Skip to content

Commit c33695b

Browse files
ccushingcodycushing
ccushing
authored and
codycushing
committed
Fix SecurityList ingressRule isStateless property
* update docs, examples and tests
1 parent 2720086 commit c33695b

File tree

4 files changed

+166
-60
lines changed

4 files changed

+166
-60
lines changed

‎docs/examples/networking/security_list/security_list.tf‎

Lines changed: 38 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
/*
2+
* This example demonstrates some basic security list options.
3+
*/
4+
15
variable "tenancy_ocid" {}
26
variable "user_ocid" {}
37
variable "fingerprint" {}
@@ -21,18 +25,48 @@ provider "baremetal" {
2125

2226
resource "baremetal_core_security_list" "security_list1" {
2327
compartment_id = "${var.compartment_ocid}"
28+
vcn_id = "${var.vcn_ocid}"
2429
display_name = "security_list1"
25-
vcn_id = "${var.vcn_ocid}}"
30+
31+
// allow outbound tcp traffic on all ports
2632
egress_security_rules {
2733
destination = "0.0.0.0/0"
2834
protocol = "6"
2935
}
36+
37+
// allow outbound udp traffic on a port range
38+
egress_security_rules {
39+
destination = "0.0.0.0/0"
40+
protocol = "17" // udp
41+
stateless = true
42+
43+
udp_options {
44+
"min" = 319
45+
"max" = 320
46+
}
47+
}
48+
49+
// allow inbound ssh traffic
3050
ingress_security_rules {
51+
protocol = "6" // tcp
52+
source = "0.0.0.0/0"
53+
stateless = false
54+
3155
tcp_options {
32-
"max" = 22
3356
"min" = 22
57+
"max" = 22
58+
}
59+
}
60+
61+
// allow inbound icmp traffic of a specific type
62+
ingress_security_rules {
63+
protocol = 1
64+
source = "0.0.0.0/0"
65+
stateless = true
66+
67+
icmp_options {
68+
"type" = 3
69+
"code" = 4
3470
}
35-
protocol = "6"
36-
source = "0.0.0.0/0"
3771
}
3872
}

‎docs/resources/core/security_list.md‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,51 @@
11
# baremetal\_core\_security\_lists
22

33
Provides a security list resource.
4+
See the [Security Lists](https://docs.us-phoenix-1.oraclecloud.com/Content/Network/Concepts/securitylists.htm)
5+
overview for more information
46

57
## Example Usage
68

9+
Protocols are specified as protocol numbers. For protocol numbers see
10+
http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
11+
712
```
813
resource "baremetal_core_security_list" "t" {
914
compartment_id = "compartment_id"
15+
vcn_id = "vcn_id"
1016
display_name = "display_name"
17+
1118
egress_security_rules {
12-
destination = "destination"
19+
protocol = "1"
20+
destination = "0.0.0.0/0"
21+
1322
icmp_options {
14-
"code" = 1
15-
"type" = 2
23+
"type" = 3
24+
"code" = 4
1625
}
17-
protocol = "protocol"
1826
}
27+
1928
ingress_security_rules {
29+
protocol = "6"
30+
source = "0.0.0.0/0"
31+
stateful = true
32+
2033
tcp_options {
21-
"max" = 2
22-
"min" = 1
34+
"min" = 80
35+
"max" = 82
36+
}
37+
}
38+
39+
ingress_security_rules {
40+
protocol = "17"
41+
source = "0.0.0.0/0"
42+
stateful = true
43+
44+
upd_options {
45+
"min" = 319
46+
"max" = 320
2347
}
24-
protocol = "protocol"
25-
source = "source"
2648
}
27-
vcn_id = "vcn_id"
2849
}
2950
```
3051

