Skip to content

Commit e982f5b

Browse files
Shawnli222Shawnli222
authored
Remove-AzApplicationGatewayFirewallCustomRule cmdlet (#23075)
* test * test name * edit trst * pass test * delete old test
1 parent 38b4f27 commit e982f5b

File tree

7 files changed

+1892
-0
lines changed

7 files changed

+1892
-0
lines changed

‎src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,14 @@ public void TestApplicationGatewayFirewallPolicyWithRateLimitRuleGeoLocation()
293293
TestRunner.RunTestScript("Test-ApplicationGatewayFirewallPolicyWithRateLimitRuleGeoLocation");
294294
}
295295

296+
[Fact]
297+
[Trait(Category.AcceptanceType, Category.CheckIn)]
298+
[Trait(Category.Owner, NrpTeamAlias.nvadev_subset1)]
299+
public void TestApplicationGatewayFirewallPolicyCustomRuleRemoval()
300+
{
301+
TestRunner.RunTestScript("Test-ApplicationGatewayFirewallPolicyCustomRuleRemoval");
302+
}
303+
296304
[Fact]
297305
[Trait(Category.AcceptanceType, Category.CheckIn)]
298306
[Trait(Category.Owner, NrpTeamAlias.nvadev_subset1)]

‎src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.ps1

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4983,6 +4983,67 @@ function Test-ApplicationGatewayFirewallPolicyWithInspectionLimit
49834983
}
49844984
}
49854985

4986+
function Test-ApplicationGatewayFirewallPolicyCustomRuleRemoval
4987+
{
4988+
# Setup
4989+
$location = Get-ProviderLocation "Microsoft.Network/applicationGateways" "West US 2"
4990+
$rgname = Get-ResourceGroupName
4991+
$wafPolicyName = "wafPolicy1"
4992+
4993+
try {
4994+
4995+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = "APPGw tag"}
4996+
4997+
# WAF Policy with rate limiting rule custom Rule
4998+
$variable = New-AzApplicationGatewayFirewallMatchVariable -VariableName RequestHeaders -Selector Malicious-Header
4999+
$condition = New-AzApplicationGatewayFirewallCondition -MatchVariable $variable -Operator Any -NegationCondition $False
5000+
$groupbyVar = New-AzApplicationGatewayFirewallCustomRuleGroupByVariable -VariableName GeoLocation
5001+
$groupbyUserSes = New-AzApplicationGatewayFirewallCustomRuleGroupByUserSession -GroupByVariable $groupbyVar
5002+
$customRule = New-AzApplicationGatewayFirewallCustomRule -Name example -Priority 2 -RateLimitDuration OneMin -RateLimitThreshold 10 -RuleType RateLimitRule -MatchCondition $condition -GroupByUserSession $groupbyUserSes -Action Block
5003+
5004+
$policySettings = New-AzApplicationGatewayFirewallPolicySetting -Mode Prevention -State Enabled -MaxFileUploadInMb 70 -MaxRequestBodySizeInKb 70
5005+
$managedRuleSet = New-AzApplicationGatewayFirewallPolicyManagedRuleSet -RuleSetType "OWASP" -RuleSetVersion "3.2"
5006+
$managedRule = New-AzApplicationGatewayFirewallPolicyManagedRule -ManagedRuleSet $managedRuleSet
5007+
New-AzApplicationGatewayFirewallPolicy -Name $wafPolicyName -ResourceGroupName $rgname -Location $location -ManagedRule $managedRule -PolicySetting $policySettings -CustomRule $customRule
5008+
5009+
$policy = Get-AzApplicationGatewayFirewallPolicy -Name $wafPolicyName -ResourceGroupName $rgname
5010+
5011+
# Check WAF policy
5012+
Assert-AreEqual $policy.CustomRules[0].Name $customRule.Name
5013+
Assert-AreEqual $policy.CustomRules[0].RuleType $customRule.RuleType
5014+
Assert-AreEqual $policy.CustomRules[0].Action $customRule.Action
5015+
Assert-AreEqual $policy.CustomRules[0].Priority $customRule.Priority
5016+
Assert-AreEqual $policy.CustomRules[0].RateLimitDuration $customRule.RateLimitDuration
5017+
Assert-AreEqual $policy.CustomRules[0].RateLimitThreshold $customRule.RateLimitThreshold
5018+
Assert-AreEqual $policy.CustomRules[0].State "Enabled"
5019+
Assert-AreEqual $policy.CustomRules[0].MatchConditions[0].OperatorProperty $customRule.MatchConditions[0].OperatorProperty
5020+
Assert-AreEqual $policy.CustomRules[0].MatchConditions[0].NegationConditon $customRule.MatchConditions[0].NegationConditon
5021+
Assert-AreEqual $policy.CustomRules[0].MatchConditions[0].MatchVariables[0].VariableName $customRule.MatchConditions[0].MatchVariables[0].VariableName
5022+
Assert-AreEqual $policy.CustomRules[0].MatchConditions[0].MatchVariables[0].Selector $customRule.MatchConditions[0].MatchVariables[0].Selector
5023+
Assert-AreEqual $policy.CustomRules[0].GroupByUserSession[0].GroupByVariables[0].VariableName $customRule.GroupByUserSession[0].GroupByVariables[0].VariableName
5024+
Assert-AreEqual $policy.PolicySettings.FileUploadLimitInMb $policySettings.FileUploadLimitInMb
5025+
Assert-AreEqual $policy.PolicySettings.MaxRequestBodySizeInKb $policySettings.MaxRequestBodySizeInKb
5026+
Assert-AreEqual $policy.PolicySettings.RequestBodyCheck $policySettings.RequestBodyCheck
5027+
Assert-AreEqual $policy.PolicySettings.Mode $policySettings.Mode
5028+
Assert-AreEqual $policy.PolicySettings.State $policySettings.State
5029+
5030+
$policy.CustomRules[0].State = "Disabled"
5031+
Set-AzApplicationGatewayFirewallPolicy -InputObject $policy
5032+
$policy1 = Get-AzApplicationGatewayFirewallPolicy -Name $wafPolicyName -ResourceGroupName $rgname
5033+
Assert-AreEqual $policy1.CustomRules[0].State "Disabled"
5034+
5035+
#Remove Custom Rule
5036+
Remove-AzApplicationGatewayFirewallCustomRule -Name $customRule.Name -ResourceGroupName $rgname -PolicyName $wafPolicyName
5037+
$policynew = Get-AzApplicationGatewayFirewallPolicy -Name $wafPolicyName -ResourceGroupName $rgname
5038+
Assert-Null $policynew.CustomRules[0]
5039+
}
5040+
finally
5041+
{
5042+
# Cleanup
5043+
Clean-ResourceGroup $rgname
5044+
}
5045+
}
5046+
49865047
function Test-ApplicationGatewayFirewallPolicyWithCustomBlockResponse
49875048
{
49885049
# Setup

