Skip to content

Commit 2dfbe08

Browse files
Karin-Yechilzuke-ImpervaKarin-Yechilzuke-Imperva
authored
TF | Support client_apps & countries & continents in bot_access_control rule exception (#606)
* adding missing args * added acceptance tests
1 parent aa6b967 commit 2dfbe08

File tree

3 files changed

+173
-5
lines changed

3 files changed

+173
-5
lines changed

‎incapsula/client_security_rule_exception.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ var securityRuleExceptionParamMapping = map[string][]string{
2222
blacklistedURLsExceptionRuleID: {"client_apps", "countries", "continents", "ips", "urls"},
2323
// WAF RuleIDs
2424
backdoorExceptionRuleID: {"client_apps", "countries", "continents", "ips", "urls", "user_agents", "parameters"},
25-
botAccessControlExceptionRuleID: {"client_app_types", "ips", "urls", "user_agents"},
25+
botAccessControlExceptionRuleID: {"client_app_types", "client_apps", "countries", "continents", "ips", "urls", "user_agents"},
2626
crossSiteScriptingExceptionRuleID: {"client_apps", "countries", "continents", "urls", "parameters"},
2727
ddosExceptionRuleID: {"client_apps", "countries", "continents", "ips", "urls"},
2828
illegalResourceAccessExceptionRuleID: {"client_apps", "countries", "continents", "ips", "urls", "parameters"},

‎incapsula/resource_security_rule_exception.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -352,10 +352,10 @@ func resourceSecurityRuleExceptionUpdate(d *schema.ResourceData, m interface{})
352352
_, err := client.EditSecurityRuleException(
353353
d.Get("site_id").(int),
354354
ruleID,
355-
"",
356-
"",
357-
"",
358-
"",
355+
d.Get("client_app_types").(string),
356+
d.Get("client_apps").(string),
357+
d.Get("countries").(string),
358+
d.Get("continents").(string),
359359
d.Get("ips").(string),
360360
d.Get("urls").(string),
361361
d.Get("user_agents").(string),

‎incapsula/resource_security_rule_exception_test.go‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package incapsula
22

33
import (
44
"fmt"
5+
"regexp"
56
"strconv"
67
"testing"
78

@@ -11,6 +12,8 @@ import (
1112

1213
const securityRuleExceptionNameBlacklistedCountries = "Example security rule exception - blacklisted_countries"
1314
const securityRuleExceptionResourceNameBlacklistedCountries = "incapsula_security_rule_exception.example-waf-blacklisted-countries-rule-exception"
15+
const securityRuleExceptionNameBotAccessControl = "Example security rule exception - bot_access_control"
16+
const securityRuleExceptionResourceNameBotAccessControl = "incapsula_security_rule_exception.example-waf-bot-access-control-rule-exception"
1417

1518
////////////////////////////////////////////////////////////////
1619
// AccCheckAddSecurityRuleException Tests
@@ -85,6 +88,58 @@ func testAccCheckSecurityRuleExceptionCreateInvalidParams(t *testing.T) {
8588
})
8689
}
8790

