T9393: new rolesmain

8 files changed, 309 insertions, 0 deletions

diff --git a/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt b/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt
new file mode 100644
index 0000000..2dbd927
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt
@@ -0,0 +1,42 @@
+set interfaces tunnel tun1 encapsulation 'gre'
+set interfaces tunnel tun1 ip adjust-mss '1336'
+set interfaces tunnel tun1 mtu '1376'
+set interfaces tunnel tun1 remote '10.1.1.6'
+set interfaces tunnel tun1 source-address '198.51.100.1'
+set vpn ipsec authentication psk vyos_cisco_l
+set vpn ipsec authentication psk vyos_cisco_l ******** '********'
+set vpn ipsec authentication psk vyos_cisco_l id cisco.hub.net
+set vpn ipsec authentication psk vyos_cisco_l id vyos.net
+set vpn ipsec esp-group e1
+set vpn ipsec esp-group e1 lifetime 3600
+set vpn ipsec esp-group e1 mode tunnel
+set vpn ipsec esp-group e1 pfs disable
+set vpn ipsec esp-group e1 proposal 1
+set vpn ipsec esp-group e1 proposal 1 encryption aes128
+set vpn ipsec esp-group e1 proposal 1 hash sha256
+set vpn ipsec ike-group i1
+set vpn ipsec ike-group i1 key-exchange ikev2
+set vpn ipsec ike-group i1 lifetime 28800
+set vpn ipsec ike-group i1 proposal 1
+set vpn ipsec ike-group i1 proposal 1 dh-group 5
+set vpn ipsec ike-group i1 proposal 1 encryption aes256
+set vpn ipsec ike-group i1 proposal 1 hash sha256
+set vpn ipsec interface eth2
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec options flexvpn
+set vpn ipsec options interface tun1
+set vpn ipsec options virtual-ip
+set vpn ipsec site-to-site peer cisco_hub
+set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net'
+set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net'
+set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
+set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
+set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
+set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1'
+set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
+set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'
diff --git a/tests/render/cases/blueprints/flexvpn_cisco/roles b/tests/render/cases/blueprints/flexvpn_cisco/roles
new file mode 100644
index 0000000..2a14e05
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/roles
@@ -0,0 +1 @@
+gre_tunnel,ipsec_policy_based
diff --git a/tests/render/cases/blueprints/flexvpn_cisco/vars.yml b/tests/render/cases/blueprints/flexvpn_cisco/vars.yml
new file mode 100644
index 0000000..ed7c51b
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/vars.yml
@@ -0,0 +1,46 @@
+---
+# docs.vyos.io/en/1.5/configexamples/site-2-site-cisco.html - VyOS side
+# The page's PSK is the word "secret". Ansible masks every occurrence of a
+# no_log value, so the golden file shows the PSK line as "******** ********".
+gre_tunnel_interfaces:
+  - name: tun1
+    encapsulation: gre
+    adjust_mss: "1336"
+    mtu: 1376
+    remote: 10.1.1.6
+    source_address: 198.51.100.1
+
+ipsec_policy_based_peers:
+  - name: cisco_hub
+    psk_name: vyos_cisco_l
+    psk: secret
+    local_address: 198.51.100.1
+    remote_address: 10.1.1.6
+    local_id: vyos.net
+    remote_id: cisco.hub.net
+    connection_type: initiate
+    virtual_address: 0.0.0.0
+    tunnels:
+      - {id: 1, local_prefix: 198.51.100.1/32, remote_prefix: 10.1.1.6/32, protocol: gre}
+ipsec_policy_based_ike_group:
+  name: i1
+  key_exchange: ikev2
+  lifetime: 28800
+  proposal_id: 1
+  dh_group: 5
+  encryption: aes256
+  hash: sha256
+ipsec_policy_based_esp_group:
+  name: e1
+  lifetime: 3600
+  mode: tunnel
+  pfs: disable
+  proposal_id: 1
+  encryption: aes128
+  hash: sha256
+ipsec_policy_based_interfaces: [eth2]
+ipsec_policy_based_options:
+  disable_route_autoinstall: true
+  flexvpn: true
+  interface: tun1
+  virtual_ip: true
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/expected/LEFT.txt b/tests/render/cases/blueprints/policy_ipsec_firewall/expected/LEFT.txt
new file mode 100644
index 0000000..0f05a70
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/expected/LEFT.txt
@@ -0,0 +1,100 @@
+set firewall group network-group LOCAL-NETS
+set firewall group network-group LOCAL-NETS network 10.1.11.0/24
+set firewall group network-group LOCAL-NETS network 10.1.12.0/24
+set firewall group network-group REMOTE-NETS
+set firewall group network-group REMOTE-NETS network 10.2.21.0/24
+set firewall group network-group REMOTE-NETS network 10.2.22.0/24
+set firewall group network-group TRUSTED
+set firewall group network-group TRUSTED network 10.1.11.0/24
+set firewall group network-group TRUSTED network 192.168.70.0/24
+set firewall group network-group TRUSTED network 198.51.100.125/32
+set firewall group network-group TRUSTED network 203.0.113.0/24
+set firewall ipv4 forward filter default-action 'drop'
+set firewall ipv4 forward filter rule 1
+set firewall ipv4 forward filter rule 1 action 'accept'
+set firewall ipv4 forward filter rule 1 state established
+set firewall ipv4 forward filter rule 1 state related
