Skip to content

Commit 606d8c9

Browse files
keerthi-gpkeerthi-gp
committed
feat(security-group): handle edge cases
1 parent cb61a06 commit 606d8c9

File tree

6 files changed

+80
-33
lines changed

6 files changed

+80
-33
lines changed

‎common/github.com/IBM/vpc-go-sdk/vpcv1/vpc_v1.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30021,7 +30021,9 @@ func (vpc *VpcV1) GetVPCDefaultNetworkACLWithContext(ctx context.Context, getVPC
3002130021
}
3002230022
builder.AddHeader("Accept", "application/json")
3002330023

30024-
builder.AddQuery("version", fmt.Sprint(*vpc.Version))
30024+
builder.AddQuery("version", getTomorrowDate())
30025+
builder.AddQuery("maturity", "development")
30026+
builder.AddQuery("future_version", "true")
3002530027
builder.AddQuery("generation", fmt.Sprint(*vpc.Generation))
3002630028

3002730029
request, err := builder.Build()

‎ibm/service/vpc/resource_ibm_is_networkacls.go‎

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -450,7 +450,7 @@ func ResourceIBMISNetworkACLValidator() *validate.ResourceValidator {
450450
MaxValueLength: 128})
451451
validateSchema = append(validateSchema,
452452
validate.ValidateSchema{
453-
Identifier: isSecurityGroupRuleProtocol,
453+
Identifier: isNetworkACLRuleProtocol,
454454
ValidateFunctionIdentifier: validate.ValidateAllowedStringValue,
455455
Type: validate.TypeString,
456456
AllowedValues: protocol})
@@ -504,7 +504,7 @@ func nwaclCreate(context context.Context, d *schema.ResourceData, meta interface
504504
if rls, ok := d.GetOk(isNetworkACLRules); ok {
505505
rules = rls.([]interface{})
506506
}
507-
err = validateInlineRules(rules)
507+
err = validateInlineRules(d, rules)
508508
if err != nil {
509509
return flex.DiscriminatedTerraformErrorf(err, err.Error(), "ibm_is_network_acl", "create", "validate-inline-rules").GetDiag()
510510
}
@@ -531,7 +531,7 @@ func nwaclCreate(context context.Context, d *schema.ResourceData, meta interface
531531
return tfErr.GetDiag()
532532
}
533533

534-
err = createInlineRules(sess, nwaclid, rules)
534+
err = createInlineRules(d, sess, nwaclid, rules)
535535
if err != nil {
536536
tfErr := flex.TerraformErrorf(err, fmt.Sprintf("createInlineRules failed: %s", err.Error()), "ibm_is_network_acl", "create")
537537
log.Printf("[DEBUG]\n%s", tfErr.GetDebugMessage())
@@ -865,7 +865,7 @@ func nwaclUpdate(context context.Context, d *schema.ResourceData, meta interface
865865
}
866866
}
867867
if d.HasChange(isNetworkACLRules) {
868-
err := validateInlineRules(rules)
868+
err := validateInlineRules(d, rules)
869869
if err != nil {
870870
tfErr := flex.TerraformErrorf(err, fmt.Sprintf("validateInlineRules failed: %s", err.Error()), "ibm_is_network_acl", "update")
871871
log.Printf("[DEBUG]\n%s", tfErr.GetDebugMessage())
@@ -879,7 +879,7 @@ func nwaclUpdate(context context.Context, d *schema.ResourceData, meta interface
879879
return tfErr.GetDiag()
880880
}
881881
//Create the rules as per the def
882-
err = createInlineRules(sess, id, rules)
882+
err = createInlineRules(d, sess, id, rules)
883883
if err != nil {
884884
tfErr := flex.TerraformErrorf(err, fmt.Sprintf("createInlineRules failed: %s", err.Error()), "ibm_is_network_acl", "update")
885885
log.Printf("[DEBUG]\n%s", tfErr.GetDebugMessage())
@@ -1022,8 +1022,8 @@ func clearRules(nwaclC *vpcv1.VpcV1, nwaclid string) error {
10221022
return nil
10231023
}
10241024

1025-
func validateInlineRules(rules []interface{}) error {
1026-
for _, rule := range rules {
1025+
func validateInlineRules(d *schema.ResourceData, rules []interface{}) error {
1026+
for i, rule := range rules {
10271027
rulex := rule.(map[string]interface{})
10281028
action := rulex[isNetworkACLRuleAction].(string)
10291029
if (action != "allow") && (action != "deny") {
@@ -1042,41 +1042,42 @@ func validateInlineRules(rules []interface{}) error {
10421042
}
10431043

