Add exclusions to WAF cmdlets

src/FrontDoor/FrontDoor.Test/FrontDoor.Test.csproj

@@ -11,7 +11,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Azure.Management.FrontDoor" Version="1.0.0" />
+    <PackageReference Include="Microsoft.Azure.Management.FrontDoor" Version="2.0.0" />
   </ItemGroup>
 
 </Project>

src/FrontDoor/FrontDoor.Test/ScenarioTests/WebApplicationFireWallPolicyTests.ps1

@@ -25,9 +25,14 @@ function Test-PolicyCrud
     $matchCondition1 = New-AzFrontDoorWafMatchConditionObject -MatchVariable RequestHeader -OperatorProperty Contains -Selector "UserAgent" -MatchValue "WINDOWS" -Transform "Uppercase"
     $customRule1 = New-AzFrontDoorWafCustomRuleObject -Name "Rule1" -RuleType MatchRule -MatchCondition $matchCondition1 -Action Block -Priority 2
 
-    $ruleOverride = New-AzFrontDoorWafManagedRuleOverrideObject -RuleId "942100" -Action Log
-    $override1 = New-AzFrontDoorWafRuleGroupOverrideObject -RuleGroupName SQLI -ManagedRuleOverride $ruleOverride
-    $managedRule1 = New-AzFrontDoorWafManagedRuleObject -Type DefaultRuleSet -Version "1.0" -RuleGroupOverride $override1
+    # Create exclusion objects
+    $exclusionRule = New-AzFrontDoorWafManagedRuleExclusionObject -Variable QueryStringArgNames -Operator Equals -Selector "ExcludeInRule"
+    $exclusionGroup = New-AzFrontDoorWafManagedRuleExclusionObject -Variable QueryStringArgNames -Operator Equals -Selector "ExcludeInGroup"
+    $exclusionSet = New-AzFrontDoorWafManagedRuleExclusionObject -Variable QueryStringArgNames -Operator Equals -Selector "ExcludeInSet"
+
+    $ruleOverride = New-AzFrontDoorWafManagedRuleOverrideObject -RuleId "942100" -Action Log -Exclusion $exclusionRule
+    $override1 = New-AzFrontDoorWafRuleGroupOverrideObject -RuleGroupName SQLI -ManagedRuleOverride $ruleOverride -Exclusion $exclusionGroup
+    $managedRule1 = New-AzFrontDoorWafManagedRuleObject -Type DefaultRuleSet -Version "1.0" -RuleGroupOverride $override1 -Exclusion $exclusionSet
     $managedRule2 = New-AzFrontDoorWafManagedRuleObject -Type BotProtection -Version "preview-0.1"
 
     New-AzFrontDoorWafPolicy -Name $Name -ResourceGroupName $resourceGroupName -Customrule $customRule1 -ManagedRule $managedRule1,$managedRule2 -EnabledState Enabled -Mode Prevention
@@ -44,7 +49,10 @@ function Test-PolicyCrud
     Assert-AreEqual $matchCondition1.OperatorProperty $retrievedPolicy.CustomRules[0].MatchConditions[0].OperatorProperty
     Assert-AreEqual $matchCondition1.MatchValue[0] $retrievedPolicy.CustomRules[0].MatchConditions[0].MatchValue[0]
     Assert-AreEqual $matchCondition1.Transform[0] $retrievedPolicy.CustomRules[0].MatchConditions[0].Transform[0]
+    Assert-AreEqual $managedRule1.Exclusions[0].Selector $retrievedPolicy.ManagedRules[0].Exclusions[0].Selector
     Assert-AreEqual $managedRule1.RuleGroupOverrides[0].ManagedRuleOverrides[0].Action $retrievedPolicy.ManagedRules[0].RuleGroupOverrides[0].ManagedRuleOverrides[0].Action
+    Assert-AreEqual $managedRule1.RuleGroupOverrides[0].Exclusions[0].Selector $retrievedPolicy.ManagedRules[0].RuleGroupOverrides[0].Exclusions[0].Selector
+    Assert-AreEqual $managedRule1.RuleGroupOverrides[0].ManagedRuleOverrides[0].Exclusions[0].Selector $retrievedPolicy.ManagedRules[0].RuleGroupOverrides[0].ManagedRuleOverrides[0].Exclusions[0].Selector
     Assert-AreEqual $managedRule1.RuleSetType $retrievedPolicy.ManagedRules[0].RuleSetType
     Assert-AreEqual $managedRule1.RuleSetVersion $retrievedPolicy.ManagedRules[0].RuleSetVersion
     Assert-AreEqual $managedRule2.RuleSetType $retrievedPolicy.ManagedRules[1].RuleSetType

