Skip to content

Commit 4548cbe

Browse files
msJinLeimsJinLei
authored
Merge pull request Azure#10197 from venkatsvpr/network-september
Toplevel waf powershell changes
2 parents fb3895d + 0ed0fce commit 4548cbe

File tree

46 files changed

+24390
-25
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+24390
-25
lines changed

‎src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.cs

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,5 +105,21 @@ public void TestApplicationGatewayCRUDRewriteRuleSetWithConditions()
105105
{
106106
TestRunner.RunTestScript(string.Format("Test-ApplicationGatewayCRUDRewriteRuleSetWithConditions -baseDir '{0}'", AppDomain.CurrentDomain.BaseDirectory));
107107
}
108+
109+
[Fact]
110+
[Trait(Category.AcceptanceType, Category.CheckIn)]
111+
[Trait(Category.Owner, NrpTeamAlias.nvadev)]
112+
public void TestTopLevelWafResourceWithApplicationGateway()
113+
{
114+
TestRunner.RunTestScript(string.Format("Test-ApplicationGatewayTopLevelFirewallPolicy -baseDir '{0}'", AppDomain.CurrentDomain.BaseDirectory));
115+
}
116+
117+
[Fact]
118+
[Trait(Category.AcceptanceType, Category.CheckIn)]
119+
[Trait(Category.Owner, NrpTeamAlias.nvadev)]
120+
public void TestApplicationGatewayWithFirewallPolicy()
121+
{
122+
TestRunner.RunTestScript(string.Format("Test-ApplicationGatewayWithFirewallPolicy -baseDir '{0}'", AppDomain.CurrentDomain.BaseDirectory));
123+
}
108124
}
109125
}

‎src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.ps1

Lines changed: 473 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.ApplicationGatewayTests/TestApplicationGatewayWithFirewallPolicy.json

Lines changed: 10231 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.ApplicationGatewayTests/TestTopLevelWafResourceWithApplicationGateway.json

Lines changed: 11887 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/ApplicationGateway/HttpListener/AzureApplicationGatewayHttpListenerBase.cs

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,16 @@ public class AzureApplicationGatewayHttpListenerBase : NetworkBaseCmdlet
5858
[ValidateNotNullOrEmpty]
5959
public string SslCertificateId { get; set; }
6060

61+
[Parameter(
62+
ParameterSetName = "SetByResourceId",
63+
HelpMessage = "FirewallPolicyId")]
64+
public string FirewallPolicyId { get; set; }
65+
66+
[Parameter(
67+
ParameterSetName = "SetByResource",
68+
HelpMessage = "FirewallPolicy")]
69+
public PSApplicationGatewayWebApplicationFirewallPolicy FirewallPolicy { get; set; }
70+
6171
[Parameter(
6272
ParameterSetName = "SetByResource",
6373
HelpMessage = "Application gateway SslCertificate")]
@@ -97,14 +107,21 @@ public override void ExecuteCmdlet()
97107
{
98108
this.FrontendIPConfigurationId = this.FrontendIPConfiguration.Id;
99109
}
110+
100111
if (FrontendPort != null)
101112
{
102113
this.FrontendPortId = this.FrontendPort.Id;
103114
}
115+
104116
if (SslCertificate != null)
105117
{
106118
this.SslCertificateId = this.SslCertificate.Id;
107119
}
120+
121+
if (FirewallPolicy != null)
122+
{
123+
this.FirewallPolicyId = this.FirewallPolicy.Id;
124+
}
108125
}
109126
}
110127

@@ -147,6 +164,12 @@ public PSApplicationGatewayHttpListener NewObject()
147164
httpListener.SslCertificate.Id = this.SslCertificateId;
148165
}
149166

