T9393: new rolesmain

5 files changed, 167 insertions, 0 deletions

diff --git a/extensions/molecule/vrf_firewall/converge.yml b/extensions/molecule/vrf_firewall/converge.yml
new file mode 100644
index 0000000..bdf90f7
--- /dev/null
+++ b/extensions/molecule/vrf_firewall/converge.yml
@@ -0,0 +1,7 @@
+---
+- name: Converge
+  hosts: vyos
+  gather_facts: false
+  roles:
+    - vyos.blueprints.base
+    - vyos.blueprints.vrf_firewall
diff --git a/extensions/molecule/vrf_firewall/inventory.yml b/extensions/molecule/vrf_firewall/inventory.yml
new file mode 100644
index 0000000..4d3b6f7
--- /dev/null
+++ b/extensions/molecule/vrf_firewall/inventory.yml
@@ -0,0 +1,54 @@
+---
+all:
+  children:
+    vyos:
+      hosts:
+        r1:
+          ansible_host: clab-bp-vrf-r1
+      vars:
+        ansible_network_os: vyos.vyos.vyos
+        ansible_connection: ansible.netcommon.network_cli
+        ansible_user: admin
+        ansible_password: admin
+        base_interfaces:
+          - {name: eth1, addresses: [10.100.100.1/24]}
+          - {name: eth2}
+          - {name: eth2.150, addresses: [10.150.150.1/24]}
+          - {name: eth2.3500, addresses: [172.16.20.1/24]}
+          - {name: eth3, addresses: [203.0.113.1/24]}
+        vrf_firewall_vrfs:
+          - name: MGMT
+            table: 102
+            interfaces: [eth1]
+            routes:
+              - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+              - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+          - name: WAN
+            table: 101
+            interfaces: [eth3]
+            routes:
+              - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+              - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+          - name: LAN
+            table: 103
+            interfaces: [eth2.150]
+            routes:
+              - {dest: 0.0.0.0/0, interface: eth3, vrf: WAN}
+              - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT}
+              - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+          - name: PROD
+            table: 104
+            interfaces: [eth2.3500]
+            routes:
+              - {dest: 0.0.0.0/0, interface: eth3, vrf: WAN}
+              - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT}
+              - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+        vrf_firewall_forward_rules:
+          - {number: 10, description: MGMT - Allow to LAN and PROD, inbound_interface: MGMT, outbound_interface: eth2*}
+          - {number: 99, action: drop, description: MGMT - Drop all going to mgmt, outbound_interface: eth1}
+          - {number: 120, description: LAN - Allow to PROD, inbound_interface: LAN, outbound_interface: eth2.3500}
+          - {number: 130, description: LAN - Allow internet, inbound_interface: LAN, outbound_interface: eth3}
+        vrf_firewall_input_rules:
+          # containerlab management; keeps Ansible's SSH session working
+          - {number: 5, description: containerlab management, inbound_interface: eth0}
+          - {number: 10, description: MGMT - Allow input, inbound_interface: MGMT}
diff --git a/extensions/molecule/vrf_firewall/molecule.yml b/extensions/molecule/vrf_firewall/molecule.yml
new file mode 100644
index 0000000..612af0a
--- /dev/null
+++ b/extensions/molecule/vrf_firewall/molecule.yml
@@ -0,0 +1,27 @@
+---
+# VyOS runs as a container (containerlab kind vyosnetworks_vyos);
+# the lab is deployed in prepare and destroyed in cleanup.
