T9393: new rolesmain

2 files changed, 58 insertions, 0 deletions

diff --git a/roles/zone_firewall/tasks/main.yml b/roles/zone_firewall/tasks/main.yml
new file mode 100644
index 0000000..469dc24
--- /dev/null
+++ b/roles/zone_firewall/tasks/main.yml
@@ -0,0 +1,34 @@
+---
+- name: Check zones and policies
+  ansible.builtin.assert:
+    that:
+      - zone_firewall_zones | selectattr('local', 'defined') | selectattr('local') | list | length <= 1
+      - (zone_firewall_policies | map(attribute='from') | list + zone_firewall_policies | map(attribute='to') | list)
+        | difference(_zone_firewall_names) | length == 0
+      - not (zone_firewall_base_rules | bool)
+        or (zone_firewall_policies | map(attribute='rules', default=[]) | flatten
+            | map(attribute='number') | select('in', [1, 2]) | list | length == 0)
+    fail_msg: >-
+      At most one local zone; every policy must reference defined zones;
+      rule numbers 1 and 2 are reserved for the base rules.
+    quiet: true
+
+- name: Create one ruleset per zone-pair-direction
+  vyos.vyos.vyos_firewall_rules:
+    config: "{{ lookup('ansible.builtin.template', 'firewall_rules.yml.j2') | from_yaml }}"
+    state: "{{ _zone_firewall_state }}"
+  register: _zone_firewall_r_rules
+
+- name: Define zones and bind the rulesets
+  vyos.vyos.vyos_firewall_global:
+    config: "{{ lookup('ansible.builtin.template', 'zones.yml.j2') | from_yaml }}"
+    state: "{{ _zone_firewall_state }}"
+  register: _zone_firewall_r_zones
+
+- name: Collect rendered commands  # noqa: var-naming[no-role-prefix] - shared across roles by design
+  ansible.builtin.set_fact:
+    vyos_blueprints_rendered: >-
+      {{ vyos_blueprints_rendered | default([])
+         + ([_zone_firewall_r_rules, _zone_firewall_r_zones]
+            | selectattr('rendered', 'defined') | map(attribute='rendered') | flatten) }}
+  when: vyos_blueprints_render_only | default(false) | bool
diff --git a/roles/zone_firewall/tasks/verify.yml b/roles/zone_firewall/tasks/verify.yml
new file mode 100644
index 0000000..110eeac
--- /dev/null
+++ b/roles/zone_firewall/tasks/verify.yml
@@ -0,0 +1,24 @@
+---
+- name: Read zone policy
+  vyos.vyos.vyos_command:
+    commands:
+      - show firewall zone-policy
+  register: _zone_firewall_v
+
+- name: Every zone is active
+  ansible.builtin.assert:
+    that: _zone_firewall_v.stdout[0] is search('(?m)^\s*' ~ (item.name | regex_escape) ~ '\s')
+    fail_msg: "zone {{ item.name }} is missing from 'show firewall zone-policy'"
+    quiet: true
+  loop: "{{ zone_firewall_zones }}"
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Member interfaces are bound
+  ansible.builtin.assert:
+    that: _zone_firewall_v.stdout[0] is search('\b' ~ (item.1 | regex_escape) ~ '\b')
+    fail_msg: "interface {{ item.1 }} of zone {{ item.0.name }} is not bound"
+    quiet: true
+  loop: "{{ zone_firewall_zones | subelements('interfaces', skip_missing=true) }}"
+  loop_control:
+    label: "{{ item.0.name }} {{ item.1 }}"