Skip to content

Commit 5d466aa

Browse files
isra-felisra-fel
authored
Merge pull request #10414 from andreycpp/merge-network
Add ThreatIntelWhitelist to AzFirewall commands
2 parents e691949 + ba1656b commit 5d466aa

File tree

17 files changed

+2872
-43
lines changed

17 files changed

+2872
-43
lines changed

‎src/Accounts/Accounts/AzureRmAlias/Mappings.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1262,7 +1262,7 @@
12621262
"Set-AzApplicationGatewayAutoscaleConfiguration": "Set-AzureRmApplicationGatewayAutoscaleConfiguration",
12631263
"Set-AzApplicationGatewayAuthenticationCertificate": "Set-AzureRmApplicationGatewayAuthenticationCertificate",
12641264
"Get-AzApplicationGatewayAvailableWafRuleSets": "Get-AzureRmApplicationGatewayAvailableWafRuleSets",
1265-
"Get-AzApplicationGatewayAvailableServerVariableAndHeader": "Get-AzureRmApplicationGatewayAvailableServerVariableAndHeader",
1265+
"Get-AzApplicationGatewayAvailableServerVariableAndHeader": "Get-AzureRmApplicationGatewayAvailableServerVariableAndHeader",
12661266
"Get-AzApplicationGatewayAvailableSslOptions": "Get-AzureRmApplicationGatewayAvailableSslOptions",
12671267
"Add-AzApplicationGatewayBackendAddressPool": "Add-AzureRmApplicationGatewayBackendAddressPool",
12681268
"Get-AzApplicationGatewayBackendAddressPool": "Get-AzureRmApplicationGatewayBackendAddressPool",
@@ -2519,4 +2519,4 @@
25192519
"New-AzWebAppAzureStoragePath": "New-AzureRmWebAppAzureStoragePath",
25202520
"Swap-AzWebAppSlot": "Swap-AzureRmWebAppSlot"
25212521
}
2522-
}
2522+
}

‎src/Network/Network.Test/ScenarioTests/AzureFirewallTests.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,5 +66,13 @@ public void TestAzureFirewallVirtualHubCRUD()
6666
TestRunner.RunTestScript("Test-AzureFirewallVirtualHubCRUD");
6767
}
6868

69+
[Fact]
70+
[Trait(Category.AcceptanceType, Category.CheckIn)]
71+
[Trait(Category.Owner, NrpTeamAlias.azurefirewall)]
72+
public void TestAzureFirewallThreatIntelWhitelistCRUD()
73+
{
74+
TestRunner.RunTestScript("Test-AzureFirewallThreatIntelWhitelistCRUD");
75+
}
76+
6977
}
7078
}

