T9393: new rolesmain

2 files changed, 240 insertions, 0 deletions

diff --git a/tests/render/cases/bridge_firewall/docs_three_bridges/expected/r1.txt b/tests/render/cases/bridge_firewall/docs_three_bridges/expected/r1.txt
new file mode 100644
index 0000000..e9b871a
--- /dev/null
+++ b/tests/render/cases/bridge_firewall/docs_three_bridges/expected/r1.txt
@@ -0,0 +1,159 @@
+set firewall bridge forward filter default-action 'drop'
+set firewall bridge forward filter rule 10 action 'drop'
+set firewall bridge forward filter rule 10 state 'invalid'
+set firewall bridge forward filter rule 110 action 'jump'
+set firewall bridge forward filter rule 110 description 'br0 traffic'
+set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces'
+set firewall bridge forward filter rule 110 jump-target 'br0-fwd'
+set firewall bridge forward filter rule 120 action 'jump'
+set firewall bridge forward filter rule 120 description 'br1 traffic'
+set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces'
+set firewall bridge forward filter rule 120 jump-target 'br1-fwd'
+set firewall bridge forward filter rule 130 action 'jump'
+set firewall bridge forward filter rule 130 description 'br2 traffic'
+set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces'
+set firewall bridge forward filter rule 130 jump-target 'br2-fwd'
+set firewall bridge forward filter rule 5 action 'accept'
+set firewall bridge forward filter rule 5 state 'established'
+set firewall bridge forward filter rule 5 state 'related'
+set firewall bridge name br0-fwd default-action 'accept'
+set firewall bridge name br0-pre default-action 'drop'
+set firewall bridge name br0-pre rule 10 action 'accept'
+set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic'
+set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6'
+set firewall bridge name br1-fwd default-action 'drop'
+set firewall bridge name br1-fwd rule 10 action 'accept'
+set firewall bridge name br1-fwd rule 10 description 'Accept ARP'
+set firewall bridge name br1-fwd rule 10 ethernet-type 'arp'
+set firewall bridge name br1-fwd rule 20 action 'accept'
+set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host'
+set firewall bridge name br1-fwd rule 20 source address '10.1.1.102'
+set firewall bridge name br1-fwd rule 20 state 'new'
+set firewall bridge name br1-pre default-action 'accept'
+set firewall bridge name br1-pre rule 10 action 'drop'
+set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover'
+set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
+set firewall bridge name br1-pre rule 10 destination port '67'
+set firewall bridge name br1-pre rule 10 log
+set firewall bridge name br1-pre rule 10 protocol 'udp'
+set firewall bridge name br1-pre rule 10 source port '68'
+set firewall bridge name br1-pre rule 20 action 'drop'
+set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic'
+set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6'
+set firewall bridge name br2-fwd default-action 'drop'
+set firewall bridge name br2-fwd rule 10 action 'accept'
+set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover'
+set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
+set firewall bridge name br2-fwd rule 10 destination port '67'
+set firewall bridge name br2-fwd rule 10 protocol 'udp'
+set firewall bridge name br2-fwd rule 10 source port '68'
+set firewall bridge name br2-fwd rule 20 action 'accept'
+set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface'
+set firewall bridge name br2-fwd rule 20 destination port '68'
+set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6'
+set firewall bridge name br2-fwd rule 20 protocol 'udp'
+set firewall bridge name br2-fwd rule 20 source port '67'
+set firewall bridge name br2-fwd rule 22 action 'drop'
+set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers'
+set firewall bridge name br2-fwd rule 22 destination port '68'
+set firewall bridge name br2-fwd rule 22 log
+set firewall bridge name br2-fwd rule 22 protocol 'udp'
+set firewall bridge name br2-fwd rule 22 source port '67'
+set firewall bridge name br2-fwd rule 30 action 'accept'
+set firewall bridge name br2-fwd rule 30 description 'Accept ARP'
+set firewall bridge name br2-fwd rule 30 ethernet-type 'arp'
+set firewall bridge name br2-fwd rule 40 action 'accept'