+dependency:
+  name: galaxy
+  enabled: false
+driver:
+  name: default
+  options:
+    managed: false
+platforms:
+  - name: r1
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      host_key_checking: false
+    persistent_connection:
+      command_timeout: 60
+  inventory:
+    links:
+      hosts: inventory.yml
+  playbooks:
+    prepare: ../_shared/lab_up.yml
+    cleanup: ../_shared/lab_down.yml
+verifier:
+  name: ansible
diff --git a/extensions/molecule/vrf_firewall/topology.clab.yml b/extensions/molecule/vrf_firewall/topology.clab.yml
new file mode 100644
index 0000000..567cd56
--- /dev/null
+++ b/extensions/molecule/vrf_firewall/topology.clab.yml
@@ -0,0 +1,43 @@
+name: bp-vrf
+topology:
+  nodes:
+    r1:
+      kind: vyosnetworks_vyos
+      image: ${VYOS_IMAGE:=vyos:blueprints-ci}
+    mgmt:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 10.100.100.10/24 dev eth1", "ip route replace default via 10.100.100.1"]
+    # VLAN-aware bridge for the eth2 trunk (vif 150 = LAN, vif 3500 = PROD)
+    sw:
+      kind: linux
+      image: alpine:3
+      exec:
+        - ip link add br0 type bridge vlan_filtering 1
+        - ip link set eth1 master br0
+        - ip link set eth2 master br0
+        - ip link set eth3 master br0
+        - bridge vlan add dev eth1 vid 150
+        - bridge vlan add dev eth1 vid 3500
+        - bridge vlan add dev eth2 vid 150 pvid untagged
+        - bridge vlan add dev eth3 vid 3500 pvid untagged
+        - ip link set br0 up
+    lan:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 10.150.150.10/24 dev eth1", "ip route replace default via 10.150.150.1"]
+    prod:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 172.16.20.10/24 dev eth1", "ip route replace default via 172.16.20.1"]
+    # stands in for the page's PPPoE uplink
+    wan:
+      kind: linux
+      image: alpine:3
+      exec: ["ip addr add 203.0.113.100/24 dev eth1", "ip route replace default via 203.0.113.1"]
+  links:
+    - endpoints: ["r1:eth1", "mgmt:eth1"]
+    - endpoints: ["r1:eth2", "sw:eth1"]
+    - endpoints: ["sw:eth2", "lan:eth1"]
+    - endpoints: ["sw:eth3", "prod:eth1"]
+    - endpoints: ["r1:eth3", "wan:eth1"]
diff --git a/extensions/molecule/vrf_firewall/verify.yml b/extensions/molecule/vrf_firewall/verify.yml
new file mode 100644
index 0000000..82989cc
--- /dev/null
+++ b/extensions/molecule/vrf_firewall/verify.yml
@@ -0,0 +1,36 @@
+---
+- name: Verify role state
+  hosts: vyos
+  gather_facts: false
+  tasks:
+    - name: Run role checks
+      ansible.builtin.include_role:
+        name: vyos.blueprints.vrf_firewall
+        tasks_from: verify
+
+- name: Verify traffic between VRFs against the page's requirements
+  hosts: localhost
+  gather_facts: false
+  vars:
+    _flows:
+      - {from: mgmt, to: 10.150.150.10, allowed: true, why: "MGMT may connect to LAN"}
+      - {from: mgmt, to: 172.16.20.10, allowed: true, why: "MGMT may connect to PROD"}
+      - {from: mgmt, to: 203.0.113.100, allowed: false, why: "MGMT may not reach the internet"}
+      - {from: lan, to: 172.16.20.10, allowed: true, why: "LAN may connect to PROD"}
+      - {from: lan, to: 203.0.113.100, allowed: true, why: "LAN may reach the internet"}
+      - {from: lan, to: 10.100.100.10, allowed: false, why: "nothing may connect to MGMT"}
+      - {from: prod, to: 10.150.150.10, allowed: false, why: "PROD only accepts connections"}
+      # The page's text says WAN may connect to PROD, but its configuration has
+      # no rule for it, so the configuration (default drop) is what is tested.
+      - {from: wan, to: 172.16.20.10, allowed: false, why: "no WAN->PROD rule in the page's configuration"}
+  tasks:
+    - name: Ping across VRFs
+      ansible.builtin.command:
+        cmd: docker exec clab-bp-vrf-{{ item.from }} ping -c 2 -W 2 {{ item.to }}
+      become: "{{ lookup('ansible.builtin.env', 'CLAB_BECOME', default='true') | bool }}"
+      register: _ping
+      changed_when: false
+      failed_when: (_ping.rc == 0) != item.allowed
+      loop: "{{ _flows }}"
+      loop_control:
+        label: "{{ item.from }} -> {{ item.to }} ({{ item.why }})"