diff --git a/tests/integration/verify.yml b/tests/integration/verify.yml index 129b908..1f460f5 100644 --- a/tests/integration/verify.yml +++ b/tests/integration/verify.yml @@ -71,8 +71,10 @@ when: integration_profile == 'ubongo' ansible.builtin.assert: that: - - "'hook input priority 0; policy drop;' in _nft.stdout" - - "'hook forward priority 0; policy accept;' in _nft.stdout" + # live `nft list ruleset` prints the SYMBOLIC priority (`filter` = 0), unlike the + # rendered /etc/nftables.conf (`priority 0`) that the Molecule scenario asserts against. + - "'hook input priority filter; policy drop;' in _nft.stdout" + - "'hook forward priority filter; policy accept;' in _nft.stdout" # the ssh-from-control lifeline (base__firewall_control_addr) — the reconnect path - "'ip saddr 192.168.150.1 tcp dport 22 accept' in _nft.stdout" - "'ip saddr 192.168.150.98 tcp dport 22 accept' in _nft.stdout"