebase the changes there and merge (and release a new version to Supermarket).

Thansk for all the work you've put into this, very much apprechiated.

hrak commented 2 years ago

You can add me as Hans Rakers. Thanks and you're welcome!

chr4 commented 2 years ago

Done. Closing in favor of #74.

chr4 commented 2 years ago

Released as 4.1.0 on Chef supermarket.