+set firewall bridge name br2-fwd rule 40 description 'Accept ipv4'
+set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4'
+set firewall bridge name br2-pre default-action 'accept'
+set firewall bridge name br2-pre rule 10 action 'drop'
+set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic'
+set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6'
+set firewall bridge prerouting filter rule 10 action 'jump'
+set firewall bridge prerouting filter rule 10 description 'br0 traffic'
+set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces'
+set firewall bridge prerouting filter rule 10 jump-target 'br0-pre'
+set firewall bridge prerouting filter rule 20 action 'jump'
+set firewall bridge prerouting filter rule 20 description 'br1 traffic'
+set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces'
+set firewall bridge prerouting filter rule 20 jump-target 'br1-pre'
+set firewall bridge prerouting filter rule 30 action 'jump'
+set firewall bridge prerouting filter rule 30 description 'br2 traffic'
+set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces'
+set firewall bridge prerouting filter rule 30 jump-target 'br2-pre'
+set firewall group interface-group br0-ifaces interface 'br0'
+set firewall group interface-group br0-ifaces interface 'eth1'
+set firewall group interface-group br0-ifaces interface 'eth2'
+set firewall group interface-group br1-ifaces interface 'br1'
+set firewall group interface-group br1-ifaces interface 'eth3'
+set firewall group interface-group br1-ifaces interface 'eth4'
+set firewall group interface-group br2-ifaces interface 'br2'
+set firewall group interface-group br2-ifaces interface 'eth5'
+set firewall group interface-group br2-ifaces interface 'eth6'
+set firewall group interface-group br2-ifaces interface 'eth7'
+set firewall ipv4 forward filter default-action 'drop'
+set firewall ipv4 forward filter rule 10
+set firewall ipv4 forward filter rule 10 action 'drop'
+set firewall ipv4 forward filter rule 10 state invalid
+set firewall ipv4 forward filter rule 110
+set firewall ipv4 forward filter rule 110 action 'jump'
+set firewall ipv4 forward filter rule 110 description 'br1 traffic'
+set firewall ipv4 forward filter rule 110 inbound-interface group br1-ifaces
+set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd'
+set firewall ipv4 forward filter rule 120
+set firewall ipv4 forward filter rule 120 action 'jump'
+set firewall ipv4 forward filter rule 120 description 'br2 traffic'
+set firewall ipv4 forward filter rule 120 inbound-interface group br2-ifaces
+set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd'
+set firewall ipv4 forward filter rule 5
+set firewall ipv4 forward filter rule 5 action 'accept'
+set firewall ipv4 forward filter rule 5 state established
+set firewall ipv4 forward filter rule 5 state related
+set firewall ipv4 input filter rule 10
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 10 state established
+set firewall ipv4 input filter rule 10 state related
+set firewall ipv4 input filter rule 110
+set firewall ipv4 input filter rule 110 action 'accept'
+set firewall ipv4 input filter rule 110 description 'Accept access from br1'
+set firewall ipv4 input filter rule 110 inbound-interface group br1-ifaces
+set firewall ipv4 input filter rule 120
+set firewall ipv4 input filter rule 120 action 'drop'
+set firewall ipv4 input filter rule 120 description 'Deny access from br2'
+set firewall ipv4 input filter rule 120 inbound-interface group br2-ifaces
+set firewall ipv4 input filter rule 20
+set firewall ipv4 input filter rule 20 action 'drop'
+set firewall ipv4 input filter rule 20 state invalid
+set firewall ipv4 name ip-br1-fwd default-action 'drop'
+set firewall ipv4 name ip-br1-fwd rule 10
+set firewall ipv4 name ip-br1-fwd rule 10 action 'accept'
+set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access'
+set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name eth0
+set firewall ipv4 name ip-br2-fwd default-action 'drop'
+set firewall ipv4 name ip-br2-fwd rule 10
+set firewall ipv4 name ip-br2-fwd rule 10 action 'accept'
+set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access'
+set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name eth0
+set firewall ipv4 name ip-br2-fwd rule 20
