Skip to content

Commit a74eeb9

Browse files
ps031046ps031046
committed
@ANS-TF-IDPS: Support IDPS gateway policy and rules
+ TF Resource for IDPS Gateway Policy IDPS gateway policy with embedded rules + TF Resource for IDPS Gateway Policy Rule IDPS rule under an existing gateway policy + TF Resource for Parent IDPS Gateway Policy Parent policy for use with standalone rules + TF Datasource for IDPS Gateway Policy + TF acceptance tests for all resources and data sources + TF documentation for all resources and data sources Testing: Tested via acceptance tests and manual testing via scripts based TF configuration on a live setup. - 11 Go acceptance tests (3 policy, 2 parent policy, 3 rule, 3 data source) - 34 manual test scenarios (15 positive, 3 CRUD, 15 negative, 1 special) JIRA: #NSEC-12727
1 parent 1f34297 commit a74eeb9

16 files changed

+2540
-1
lines changed

‎api/infra/domains/intrusion_service_gateway_policies/rule.go‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
//nolint:revive
2+
package intrusionservicegatewaypolicies
3+
4+
import (
5+
"errors"
6+
7+
vapiProtocolClient_ "github.com/vmware/vsphere-automation-sdk-go/runtime/protocol/client"
8+
client0 "github.com/vmware/vsphere-automation-sdk-go/services/nsxt/infra/domains/intrusion_service_gateway_policies"
9+
model0 "github.com/vmware/vsphere-automation-sdk-go/services/nsxt/model"
10+
11+
utl "github.com/vmware/terraform-provider-nsxt/api/utl"
12+
)
13+
14+
type IntrusionServiceGatewayRuleClientContext utl.ClientContext
15+
16+
func NewRulesClient(sessionContext utl.SessionContext, connector vapiProtocolClient_.Connector) *IntrusionServiceGatewayRuleClientContext {
17+
var client interface{}
18+
19+
switch sessionContext.ClientType {
20+
21+
case utl.Local:
22+
client = client0.NewRulesClient(connector)
23+
24+
default:
25+
return nil
26+
}
27+
return &IntrusionServiceGatewayRuleClientContext{Client: client, ClientType: sessionContext.ClientType, ProjectID: sessionContext.ProjectID, VPCID: sessionContext.VPCID}
28+
}
29+
30+
func (c IntrusionServiceGatewayRuleClientContext) Get(domainIdParam string, policyIdParam string, ruleIdParam string) (model0.IdsRule, error) {
31+
var obj model0.IdsRule
32+
var err error
33+
34+
switch c.ClientType {
35+
36+
case utl.Local:
37+
client := c.Client.(client0.RulesClient)
38+
obj, err = client.Get(domainIdParam, policyIdParam, ruleIdParam)
39+
if err != nil {
40+
return obj, err
41+
}
42+
43+
default:
44+
return obj, errors.New("invalid infrastructure for model")
45+
}
46+
return obj, err
47+
}
48+
49+
func (c IntrusionServiceGatewayRuleClientContext) Delete(domainIdParam string, policyIdParam string, ruleIdParam string) error {
50+
var err error
51+
52+
switch c.ClientType {
53+
54+
case utl.Local:
55+
client := c.Client.(client0.RulesClient)
56+
err = client.Delete(domainIdParam, policyIdParam, ruleIdParam)
57+
58+
default:
59+
err = errors.New("invalid infrastructure for model")
60+
}
61+
return err
62+
}
63+
64+
func (c IntrusionServiceGatewayRuleClientContext) Patch(domainIdParam string, policyIdParam string, ruleIdParam string, idsRuleParam model0.IdsRule) error {
65+
var err error
66+
67+
switch c.ClientType {
68+
69+
case utl.Local:
70+
client := c.Client.(client0.RulesClient)
71+
err = client.Patch(domainIdParam, policyIdParam, ruleIdParam, idsRuleParam)
72+
73+
default:
74+
err = errors.New("invalid infrastructure for model")
75+
}
76+
return err
77+
}
78+
79+
func (c IntrusionServiceGatewayRuleClientContext) Update(domainIdParam string, policyIdParam string, ruleIdParam string, idsRuleParam model0.IdsRule) (model0.IdsRule, error) {
80+
var err error
81+
var obj model0.IdsRule
82+
83+
switch c.ClientType {
84+
85+
case utl.Local:
86+
client := c.Client.(client0.RulesClient)
87+
obj, err = client.Update(domainIdParam, policyIdParam, ruleIdParam, idsRuleParam)
88+
89+
default:
90+
err = errors.New("invalid infrastructure for model")
91+
}
92+
return obj, err
93+
}
94+
95+
func (c IntrusionServiceGatewayRuleClientContext) List(domainIdParam string, policyIdParam string, cursorParam *string, includeMarkForDeleteObjectsParam *bool, includedFieldsParam *string, pageSizeParam *int64, sortAscendingParam *bool, sortByParam *string) (model0.IdsRuleListResult, error) {
96+
var err error
97+
var obj model0.IdsRuleListResult
98+
99+
switch c.ClientType {
100+
101+
case utl.Local:
102+
client := c.Client.(client0.RulesClient)
103+
obj, err = client.List(domainIdParam, policyIdParam, cursorParam, includeMarkForDeleteObjectsParam, includedFieldsParam, pageSizeParam, sortAscendingParam, sortByParam)
104+
105+
default:
106+
err = errors.New("invalid infrastructure for model")
107+
}
108+
return obj, err
109+
}