‎src/Network/Network.Test/ScenarioTests/AzureFirewallTests.ps1

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1156,3 +1156,52 @@ function Test-AzureFirewallVirtualHubCRUD {
11561156
Clean-ResourceGroup $rgname
11571157
}
11581158
}
1159+
1160+
<#
1161+
.SYNOPSIS
1162+
Tests AzureFirewall ThreatIntelWhitelist
1163+
#>
1164+
function Test-AzureFirewallThreatIntelWhitelistCRUD {
1165+
$rgname = Get-ResourceGroupName
1166+
$azureFirewallName = Get-ResourceName
1167+
$resourceTypeParent = "Microsoft.Network/AzureFirewalls"
1168+
$location = Get-ProviderLocation $resourceTypeParent "eastus2euap"
1169+
1170+
$vnetName = Get-ResourceName
1171+
$subnetName = "AzureFirewallSubnet"
1172+
$publicIpName = Get-ResourceName
1173+
1174+
$threatIntelWhitelist1 = New-AzFirewallThreatIntelWhitelist -FQDN @("*.microsoft.com", "microsoft.com") -IpAddress @("8.8.8.8", "1.1.1.1")
1175+
$threatIntelWhitelist2 = New-AzFirewallThreatIntelWhitelist -IpAddress @(" 2.2.2.2 "," 3.3.3.3 ") -FQDN @(" bing.com ", "yammer.com ")
1176+
1177+
try {
1178+
# Create the resource group
1179+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location
1180+
1181+
# Create the Virtual Network
1182+
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix 10.0.0.0/24
1183+
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname -Location $location -AddressPrefix 10.0.0.0/16 -Subnet $subnet
1184+
1185+
# Create public ip
1186+
$publicip = New-AzPublicIpAddress -ResourceGroupName $rgname -name $publicIpName -location $location -AllocationMethod Static -Sku Standard
1187+
1188+
# Create AzureFirewall
1189+
$azureFirewall = New-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname -Location $location -ThreatIntelWhitelist $threatIntelWhitelist1
1190+
1191+
# Verify
1192+
$getAzureFirewall = Get-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname
1193+
Assert-AreEqualArray $threatIntelWhitelist1.FQDNs $getAzureFirewall.ThreatIntelWhitelist.FQDNs
1194+
Assert-AreEqualArray $threatIntelWhitelist1.IpAddresses $getAzureFirewall.ThreatIntelWhitelist.IpAddresses
1195+
1196+
# Modify
1197+
$azureFirewall.ThreatIntelWhitelist = $threatIntelWhitelist2
1198+
Set-AzFirewall -AzureFirewall $azureFirewall
1199+
$getAzureFirewall = Get-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname
1200+
Assert-AreEqualArray $threatIntelWhitelist2.FQDNs $getAzureFirewall.ThreatIntelWhitelist.FQDNs
1201+
Assert-AreEqualArray $threatIntelWhitelist2.IpAddresses $getAzureFirewall.ThreatIntelWhitelist.IpAddresses
1202+
}
1203+
finally {
1204+
# Cleanup
1205+
Clean-ResourceGroup $rgname
1206+
}
1207+
}

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.AzureFirewallTests/TestAzureFirewallThreatIntelWhitelistCRUD.json

Lines changed: 2381 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/Az.Network.psd1

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -389,7 +389,8 @@ CmdletsToExport = 'Add-AzApplicationGatewayAuthenticationCertificate',
389389
'New-AzFirewallApplicationRuleCollection',
390390
'New-AzFirewallApplicationRule', 'New-AzFirewallNatRuleCollection',
391391
'New-AzFirewallNatRule', 'New-AzFirewallNetworkRuleCollection',
392-
'New-AzFirewallNetworkRule', 'Get-AzFirewallFqdnTag',
392+
'New-AzFirewallNetworkRule', 'New-AzFirewallThreatIntelWhitelist',
393+
'Get-AzFirewallFqdnTag',
393394
'Get-AzNetworkProfile', 'New-AzNetworkProfile',
394395
'Remove-AzNetworkProfile', 'Set-AzNetworkProfile',
395396
'New-AzContainerNicConfig', 'New-AzContainerNicConfigIpConfig',
@@ -459,7 +460,8 @@ AliasesToExport = 'List-AzApplicationGatewayAvailableWafRuleSets',
459460
'Get-AzExpressRouteCircuitStats',
460461
'Get-AzApplicationGatewayAvailableWafRuleSets',
461462
'Get-AzApplicationGatewayAvailableSslOptions',
462-
'Get-AzInterfaceEndpoint'
463+
'Get-AzInterfaceEndpoint',
464+
'New-AzFirewallThreatIntelWhitelistObject'
463465

464466
# DSC resources to export from this module
465467
# DscResourcesToExport = @()

‎src/Network/Network/AzureFirewall/NewAzureFirewallCommand.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,11 @@ public class NewAzureFirewallCommand : AzureFirewallBaseCmdlet
135135
IgnoreCase = false)]
136136
public string ThreatIntelMode { get; set; }
137137

