Merge branch 'imperva:master' into master

Author: dotanrazimpv

.github/workflows/acceptance-tests.yml

@@ -60,7 +60,7 @@ jobs:
         key: ${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
 
     #- name: Run unit tests
-     # run: go test ./incapsula
+     # run: go test -parallel=1 ./incapsula
 
     - name: Run acceptance tests
-      run: TF_LOG=debug make testacc
+      run: make testacc

incapsula/client_delivery_rules_configuration.go

@@ -55,7 +55,7 @@ func (c *Client) ReadDeliveryRuleConfiguration(siteID string, category string) (
 	responseBody, err := ioutil.ReadAll(resp.Body)
 
 	// Dump JSON
-	log.Printf("[DEBUG] Incapsula Read Waiting Room JSON response: %s\n", string(responseBody))
+	log.Printf("[DEBUG] Incapsula Read Delivery Rules JSON response: %s\n", string(responseBody))
 
 	if resp.StatusCode != 200 {
 		diags = append(diags, diag.Diagnostic{

incapsula/client_performance.go

@@ -30,9 +30,9 @@ type PerformanceSettings struct {
 		CacheShield         bool `json:"cache_shield"`
 		CacheResponseHeader struct {
 			Mode    string        `json:"mode,omitempty"`
-			Headers []interface{} `json:"headers,omitempty"`
+			Headers []interface{} `json:"headers"`
 		} `json:"cache_response_header,omitempty"`
-		TagResponseHeader    string `json:"tag_response_header,omitempty"`
+		TagResponseHeader    string `json:"tag_response_header"`
 		CacheEmptyResponses  bool   `json:"cache_empty_responses"`
 		Cache300X            bool   `json:"cache_300x"`
 		CacheHTTP10Responses bool   `json:"cache_http_10_responses"`
@@ -53,14 +53,14 @@ type PerformanceSettings struct {
 }
 
 // GetPerformanceSettings gets the site performance settings
-func (c *Client) GetPerformanceSettings(siteID string) (*PerformanceSettings, int, error) {
+func (c *Client) GetPerformanceSettings(siteID string) (*PerformanceSettings, error) {
 	log.Printf("[INFO] Getting Incapsula Performance Settings for Site ID %s\n", siteID)
 
 	// Post form to Incapsula
 	reqURL := fmt.Sprintf("%s/sites/%s/settings/cache", c.config.BaseURLRev2, siteID)
 	resp, err := c.DoJsonRequestWithHeaders(http.MethodGet, reqURL, nil, ReadSitePerformance)
 	if err != nil {
-		return nil, 0, fmt.Errorf("Error from Incapsula service when reading Incap Performance Settings for Site ID %s: %s", siteID, err)
+		return nil, fmt.Errorf("Error from Incapsula service when reading Incap Performance Settings for Site ID %s: %s", siteID, err)
 	}
 
 	// Read the body
@@ -72,17 +72,17 @@ func (c *Client) GetPerformanceSettings(siteID string) (*PerformanceSettings, in
 
 	// Check the response code
 	if resp.StatusCode != 200 {
-		return nil, resp.StatusCode, fmt.Errorf("Error status code %d from Incapsula service when reading Incap Performance Settings for Site ID %s: %s", resp.StatusCode, siteID, string(responseBody))
+		return nil, fmt.Errorf("Error status code %d from Incapsula service when reading Incap Performance Settings for Site ID %s: %s", resp.StatusCode, siteID, string(responseBody))
 	}
 
 	// Parse the JSON
 	var performanceSettings PerformanceSettings
 	err = json.Unmarshal([]byte(responseBody), &performanceSettings)
 	if err != nil {
-		return nil, resp.StatusCode, fmt.Errorf("Error parsing Incap Performance Settings JSON response for Site ID %s: %s\nresponse: %s", siteID, err, string(responseBody))
+		return nil, fmt.Errorf("Error parsing Incap Performance Settings JSON response for Site ID %s: %s\nresponse: %s", siteID, err, string(responseBody))
 	}
 
-	return &performanceSettings, resp.StatusCode, nil
+	return &performanceSettings, nil
 }
 
 // UpdatePerformanceSettings updates the site performance settings

incapsula/client_performance_test.go

@@ -17,7 +17,7 @@ func TestClientGetPerformanceSettingsBadConnection(t *testing.T) {
 	config := &Config{APIID: "foo", APIKey: "bar", BaseURL: "badness.incapsula.com"}
 	client := &Client{config: config, httpClient: &http.Client{Timeout: time.Millisecond * 1}}
 	siteID := "123"
-	performanceSettings, _, err := client.GetPerformanceSettings(siteID)
+	performanceSettings, err := client.GetPerformanceSettings(siteID)
 	if err == nil {
 		t.Errorf("Should have received an error")
 	}
@@ -47,7 +47,7 @@ func TestClientGetPerformanceSettingsBadJSON(t *testing.T) {
 	config := &Config{APIID: apiID, APIKey: apiKey, BaseURL: server.URL, BaseURLRev2: server.URL, BaseURLAPI: server.URL}
 	client := &Client{config: config, httpClient: &http.Client{}}
 