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.ApplicationGatewayTests/TestApplicationGatewayFirewallPolicyCustomRuleRemoval.json

Lines changed: 1528 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/Az.Network.psd1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ CmdletsToExport = 'Add-AzApplicationGatewayAuthenticationCertificate',
111111
'New-AzApplicationGatewayFirewallPolicyExclusionManagedRuleSet',
112112
'New-AzApplicationGatewayFirewallCondition',
113113
'New-AzApplicationGatewayFirewallCustomRule',
114+
'Remove-AzApplicationGatewayFirewallCustomRule',
114115
'New-AzApplicationGatewayFirewallCustomRuleGroupByUserSession',
115116
'New-AzApplicationGatewayFirewallCustomRuleGroupByVariable',
116117
'New-AzApplicationGatewayFirewallMatchVariable',

‎src/Network/Network/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
* Updated cmdlet `New-AzLoadBalancerBackendAddressPool` to support managed IP based backend
2525
* Added cmdlet `New-AzSaaSNetworkVirtualAppliance` for creating a NetworkVirtualAppliance of SaaS type.
2626
* Added control knobs to virtual network gateways and ExpressRoute gateways as well to cmdlets operating on those.
27+
* Added cmdlet 'Remove-AzApplicationGatewayFirewallCustomRule' to support removing custom rule in Firewall Policy.
2728

2829
## Version 6.2.0
2930
* Added support for new Application Gateway SKU type, Basic SKU

‎src/Network/Network/FirewallPolicy/FirewallCustomRule/RemoveAzureApplicationGatewayFirewallCustomRuleCommand.cs