‎api/infra/domains/intrusion_service_gateway_policy.go‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
//nolint:revive
2+
package domains
3+
4+
import (
5+
"errors"
6+
7+
vapiProtocolClient_ "github.com/vmware/vsphere-automation-sdk-go/runtime/protocol/client"
8+
client0 "github.com/vmware/vsphere-automation-sdk-go/services/nsxt/infra/domains"
9+
model0 "github.com/vmware/vsphere-automation-sdk-go/services/nsxt/model"
10+
11+
utl "github.com/vmware/terraform-provider-nsxt/api/utl"
12+
)
13+
14+
type IntrusionServiceGatewayPolicyClientContext utl.ClientContext
15+
16+
func NewIntrusionServiceGatewayPoliciesClient(sessionContext utl.SessionContext, connector vapiProtocolClient_.Connector) *IntrusionServiceGatewayPolicyClientContext {
17+
var client interface{}
18+
19+
switch sessionContext.ClientType {
20+
21+
case utl.Local:
22+
client = client0.NewIntrusionServiceGatewayPoliciesClient(connector)
23+
24+
default:
25+
return nil
26+
}
27+
return &IntrusionServiceGatewayPolicyClientContext{Client: client, ClientType: sessionContext.ClientType, ProjectID: sessionContext.ProjectID, VPCID: sessionContext.VPCID}
28+
}
29+
30+
func (c IntrusionServiceGatewayPolicyClientContext) Get(domainIdParam string, policyIdParam string) (model0.IdsGatewayPolicy, error) {
31+
var obj model0.IdsGatewayPolicy
32+
var err error
33+
34+
switch c.ClientType {
35+
36+
case utl.Local:
37+
client := c.Client.(client0.IntrusionServiceGatewayPoliciesClient)
38+
obj, err = client.Get(domainIdParam, policyIdParam)
39+
if err != nil {
40+
return obj, err
41+
}
42+
43+
default:
44+
return obj, errors.New("invalid infrastructure for model")
45+
}
46+
return obj, err
47+
}
48+
49+
func (c IntrusionServiceGatewayPolicyClientContext) Delete(domainIdParam string, policyIdParam string) error {
50+
var err error
51+
52+
switch c.ClientType {
53+
54+
case utl.Local:
55+
client := c.Client.(client0.IntrusionServiceGatewayPoliciesClient)
56+
err = client.Delete(domainIdParam, policyIdParam)
57+
58+
default:
59+
err = errors.New("invalid infrastructure for model")
60+
}
61+
return err
62+
}
63+
64+
func (c IntrusionServiceGatewayPolicyClientContext) List(domainIdParam string, cursorParam *string, includeMarkForDeleteObjectsParam *bool, includeRuleCountParam *bool, includedFieldsParam *string, pageSizeParam *int64, sortAscendingParam *bool, sortByParam *string) (model0.IdsGatewayPolicyListResult, error) {
65+
var err error
66+
var obj model0.IdsGatewayPolicyListResult
67+
68+
switch c.ClientType {
69+
70+
case utl.Local:
71+
client := c.Client.(client0.IntrusionServiceGatewayPoliciesClient)
72+
obj, err = client.List(domainIdParam, cursorParam, includeMarkForDeleteObjectsParam, includeRuleCountParam, includedFieldsParam, pageSizeParam, sortAscendingParam, sortByParam)
73+
74+
default:
75+
err = errors.New("invalid infrastructure for model")
76+
}
77+
return obj, err
78+
}
79+
80+
func (c IntrusionServiceGatewayPolicyClientContext) Patch(domainIdParam string, policyIdParam string, idsGatewayPolicyParam model0.IdsGatewayPolicy) error {
81+
var err error
82+
83+
switch c.ClientType {
84+
85+
case utl.Local:
86+
client := c.Client.(client0.IntrusionServiceGatewayPoliciesClient)
87+
err = client.Patch(domainIdParam, policyIdParam, idsGatewayPolicyParam)
88+
89+
default:
90+
err = errors.New("invalid infrastructure for model")
91+
}
92+
return err
93+
}
94+
95+
func (c IntrusionServiceGatewayPolicyClientContext) Update(domainIdParam string, policyIdParam string, idsGatewayPolicyParam model0.IdsGatewayPolicy) (model0.IdsGatewayPolicy, error) {
96+
var err error
97+
var obj model0.IdsGatewayPolicy
98+
99+
switch c.ClientType {
100+
101+
case utl.Local:
102+
client := c.Client.(client0.IntrusionServiceGatewayPoliciesClient)
103+
obj, err = client.Update(domainIdParam, policyIdParam, idsGatewayPolicyParam)
104+
105+
default:
106+
err = errors.New("invalid infrastructure for model")
107+
}
108+
return obj, err
109+
}

