T9180: added return and continue to the firewall rules default action (#494)

* T9180: added return to the firewall rules default action

* T9180: added changelog fragment

* T9180: added missing docs

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* T9180: added unit and integration tests

* T9180: added YAML document marker

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: omnom62 <75066712+omnom62@users.noreply.github.com>
Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>

6 files changed, 142 insertions, 1 deletions

diff --git a/changelogs/fragments/t9180_fw_rules_return_action.yml b/changelogs/fragments/t9180_fw_rules_return_action.yml
new file mode 100644
index 00000000..aba64c34
--- /dev/null
+++ b/changelogs/fragments/t9180_fw_rules_return_action.yml
@@ -0,0 +1,2 @@
+minor_changes:
+  - vyos_firewall_rules - Added 'return' and 'continue' to default action.
diff --git a/docs/vyos.vyos.vyos_firewall_rules_module.rst b/docs/vyos.vyos.vyos_firewall_rules_module.rst
index 051a9791..1415b2be 100644
--- a/docs/vyos.vyos.vyos_firewall_rules_module.rst
+++ b/docs/vyos.vyos.vyos_firewall_rules_module.rst
@@ -104,6 +104,8 @@ Parameters
                                     <li>reject</li>
                                     <li>accept</li>
                                     <li>jump</li>
+                                    <li>return</li>
+                                    <li>continue</li>
                         </ul>
                 </td>
                 <td>
@@ -112,6 +114,8 @@ Parameters
                         <div>reject (Drop and notify source if no prior rules are hit)</div>
                         <div>accept (Accept if no prior rules are hit)</div>
                         <div>jump (Jump to another rule-set, 1.4+)</div>
+                        <div>return (Return from the current chain and continue at the next rule of the last chain, 1.4+)</div>
+                        <div>continue (Continue parsing next rule, 1.4+)</div>
                 </td>
             </tr>
             <tr>
diff --git a/plugins/module_utils/network/vyos/argspec/firewall_rules/firewall_rules.py b/plugins/module_utils/network/vyos/argspec/firewall_rules/firewall_rules.py
index d1cf4fe8..76faf1a4 100644
--- a/plugins/module_utils/network/vyos/argspec/firewall_rules/firewall_rules.py
+++ b/plugins/module_utils/network/vyos/argspec/firewall_rules/firewall_rules.py
@@ -56,6 +56,8 @@ class Firewall_rulesArgs(object):  # pylint: disable=R0903
                                 "reject",
                                 "accept",
                                 "jump",
+                                "return",
+                                "continue",
                             ],
                             "type": "str",
                         },
diff --git a/plugins/modules/vyos_firewall_rules.py b/plugins/modules/vyos_firewall_rules.py
index 7213abd5..9045a5c6 100644
--- a/plugins/modules/vyos_firewall_rules.py
+++ b/plugins/modules/vyos_firewall_rules.py
@@ -90,8 +90,10 @@ options:
             - reject (Drop and notify source if no prior rules are hit)
             - accept (Accept if no prior rules are hit)
             - jump (Jump to another rule-set, 1.4+)
+            - return (Return from the current chain and continue at the next rule of the last chain, 1.4+)
+            - continue (Continue parsing next rule, 1.4+)
             type: str
-            choices: ['drop', 'reject', 'accept', 'jump']
+            choices: ['drop', 'reject', 'accept', 'jump', 'return', 'continue']
           default_jump_target:
             description:
             - Default jump target if the default action is jump.
diff --git a/tests/integration/targets/vyos_firewall_rules/tests/cli/default_action.yaml b/tests/integration/targets/vyos_firewall_rules/tests/cli/default_action.yaml
new file mode 100644
index 00000000..51e16d2f
--- /dev/null
+++ b/tests/integration/targets/vyos_firewall_rules/tests/cli/default_action.yaml
@@ -0,0 +1,69 @@
+---
+- debug:
+    msg: START vyos_firewall_rules default_action integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _remove_config.yaml
+
+- block:
+    - name: Select the default_action values supported by VyOS {{ vyos_version }}
+      set_fact:
+        default_action_sets: >-
+          {{ all_sets if vyos_version is version('1.4.0', '>=', version_type='semver')
+             else all_sets | rejectattr('default_action', 'in', ['jump', 'return', 'continue']) | list }}
+      vars:
+        all_sets:
+          - name: DA-DROP
+            default_action: drop
+          - name: DA-REJECT
+            default_action: reject
+          - name: DA-ACCEPT
+            default_action: accept
+          - name: DA-JUMP
+            default_action: jump
+            default_jump_target: DA-ACCEPT
+          - name: DA-RETURN
+            default_action: return
+          - name: DA-CONTINUE
+            default_action: continue
+
+    - name: Configure one rule-set per default_action value
+      register: result
+      vyos.vyos.vyos_firewall_rules: &id001
+        config:
