From d82dc3263a31f051fb3fc498f98567c448cbe7ed Mon Sep 17 00:00:00 2001 From: omnom62 <75066712+omnom62@users.noreply.github.com> Date: Sat, 29 Nov 2025 02:56:51 +1000 Subject: T7933 bugfix - 'offload' action (#440) * Init T7933 bugfix * offload-target * Argspsec fixed * Documentation fixes * fw_rules config fpor offload_target * fact fixes * offload unit test merge * offload unit tests for v1.3- overriden, replaced * Offload unit test v13 complete * v14+ offload unit tests * v1.4.+ unit tests for offload --- .../vyos/fixtures/vyos_firewall_rules_config.cfg | 6 +- .../fixtures/vyos_firewall_rules_config_v14.cfg | 7 +- .../network/vyos/test_vyos_firewall_rules13.py | 214 +++++++++++++++------ .../network/vyos/test_vyos_firewall_rules14.py | 193 +++++++++++-------- 4 files changed, 285 insertions(+), 135 deletions(-) (limited to 'tests/unit/modules') diff --git a/tests/unit/modules/network/vyos/fixtures/vyos_firewall_rules_config.cfg b/tests/unit/modules/network/vyos/fixtures/vyos_firewall_rules_config.cfg index 3ad6ec97..9665f86b 100644 --- a/tests/unit/modules/network/vyos/fixtures/vyos_firewall_rules_config.cfg +++ b/tests/unit/modules/network/vyos/fixtures/vyos_firewall_rules_config.cfg @@ -1,3 +1,5 @@ +set firewall flowtable test interface 'eth1' +set firewall flowtable test offload 'software' set firewall name V4-INGRESS default-action 'accept' set firewall ipv6-name V6-INGRESS default-action 'accept' set firewall name V4-INGRESS description 'This is IPv4 V4-INGRESS rule set' @@ -18,4 +20,6 @@ set firewall name MULTIPLE-RULE default-action 'drop' set firewall name MULTIPLE-RULE rule 1 action 'accept' set firewall name MULTIPLE-RULE rule 1 protocol 'all' set firewall name MULTIPLE-RULE rule 2 action 'drop' -set firewall name MULTIPLE-RULE rule 2 protocol 'all' \ No newline at end of file +set firewall name MULTIPLE-RULE rule 2 protocol 'all' +set firewall name V4-OFFLOAD rule 1 action 'offload' +set firewall name V4-OFFLOAD rule 1 offload-target 'test' diff --git a/tests/unit/modules/network/vyos/fixtures/vyos_firewall_rules_config_v14.cfg b/tests/unit/modules/network/vyos/fixtures/vyos_firewall_rules_config_v14.cfg index 7f63dd78..6f69211a 100644 --- a/tests/unit/modules/network/vyos/fixtures/vyos_firewall_rules_config_v14.cfg +++ b/tests/unit/modules/network/vyos/fixtures/vyos_firewall_rules_config_v14.cfg @@ -1,3 +1,5 @@ +set firewall flowtable test interface 'eth1' +set firewall flowtable test offload 'software' set firewall ipv4 name V4-INGRESS default-action 'accept' set firewall ipv6 name V6-INGRESS default-action 'accept' set firewall ipv4 name V4-INGRESS description 'This is IPv4 V4-INGRESS rule set' @@ -36,4 +38,7 @@ set firewall ipv4 name MULTIPLE-RULE default-action 'drop' set firewall ipv4 name MULTIPLE-RULE rule 1 action 'accept' set firewall ipv4 name MULTIPLE-RULE rule 1 protocol 'all' set firewall ipv4 name MULTIPLE-RULE rule 2 action 'drop' -set firewall ipv4 name MULTIPLE-RULE rule 2 protocol 'all' \ No newline at end of file +set firewall ipv4 name MULTIPLE-RULE rule 2 protocol 'all' +set firewall ipv4 name V4-OFFLOAD rule 105 +set firewall ipv4 name V4-OFFLOAD rule 105 action 'offload' +set firewall ipv4 name V4-OFFLOAD rule 105 offload-target 'test' diff --git a/tests/unit/modules/network/vyos/test_vyos_firewall_rules13.py b/tests/unit/modules/network/vyos/test_vyos_firewall_rules13.py index 9a25198f..1af61752 100644 --- a/tests/unit/modules/network/vyos/test_vyos_firewall_rules13.py +++ b/tests/unit/modules/network/vyos/test_vyos_firewall_rules13.py @@ -167,6 +167,13 @@ class TestVyosFirewallRulesModule13(TestVyosModule): fragment="match-frag", disable=True, ), + dict( + number="105", + action="offload", + offload_target="test", + description="Rule 105 is configured by Ansible", + protocol="udp", + ), ], ), ], @@ -187,12 +194,17 @@ class TestVyosFirewallRulesModule13(TestVyosModule): "set firewall name INBOUND rule 101 action 'accept'", "set firewall name INBOUND rule 101 ipsec 'match-ipsec'", "set firewall name INBOUND rule 101 log 'disable'", + "set firewall name INBOUND rule 105", + "set firewall name INBOUND rule 105 action 'offload'", + "set firewall name INBOUND rule 105 offload-target 'test'", + "set firewall name INBOUND rule 105 description 'Rule 105 is configured by Ansible'", + "set firewall name INBOUND rule 105 protocol 