T9393: new rolesmain

8 files changed, 199 insertions, 0 deletions

diff --git a/roles/firewall/defaults/main.yml b/roles/firewall/defaults/main.yml
new file mode 100644
index 0000000..d5bec3f
--- /dev/null
+++ b/roles/firewall/defaults/main.yml
@@ -0,0 +1,4 @@
+---
+firewall_groups: {}
+firewall_ipv4: {}
+firewall_ipv6: {}
diff --git a/roles/firewall/meta/argument_specs.yml b/roles/firewall/meta/argument_specs.yml
new file mode 100644
index 0000000..d25fe5d
--- /dev/null
+++ b/roles/firewall/meta/argument_specs.yml
@@ -0,0 +1,77 @@
+---
+argument_specs:
+  main:
+    short_description: Firewall groups and base-chain filters
+    description:
+      - Configures firewall network, address and port groups and the
+        C(input), C(forward) and C(output) filters for IPv4 and IPv6.
+      - Building block used by blueprints such as "Policy-Based Site-to-Site
+        VPN and Firewall Configuration"; for zone-based designs use
+        C(vyos.blueprints.zone_firewall).
+      - Rules use the rule format of vyos.vyos.vyos_firewall_rules (number,
+        action, description, protocol, state, source, destination,
+        inbound_interface, outbound_interface, log, ...), passed through unchanged.
+      - B(Lockout risk) - a C(drop) input filter must allow the address or
+        interface you manage the router from.
+    options:
+      firewall_groups:
+        type: dict
+        default: {}
+        description: Firewall groups.
+        options:
+          network:
+            type: list
+            elements: dict
+            default: []
+            description: IPv4 network groups.
+            options:
+              name: {type: str, required: true, description: Group name.}
+              description: {type: str, description: Group description.}
+              networks: {type: list, elements: str, required: true, description: Member networks.}
+          address:
+            type: list
+            elements: dict
+            default: []
+            description: IPv4 address groups.
+            options:
+              name: {type: str, required: true, description: Group name.}
+              description: {type: str, description: Group description.}
+              addresses: {type: list, elements: str, required: true, description: Member addresses or ranges.}
+          port:
+            type: list
+            elements: dict
+            default: []
+            description: Port groups.
+            options:
+              name: {type: str, required: true, description: Group name.}
+              description: {type: str, description: Group description.}
+              ports: {type: list, elements: str, required: true, description: Member ports or ranges.}
+      firewall_ipv4:
+        type: dict
+        default: {}
+        description: IPv4 filters keyed by base chain (C(input), C(forward), C(output)).
+        options: &filters
+          input: &filter
+            type: dict
+            description: Filter for this chain.
+            options:
+              default_action: {type: str, choices: [accept, drop, reject], description: Default action.}
+              default_log: {type: bool, default: false, description: Log packets hitting the default action.}
+              rules: {type: list, elements: dict, default: [], description: Rules in vyos_firewall_rules format.}
+          forward: *filter
+          output: *filter
+      firewall_ipv6:
+        type: dict
+        default: {}
+        description: IPv6 filters keyed by base chain.
+        options: *filters
+      vyos_blueprints_render_only:
+        type: bool
+        default: false
+        description: Collect commands into C(vyos_blueprints_rendered) instead of configuring.
+  verify:
+    short_description: Post-deployment checks for the firewall role
+    description: Run with C(tasks_from=verify). Checks every configured filter is active with its rules.
+    options:
+      firewall_ipv4: {type: dict, default: {}, description: Same value as for C(main).}
+      firewall_ipv6: {type: dict, default: {}, description: Same value as for C(main).}
diff --git a/roles/firewall/meta/main.yml b/roles/firewall/meta/main.yml
new file mode 100644
index 0000000..8c38572
--- /dev/null
+++ b/roles/firewall/meta/main.yml
@@ -0,0 +1,11 @@
+---
+galaxy_info:
+  author: VyOS maintainers and contributors
+  description: Stateful firewall - groups and IPv4/IPv6 input, forward and output filters
+  license: GPL-3.0-or-later
+  min_ansible_version: "2.16"
+  platforms:
+    - name: GenericLinux
+      versions: [all]
+  galaxy_tags: [vyos, networking, firewall]
+dependencies: []
diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml
new file mode 100644
