Skip to content
This repository was archived by the owner on Aug 15, 2026. It is now read-only.

Add bash import test fixture scripts #3

Merged
studiowebux merged 1 commit into from
Feb 28, 2026
Merged

Add bash import test fixture scripts #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions examples/import-basic.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
#!/bin/bash
# Basic firewall-cmd commands for testing bash import
# Expected: all commands parsed successfully, 2 skipped (shebang + this comment)

# Zone: public — services, ports, protocols
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --permanent --zone=public --add-port=8080/tcp
firewall-cmd --permanent --zone=public --add-port=8443/tcp
firewall-cmd --permanent --zone=public --add-port=53/udp
firewall-cmd --permanent --zone=public --add-protocol=icmp

# Zone: public — sources, interfaces, target
firewall-cmd --permanent --zone=public --add-source=10.0.0.0/8
firewall-cmd --permanent --zone=public --add-source=192.168.1.0/24
firewall-cmd --permanent --zone=public --add-interface=eth0
firewall-cmd --permanent --zone=public --set-target=DROP

# Zone: public — forward, masquerade
firewall-cmd --permanent --zone=public --add-forward
firewall-cmd --permanent --zone=public --add-masquerade

# Zone: public — forward ports
firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080
firewall-cmd --permanent --zone=public --add-forward-port=port=443:proto=tcp:toport=8443:toaddr=10.0.0.5

# Zone: public — source ports
firewall-cmd --permanent --zone=public --add-source-port=1024/tcp

# Zone: public — ICMP blocks
firewall-cmd --permanent --zone=public --add-icmp-block=echo-reply
firewall-cmd --permanent --zone=public --add-icmp-block=timestamp-request
firewall-cmd --permanent --zone=public --add-icmp-block-inversion

# Zone: trusted — separate zone
firewall-cmd --permanent --zone=trusted --add-source=172.16.0.0/12
firewall-cmd --permanent --zone=trusted --add-service=dns

# Rich rules
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.1" service name="ssh" accept'
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3306" protocol="tcp" accept'
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" drop'
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" service name="http" log prefix="HTTP_ACCESS" level="info" accept'
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="172.16.0.0/12" port port="5432" protocol="tcp" reject type="icmp-port-unreachable"'

# Direct rules
firewall-cmd --permanent --direct --add-chain ipv4 filter DOCKER-USER
firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 1 -j RETURN -s 172.16.0.0/12
firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 10 -j DROP
firewall-cmd --permanent --direct --add-passthrough ipv4 -t nat -A POSTROUTING -o eth0 -j MASQUERADE

firewall-cmd --reload
50 changes: 50 additions & 0 deletions examples/import-edge-cases.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
#!/bin/bash
# Edge cases for bash import testing
# Tests: shell variables (errors), zone-less commands (default public),
# query commands (skipped), reload variants (skipped), sudo prefix

# --- Should be SKIPPED (comments, blank lines) ---

# This is a comment

# --- Should be SKIPPED (reload variants) ---
firewall-cmd --reload
sudo firewall-cmd --reload
firewall-cmd --complete-reload
firewall-cmd --permanent --reload

# --- Should be SKIPPED (non-modifying / query commands) ---
firewall-cmd --state
firewall-cmd --version
firewall-cmd --get-zones
firewall-cmd --get-services
firewall-cmd --get-default-zone
firewall-cmd --get-active-zones
firewall-cmd --get-log-denied
firewall-cmd --list-all
firewall-cmd --list-all-zones
firewall-cmd --list-services
firewall-cmd --list-ports
firewall-cmd --zone=public --list-rich-rules
firewall-cmd --query-service=http
firewall-cmd --query-port=80/tcp
firewall-cmd --runtime-to-permanent
firewall-cmd --check-config

# --- Should ERROR (shell variables) ---
firewall-cmd --permanent --zone=public --add-port=$PORT/tcp
firewall-cmd --permanent --zone=${ZONE} --add-service=http
firewall-cmd --permanent --zone=public --add-source=$(echo 10.0.0.0/8)