-	performanceSettings, _, err := client.GetPerformanceSettings(siteID)
+	performanceSettings, err := client.GetPerformanceSettings(siteID)
 	if err == nil {
 		t.Errorf("Should have received an error")
 	}
@@ -78,7 +78,7 @@ func TestClientGetPerformanceSettingsInvalidSite(t *testing.T) {
 	config := &Config{APIID: apiID, APIKey: apiKey, BaseURL: server.URL, BaseURLRev2: server.URL, BaseURLAPI: server.URL}
 	client := &Client{config: config, httpClient: &http.Client{}}
 
-	performanceSettings, _, err := client.GetPerformanceSettings(siteID)
+	performanceSettings, err := client.GetPerformanceSettings(siteID)
 	if err == nil {
 		t.Errorf("Should have received an error")
 	}
@@ -108,7 +108,7 @@ func TestClientGetPerformanceSettingsValidSite(t *testing.T) {
 	config := &Config{APIID: apiID, APIKey: apiKey, BaseURL: server.URL, BaseURLRev2: server.URL, BaseURLAPI: server.URL}
 	client := &Client{config: config, httpClient: &http.Client{}}
 
-	performanceSettings, _, err := client.GetPerformanceSettings(siteID)
+	performanceSettings, err := client.GetPerformanceSettings(siteID)
 	if err != nil {
 		t.Errorf("Should not have received an error")
 	}

incapsula/provider.go

@@ -127,7 +127,6 @@ func Provider() *schema.Provider {
 			"incapsula_api_security_endpoint_config":                           resourceApiSecurityEndpointConfig(),
 			"incapsula_notification_center_policy":                             resourceNotificationCenterPolicy(),
 			"incapsula_site_ssl_settings":                                      resourceSiteSSLSettings(),
-			"incapsula_site_log_configuration":                                 resourceSiteLogConfiguration(),
 			"incapsula_ssl_validation":                                         resourceDomainsValidation(),
 			"incapsula_csp_site_configuration":                                 resourceCSPSiteConfiguration(),
 			"incapsula_csp_site_domain":                                        resourceCSPSiteDomain(),
@@ -154,6 +153,7 @@ func Provider() *schema.Provider {
 			"incapsula_abp_websites":                                           resourceAbpWebsites(),
 			"incapsula_delivery_rules_configuration":                           resourceDeliveryRulesConfiguration(),
 			"incapsula_simplified_redirect_rules_configuration":                resourceSimplifiedRedirectRulesConfiguration(),
+			"incapsula_site_cache_configuration":                               resourceSiteCacheConfiguration(),
 		},
 	}
 

incapsula/resource_delivery_rules_configuration_test.go

@@ -3,6 +3,7 @@ package incapsula
 import (
 	"fmt"
 	"log"
+	"strconv"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -116,6 +117,16 @@ func testAccCheckIncapsulaDeliveryRuleDestroy(state *terraform.State) error {
 		}
 
 		siteID, ok := res.Primary.Attributes["site_id"]
+		if siteID == "" {
+			// There is a bug in Terraform: https://github.com/hashicorp/terraform/issues/23635
+			// Specifically, upgrades/destroys are happening simulatneously and not honoroing
+			// dependencies. In this case, it's possible that the site has already been deleted,
+			// which means that all of the subresources will have been cleared out.
+			// Ordinarily, this should return an error, but until this gets addressed, we're
+			// going to simply return nil.
+			// return fmt.Errorf("Incapsula site ID does not exist")
+			return nil
+		}
 		if !ok {
 			return fmt.Errorf("Incapsula Site ID does not exist")
 		}
@@ -126,6 +137,17 @@ func testAccCheckIncapsulaDeliveryRuleDestroy(state *terraform.State) error {
 
 		deliveryRulesListDTO, diags := client.ReadDeliveryRuleConfiguration(siteID, category)
 