167+
if (!string.IsNullOrEmpty(this.FirewallPolicyId))
168+
{
169+
httpListener.FirewallPolicy = new PSResourceId();
170+
httpListener.FirewallPolicy.Id = this.FirewallPolicyId;
171+
}
172+
150173
if (this.CustomErrorConfiguration != null)
151174
{
152175
httpListener.CustomErrorConfigurations = this.CustomErrorConfiguration?.ToList();

‎src/Network/Network/ApplicationGateway/PathRule/AzureApplicationGatewayPathRuleConfigBase.cs

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,17 @@ public class AzureApplicationGatewayPathRuleConfigBase : NetworkBaseCmdlet
8080
HelpMessage = "Application gateway RedirectConfiguration")]
8181
[ValidateNotNullOrEmpty]
8282
public PSApplicationGatewayRedirectConfiguration RedirectConfiguration { get; set; }
83+
84+
[Parameter(
85+
ParameterSetName = "SetByResourceId",
86+
HelpMessage = "FirewallPolicyId")]
87+
public string FirewallPolicyId { get; set; }
8388

89+
[Parameter(
90+
ParameterSetName = "SetByResource",
91+
HelpMessage = "FirewallPolicy")]
92+
public PSApplicationGatewayWebApplicationFirewallPolicy FirewallPolicy { get; set; }
93+
8494
public override void ExecuteCmdlet()
8595
{
8696
base.ExecuteCmdlet();
@@ -91,18 +101,26 @@ public override void ExecuteCmdlet()
91101
{
92102
this.BackendAddressPoolId = this.BackendAddressPool.Id;
93103
}
104+
94105
if (BackendHttpSettings != null)
95106
{
96107
this.BackendHttpSettingsId = this.BackendHttpSettings.Id;
97108
}
109+
98110
if (RewriteRuleSet != null)
99111
{
100112
this.RewriteRuleSetId = this.RewriteRuleSet.Id;
101113
}
114+
102115
if (RedirectConfiguration != null)
103116
{
104117
this.RedirectConfigurationId = this.RedirectConfiguration.Id;
105118
}
119+
120+
if (FirewallPolicy != null)
121+
{
122+
this.FirewallPolicyId = this.FirewallPolicy.Id;
123+
}
106124
}
107125
}
108126

@@ -136,6 +154,12 @@ public PSApplicationGatewayPathRule NewObject()
136154
pathRule.RedirectConfiguration = new PSResourceId();
137155
pathRule.RedirectConfiguration.Id = this.RedirectConfigurationId;
138156
}
157+
158+
if (!string.IsNullOrEmpty(this.FirewallPolicyId))
159+
{
160+
pathRule.FirewallPolicy = new PSResourceId();
161+
pathRule.FirewallPolicy.Id = this.FirewallPolicyId;
162+
}
139163

140164
return pathRule;
141165
}

‎src/Network/Network/Az.Network.psd1

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,13 @@ CmdletsToExport = 'Add-AzApplicationGatewayAuthenticationCertificate',
110110
'New-AzApplicationGatewayFirewallPolicy',
111111
'Get-AzApplicationGatewayFirewallPolicy',
112112
'Remove-AzApplicationGatewayFirewallPolicy',
113-
'Set-AzApplicationGatewayFirewallPolicy',
113+
'Set-AzApplicationGatewayFirewallPolicy',
114+
'New-AzApplicationGatewayFirewallPolicyExclusion',
115+
'New-AzApplicationGatewayFirewallPolicyManagedRule',
116+
'New-AzApplicationGatewayFirewallPolicyManagedRuleOverride',
117+
'New-AzApplicationGatewayFirewallPolicyManagedRuleGroupOverride',
118+
'New-AzApplicationGatewayFirewallPolicyManagedRuleSet',
119+
'New-AzApplicationGatewayFirewallPolicySetting',
114120
'Add-AzApplicationGatewayFrontendIPConfig',
115121
'Get-AzApplicationGatewayFrontendIPConfig',
116122
'New-AzApplicationGatewayFrontendIPConfig',

