Skip to content

Commit 12d3d35

Browse files
ps031046ps031046
committed
@ANS-TF-IDPS: Support IDPS DFW Parent Policy and Standalone Rules
+ TF Resource for IDPS DFW Parent Policy - Parent Policy for use with Standalone Rules + TF Resource for IDPS DFW Policy Rule - Standalone IDPS DFW Rule under an existing DFW IDPS Policy + TF Datasource for IDPS DFW Policy - Data source to look up an existing IDPS DFW Policy + TF acceptance tests for all new resources and data source + TF documentation for all new resources and data source Testing: Tested via acceptance tests and manual testing via scripts based TF configuration on a live setup. - 11 Go acceptance tests (4 parent policy, 5 standalone rule, 2 data source) - 31 manual test scenarios (14 positive, 5 CRUD, 10 negative, 2 special) JIRA: #NSEC-13037
1 parent 3571e24 commit 12d3d35

12 files changed

+1481
-5
lines changed

‎api/infra/domains/intrusion_service_policies/rule.go‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
//nolint:revive
2+
package intrusionservicepolicies
3+
4+
import (
5+
"errors"
6+
7+
vapiProtocolClient_ "github.com/vmware/vsphere-automation-sdk-go/runtime/protocol/client"
8+
client0 "github.com/vmware/vsphere-automation-sdk-go/services/nsxt/infra/domains/intrusion_service_policies"
9+
model0 "github.com/vmware/vsphere-automation-sdk-go/services/nsxt/model"
10+
client1 "github.com/vmware/vsphere-automation-sdk-go/services/nsxt/orgs/projects/infra/domains/intrusion_service_policies"
11+
12+
utl "github.com/vmware/terraform-provider-nsxt/api/utl"
13+
)
14+
15+
type IntrusionServicePolicyRuleClientContext utl.ClientContext
16+
17+
func NewRulesClient(sessionContext utl.SessionContext, connector vapiProtocolClient_.Connector) *IntrusionServicePolicyRuleClientContext {
18+
var client interface{}
19+
20+
switch sessionContext.ClientType {
21+
22+
case utl.Local:
23+
client = client0.NewRulesClient(connector)
24+
25+
case utl.Multitenancy:
26+
client = client1.NewRulesClient(connector)
27+
28+
default:
29+
return nil
30+
}
31+
return &IntrusionServicePolicyRuleClientContext{Client: client, ClientType: sessionContext.ClientType, ProjectID: sessionContext.ProjectID, VPCID: sessionContext.VPCID}
32+
}
33+
34+
func (c IntrusionServicePolicyRuleClientContext) Get(domainIdParam string, policyIdParam string, ruleIdParam string) (model0.IdsRule, error) {
35+
var obj model0.IdsRule
36+
var err error
37+
38+
switch c.ClientType {
39+
40+
case utl.Local:
41+
client := c.Client.(client0.RulesClient)
42+
obj, err = client.Get(domainIdParam, policyIdParam, ruleIdParam)
43+
if err != nil {
44+
return obj, err
45+
}
46+
47+
case utl.Multitenancy:
48+
client := c.Client.(client1.RulesClient)
49+
obj, err = client.Get(utl.DefaultOrgID, c.ProjectID, domainIdParam, policyIdParam, ruleIdParam)
50+
if err != nil {
51+
return obj, err
52+
}
53+
54+
default:
55+
return obj, errors.New("invalid infrastructure for model")
56+
}
57+
return obj, err
58+
}
59+
60+
