Skip to content

Commit 22d6177

Browse files
Shawnli222wyunchi-msmsJinLei
authored
Log Scrubbing Feature for Application Gateway Firewall Policy Settings (#21568)
* 2 * 1 * 2 * 1 * 1 * 2 * 1 * 1 * 1 * 2 * 2 * 2 * 1 * 1 * 1 * 1 * 1 * 1 * 1 * 2 * 1 * 2 * 1 * 1 * 1 * 1 * 1 * test * sdk * name * staticanalysis * comment * revert * scrubbingrules * revert scrubbingrules change --------- Co-authored-by: Yunchi Wang <[email protected]> Co-authored-by: Jin Lei <[email protected]>
1 parent f7c280c commit 22d6177

16 files changed

+1256
-3
lines changed

‎src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,14 @@ public void TestApplicationGatewayWithFirewallPolicy()
156156
TestRunner.RunTestScript(string.Format("Test-ApplicationGatewayWithFirewallPolicy -baseDir '{0}'", AppDomain.CurrentDomain.BaseDirectory));
157157
}
158158

159+
[Fact]
160+
[Trait(Category.AcceptanceType, Category.CheckIn)]
161+
[Trait(Category.Owner, NrpTeamAlias.nvadev_subset1)]
162+
public void TestApplicationGatewayWithFirewallPolicyWithLogScrubbing()
163+
{
164+
TestRunner.RunTestScript(string.Format("Test-ApplicationGatewayFirewallPolicyWithLogScrubbing -baseDir '{0}'", AppDomain.CurrentDomain.BaseDirectory));
165+
}
166+
159167
[Fact]
160168
[Trait(Category.AcceptanceType, Category.CheckIn)]
161169
[Trait(Category.Owner, NrpTeamAlias.nvadev_subset1)]

‎src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.ps1

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3477,6 +3477,55 @@ function Test-ApplicationGatewayFirewallPolicyWithPerRuleExclusions
34773477
}
34783478
}
34793479

3480+
<#
3481+
.SYNOPSIS
3482+
Application gateway v2 waf policy with log scrubbing
3483+
#>
3484+
function Test-ApplicationGatewayFirewallPolicyWithLogScrubbing
3485+
{
3486+
# Setup
3487+
$location = Get-ProviderLocation "Microsoft.Network/applicationGateways" "West US 2"
3488+
3489+
$rgname = Get-ResourceGroupName
3490+
$wafPolicyName = Get-ResourceName
3491+
3492+
try
3493+
{
3494+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "APPGw tag"}
3495+
3496+
# WAF Policy and Custom Rule
3497+
$variable = New-AzApplicationGatewayFirewallMatchVariable -VariableName RequestHeaders -Selector Content-Length
3498+
$condition = New-AzApplicationGatewayFirewallCondition -MatchVariable $variable -Operator GreaterThan -MatchValue 1000 -Transform Lowercase -NegationCondition $False
3499+
$logScrubbingRule1 = New-AzApplicationGatewayFirewallPolicyLogScrubbingRule -State Enabled -MatchVariable RequestArgNames -SelectorMatchOperator Equals -Selector test
3500+
$logScrubbingRule2 = New-AzApplicationGatewayFirewallPolicyLogScrubbingRule -State Enabled -MatchVariable RequestIPAddress -SelectorMatchOperator EqualsAny
3501+
$logScrubbingRuleConfig = New-AzApplicationGatewayFirewallPolicyLogScrubbingConfiguration -State Enabled -ScrubbingRule $logScrubbingRule1, $logScrubbingRule2
3502+
$policySettings = New-AzApplicationGatewayFirewallPolicySetting -Mode Prevention -State Enabled -MaxFileUploadInMb 4000 -MaxRequestBodySizeInKb 2000 -LogScrubbing $logScrubbingRuleConfig
3503+
$managedRuleSet = New-AzApplicationGatewayFirewallPolicyManagedRuleSet -RuleSetType "OWASP" -RuleSetVersion "3.2"
3504+
$managedRule = New-AzApplicationGatewayFirewallPolicyManagedRule -ManagedRuleSet $managedRuleSet
3505+
New-AzApplicationGatewayFirewallPolicy -Name $wafPolicyName -ResourceGroupName $rgname -Location $location -ManagedRule $managedRule -PolicySetting $policySettings
3506+
3507+
$policy = Get-AzApplicationGatewayFirewallPolicy -Name $wafPolicyName -ResourceGroupName $rgname
3508+
3509+
# Check firewall policy
3510+
Assert-AreEqual $policy.PolicySettings.FileUploadLimitInMb $policySettings.FileUploadLimitInMb
3511+
Assert-AreEqual $policy.PolicySettings.MaxRequestBodySizeInKb $policySettings.MaxRequestBodySizeInKb
3512+
Assert-AreEqual $policy.PolicySettings.RequestBodyCheck $policySettings.RequestBodyCheck
3513+
Assert-AreEqual $policy.PolicySettings.Mode $policySettings.Mode
3514+
Assert-AreEqual $policy.PolicySettings.State $policySettings.State
3515+
Assert-AreEqual $policy.PolicySettings.LogScrubbing.ScrubbingRules.Count 2
3516+
Assert-AreEqual $policy.PolicySettings.LogScrubbing.ScrubbingRules[0].State $policySettings.LogScrubbing.ScrubbingRules[0].State
3517+
Assert-AreEqual $policy.PolicySettings.LogScrubbing.ScrubbingRules[0].MatchVariable $policySettings.LogScrubbing.ScrubbingRules[0].MatchVariable
3518+
Assert-AreEqual $policy.PolicySettings.LogScrubbing.ScrubbingRules[0].SelectorMatchOperator $policySettings.LogScrubbing.ScrubbingRules[0].SelectorMatchOperator
3519+
Assert-AreEqual $policy.PolicySettings.LogScrubbing.ScrubbingRules[0].Selector $policySettings.LogScrubbing.ScrubbingRules[0].Selector
3520+
3521+
}
3522+
finally
3523+
{
3524+
# Cleanup
3525+
Clean-ResourceGroup $rgname
3526+
}
3527+
}
3528+
34803529
<#
34813530
.SYNOPSIS
34823531
This case tests the per-listener HostNames feature.

