@@ -1855,7 +1855,6 @@ function Test-AvailableServerVariableAndHeader
1855
1855
Assert-True { $result.AvailableResponseHeader.Count -gt 0 }
1856
1856
}
1857
1857
1858
-
1859
1858
<#
1860
1859
. SYNOPSIS
1861
1860
Application gateway v2 top level waf tests
@@ -1935,7 +1934,6 @@ function Test-ApplicationGatewayTopLevelFirewallPolicy
1935
1934
$fp01 = New-AzApplicationGatewayFrontendPort - Name $frontendPort01Name - Port 80
1936
1935
$fp02 = New-AzApplicationGatewayFrontendPort - Name $frontendPort02Name - Port 443
1937
1936
$listener01 = New-AzApplicationGatewayHttpListener - Name $listener01Name - Protocol Http - FrontendIPConfiguration $fipconfig - FrontendPort $fp01 - RequireServerNameIndication false
1938
-
1939
1937
$pool = New-AzApplicationGatewayBackendAddressPool - Name $poolName - BackendIPAddresses www.microsoft.com , www.bing.com
1940
1938
$poolSetting01 = New-AzApplicationGatewayBackendHttpSettings - Name $poolSetting01Name - Port 443 - Protocol Https - CookieBasedAffinity Enabled - PickHostNameFromBackendAddress
1941
1939
@@ -2030,6 +2028,240 @@ function Test-ApplicationGatewayTopLevelFirewallPolicy
2030
2028
$wafPolicyName = " wafPolicy1"
2031
2029
New-AzApplicationGatewayFirewallPolicy - Name $wafPolicyName - ResourceGroupName $rgname - Location $location - ManagedRule $managedRule - PolicySetting $policySettings
2032
2030
2031
+ # Get Application Gateway
2032
+ $appgw = Get-AzApplicationGateway - Name $appgwName - ResourceGroupName $rgname
2033
+ $policy = Get-AzApplicationGatewayFirewallPolicy - Name $wafPolicyName - ResourceGroupName $rgname
2034
+ $appgw.FirewallPolicy = $policy
2035
+ $appgw = Set-AzApplicationGateway - ApplicationGateway $appgw
2036
+
2037
+ $policy = Get-AzApplicationGatewayFirewallPolicy - Name $wafPolicyName - ResourceGroupName $rgname
2038
+ $policy.CustomRules = $rule
2039
+ Set-AzApplicationGatewayFirewallPolicy - InputObject $policy
2040
+
2041
+ $appgw = Get-AzApplicationGateway - Name $appgwName - ResourceGroupName $rgname
2042
+ $policy = Get-AzApplicationGatewayFirewallPolicy - Name $wafPolicyName - ResourceGroupName $rgname
2043
+
2044
+ # Second check firewll policy
2045
+ Assert-AreEqual $policy.Id $appgw.FirewallPolicy.Id
2046
+ Assert-AreEqual $policy.CustomRules [0 ].Name $rule.Name
2047
+ Assert-AreEqual $policy.CustomRules [0 ].RuleType $rule.RuleType
2048
+ Assert-AreEqual $policy.CustomRules [0 ].Action $rule.Action
2049
+ Assert-AreEqual $policy.CustomRules [0 ].Priority $rule.Priority
2050
+ Assert-AreEqual $policy.CustomRules [0 ].MatchConditions[0 ].OperatorProperty $rule.MatchConditions [0 ].OperatorProperty
2051
+ Assert-AreEqual $policy.CustomRules [0 ].MatchConditions[0 ].Transforms[0 ] $rule.MatchConditions [0 ].Transforms[0 ]
2052
+ Assert-AreEqual $policy.CustomRules [0 ].MatchConditions[0 ].NegationConditon $rule.MatchConditions [0 ].NegationConditon
2053
+ Assert-AreEqual $policy.CustomRules [0 ].MatchConditions[0 ].MatchValues[0 ] $rule.MatchConditions [0 ].MatchValues[0 ]
2054
+ Assert-AreEqual $policy.CustomRules [0 ].MatchConditions[0 ].MatchVariables[0 ].VariableName $rule.MatchConditions [0 ].MatchVariables[0 ].VariableName
2055