‎src/Network/Network/ChangeLog.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,22 @@
5757
- Update-AzureRmVpnConnection : added parameter EnableInternetSecurity
5858
- New-AzureRmExpressRouteConnection : added parameter EnableInternetSecurity
5959
- Set-AzureRmExpressRouteConnection : added parameter EnableInternetSecurity
60+
* Add support for Configuring TopLevel WebApplicationFirewall Policy
61+
- New cmdlets added:
62+
- New-AzApplicationGatewayFirewallPolicySetting
63+
- New-AzApplicationGatewayFirewallPolicyExclusion
64+
- New-AzApplicationGatewayFirewallPolicyManagedRuleGroupOverride
65+
- New-AzApplicationGatewayFirewallPolicyManagedRuleOverride
66+
- New-AzApplicationGatewayFirewallPolicyManagedRule
67+
- New-AzApplicationGatewayFirewallPolicyManagedRuleSet
68+
- Cmdlets updated with optional parameters:
69+
- New-AzApplicationGatewayFirewallPolicy : added parameter PolicySetting, ManagedRule
70+
* Added support for Geo-Match operator on CustomRule
71+
- Added GeoMatch to the operator on the FirewallCondition
72+
* Added support for perListener and perSite Firewall policy
73+
- Cmdlets updated with optional parameters:
74+
- New-AzApplicationGatewayHttpListener : added parameter FirewallPolicy, FirewallPolicyId
75+
- New-AzApplicationGatewayPathRuleConfig : added parameter FirewallPolicy, FirewallPolicyId
6076
* Fix required subnet with name AzureBastionSubnet in `PSBastion` can be case insensitive
6177
* Support for Destination FQDNs in Network Rules and Translated FQDN in NAT Rules for Azure Firewall
6278
* Add support for top level resource RouteTables of IpGroup

‎src/Network/Network/Common/NetworkResourceManagerProfile.cs

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -916,6 +916,12 @@ private static void Initialize()
916916
cfg.CreateMap<CNM.PSApplicationGatewayFirewallCustomRule, MNM.WebApplicationFirewallCustomRule>();
917917
cfg.CreateMap<CNM.PSApplicationGatewayFirewallMatchVariable, MNM.MatchVariable>();
918918
cfg.CreateMap<CNM.PSApplicationGatewayWebApplicationFirewallPolicy, MNM.WebApplicationFirewallPolicy>();
919+
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicySettings, MNM.PolicySettings>();
920+
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyManagedRules, MNM.ManagedRulesDefinition>();
921+
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyManagedRuleSet, MNM.ManagedRuleSet>();
922+
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyManagedRuleGroupOverride, MNM.ManagedRuleGroupOverride>();
923+
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyManagedRuleOverride, MNM.ManagedRuleOverride>();
924+
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyExclusion, MNM.ApplicationGatewayFirewallExclusion>();
919925
cfg.CreateMap<CNM.PSApplicationGatewayConnectionDraining, MNM.ApplicationGatewayConnectionDraining>();
920926
cfg.CreateMap<CNM.PSApplicationGatewayFirewallDisabledRuleGroup, MNM.ApplicationGatewayFirewallDisabledRuleGroup>()
921927
.AfterMap((src, dest) => dest.Rules = (src.Rules == null) ? null : dest.Rules);
@@ -972,6 +978,12 @@ private static void Initialize()
972978
cfg.CreateMap<MNM.WebApplicationFirewallCustomRule, CNM.PSApplicationGatewayFirewallCustomRule>();
973979
cfg.CreateMap<MNM.MatchVariable, CNM.PSApplicationGatewayFirewallMatchVariable>();
974980
cfg.CreateMap<MNM.WebApplicationFirewallPolicy, CNM.PSApplicationGatewayWebApplicationFirewallPolicy>();
981+
cfg.CreateMap<MNM.PolicySettings, CNM.PSApplicationGatewayFirewallPolicySettings>();
982+
cfg.CreateMap<MNM.ManagedRulesDefinition, CNM.PSApplicationGatewayFirewallPolicyManagedRules>();
983+
cfg.CreateMap<MNM.ManagedRuleSet, CNM.PSApplicationGatewayFirewallPolicyManagedRuleSet>();
984+
cfg.CreateMap<MNM.ManagedRuleGroupOverride, CNM.PSApplicationGatewayFirewallPolicyManagedRuleGroupOverride>();
985+
cfg.CreateMap<MNM.ManagedRuleOverride, CNM.PSApplicationGatewayFirewallPolicyManagedRuleOverride>();
986+
cfg.CreateMap<MNM.ApplicationGatewayFirewallExclusion, CNM.PSApplicationGatewayFirewallPolicyExclusion>();
975987
cfg.CreateMap<MNM.ApplicationGatewayConnectionDraining, CNM.PSApplicationGatewayConnectionDraining>();
976988
cfg.CreateMap<MNM.ApplicationGatewayFirewallDisabledRuleGroup, CNM.PSApplicationGatewayFirewallDisabledRuleGroup>()
977989
.AfterMap((src, dest) => dest.Rules = (src.Rules == null) ? null : dest.Rules);