10441044
protocol := rulex[isNetworkACLRuleProtocol]
1045-
icmpType := rulex[isNetworkACLRuleICMPType]
1046-
icmpCode := rulex[isNetworkACLRuleICMPCode]
1047-
portMin := rulex[isNetworkACLRulePortMin]
1048-
portMax := rulex[isNetworkACLRulePortMax]
1049-
srcPortMin := rulex[isNetworkACLRuleSourcePortMin]
1050-
srcPortMax := rulex[isNetworkACLRuleSourcePortMax]
1051-
1045+
icmpType := fmt.Sprintf("rules.%d.type", i)
1046+
icmpCode := fmt.Sprintf("rules.%d.code", i)
1047+
portMin := fmt.Sprintf("rules.%d.port_min", i)
1048+
portMax := fmt.Sprintf("rules.%d.port_max", i)
1049+
srcPortMin := fmt.Sprintf("rules.%d.source_port_min", i)
1050+
srcPortMax := fmt.Sprintf("rules.%d.source_port_max", i)
1051+
var okIcmpType, okIcmpCode bool
10521052
if protocol != "icmp" && protocol != "" {
1053-
if icmpType != nil && icmpType != 0 {
1053+
if _, ok := d.GetOk(icmpType); ok {
10541054
return fmt.Errorf("attribute 'type' conflicts with protocol %q; 'type' is only valid for icmp protocol", protocol)
10551055
}
1056-
if icmpCode != nil && icmpCode != 0 {
1056+
if _, ok := d.GetOk(icmpCode); ok {
10571057
return fmt.Errorf("attribute 'code' conflicts with protocol %q; 'code' is only valid for icmp protocol", protocol)
10581058
}
10591059
}
10601060

10611061
if protocol == "icmp" {
1062-
if (icmpType != nil && icmpCode == nil) || (icmpType == nil && icmpCode != nil) {
1062+
_, okIcmpType = d.GetOk(icmpType)
1063+
_, okIcmpCode = d.GetOk(icmpCode)
1064+
if (okIcmpType && !okIcmpCode) || (!okIcmpType && okIcmpCode) {
10631065
return fmt.Errorf("'code' and 'type' must both be specified together for icmp protocol")
10641066
}
10651067
}
10661068

10671069
if protocol != "tcp" && protocol != "udp" && protocol != "" {
1068-
fmt.Println("Inside Print the protocol value ", protocol)
1069-
if portMin != nil && portMin != 0 {
1070+
if _, ok := d.GetOk(portMin); ok {
10701071
return fmt.Errorf("attribute 'port_min' conflicts with protocol %s; ports apply only to tcp/udp protocol", protocol)
10711072
}
1072-
if portMax != nil && portMax != 0 {
1073+
if _, ok := d.GetOk(portMax); ok {
10731074
return fmt.Errorf("attribute 'port_max' conflicts with protocol %s; ports apply only to tcp/udp protocol", protocol)
10741075
}
10751076

1076-
if srcPortMin != nil && srcPortMin != 0 {
1077+
if _, ok := d.GetOk(srcPortMin); ok {
10771078
return fmt.Errorf("attribute 'source_port_min' conflicts with protocol %s; ports apply only to tcp/udp protocol", protocol)
10781079
}
1079-
if srcPortMax != nil && srcPortMax != 0 {
1080+
if _, ok := d.GetOk(srcPortMax); ok {
10801081
return fmt.Errorf("attribute 'source_port_max' conflicts with protocol %s; ports apply only to tcp/udp protocol", protocol)
10811082
}
10821083
}
@@ -1085,7 +1086,7 @@ func validateInlineRules(rules []interface{}) error {
10851086
return nil
10861087
}
10871088

1088-
func createInlineRules(nwaclC *vpcv1.VpcV1, nwaclid string, rules []interface{}) error {
1089+
func createInlineRules(d *schema.ResourceData, nwaclC *vpcv1.VpcV1, nwaclid string, rules []interface{}) error {
10891090
before := ""
10901091

10911092
for i := 0; i <= len(rules)-1; i++ {
@@ -1143,12 +1144,14 @@ func createInlineRules(nwaclC *vpcv1.VpcV1, nwaclid string, rules []interface{})
11431144
}
11441145
}
11451146
} else if protocol == "icmp" {
1147+
icmpType := fmt.Sprintf("rules.%d.type", i)
1148+
icmpCode := fmt.Sprintf("rules.%d.code", i)
11461149
ruleTemplate.Protocol = &protocol
1147-
if val, ok := rulex["type"]; ok {
1150+
if val, ok := d.GetOk(icmpType); ok {
11481151
icmptype = int64(val.(int))
11491152
ruleTemplate.Type = &icmptype
11501153
}
1151-
if val, ok := rulex["code"]; ok {
1154+
if val, ok := d.GetOk(icmpCode); ok {
11521155
icmpcode = int64(val.(int))
11531156
ruleTemplate.Code = &icmpcode
11541157
}