'udp'", ] self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4_rule_sets_rule_merged_02(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -253,7 +265,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_03(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -302,7 +314,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_04(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -327,9 +339,8 @@ class TestVyosFirewallRulesModule13(TestVyosModule): tcp=dict( flags=[ dict(flag="all"), - ] + ], ), - ), ], ), @@ -399,7 +410,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v6_rule_sets_rule_merged_02(self): """Test if plugin correctly adds new rules with variant attributes - within existing ipv6 rule set + within existing ipv6 rule set """ set_module_args( dict( @@ -460,7 +471,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v6_rule_sets_rule_merged_03(self): """Test if plugin correctly adds new rules with variant attributes - within existing ipv6 rule set + within existing ipv6 rule set """ set_module_args( dict( @@ -509,7 +520,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v6_rule_sets_rule_merged_04(self): """Test if plugin correctly adds new rules with variant attributes - within existing ipv6 rule set + within existing ipv6 rule set """ set_module_args( dict( @@ -534,7 +545,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): tcp=dict( flags=[ dict(flag="all"), - ] + ], ), ), dict( @@ -545,8 +556,8 @@ class TestVyosFirewallRulesModule13(TestVyosModule): dict(flag="syn"), dict(flag="fin", invert=True), ], - ) - ) + ), + ), ], ), ], @@ -572,7 +583,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v6_rule_sets_rule_merged_icmp_01(self): """Test if plugin correctly adds new rules with variant attributes - within existing ipv6 rule set + within existing ipv6 rule set """ set_module_args( dict( @@ -605,7 +616,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_icmp_01(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -639,7 +650,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_icmp_02(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -671,8 +682,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4_rule_sets_del_01(self): - """Test if plugin correctly removes existing rule set - """ + """Test if plugin correctly removes existing rule set""" set_module_args( dict( config=[dict(afi="ipv4", rule_sets=[dict(name="V4-INGRESS")])], @@ -683,33 +693,32 @@ class TestVyosFirewallRulesModule13(TestVyosModule): self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_del_02(self): - """Test if plugin correctly removes existing rule sets, both ipv4 and ipv6 - """ + """Test if plugin correctly removes existing rule sets, both ipv4 and ipv6""" set_module_args( dict( config=[ dict(afi="ipv4", rule_sets=[dict(name="V4-INGRESS")]), dict(afi="ipv6", rule_sets=[dict(name="V6-INGRESS")]), + dict(afi="ipv4", rule_sets=[dict(name="V4-OFFLOAD")]), ], state="deleted", ), ) commands = [ + "delete firewall name V4-OFFLOAD", "delete firewall name V4-INGRESS", "delete firewall ipv6-name V6-INGRESS", ] self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_del_03(self): - """Test if plugin correctly removes existing AFIs, both ipv4 and ipv6 - """ + """Test if plugin correctly removes existing AFIs, both ipv4 and ipv6""" set_module_args(dict(config=[], state="deleted")) commands = ["delete firewall name", "delete firewall ipv6-name"] self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_del_04(self): - """Test if plugin has no effect on non-existent rule sets - """ + """Test if plugin has no effect on non-existent rule sets""" set_module_args( dict( config=[ @@ -723,7 +732,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v4v6_rule_sets_rule_rep_01(self): """Test if plugin correctly replaces a particular rule set(s) - without affecting the others + without affecting the others """ set_module_args( dict( @@ -803,7 +812,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v4v6_rule_sets_rule_rep_02(self): """Test if plugin correctly replaces a particular rule(s) and rule set attribute(s) - without affecting the others + without affecting the others """ set_module_args( dict( @@ -867,8 +876,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_rule_rep_idem_01(self): - """Test if plugin correctly has no effect if there is no change in