‎docs/data-sources/policy_intrusion_service_gateway_policy.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
subcategory: "Beta"
3+
layout: "nsxt"
4+
page_title: "NSXT: nsxt_policy_intrusion_service_gateway_policy"
5+
description: A data source to retrieve an Intrusion Service Gateway Policy.
6+
---
7+
8+
# nsxt_policy_intrusion_service_gateway_policy
9+
10+
This data source provides information about an existing Intrusion Service Gateway Policy configured on NSX.
11+
This data source can be useful for fetching policy path to use in `nsxt_policy_intrusion_service_gateway_policy_rule` resource.
12+
13+
~> **NOTE:** This data source retrieves only the policy metadata (id, display_name, description, path, category). It does not retrieve the rules within the policy. To manage rules, use the `nsxt_policy_intrusion_service_gateway_policy_rule` resource with the policy path obtained from this data source.
14+
15+
This data source is applicable to NSX Policy Manager (NSX version 4.2.0 onwards).
16+
17+
## Example Usage
18+
19+
```hcl
20+
data "nsxt_policy_intrusion_service_gateway_policy" "idps_gateway_policy" {
21+
display_name = "intrusion-service-gateway-policy"
22+
}
23+
```
24+
25+
## Argument Reference
26+
27+
* `id` - (Optional) The ID of the policy to retrieve.
28+
* `display_name` - (Optional) The display name of the policy to retrieve.
29+
* `domain` - (Optional) The domain of the policy. Defaults to `default`.
30+
* `category` - (Optional) Category of the policy.
31+
32+
## Attributes Reference
33+
34+
In addition to arguments listed above, the following attributes are exported:
35+
36+
* `description` - The description of the resource.
37+
* `path` - The NSX path of the policy resource.