func (c IntrusionServicePolicyRuleClientContext) Delete(domainIdParam string, policyIdParam string, ruleIdParam string) error {
61+
var err error
62+
63+
switch c.ClientType {
64+
65+
case utl.Local:
66+
client := c.Client.(client0.RulesClient)
67+
err = client.Delete(domainIdParam, policyIdParam, ruleIdParam)
68+
69+
case utl.Multitenancy:
70+
client := c.Client.(client1.RulesClient)
71+
err = client.Delete(utl.DefaultOrgID, c.ProjectID, domainIdParam, policyIdParam, ruleIdParam)
72+
73+
default:
74+
err = errors.New("invalid infrastructure for model")
75+
}
76+
return err
77+
}
78+
79+
func (c IntrusionServicePolicyRuleClientContext) Patch(domainIdParam string, policyIdParam string, ruleIdParam string, idsRuleParam model0.IdsRule) error {
80+
var err error
81+
82+
switch c.ClientType {
83+
84+
case utl.Local:
85+
client := c.Client.(client0.RulesClient)
86+
err = client.Patch(domainIdParam, policyIdParam, ruleIdParam, idsRuleParam)
87+
88+
case utl.Multitenancy:
89+
client := c.Client.(client1.RulesClient)
90+
err = client.Patch(utl.DefaultOrgID, c.ProjectID, domainIdParam, policyIdParam, ruleIdParam, idsRuleParam)
91+
92+
default:
93+
err = errors.New("invalid infrastructure for model")
94+
}
95+
return err
96+
}
97+
98+
func (c IntrusionServicePolicyRuleClientContext) Update(domainIdParam string, policyIdParam string, ruleIdParam string, idsRuleParam model0.IdsRule) (model0.IdsRule, error) {
99+
var err error
100+
var obj model0.IdsRule
101+
102+
switch c.ClientType {
103+
104+
case utl.Local:
105+
client := c.Client.(client0.RulesClient)
106+
obj, err = client.Update(domainIdParam, policyIdParam, ruleIdParam, idsRuleParam)
107+
108+
case utl.Multitenancy:
109+
client := c.Client.(client1.RulesClient)
110+
obj, err = client.Update(utl.DefaultOrgID, c.ProjectID, domainIdParam, policyIdParam, ruleIdParam, idsRuleParam)
111+
112+
default:
113+
err = errors.New("invalid infrastructure for model")
114+
}
115+
return obj, err
116+
}
117+
118+
func (c IntrusionServicePolicyRuleClientContext) List(domainIdParam string, policyIdParam string, cursorParam *string, includeMarkForDeleteObjectsParam *bool, includedFieldsParam *string, pageSizeParam *int64, sortAscendingParam *bool, sortByParam *string) (model0.IdsRuleListResult, error) {
119+
var err error
120+
var obj model0.IdsRuleListResult
121+
122+
switch c.ClientType {
123+
124+
case utl.Local:
125+
client := c.Client.(client0.RulesClient)
126+
obj, err = client.List(domainIdParam, policyIdParam, cursorParam, includeMarkForDeleteObjectsParam, includedFieldsParam, pageSizeParam, sortAscendingParam, sortByParam)
127+
128+
case utl.Multitenancy:
129+
client := c.Client.(client1.RulesClient)
130+
obj, err = client.List(utl.DefaultOrgID, c.ProjectID, domainIdParam, policyIdParam, cursorParam, includeMarkForDeleteObjectsParam, includedFieldsParam, pageSizeParam, sortAscendingParam, sortByParam)
131+
132+
default:
133+
err = errors.New("invalid infrastructure for model")
134+
}
135+
return obj, err
136+
}