91+
func TestAccCheckSecurityRuleExceptionCreateValidRuleBots(t *testing.T) {
92+
resource.Test(t, resource.TestCase{
93+
PreCheck: func() { testAccPreCheck(t) },
94+
Providers: testAccProviders,
95+
CheckDestroy: testAccCheckSecurityRuleExceptionDestroyBots,
96+
Steps: []resource.TestStep{
97+
{
98+
Config: testAccCheckSecurityRuleExceptionGoodConfigBots(t),
99+
Check: resource.ComposeTestCheckFunc(
100+
testCheckSecurityRuleExceptionExistsBots(securityRuleExceptionResourceNameBotAccessControl),
101+
resource.TestCheckResourceAttr(securityRuleExceptionResourceNameBotAccessControl, "rule_id", "api.threats.bot_access_control"),
102+
resource.TestCheckResourceAttr(securityRuleExceptionResourceNameBotAccessControl, "client_app_types", "DataScraper"),
103+
resource.TestCheckResourceAttr(securityRuleExceptionResourceNameBotAccessControl, "client_apps", "123,488"),
104+
resource.TestCheckResourceAttr(securityRuleExceptionResourceNameBotAccessControl, "countries", "JM"),
105+
resource.TestCheckResourceAttr(securityRuleExceptionResourceNameBotAccessControl, "continents", "EU"),
106+
resource.TestCheckResourceAttr(securityRuleExceptionResourceNameBotAccessControl, "ips", "1.2.3.6,1.2.3.7"),
107+
resource.TestCheckResourceAttr(securityRuleExceptionResourceNameBotAccessControl, "urls", "/myurl"),
108+
resource.TestCheckResourceAttr(securityRuleExceptionResourceNameBotAccessControl, "user_agents", "myUserAgent"),
109+
),
110+
},
111+
},
112+
})
113+
}
114+
115+
func TestAccCheckSecurityRuleExceptionCreateInvalidRuleIDBots(t *testing.T) {
116+
resource.Test(t, resource.TestCase{
117+
PreCheck: func() { testAccPreCheck(t) },
118+
Providers: testAccProviders,
119+
CheckDestroy: testAccCheckSecurityRuleExceptionDestroyBots,
120+
Steps: []resource.TestStep{
121+
{
122+
Config: testAccCheckSecurityRuleExceptionInvalidConfigBots(t),
123+
ExpectError: regexp.MustCompile("invalid rule_id"),
124+
},
125+
},
126+
})
127+
}
128+
129+
func TestAccCheckSecurityRuleExceptionCreateInvalidParamsBots(t *testing.T) {
130+
resource.Test(t, resource.TestCase{
131+
PreCheck: func() { testAccPreCheck(t) },
132+
Providers: testAccProviders,
133+
CheckDestroy: testAccCheckSecurityRuleExceptionDestroyBots,
134+
Steps: []resource.TestStep{
135+
{
136+
Config: testAccCheckSecurityRuleExceptionInvalidParamsBots(t),
137+
ExpectError: regexp.MustCompile("Error parsing SecurityRuleExceptionCreateResponse JSON response"),
138+
},
139+
},
140+
})
141+
}
142+
88143
////////////////////////////////////////////////////////////////
89144
// testAccCheckSecurityRuleExceptionDestroy Tests
90145
////////////////////////////////////////////////////////////////
@@ -156,6 +211,69 @@ func testAccStateSecurityRuleExceptionID(s *terraform.State) (string, error) {
156211
return "", fmt.Errorf("Error finding site_id")
157212
}
158213

