2 files changed, 62 insertions, 0 deletions
diff --git a/roles/bridge_firewall/tasks/main.yml b/roles/bridge_firewall/tasks/main.yml
new file mode 100644
index 0000000..d947258
--- /dev/null
+++ b/roles/bridge_firewall/tasks/main.yml
@@ -0,0 +1,35 @@
+---
+- name: Set member interface descriptions
+  vyos.vyos.vyos_interfaces:
+    config: "{{ _bridge_firewall_member_descriptions }}"
+    state: "{{ _bridge_firewall_state }}"
+  register: _bridge_firewall_r_ifaces
+  when: _bridge_firewall_member_descriptions | length > 0
+
+- name: Create bridges, interface groups and the bridge firewall
+  # No vyos.vyos resource module covers bridges, interface groups or the
+  # bridge firewall yet, so these go through vyos_config.
+  vyos.vyos.vyos_config:
+    lines: "{{ _bridge_firewall_cli_lines }}"
+  register: _bridge_firewall_r_cli
+  when: not (vyos_blueprints_render_only | default(false) | bool)
+
+- name: Configure the IPv4 input and forward filters
+  vyos.vyos.vyos_firewall_rules:
+    config: "{{ _bridge_firewall_ipv4 }}"
+    state: "{{ _bridge_firewall_state }}"
+  vars:
+    _bridge_firewall_ipv4: "{{ lookup('ansible.builtin.template', 'ipv4_rules.yml.j2') | from_yaml }}"
+  register: _bridge_firewall_r_ipv4
+  when: >-
+    bridge_firewall_bridges | selectattr('ip_forward', 'defined') | list | length > 0
+    or bridge_firewall_bridges | selectattr('router_access', 'defined') | list | length > 0
+
+- name: Collect rendered commands  # noqa: var-naming[no-role-prefix] - shared across roles by design
+  ansible.builtin.set_fact:
+    vyos_blueprints_rendered: >-
+      {{ vyos_blueprints_rendered | default([])
+         + (_bridge_firewall_r_ifaces.rendered | default([]))
+         + _bridge_firewall_cli_lines
+         + (_bridge_firewall_r_ipv4.rendered | default([])) }}
+  when: vyos_blueprints_render_only | default(false) | bool
diff --git a/roles/bridge_firewall/tasks/verify.yml b/roles/bridge_firewall/tasks/verify.yml
new file mode 100644
index 0000000..295b8af
--- /dev/null
+++ b/roles/bridge_firewall/tasks/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: Read bridges and bridge firewall
+  vyos.vyos.vyos_command:
+    commands:
+      - show configuration commands
+      - show firewall bridge
+  register: _bridge_firewall_v
+
+- name: Every member interface is in its bridge
+  ansible.builtin.assert:
+    that: >-
+      _bridge_firewall_v.stdout[0] is search('set interfaces bridge ' ~ (item.0.name | regex_escape)
+      ~ ' member interface ' ~ (item.1.interface | regex_escape) ~ '\b')
+    fail_msg: "{{ item.1.interface }} is not a member of {{ item.0.name }}"
+    quiet: true
+  loop: "{{ bridge_firewall_bridges | subelements('members') }}"
+  loop_control:
+    label: "{{ item.0.name }} {{ item.1.interface }}"
+
+- name: Every bridge ruleset is active
+  ansible.builtin.assert:
+    that: _bridge_firewall_v.stdout[1] is search('name ' ~ item)
+    fail_msg: "bridge ruleset {{ item }} is not active"
+    quiet: true
+  loop: >-
+    {{ (bridge_firewall_bridges | selectattr('prerouting', 'defined') | map(attribute='name') | map('regex_replace', '$', '-pre') | list)
+       + (bridge_firewall_bridges | selectattr('forward', 'defined') | map(attribute='name') | map('regex_replace', '$', '-fwd') | list) }}