src/FrontDoor/FrontDoor/Az.FrontDoor.psd1

@@ -90,7 +90,8 @@ CmdletsToExport = 'New-AzFrontDoor', 'Get-AzFrontDoor', 'Set-AzFrontDoor',
                'Remove-AzFrontDoorContent', 'Enable-AzFrontDoorCustomDomainHttps', 
                'Disable-AzFrontDoorCustomDomainHttps', 
                'Get-AzFrontDoorFrontendEndpoint', 
-               'New-AzFrontDoorWafManagedRuleOverrideObject'
+               'New-AzFrontDoorWafManagedRuleOverrideObject',
+               'New-AzFrontDoorWafManagedRuleExclusionObject'
 
 # Variables to export from this module
 # VariablesToExport = @()

src/FrontDoor/FrontDoor/ChangeLog.md

@@ -18,6 +18,8 @@
         - Additional information about change #1
 -->
 ## Upcoming Release
+* Added WAF managed rules exclusion support
+* Add SocketAddr to auto-complete
 
 ## Version 1.2.0
 * Add MinimumTlsVersion parameter to Enable-AzFrontDoorCustomDomainHttps and New-AzFrontDoorFrontendEndpointObject

src/FrontDoor/FrontDoor/Cmdlets/GetAzureRmFrontDoorWafPolicy.cs

@@ -12,17 +12,14 @@
 // limitations under the License.
 // ----------------------------------------------------------------------------------
 
-using System;
-using System.Collections;
-using System.Management.Automation;
-using System.Net;
 using Microsoft.Azure.Commands.FrontDoor.Common;
 using Microsoft.Azure.Commands.FrontDoor.Helpers;
 using Microsoft.Azure.Commands.FrontDoor.Models;
 using Microsoft.Azure.Commands.FrontDoor.Properties;
 using Microsoft.Azure.Management.FrontDoor;
 using System.Linq;
-using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
+using System.Management.Automation;
+using System.Net;
 
 namespace Microsoft.Azure.Commands.FrontDoor.Cmdlets
 {

src/FrontDoor/FrontDoor/Cmdlets/NewAzureRmFrontDoor.cs

@@ -12,18 +12,15 @@
 // limitations under the License.
 // ----------------------------------------------------------------------------------
 
-using System;
-using System.Collections;
-using System.Management.Automation;
-using System.Net;
 using Microsoft.Azure.Commands.FrontDoor.Common;
 using Microsoft.Azure.Commands.FrontDoor.Helpers;
 using Microsoft.Azure.Commands.FrontDoor.Models;
 using Microsoft.Azure.Commands.FrontDoor.Properties;
-using Microsoft.WindowsAzure.Commands.Utilities.Common;
 using Microsoft.Azure.Management.FrontDoor;
+using Microsoft.WindowsAzure.Commands.Utilities.Common;
+using System.Collections;
 using System.Linq;
-using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
+using System.Management.Automation;
 
 namespace Microsoft.Azure.Commands.FrontDoor.Cmdlets
 {

src/FrontDoor/FrontDoor/Cmdlets/NewAzureRmFrontDoorWafManagedRuleExclusionObject.cs