the configuration - """ + """Test if plugin correctly has no effect if there is no change in the configuration""" set_module_args( dict( config=[ @@ -890,7 +898,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): fragment="match-frag", disable=True, log="enable", - ) + ), ], ), dict( @@ -925,8 +933,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): self.execute_module(changed=False, commands=[]) def test_vyos_firewall_v4v6_rule_sets_rule_rep_idem_02(self): - """Test if plugin correctly has no effect if there is no change in the configuration - """ + """Test if plugin correctly has no effect if there is no change in the configuration""" set_module_args( dict( config=[ @@ -947,7 +954,33 @@ class TestVyosFirewallRulesModule13(TestVyosModule): protocol="icmp", fragment="match-frag", disable=True, - log="enable" + log="enable", + ), + ], + ), + ], + ), + ], + state="replaced", + ), + ) + self.execute_module(changed=False, commands=[]) + + def test_vyos_firewall_v4v6_rule_sets_rule_rep_idem_03(self): + """Test if plugin correctly has no effect if there is no change in the configuration""" + set_module_args( + dict( + config=[ + dict( + afi="ipv4", + rule_sets=[ + dict( + name="V4-OFFLOAD", + rules=[ + dict( + number="1", + action="offload", + offload_target="test", ), ], ), @@ -960,8 +993,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): self.execute_module(changed=False, commands=[]) def test_vyos_firewall_v4v6_rule_sets_rule_mer_idem_01(self): - """Test if plugin correctly has no effect if there is no change in the configuration - """ + """Test if plugin correctly has no effect if there is no change in the configuration""" set_module_args( dict( config=[ @@ -982,7 +1014,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): protocol="icmp", fragment="match-frag", disable=True, - ) + ), ], ), dict( @@ -1016,9 +1048,74 @@ class TestVyosFirewallRulesModule13(TestVyosModule): ) self.execute_module(changed=False, commands=[]) + def test_vyos_firewall_v4v6_rule_sets_rule_mer_idem_02(self): + """Test if plugin correctly has no effect if there is no change in the configuration""" + set_module_args( + dict( + config=[ + dict( + afi="ipv4", + rule_sets=[ + dict( + name="V4-INGRESS", + description="This is IPv4 V4-INGRESS rule set", + default_action="accept", + enable_default_log=True, + rules=[ + dict( + number="101", + action="accept", + description="Rule 101 is configured by Ansible", + ipsec="match-ipsec", + protocol="icmp", + fragment="match-frag", + disable=True, + ), + ], + ), + dict( + name="EGRESS", + default_action="reject", + ), + dict( + name="V4-OFFLOAD", + rules=[ + dict( + number="1", + action="offload", + offload_target="test", + ), + ], + ), + ], + ), + dict( + afi="ipv6", + rule_sets=[ + dict( + name="V6-INGRESS", + default_action="accept", + ), + dict( + name="EGRESS", + default_action="reject", + rules=[ + dict( + icmp=dict(type_name="echo-request"), + number=20, + ), + ], + ), + ], + ), + ], + state="merged", + ), + ) + self.execute_module(changed=False, commands=[]) + def test_vyos_firewall_v4v6_rule_sets_rule_ovr_01(self): - """Test if plugin correctly resets the entire rule set if there is a change in the configuration - """ + """Test if plugin correctly resets the entire rule set if there is a change in the configuration""" set_module_args( dict( config=[ @@ -1095,6 +1192,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): "delete firewall name V4-INGRESS", "delete firewall name EGRESS", "delete firewall name MULTIPLE-RULE", + "delete firewall name V4-OFFLOAD", "set firewall name MULTIPLE-RULE default-action 'drop'", "set firewall name MULTIPLE-RULE rule 1", "set firewall name MULTIPLE-RULE rule 1 action 'accept'", @@ -1126,7 +1224,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_v4v6_rule_sets_rule_ovr_02(self): """Test if plugin correctly resets the entire rule set - while removing the absent ones if there is a change in the configuration + while removing the absent ones if there is a change in the configuration """ set_module_args( dict( @@ -1176,6 +1274,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): "delete firewall name V4-INGRESS", "delete firewall name EGRESS", "delete firewall name MULTIPLE-RULE", + "delete firewall name V4-OFFLOAD", "set firewall name V4-INGRESS rule 101", "set firewall name V4-INGRESS