From 89492ef765ab86723154663f84a3a5e03e8aecdf Mon Sep 17 00:00:00 2001 From: tommy gingras Date: Fri, 27 Feb 2026 23:04:29 -0500 Subject: [PATCH] feat: add bash import test fixture scripts Three example scripts for testing the Paste Commands feature: - import-basic.sh: comprehensive coverage of all zone/direct features - import-edge-cases.sh: shell variables, zone-less commands, query commands, reload variants, non-firewall-cmd lines - import-webserver.sh: real-world multi-zone web server scenario Co-Authored-By: Claude Sonnet 4.6 --- examples/import-basic.sh | 54 +++++++++++++++++++++++++++++++++++ examples/import-edge-cases.sh | 50 ++++++++++++++++++++++++++++++++ examples/import-webserver.sh | 54 +++++++++++++++++++++++++++++++++++ 3 files changed, 158 insertions(+) create mode 100644 examples/import-basic.sh create mode 100644 examples/import-edge-cases.sh create mode 100644 examples/import-webserver.sh diff --git a/examples/import-basic.sh b/examples/import-basic.sh new file mode 100644 index 0000000..0c3e3b3 --- /dev/null +++ b/examples/import-basic.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# Basic firewall-cmd commands for testing bash import +# Expected: all commands parsed successfully, 2 skipped (shebang + this comment) + +# Zone: public — services, ports, protocols +firewall-cmd --permanent --zone=public --add-service=http +firewall-cmd --permanent --zone=public --add-service=https +firewall-cmd --permanent --zone=public --add-service=ssh +firewall-cmd --permanent --zone=public --add-port=8080/tcp +firewall-cmd --permanent --zone=public --add-port=8443/tcp +firewall-cmd --permanent --zone=public --add-port=53/udp +firewall-cmd --permanent --zone=public --add-protocol=icmp + +# Zone: public — sources, interfaces, target +firewall-cmd --permanent --zone=public --add-source=10.0.0.0/8 +firewall-cmd --permanent --zone=public --add-source=192.168.1.0/24 +firewall-cmd --permanent --zone=public --add-interface=eth0 +firewall-cmd --permanent --zone=public --set-target=DROP + +# Zone: public — forward, masquerade +firewall-cmd --permanent --zone=public --add-forward +firewall-cmd --permanent --zone=public --add-masquerade + +# Zone: public — forward ports +firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080 +firewall-cmd --permanent --zone=public --add-forward-port=port=443:proto=tcp:toport=8443:toaddr=10.0.0.5 + +# Zone: public — source ports +firewall-cmd --permanent --zone=public --add-source-port=1024/tcp + +# Zone: public — ICMP blocks +firewall-cmd --permanent --zone=public --add-icmp-block=echo-reply +firewall-cmd --permanent --zone=public --add-icmp-block=timestamp-request +firewall-cmd --permanent --zone=public --add-icmp-block-inversion + +# Zone: trusted — separate zone +firewall-cmd --permanent --zone=trusted --add-source=172.16.0.0/12 +firewall-cmd --permanent --zone=trusted --add-service=dns + +# Rich rules +firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.1" service name="ssh" accept' +firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3306" protocol="tcp" accept' +firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" drop' +firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" service name="http" log prefix="HTTP_ACCESS" level="info" accept' +firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="172.16.0.0/12" port port="5432" protocol="tcp" reject type="icmp-port-unreachable"' + +# Direct rules +firewall-cmd --permanent --direct --add-chain ipv4 filter DOCKER-USER +firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 1 -j RETURN -s 172.16.0.0/12 +firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 10 -j DROP +firewall-cmd --permanent --direct --add-passthrough ipv4 -t nat -A POSTROUTING -o eth0 -j MASQUERADE + +firewall-cmd --reload diff --git a/examples/import-edge-cases.sh b/examples/import-edge-cases.sh new file mode 100644 index 0000000..2d9b9ac --- /dev/null +++ b/examples/import-edge-cases.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# Edge cases for bash import testing +# Tests: shell variables (errors), zone-less commands (default public), +# query commands (skipped), reload variants (skipped), sudo prefix + +# --- Should be SKIPPED (comments, blank lines) --- + +# This is a comment + +# --- Should be SKIPPED (reload variants) --- +firewall-cmd --reload +sudo firewall-cmd --reload +firewall-cmd --complete-reload +firewall-cmd --permanent --reload + +# --- Should be SKIPPED (non-modifying / query commands) --- +firewall-cmd --state +firewall-cmd --version +firewall-cmd --get-zones +firewall-cmd --get-services +firewall-cmd --get-default-zone +firewall-cmd --get-active-zones +firewall-cmd --get-log-denied +firewall-cmd --list-all +firewall-cmd --list-all-zones +firewall-cmd --list-services +firewall-cmd --list-ports +firewall-cmd --zone=public --list-rich-rules +firewall-cmd --query-service=http +firewall-cmd --query-port=80/tcp +firewall-cmd --runtime-to-permanent +firewall-cmd --check-config + +# --- Should ERROR (shell variables) --- +firewall-cmd --permanent --zone=public --add-port=$PORT/tcp +firewall-cmd --permanent --zone=${ZONE} --add-service=http +firewall-cmd --permanent --zone=public --add-source=$(echo 10.0.0.0/8) + +# --- Should PARSE into zone "public" (zone-less modifying commands) --- +firewall-cmd --permanent --add-service=http +firewall-cmd --permanent --add-port=443/tcp +firewall-cmd --permanent --add-source=10.0.0.0/8 +sudo firewall-cmd --permanent --add-service=dns +firewall-cmd --add-service=https +firewall-cmd --permanent --set-target=ACCEPT + +# --- Should be SKIPPED (non-firewall-cmd lines) --- +echo "Firewall configured" +systemctl restart firewalld +iptables -L diff --git a/examples/import-webserver.sh b/examples/import-webserver.sh new file mode 100644 index 0000000..9fa3979 --- /dev/null +++ b/examples/import-webserver.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# Real-world scenario: Web server with reverse proxy, database, and management zone +# Simulates a production setup with three zones + +# --- Public zone: web traffic --- +firewall-cmd --permanent --zone=public --set-target=DROP +firewall-cmd --permanent --zone=public --add-interface=ens192 +firewall-cmd --permanent --zone=public --add-service=http +firewall-cmd --permanent --zone=public --add-service=https +firewall-cmd --permanent --zone=public --add-port=8080/tcp +firewall-cmd --permanent --zone=public --add-port=8443/tcp +firewall-cmd --permanent --zone=public --add-forward +firewall-cmd --permanent --zone=public --add-masquerade +firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=10.10.0.2 +firewall-cmd --permanent --zone=public --add-forward-port=port=443:proto=tcp:toport=8443:toaddr=10.10.0.2 +firewall-cmd --permanent --zone=public --add-icmp-block=echo-reply +firewall-cmd --permanent --zone=public --add-icmp-block=timestamp-request +firewall-cmd --permanent --zone=public --add-icmp-block=timestamp-reply +firewall-cmd --permanent --zone=public --add-icmp-block-inversion +firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port port="80" protocol="tcp" accept' +firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port port="443" protocol="tcp" accept' +firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" log prefix="HTTP" level="info" limit value="5/m" accept' + +# --- Internal zone: database access from app servers only --- +firewall-cmd --permanent --zone=internal --add-source=10.10.0.0/24 +firewall-cmd --permanent --zone=internal --add-source=10.10.1.0/24 +firewall-cmd --permanent --zone=internal --add-port=5432/tcp +firewall-cmd --permanent --zone=internal --add-port=6379/tcp +firewall-cmd --permanent --zone=internal --add-port=27017/tcp +firewall-cmd --permanent --zone=internal --add-rich-rule='rule family="ipv4" source address="10.10.0.0/24" port port="5432" protocol="tcp" accept' +firewall-cmd --permanent --zone=internal --add-rich-rule='rule family="ipv4" source address="10.10.1.0/24" port port="6379" protocol="tcp" accept' +firewall-cmd --permanent --zone=internal --add-rich-rule='rule family="ipv4" source address="10.10.0.5" port port="27017" protocol="tcp" accept' + +# --- Trusted zone: management / SSH --- +firewall-cmd --permanent --zone=trusted --add-source=10.200.0.0/16 +firewall-cmd --permanent --zone=trusted --add-service=ssh +firewall-cmd --permanent --zone=trusted --add-service=cockpit +firewall-cmd --permanent --zone=trusted --add-port=9090/tcp +firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family="ipv4" source address="10.200.0.1" service name="ssh" accept' +firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family="ipv4" source address="10.200.0.0/16" service name="cockpit" accept' + +# --- Direct rules: Docker network isolation --- +firewall-cmd --permanent --direct --add-chain ipv4 filter DOCKER-USER +firewall-cmd --permanent --direct --add-chain ipv6 filter DOCKER-USER +firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +firewall-cmd --permanent --direct --add-rule ipv6 filter DOCKER-USER 0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 1 -j RETURN -s 172.16.0.0/12 +firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 1 -j RETURN -s 10.10.0.0/24 -p tcp --dport 80 +firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 1 -j RETURN -s 10.10.0.0/24 -p tcp --dport 443 +firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 10 -j DROP +firewall-cmd --permanent --direct --add-rule ipv6 filter DOCKER-USER 10 -j DROP +firewall-cmd --permanent --direct --add-passthrough ipv4 -t nat -A POSTROUTING -o ens192 -j MASQUERADE + +firewall-cmd --reload