Skip to content

Commit e8aa02b

Browse files
WodansSonjackofallops
authored and
hqhqhqhqhqhqhqhqhqhqhq
committed
[Dependencies:] azurerm_cdn_frontdoor_rule, azurerm_cdn_frontdoor_ruleset and cdn_frontdoor_rule_actions - upgrade resources to 2024-02-01 API to enable support for the JS Challenge field (hashicorp#28308)
* Check-in progress... * Fixing delivery rule conditions adding a polymorphisim discriminator package... * Progress... * Think I have the new polymorphisim figured out here... * go mod vendor * Fix lint errors... * Fix RuleSet Client... * Add JSChallenge functionality for the override action type... * go mod vendor to remove legacy API dependency... * Fix lint error... from if else to switch case... * Update internal/services/cdn/cdn_frontdoor_firewall_policy_resource.go Co-authored-by: jackofallops <11830746+jackofallops@users.noreply.github.com> * Update internal/services/cdn/cdn_frontdoor_firewall_policy_resource_test.go Co-authored-by: jackofallops <11830746+jackofallops@users.noreply.github.com> * Address PR comments... * Fix test case due to new returned error value... * Set Behavior and Order in Read... * Fix lint error add example of override for jschallenge... * Add legal note for JSChallenge value for action field... --------- Co-authored-by: jackofallops <11830746+jackofallops@users.noreply.github.com>
1 parent 3dc054a commit e8aa02b

File tree

154 files changed

+10021
-10941
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

154 files changed

+10021
-10941
lines changed

‎internal/services/cdn/cdn_frontdoor_firewall_policy_resource.go‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ package cdn
66
import (
77
"fmt"
88
"strconv"
9+
"strings"
910
"time"
1011

1112
"github.com/hashicorp/go-azure-helpers/lang/pointer"
@@ -428,16 +429,13 @@ func resourceCdnFrontDoorFirewallPolicy() *pluginsdk.Resource {
428429
},
429430
},
430431

432+
// NOTE: 'ActionTypeAnomalyScoring' is only valid with 2.0 and above
433+
// 'ActionTypeJSChallenge' is only valid with BotManagerRuleSets
431434
"action": {
432435
Type: pluginsdk.TypeString,
433436
Required: true,
434-
ValidateFunc: validation.StringInSlice([]string{
435-
string(waf.ActionTypeAllow),
436-
string(waf.ActionTypeLog),
437-
string(waf.ActionTypeBlock),
438-
string(waf.ActionTypeRedirect),
439-
string(waf.ActionTypeAnomalyScoring), // Only valid with 2.0 and above
440-
}, false),
437+
ValidateFunc: validation.StringInSlice(waf.PossibleValuesForActionType(),
438+
false),
441439
},
442440
},
443441
},
@@ -840,7 +838,7 @@ func expandCdnFrontDoorFirewallManagedRules(input []interface{}) (*waf.ManagedRu
840838
return nil, fmt.Errorf("the managed rule set type %q and version %q is not supported. If you wish to use the 'Microsoft_DefaultRuleSet' type please update your 'version' field to be '1.1', '2.0' or '2.1', got %q", ruleType, version, version)
841839
}
842840

843-
ruleGroupOverrides, err := expandCdnFrontDoorFirewallManagedRuleGroupOverride(overrides, version, fVersion)
841+
ruleGroupOverrides, err := expandCdnFrontDoorFirewallManagedRuleGroupOverride(overrides, version, fVersion, ruleType)
844842
if err != nil {
845843
return nil, err
846844
}
@@ -887,7 +885,7 @@ func expandCdnFrontDoorFirewallManagedRuleGroupExclusion(input []interface{}) *[
887885
return &results
888886
}
889887

