Skip to content

Commit 4d682e1

Browse files
bbiggerrbbiggerr
authored
Merge pull request #405 from bbiggerr/firewalls-update-2021-03
[Update] Firewalls endpoints
2 parents 7563e7b + 828f11c commit 4d682e1

File tree

1 file changed

+80
-49
lines changed

1 file changed

+80
-49
lines changed

‎openapi.yaml

Lines changed: 80 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -9973,14 +9973,12 @@ paths:
99739973
Firewall to a Linode service. Currently, Firewalls can only be assigned to Linode
99749974
instances.
99759975

9976-
A Firewall can be assigned to multiple Linode services, and up to five active Firewalls
9977-
can be assigned to a single Linode service.
9976+
A Firewall can be assigned to a single Linode service at a time.
99789977

99799978
A `firewall_create` Event is generated when this endpoint returns successfully.
99809979

99819980
This endpoint is in **beta**.
99829981

9983-
99849982
* Gain access to [Linode Cloud Firewall](https://www.linode.com/products/firewall/) by signing up for our [Greenlight Beta program](https://www.linode.com/green-light/#sign-up-form).
99859983
* During the beta, Cloud Firewall is not available in every [data center region](/docs/api/regions). For the current list of availability, see the [Cloud Firewall Product Documentation](https://www.linode.com/docs/products/networking/cloud-firewall/).
99869984
* Please make sure to prepend all requests with
@@ -9998,25 +9996,22 @@ paths:
99989996
content:
99999997
application/json:
100009998
schema:
10001-
type: object
9999+
allOf:
10000+
- $ref: '#/components/schemas/Firewall'
1000210001
required:
10003-
- label
10004-
- rules
10002+
- label
10003+
- rules
10004+
- inbound_policy
10005+
- outbound_policy
10006+
- action
1000510007
properties:
10006-
label:
10007-
$ref: '#/components/schemas/Firewall/properties/label'
10008-
rules:
10009-
$ref: '#/components/schemas/Firewall/properties/rules'
10010-
tags:
10011-
$ref: '#/components/schemas/Firewall/properties/tags'
1001210008
devices:
1001310009
type: object
1001410010
description: >
1001510011
A Firewall Device assigns a Firewall to a Linode service. Currently, Firewalls
1001610012
can only be assigned to Linode instances.
1001710013

10018-
* A Firewall can be assigned to multiple Linode services, and up to five active Firewalls can
10019-
be assigned to a single Linode service.
10014+
* A Firewall can be assigned to a single Linode service at a time.
1002010015

1002110016
* Additional disabled Firewalls can be assigned to a service, but they cannot be enabled if five other active Firewalls
1002210017
are already assigned to the same service.
@@ -10052,41 +10047,46 @@ paths:
1005210047
-X POST -d '{
1005310048
"label": "firewall123",
1005410049
"rules": {
10050+
"inbound_policy": "DROP",
1005510051
"inbound": [
1005610052
{
1005710053
"protocol": "TCP",
1005810054
"ports": "22, 80, 443",
1005910055
"addresses": {
1006010056
"ipv4": [
10061-
"192.0.2.1",
1006210057
"192.0.2.0/24"
1006310058
],
1006410059
"ipv6": [
1006510060
"2001:DB8::/32"
1006610061
]
10067-
}
10062+
},
10063+
"action": "ACCEPT",
10064+
"label": "inbound-rule123",
10065+
"description": "An example inbound rule description."
1006810066
}
1006910067
],
10068+
"outbound_policy": "DROP"
1007010069
"outbound": [
1007110070
{
1007210071
"protocol": "TCP",
1007310072
"ports": "49152-65535",
1007410073
"addresses": {
1007510074
"ipv4": [
10076-
"192.0.2.1",
1007710075
"192.0.2.0/24"
1007810076
],
1007910077
"ipv6": [
1008010078
"2001:DB8::/32"
1008110079
]
10082-
}
10080+
},
10081+
"action": "ACCEPT",
10082+
"label": "outbound-rule123",
10083+
"description": "An example outbound rule description."
1008310084
}
1008410085
]
1008510086
},
1008610087
"devices": {
1008710088
"linodes": [
10088-
123,
10089-
456
10089+
123
1009010090
]
1009110091
},
1009210092
"tags": [
@@ -10358,10 +10358,9 @@ paths:
1035810358
description: |
1035910359
Creates a Firewall Device, which assigns a Firewall to a Linode service (referred to
1036010360
as the Device's `entity`). Currently, only Devices with an entity of type `linode` are accepted.
10361-
A Firewall can be assigned to multiple Linode services, and up to five active Firewalls can
10362-
be assigned to a single Linode service. Additional disabled Firewalls can be
10363-
assigned to a service, but they cannot be enabled if five other active Firewalls
10364-
are already assigned to the same service.
10361+
A Firewall can be assigned a single Linode service at a time. Additional disabled Firewalls can be
10362+
assigned to a service, but they cannot be enabled if another active Firewall
10363+
is already assigned to the same service.
1036510364