+ Assert-AreEqual $policy.CustomRules [0 ].MatchConditions[0 ].MatchVariables[0 ].Selector $rule.MatchConditions [0 ].MatchVariables[0 ].Selector
2056
+ Assert-AreEqual $policy.PolicySettings.FileUploadLimitInMb $policySettings.FileUploadLimitInMb
2057
+ Assert-AreEqual $policy.PolicySettings.MaxRequestBodySizeInKb $policySettings.MaxRequestBodySizeInKb
2058
+ Assert-AreEqual $policy.PolicySettings.RequestBodyCheck $policySettings.RequestBodyCheck
2059
+ Assert-AreEqual $policy.PolicySettings.Mode $policySettings.Mode
2060
+ Assert-AreEqual $policy.PolicySettings.State $policySettings.State
2061
+
2062
+ # Add Exclusions and disabled rules to the firewall policy
2063
+ $exclusionEntry = New-AzApplicationGatewayFirewallPolicyExclusion - MatchVariable RequestArgNames - SelectorMatchOperator Contains - Selector Bingo
2064
+ $ruleOverrideEntry1 = New-AzApplicationGatewayFirewallPolicyManagedRuleOverride - RuleId 942100
2065
+ $ruleOverrideEntry2 = New-AzApplicationGatewayFirewallPolicyManagedRuleOverride - RuleId 942110
2066
+ $sqlRuleGroupOverrideEntry = New-AzApplicationGatewayFirewallPolicyManagedRuleGroupOverride - RuleGroupName REQUEST-942 - APPLICATION- ATTACK- SQLI - Rule $ruleOverrideEntry1 , $ruleOverrideEntry2
2067
+
2068
+ $ruleOverrideEntry3 = New-AzApplicationGatewayFirewallPolicyManagedRuleOverride - RuleId 941100
2069
+ $xssRuleGroupOverrideEntry = New-AzApplicationGatewayFirewallPolicyManagedRuleGroupOverride - RuleGroupName REQUEST-941 - APPLICATION- ATTACK- XSS - Rule $ruleOverrideEntry3
2070
+
2071
+ $managedRuleSet = New-AzApplicationGatewayFirewallPolicyManagedRuleSet - RuleSetType " OWASP" - RuleSetVersion " 3.0" - RuleGroupOverride $sqlRuleGroupOverrideEntry , $xssRuleGroupOverrideEntry
2072
+ $managedRules = New-AzApplicationGatewayFirewallPolicyManagedRule - ManagedRuleSet $managedRuleSet - Exclusion $exclusionEntry
2073
+ $policy = Get-AzApplicationGatewayFirewallPolicy - Name $wafPolicyName - ResourceGroupName $rgname
2074
+ $policySettings = New-AzApplicationGatewayFirewallPolicySetting - Mode Prevention - State Enabled - MaxFileUploadInMb 750 - MaxRequestBodySizeInKb 128
2075
+ $policy.managedRules = $managedRules
2076
+ $policy.PolicySettings = $policySettings
2077
+ Set-AzApplicationGatewayFirewallPolicy - InputObject $policy
2078
+
2079
+ # Get firewall policy
2080
+ $policy = Get-AzApplicationGatewayFirewallPolicy - Name $wafPolicyName - ResourceGroupName $rgname
2081
+ Assert-AreEqual $policy.ManagedRules.ManagedRuleSets.Count 1
2082
+ Assert-AreEqual $policy.ManagedRules.ManagedRuleSets [0 ].RuleGroupOverrides.Count 2
2083
+ Assert-AreEqual $policy.ManagedRules.Exclusions.Count 1
2084
+ Assert-AreEqual $policy.PolicySettings.FileUploadLimitInMb $policySettings.FileUploadLimitInMb
2085
+ Assert-AreEqual $policy.PolicySettings.MaxRequestBodySizeInKb $policySettings.MaxRequestBodySizeInKb
2086
+ Assert-AreEqual $policy.PolicySettings.RequestBodyCheck $policySettings.RequestBodyCheck
2087
+ Assert-AreEqual $policy.PolicySettings.Mode $policySettings.Mode
2088
+ Assert-AreEqual $policy.PolicySettings.State $policySettings.State
2089
+ }
2090
+ finally
2091
+ {
2092
+ # Cleanup
2093
+ Clean - ResourceGroup $rgname
2094
+ }
2095
+
2096
+ <#
2097
+ . SYNOPSIS
2098