890-
func expandCdnFrontDoorFirewallManagedRuleGroupOverride(input []interface{}, versionRaw string, version float64) (*[]waf.ManagedRuleGroupOverride, error) {
888+
func expandCdnFrontDoorFirewallManagedRuleGroupOverride(input []interface{}, versionRaw string, version float64, ruleType string) (*[]waf.ManagedRuleGroupOverride, error) {
891889
result := make([]waf.ManagedRuleGroupOverride, 0)
892890
if len(input) == 0 {
893891
return nil, nil
@@ -898,7 +896,7 @@ func expandCdnFrontDoorFirewallManagedRuleGroupOverride(input []interface{}, ver
898896

899897
exclusions := expandCdnFrontDoorFirewallManagedRuleGroupExclusion(override["exclusion"].([]interface{}))
900898
ruleGroupName := override["rule_group_name"].(string)
901-
rules, err := expandCdnFrontDoorFirewallRuleOverride(override["rule"].([]interface{}), versionRaw, version)
899+
rules, err := expandCdnFrontDoorFirewallRuleOverride(override["rule"].([]interface{}), versionRaw, version, ruleType)
902900
if err != nil {
903901
return nil, err
904902
}
@@ -913,7 +911,7 @@ func expandCdnFrontDoorFirewallManagedRuleGroupOverride(input []interface{}, ver
913911
return &result, nil
914912
}
915913

916-
func expandCdnFrontDoorFirewallRuleOverride(input []interface{}, versionRaw string, version float64) (*[]waf.ManagedRuleOverride, error) {
914+
func expandCdnFrontDoorFirewallRuleOverride(input []interface{}, versionRaw string, version float64, ruleType string) (*[]waf.ManagedRuleOverride, error) {
917915
result := make([]waf.ManagedRuleOverride, 0)
918916
if len(input) == 0 {
919917
return nil, nil
@@ -932,10 +930,15 @@ func expandCdnFrontDoorFirewallRuleOverride(input []interface{}, versionRaw stri
932930

933931
// NOTE: Default Rule Sets(DRS) 2.0 and above rules only use action type of 'AnomalyScoring' or 'Log'. Issues 19088 and 19561
934932
// This will still work for bot rules as well since it will be the default value of 1.0
935-
if version < 2.0 && action == waf.ActionTypeAnomalyScoring {
936-
return nil, fmt.Errorf("'AnomalyScoring' is only valid in managed rules that are DRS 2.0 and above, got %q", versionRaw)
937-
} else if version >= 2.0 && action != waf.ActionTypeAnomalyScoring && action != waf.ActionTypeLog {
933+
switch {
934+
case version < 2.0 && action == waf.ActionTypeAnomalyScoring:
935+
return nil, fmt.Errorf("%q is only valid in managed rules where 'type' is DRS and `version` is '2.0' or above, got %q", waf.ActionTypeAnomalyScoring, versionRaw)
936+
937+
case version >= 2.0 && action != waf.ActionTypeAnomalyScoring && action != waf.ActionTypeLog:
938938
return nil, fmt.Errorf("the managed rules 'action' field must be set to 'AnomalyScoring' or 'Log' if the managed rule is DRS 2.0 or above, got %q", action)
939+
940+
case !strings.Contains(strings.ToLower(ruleType), "botmanagerruleset") && action == waf.ActionTypeJSChallenge:
941+
return nil, fmt.Errorf("%q is only valid if the managed rules 'type' is 'Microsoft_BotManagerRuleSet', got %q", waf.ActionTypeJSChallenge, ruleType)
939942
}
940943

941944
exclusions := expandCdnFrontDoorFirewallManagedRuleGroupExclusion(rule["exclusion"].([]interface{}))

‎internal/services/cdn/cdn_frontdoor_firewall_policy_resource_test.go‎

Lines changed: 149 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,12 @@ import (
99
"regexp"
1010
"testing"
1111

12-
"github.com/hashicorp/go-azure-helpers/lang/response"
12+
"github.com/hashicorp/go-azure-helpers/lang/pointer"
1313
waf "github.com/hashicorp/go-azure-sdk/resource-manager/frontdoor/2024-02-01/webapplicationfirewallpolicies"
1414
"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance"
1515
"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance/check"
1616
"github.com/hashicorp/terraform-provider-azurerm/internal/clients"
1717
"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
18-
"github.com/hashicorp/terraform-provider-azurerm/utils"
1918
)
2019