1036610365
Creating a Firewall Device will apply the Rules from a Firewall to a Linode service.
1036710366
A `firewall_device_add` Event is generated when the Firewall Device is added successfully.
@@ -10629,34 +10628,40 @@ paths:
1062910628
curl -H "Content-Type: application/json" \
1063010629
-H "Authorization: Bearer $TOKEN" \
1063110630
-X PUT -d '{
10631+
"inbound_policy": "DROP",
1063210632
"inbound": [
1063310633
{
1063410634
"protocol": "TCP",
1063510635
"ports": "22, 80, 443",
10636-
"addresses": {
10636+
"addresses": {
1063710637
"ipv4": [
10638-
"192.0.2.1",
1063910638
"192.0.2.0/24"
1064010639
],
1064110640
"ipv6": [
1064210641
"2001:DB8::/32"
1064310642
]
10644-
}
10643+
},
10644+
"action": "ACCEPT",
10645+
"label": "inbound-rule123",
10646+
"description": "An example inbound rule description."
1064510647
}
1064610648
],
10649+
"outbound_policy": "DROP"
1064710650
"outbound": [
1064810651
{
1064910652
"protocol": "TCP",
1065010653
"ports": "49152-65535",
1065110654
"addresses": {
1065210655
"ipv4": [
10653-
"192.0.2.1",
1065410656
"192.0.2.0/24"
1065510657
],
1065610658
"ipv6": [
1065710659
"2001:DB8::/32"
1065810660
]
10659-
}
10661+
},
10662+
"action": "ACCEPT",
10663+
"label": "outbound-rule123",
10664+
"description": "An example outbound rule description."
1066010665
}
1066110666
]
1066210667
}' \
@@ -16708,8 +16713,7 @@ components:
1670816713
Firewall:
1670916714
type: object
1671016715
description: >
16711-
A resource that controls incoming and outgoing network traffic to a Linode service. A Firewall can
16712-
be assigned to multiple Linode services, and up to five active Firewalls can be assigned to a single Linode service.
16716+
A resource that controls incoming and outgoing network traffic to a Linode service. Only one Firewall can be attached to a Linode at any given time.
1671316717
[Create a Firewall Device](/docs/api/networking/#firewall-create)
1671416718
to assign a Firewall to a Linode service. Currently, Firewalls can only be assigned to Linode instances.
1671516719
properties:
@@ -16724,7 +16728,7 @@ components:
1672416728
label:
1672516729
x-linode-filterable: true
1672616730
type: string
16727-
description: >
16731+
description: |
1672816732
The Firewall's label, for display purposes only.
1672916733

1673016734
Firewall labels have the following constraints:
@@ -16763,7 +16767,7 @@ components:
1676316767
The status of this Firewall.
1676416768