‎ibm/service/vpc/resource_ibm_is_networkacls_test.go‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ func TestNetworkACLGen2(t *testing.T) {
9999
resource.TestCheckResourceAttr(
100100
"ibm_is_network_acl.isExampleACL", "name", "is-example-acl"),
101101
resource.TestCheckResourceAttr(
102-
"ibm_is_network_acl.isExampleACL", "rules.#", "5"),
102+
"ibm_is_network_acl.isExampleACL", "rules.#", "6"),
103103
resource.TestCheckResourceAttr(
104104
"ibm_is_network_acl.isExampleACL", "tags.#", "2"),
105105
),
@@ -231,7 +231,17 @@ func testAccCheckIBMISNetworkACLConfig1() string {
231231
# port_min =
232232
}
233233
rules {
234-
name = "inbound"
234+
name = "icmnew"
235+
action = "allow"
236+
source = "0.0.0.0/0"
237+
destination = "0.0.0.0/0"
238+
direction = "inbound"
239+
protocol = "icmp"
240+
code = 8
241+
type = 1
242+
}
243+
rules {
244+
name = "anyprotocol"
235245
action = "allow"
236246
source = "0.0.0.0/0"
237247
destination = "0.0.0.0/0"
@@ -240,16 +250,15 @@ func testAccCheckIBMISNetworkACLConfig1() string {
240250
}
241251
242252
rules {
243-
name = "inbound"
253+
name = "icmptcpudp"
244254
action = "allow"
245255
source = "0.0.0.0/0"
246256
destination = "0.0.0.0/0"
247257
direction = "inbound"
248258
protocol = "icmp_tcp_udp"
249259
}
250-
251260
rules {
252-
name = "inbound"
261+
name = "individual"
253262
action = "allow"
254263
source = "0.0.0.0/0"
255264
destination = "0.0.0.0/0"

‎ibm/service/vpc/resource_ibm_is_security_group_rule_test.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,7 @@ func testAccCheckIBMISsecurityGroupRuleConfig(vpcname, name string) string {
217217
local = "192.168.3.4"
218218
tcp {
219219
}
220+
}
220221
221222
resource "ibm_is_security_group_rule" "testacc_security_group_rule_any" {
222223
depends_on = [ibm_is_security_group_rule.testacc_security_group_rule_tcp]
@@ -238,7 +239,34 @@ func testAccCheckIBMISsecurityGroupRuleConfig(vpcname, name string) string {
238239
direction = "inbound"
239240
remote = "127.0.0.1"
240241
protocol = "number_99"
242+
}
243+
resource "ibm_is_security_group_rule" "testacc_security_group_rule_icmp_new" {
244+
depends_on = [ibm_is_security_group_rule.testacc_security_group_rule_tcp]
245+
group = ibm_is_security_group.testacc_security_group.id
246+
direction = "inbound"
247+
remote = "127.0.0.1"
248+
protocol = "icmp"
249+
code = 20
250+
type = 30
251+
}
252+
resource "ibm_is_security_group_rule" "testacc_security_group_rule_tcp_new" {
253+
depends_on = [ibm_is_security_group_rule.testacc_security_group_rule_tcp]
254+
group = ibm_is_security_group.testacc_security_group.id
255+
direction = "inbound"
256+
remote = "127.0.0.1"
257+
protocol = "tcp"
258+
port_min = 8080
259+
port_max = 8080
241260
}
261+
resource "ibm_is_security_group_rule" "testacc_security_group_rule_udp_new" {
262+
depends_on = [ibm_is_security_group_rule.testacc_security_group_rule_tcp]
263+
group = ibm_is_security_group.testacc_security_group.id
264+
direction = "inbound"
265+
remote = "127.0.0.1"
266+
protocol = "udp"
267+
port_min = 8080
268+
port_max = 8080
269+
}
242270
}
243271
`, vpcname, name)
244272

‎ibm/service/vpc/resource_ibm_is_subnet_network_acl_attachment.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,11 @@ func ResourceIBMISSubnetNetworkACLAttachment() *schema.Resource {
115115
Computed: true,
116116
Description: "Direction of traffic to enforce, either inbound or outbound",
117117
},
118+
isNetworkACLRuleProtocol: {
119+
Type: schema.TypeString,
120+
Computed: true,
121+
Description: "The name of the network protocol",
122+
},
118123
isNetworkACLRuleICMP: {
119124
Type: schema.TypeList,
120125
Computed: true,

‎ibm/service/vpc/resource_ibm_is_vpc.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -911,7 +911,7 @@ func deleteDefaultNetworkACLRules(sess *vpcv1.VpcV1, vpcID string) error {
911911

912912
if result.Rules != nil {
913913
for _, sourceRule := range result.Rules {
914-
sourceRuleVal := sourceRule.(*vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolAny)
914+
sourceRuleVal := sourceRule.(*vpcv1.NetworkACLRuleItemNetworkACLRuleProtocolIcmptcpudp)
915915
if sourceRuleVal.ID != nil {
916916
getNetworkAclRuleOptions := &vpcv1.GetNetworkACLRuleOptions{
917917
NetworkACLID: result.ID,
@@ -947,7 +947,7 @@ func deleteDefaultSecurityGroupRules(sess *vpcv1.VpcV1, vpcID string) error {
947947

948948
if result.Rules != nil {
949949
for _, sourceRule := range result.Rules {
950-
sourceRuleVal := sourceRule.(*vpcv1.SecurityGroupRuleProtocolAny)
950+
sourceRuleVal := sourceRule.(*vpcv1.SecurityGroupRuleProtocolIcmptcpudp)
951951
if sourceRuleVal.ID != nil {
952952
getSecurityGroupRuleOptions := &vpcv1.GetSecurityGroupRuleOptions{
953953
SecurityGroupID: result.ID,

0 commit comments

Comments
 (0)