+ Application gateway v2 top level waf tests
2099
+ #>
2100
+ function Test-ApplicationGatewayHttpListenerFirewallPolicy
2101
+ {
2102
+ param
2103
+ (
2104
+ $basedir = " ./"
2105
+ )
2106
+
2107
+ # Setup
2108
+ $location = Get-ProviderLocation " Microsoft.Network/applicationGateways" " West US 2"
2109
+
2110
+ $rgname = Get-ResourceGroupName
2111
+ $appgwName = Get-ResourceName
2112
+ $vnetName = Get-ResourceName
2113
+ $gwSubnetName = Get-ResourceName
2114
+ $vnetName2 = Get-ResourceName
2115
+ $gwSubnetName2 = Get-ResourceName
2116
+ $publicIpName = Get-ResourceName
2117
+ $gipconfigname = Get-ResourceName
2118
+
2119
+ $frontendPort01Name = Get-ResourceName
2120
+ $frontendPort02Name = Get-ResourceName
2121
+ $fipconfigName = Get-ResourceName
2122
+ $listener01Name = Get-ResourceName
2123
+ $listener02Name = Get-ResourceName
2124
+ $listener03Name = Get-ResourceName
2125
+
2126
+ $poolName = Get-ResourceName
2127
+ $poolName02 = Get-ResourceName
2128
+ $trustedRootCertName = Get-ResourceName
2129
+ $poolSetting01Name = Get-ResourceName
2130
+ $poolSetting02Name = Get-ResourceName
2131
+ $probeName = Get-ResourceName
2132
+
2133
+ $rule01Name = Get-ResourceName
2134
+ $rule02Name = Get-ResourceName
2135
+
2136
+ $customError403Url01 = " https://mycustomerrorpages.blob.core.windows.net/errorpages/403-another.htm"
2137
+ $customError403Url02 = " http://mycustomerrorpages.blob.core.windows.net/errorpages/403-another.htm"
2138
+
2139
+ $urlPathMapName = Get-ResourceName
2140
+ $urlPathMapName2 = Get-ResourceName
2141
+ $PathRuleName = Get-ResourceName
2142
+ $PathRule01Name = Get-ResourceName
2143
+ $redirectName = Get-ResourceName
2144
+ $sslCert01Name = Get-ResourceName
2145
+
2146
+ $rewriteRuleName = Get-ResourceName
2147
+ $rewriteRuleSetName = Get-ResourceName
2148
+
2149
+ try
2150
+ {
2151
+ $resourceGroup = New-AzResourceGroup - Name $rgname - Location $location - Tags @ { testtag = " APPGw tag" }
2152
+ # Create the Virtual Network
2153
+ $gwSubnet = New-AzVirtualNetworkSubnetConfig - Name $gwSubnetName - AddressPrefix 10.0 .0.0 / 24
2154
+ $vnet = New-AzVirtualNetwork - Name $vnetName - ResourceGroupName $rgname - Location $location - AddressPrefix 10.0 .0.0 / 16 - Subnet $gwSubnet
2155
+ $vnet = Get-AzVirtualNetwork - Name $vnetName - ResourceGroupName $rgname
2156
+ $gwSubnet = Get-AzVirtualNetworkSubnetConfig - Name $gwSubnetName - VirtualNetwork $vnet
2157
+
2158
+ $gwSubnet2 = New-AzVirtualNetworkSubnetConfig - Name $gwSubnetName2 - AddressPrefix 11.0 .1.0 / 24
2159
+ $vnet2 = New-AzVirtualNetwork - Name $vnetName2 - ResourceGroupName $rgname - Location $location - AddressPrefix 11.0 .0.0 / 8 - Subnet $gwSubnet2
2160
+ $vnet2 = Get-AzVirtualNetwork - Name $vnetName2 - ResourceGroupName $rgname
2161
+ $gwSubnet2 = Get-AzVirtualNetworkSubnetConfig - Name $gwSubnetName2 - VirtualNetwork $vnet2
2162
+
2163
+ # Create public ip
2164
+ $publicip = New-AzPublicIpAddress - ResourceGroupName $rgname - name $publicIpName - location $location - AllocationMethod Static - sku Standard
2165
+
2166
+ # Create ip configuration
2167
+ $gipconfig = New-AzApplicationGatewayIPConfiguration - Name $gipconfigname - Subnet $gwSubnet
2168
+
2169