@@ -0,0 +1,78 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System.Linq;
+using System.Management.Automation;
+using Microsoft.Azure.Commands.FrontDoor.Common;
+using Microsoft.Azure.Commands.FrontDoor.Models;
+using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
+
+namespace Microsoft.Azure.Commands.FrontDoor.Cmdlets
+{
+    /// <summary>
+    /// Defines the New-AzFrontDoorWafManagedRuleExclusionObject cmdlet.
+    /// </summary>
+    [Cmdlet("New", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "FrontDoorWafManagedRuleExclusionObject"), OutputType(typeof(PSManagedRuleExclusion))]
+    public class NewAzureRmFrontDoorWafManagedRuleExclusionObject : AzureFrontDoorCmdletBase
+    {
+        /// <summary>
+        /// Exclusion match variable
+        /// </summary>
+        [Parameter(Mandatory = true, HelpMessage = "Match variable")]
+        [PSArgumentCompleter("RequestHeaderNames", "RequestCookieNames", "QueryStringArgNames", "RequestBodyPostArgNames")]
+        public string Variable { get; set; }
+
+        /// <summary>
+        /// Exclusion operator, performed on the selector
+        /// In the case of EqualsAny, the selector cannot be specified (it will exclude all match variables of the specified type)
+        /// </summary>
+        [Parameter(Mandatory = true, HelpMessage = "Operator")]
+        [PSArgumentCompleter("Equals", "Contains", "StartsWith", "EndsWith", "EqualsAny")]
+        public string Operator { get; set; }
+
+        /// <summary>
+        /// Exclusion selector
+        /// </summary>
+        [Parameter(Mandatory = false, HelpMessage = "Selector")]
+        public string Selector { get; set; }
+
+        public override void ExecuteCmdlet()
+        {
+            ValidateArguments();
+
+            var rule = new PSManagedRuleExclusion
+            {
+                MatchVariable = Variable,
+                SelectorMatchOperator = Operator,
+                Selector = Selector
+            };
+            WriteObject(rule);
+        }
+
+        private void ValidateArguments()
+        {
+            if (Operator == PSExclusionOperatorProperty.EqualsAny.ToString() && Selector != null)
+            {
+                // Selector is required if the operator is not "EqualsAny".
+                throw new PSArgumentException(nameof(Selector));
+            }
+
+            if (Operator != PSExclusionOperatorProperty.EqualsAny.ToString() && string.IsNullOrEmpty(Selector))
+            {
+                // Selector cannot be specified if the operator is "EqualsAny".
+                throw new PSArgumentNullException(nameof(Selector));
+            }
+        }
+    }
+}

src/FrontDoor/FrontDoor/Cmdlets/NewAzureRmFrontDoorWafManagedRuleObject.cs

@@ -46,13 +46,20 @@ public class NewAzureRmFrontDoorWafManagedRuleObject : AzureFrontDoorCmdletBase
         [Parameter(Mandatory = false, HelpMessage = "List of azure managed provider override configuration")]
         public PSAzureRuleGroupOverride[] RuleGroupOverride { get; set; }
 
+        /// <summary>
+        /// Exclusions
+        /// </summary>
+        [Parameter(Mandatory = false, HelpMessage = "Exclusions")]
+        public PSManagedRuleExclusion[] Exclusion { get; set; }
+
         public override void ExecuteCmdlet()
         {
             var rule = new PSAzureManagedRule
             {
                RuleSetType = Type,
                RuleSetVersion = Version,
-               RuleGroupOverrides = RuleGroupOverride?.ToList()
+               RuleGroupOverrides = RuleGroupOverride?.ToList(),
+               Exclusions = Exclusion?.ToList()
             };
             WriteObject(rule);
         }

src/FrontDoor/FrontDoor/Cmdlets/NewAzureRmFrontDoorWafManagedRuleOverrideObject.cs

@@ -12,11 +12,12 @@
 // limitations under the License.
 // ----------------------------------------------------------------------------------
 
-using System.Management.Automation;
 using Microsoft.Azure.Commands.FrontDoor.Common;
-using Microsoft.WindowsAzure.Commands.Utilities.Common;
 using Microsoft.Azure.Commands.FrontDoor.Models;
 using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
+using Microsoft.WindowsAzure.Commands.Utilities.Common;
+using System.Linq;
+using System.Management.Automation;
 
 namespace Microsoft.Azure.Commands.FrontDoor.Cmdlets
 {
@@ -45,13 +46,20 @@ public class NewAzureRmFrontDoorWafManagedRuleOverrideObject : AzureFrontDoorCmd
         [Parameter(Mandatory = false, HelpMessage = "Disabled state")]
         public SwitchParameter Disabled { get; set; }
 
+        /// <summary>
+        /// Exclusions
+        /// </summary>
+        [Parameter(Mandatory = false, HelpMessage = "Exclusions")]
+        public PSManagedRuleExclusion[] Exclusion { get; set; }
+
         public override void ExecuteCmdlet()
         {
             var managedRuleOverride = new PSAzureManagedRuleOverride
             {
                 RuleId = RuleId,
                 Action = this.IsParameterBound(c => c.Action) ? Action : null,
-                EnabledState = (this.IsParameterBound(c => c.Disabled) && Disabled.IsPresent) ? PSEnabledState.Disabled : PSEnabledState.Enabled
+                EnabledState = (this.IsParameterBound(c => c.Disabled) && Disabled.IsPresent) ? PSEnabledState.Disabled : PSEnabledState.Enabled,
+                Exclusions = Exclusion?.ToList()
             };
             WriteObject(managedRuleOverride);
         }