2120
type CdnFrontDoorFirewallPolicyResource struct{}
@@ -197,7 +196,7 @@ func TestAccCdnFrontDoorFirewallPolicy_DRSOnePointOhError(t *testing.T) {
197196
data.ResourceTest(t, r, []acceptance.TestStep{
198197
{
199198
Config: r.DRSOnePointOhError(data),
200-
ExpectError: regexp.MustCompile("'AnomalyScoring' is only valid in managed rules that are DRS 2.0 and above"),
199+
ExpectError: regexp.MustCompile(`"AnomalyScoring" is only valid in managed rules where 'type' is DRS`),
201200
},
202201
})
203202
}
@@ -309,21 +308,71 @@ func TestAccCdnFrontDoorFirewallPolicy_DRSTwoPointOneActionError(t *testing.T) {
309308
})
310309
}
311310

311+
func TestAccCdnFrontDoorFirewallPolicy_JSChallengeDRSError(t *testing.T) {
312+
data := acceptance.BuildTestData(t, "azurerm_cdn_frontdoor_firewall_policy", "test")
313+
r := CdnFrontDoorFirewallPolicyResource{}
314+
data.ResourceTest(t, r, []acceptance.TestStep{
315+
{
316+
Config: r.JSChallengeDRSError(data),
317+
ExpectError: regexp.MustCompile(`"JSChallenge" is only valid if the managed rules 'type' is 'Microsoft_BotManagerRuleSet', got "DefaultRuleSet"`),
318+
},
319+
})
320+
}
321+
322+
func TestAccCdnFrontDoorFirewallPolicy_JSChallengeBasic(t *testing.T) {
323+
data := acceptance.BuildTestData(t, "azurerm_cdn_frontdoor_firewall_policy", "test")
324+
r := CdnFrontDoorFirewallPolicyResource{}
325+
data.ResourceTest(t, r, []acceptance.TestStep{
326+
{
327+
Config: r.JSChallengeBasic(data),
328+
Check: acceptance.ComposeTestCheckFunc(
329+
check.That(data.ResourceName).ExistsInAzure(r),
330+
),
331+
},
332+
data.ImportStep(),
333+
})
334+
}
335+
336+
func TestAccCdnFrontDoorFirewallPolicy_JSChallengeUpdate(t *testing.T) {
337+
data := acceptance.BuildTestData(t, "azurerm_cdn_frontdoor_firewall_policy", "test")
338+
r := CdnFrontDoorFirewallPolicyResource{}
339+
data.ResourceTest(t, r, []acceptance.TestStep{
340+
{
341+
Config: r.JSChallengeBasic(data),
342+
Check: acceptance.ComposeTestCheckFunc(
343+
check.That(data.ResourceName).ExistsInAzure(r),
344+
),
345+
},
346+
data.ImportStep(),
347+
{
348+
Config: r.JSChallengeRemove(data),
349+
Check: acceptance.ComposeTestCheckFunc(
350+
check.That(data.ResourceName).ExistsInAzure(r),
351+
),
352+
},
353+
data.ImportStep(),
354+
{
355+
Config: r.JSChallengeBasic(data),
356+
Check: acceptance.ComposeTestCheckFunc(
357+
check.That(data.ResourceName).ExistsInAzure(r),
358+
),
359+
},
360+
data.ImportStep(),
361+
})
362+
}
363+
312364
func (CdnFrontDoorFirewallPolicyResource) Exists(ctx context.Context, clients *clients.Client, state *pluginsdk.InstanceState) (*bool, error) {
313365
id, err := waf.ParseFrontDoorWebApplicationFirewallPolicyID(state.ID)
314366
if err != nil {
315367
return nil, err
316368
}
317369

