Skip to content

Commit f7b324f

Browse files
ishaniGupta27Ishani Gupta
ishaniGupta27
and
Ishani Gupta
authored
DNS Proxy in Firewall Policy (#12120)
* merge conflict * fixes * tejas review Co-authored-by: Ishani Gupta <[email protected]>
1 parent c1e4191 commit f7b324f

17 files changed

+5241
-58
lines changed

‎src/Network/Network.Test/ScenarioTests/AzureFirewallPolicyTests.cs

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,5 +41,21 @@ public void TestAzureFirewallPolicyWithThreatIntelWhitelistCRUD()
4141
{
4242
TestRunner.RunTestScript("Test-AzureFirewallPolicyWithThreatIntelWhitelistCRUD");
4343
}
44+
45+
[Fact]
46+
[Trait(Category.AcceptanceType, Category.CheckIn)]
47+
[Trait(Category.Owner, NrpTeamAlias.azurefirewall)]
48+
public void TestAzureFirewallPolicyWithDNSSettings()
49+
{
50+
TestRunner.RunTestScript("Test-AzureFirewallPolicyWithDNSSettings");
51+
}
52+
53+
[Fact]
54+
[Trait(Category.AcceptanceType, Category.CheckIn)]
55+
[Trait(Category.Owner, NrpTeamAlias.azurefirewall)]
56+
public void TestAzureFirewallPolicyCRUDWithNetworkRuleDestinationFQDNs()
57+
{
58+
TestRunner.RunTestScript("Test-AzureFirewallPolicyCRUDWithNetworkRuleDestinationFQDNs");
59+
}
4460
}
4561
}