138+
[Parameter(
139+
Mandatory = false,
140+
HelpMessage = "The whitelist for Threat Intelligence")]
141+
public PSAzureFirewallThreatIntelWhitelist ThreatIntelWhitelist { get; set; }
142+
138143
[Parameter(
139144
Mandatory = false,
140145
ValueFromPipelineByPropertyName = true,
@@ -256,6 +261,7 @@ private PSAzureFirewall CreateAzureFirewall()
256261
NatRuleCollections = this.NatRuleCollection?.ToList(),
257262
NetworkRuleCollections = this.NetworkRuleCollection?.ToList(),
258263
ThreatIntelMode = this.ThreatIntelMode ?? MNM.AzureFirewallThreatIntelMode.Alert,
264+
ThreatIntelWhitelist = this.ThreatIntelWhitelist,
259265
Sku = sku
260266
};
261267

‎src/Network/Network/AzureFirewall/ThreatIntelWhitelist/NewAzureFirewallThreatIntelWhitelistCommand.cs

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using System;
16+
using System.Collections.Generic;
17+
using System.Linq;
18+
using System.Management.Automation;
19+
using Microsoft.Azure.Commands.Network.Models;
20+
21+
namespace Microsoft.Azure.Commands.Network
22+
{
23+
[Cmdlet(VerbsCommon.New, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "FirewallThreatIntelWhitelist"), OutputType(typeof(PSAzureFirewallThreatIntelWhitelist))]
24+
[Alias("New-AzFirewallThreatIntelWhitelistObject")]
25+
public class NewAzureFirewallThreatIntelWhitelistCommand : AzureFirewallBaseCmdlet
26+
{
27+
[Parameter(
28+
Mandatory = false,
29+
HelpMessage = "The FQDNs of the Threat Intel Whitelist")]
30+
[ValidateNotNull]
31+
public string[] FQDN { get; set; }
32+
33+
[Parameter(
34+
Mandatory = false,
35+
HelpMessage = "The IP Addresses of the Threat Intel Whitelist")]
36+
[ValidateNotNull]
37+
public string[] IpAddress { get; set; }
38+
39+
public override void Execute()
40+
{
41+
base.Execute();
42+
43+
var threatIntelWhitelist = new PSAzureFirewallThreatIntelWhitelist
44+
{
45+
FQDNs = this.FQDN?.Select(str => str.Trim()).ToArray(),
46+
IpAddresses = this.IpAddress?.Select(str => str.Trim()).ToArray(),
47+
};
48+
WriteObject(threatIntelWhitelist);
49+
}
50+
}
51+
}

‎src/Network/Network/ChangeLog.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@
3535
- Updated New-AzPrivateLinkService to add a new optional parameter EnableProxyProtocol.
3636
* Fix incorrect parameter description in `New-AzApplicationGatewaySku` reference documentation
3737
* New cmdlets to support the azure firewall policy
38+
* Add support for ThreatIntelWhitelist property for AzFirewall
39+
- New cmdlet added:
40+
- New-AzFirewallThreatIntelWhitelist
41+
- Cmdlets updated with optional parameters:
42+
- New-AzFirewall : added parameter ThreatIntelWhitelist
3843
* Add support for child resource RouteTables of VirtualHub
3944
- New cmdlets added:
4045
- Add-AzVirtualHubRoute

‎src/Network/Network/Common/NetworkResourceManagerProfile.cs

Lines changed: 34 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,10 @@
1515
namespace Microsoft.Azure.Commands.Network
1616
{
1717
using AutoMapper;
18+
using System;
1819
using System.Collections.Generic;
1920
using System.Linq;
21+
using System.Management.Automation;
2022
using WindowsAzure.Commands.Common;
2123
using CNM = Microsoft.Azure.Commands.Network.Models;
2224
using MNM = Microsoft.Azure.Management.Network.Models;
@@ -101,7 +103,7 @@ public CNM.PSVirtualRouter Convert(MNM.VirtualRouter source, CNM.PSVirtualRouter
101103
Location = source.Location,
102104
Type = source.Type,
103105
ProvisioningState = source.ProvisioningState,
104-
VirtualRouterAsn = (uint) source.VirtualRouterAsn
106+
VirtualRouterAsn = (uint)source.VirtualRouterAsn
105107
};
106108
if (source.HostedGateway != null)
107109
{
@@ -178,7 +180,7 @@ private static void MapRouteTableV2sToRouteTables<MnmType, CnmType>(MnmType mnmO
178180