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+

2+
3+
// ----------------------------------------------------------------------------------
4+
//
5+
// Copyright Microsoft Corporation
6+
// Licensed under the Apache License, Version 2.0 (the "License");
7+
// you may not use this file except in compliance with the License.
8+
// You may obtain a copy of the License at
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
// ----------------------------------------------------------------------------------
16+
17+
using Microsoft.Azure.Commands.Network.Models;
18+
using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
19+
using Microsoft.Azure.Commands.ResourceManager.Common.Tags;
20+
using Microsoft.Azure.Management.Network;
21+
using System;
22+
using System.Management.Automation;
23+
using System.Text;
24+
using MNM = Microsoft.Azure.Management.Network.Models;
25+
26+
namespace Microsoft.Azure.Commands.Network
27+
{
28+
[Cmdlet("Remove", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "ApplicationGatewayFirewallCustomRule", SupportsShouldProcess = true), OutputType(typeof(bool))]
29+
public class RemoveAzureApplicationGatewayFirewallCustomRuleCommand : ApplicationGatewayFirewallPolicyBaseCmdlet
30+
{
31+
[Alias("ResourceName")]
32+
[Parameter(
33+
Mandatory = true,
34+
ValueFromPipelineByPropertyName = true,
35+
HelpMessage = "The resource name.")]
36+
[ResourceNameCompleter("Microsoft.Network/applicationGatewayWebApplicationFirewallCustomRule", "ResourceGroupName")]
37+
[ValidateNotNullOrEmpty]
38+
public virtual string Name { get; set; }
39+
40+
[Parameter(
41+
Mandatory = true,
42+
ValueFromPipelineByPropertyName = true,
43+
HelpMessage = "The resource group name.")]
44+
[ResourceGroupCompleter]
45+
[ValidateNotNullOrEmpty]
46+
public virtual string ResourceGroupName { get; set; }
47+
48+
[Parameter(
49+
Mandatory = true,
50+
ValueFromPipelineByPropertyName = true,
51+
HelpMessage = "The policy name.")]
52+
[ResourceGroupCompleter]
53+
[ValidateNotNullOrEmpty]
54+
public virtual string PolicyName { get; set; }
55+
56+
[Parameter(
57+
Mandatory = false,
58+
ValueFromPipelineByPropertyName = true,
59+
HelpMessage = "Do not ask for confirmation.")]
60+
public SwitchParameter Force { get; set; }
61+
62+
[Parameter(Mandatory = false)]
63+
public SwitchParameter PassThru { get; set; }
64+
65+
public override void ExecuteCmdlet()
66+
{
67+
base.ExecuteCmdlet();
68+
69+
if (!this.IsApplicationGatewayFirewallPolicyPresent(ResourceGroupName, PolicyName))
70+
{
71+
throw new ArgumentException(Microsoft.Azure.Commands.Network.Properties.Resources.ResourceNotFound);
72+
}
73+
74+
var firewallPolicy = this.GetApplicationGatewayFirewallPolicy(ResourceGroupName, PolicyName);
75+
76+
foreach (PSApplicationGatewayFirewallCustomRule rule in firewallPolicy.CustomRules)
77+
{
78+
if(rule.Name == this.Name)
79+
{
80+
firewallPolicy.CustomRules.Remove(rule);
81+
}
82+
break;
83+
}
84+
85+
// Map to the sdk object
86+
var firewallPolicyModel = NetworkResourceManagerProfile.Mapper.Map<MNM.WebApplicationFirewallPolicy>(firewallPolicy);
87+
firewallPolicyModel.Tags = TagsConversionHelper.CreateTagDictionary(firewallPolicy.Tag, validate: true);
88+
89+
// Execute the Create VirtualNetwork call
90+
this.ApplicationGatewayFirewallPolicyClient.CreateOrUpdate(ResourceGroupName, PolicyName, firewallPolicyModel);
91+
92+
var getApplicationGatewayFirewallPolicy = this.GetApplicationGatewayFirewallPolicy(ResourceGroupName, PolicyName);
93+
94+
// Assign the CustomBlockResponse fields from policy settings to policy (Feature parity with AFD WAF Policy)
95+
getApplicationGatewayFirewallPolicy.CustomBlockResponseStatusCode = getApplicationGatewayFirewallPolicy.PolicySettings.CustomBlockResponseStatusCode;
96+
97+
// decode the body value as it is base64 encoded
98+
if (!string.IsNullOrEmpty(getApplicationGatewayFirewallPolicy.PolicySettings.CustomBlockResponseBody))
99+
{
100+
string decodedCustomBlockResponseBody = Encoding.UTF8.GetString(Convert.FromBase64String(getApplicationGatewayFirewallPolicy.PolicySettings.CustomBlockResponseBody));
101+
getApplicationGatewayFirewallPolicy.CustomBlockResponseBody = decodedCustomBlockResponseBody;
102+
}
103+
104+
WriteObject(getApplicationGatewayFirewallPolicy.CustomRules);
105+
106+
}
107+
}
108+
}