‎src/Network/Network.Test/ScenarioTests/AzureFirewallPolicyTests.ps1

Lines changed: 222 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,4 +300,225 @@ function Test-AzureFirewallPolicyWithThreatIntelWhitelistCRUD {
300300
# Cleanup
301301
Clean-ResourceGroup $rgname
302302
}
303-
}
303+
}
304+
305+
<#
306+
.SYNOPSIS
307+
Tests AzureFirewallPolicyWithDNSSettings.
308+
#>
309+
function Test-AzureFirewallPolicyWithDNSSettings {
310+
# Setup
311+
$rgname = Get-ResourceGroupName
312+
$azureFirewallPolicyName = Get-ResourceName
313+
$azureFirewallPolicyAsJobName = Get-ResourceName
314+
$resourceTypeParent = "Microsoft.Network/FirewallPolicies"
315+
$location = "eastus2euap"
316+
$dnsServers = @("10.10.10.1", "20.20.20.2")
317+
318+
try {
319+
# Create the resource group
320+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "testval" }
321+
322+
# Create AzureFirewallPolicy with No DNS Settings
323+
$azureFirewallPolicy = New-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname -Location $location
324+
325+
# Get AzureFirewallPolicy
326+
$getAzureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
327+
328+
#verification
329+
Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
330+
Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
331+
Assert-NotNull $getAzureFirewallPolicy.Location
332+
Assert-AreEqual (Normalize-Location $location) $getAzureFirewallPolicy.Location
333+
334+
# Check DNS Proxy
335+
Assert-Null $getAzureFirewallPolicy.DnsSettings.EnableProxy
336+
Assert-Null $getAzureFirewallPolicy.DnsSettings.Servers
337+
Assert-Null $getAzureFirewallPolicy.DnsSettings.RequireProxyForNetworkRules
338+
339+
# Update AzureFirewallPolicy with Enable Proxy and DNS Servers
340+
341+
$dnsSetting = New-AzFirewallPolicyDnsSetting -EnableProxy -Server $dnsServers
342+
343+
$azureFirewallPolicy = Set-AzFirewallPolicy -InputObject $azureFirewallPolicy -DnsSetting $dnsSetting
344+
345+
# Get AzureFirewallPolicy
346+
$getAzureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
347+
348+
#verification
349+
Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
350+
Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
351+
Assert-NotNull $getAzureFirewallPolicy.Location
352+
Assert-AreEqual (Normalize-Location $location) $getAzureFirewallPolicy.Location
353+
354+
# Check DNS Proxy
355+
Assert-AreEqual true $getAzureFirewallPolicy.DnsSettings.EnableProxy
356+
Assert-AreEqualArray $dnsServers $getAzureFirewallPolicy.DnsSettings.Servers
357+
Assert-Null $getAzureFirewallPolicy.DnsSettings.RequireProxyForNetworkRules
358+
359+
# Update AzureFirewallPolicy with Enable Proxy , DNS Servers and Dns ProxyNotRequiredForNetworkRule
360+
$dnsSettings2 = New-AzFirewallPolicyDnsSetting -EnableProxy -Server $dnsServers -ProxyNotRequiredForNetworkRule
361+
362+
$azureFirewallPolicy = Set-AzFirewallPolicy -InputObject $azureFirewallPolicy -DnsSetting $dnsSettings2
363+
364+
# Get AzureFirewallPolicy
365+
$getAzureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
366+
367+
#verification
368+
Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
369+
Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
370+
Assert-NotNull $getAzureFirewallPolicy.Location
371+
Assert-AreEqual (Normalize-Location $location) $getAzureFirewallPolicy.Location
372+
373+
# Check DNS Proxy
374+
Assert-AreEqual true $getAzureFirewallPolicy.DnsSettings.EnableProxy
375+
Assert-AreEqualArray $dnsServers $getAzureFirewallPolicy.DnsSettings.Servers
376+
Assert-AreEqual false $getAzureFirewallPolicy.DnsSettings.RequireProxyForNetworkRules
377+
378+
# Set AzureFirewallPolicy
379+
Set-AzFirewallPolicy -InputObject $azureFirewallPolicy
380+
# Get AzureFirewallPolicy
381+
$getAzureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgName
382+
383+
# #verification
384+
Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
385+
Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
386+
Assert-NotNull $getAzureFirewallPolicy.Location
387+
Assert-AreEqual $location $getAzureFirewallPolicy.Location
388+
389+
# Check DNS Proxy
390+
Assert-AreEqual true $getAzureFirewallPolicy.DnsSettings.EnableProxy
391+
Assert-AreEqualArray $dnsServers $getAzureFirewallPolicy.DnsSettings.Servers
392+
Assert-AreEqual false $getAzureFirewallPolicy.DnsSettings.RequireProxyForNetworkRules
393+
394+
$azureFirewallPolicyAsJob = New-AzFirewallPolicy -Name $azureFirewallPolicyAsJobName -ResourceGroupName $rgname -Location $location -DnsSetting $dnsSettings -AsJob
395+
$result = $azureFirewallPolicyAsJob | Wait-Job
396+
Assert-AreEqual "Completed" $result.State;
397+
}
398+
finally {
399+
# Cleanup
400+
Clean-ResourceGroup $rgname
401+
}
402+
}
403+
404+
<#
405+
.SYNOPSIS
406+
Tests AzureFirewallPolicyCRUD.
407+
#>
408+
function Test-AzureFirewallPolicyCRUDWithNetworkRuleDestinationFQDNs {
409+
# Setup
410+
$rgname = Get-ResourceGroupName
411+
$azureFirewallPolicyName = Get-ResourceName
412+
$azureFirewallPolicyAsJobName = Get-ResourceName
413+
$resourceTypeParent = "Microsoft.Network/FirewallPolicies"
414+
$location = "eastus2euap"
415+
$dnsServers = @("10.10.10.1", "20.20.20.2")
416+
417+
$ruleGroupName = Get-ResourceName
418+
419+