‎src/Network/Network/FirewallPolicy/ApplicationGatewayFirewallPolicyBaseCmdlet.cs

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,7 @@ public PSApplicationGatewayWebApplicationFirewallPolicy GetApplicationGatewayFir
6767
public PSApplicationGatewayWebApplicationFirewallPolicy ToPsApplicationGatewayFirewallPolicy(WebApplicationFirewallPolicy firewallPolicy)
6868
{
6969
var psFirewallPolicy = NetworkResourceManagerProfile.Mapper.Map<PSApplicationGatewayWebApplicationFirewallPolicy>(firewallPolicy);
70-
7170
psFirewallPolicy.Tag = TagsConversionHelper.CreateTagHashtable(firewallPolicy.Tags);
72-
7371
return psFirewallPolicy;
7472
}
7573
}

‎src/Network/Network/FirewallPolicy/FirewallCondition/AzureApplicationGatewayFirewallConditionBase.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public class AzureApplicationGatewayFirewallConditionBase : NetworkBaseCmdlet
3131
[Parameter(
3232
Mandatory = true,
3333
HelpMessage = "Describes operator to be matched.")]
34-
[ValidateSet("IPMatch", "Equal", "Contains", "LessThan", "GreaterThan", "LessThanOrEqual", "GreaterThanOrEqual", "BeginsWith", "EndsWith", "Regex", IgnoreCase = true)]
34+
[ValidateSet("IPMatch", "Equal", "Contains", "LessThan", "GreaterThan", "LessThanOrEqual", "GreaterThanOrEqual", "BeginsWith", "EndsWith", "Regex", "GeoMatch", IgnoreCase = true)]
3535
[ValidateNotNullOrEmpty]
3636
public string Operator { get; set; }
3737

‎src/Network/Network/FirewallPolicy/ManagedRules/AzureApplicationGatewayFirewallPolicyManagedRules.cs