description 'This is IPv4 INGRESS rule set'", "set firewall name V4-INGRESS default-action 'accept'", @@ -1186,13 +1285,12 @@ class TestVyosFirewallRulesModule13(TestVyosModule): "set firewall ipv6-name EGRESS default-action 'reject'", "set firewall ipv6-name EGRESS rule 20", "set firewall ipv6-name EGRESS rule 20 protocol 'udp'", - "set firewall ipv6-name EGRESS rule 20 action 'accept'" + "set firewall ipv6-name EGRESS rule 20 action 'accept'", ] self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_rule_ovr_idem_01(self): - """Test if plugin correctly has no effect if there is no change in the configuration - """ + """Test if plugin correctly has no effect if there is no change in the configuration""" set_module_args( dict( config=[ @@ -1214,7 +1312,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): fragment="match-frag", disable=True, log="enable", - ) + ), ], ), dict( @@ -1237,6 +1335,16 @@ class TestVyosFirewallRulesModule13(TestVyosModule): ), ], ), + dict( + name="V4-OFFLOAD", + rules=[ + dict( + number="1", + action="offload", + offload_target="test", + ), + ], + ), ], ), dict( @@ -1265,8 +1373,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): self.execute_module(changed=False, commands=[]) def test_vyos_firewall_v6_rule_sets_rule_merged_01_version(self): - """Test if plugin correctly adds ipv6 rule set with rules - """ + """Test if plugin correctly adds ipv6 rule set with rules""" self.get_os_version.return_value = "1.3" set_module_args( dict( @@ -1321,13 +1428,12 @@ class TestVyosFirewallRulesModule13(TestVyosModule): "set firewall ipv6-name INBOUND rule 102 action 'reject'", "set firewall ipv6-name INBOUND rule 102 description 'Rule 102 is configured by Ansible'", "set firewall ipv6-name INBOUND rule 102 protocol 'ipv6-icmp'", - 'set firewall ipv6-name INBOUND rule 102 icmpv6 type 7', + "set firewall ipv6-name INBOUND rule 102 icmpv6 type 7", ] self.execute_module(changed=True, commands=commands) def test_vyos_firewall_jump_rules_merged_01(self): - """Test if plugin correctly adds rule set with a jump action - """ + """Test if plugin correctly adds rule set with a jump action""" set_module_args( dict( config=[ @@ -1348,7 +1454,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): protocol="icmp", icmp=dict(type_name="echo-request"), jump_target="PROTECT-RE", - packet_length_exclude=[dict(length=100), dict(length=200)] + packet_length_exclude=[dict(length=100), dict(length=200)], ), dict( number="102", @@ -1360,10 +1466,10 @@ class TestVyosFirewallRulesModule13(TestVyosModule): ], ), ], - ) + ), ], state="merged", - ) + ), ) commands = [ "set firewall ipv6-name INBOUND default-action 'accept'", @@ -1382,7 +1488,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): "set firewall ipv6-name INBOUND rule 102 action 'reject'", "set firewall ipv6-name INBOUND rule 102 description 'Rule 102 is configured by Ansible'", "set firewall ipv6-name INBOUND rule 102 protocol 'ipv6-icmp'", - 'set firewall ipv6-name INBOUND rule 102 icmpv6 type 7', + "set firewall ipv6-name INBOUND rule 102 icmpv6 type 7", ] self.execute_module(changed=True, commands=commands) @@ -1409,10 +1515,10 @@ class TestVyosFirewallRulesModule13(TestVyosModule): ], ), ], - ) + ), ], state="merged", - ) + ), ) commands = [ "set firewall ipv6-name INBOUND default-action 'accept'", @@ -1428,7 +1534,7 @@ class TestVyosFirewallRulesModule13(TestVyosModule): def test_vyos_firewall_log_replace_01(self): """Test that stanza is correctly replaced - without touching the other stanzas + without touching the other stanzas """ set_module_args( dict( @@ -1453,10 +1559,10 @@ class TestVyosFirewallRulesModule13(TestVyosModule): ], ), ], - ) + ), ], state="replaced", - ) + ), ) commands = [ "delete firewall name V4-INGRESS rule 101", diff --git a/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py b/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py index 64884282..0c371b92 100644 --- a/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py +++ b/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py @@ -35,35 +35,35 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def setUp(self): super(TestVyosFirewallRulesModule14, self).setUp() self.mock_get_config = patch( - "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.network.Config.get_config" + "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.network.Config.get_config", ) self.get_config = self.mock_get_config.start() self.mock_load_config = patch( - "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.network.Config.load_config" + "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.network.Config.load_config", ) self.load_config = self.mock_load_config.start() self.mock_get_resource_connection_config = patch( - "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.cfg.base.get_resource_connection" + "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.cfg.base.get_resource_connection", ) self.get_resource_connection_config = self.mock_get_resource_connection_config.start() self.mock_get_resource_connection_facts = patch( - "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.facts.facts.get_resource_connection" + "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.facts.facts.get_resource_connection", ) self.get_resource_connection_facts = self.mock_get_resource_connection_facts.start() self.mock_execute_show_command = patch( - "ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.facts.static_routes.static_routes.Static_routesFacts.get_device_data" + "ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.facts.static_routes.static_routes.Static_routesFacts.get_device_data", ) self.mock_execute_show_command = patch( - "ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.facts.firewall_rules.firewall_rules.Firewall_rulesFacts.get_device_data" + "ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.facts.firewall_rules.firewall_rules.Firewall_rulesFacts.get_device_data", ) self.execute_show_command = self.mock_execute_show_command.start() self.mock_get_os_version = patch( - "ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.config.firewall_rules.firewall_rules.get_os_version" + "ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.config.firewall_rules.firewall_rules.get_os_version", ) self.get_os_version = self.mock_get_os_version.start() self.get_os_version.return_value = "1.4" @@ -164,15 +164,15 @@ class TestVyosFirewallRulesModule14(TestVyosModule): description="Rule 101 is configured by Ansible", jump_target="PROTECT-RE", packet_length_exclude=[dict(length=100), dict(length=200)], - packet_length=[dict(length=22)] + packet_length=[dict(length=22)], ), ], ), ], - ) + ), ], state="merged", - ) + ), ) commands = [ "set firewall ipv6 name INBOUND default-action 'accept'", @@ -191,7 +191,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_packet_length_replace_01(self): """Test that stanza is correctly replaced - without touching the other stanzas + without touching the other stanzas """ set_module_args( dict( @@ -210,15 +210,15 @@ class TestVyosFirewallRulesModule14(TestVyosModule): action="accept", description="Rule 101 is configured by Ansible", packet_length_exclude=[dict(length=100), dict(length=200)], - packet_length=[dict(length=22)] + packet_length=[dict(length=22)], ), ], ), ], - ) + ), ], state="replaced", - ) + ), ) commands = [ "delete firewall ipv4 name V4-INGRESS rule 101", @@ -252,15 +252,15 @@ class TestVyosFirewallRulesModule14(TestVyosModule): description="Rule 101 is configured by Ansible", jump_target="PROTECT-RE", packet_length_exclude=[dict(length=100), dict(length=200)], - packet_length=[dict(length=22)] + packet_length=[dict(length=22)], ), ], ), ], - ) + ), ], state="merged", - ) + ), ) commands = [ "set firewall ipv6 input filter default-action 'accept'", @@ -298,13 +298,20 @@ class TestVyosFirewallRulesModule14(TestVyosModule): inbound_interface=dict(name="eth0"), outbound_interface=dict(group="eth1"), ), + dict( + number="105", + action="offload", + offload_target="test", + description="Rule 105 is configured by Ansible", + protocol="udp", + ), ], ), ], - ) + ), ], state="merged", - ) + ), ) commands = [ "set firewall ipv6 name V6-INGRESS description 'This is IPv6 INBOUND rule set with a jump action'", @@ -314,13 +321,18 @@ class TestVyosFirewallRulesModule14(TestVyosModule): "set firewall ipv6 name V6-INGRESS rule 101", "set firewall ipv6 name V6-INGRESS rule 101 action 'jump'", "set firewall ipv6 name V6-INGRESS rule 101 jump-target 'PROTECT-RE'", + "set firewall ipv6 name V6-INGRESS rule 105", + "set firewall ipv6 name V6-INGRESS rule 105 action 'offload'", + "set firewall ipv6 name V6-INGRESS rule 105 