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.ApplicationGatewayTests/TestApplicationGatewayWithFirewallPolicyWithLogScrubbing.json

Lines changed: 754 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/Az.Network.psd1

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,9 @@ CmdletsToExport = 'Add-AzApplicationGatewayAuthenticationCertificate',
123123
'New-AzApplicationGatewayFirewallPolicyManagedRuleOverride',
124124
'New-AzApplicationGatewayFirewallPolicyManagedRuleGroupOverride',
125125
'New-AzApplicationGatewayFirewallPolicyManagedRuleSet',
126-
'New-AzApplicationGatewayFirewallPolicySetting',
126+
'New-AzApplicationGatewayFirewallPolicySetting',
127+
'New-AzApplicationGatewayFirewallPolicyLogScrubbingConfiguration',
128+
'New-AzApplicationGatewayFirewallPolicyLogScrubbingRule',
127129
'Add-AzApplicationGatewayFrontendIPConfig',
128130
'Get-AzApplicationGatewayFrontendIPConfig',
129131
'New-AzApplicationGatewayFrontendIPConfig',

‎src/Network/Network/ChangeLog.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@
4040
* Added support of `AdditionalNic` Property in New-AzNetworkVirtualAppliance
4141
* Added the new cmdlet for supporting `AdditionalNic` Property
4242
- 'New-AzVirtualApplianceAdditionalNicProperty'
43+
* Added new cmdlets to support Log Scrubbing Feature for Application Gateway WAF Firewall Policy
44+
- 'New-AzApplicationGatewayFirewallPolicyLogScrubbingConfiguration',
45+
- 'New-AzApplicationGatewayFirewallPolicyLogScrubbingRule',
46+
- Also updated cmdlet to add the property of LogScrubbing
47+
- `New-AzApplicationGatewayFirewallPolicySetting`
48+
4349

4450
## Version 5.6.0
4551
* Updated `New-AzLoadBalancer` and `Set-AzLoadBalancer` to validate surface level parameters for global tier load balancers