‎docs/data-sources/policy_intrusion_service_policy.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
subcategory: "Beta"
3+
layout: "nsxt"
4+
page_title: "NSXT: nsxt_policy_intrusion_service_policy"
5+
description: A data source to retrieve an Intrusion Service (IDS) Policy.
6+
---
7+
8+
# nsxt_policy_intrusion_service_policy
9+
10+
This data source provides information about an existing Intrusion Service (IDS) Policy configured on NSX.
11+
This data source can be useful for fetching policy path to use in `nsxt_policy_intrusion_service_policy_rule` resource.
12+
13+
~> **NOTE:** This data source retrieves only the policy metadata (id, display_name, description, path). It does not retrieve the rules within the policy. To manage rules, use the `nsxt_policy_intrusion_service_policy_rule` resource with the policy path obtained from this data source.
14+
15+
This data source is applicable to NSX Policy Manager and VMC (NSX version 3.1.0 onwards).
16+
17+
## Example Usage
18+
19+
```hcl
20+
data "nsxt_policy_intrusion_service_policy" "ids_policy" {
21+
display_name = "intrusion-service-policy"
22+
}
23+
```
24+
25+
## Example Usage - Multi-Tenancy
26+
27+
```hcl
28+
data "nsxt_policy_project" "demoproj" {
29+
display_name = "demoproj"
30+
}
31+
32+
data "nsxt_policy_intrusion_service_policy" "ids_policy" {
33+
context {
34+
project_id = data.nsxt_policy_project.demoproj.id
35+
}
36+
display_name = "intrusion-service-policy"
37+
}
38+
```
39+
40+
## Argument Reference
41+
42+
* `id` - (Optional) The ID of the policy to retrieve.
43+
* `display_name` - (Optional) The display name of the policy to retrieve.
44+
* `domain` - (Optional) The domain of the policy. Defaults to `default`.
45+
* `context` - (Optional) The context which the object belongs to
46+
* `project_id` - (Required) The ID of the project which the object belongs to
47+
48+
## Attributes Reference
49+
50+
In addition to arguments listed above, the following attributes are exported:
51+
52+
* `description` - The description of the resource.
53+
* `path` - The NSX path of the policy resource.