‎src/Network/Network/help/Remove-AzApplicationGatewayFirewallCustomRule.md

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
---
2+
external help file: Microsoft.Azure.PowerShell.Cmdlets.Network.dll-Help.xml
3+
Module Name: Az.Network
4+
online version: https://learn.microsoft.com/powershell/module/az.network/remove-azapplicationgatewayfirewallcustomrule
5+
schema: 2.0.0
6+
---
7+
8+
# Remove-AzApplicationGatewayFirewallCustomRule
9+
10+
## SYNOPSIS
11+
Removes an application gateway firewall custom rule.
12+
13+
## SYNTAX
14+
15+
```
16+
Remove-AzApplicationGatewayFirewallCustomRule -Name <String> -ResourceGroupName <String> -PolicyName <String> [-Force] [-PassThru]
17+
[-AsJob] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
18+
```
19+
20+
## DESCRIPTION
21+
The **Remove-AzApplicationGatewayFirewallCustomRule** cmdlet removes an application gateway firewall custom rule.
22+
23+
## EXAMPLES
24+
25+
### Example 1
26+
```powershell
27+
Remove-AzApplicationGatewayFirewallCustomRule -Name "ApplicationGatewayFirewallCustomRule01" -ResourceGroupName "ResourceGroup01" -PolicyName "PolicyName01"
28+
```
29+
30+
This command removes the application gateway firewall custom rule named ApplicationGatewayFirewallCustomRule01 in the resource group named ResourceGroup01 in policy named PolicyName01.
31+
32+
## PARAMETERS
33+
34+
### -AsJob
35+
Run cmdlet in the background
36+
37+
```yaml
38+
Type: System.Management.Automation.SwitchParameter
39+
Parameter Sets: (All)
40+
Aliases:
41+
42+
Required: False
43+
Position: Named
44+
Default value: None
45+
Accept pipeline input: False
46+
Accept wildcard characters: False
47+
```
48+
49+
### -DefaultProfile
50+
The credentials, account, tenant, and subscription used for communication with Azure.
51+
52+
```yaml
53+
Type: Microsoft.Azure.Commands.Common.Authentication.Abstractions.Core.IAzureContextContainer
54+
Parameter Sets: (All)
55+
Aliases: AzContext, AzureRmContext, AzureCredential
56+
57+
Required: False
58+
Position: Named
59+
Default value: None
60+
Accept pipeline input: False
61+
Accept wildcard characters: False
62+
```
63+
64+
### -Force
65+
Do not ask for confirmation.
66+
67+
```yaml
68+
Type: System.Management.Automation.SwitchParameter
69+
Parameter Sets: (All)
70+
Aliases:
71+
72+
Required: False
73+
Position: Named
74+
Default value: None
75+
Accept pipeline input: False
76+
Accept wildcard characters: False
77+
```
78+
79+
80+
### -Name
81+
The resource name.
82+
83+
```yaml
84+
Type: System.String
85+
Parameter Sets: ByFactoryName
86+
Aliases: ResourceName
87+
88+
Required: True
89+
Position: Named
90+
Default value: None
91+
Accept pipeline input: True (ByPropertyName)
92+
Accept wildcard characters: False
93+
```
94+
95+
### -PassThru
96+
Returns an object representing the item with which you are working.
97+
By default, this cmdlet does not generate any output.
98+
99+
```yaml
100+
Type: System.Management.Automation.SwitchParameter
101+
Parameter Sets: (All)
102+
Aliases:
103+
104+
Required: False
105+
Position: Named
106+
Default value: None
107+
Accept pipeline input: False
108+
Accept wildcard characters: False
109+
```
110+
111+
### -ResourceGroupName
112+
The resource group name.
113+
114+
```yaml
115+
Type: System.String
116+
Parameter Sets: ByFactoryName
117+
Aliases:
118+
119+
Required: True
120+
Position: Named
121+
Default value: None
122+
Accept pipeline input: True (ByPropertyName)
123+
Accept wildcard characters: False
124+
```
125+
126+
### -PolicyName
127+
The policy name.
128+
129+
```yaml
130+
Type: System.String
131+
Parameter Sets: ByFactoryName
132+
Aliases:
133+
134+
Required: True
135+
Position: Named
136+
Default value: None
137+
Accept pipeline input: True (ByPropertyName)
138+
Accept wildcard characters: False
139+
```
140+
141+
### -Confirm
142+
Prompts you for confirmation before running the cmdlet.
143+
144+
```yaml
145+
Type: System.Management.Automation.SwitchParameter
146+
Parameter Sets: (All)
147+
Aliases: cf
148+
149+
Required: False
150+
Position: Named
151+
Default value: None
152+
Accept pipeline input: False
153+
Accept wildcard characters: False
154+
```
155+
156+
### -WhatIf
157+
Shows what would happen if the cmdlet runs.
158+
The cmdlet is not run.
159+
160+
```yaml
161+
Type: System.Management.Automation.SwitchParameter
162+
Parameter Sets: (All)
163+
Aliases: wi
164+
165+
Required: False
166+
Position: Named
167+
Default value: None
168+
Accept pipeline input: False
169+
Accept wildcard characters: False
170+
```
171+
172+
### CommonParameters
173+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
174+
175+
## INPUTS
176+
177+
### System.String
178+
179+
## OUTPUTS
180+
181+
### System.Boolean
182+
183+
## NOTES
184+
185+
## RELATED LINKS

0 commit comments

Comments
 (0)