{"push_id":622793216,"size":1,"distinct_size":1,"ref":"refs/heads/rspec-tests-apparmor","head":"7a0f6781231ca70f163111d18f39e535db6ccf4d","before":"0b8a17d02811ec9ed60bcdae75112212203bc3fb","commits":[{"sha":"7a0f6781231ca70f163111d18f39e535db6ccf4d","author":{"email":"474ba67bdb289c6263b36dfd8a7bed6c85b04943@freedom.press","name":"James"},"message":"Using virtualbox IP addresses\n\nCurrently using hardcoded IP addresses in the iptables tests that are static in the Vagrantfile. This will need to be changed to support SNAP_CI, prod testing and other use cases.\n\nLeveraging something like. https://github.com/volanja/ansible_spec may work.\n\nFixed syntax in the iptables tests.\n\nIf the Vagrantfile is not provisioned skipping the `aa-complain` the respective tests will fail.\n\n```\nrspec ./spec/localhost/apparmor_spec.rb:19 # File \"/etc/apparmor.d/usr.sbin.apache2\" content should match \"/usr/sbin/apache2 {\"\nrspec ./spec/localhost/apparmor_spec.rb:37 # Command \"aa-status --complaining\" should return stdout \"0\"\n```\n\nIf the `Allow_direct_access` role is not skipped then the respective tests will fail. To test without the allow direct access, the vagrant inventory needs to be populated with the onion addresses and the host systems torrc needs to configured for ATHS for both servers.\n\n```\nrspec ./spec/localhost/iptables_spec.rb:5 # iptables should not have rule \" INPUT -p tcp -m tcp --dport 8080 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \\\"Staging only allow direct access\\\" -j ACCEPT\"\nrspec ./spec/localhost/iptables_spec.rb:6 # iptables should not have rule \" INPUT -p tcp -m tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \\\"Staging only allow direct access\\\" -j ACCEPT\"\nrspec ./spec/localhost/iptables_spec.rb:7 # iptables should not have rule \" INPUT -p udp -m udp --sport 53 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \\\"Staging only allow direct access\\\" -j ACCEPT\"\nrspec ./spec/localhost/iptables_spec.rb:8 # iptables should not have rule \" INPUT -p tcp -m tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \\\"Staging only allow direct access\\\" -j ACCEPT\"\nrspec ./spec/localhost/iptables_spec.rb:9 # iptables should not have rule \" OUTPUT -p tcp -m tcp --sport 8080 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \\\"Staging only allow direct access\\\" -j ACCEPT\"\nrspec ./spec/localhost/iptables_spec.rb:10 # iptables should not have rule \" OUTPUT -p tcp -m tcp --sport 80 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \\\"Staging only allow direct access\\\" -j ACCEPT\"\nrspec ./spec/localhost/iptables_spec.rb:11 # iptables should not have rule \" OUTPUT -p udp -m udp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \\\"Staging only allow direct access\\\" -j ACCEPT\"\nrspec ./spec/localhost/iptables_spec.rb:12 # iptables should not have rule \" OUTPUT -p tcp -m tcp --sport 22 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \\\"Staging only allow direct access\\\" -j ACCEPT\"\n/usr/bin/ruby1.9.1 -S rspec spec/localhost/apache_spec.rb spec/localhost/apparmor_spec.rb spec/localhost/grsec_spec.rb spec/localhost/iptables_spec.rb spec/localhost/securedrop_app_spec.rb spec/localhost/tor_spec.rb failed\n```","distinct":true,"url":"https://api.github.com/repos/dolanjs/securedrop/commits/7a0f6781231ca70f163111d18f39e535db6ccf4d"}]}