@@ -34,8 +55,8 @@ The following arguments are supported:
3455

3556
* `compartment_id` - (Required) The OCID of the compartment to contain the security list.
3657
* `display_name` - (Required) The OCID of the VCN.
37-
* `egress_security_rules` - (Required) Rules for allowing egress IP packets.
38-
* `ingress_security_rules` - (Required) Rules for allowing ingress IP packets.
58+
* `egress_security_rules` - (Required) Rules for allowing egress IP packets. [EgressSecurityRule API Docs](https://docs.us-phoenix-1.oraclecloud.com/api/#/en/iaas/20160918/EgressSecurityRule/)
59+
* `ingress_security_rules` - (Required) Rules for allowing ingress IP packets. [IngressSecurityRule API Docs](https://docs.us-phoenix-1.oraclecloud.com/api/#/en/iaas/20160918/IngressSecurityRule/)
3960
* `vcn_id` - (Optional) The OCID of the VCN the security list belongs to.
4061

4162
## Attributes Reference

‎resource_obmcs_core_security_list.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ func (s *SecurityListResourceCrud) SetData() {
264264
ingressRule.ICMPOptions,
265265
ingressRule.TCPOptions,
266266
ingressRule.UDPOptions,
267-
nil,
267+
&ingressRule.IsStateless,
268268
)
269269
confIngressRules = append(confIngressRules, confIngressRule)
270270
}

‎resource_obmcs_core_security_list_test.go‎

Lines changed: 95 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -50,45 +50,40 @@ resource "baremetal_core_virtual_network" "t" {
5050
compartment_id = "${var.compartment_id}"
5151
display_name = "display_name"
5252
}
53-
54-
55-
resource "baremetal_core_internet_gateway" "CompleteIG" {
56-
compartment_id = "${var.compartment_id}"
57-
display_name = "CompleteIG"
58-
vcn_id = "${baremetal_core_virtual_network.t.id}"
59-
}
60-
61-
resource "baremetal_core_route_table" "RouteForComplete" {
62-
compartment_id = "${var.compartment_id}"
63-
vcn_id = "${baremetal_core_virtual_network.t.id}"
64-
display_name = "RouteTableForComplete"
65-
route_rules {
66-
cidr_block = "0.0.0.0/0"
67-
network_entity_id = "${baremetal_core_internet_gateway.CompleteIG.id}"
68-
}
69-
}
7053
`
7154
s.SLConfig = `
7255
resource "baremetal_core_security_list" "t" {
73-
compartment_id = "${var.compartment_id}"
74-
display_name = "Public"
75-
vcn_id = "${baremetal_core_virtual_network.t.id}"
76-
egress_security_rules = [{
77-
destination = "0.0.0.0/0"
78-
protocol = "6"
79-
}]
80-
ingress_security_rules = [{
81-
tcp_options {
82-
"max" = 80
83-
"min" = 80
84-
}
85-
protocol = "6"
86-
source = "0.0.0.0/0"
87-
},
56+
compartment_id = "${var.compartment_id}"
57+
display_name = "security_list0"
58+
vcn_id = "${baremetal_core_virtual_network.t.id}"
59+
egress_security_rules = [{
60+
destination = "0.0.0.0/0"
61+
protocol = "6"
62+
}]
63+
ingress_security_rules = [{
64+
protocol = "1"
65+
source = "0.0.0.0/0"
66+
icmp_options {
67+
"type" = 3
68+
"code" = 4
69+
}
70+
},
8871
{
89-
protocol = "6"
90-
source = "10.0.0.0/16"
91-
}]
72+
protocol = "6"
73+
source = "0.0.0.0/0"
74+
tcp_options {
75+
"min" = 80
76+
"max" = 80
77+
}
78+
},
79+
{
80+
protocol = "17"
81+
source = "10.0.0.0/16"
82+
udp_options {
83+
"min" = 319
84+
"max" = 320
85+
}
86+
}]
9287
}
9388
`
9489
s.Config += testProviderConfig()
@@ -106,18 +101,20 @@ func (s *ResourceCoreSecurityListTestSuite) TestCreateResourceCoreSecurityList()
106101
ImportStateVerify: true,
107102
Config: s.Config + s.SLConfig,
108103
Check: resource.ComposeTestCheckFunc(
109-
resource.TestCheckResourceAttr(s.ResourceName, "display_name", "Public"),
104+
resource.TestCheckResourceAttr(s.ResourceName, "display_name", "security_list0"),
110105
resource.TestCheckResourceAttr(s.ResourceName, "egress_security_rules.#", "1"),
111-
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.#", "2"),
112106
resource.TestCheckResourceAttr(s.ResourceName, "egress_security_rules.0.stateless", "false"),
113-
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.0.tcp_options.0.max", "80"),
107+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.#", "3"),
108+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.0.icmp_options.0.type", "3"),
109+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.1.tcp_options.0.max", "80"),
110+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.2.udp_options.0.max", "320"),
114111
),
115112
},
116113
},
117114
})
118115
}
119116