+set firewall ipv4 forward filter rule 10
+set firewall ipv4 forward filter rule 10 action 'accept'
+set firewall ipv4 forward filter rule 10 source group network-group LOCAL-NETS
+set firewall ipv4 forward filter rule 2
+set firewall ipv4 forward filter rule 2 action 'drop'
+set firewall ipv4 forward filter rule 2 state invalid
+set firewall ipv4 forward filter rule 20
+set firewall ipv4 forward filter rule 20 action 'accept'
+set firewall ipv4 forward filter rule 20 destination group network-group LOCAL-NETS
+set firewall ipv4 forward filter rule 20 source group network-group REMOTE-NETS
+set firewall ipv4 input filter default-action 'drop'
+set firewall ipv4 input filter rule 1
+set firewall ipv4 input filter rule 1 action 'accept'
+set firewall ipv4 input filter rule 1 state established
+set firewall ipv4 input filter rule 1 state related
+set firewall ipv4 input filter rule 10
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 10 destination port 500,4500
+set firewall ipv4 input filter rule 10 inbound-interface name eth0
+set firewall ipv4 input filter rule 10 protocol 'udp'
+set firewall ipv4 input filter rule 15
+set firewall ipv4 input filter rule 15 action 'accept'
+set firewall ipv4 input filter rule 15 inbound-interface name eth0
+set firewall ipv4 input filter rule 15 protocol 'esp'
+set firewall ipv4 input filter rule 2
+set firewall ipv4 input filter rule 2 action 'drop'
+set firewall ipv4 input filter rule 2 state invalid
+set firewall ipv4 input filter rule 20
+set firewall ipv4 input filter rule 20 action 'accept'
+set firewall ipv4 input filter rule 20 destination port 22
+set firewall ipv4 input filter rule 20 protocol 'tcp'
+set firewall ipv4 input filter rule 20 source group network-group TRUSTED
+set firewall ipv4 input filter rule 25
+set firewall ipv4 input filter rule 25 action 'accept'
+set firewall ipv4 input filter rule 25 destination port 53
+set firewall ipv4 input filter rule 25 protocol 'udp'
+set firewall ipv4 input filter rule 25 source group network-group LOCAL-NETS
+set firewall ipv4 input filter rule 30
+set firewall ipv4 input filter rule 30 action 'accept'
+set firewall ipv4 input filter rule 30 protocol 'icmp'
+set nat source rule 10 destination group network-group REMOTE-NETS
+set nat source rule 10 exclude
+set nat source rule 10 outbound-interface name eth0
+set nat source rule 10 source group network-group LOCAL-NETS
+set nat source rule 20 outbound-interface name eth0
+set nat source rule 20 source group network-group LOCAL-NETS
+set nat source rule 20 translation address masquerade
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '198.51.100.13'
+set vpn ipsec authentication psk RIGHT
+set vpn ipsec authentication psk RIGHT id 192.0.2.130
+set vpn ipsec authentication psk RIGHT id 198.51.100.14
+set vpn ipsec authentication psk RIGHT secret '********'
+set vpn ipsec esp-group ESP-GROUP
+set vpn ipsec esp-group ESP-GROUP mode tunnel
+set vpn ipsec esp-group ESP-GROUP proposal 1
+set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes256
+set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha256
+set vpn ipsec ike-group IKE-GROUP
+set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
+set vpn ipsec ike-group IKE-GROUP proposal 1
+set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group 14
+set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes256
+set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha256
+set vpn ipsec interface eth0
+set vpn ipsec site-to-site peer RIGHT
+set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer RIGHT connection-type 'initiate'
+set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14'
+set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130'
+set vpn ipsec site-to-site peer RIGHT tunnel 0
+set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 1
+set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 2
+set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 3
+set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24'
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/expected/RIGHT.txt b/tests/render/cases/blueprints/policy_ipsec_firewall/expected/RIGHT.txt
new file mode 100644
index 0000000..547e447
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/expected/RIGHT.txt
@@ -0,0 +1,35 @@
+set vpn ipsec authentication psk LEFT
+set vpn ipsec authentication psk LEFT id 192.0.2.130
+set vpn ipsec authentication psk LEFT id 198.51.100.14
+set vpn ipsec authentication psk LEFT secret '********'
+set vpn ipsec esp-group ESP-GROUP
+set vpn ipsec esp-group ESP-GROUP mode tunnel
+set vpn ipsec esp-group ESP-GROUP proposal 1
+set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes256
+set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha256
+set vpn ipsec ike-group IKE-GROUP
+set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
+set vpn ipsec ike-group IKE-GROUP proposal 1
+set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group 14
+set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes256
+set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha256