index 0000000..fe99b15
--- /dev/null
+++ b/roles/firewall/tasks/main.yml
@@ -0,0 +1,22 @@
+---
+- name: Create firewall groups
+  vyos.vyos.vyos_firewall_global:
+    config: "{{ lookup('ansible.builtin.template', 'groups.yml.j2') | from_yaml }}"
+    state: "{{ _firewall_state }}"
+  register: _firewall_r_groups
+  when: firewall_groups | dict2items | map(attribute='value') | select | list | length > 0
+
+- name: Configure the input, forward and output filters
+  vyos.vyos.vyos_firewall_rules:
+    config: "{{ lookup('ansible.builtin.template', 'rules.yml.j2') | from_yaml }}"
+    state: "{{ _firewall_state }}"
+  register: _firewall_r_rules
+  when: (firewall_ipv4 | length > 0) or (firewall_ipv6 | length > 0)
+
+- name: Collect rendered commands  # noqa: var-naming[no-role-prefix] - shared across roles by design
+  ansible.builtin.set_fact:
+    vyos_blueprints_rendered: >-
+      {{ vyos_blueprints_rendered | default([])
+         + ([_firewall_r_groups, _firewall_r_rules]
+            | selectattr('rendered', 'defined') | map(attribute='rendered') | flatten) }}
+  when: vyos_blueprints_render_only | default(false) | bool
diff --git a/roles/firewall/tasks/verify.yml b/roles/firewall/tasks/verify.yml
new file mode 100644
index 0000000..c2e3281
--- /dev/null
+++ b/roles/firewall/tasks/verify.yml
@@ -0,0 +1,23 @@
+---
+- name: Read the firewall
+  vyos.vyos.vyos_command:
+    commands:
+      - show firewall
+  register: _firewall_v
+
+- name: Every configured filter is active with its rules
+  ansible.builtin.assert:
+    that: >-
+      _firewall_v.stdout[0] is search((item.afi | upper | replace('V', 'v')) ~ ' Firewall "' ~ item.chain ~ ' filter"')
+    fail_msg: "{{ item.afi }} {{ item.chain }} filter is not active"
+    quiet: true
+  loop: >-
+    {%- set out = [] -%}
+    {%- for afi, filters in [('ipv4', firewall_ipv4), ('ipv6', firewall_ipv6)] -%}
+    {%-   for chain in ['input', 'forward', 'output'] if filters[chain] is defined and filters[chain] -%}
+    {%-     set _ = out.append({'afi': afi, 'chain': chain}) -%}
+    {%-   endfor -%}
+    {%- endfor -%}
+    {{ out }}
+  loop_control:
+    label: "{{ item.afi }} {{ item.chain }}"
diff --git a/roles/firewall/templates/groups.yml.j2 b/roles/firewall/templates/groups.yml.j2
new file mode 100644
index 0000000..5641e2a
--- /dev/null
+++ b/roles/firewall/templates/groups.yml.j2
@@ -0,0 +1,42 @@
+group:
+{% if firewall_groups.network | default([]) %}
+  network_group:
+{%   for g in firewall_groups.network %}
+    - name: {{ g.name | to_json }}
+      afi: ipv4
+{%     if g.description is defined %}
+      description: {{ g.description | to_json }}
+{%     endif %}
+      members:
+{%     for n in g.networks %}
+        - address: {{ n | to_json }}
+{%     endfor %}
+{%   endfor %}
+{% endif %}
+{% if firewall_groups.address | default([]) %}
+  address_group:
+{%   for g in firewall_groups.address %}
+    - name: {{ g.name | to_json }}
+      afi: ipv4
+{%     if g.description is defined %}
+      description: {{ g.description | to_json }}
+{%     endif %}
+      members:
+{%     for a in g.addresses %}
+        - address: {{ a | to_json }}
+{%     endfor %}
+{%   endfor %}
+{% endif %}
+{% if firewall_groups.port | default([]) %}
+  port_group:
+{%   for g in firewall_groups.port %}
+    - name: {{ g.name | to_json }}
+{%     if g.description is defined %}
+      description: {{ g.description | to_json }}
+{%     endif %}
+      members:
+{%     for p in g.ports %}
+        - port: {{ p | string | to_json }}
+{%     endfor %}
+{%   endfor %}
+{% endif %}
diff --git a/roles/firewall/templates/rules.yml.j2 b/roles/firewall/templates/rules.yml.j2
new file mode 100644
index 0000000..f746c84
--- /dev/null
+++ b/roles/firewall/templates/rules.yml.j2
@@ -0,0 +1,17 @@
+{% for afi, filters in [('ipv4', firewall_ipv4), ('ipv6', firewall_ipv6)] if filters %}
+- afi: {{ afi }}
+  rule_sets:
+{%   for chain in _firewall_filters if filters[chain] is defined and filters[chain] %}
+{%     set f = filters[chain] %}
+    - filter: {{ chain }}
+{%     if f.default_action is defined %}
+      default_action: {{ f.default_action }}
+{%     endif %}
+{%     if f.default_log | default(false) | bool %}
+      enable_default_log: true
+{%     endif %}
+{%     if f.rules | default([]) %}
+      rules: {{ f.rules | to_json }}
+{%     endif %}
+{%   endfor %}
+{% endfor %}
diff --git a/roles/firewall/vars/main.yml b/roles/firewall/vars/main.yml
new file mode 100644
index 0000000..eebd515
--- /dev/null
+++ b/roles/firewall/vars/main.yml
@@ -0,0 +1,3 @@
+---
+_firewall_state: "{{ 'rendered' if (vyos_blueprints_render_only | default(false) | bool) else 'merged' }}"
+_firewall_filters: [input, forward, output]