‎docs/resources/policy_intrusion_service_gateway_policy.md‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
---
2+
subcategory: "Beta"
3+
layout: "nsxt"
4+
page_title: "NSXT: nsxt_policy_intrusion_service_gateway_policy"
5+
description: A resource to configure an Intrusion Service Gateway Policy and its rules.
6+
---
7+
8+
# nsxt_policy_intrusion_service_gateway_policy
9+
10+
This resource provides a method for the management of an Intrusion Service Gateway Policy and its rules for North-South traffic (Gateway Firewall context).
11+
12+
This resource is applicable to NSX Policy Manager (NSX version 4.2.0 onwards).
13+
14+
## Example Usage
15+
16+
```hcl
17+
data "nsxt_policy_tier1_gateway" "tier1_gw" {
18+
display_name = "tier1-gateway"
19+
}
20+
21+
data "nsxt_policy_intrusion_service_profile" "default" {
22+
display_name = "DefaultIDSProfile"
23+
}
24+
25+
resource "nsxt_policy_intrusion_service_gateway_policy" "idps_gateway_policy" {
26+
display_name = "intrusion-service-gateway-policy"
27+
description = "North-South IDPS policy for gateway traffic"
28+
category = "LocalGatewayRules"
29+
locked = false
30+
sequence_number = 3
31+
stateful = true
32+
33+
rule {
34+
display_name = "detect-inbound-threats"
35+
description = "Detect threats in North-South inbound traffic"
36+
direction = "IN"
37+
action = "DETECT"
38+
scope = [data.nsxt_policy_tier1_gateway.tier1_gw.path]
39+
source_groups = [nsxt_policy_group.web_servers.path]
40+
destination_groups = [nsxt_policy_group.db_servers.path]
41+
services = [nsxt_policy_service.http.path]
42+
ids_profiles = [data.nsxt_policy_intrusion_service_profile.default.path]
43+
logged = true
44+
}
45+
46+
rule {
47+
display_name = "detect-prevent-outbound"
48+
description = "Detect and prevent threats in outbound traffic"
49+
direction = "OUT"
50+
action = "DETECT_PREVENT"
51+
scope = [data.nsxt_policy_tier1_gateway.tier1_gw.path]
52+
ids_profiles = [data.nsxt_policy_intrusion_service_profile.default.path]
53+
logged = true
54+
}
55+
56+
lifecycle {
57+
create_before_destroy = true
58+
}
59+
}
60+
```
61+
62+
-> We recommend using `lifecycle` directive as in sample above, in order to avoid dependency issues when updating groups/services simultaneously with the rule.
63+
64+
## Argument Reference
65+
66+
The following arguments are supported:
67+
68+
* `display_name` - (Required) Display name of the resource.
69+
* `description` - (Optional) Description of the resource.
70+
* `domain` - (Optional) The domain to use for the resource. Defaults to `default`.
71+
* `tag` - (Optional) A list of scope + tag pairs to associate with this policy.
72+
* `nsx_id` - (Optional) The NSX ID of this resource. If set, this ID will be used to create the resource.
73+
* `category` - (Required) Category of this policy. Must be one of: `Emergency`, `SystemRules`, `SharedPreRules`, `LocalGatewayRules`, `AutoServiceRules`, or `Default`. ForceNew.
74+
* `comments` - (Optional) Comments for security policy lock/unlock.
75+
* `locked` - (Optional) Indicates whether a security policy should be locked. Default is `false`.
76+
* `sequence_number` - (Optional) This field is used to resolve conflicts between security policies across domains. Default is `0`.
77+
* `stateful` - (Optional) When it is stateful, the state of the network connects are tracked and a stateful packet inspection is performed. Default is `true`.
78+
* `tcp_strict` - (Optional) Ensures that a 3-way TCP handshake is done before the data packets are sent. Computed if not set.
79+
* `rule` - (Optional) A list of rules for this policy. Each rule supports the following:
80+
* `display_name` - (Required) Display name of the rule.
81+
* `description` - (Optional) Description of the rule.
82+
* `destination_groups` - (Optional) Set of group paths that serve as the destination for this rule.
83+
* `destinations_excluded` - (Optional) Negation of destination groups. Default is `false`.
84+
* `direction` - (Optional) Traffic direction. One of `IN`, `OUT`, or `IN_OUT`. Default is `IN_OUT`.
85+
* `disabled` - (Optional) Flag to disable the rule. Default is `false`.
86+
* `ip_version` - (Optional) IP version. One of `IPV4`, `IPV6`, or `IPV4_IPV6`. Default is `IPV4_IPV6`.
87+
* `logged` - (Optional) Flag to enable packet logging. Default is `false`.
88+
* `notes` - (Optional) Text for additional notes on changes.
89+
* `scope` - (Required) Set of policy paths where the rule is applied (e.g., Tier-0/Tier-1 gateway paths).
90+
* `services` - (Optional) Set of service paths to match.
91+
* `source_groups` - (Optional) Set of group paths that serve as the source for this rule.
92+
* `sources_excluded` - (Optional) Negation of source groups. Default is `false`.
93+
* `log_label` - (Optional) Additional information which will be propagated to the rule syslog.
94+
* `tag` - (Optional) A list of scope + tag pairs to associate with this rule.
95+
* `action` - (Optional) Rule action. One of `DETECT` or `DETECT_PREVENT`. Default is `DETECT`.
96+
* `ids_profiles` - (Required) Set of IDS profile paths for this rule.
97+
* `sequence_number` - (Optional) Sequence number of this rule.
98+
99+
## Attributes Reference
100+
101+
In addition to arguments listed above, the following attributes are exported:
102+
103+
* `id` - ID of the resource.
104+
* `revision` - Indicates current revision number of the object as seen by NSX-T API server.
105+
* `path` - The NSX path of the policy resource.
106+
* `rule`:
107+
* `revision` - Indicates current revision number of the rule.
108+
* `path` - The NSX path of the rule.
109+
* `sequence_number` - Sequence number of the rule.
110+
* `nsx_id` - NSX ID of the rule.
111+
112+
## Importing
113+
114+
An existing Intrusion Service Gateway Policy can be [imported][docs-import] into this resource, via the following command:
115+
116+
[docs-import]: https://www.terraform.io/cli/import
117+
118+
```shell
119+
terraform import nsxt_policy_intrusion_service_gateway_policy.north_south_detect POLICY_PATH
120+
```
121+
122+
The above command imports the policy named `north_south_detect` with the policy path `POLICY_PATH`.
123+
Example: `/infra/domains/default/intrusion-service-gateway-policies/idps-gateway-policy`.

0 commit comments

Comments
 (0)