+set firewall ipv4 name ip-br2-fwd rule 20 action 'accept'
+set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1'
+set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group br1-ifaces
+set interfaces bridge br0 description 'Isolated L2 bridge'
+set interfaces bridge br0 member interface eth1
+set interfaces bridge br0 member interface eth2
+set interfaces bridge br1 address '10.1.1.1/24'
+set interfaces bridge br1 description 'L3 bridge br1'
+set interfaces bridge br1 member interface eth3
+set interfaces bridge br1 member interface eth4
+set interfaces bridge br2 address '10.2.2.1/24'
+set interfaces bridge br2 description 'L3 bridge br2'
+set interfaces bridge br2 member interface eth5
+set interfaces bridge br2 member interface eth6
+set interfaces bridge br2 member interface eth7
+set interfaces ethernet eth1 description 'br0'
+set interfaces ethernet eth2 description 'br0'
+set interfaces ethernet eth3 description 'br1'
+set interfaces ethernet eth4 description 'br1'
+set interfaces ethernet eth5 description 'br2 - Host'
+set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server'
+set interfaces ethernet eth7 description 'br2'
diff --git a/tests/render/cases/bridge_firewall/docs_three_bridges/vars.yml b/tests/render/cases/bridge_firewall/docs_three_bridges/vars.yml
new file mode 100644
index 0000000..211891f
--- /dev/null
+++ b/tests/render/cases/bridge_firewall/docs_three_bridges/vars.yml
@@ -0,0 +1,81 @@
+---
+# docs.vyos.io/en/1.5/configexamples/fwall-and-bridge.html
+bridge_firewall_bridges:
+  - name: br0
+    description: Isolated L2 bridge
+    members:
+      - {interface: eth1, description: br0}
+      - {interface: eth2, description: br0}
+    prerouting:
+      default_action: drop
+      rules:
+        - {number: 10, description: Accept IPv6 traffic, ethernet_type: ipv6}
+    forward:
+      default_action: accept
+
+  - name: br1
+    description: L3 bridge br1
+    addresses: [10.1.1.1/24]
+    members:
+      - {interface: eth3, description: br1}
+      - {interface: eth4, description: br1}
+    prerouting:
+      default_action: accept
+      rules:
+        - number: 10
+          description: Drop DHCP discover
+          action: drop
+          protocol: udp
+          source: {port: "68"}
+          destination: {port: "67", mac_address: "ff:ff:ff:ff:ff:ff"}
+          log: true
+        - {number: 20, description: Drop IPv6 traffic, action: drop, ethernet_type: ipv6}
+    forward:
+      default_action: drop
+      rules:
+        - {number: 10, description: Accept ARP, ethernet_type: arp}
+        - {number: 20, description: Accept ipv4 from host, source: {address: 10.1.1.102}, state: [new]}
+    ip_forward:
+      rules:
+        - {number: 10, description: br1 - allow internet access, outbound_interface: eth0}
+    router_access: accept
+
+  - name: br2
+    description: L3 bridge br2
+    addresses: [10.2.2.1/24]
+    members:
+      - {interface: eth5, description: br2 - Host}
+      - {interface: eth6, description: br2 - Trusted DHCP Server}
+      - {interface: eth7, description: br2}
+    prerouting:
+      default_action: accept
+      rules:
+        - {number: 10, description: Drop IPv6 traffic, action: drop, ethernet_type: ipv6}
+    forward:
+      default_action: drop
+      rules:
+        - number: 10
+          description: Accept DHCP discover
+          protocol: udp
+          source: {port: "68"}
+          destination: {port: "67", mac_address: "ff:ff:ff:ff:ff:ff"}
+        - number: 20
+          description: Accept DHCP offers from trusted interface
+          protocol: udp
+          source: {port: "67"}
+          destination: {port: "68"}
+          inbound_interface: eth6
+        - number: 22
+          description: Drop all other DHCP offers
+          action: drop
+          protocol: udp
+          source: {port: "67"}
+          destination: {port: "68"}
+          log: true
+        - {number: 30, description: Accept ARP, ethernet_type: arp}
+        - {number: 40, description: Accept ipv4, ethernet_type: ipv4}
+    ip_forward:
+      rules:
+        - {number: 10, description: br2 - allow internet access, outbound_interface: eth0}
+        - {number: 20, description: br2 - allow access to br1, outbound_bridge: br1}
+    router_access: drop