src/FrontDoor/FrontDoor/Cmdlets/NewAzureRmFrontDoorWafMatchConditionObject.cs

@@ -31,10 +31,10 @@ public class NewAzureRmFrontDoorWafMatchConditionObject : AzureFrontDoorCmdletBa
         /// <summary>
         /// Match Variable. 
         /// Possible values include: 'RemoteAddr', 'RequestMethod', 'QueryString', 'PostArgs',
-        /// 'RequestUri', 'RequestHeader', 'RequestBody'
+        /// 'RequestUri', 'RequestHeader', 'RequestBody', 'SocketAddr'
         /// </summary>
-        [Parameter(Mandatory = true, HelpMessage = "Match Variable. Possible values include: 'RemoteAddr', 'RequestMethod', 'QueryString', 'PostArgs','RequestUri', 'RequestHeader', 'RequestBody'")]
-        [PSArgumentCompleter("RemoteAddr", "RequestMethod", "QueryString", "PostArgs", "RequestUri", "RequestHeader", "RequestBody")]
+        [Parameter(Mandatory = true, HelpMessage = "Match Variable. Possible values include: 'RemoteAddr', 'RequestMethod', 'QueryString', 'PostArgs','RequestUri', 'RequestHeader', 'RequestBody', 'SocketAddr'")]
+        [PSArgumentCompleter("RemoteAddr", "RequestMethod", "QueryString", "PostArgs", "RequestUri", "RequestHeader", "RequestBody", "SocketAddr")]
         public string MatchVariable { get; set; }
 
         /// <summary>

src/FrontDoor/FrontDoor/Cmdlets/NewAzureRmFrontDoorWafRuleGroupOverrideObject.cs

@@ -37,12 +37,19 @@ public class NewAzureRmFrontDoorWafRuleGroupOverrideObject : AzureFrontDoorCmdle
         [Parameter(Mandatory = false, HelpMessage = "Rule override list")]
         public PSAzureManagedRuleOverride[] ManagedRuleOverride { get; set; }
 
+        /// <summary>
+        /// Exclusions
+        /// </summary>
+        [Parameter(Mandatory = false, HelpMessage = "Exclusions")]
+        public PSManagedRuleExclusion[] Exclusion { get; set; }
+
         public override void ExecuteCmdlet()
         {
             var ruleGroupOverride = new PSAzureRuleGroupOverride 
             {
                ManagedRuleOverrides = ManagedRuleOverride?.ToList(),
-               RuleGroupName = RuleGroupName
+               RuleGroupName = RuleGroupName,
+               Exclusions = Exclusion?.ToList()
             };
             WriteObject(ruleGroupOverride);
         }

src/FrontDoor/FrontDoor/FrontDoor.csproj

@@ -11,7 +11,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Azure.Management.FrontDoor" Version="1.0.0" />
+    <PackageReference Include="Microsoft.Azure.Management.FrontDoor" Version="2.0.0" />
   </ItemGroup>
 
   <ItemGroup>

src/FrontDoor/FrontDoor/Helpers/ModelExtensions.cs

@@ -20,6 +20,7 @@
 using System.Linq;
 using System.Management.Automation;
 using System.Text;
+using sdkAzManagedRuleExclusion = Microsoft.Azure.Management.FrontDoor.Models.ManagedRuleExclusion;
 using sdkAzManagedRuleGroupOverride = Microsoft.Azure.Management.FrontDoor.Models.ManagedRuleGroupOverride;
 using sdkAzManagedRuleOverride = Microsoft.Azure.Management.FrontDoor.Models.ManagedRuleOverride;
 using SdkBackend = Microsoft.Azure.Management.FrontDoor.Models.Backend;
@@ -383,20 +384,32 @@ public static PSAzureRuleGroupOverride ToPSAzRuleGroupOverride(this sdkAzManaged
                     {
                         Action = ruleOverride.Action,
                         EnabledState = ruleOverride.EnabledState == null ? (PSEnabledState?)null : (PSEnabledState)Enum.Parse(typeof(PSEnabledState), ruleOverride.EnabledState),
-                        RuleId = ruleOverride.RuleId
+                        RuleId = ruleOverride.RuleId,
+                        Exclusions = ruleOverride.Exclusions?.Select(exclusion => exclusion.ToPSAzManagedRuleExclusion()).ToList()
                     };
-                }).ToList()
+                }).ToList(),
+                Exclusions = sdkAzOverride.Exclusions?.Select(exclusion => exclusion.ToPSAzManagedRuleExclusion()).ToList()
             };
         }
 