# --- Should PARSE into zone "public" (zone-less modifying commands) ---
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --permanent --add-source=10.0.0.0/8
sudo firewall-cmd --permanent --add-service=dns
firewall-cmd --add-service=https
firewall-cmd --permanent --set-target=ACCEPT

# --- Should be SKIPPED (non-firewall-cmd lines) ---
echo "Firewall configured"
systemctl restart firewalld
iptables -L
54 changes: 54 additions & 0 deletions examples/import-webserver.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
#!/bin/bash
# Real-world scenario: Web server with reverse proxy, database, and management zone
# Simulates a production setup with three zones

# --- Public zone: web traffic ---
firewall-cmd --permanent --zone=public --set-target=DROP
firewall-cmd --permanent --zone=public --add-interface=ens192
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --permanent --zone=public --add-port=8080/tcp
firewall-cmd --permanent --zone=public --add-port=8443/tcp
firewall-cmd --permanent --zone=public --add-forward
firewall-cmd --permanent --zone=public --add-masquerade
firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=10.10.0.2
firewall-cmd --permanent --zone=public --add-forward-port=port=443:proto=tcp:toport=8443:toaddr=10.10.0.2
firewall-cmd --permanent --zone=public --add-icmp-block=echo-reply
firewall-cmd --permanent --zone=public --add-icmp-block=timestamp-request
firewall-cmd --permanent --zone=public --add-icmp-block=timestamp-reply
firewall-cmd --permanent --zone=public --add-icmp-block-inversion
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port port="80" protocol="tcp" accept'
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port port="443" protocol="tcp" accept'
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" log prefix="HTTP" level="info" limit value="5/m" accept'

# --- Internal zone: database access from app servers only ---
firewall-cmd --permanent --zone=internal --add-source=10.10.0.0/24
firewall-cmd --permanent --zone=internal --add-source=10.10.1.0/24
firewall-cmd --permanent --zone=internal --add-port=5432/tcp
firewall-cmd --permanent --zone=internal --add-port=6379/tcp
firewall-cmd --permanent --zone=internal --add-port=27017/tcp
firewall-cmd --permanent --zone=internal --add-rich-rule='rule family="ipv4" source address="10.10.0.0/24" port port="5432" protocol="tcp" accept'
firewall-cmd --permanent --zone=internal --add-rich-rule='rule family="ipv4" source address="10.10.1.0/24" port port="6379" protocol="tcp" accept'
firewall-cmd --permanent --zone=internal --add-rich-rule='rule family="ipv4" source address="10.10.0.5" port port="27017" protocol="tcp" accept'

# --- Trusted zone: management / SSH ---
firewall-cmd --permanent --zone=trusted --add-source=10.200.0.0/16
firewall-cmd --permanent --zone=trusted --add-service=ssh
firewall-cmd --permanent --zone=trusted --add-service=cockpit
firewall-cmd --permanent --zone=trusted --add-port=9090/tcp
firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family="ipv4" source address="10.200.0.1" service name="ssh" accept'
firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family="ipv4" source address="10.200.0.0/16" service name="cockpit" accept'

# --- Direct rules: Docker network isolation ---
firewall-cmd --permanent --direct --add-chain ipv4 filter DOCKER-USER
firewall-cmd --permanent --direct --add-chain ipv6 filter DOCKER-USER
firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv6 filter DOCKER-USER 0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 1 -j RETURN -s 172.16.0.0/12
firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 1 -j RETURN -s 10.10.0.0/24 -p tcp --dport 80
firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 1 -j RETURN -s 10.10.0.0/24 -p tcp --dport 443
firewall-cmd --permanent --direct --add-rule ipv4 filter DOCKER-USER 10 -j DROP
firewall-cmd --permanent --direct --add-rule ipv6 filter DOCKER-USER 10 -j DROP
firewall-cmd --permanent --direct --add-passthrough ipv4 -t nat -A POSTROUTING -o ens192 -j MASQUERADE

firewall-cmd --reload