Feature/#18893 add firewall

spec/configuration/cgroup_spec.rb

@@ -5,11 +5,10 @@
 
 cgroups = command('find /sys/fs/cgroup/redborder.slice -type d -name "redborder-*" -not -name "*.service"').stdout.split
 
+describe file('/sys/fs/cgroup/redborder.slice') do
+  it { should exist }
+end
 describe 'Check cgroups' do
-  describe file('/sys/fs/cgroup/redborder.slice') do
-    it { should exist }
-  end
-
   cgroups.each do |cgroup|
     next if cgroup.include?('snortd') || cgroup.include?('barnyard2')
 

spec/configuration/firewall_spec.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'set'
+
+set :os, family: 'redhat', release: '9', arch: 'x86_64'
+
+describe 'Check zones are defined' do
+  describe file('/etc/firewalld/zones/public.xml') do
+    it { should exist }
+    it { should be_owned_by 'root' }
+    it { should be_grouped_into 'root' }
+    # it { should be_mode 600 } # Ensures file is readable and writable by root only
+  end
+end
+
+describe 'Check if not allowed open ports in public zone are empty' do
+  valid_public_ports = Set.new [
+    '5353/udp',   # (mDNS / Serf)
+    '161/udp',    # (snmp)
+    '162/udp'     # (snmp)
+  ]
+
+  open_public = command('firewall-cmd --zone=public --list-ports')
+  open_public = open_public.stdout.strip.split(' ')
+  open_public = Set.new open_public
+
+  not_allowed_open_public = open_public - valid_public_ports
+
+  it 'should not have any not allowed open ports in public zone' do
+    unless not_allowed_open_public.empty?
+      # Better to use 'skip' instead of 'fail' to not block the pipeline
+      skip "Not allowed open ports in public zone: #{not_allowed_open_public.to_a.join(', ')}"
+    end
+
+    expect(not_allowed_open_public).to be_empty
+  end
+end

spec/services/firewalld_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+set :os, family: 'redhat', release: '9', arch: 'x86_64'
+
+describe service('firewalld') do
+  it { should be_running }
+  it { should be_enabled }
+end
+
+describe command('firewall-cmd --reload') do
+  its(:exit_status) { should eq 0 }
+end