179181
List<CNM.PSVirtualHubRoute> cnmRoutes = new List<CNM.PSVirtualHubRoute>();
180182
var cnmAttachedConnections = new List<string>(mnmAttachedConnections);
181-
183+
182184
foreach (var mnmRoute in mnmRoutes)
183185
{
184186
var cnmRoute = new CNM.PSVirtualHubRoute
@@ -708,7 +710,7 @@ private static void Initialize()
708710
.AfterMap((src, dest) =>
709711
{
710712
MapSecurityRuleCommandToManagement<CNM.PSEffectiveSecurityRule, MNM.EffectiveNetworkSecurityRule>(src, dest);
711-
});
713+
});
712714

713715
// MNM to CNM
714716
cfg.CreateMap<MNM.EffectiveNetworkSecurityGroup, CNM.PSEffectiveNetworkSecurityGroup>();
@@ -1119,7 +1121,14 @@ private static void Initialize()
11191121

11201122
// Azure Firewalls
11211123
// CNM to MNM
1122-
cfg.CreateMap<CNM.PSAzureFirewall, MNM.AzureFirewall>();
1124+
cfg.CreateMap<CNM.PSAzureFirewall, MNM.AzureFirewall>().AfterMap((src, dest) =>
1125+
{
1126+
dest.AdditionalProperties = new Dictionary<string, string>()
1127+
{
1128+
{ "ThreatIntel.Whitelist.FQDNs", src.ThreatIntelWhitelist?.FQDNs?.Aggregate((result, item) => result + "," + item) },
1129+
{ "ThreatIntel.Whitelist.IpAddresses", src.ThreatIntelWhitelist?.IpAddresses?.Aggregate((result, item) => result + "," + item) },
1130+
}.Where(kvp => kvp.Value != null).ToDictionary(key => key.Key, val => val.Value); // TODO: remove after backend code is refactored
1131+
});
11231132
cfg.CreateMap<CNM.PSAzureFirewallSku, MNM.AzureFirewallSku>();
11241133
cfg.CreateMap<CNM.PSAzureFirewallIpConfiguration, MNM.AzureFirewallIPConfiguration>();
11251134
cfg.CreateMap<CNM.PSAzureFirewallApplicationRuleCollection, MNM.AzureFirewallApplicationRuleCollection>();
@@ -1133,7 +1142,27 @@ private static void Initialize()
11331142
cfg.CreateMap<CNM.PSAzureFirewallApplicationRuleProtocol, MNM.AzureFirewallApplicationRuleProtocol>();
11341143