318-
result, err := clients.Cdn.FrontDoorFirewallPoliciesClient.PoliciesGet(ctx, *id)
370+
_, err = clients.Cdn.FrontDoorFirewallPoliciesClient.PoliciesGet(ctx, *id)
319371
if err != nil {
320-
if response.WasNotFound(result.HttpResponse) {
321-
return utils.Bool(false), nil
322-
}
323372
return nil, fmt.Errorf("retrieving %s: %+v", id, err)
324373
}
325374

326-
return utils.Bool(true), nil
375+
return pointer.To(true), nil
327376
}
328377

329378
func (CdnFrontDoorFirewallPolicyResource) template(data acceptance.TestData) string {
@@ -883,3 +932,95 @@ resource "azurerm_cdn_frontdoor_firewall_policy" "test" {
883932
}
884933
`, tmp, data.RandomInteger)
885934
}
935+
936+
func (r CdnFrontDoorFirewallPolicyResource) JSChallengeDRSError(data acceptance.TestData) string {
937+
tmp := r.template(data)
938+
return fmt.Sprintf(`
939+
%s
940+
941+
resource "azurerm_cdn_frontdoor_firewall_policy" "test" {
942+
name = "accTestWAF%d"
943+
resource_group_name = azurerm_resource_group.test.name
944+
sku_name = azurerm_cdn_frontdoor_profile.test.sku_name
945+
enabled = true
946+
mode = "Prevention"
947+
redirect_url = "https://www.contoso.com"
948+
custom_block_response_status_code = 403
949+
custom_block_response_body = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="
950+
951+
managed_rule {
952+
type = "DefaultRuleSet"
953+
version = "preview-0.1"
954+
action = "Block"
955+
956+
override {
957+
rule_group_name = "PHP"
958+
959+
rule {
960+
rule_id = "933100"
961+
enabled = false
962+
action = "JSChallenge"
963+
}
964+
}
965+
}
966+
}
967+
`, tmp, data.RandomInteger)
968+
}
969+
970+
func (r CdnFrontDoorFirewallPolicyResource) JSChallengeBasic(data acceptance.TestData) string {
971+
tmp := r.template(data)
972+
return fmt.Sprintf(`
973+
%s
974+
975+
resource "azurerm_cdn_frontdoor_firewall_policy" "test" {
976+
name = "accTestWAF%d"
977+
resource_group_name = azurerm_resource_group.test.name
978+
sku_name = azurerm_cdn_frontdoor_profile.test.sku_name
979+
enabled = true
980+
mode = "Prevention"
981+
redirect_url = "https://www.contoso.com"
982+
custom_block_response_status_code = 403
983+
custom_block_response_body = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="
984+
985+
managed_rule {
986+
type = "Microsoft_BotManagerRuleSet"
987+
version = "1.0"
988+
action = "Log"
989+
990+
override {
991+
rule_group_name = "BadBots"
992+
993+
rule {
994+
rule_id = "Bot100200"
995+
enabled = true
996+
action = "JSChallenge"
997+
}
998+
}
999+
}
1000+
}
1001+
`, tmp, data.RandomInteger)
1002+
}
1003+
1004+
func (r CdnFrontDoorFirewallPolicyResource) JSChallengeRemove(data acceptance.TestData) string {
1005+
tmp := r.template(data)
1006+
return fmt.Sprintf(`
1007+
%s
1008+
1009+
resource "azurerm_cdn_frontdoor_firewall_policy" "test" {
1010+
name = "accTestWAF%d"
1011+
resource_group_name = azurerm_resource_group.test.name
1012+
sku_name = azurerm_cdn_frontdoor_profile.test.sku_name
1013+
enabled = true
1014+
mode = "Prevention"
1015+
redirect_url = "https://www.contoso.com"
1016+
custom_block_response_status_code = 403
1017+
custom_block_response_body = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="
1018+
1019+
managed_rule {
1020+
type = "Microsoft_BotManagerRuleSet"
1021+
version = "1.0"
1022+
action = "Log"
1023+
}
1024+
}
1025+
`, tmp, data.RandomInteger)
1026+
}

0 commit comments

Comments
 (0)