214+
func testAccCheckSecurityRuleExceptionDestroyBots(state *terraform.State) error {
215+
client := testAccProvider.Meta().(*Client)
216+
217+
for _, res := range state.RootModule().Resources {
218+
if res.Type != "incapsula_security_rule_exception" {
219+
continue
220+
}
221+
222+
ruleID := res.Primary.ID
223+
if ruleID == "" {
224+
return fmt.Errorf("Incapsula security rule exception does not exist")
225+
}
226+
227+
siteID := res.Primary.Attributes["site_id"]
228+
if siteID == "" {
229+
return fmt.Errorf("incapsula site_id does not exist")
230+
}
231+
232+
siteIDInt, err := strconv.Atoi(siteID)
233+
if err != nil {
234+
return fmt.Errorf("Error parsing siteID %s to int", siteID)
235+
}
236+
237+
siteStatusResponse, _ := client.ListSecurityRuleExceptions(siteID, ruleID)
238+
if siteStatusResponse.SiteID == siteIDInt {
239+
return fmt.Errorf("site id (%s) still exists", siteID)
240+
}
241+
}
242+
243+
return nil
244+
}
245+
246+
func testCheckSecurityRuleExceptionExistsBots(name string) resource.TestCheckFunc {
247+
return func(state *terraform.State) error {
248+
res, ok := state.RootModule().Resources[name]
249+
if !ok {
250+
return fmt.Errorf("Incapsula security rule exception resource not found: %s", name)
251+
}
252+
253+
ruleID := res.Primary.ID
254+
if ruleID == "" {
255+
return fmt.Errorf("Incapsula security exception rule rule_id (%s) does not exist", ruleID)
256+
}
257+
258+
siteID := res.Primary.Attributes["site_id"]
259+
if siteID == "" {
260+
return fmt.Errorf("incapsula site_id does not exist")
261+
}
262+
263+
client := testAccProvider.Meta().(*Client)
264+
siteStatusResponse, err := client.ListSecurityRuleExceptions(siteID, ruleID)
265+
if err != nil {
266+
return fmt.Errorf("ListSecurityRuleExceptions Error for site_id (%s) and rule_id (%s) %s", siteID, ruleID, err)
267+
}
268+
269+
if siteStatusResponse == nil {
270+
return fmt.Errorf("Incapsula security rule exception for site id (%s) and rule_id (%s) does not exist", siteID, ruleID)
271+
}
272+
273+
return nil
274+
}
275+
}
276+
159277
// Good Security Rule Exception configs
160278
func testAccCheckACLSecurityRuleExceptionGoodConfigBlacklistedCountries(t *testing.T) string {
161279
return testAccCheckIncapsulaSiteConfigBasic(GenerateTestDomain(t)) + fmt.Sprintf("%s%s", `
@@ -193,3 +311,53 @@ resource "incapsula_security_rule_exception" "example-waf-blacklisted-countries-
193311
}`, securityRuleExceptionResourceNameBlacklistedCountries,
194312
)
195313
}
314+
315+
// Good Security Rule Exception configs - bots
316+
func testAccCheckSecurityRuleExceptionGoodConfigBots(t *testing.T) string {
317+
return testAccCheckIncapsulaSiteConfigBasic(GenerateTestDomain(t)) + fmt.Sprintf("%s", `
318+
resource "incapsula_security_rule_exception" "example-waf-bot-access-control-rule-exception" {
319+
site_id = "${incapsula_site.testacc-terraform-site.id}"
320+
rule_id = "api.threats.bot_access_control"
321+
client_app_types="DataScraper"
322+
client_apps="488,123"
323+
countries="JM"
324+
continents="EU"
325+
ips="1.2.3.6,1.2.3.7"
326+
urls="/myurl"
327+
user_agents="myUserAgent"
328+
}`,
329+
)
330+
}
331+
332+
// Bad Security Rule Exception configs - bots
333+
func testAccCheckSecurityRuleExceptionInvalidConfigBots(t *testing.T) string {
334+
return testAccCheckIncapsulaSiteConfigBasic(GenerateTestDomain(t)) + fmt.Sprintf("%s", `
335+
resource "incapsula_security_rule_exception" "example-waf-bot-access-control-rule-exception" {
336+
site_id = "${incapsula_site.testacc-terraform-site.id}"
337+
rule_id = "bad_rule_id"
338+
client_app_types="DataScraper"
339+
client_apps="488,123"
340+
countries="JM"
341+
continents="EU"
342+
ips="1.2.3.6,1.2.3.7"
343+
urls="/myurl"
344+
user_agents="myUserAgent"
345+
}`,
346+
)
347+
}
348+
349+
func testAccCheckSecurityRuleExceptionInvalidParamsBots(t *testing.T) string {
350+
return testAccCheckIncapsulaSiteConfigBasic(GenerateTestDomain(t)) + fmt.Sprintf("%s", `
351+
resource "incapsula_security_rule_exception" "example-waf-bot-access-control-rule-exception" {
352+
site_id = "${incapsula_site.testacc-terraform-site.id}"
353+
rule_id = "api.threats.bot_access_control"
354+
client_app_types="DataScraper"
355+
client_apps="488,123"
356+
countries="JM"
357+
continents="EU"
358+
ips="1.2.3.6,1.2.3."
359+
urls="/myurl"
360+
user_agents="myUserAgent"
361+
}`,
362+
)
363+
}

0 commit comments

Comments
 (0)