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.Network.Models;
16+
using System.Collections.Generic;
17+
using System.Linq;
18+
using System.Management.Automation;
19+
20+
namespace Microsoft.Azure.Commands.Network
21+
{
22+
public class AzureApplicationGatewayFirewallPolicyManagedRules : NetworkBaseCmdlet
23+
{
24+
[Parameter(
25+
Mandatory = false,
26+
HelpMessage = "List of Managed ruleSets.")]
27+
[ValidateNotNullOrEmpty]
28+
public PSApplicationGatewayFirewallPolicyManagedRuleSet[] ManagedRuleSet { get; set; }
29+
30+
[Parameter(
31+
Mandatory = false,
32+
HelpMessage = "List of Exclusion Entry.")]
33+
[ValidateNotNullOrEmpty]
34+
public PSApplicationGatewayFirewallPolicyExclusion[] Exclusion { get; set; }
35+
36+
public override void ExecuteCmdlet()
37+
{
38+
base.ExecuteCmdlet();
39+
}
40+
41+
protected PSApplicationGatewayFirewallPolicyManagedRules NewObject()
42+
{
43+
var managedRules = new PSApplicationGatewayFirewallPolicyManagedRules()
44+
{
45+
Exclusions = this.Exclusion?.ToList(),
46+
ManagedRuleSets = this.ManagedRuleSet?.ToList()
47+
};
48+
49+
if (this.ManagedRuleSet == null || this.ManagedRuleSet.Count() == 0)
50+
{
51+
managedRules.ManagedRuleSets = new List<PSApplicationGatewayFirewallPolicyManagedRuleSet>()
52+
{
53+
new PSApplicationGatewayFirewallPolicyManagedRuleSet()
54+
{
55+
RuleSetType = "OWASP",
56+
RuleSetVersion = "3.0"
57+
}
58+
};
59+
}
60+
61+
return managedRules;
62+
}
63+
}
64+
}

‎src/Network/Network/FirewallPolicy/ManagedRules/Exclusion/AzureApplicationGatewayFirewallPolicyExclusion.cs

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.Network.Models;
16+
using System.Collections.Generic;
17+
using System.Management.Automation;
18+
19+
namespace Microsoft.Azure.Commands.Network
20+
{
21+
public class AzureApplicationGatewayFirewallPolicyExclusion : NetworkBaseCmdlet
22+
{
23+
[Parameter(
24+
Mandatory = true,
25+
HelpMessage = "MatchVariable on Exclusion entry.")]
26+
[ValidateSet("RequestHeaderNames", "RequestCookieNames", "RequestArgNames", IgnoreCase = true)]
27+
[ValidateNotNullOrEmpty]
28+
public string MatchVariable { get; set; }
29+
30+
[Parameter(
31+
Mandatory = true,
32+
HelpMessage = "Selector Match Operator.")]
33+
[ValidateSet("Equals", "Contains", "StartsWith", "EndsWith", "EqualsAny", IgnoreCase = true)]
34+
[ValidateNotNullOrEmpty]
35+
public string SelectorMatchOperator { get; set; }
36+
37+
[Parameter(
38+
Mandatory = true,
39+
HelpMessage = "Selector")]
40+
public string Selector { get; set; }
41+
42+
43+
public override void ExecuteCmdlet()
44+
{
45+
base.ExecuteCmdlet();
46+
}
47+
48+
protected PSApplicationGatewayFirewallPolicyExclusion NewObject()
49+
{
50+
return new PSApplicationGatewayFirewallPolicyExclusion()
51+
{
52+
MatchVariable = this.MatchVariable,
53+
SelectorMatchOperator = this.SelectorMatchOperator,
54+
Selector = this.Selector
55+
};
56+
}
57+
}
58+
}

‎src/Network/Network/FirewallPolicy/ManagedRules/Exclusion/NewAzureApplicationGatewayFirewallPolicyExclusionCommand.cs

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.Network.Models;
16+
using System.Management.Automation;
17+
18+
namespace Microsoft.Azure.Commands.Network
19+
{
20+
[Cmdlet("New", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "ApplicationGatewayFirewallPolicyExclusion"), OutputType(typeof(PSApplicationGatewayFirewallPolicyExclusion))]
21+
public class NewAzureApplicationGatewayFirewallPolicyExclusionCommand : AzureApplicationGatewayFirewallPolicyExclusion
22+
{
23+
public override void ExecuteCmdlet()
24+
{
25+
base.ExecuteCmdlet();
26+
WriteObject(base.NewObject());
27+
}
28+
}
29+
}

0 commit comments

Comments
 (0)