offload-target 'test'", + "set firewall ipv6 name V6-INGRESS rule 105 description 'Rule 105 is configured by Ansible'", + "set firewall ipv6 name V6-INGRESS rule 105 protocol 'udp'", ] self.maxDiff = None self.execute_module(changed=True, commands=commands) def test_vyos_firewall_interface_replace_02(self): """Test that new stanza is correctly replaced - without touching the other stanzas + without touching the other stanzas """ set_module_args( dict( @@ -341,17 +353,17 @@ class TestVyosFirewallRulesModule14(TestVyosModule): ], ), ], - ) + ), ], state="replaced", - ) + ), ) commands = [ "delete firewall ipv4 name IF-TEST rule 10", "set firewall ipv4 name IF-TEST rule 10", "set firewall ipv4 name IF-TEST description 'Changed'", "set firewall ipv4 name IF-TEST rule 10 description 'Rule 10 is configured by Ansible'", - 'set firewall ipv4 name IF-TEST rule 10 inbound-interface name eth1', + "set firewall ipv4 name IF-TEST rule 10 inbound-interface name eth1", "set firewall ipv4 name IF-TEST rule 10 action 'accept'", ] self.maxDiff = None @@ -405,7 +417,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_02(self): """Test that a rule set is correctly applied - including variant attributes such as state + including variant attributes such as state """ set_module_args( dict( @@ -466,7 +478,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_03(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -515,7 +527,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_04(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -540,9 +552,8 @@ class TestVyosFirewallRulesModule14(TestVyosModule): tcp=dict( flags=[ dict(flag="all"), - ] + ], ), - ), ], ), @@ -612,7 +623,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v6_rule_sets_rule_merged_02(self): """Test if plugin correctly adds new rules with variant attributes - within existing ipv6 rule set + within existing ipv6 rule set """ set_module_args( dict( @@ -673,7 +684,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v6_rule_sets_rule_merged_03(self): """Test if plugin correctly adds new rules with variant attributes - within existing ipv6 rule set + within existing ipv6 rule set """ set_module_args( dict( @@ -722,7 +733,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v6_rule_sets_rule_merged_04(self): """Test that the plugin correctly applies configuration - within exsiting rule set + within exsiting rule set """ set_module_args( dict( @@ -747,7 +758,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): tcp=dict( flags=[ dict(flag="all"), - ] + ], ), ), dict( @@ -758,8 +769,8 @@ class TestVyosFirewallRulesModule14(TestVyosModule): dict(flag="syn"), dict(flag="fin", invert=True), ], - ) - ) + ), + ), ], ), ], @@ -787,7 +798,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4_rule_sets_change_state_01(self): """Test that a rule set is replaced applied without touching the other stanzas - in particular variant attributes such as state + in particular variant attributes such as state """ set_module_args( dict( @@ -826,7 +837,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v6_rule_sets_rule_merged_icmp_01(self): """Test if plugin correctly adds new rules with variant attributes - within existing ipv6 rule set + within existing ipv6 rule set """ set_module_args( dict( @@ -859,7 +870,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_icmp_01(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -893,7 +904,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4_rule_sets_rule_merged_icmp_02(self): """Test if plugin correctly adds new rules with variant attributes - within existing rule set + within existing rule set """ set_module_args( dict( @@ -925,8 +936,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4_rule_sets_del_01(self): - """Test if plugin correctly removes existing rule set - """ + """Test if plugin correctly removes existing rule set""" set_module_args( dict( config=[dict(afi="ipv4", rule_sets=[dict(name="V4-INGRESS")])], @@ -937,8 +947,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_del_02(self): - """Test if plugin correctly removes existing rule sets, both ipv4 and ipv6 - """ + """Test if plugin correctly removes existing rule sets, both ipv4 and ipv6""" set_module_args( dict( config=[ @@ -956,15 +965,14 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4v6_rule_sets_del_03(self): """Test