‎docs/resources/policy_intrusion_service_policy_rule.md‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
subcategory: "Beta"
3+
layout: "nsxt"
4+
page_title: "NSXT: nsxt_policy_intrusion_service_policy_rule"
5+
description: A resource to configure a single rule in an Intrusion Service (IDS) Policy.
6+
---
7+
8+
# nsxt_policy_intrusion_service_policy_rule
9+
10+
This resource provides a method for the management of a single rule in an Intrusion Service (IDS) Policy for East-West traffic (Distributed Firewall context).
11+
12+
Note: to avoid unexpected behavior, don't use this resource and resource `nsxt_policy_intrusion_service_policy` to manage rules under an intrusion service policy at the same time.
13+
Instead, please use this resource with resource `nsxt_policy_parent_intrusion_service_policy` to manage an intrusion service policy and its rules separately, and use `nsxt_policy_intrusion_service_policy` to manage a policy and its rules in one single resource.
14+
15+
This resource is applicable to NSX Policy Manager and VMC (NSX version 3.1.0 onwards).
16+
17+
## Example Usage
18+
19+
```hcl
20+
data "nsxt_policy_intrusion_service_profile" "default" {
21+
display_name = "DefaultIDSProfile"
22+
}
23+
24+
resource "nsxt_policy_parent_intrusion_service_policy" "parent" {
25+
display_name = "tf-intrusion-svc-parent-policy"
26+
locked = false
27+
sequence_number = 3
28+
stateful = true
29+
30+
lifecycle {
31+
create_before_destroy = true
32+
}
33+
}
34+
35+
resource "nsxt_policy_intrusion_service_policy_rule" "detect_rule" {
36+
display_name = "detect-threats"
37+
description = "Detect threats in East-West traffic"
38+
policy_path = nsxt_policy_parent_intrusion_service_policy.parent.path
39+
action = "DETECT"
40+
direction = "IN"
41+
sequence_number = 1
42+
source_groups = [nsxt_policy_group.web_servers.path]
43+
destination_groups = [nsxt_policy_group.db_servers.path]
44+
services = [nsxt_policy_service.http.path]
45+
ids_profiles = [data.nsxt_policy_intrusion_service_profile.default.path]
46+
logged = true
47+
}
48+
```
49+
50+
## Example Usage - Multi-Tenancy
51+
52+
```hcl
53+
data "nsxt_policy_project" "demoproj" {
54+
display_name = "demoproj"
55+
}
56+
57+
resource "nsxt_policy_parent_intrusion_service_policy" "parent" {
58+
context {
59+
project_id = data.nsxt_policy_project.demoproj.id
60+
}
61+
display_name = "tf-intrusion-svc-parent-policy"
62+
locked = false
63+
sequence_number = 3
64+
stateful = true
65+
}
66+
67+
resource "nsxt_policy_intrusion_service_policy_rule" "detect_rule" {
68+
context {
69+
project_id = data.nsxt_policy_project.demoproj.id
70+
}
71+
display_name = "detect-threats"
72+
policy_path = nsxt_policy_parent_intrusion_service_policy.parent.path
73+
action = "DETECT"
74+
direction = "IN_OUT"
75+
sequence_number = 1
76+
ids_profiles = [data.nsxt_policy_intrusion_service_profile.default.path]
77+
}
78+
```
79+
80+
## Argument Reference
81+
82+
The following arguments are supported:
83+
84+
* `display_name` - (Required) Display name of the resource.
85+
* `description` - (Optional) Description of the resource.
86+
* `policy_path` - (Required) Path of the Intrusion Service Policy this rule belongs to. ForceNew.
87+
* `nsx_id` - (Optional) The NSX ID of this resource. If set, this ID will be used to create the resource.
88+
* `context` - (Optional) The context which the object belongs to. If it's not provided, it will be derived from `policy_path`.
89+
* `project_id` - (Required) The ID of the project which the object belongs to
90+
* `destination_groups` - (Optional) Set of group paths that serve as the destination for this rule.
91+
* `destinations_excluded` - (Optional) Negation of destination groups. Default is `false`.
92+
* `direction` - (Optional) Traffic direction. One of `IN`, `OUT`, or `IN_OUT`. Default is `IN_OUT`.
93+
* `disabled` - (Optional) Flag to disable the rule. Default is `false`.
94+
* `ip_version` - (Optional) IP version. One of `IPV4`, `IPV6`, or `IPV4_IPV6`. Default is `IPV4_IPV6`.
95+
* `logged` - (Optional) Flag to enable packet logging. Default is `false`.
96+
* `notes` - (Optional) Text for additional notes on changes.
97+
* `scope` - (Optional) Set of policy object paths where the rule is applied.
98+
* `services` - (Optional) Set of service paths to match.
99+
* `source_groups` - (Optional) Set of group paths that serve as the source for this rule.
100+
* `sources_excluded` - (Optional) Negation of source groups. Default is `false`.
101+
* `log_label` - (Optional) Additional information which will be propagated to the rule syslog.
102+
* `tag` - (Optional) A list of scope + tag pairs to associate with this rule.
103+
* `action` - (Optional) Rule action. One of `DETECT` or `DETECT_PREVENT`. Default is `DETECT`.
104+
* `ids_profiles` - (Required) Set of IDS profile paths for this rule.
105+
* `sequence_number` - (Required) Sequence number of this rule.
106+
107+
## Attributes Reference
108+
109+
In addition to arguments listed above, the following attributes are exported:
110+
111+
* `id` - ID of the resource.
112+
* `revision` - Indicates current revision number of the object as seen by NSX-T API server.
113+
* `path` - The NSX path of the policy resource.
114+
115+
## Importing
116+
117+
An existing Intrusion Service Policy Rule can be [imported][docs-import] into this resource, via the following command:
118+
119+
[docs-import]: https://www.terraform.io/cli/import
120+
121+
```shell
122+
terraform import nsxt_policy_intrusion_service_policy_rule.detect_rule RULE_PATH
123+
```
124+
125+
Example: `/infra/domains/default/intrusion-service-policies/ids-policy/rules/detect-rule`.

0 commit comments

Comments
 (0)