120-
func (s *ResourceCoreSecurityListTestSuite) TestCreateResourceCoreSecurityListRemoveRules() {
117+
func (s *ResourceCoreSecurityListTestSuite) TestCreateResourceCoreSecurityListUpdateRules() {
121118

122119
resource.UnitTest(s.T(), resource.TestCase{
123120
Providers: s.Providers,
@@ -130,11 +127,65 @@ func (s *ResourceCoreSecurityListTestSuite) TestCreateResourceCoreSecurityListRe
130127
{
131128
Config: s.Config + `
132129
resource "baremetal_core_security_list" "t" {
133-
compartment_id = "${var.compartment_id}"
134-
display_name = "Public"
135-
vcn_id = "${baremetal_core_virtual_network.t.id}"
136-
egress_security_rules = []
137-
ingress_security_rules = []
130+
compartment_id = "${var.compartment_id}"
131+
display_name = "security_list1"
132+
vcn_id = "${baremetal_core_virtual_network.t.id}"
133+
egress_security_rules = [{
134+
destination = "0.0.0.0/0"
135+
protocol = "17"
136+
stateless = true
137+
}]
138+
ingress_security_rules = [{
139+
protocol = "1"
140+
source = "0.0.0.0/0"
141+
stateless = true
142+
icmp_options {
143+
"type" = 5
144+
"code" = 0
145+
}
146+
},
147+
{
148+
protocol = "6"
149+
source = "0.0.0.0/0"
150+
stateless = true
151+
tcp_options {
152+
"min" = 80
153+
"max" = 82
154+
}
155+
},
156+
{
157+
protocol = "17"
158+
source = "10.0.0.0/16"
159+
stateless = true
160+
}]
161+
}
162+
`,
163+
Check: resource.ComposeTestCheckFunc(
164+
resource.TestCheckResourceAttr(s.ResourceName, "display_name", "security_list1"),
165+
resource.TestCheckResourceAttr(s.ResourceName, "egress_security_rules.0.protocol", "17"),
166+
resource.TestCheckResourceAttr(s.ResourceName, "egress_security_rules.0.stateless", "true"),
167+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.0.stateless", "true"),
168+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.0.icmp_options.0.type", "5"),
169+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.1.tcp_options.0.max", "82"),
170+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.1.stateless", "true"),
171+
resource.TestCheckResourceAttr(s.ResourceName, "ingress_security_rules.2.stateless", "true"),
172+
resource.TestCheckNoResourceAttr(s.ResourceName, "ingress_security_rules.2.udp_options"),
173+
),
174+
},
175+
// todo: consistent 500 error from server without this step
176+
{
177+
ImportState: true,
178+
ImportStateVerify: true,
179+
Config: s.Config,
180+
},
181+
{
182+
Config: s.Config + `
183+
resource "baremetal_core_security_list" "t" {
184+
compartment_id = "${var.compartment_id}"
185+
display_name = "Public"
186+
vcn_id = "${baremetal_core_virtual_network.t.id}"
187+
egress_security_rules = []
188+
ingress_security_rules = []
138189
}
139190
`,
140191
Check: resource.ComposeTestCheckFunc(

0 commit comments

Comments
 (0)