+ $fipconfig = New-AzApplicationGatewayFrontendIPConfig - Name $fipconfigName - PublicIPAddress $publicip
2170
+ $fp01 = New-AzApplicationGatewayFrontendPort - Name $frontendPort01Name - Port 80
2171
+ $fp02 = New-AzApplicationGatewayFrontendPort - Name $frontendPort02Name - Port 443
2172
+ $listener01 = New-AzApplicationGatewayHttpListener - Name $listener01Name - Protocol Http - FrontendIPConfiguration $fipconfig - FrontendPort $fp01 - RequireServerNameIndication false
2173
+ $pool = New-AzApplicationGatewayBackendAddressPool - Name $poolName - BackendIPAddresses www.microsoft.com , www.bing.com
2174
+ $poolSetting01 = New-AzApplicationGatewayBackendHttpSettings - Name $poolSetting01Name - Port 443 - Protocol Https - CookieBasedAffinity Enabled - PickHostNameFromBackendAddress
2175
+
2176
+ # rule
2177
+ $rule01 = New-AzApplicationGatewayRequestRoutingRule - Name $rule01Name - RuleType basic - BackendHttpSettings $poolSetting01 - HttpListener $listener01 - BackendAddressPool $pool
2178
+
2179
+ # sku
2180
+ $sku = New-AzApplicationGatewaySku - Name WAF_v2 - Tier WAF_v2
2181
+
2182
+ $autoscaleConfig = New-AzApplicationGatewayAutoscaleConfiguration - MinCapacity 3
2183
+ Assert-AreEqual $autoscaleConfig.MinCapacity 3
2184
+
2185
+ $redirectConfig = New-AzApplicationGatewayRedirectConfiguration - Name $redirectName - RedirectType Permanent - TargetListener $listener01 - IncludePath $true - IncludeQueryString $true
2186
+ $headerConfiguration = New-AzApplicationGatewayRewriteRuleHeaderConfiguration - HeaderName " abc" - HeaderValue " def"
2187
+ $actionSet = New-AzApplicationGatewayRewriteRuleActionSet - RequestHeaderConfiguration $headerConfiguration
2188
+ $rewriteRule = New-AzApplicationGatewayRewriteRule - Name $rewriteRuleName - ActionSet $actionSet
2189
+ $rewriteRuleSet = New-AzApplicationGatewayRewriteRuleSet - Name $rewriteRuleSetName - RewriteRule $rewriteRule
2190
+ $videoPathRule = New-AzApplicationGatewayPathRuleConfig - Name $PathRuleName - Paths " /video" - RedirectConfiguration $redirectConfig - RewriteRuleSet $rewriteRuleSet
2191
+ Assert-AreEqual $videoPathRule.RewriteRuleSet.Id $rewriteRuleSet.Id
2192
+ $imagePathRule = New-AzApplicationGatewayPathRuleConfig - Name $PathRule01Name - Paths " /image" - RedirectConfigurationId $redirectConfig.Id - RewriteRuleSetId $rewriteRuleSet.Id
2193
+ Assert-AreEqual $imagePathRule.RewriteRuleSet.Id $rewriteRuleSet.Id
2194
+ $urlPathMap = New-AzApplicationGatewayUrlPathMapConfig - Name $urlPathMapName - PathRules $videoPathRule - DefaultBackendAddressPool $pool - DefaultBackendHttpSettings $poolSetting01
2195
+ $urlPathMap2 = New-AzApplicationGatewayUrlPathMapConfig - Name $urlPathMapName2 - PathRules $videoPathRule , $imagePathRule - DefaultRedirectConfiguration $redirectConfig - DefaultRewriteRuleSet $rewriteRuleSet
2196
+ $probe = New-AzApplicationGatewayProbeConfig - Name $probeName - Protocol Http - Path " /path/path.htm" - Interval 89 - Timeout 88 - UnhealthyThreshold 8 - MinServers 1 - PickHostNameFromBackendHttpSettings
2197
+
2198
+ # [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine")]
2199
+ $pw01 = ConvertTo-SecureString " P@ssw0rd" - AsPlainText - Force
2200
