blob: 5c1c34e35ece81ea3ebb10ced8ef9f0db71cbf43 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
{ lib, pkgs, ... }:
{
name = "firewalld";
meta.maintainers = with pkgs.lib.maintainers; [
prince213
];
nodes = {
walled = {
networking.nftables.enable = true;
services.firewalld.enable = true;
services.httpd.enable = true;
services.httpd.adminAddr = "foo@example.org";
};
open = {
networking.nftables.enable = true;
services.firewalld = {
enable = true;
settings.DefaultZone = "trusted";
};
services.httpd.enable = true;
services.httpd.adminAddr = "foo@example.org";
};
};
testScript = ''
start_all()
walled.wait_for_unit("firewalld")
walled.wait_for_unit("httpd")
# https://github.com/firewalld/firewalld/issues/1571
walled.wait_until_succeeds("firewall-cmd --state")
open.wait_for_unit("network.target")
with subtest("walled local httpd works"):
walled.succeed("curl -v http://localhost/ >&2")
with subtest("incoming connections are blocked"):
open.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
with subtest("outgoing connections are allowed"):
walled.succeed("curl -v http://open/ >&2")
with subtest("runtime configuration can be changed"):
walled.succeed("firewall-cmd --add-service=http")
open.succeed("curl -v http://walled/ >&2")
with subtest("runtime configuration are not permanent"):
walled.succeed("firewall-cmd --complete-reload")
open.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
'';
}
|
