poc4 wit rust

tests/test_deploy_script.py

@@ -68,3 +68,43 @@ def test_routeros_deploy_forwards_ndr_and_persistence_controls():
         "METRICS_BASIC_AUTH_PASSWORD",
     ):
         assert f"key={key}" in script
+
+
+def test_routeros_deploy_uses_hybrid_tzsp_capture_without_site_bridge_assumption():
+    script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
+    env_example = (ROOT / "deploy-routeros.env.example").read_text()
+
+    assert 'action=sniff-tzsp' in script
+    assert 'chain=forward' in script
+    assert 'comment="MikroSuricata TZSP IPv4"' in script
+    assert '/ip/firewall/mangle/remove [find where comment="MikroSuricata TZSP IPv4"]' in script
+    assert 'filter-mac-protocol=${TZSP_L2_MAC_PROTOCOL}' in script
+    assert 'TZSP_L2_FILTER_INTERFACE="${TZSP_L2_INTERFACE:-all}"' in script
+    assert 'filter-interface="${TZSP_L2_FILTER_INTERFACE}"' in script
+    assert 'streaming-server=${CONTAINER_IP_ONLY}:${TZSP_PORT}' in script
+    assert 'streaming-port=${TZSP_PORT}' in script  # compatibility fallback only
+    assert 'VLAN_ID' not in env_example
+    assert 'TZSP_L2_INTERFACE=' in env_example
+    assert 'TZSP_L2_MAC_PROTOCOL=!ip' in env_example
+    assert 'bridge-trunk' not in script
+
+
+def test_hybrid_capture_migration_helper_supports_dry_run_and_same_owned_rule():
+    script = (ROOT / "scripts" / "configure-routeros-tzsp-hybrid.sh").read_text()
+    assert 'DRY_RUN' in script
+    assert 'action=sniff-tzsp' in script
+    assert 'comment="MikroSuricata TZSP IPv4"' in script
+    assert 'filter-mac-protocol=${TZSP_L2_MAC_PROTOCOL}' in script
+    assert 'TZSP_L2_FILTER_INTERFACE="${TZSP_L2_INTERFACE:-all}"' in script
+    assert 'streaming-server=${CONTAINER_IP_ONLY}:${TZSP_PORT}' in script
+
+
+def test_routeros_manual_capture_template_is_hybrid_and_not_vlan_specific():
+    hybrid = ROOT / "routeros" / "02-tzsp-hybrid.rsc"
+    assert hybrid.exists()
+    assert not (ROOT / "routeros" / "02-sniffer-vlan100.rsc").exists()
+    text = hybrid.read_text()
+    assert 'action=sniff-tzsp' in text
+    assert 'filter-mac-protocol=$l2MacProtocol' in text
+    assert ':local l2Interface "all"' in text
+    assert 'filter-vlan=100' not in text