‎src/Network/Network/Common/NetworkResourceManagerProfile.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1023,6 +1023,8 @@ private static void Initialize()
10231023
cfg.CreateMap<CNM.PSApplicationGatewayFirewallMatchVariable, MNM.MatchVariable>();
10241024
cfg.CreateMap<CNM.PSApplicationGatewayWebApplicationFirewallPolicy, MNM.WebApplicationFirewallPolicy>();
10251025
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicySettings, MNM.PolicySettings>();
1026+
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyLogScrubbingConfiguration, MNM.PolicySettingsLogScrubbing>();
1027+
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyLogScrubbingRule, MNM.WebApplicationFirewallScrubbingRules>();
10261028
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyManagedRules, MNM.ManagedRulesDefinition>();
10271029
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyManagedRuleSet, MNM.ManagedRuleSet>();
10281030
cfg.CreateMap<CNM.PSApplicationGatewayFirewallPolicyManagedRuleGroupOverride, MNM.ManagedRuleGroupOverride>();
@@ -1101,6 +1103,8 @@ private static void Initialize()
11011103
cfg.CreateMap<MNM.MatchVariable, CNM.PSApplicationGatewayFirewallMatchVariable>();
11021104
cfg.CreateMap<MNM.WebApplicationFirewallPolicy, CNM.PSApplicationGatewayWebApplicationFirewallPolicy>();
11031105
cfg.CreateMap<MNM.PolicySettings, CNM.PSApplicationGatewayFirewallPolicySettings>();
1106+
cfg.CreateMap<MNM.PolicySettingsLogScrubbing, CNM.PSApplicationGatewayFirewallPolicyLogScrubbingConfiguration>();
1107+
cfg.CreateMap<MNM.WebApplicationFirewallScrubbingRules, CNM.PSApplicationGatewayFirewallPolicyLogScrubbingRule>();
11041108
cfg.CreateMap<MNM.ManagedRulesDefinition, CNM.PSApplicationGatewayFirewallPolicyManagedRules>();
11051109
cfg.CreateMap<MNM.ManagedRuleSet, CNM.PSApplicationGatewayFirewallPolicyManagedRuleSet>();
11061110
cfg.CreateMap<MNM.ManagedRuleGroupOverride, CNM.PSApplicationGatewayFirewallPolicyManagedRuleGroupOverride>();

‎src/Network/Network/FirewallPolicy/PolicySettings/AzureApplicationGatewayFirewallPolicySetting.cs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,10 @@ public class AzureApplicationGatewayFirewallPolicySetting : NetworkBaseCmdlet
5656
[ValidateNotNullOrEmpty]
5757
public string CustomBlockResponseBody { get; set; }
5858

59+
[Parameter(Mandatory = false, HelpMessage = "To scrub sensitive log fields")]
60+
[ValidateNotNullOrEmpty]
61+
public PSApplicationGatewayFirewallPolicyLogScrubbingConfiguration LogScrubbing { get; set; }
62+
5963
public override void ExecuteCmdlet()
6064
{
6165
base.ExecuteCmdlet();
@@ -107,6 +111,7 @@ protected PSApplicationGatewayFirewallPolicySettings NewObject()
107111
FileUploadLimitInMb = this.MaxFileUploadInMb,
108112
CustomBlockResponseBody = this.CustomBlockResponseBody,
109113
CustomBlockResponseStatusCode = this.CustomBlockResponseStatusCode,
114+
LogScrubbing = this.LogScrubbing
110115
};
111116
}
112117
}

‎src/Network/Network/FirewallPolicy/PolicySettings/LogScrubbing/LogScrubbingRule/NewAzureApplicationGatewayFirewallPolicyLogScrubbingRuleCommand.cs