# AzureFirewallPolicyNetworkRuleCollection
420+
$networkRcName = "networkRc"
421+
$networkRcPriority = 200
422+
$networkRcActionType = "Deny"
423+
424+
# AzureFirewallPolicyNetworkRule 1
425+
$networkRule1Name = "networkRule"
426+
$networkRule1Desc = "desc1"
427+
$networkRule1SourceAddress1 = "10.0.0.0"
428+
$networkRule1SourceAddress2 = "111.1.0.0/24"
429+
$networkRuleDestinationFqdns = "www.bing.com"
430+
$networkRule1Protocol1 = "UDP"
431+
$networkRule1Protocol2 = "TCP"
432+
$networkRule1Protocol3 = "ICMP"
433+
$networkRule1DestinationPort1 = "90"
434+
435+
$pipelineRcPriority = 154
436+
437+
try {
438+
# Create the resource group
439+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "testval" }
440+
441+
$dnsSettings = New-AzFirewallPolicyDnsSetting -EnableProxy -Server $dnsServers
442+
443+
# Create AzureFirewallPolicy (with DNS Settings)
444+
$azureFirewallPolicy = New-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname -Location $location -DnsSetting $dnsSettings
445+
446+
# Get AzureFirewallPolicy
447+
$getAzureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
448+
449+
#verification
450+
Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
451+
Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
452+
Assert-NotNull $getAzureFirewallPolicy.Location
453+
Assert-AreEqual (Normalize-Location $location) $getAzureFirewallPolicy.Location
454+
Assert-AreEqual "Alert" $getAzureFirewallPolicy.ThreatIntelMode
455+
456+
# Create Network Rule
457+
$networkRule = New-AzFirewallPolicyNetworkRule -Name $networkRule1Name -Description $networkRule1Desc -Protocol $networkRule1Protocol1, $networkRule1Protocol2 -SourceAddress $networkRule1SourceAddress1, $networkRule1SourceAddress2 -DestinationFqdn $networkRuleDestinationFqdns -DestinationPort $networkRule1DestinationPort1
458+
459+
# Create a second Filter Rule Collection with 1 network rule
460+
$netRc1 = New-AzFirewallPolicyFilterRuleCollection -Name $networkRcName -Priority $networkRcPriority -Rule $networkRule -ActionType $networkRcActionType
461+
462+
New-AzFirewallPolicyRuleCollectionGroup -Name $ruleGroupName -Priority 100 -RuleCollection $netRc1 -FirewallPolicyObject $azureFirewallPolicy
463+
464+
# Set AzureFirewallPolicy
465+
Set-AzFirewallPolicy -InputObject $azureFirewallPolicy
466+
# Get AzureFirewallPolicy
467+
$getAzureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgName
468+
469+
# verification
470+
Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName
471+
Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name
472+
Assert-NotNull $getAzureFirewallPolicy.Location
473+
Assert-AreEqual $location $getAzureFirewallPolicy.Location
474+
Assert-NotNull $getAzureFirewallPolicy.DnsSettings
475+
476+
# Check rule collection groups count
477+
Assert-AreEqual 1 @($getAzureFirewallPolicy.RuleCollectionGroups).Count
478+
479+
$getRg = Get-AzFirewallPolicyRuleCollectionGroup -Name $ruleGroupName -AzureFirewallPolicy $getAzureFirewallPolicy
480+
481+
Assert-AreEqual 1 @($getRg.properties.ruleCollection).Count
482+
483+
$filterRuleCollection = $getRg.Properties.GetRuleCollectionByName($networkRcName)
484+
485+
# Verify Filter Rule Collection
486+
Assert-AreEqual $networkRcName $filterRuleCollection.Name
487+
Assert-AreEqual $networkRcPriority $filterRuleCollection.Priority
488+
Assert-AreEqual $networkRcActionType $filterRuleCollection.Action.Type
489+
Assert-AreEqual 1 $filterRuleCollection.Rules.Count
490+
491+
$networkRule = $filterRuleCollection.GetRuleByName($networkRule1Name)
492+
# Verify Network rule
493+
Assert-AreEqual $networkRule1Name $networkRule.Name
494+
495+
Assert-AreEqual 2 $networkRule.SourceAddresses.Count
496+
Assert-AreEqual $networkRule1SourceAddress1 $networkRule.SourceAddresses[0]
497+
Assert-AreEqual $networkRule1SourceAddress2 $networkRule.SourceAddresses[1]
498+
499+
Assert-AreEqual 2 $networkRule.Protocols.Count
500+
Assert-AreEqual $networkRule1Protocol1 $networkRule.Protocols[0]
501+
Assert-AreEqual $networkRule1Protocol2 $networkRule.Protocols[1]
502+
503+
Assert-AreEqual 1 $networkRule.DestinationPorts.Count
504+
Assert-AreEqual $networkRule1DestinationPort1 $networkRule.DestinationPorts[0]
505+
506+
Assert-Null $networkRule.DestinationAddresses
507+
Assert-AreEqual 1 $networkRule.DestinationFqdns.Count
508+
509+
510+
$testPipelineRg = Get-AzFirewallPolicyRuleCollectionGroup -Name $ruleGroupName -AzureFirewallPolicyName $getAzureFirewallPolicy.Name -ResourceGroupName $rgname
511+
$testPipelineRg|Set-AzFirewallPolicyRuleCollectionGroup -Priority $pipelineRcPriority
512+
$testPipelineRg = Get-AzFirewallPolicyRuleCollectionGroup -Name $ruleGroupName -AzureFirewallPolicyName $getAzureFirewallPolicy.Name -ResourceGroupName $rgname
513+
Assert-AreEqual $pipelineRcPriority $testPipelineRg.properties.Priority
514+
515+
$azureFirewallPolicyAsJob = New-AzFirewallPolicy -Name $azureFirewallPolicyAsJobName -ResourceGroupName $rgname -Location $location -AsJob
516+
$result = $azureFirewallPolicyAsJob | Wait-Job
517+
Assert-AreEqual "Completed" $result.State
518+
}
519+
finally {
520+
# Cleanup
521+
Clean-ResourceGroup $rgname
522+
}
523+
}
524+

0 commit comments

Comments
 (0)