1676516769
* When a Firewall is first created its status is `enabled`.
16766-
* Use the [Update Firewall](/docs/api/networking/#firewall-update) endpoint to set a Firewall's status to `enbaled` or `disabled`.
16770+
* Use the [Update Firewall](/docs/api/networking/#firewall-update) endpoint to set a Firewall's status to `enabled` or `disabled`.
1676716771
* Use the [Delete Firewall](/docs/api/networking/#firewall-delete) endpoint to delete a Firewall.
1676816772
enum:
1676916773
- enabled
@@ -16776,13 +16780,6 @@ components:
1677616780
description: |
1677716781
The inbound and outbound access rules to apply to the Firewall.
1677816782

16779-
* A minimum of one open inbound rule is required. Any inbound
16780-
traffic that is not permitted by your rules will be blocked.
16781-
* Outbound rules are optional. When no outbound rules are specified,
16782-
all outbound traffic is allowed. If one or more outbound rules are
16783-
specified, all outbound traffic that is not permitted by your rules
16784-
will be blocked.
16785-
1678616783
A Firewall may have up to 25 rules across its inbound and outbound rulesets.
1678716784
properties:
1678816785
inbound:
@@ -16793,8 +16790,22 @@ components:
1679316790
type: array
1679416791
items:
1679516792
$ref: '#/components/schemas/FirewallRuleConfig'
16796-
required:
16797-
- inbound
16793+
inbound_policy:
16794+
type: string
16795+
enum:
16796+
- ACCEPT
16797+
- DROP
16798+
description: |
16799+
The default behavior for inbound traffic. This setting can be overridden by [updating](/docs/api/networking/#firewall-rules-update) the `inbound.action` property of the Firewall Rule.
16800+
example: DROP
16801+
outbound_policy:
16802+
type: string
16803+
enum:
16804+
- ACCEPT
16805+
- DROP
16806+
description: |
16807+
The default behavior for outbound traffic. This setting can be overridden by [updating](/docs/api/networking/#firewall-rules-update) the `action` property for an individual Firewall Rule.
16808+
example: DROP
1679816809
tags:
1679916810
x-linode-filterable: true
1680016811
description: >
@@ -16847,28 +16858,48 @@ components:
1684716858
are treated as equivalent when accounting for this limit.
1684816859
properties:
1684916860
ipv4:
16850-
description: A list of IPv4 addresses or networks.
16861+
description: A list of IPv4 addresses or networks. Must be in IP/mask format.
1685116862
type: array
1685216863
items:
1685316864
type: string
1685416865
example:
16855-
- 192.0.2.1
1685616866
- 192.0.2.0/24
1685716867
ipv6:
16858-
description: A list of IPv6 addresses or networks.
16868+
description: A list of IPv6 addresses or networks. Must be in IP/mask format.
1685916869
type: array
1686016870
items:
1686116871
type: string
1686216872
example:
1686316873
- 2001:DB8::/32
16874+
action:
16875+
type: string
16876+
enum:
16877+
- ACCEPT
16878+
- DROP
16879+
description: |
16880+
Controls whether traffic is accepted or dropped by this rule. Overrides the Firewall's `inbound_policy` if this is an inbound rule, or the `outbound_policy` if this is an outbound rule.
16881+
example: ACCEPT
16882+
label:
16883+
type: string
16884+
description: |
16885+
Used to identify this rule. For display purposes only.
16886+
example: firewallrule123
16887+
minLength: 3
16888+
maxLength: 32
16889+
description:
16890+
type: string
16891+
description: |
16892+
Used to describe this rule. For display purposes only.
16893+
example: 'An example firewall rule description.'
16894+
minLength: 1
16895+
maxLength: 100
1686416896
FirewallDevices:
1686516897
type: object
1686616898
description: >
1686716899
Associates a Firewall with a Linode service. A Firewall can be assigned
16868-
to multiple Linode services, and up to five active Firewalls can
16869-
be assigned to a single Linode service. Additional disabled Firewalls can be
16870-
assigned to a service, but they cannot be enabled if five other active Firewalls
16871-
are already assigned to the same service.
16900+
to a single Linode service at a time. Additional disabled Firewalls can be
16901+
assigned to a service, but they cannot be enabled if another active Firewall
16902+
is already assigned to the same service.
1687216903
properties:
1687316904
id:
1687416905
x-linode-filterable: true

0 commit comments

Comments
 (0)