+ $sslCert01Path = $basedir + " /ScenarioTests/Data/ApplicationGatewaySslCert1.pfx"
2201
+ $sslCert = New-AzApplicationGatewaySslCertificate - Name $sslCert01Name - CertificateFile $sslCert01Path - Password $pw01
2202
+
2203
+ # Create Application Gateway
2204
+ $appgw = New-AzApplicationGateway - Name $appgwName - ResourceGroupName $rgname - Location $location - BackendAddressPools $pool - BackendHttpSettingsCollection $poolSetting01 - FrontendIpConfigurations $fipconfig - GatewayIpConfigurations $gipconfig - FrontendPorts $fp01 , $fp02 - HttpListeners $listener01 - RequestRoutingRules $rule01 - Sku $sku - AutoscaleConfiguration $autoscaleConfig - UrlPathMap $urlPathMap , $urlPathMap2 - RedirectConfiguration $redirectConfig - Probe $probe - SslCertificate $sslCert - RewriteRuleSet $rewriteRuleSet
2205
+ $certFilePath = $basedir + " /ScenarioTests/Data/ApplicationGatewayAuthCert.cer"
2206
+ $certFilePath2 = $basedir + " /Scenario/Data/TrustedRootCertificate.cer"
2207
+
2208
+ # Add
2209
+ $listener01 = Get-AzApplicationGatewayHttpListener - ApplicationGateway $appgw - Name $listener01Name
2210
+ Add-AzApplicationGatewayTrustedRootCertificate - ApplicationGateway $appgw - Name $trustedRootCertName - CertificateFile $certFilePath
2211
+ Add-AzApplicationGatewayHttpListenerCustomError - HttpListener $listener01 - StatusCode HttpStatus403 - CustomErrorPageUrl $customError403Url01
2212
+
2213
+ # Add to test Remove
2214
+ Add-AzApplicationGatewayBackendHttpSettings - ApplicationGateway $appgw - Name $poolSetting02Name - Port 1234 - Protocol Http - CookieBasedAffinity Enabled - RequestTimeout 42 - HostName test - Path / test - AffinityCookieName test
2215
+ $fipconfig = Get-AzApplicationGatewayFrontendIPConfig - ApplicationGateway $appgw - Name $fipconfigName
2216
+ Add-AzApplicationGatewayHttpListener - ApplicationGateway $appgw - Name $listener02Name - Protocol Https - FrontendIPConfiguration $fipconfig - FrontendPort $fp02 - HostName TestHostName - RequireServerNameIndication true - SslCertificate $sslCert
2217
+ $listener02 = Get-AzApplicationGatewayHttpListener - ApplicationGateway $appgw - Name $listener02Name
2218
+ Add-AzApplicationGatewayHttpListener - ApplicationGateway $appgw - Name $listener03Name - Protocol Https - FrontendIPConfiguration $fipconfig - FrontendPort $fp02 - HostName TestName - SslCertificate $sslCert
2219
+ $urlPathMap = Get-AzApplicationGatewayUrlPathMapConfig - ApplicationGateway $appgw - Name $urlPathMapName
2220
+ Add-AzApplicationGatewayRequestRoutingRule - ApplicationGateway $appgw - Name $rule02Name - RuleType PathBasedRouting - HttpListener $listener02 - UrlPathMap $urlPathMap
2221
+
2222
+ # Add twice
2223
+ Assert-ThrowsLike { Add-AzApplicationGatewayTrustedRootCertificate - ApplicationGateway $appgw - Name $trustedRootCertName - CertificateFile $certFilePath } " *already exists*"
2224
+ Assert-ThrowsLike { Add-AzApplicationGatewayHttpListenerCustomError - HttpListener $listener01 - StatusCode HttpStatus403 - CustomErrorPageUrl $customError403Url01 } " *already exists*"
2225
+
2226
+ # Add unsupported
2227
+ Assert-ThrowsLike { Add-AzApplicationGatewayBackendAddressPool - ApplicationGateway $appgw - Name $poolName02 - BackendIPAddresses www.microsoft.com - BackendFqdns www.bing.com } " *At most one of*can be specified*"