+		// If the site has already been deleted then return nil
+		// Otherwise check the delivery rules list
+		siteIdInt, err := strconv.Atoi(siteID)
+		if err != nil {
+			return fmt.Errorf("Couldn't parse site ID: %s ", siteID)
+		}
+		_, siteStatusErr := client.SiteStatus(domain, siteIdInt)
+		if siteStatusErr != nil {
+			return nil
+		}
+
 		if diags != nil {
 			log.Printf("[ERROR] Failed to read delivery rules in category %s for Site ID %s", category, siteID)
 			return fmt.Errorf("failed to read delivery rules in category %s for Site ID %s\"", category, siteID)

incapsula/resource_incap_rule.go

@@ -54,6 +54,9 @@ func resourceIncapRule() *schema.Resource {
 				Description: "The filter defines the conditions that trigger the rule action. For action `RULE_ACTION_SIMPLIFIED_REDIRECT` filter is not relevant. For other actions, if left empty, the rule is always run.",
 				Type:        schema.TypeString,
 				Optional:    true,
+				DiffSuppressFunc: func(k, remoteState, desiredState string, d *schema.ResourceData) bool {
+					return strings.TrimSpace(remoteState) == strings.TrimSpace(desiredState)
+				},
 			},
 			"response_code": {
 				Description: "For `RULE_ACTION_REDIRECT` or `RULE_ACTION_SIMPLIFIED_REDIRECT` rule's response code, valid values are `302`, `301`, `303`, `307`, `308`. For `RULE_ACTION_RESPONSE_REWRITE_RESPONSE_CODE` rule's response code, valid values are all 3-digits numbers. For `RULE_ACTION_CUSTOM_ERROR_RESPONSE`, valid values are `400`, `401`, `402`, `403`, `404`, `405`, `406`, `407`, `408`, `409`, `410`, `411`, `412`, `413`, `414`, `415`, `416`, `417`, `419`, `420`, `422`, `423`, `424`, `500`, `501`, `502`, `503`, `504`, `505`, `507`.",

incapsula/resource_simplified_redirect_rules_configuration_test.go

@@ -3,6 +3,7 @@ package incapsula
 import (
 	"fmt"
 	"log"
+	"strconv"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -98,12 +99,33 @@ func testAccCheckIncapsulaDeliverySimplifiedRedirectRuleDestroy(state *terraform
 		}
 
 		siteID, ok := res.Primary.Attributes["site_id"]
+		if siteID == "" {
+			// There is a bug in Terraform: https://github.com/hashicorp/terraform/issues/23635
+			// Specifically, upgrades/destroys are happening simulatneously and not honoroing
+			// dependencies. In this case, it's possible that the site has already been deleted,
+			// which means that all of the subresources will have been cleared out.
+			// Ordinarily, this should return an error, but until this gets addressed, we're
+			// going to simply return nil.
+			// return fmt.Errorf("Incapsula site ID does not exist")
+			return nil
+		}
 		if !ok {
 			return fmt.Errorf("Incapsula Site ID does not exist")
 		}
 
 		deliveryRulesListDTO, diags := client.ReadDeliveryRuleConfiguration(siteID, category)
 
+		// If the site has already been deleted then return nil
+		// Otherwise check the delivery rules list
+		siteIdInt, err := strconv.Atoi(siteID)
+		if err != nil {
+			return fmt.Errorf("Couldn't parse site ID: %s ", siteID)
+		}
+		_, siteStatusErr := client.SiteStatus(domain, siteIdInt)
+		if siteStatusErr != nil {
+			return nil
+		}
+
 		if diags != nil {
 			log.Printf("[ERROR] Failed to read simplified redirect rules in category %s for Site ID %s", category, siteID)
 			return fmt.Errorf("failed to read simplified redirect rules in category %s for Site ID %s\"", category, siteID)

incapsula/resource_site.go

@@ -2,13 +2,14 @@ package incapsula
 
 import (
 	"fmt"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"log"
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
 const create_retries = 3
@@ -245,7 +246,7 @@ func resourceSite() *schema.Resource {
 				Optional:    true,
 			},
 			"perf_response_cache_response_header_mode": {
-				Description: "The working mode for caching response headers. Options are `all` and `custom`.",
+				Description: "The working mode for caching response headers. Options are `all`, `custom` and `disabled`.",
 				Type:        schema.TypeString,
 				Computed:    true,
 				Optional:    true,
@@ -514,7 +515,7 @@ func resourceSiteRead(d *schema.ResourceData, m interface{}) error {
 	d.Set("hash_salt", maskingResponse.HashSalt)
 
 	// Get the performance settings for the site
-	performanceSettingsResponse, _, err := client.GetPerformanceSettings(d.Id())
+	performanceSettingsResponse, err := client.GetPerformanceSettings(d.Id())
 	if err != nil {
 		log.Printf("[ERROR] Could not read Incapsula site peformance settings for domain: %s and site id: %d, %s\n", domain, siteID, err)
 		return err