+        public static PSManagedRuleExclusion ToPSAzManagedRuleExclusion(this sdkAzManagedRuleExclusion sdkAzExclusion)
+        {
+            return new PSManagedRuleExclusion()
+            {
+                MatchVariable = sdkAzExclusion.MatchVariable,
+                Selector = sdkAzExclusion.Selector,
+                SelectorMatchOperator = sdkAzExclusion.SelectorMatchOperator
+            };
+        }
 
         public static PSManagedRule ToPSManagedRule(this SdkManagedRule sdkRule)
         {
             return new PSAzureManagedRule
             {
                 RuleSetType = sdkRule.RuleSetType,
                 RuleSetVersion = sdkRule.RuleSetVersion,
-                RuleGroupOverrides = sdkRule.RuleGroupOverrides?.Select(ruleGroupOverride => ruleGroupOverride.ToPSAzRuleGroupOverride()).ToList()
+                RuleGroupOverrides = sdkRule.RuleGroupOverrides?.Select(ruleGroupOverride => ruleGroupOverride.ToPSAzRuleGroupOverride()).ToList(),
+                Exclusions = sdkRule.Exclusions?.Select(exclusion => exclusion.ToPSAzManagedRuleExclusion()).ToList()
             };
         }
 
@@ -442,9 +455,21 @@ public static sdkAzManagedRuleGroupOverride ToSdkAzRuleGroupOverride(this PSAzur
                     {
                         Action = ruleOverride.Action,
                         EnabledState = ruleOverride.EnabledState.HasValue ? ruleOverride.EnabledState.Value.ToString() : null,
-                        RuleId = ruleOverride.RuleId
+                        RuleId = ruleOverride.RuleId,
+                        Exclusions = ruleOverride.Exclusions?.Select(x => x.ToSdkAzManagedRuleExclusion()).ToList()
                     };
-                }).ToList()
+                }).ToList(),
+                Exclusions = psAzOverride.Exclusions?.Select(x => x.ToSdkAzManagedRuleExclusion()).ToList()
+            };
+        }
+
+        public static sdkAzManagedRuleExclusion ToSdkAzManagedRuleExclusion(this PSManagedRuleExclusion psAzManagedRuleExclusion)
+        {
+            return new sdkAzManagedRuleExclusion()
+            {
+                MatchVariable = psAzManagedRuleExclusion.MatchVariable,
+                Selector = psAzManagedRuleExclusion.Selector,
+                SelectorMatchOperator = psAzManagedRuleExclusion.SelectorMatchOperator
             };
         }
 
@@ -455,7 +480,8 @@ public static SdkManagedRule ToSdkAzManagedRule(this PSManagedRule psRule)
             {
                 RuleSetType = psAzRule.RuleSetType,
                 RuleSetVersion = psAzRule.RuleSetVersion,
-                RuleGroupOverrides = psAzRule.RuleGroupOverrides?.Select(x => x.ToSdkAzRuleGroupOverride()).ToList()
+                RuleGroupOverrides = psAzRule.RuleGroupOverrides?.Select(x => x.ToSdkAzRuleGroupOverride()).ToList(),
+                Exclusions = psAzRule.Exclusions?.Select(x => x.ToSdkAzManagedRuleExclusion()).ToList()
             };
         }
 

src/FrontDoor/FrontDoor/Models/PSAzureManagedRule.cs

@@ -19,5 +19,7 @@ namespace Microsoft.Azure.Commands.FrontDoor.Models
     public class PSAzureManagedRule : PSManagedRule
     {
         public List<PSAzureRuleGroupOverride> RuleGroupOverrides { get; set; }
+
+        public List<PSManagedRuleExclusion> Exclusions { get; set; }
     }
 }

src/FrontDoor/FrontDoor/Models/PSAzureManagedRuleOverride.cs

@@ -12,6 +12,8 @@
 // limitations under the License.
 // ----------------------------------------------------------------------------------
 
+using System.Collections.Generic;
+
 namespace Microsoft.Azure.Commands.FrontDoor.Models
 {
     public class PSAzureManagedRuleOverride
@@ -21,5 +23,7 @@ public class PSAzureManagedRuleOverride
         public PSEnabledState? EnabledState { get; set; }
 
         public string Action { get; set; }
+
+        public List<PSManagedRuleExclusion> Exclusions { get; set; }
     }
 }

src/FrontDoor/FrontDoor/Models/PSAzureRuleGroupOverride.cs

@@ -21,5 +21,7 @@ public class PSAzureRuleGroupOverride
         public string RuleGroupName { get; set; }
 
         public List<PSAzureManagedRuleOverride> ManagedRuleOverrides { get; set; }
+
+        public List<PSManagedRuleExclusion> Exclusions { get; set; }
     }
 }