11351144
// MNM to CNM
1136-
cfg.CreateMap<MNM.AzureFirewall, CNM.PSAzureFirewall>();
1145+
cfg.CreateMap<MNM.AzureFirewall, CNM.PSAzureFirewall>().AfterMap((src, dest) =>
1146+
{
1147+
// TODO: refactor after backend is refactored
1148+
dest.ThreatIntelWhitelist = new CNM.PSAzureFirewallThreatIntelWhitelist();
1149+
try
1150+
{
1151+
dest.ThreatIntelWhitelist.FQDNs = src.AdditionalProperties?.SingleOrDefault(kvp => kvp.Key.Equals("ThreatIntel.Whitelist.FQDNs", StringComparison.OrdinalIgnoreCase)).Value?.Split(',').Select(str => str.Trim()).ToArray();
1152+
}
1153+
catch (PSArgumentException)
1154+
{
1155+
dest.ThreatIntelWhitelist.FQDNs = null;
1156+
}
1157+
try
1158+
{
1159+
dest.ThreatIntelWhitelist.IpAddresses = src.AdditionalProperties?.SingleOrDefault(kvp => kvp.Key.Equals("ThreatIntel.Whitelist.IpAddresses", StringComparison.OrdinalIgnoreCase)).Value?.Split(',').Select(str => str.Trim()).ToArray();
1160+
}
1161+
catch (PSArgumentException)
1162+
{
1163+
dest.ThreatIntelWhitelist.IpAddresses = null;
1164+
}
1165+
});
11371166
cfg.CreateMap<MNM.AzureFirewallSku, CNM.PSAzureFirewallSku>();
11381167
cfg.CreateMap<MNM.AzureFirewallIPConfiguration, CNM.PSAzureFirewallIpConfiguration>();
11391168
cfg.CreateMap<MNM.AzureFirewallApplicationRuleCollection, CNM.PSAzureFirewallApplicationRuleCollection>();

‎src/Network/Network/Models/AzureFirewall/PSAzureFirewall.cs

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ public class PSAzureFirewall : PSTopLevelResource
4242

4343
public string ThreatIntelMode { get; set; }
4444

45+
public PSAzureFirewallThreatIntelWhitelist ThreatIntelWhitelist { get; set; }
46+
4547
public string ProvisioningState { get; set; }
4648

4749
public List<string> Zones { get; set; }
@@ -70,6 +72,12 @@ public string NetworkRuleCollectionsText
7072
get { return JsonConvert.SerializeObject(NetworkRuleCollections, Formatting.Indented); }
7173
}
7274

75+
[JsonIgnore]
76+
public string ThreatIntelWhitelistText
77+
{
78+
get { return JsonConvert.SerializeObject(ThreatIntelWhitelist, Formatting.Indented); }
79+
}
80+
7381
#region Ip Configuration Operations
7482

7583
public void Allocate(PSVirtualNetwork virtualNetwork, PSPublicIpAddress[] publicIpAddresses)
@@ -96,7 +104,7 @@ public void Allocate(PSVirtualNetwork virtualNetwork, PSPublicIpAddress[] public
96104

97105
this.IpConfigurations = new List<PSAzureFirewallIpConfiguration>();
98106

99-
for(var i = 0; i < publicIpAddresses.Count(); i++)
107+
for (var i = 0; i < publicIpAddresses.Count(); i++)
100108
{
101109
this.IpConfigurations.Add(
102110
new PSAzureFirewallIpConfiguration
@@ -111,7 +119,7 @@ public void Allocate(PSVirtualNetwork virtualNetwork, PSPublicIpAddress[] public
111119

112120
public void Deallocate()
113121
{
114-
this.IpConfigurations = new List<PSAzureFirewallIpConfiguration> ();
122+
this.IpConfigurations = new List<PSAzureFirewallIpConfiguration>();
115123
}
116124

117125
public void AddPublicIpAddress(PSPublicIpAddress publicIpAddress)
@@ -277,7 +285,7 @@ private List<BaseRuleCollection> AddRuleCollection<BaseRuleCollection>(BaseRuleC
277285
return existingRuleCollections;
278286
}
279287

280-
private BaseRuleCollection GetRuleCollectionByName<BaseRuleCollection> (string ruleCollectionName, List<BaseRuleCollection> ruleCollections) where BaseRuleCollection : PSAzureFirewallBaseRuleCollection
288+
private BaseRuleCollection GetRuleCollectionByName<BaseRuleCollection>(string ruleCollectionName, List<BaseRuleCollection> ruleCollections) where BaseRuleCollection : PSAzureFirewallBaseRuleCollection
281289
{
282290
if (string.IsNullOrEmpty(ruleCollectionName))
283291
{

0 commit comments

Comments
 (0)