+          - afi: ipv4
+            rule_sets: "{{ default_action_sets }}"
+        state: merged
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: firewall_rules
+
+    - name: Assert that the device accepted and reports back every default_action
+      assert:
+        that:
+          - "{{ default_action_sets | symmetric_difference(gathered_sets) | length == 0 }}"
+      vars:
+        gathered_sets: >-
+          {{ ansible_facts['network_resources']['firewall_rules']
+             | selectattr('afi', 'eq', 'ipv4') | map(attribute='rule_sets') | first }}
+
+    - name: Assert that after dicts were correctly generated
+      assert:
+        that:
+          - "{{ default_action_sets | symmetric_difference(after_sets) | length == 0 }}"
+      vars:
+        after_sets: >-
+          {{ result['after'] | selectattr('afi', 'eq', 'ipv4') | map(attribute='rule_sets') | first }}
+
+    - name: Configure one rule-set per default_action value (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_firewall_rules: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+  always:
+    - include_tasks: _remove_config.yaml
+
+- debug:
+    msg: END vyos_firewall_rules default_action integration tests on connection={{ ansible_connection }}
diff --git a/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py b/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py
index 0c371b92..84243dae 100644
--- a/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py
+++ b/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py
@@ -1929,3 +1929,65 @@ class TestVyosFirewallRulesModule14(TestVyosModule):
         ]
         self.maxDiff = None
         self.execute_module(changed=True, commands=commands)
+
+    def test_vyos_firewall_default_action_merged_01(self):
+        """Test that every default-action value is accepted and rendered"""
+        set_module_args(
+            dict(
+                config=[
+                    dict(
+                        afi="ipv4",
+                        rule_sets=[
+                            dict(
+                                name="V4-DROP",
+                                description="Rule set configured with default_action drop",
+                                default_action="drop",
+                            ),
+                            dict(
+                                name="V4-JUMP",
+                                description="Rule set configured with default_action jump",
+                                default_action="jump",
+                                default_jump_target="V4-ACCEPT",
+                            ),
+                            dict(
+                                name="V4-REJECT",
+                                description="Rule set configured with default_action reject",
+                                default_action="reject",
+                            ),
+                            dict(
+                                name="V4-RETURN",
+                                description="Rule set configured with default_action return",
+                                default_action="return",
+                            ),
+                            dict(
+                                name="V4-ACCEPT",
+                                description="Rule set configured with default_action accept",
+                                default_action="accept",
+                            ),
+                            dict(
+                                name="V4-CONTINUE",
+                                description="Rule set configured with default_action continue",
+                                default_action="continue",
+                            ),
+                        ],
+                    ),
+                ],
+                state="merged",
+            ),
+        )
+        commands = [
+            "set firewall ipv4 name V4-DROP default-action 'drop'",
+            "set firewall ipv4 name V4-DROP description 'Rule set configured with default_action drop'",
+            "set firewall ipv4 name V4-JUMP default-action 'jump'",
+            "set firewall ipv4 name V4-JUMP default-jump-target 'V4-ACCEPT'",
+            "set firewall ipv4 name V4-JUMP description 'Rule set configured with default_action jump'",
+            "set firewall ipv4 name V4-REJECT default-action 'reject'",
+            "set firewall ipv4 name V4-REJECT description 'Rule set configured with default_action reject'",
+            "set firewall ipv4 name V4-RETURN default-action 'return'",
+            "set firewall ipv4 name V4-RETURN description 'Rule set configured with default_action return'",
+            "set firewall ipv4 name V4-ACCEPT default-action 'accept'",
+            "set firewall ipv4 name V4-ACCEPT description 'Rule set configured with default_action accept'",
+            "set firewall ipv4 name V4-CONTINUE default-action 'continue'",
+            "set firewall ipv4 name V4-CONTINUE description 'Rule set configured with default_action continue'",
+        ]
+        self.execute_module(changed=True, commands=commands)