+set vpn ipsec interface eth0
+set vpn ipsec site-to-site peer LEFT
+set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer LEFT connection-type 'none'
+set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130'
+set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14'
+set vpn ipsec site-to-site peer LEFT tunnel 0
+set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 1
+set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 2
+set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 3
+set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24'
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/inventory.yml b/tests/render/cases/blueprints/policy_ipsec_firewall/inventory.yml
new file mode 100644
index 0000000..42adead
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/inventory.yml
@@ -0,0 +1,67 @@
+---
+all:
+  hosts:
+    LEFT:
+      ansible_host: 192.0.2.1
+      ipsec_policy_based_peers:
+        - name: RIGHT
+          psk_name: RIGHT
+          psk: p4ssw0rd
+          authentication_ids: false
+          local_address: 198.51.100.14
+          remote_address: 192.0.2.130
+          connection_type: initiate
+          tunnels:
+            - {id: 0, local_prefix: 10.1.11.0/24, remote_prefix: 10.2.21.0/24}
+            - {id: 1, local_prefix: 10.1.11.0/24, remote_prefix: 10.2.22.0/24}
+            - {id: 2, local_prefix: 10.1.12.0/24, remote_prefix: 10.2.21.0/24}
+            - {id: 3, local_prefix: 10.1.12.0/24, remote_prefix: 10.2.22.0/24}
+      ipsec_policy_based_default_gateway: 198.51.100.13
+      # Firewall and NAT exist only on LEFT, as on the page
+      firewall_groups:
+        network:
+          - {name: LOCAL-NETS, networks: [10.1.11.0/24, 10.1.12.0/24]}
+          - {name: REMOTE-NETS, networks: [10.2.21.0/24, 10.2.22.0/24]}
+          - {name: TRUSTED, networks: [198.51.100.125/32, 203.0.113.0/24, 10.1.11.0/24, 192.168.70.0/24]}
+      firewall_ipv4:
+        forward:
+          default_action: drop
+          rules:
+            - {number: 1, action: accept, state: {established: true, related: true}}
+            - {number: 2, action: drop, state: {invalid: true}}
+            - {number: 10, action: accept, source: {group: {network_group: LOCAL-NETS}}}
+            - {number: 20, action: accept, source: {group: {network_group: REMOTE-NETS}}, destination: {group: {network_group: LOCAL-NETS}}}
+        input:
+          default_action: drop
+          rules:
+            - {number: 1, action: accept, state: {established: true, related: true}}
+            - {number: 2, action: drop, state: {invalid: true}}
+            - {number: 10, action: accept, protocol: udp, destination: {port: "500,4500"}, inbound_interface: {name: eth0}}
+            - {number: 15, action: accept, protocol: esp, inbound_interface: {name: eth0}}
+            - {number: 20, action: accept, protocol: tcp, destination: {port: "22"}, source: {group: {network_group: TRUSTED}}}
+            - {number: 25, action: accept, protocol: udp, destination: {port: "53"}, source: {group: {network_group: LOCAL-NETS}}}
+            - {number: 30, action: accept, protocol: icmp}
+      nat_source_rules:
+        - {id: 10, exclude: true, outbound_interface: {name: eth0}, source: {network_group: LOCAL-NETS}, destination: {network_group: REMOTE-NETS}}
+        - {id: 20, outbound_interface: {name: eth0}, source: {network_group: LOCAL-NETS}, translation: {address: masquerade}}
+    RIGHT:
+      ansible_host: 192.0.2.2
+      ipsec_policy_based_peers:
+        - name: LEFT
+          psk_name: LEFT
+          psk: p4ssw0rd
+          authentication_ids: false
+          local_address: 192.0.2.130
+          remote_address: 198.51.100.14
+          connection_type: none
+          tunnels:
+            - {id: 0, local_prefix: 10.2.21.0/24, remote_prefix: 10.1.11.0/24}
+            - {id: 1, local_prefix: 10.2.22.0/24, remote_prefix: 10.1.11.0/24}
+            - {id: 2, local_prefix: 10.2.21.0/24, remote_prefix: 10.1.12.0/24}
+            - {id: 3, local_prefix: 10.2.22.0/24, remote_prefix: 10.1.12.0/24}
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/roles b/tests/render/cases/blueprints/policy_ipsec_firewall/roles
new file mode 100644
index 0000000..21fdad9
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/roles
@@ -0,0 +1 @@
+ipsec_policy_based,firewall,nat
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/vars.yml b/tests/render/cases/blueprints/policy_ipsec_firewall/vars.yml
new file mode 100644
index 0000000..9296601
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/vars.yml
@@ -0,0 +1,17 @@
+---
+# docs.vyos.io/en/1.5/configexamples/policy-based-ipsec-and-firewall.html
+# Shared IPsec settings, as on the page (both routers)
+ipsec_policy_based_ike_group:
+  name: IKE-GROUP
+  key_exchange: ikev2
+  proposal_id: 1
+  dh_group: 14
+  encryption: aes256
+  hash: sha256
+ipsec_policy_based_esp_group:
+  name: ESP-GROUP
+  mode: tunnel
+  proposal_id: 1
+  encryption: aes256
+  hash: sha256
+ipsec_policy_based_interfaces: [eth0]