that the plugin correctly deprovisions - variant configuration + variant configuration """ set_module_args(dict(config=[], state="deleted")) commands = ["delete firewall ipv4", "delete firewall ipv6"] self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_del_04(self): - """Test if plugin has no effect on non-existent rule sets - """ + """Test if plugin has no effect on non-existent rule sets""" set_module_args( dict( config=[ @@ -976,9 +984,20 @@ class TestVyosFirewallRulesModule14(TestVyosModule): ) self.execute_module(changed=False, commands=[]) + def test_vyos_firewall_v4_rule_sets_del_05(self): + """Test if plugin correctly removes existing rule set""" + set_module_args( + dict( + config=[dict(afi="ipv4", rule_sets=[dict(name="V4-OFFLOAD")])], + state="deleted", + ), + ) + commands = ["delete firewall ipv4 name V4-OFFLOAD"] + self.execute_module(changed=True, commands=commands) + def test_vyos_firewall_v4v6_rule_sets_rule_rep_01(self): """Test if plugin correctly replaces a particular rule set(s) - without affecting the others + without affecting the others """ set_module_args( dict( @@ -1058,7 +1077,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4v6_rule_sets_rule_rep_02(self): """Test if plugin correctly replaces a particular rule(s) and rule set attribute(s) - without affecting the others + without affecting the others """ set_module_args( dict( @@ -1122,8 +1141,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_rule_rep_idem_01(self): - """Test if plugin correctly has no effect if there is no change in the configuration - """ + """Test if plugin correctly has no effect if there is no change in the configuration""" set_module_args( dict( config=[ @@ -1144,7 +1162,17 @@ class TestVyosFirewallRulesModule14(TestVyosModule): protocol="icmp", disable=True, log="enable", - ) + ), + ], + ), + dict( + name="V4-OFFLOAD", + rules=[ + dict( + number="105", + action="offload", + offload_target="test", + ), ], ), dict( @@ -1178,7 +1206,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): inbound_interface=dict(name="eth0"), outbound_interface=dict(group="the-ethers"), disable=True, - ) + ), ], ), dict( @@ -1233,8 +1261,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): self.execute_module(changed=False, commands=[]) def test_vyos_firewall_v4v6_rule_sets_rule_rep_idem_02(self): - """Test if plugin correctly has no effect if there is no change in the configuration - """ + """Test if plugin correctly has no effect if there is no change in the configuration""" set_module_args( dict( config=[ @@ -1255,7 +1282,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): protocol="icmp", disable=True, log="enable", - ) + ), ], ), ], @@ -1267,8 +1294,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): self.execute_module(changed=False, commands=[]) def test_vyos_firewall_v4v6_rule_sets_rule_mer_idem_01(self): - """Test if plugin correctly has no effect if there is no change in the configuration - """ + """Test if plugin correctly has no effect if there is no change in the configuration""" set_module_args( dict( config=[ @@ -1289,7 +1315,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): protocol="icmp", disable=True, log="enable", - ) + ), ], ), dict( @@ -1323,7 +1349,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): inbound_interface=dict(name="eth0"), outbound_interface=dict(group="the-ethers"), disable=True, - ) + ), ], ), dict( @@ -1378,8 +1404,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): self.execute_module(changed=False, commands=[]) def test_vyos_firewall_v4v6_rule_sets_rule_ovr_01(self): - """Test if plugin correctly resets the entire rule set if there is a change in the configuration - """ + """Test if plugin correctly resets the entire rule set if there is a change in the configuration""" set_module_args( dict( config=[ @@ -1461,6 +1486,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): "delete firewall ipv6 input filter", "delete firewall ipv6 output filter", "delete firewall ipv4 name IF-TEST", + "delete firewall ipv4 name V4-OFFLOAD", "set firewall ipv4 name MULTIPLE-RULE default-action 'drop'", "set firewall ipv4 name MULTIPLE-RULE rule 1", "set firewall ipv4 name MULTIPLE-RULE rule 1 action 'accept'", @@ -1492,7 +1518,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_v4v6_rule_sets_rule_ovr_02(self): """Test