2228
+ Add-AzApplicationGatewayBackendAddressPool - ApplicationGateway $appgw - Name $poolName02 - BackendFqdns www.bing.com , www.microsoft.com
2229
+ $appgw = Set-AzApplicationGateway - ApplicationGateway $appgw
2230
+
2231
+ Assert-NotNull $appgw.HttpListeners [0 ].CustomErrorConfigurations
2232
+ Assert-NotNull $appgw.TrustedRootCertificates
2233
+ Assert-AreEqual $appgw.BackendHttpSettingsCollection.Count 2
2234
+ Assert-AreEqual $appgw.HttpListeners.Count 3
2235
+ Assert-AreEqual $appgw.RequestRoutingRules.Count 2
2236
+
2237
+ # Get
2238
+ $trustedCert = Get-AzApplicationGatewayTrustedRootCertificate - ApplicationGateway $appgw - Name $trustedRootCertName
2239
+ Assert-NotNull $trustedCert
2240
+
2241
+ # List
2242
+ $trustedCerts = Get-AzApplicationGatewayTrustedRootCertificate - ApplicationGateway $appgw
2243
+ Assert-NotNull $trustedCerts
2244
+ Assert-AreEqual $trustedCerts.Count 1
2245
+
2246
+ # Set
2247
+ $listener01 = Get-AzApplicationGatewayHttpListener - ApplicationGateway $appgw - Name $listener01Name
2248
+ Set-AzApplicationGatewayAutoscaleConfiguration - ApplicationGateway $appgw - MinCapacity 2
2249
+ Set-AzApplicationGatewayHttpListenerCustomError - HttpListener $listener01 - StatusCode HttpStatus403 - CustomErrorPageUrl $customError403Url02
2250
+ Set-AzApplicationGatewayWebApplicationFirewallConfiguration - ApplicationGateway $appgw - Enabled $true - FirewallMode Prevention - RuleSetType " OWASP" - RuleSetVersion " 3.0" - RequestBodyCheck $true - MaxRequestBodySizeInKb 70 - FileUploadLimitInMb 70
2251
+ Set-AzApplicationGatewayTrustedRootCertificate - ApplicationGateway $appgw - Name $trustedRootCertName - CertificateFile $certFilePath2
2252
+ $appgw = Set-AzApplicationGateway - ApplicationGateway $appgw
2253
+
2254
+ # WAF Policy and Custom Rule
2255
+ $variable = New-AzApplicationGatewayFirewallMatchVariable - VariableName RequestHeaders - Selector Content- Length
2256
+ $condition = New-AzApplicationGatewayFirewallCondition - MatchVariable $variable - Operator GreaterThan - MatchValue 1000 - Transform Lowercase - NegationCondition $False
2257
+ $rule = New-AzApplicationGatewayFirewallCustomRule - Name example - Priority 2 - RuleType MatchRule - MatchCondition $condition - Action Block
2258
+ $policySettings = New-AzApplicationGatewayFirewallPolicySetting - Mode Prevention - State Enabled - MaxFileUploadInMb 70 - MaxRequestBodySizeInKb 70
2259
+ $managedRuleSet = New-AzApplicationGatewayFirewallPolicyManagedRuleSet - RuleSetType " OWASP" - RuleSetVersion " 3.0"
2260
+ $managedRule = New-AzApplicationGatewayFirewallPolicyManagedRule - ManagedRuleSet $managedRuleSet
2261
+ $wafPolicyName = " wafPolicy1"
2262
+ New-AzApplicationGatewayFirewallPolicy - Name $wafPolicyName - ResourceGroupName $rgname - Location $location - ManagedRule $managedRule - PolicySetting $policySettings
2263
+
2264
+
2033
2265
# Get Application Gateway
2034
2266
$appgw = Get-AzApplicationGateway - Name $appgwName - ResourceGroupName $rgname
2035
2267
$policy = Get-AzApplicationGatewayFirewallPolicy - Name $wafPolicyName - ResourceGroupName $rgname
0 commit comments