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.Network.Models;
16+
using System.Linq;
17+
using System.Management.Automation;
18+
19+
namespace Microsoft.Azure.Commands.Network
20+
{
21+
[Cmdlet("New", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "ApplicationGatewayFirewallPolicyLogScrubbingRule"), OutputType(typeof(PSApplicationGatewayFirewallPolicyLogScrubbingRule))]
22+
public class NewAzureApplicationGatewayFirewallPolicyLogScrubbingRuleCommand : NetworkBaseCmdlet
23+
{
24+
[Parameter(
25+
Mandatory = true,
26+
HelpMessage = "State of the log scrubbing rule. Default value is Enabled")]
27+
[ValidateNotNullOrEmpty]
28+
[ValidateSet("Enabled", "Disabled", IgnoreCase = true)]
29+
public string State { get; set; }
30+
31+
[Parameter(
32+
Mandatory = true,
33+
HelpMessage = "The variable to be scrubbed from the logs.")]
34+
[ValidateNotNullOrEmpty]
35+
[ValidateSet("RequestHeaderNames", "RequestCookieNames", "RequestArgNames", "RequestPostArgNames", "RequestJSONArgNames", "RequestIPAddress", IgnoreCase = true)]
36+
public string MatchVariable { get; set; }
37+
38+
[Parameter(
39+
Mandatory = true,
40+
HelpMessage = "When matchVariable is a collection, operate on the selector to specify which elements in the collection this rule applies to.")]
41+
[ValidateNotNullOrEmpty]
42+
[ValidateSet("Equals", "EqualsAny", IgnoreCase = true)]
43+
public string SelectorMatchOperator { get; set; }
44+
45+
[Parameter(
46+
Mandatory = false,
47+
HelpMessage = "When matchVariable is a collection, operator used to specify which elements in the collection this rule applies to.")]
48+
[ValidateNotNullOrEmpty]
49+
public string Selector { get; set; }
50+
51+
public override void ExecuteCmdlet()
52+
{
53+
base.ExecuteCmdlet();
54+
55+
if (!this.MyInvocation.BoundParameters.ContainsKey("State"))
56+
{
57+
this.State = "Enabled";
58+
}
59+
60+
WriteObject(NewObject());
61+
}
62+
63+
protected PSApplicationGatewayFirewallPolicyLogScrubbingRule NewObject()
64+
{
65+
return new PSApplicationGatewayFirewallPolicyLogScrubbingRule()
66+
{
67+
State = this.State,
68+
MatchVariable = this.MatchVariable,
69+
SelectorMatchOperator = this.SelectorMatchOperator,
70+
Selector = this.Selector
71+
};
72+
}
73+
}
74+
}

‎src/Network/Network/FirewallPolicy/PolicySettings/LogScrubbing/NewAzureApplicationGatewayFirewallPolicyLogScrubbingConfigurationCommand.cs

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.Network.Models;
16+
using System.Linq;
17+
using System.Management.Automation;
18+
19+
namespace Microsoft.Azure.Commands.Network
20+
{
21+
[Cmdlet("New", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "ApplicationGatewayFirewallPolicyLogScrubbingConfiguration"), OutputType(typeof(PSApplicationGatewayFirewallPolicyLogScrubbingConfiguration))]
22+
public class NewAzureApplicationGatewayFirewallPolicyLogScrubbingConfigurationCommand : NetworkBaseCmdlet
23+
{
24+
[Parameter(
25+
Mandatory = true,
26+
HelpMessage = "State of the log scrubbing config. Default value is Enabled")]
27+
[ValidateNotNullOrEmpty]
28+
[ValidateSet("Enabled", "Disabled", IgnoreCase = true)]
29+
public string State { get; set; }
30+
31+
[Parameter(
32+
Mandatory = true,
33+
HelpMessage = "The rules that are applied to the logs for scrubbing.")]
34+
[ValidateNotNullOrEmpty]
35+
public PSApplicationGatewayFirewallPolicyLogScrubbingRule[] ScrubbingRule { get; set; }
36+
37+
public override void ExecuteCmdlet()
38+
{
39+
base.ExecuteCmdlet();
40+
41+
if (!this.MyInvocation.BoundParameters.ContainsKey("State"))
42+
{
43+
this.State = "Enabled";
44+
}
45+
46+
WriteObject(NewObject());
47+
}
48+
49+
protected PSApplicationGatewayFirewallPolicyLogScrubbingConfiguration NewObject()
50+
{
51+
return new PSApplicationGatewayFirewallPolicyLogScrubbingConfiguration()
52+
{
53+
State = this.State,
54+
ScrubbingRules = this.ScrubbingRule?.ToList()
55+
};
56+
}
57+
}
58+
}

‎src/Network/Network/Models/PSApplicationGatewayFirewallPolicyLogScrubbingConfiguration.cs

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
//
2+
// Copyright (c) Microsoft. All rights reserved.
3+
//
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
//
15+
16+
using Microsoft.Azure.Management.Network.Models;
17+
using Microsoft.WindowsAzure.Commands.Common.Attributes;
18+
using Newtonsoft.Json;
19+
using System.Collections.Generic;
20+
21+
namespace Microsoft.Azure.Commands.Network.Models
22+
{
23+
public partial class PSApplicationGatewayFirewallPolicyLogScrubbingConfiguration
24+
{
25+
[Ps1Xml(Target = ViewControl.Table)]
26+
public string State { get; set; }
27+
28+
[Ps1Xml(Target = ViewControl.Table)]
29+
public List<PSApplicationGatewayFirewallPolicyLogScrubbingRule> ScrubbingRules { get; set; }
30+
}
31+
}

0 commit comments

Comments
 (0)