that the plugin correctly resets the entire - rule sets configuration if changes are detected + rule sets configuration if changes are detected """ set_module_args( dict( @@ -1547,6 +1573,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): "delete firewall ipv6 output filter", "delete firewall ipv4 name IF-TEST", "delete firewall ipv4 name MULTIPLE-RULE", + "delete firewall ipv4 name V4-OFFLOAD", "set firewall ipv4 name V4-INGRESS rule 101", "set firewall ipv4 name V4-INGRESS default-log", "set firewall ipv4 name V4-INGRESS description 'This is IPv4 INGRESS rule set'", @@ -1557,13 +1584,13 @@ class TestVyosFirewallRulesModule14(TestVyosModule): "set firewall ipv6 name EGRESS default-action 'reject'", "set firewall ipv6 name EGRESS rule 20", "set firewall ipv6 name EGRESS rule 20 protocol 'udp'", - "set firewall ipv6 name EGRESS rule 20 action 'accept'" + "set firewall ipv6 name EGRESS rule 20 action 'accept'", ] self.execute_module(changed=True, commands=commands) def test_vyos_firewall_v4v6_rule_sets_rule_ovr_idem_01(self): """Test that the plugin is idempotent in overridden state - if there are no changes to the rule sets + if there are no changes to the rule sets """ set_module_args( dict( @@ -1585,7 +1612,17 @@ class TestVyosFirewallRulesModule14(TestVyosModule): protocol="icmp", disable=True, log="enable", - ) + ), + ], + ), + dict( + name="V4-OFFLOAD", + rules=[ + dict( + number="105", + action="offload", + offload_target="test", + ), ], ), dict( @@ -1619,7 +1656,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): inbound_interface=dict(name="eth0"), outbound_interface=dict(group="the-ethers"), disable=True, - ) + ), ], ), dict( @@ -1690,8 +1727,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): self.execute_module(changed=False, commands=[]) def test_vyos_firewall_v6_rule_sets_rule_merged_01_version(self): - """Test if plugin correctly adds ipv6 rule set with rules - """ + """Test if plugin correctly adds ipv6 rule set with rules""" set_module_args( dict( config=[ @@ -1745,13 +1781,12 @@ class TestVyosFirewallRulesModule14(TestVyosModule): "set firewall ipv6 name INBOUND rule 102 action 'reject'", "set firewall ipv6 name INBOUND rule 102 description 'Rule 102 is configured by Ansible'", "set firewall ipv6 name INBOUND rule 102 protocol 'ipv6-icmp'", - 'set firewall ipv6 name INBOUND rule 102 icmpv6 type 7', + "set firewall ipv6 name INBOUND rule 102 icmpv6 type 7", ] self.execute_module(changed=True, commands=commands) def test_vyos_firewall_jump_rules_merged_01(self): - """Test if plugin correctly adds rule set with a jump action - """ + """Test if plugin correctly adds rule set with a jump action""" set_module_args( dict( config=[ @@ -1772,7 +1807,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): protocol="icmp", icmp=dict(type_name="echo-request"), jump_target="PROTECT-RE", - packet_length_exclude=[dict(length=100), dict(length=200)] + packet_length_exclude=[dict(length=100), dict(length=200)], ), dict( number="102", @@ -1784,10 +1819,10 @@ class TestVyosFirewallRulesModule14(TestVyosModule): ], ), ], - ) + ), ], state="merged", - ) + ), ) commands = [ "set firewall ipv6 name INBOUND default-action 'accept'", @@ -1806,7 +1841,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): "set firewall ipv6 name INBOUND rule 102 action 'reject'", "set firewall ipv6 name INBOUND rule 102 description 'Rule 102 is configured by Ansible'", "set firewall ipv6 name INBOUND rule 102 protocol 'ipv6-icmp'", - 'set firewall ipv6 name INBOUND rule 102 icmpv6 type 7', + "set firewall ipv6 name INBOUND rule 102 icmpv6 type 7", ] self.execute_module(changed=True, commands=commands) @@ -1833,10 +1868,10 @@ class TestVyosFirewallRulesModule14(TestVyosModule): ], ), ], - ) + ), ], state="merged", - ) + ), ) commands = [ "set firewall ipv6 name INBOUND default-action 'accept'", @@ -1852,7 +1887,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): def test_vyos_firewall_log_replace_01(self): """Test that stanza is correctly replaced - without touching the other stanzas + without touching the other stanzas """ set_module_args( dict( @@ -1877,10 +1912,10 @@ class TestVyosFirewallRulesModule14(TestVyosModule): ], ), ], - ) + ), ], state="replaced", - ) + ), ) commands = [ "delete firewall ipv4 name V4-INGRESS rule 101", -- cgit v1.2.3