resource_services_advanced_anti_malware_policy.go

package junos

import (
	"context"
	"fmt"
	"strings"

	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
)

type svcAdvancedAntiMalwarePolicyOptions struct {
	blacklistNotificationLog       bool
	defaultNotificationLog         bool
	fallbackOptionsNotificationLog bool
	httpNotificationLog            bool
	imapNotificationLog            bool
	smtpNotificationLog            bool
	whitelistNotificationLog       bool
	fallbackOptionsAction          string
	httpAction                     string
	httpClientNotifyFile           string
	httpClientNotifyMessage        string
	httpClientNotifyRedirectURL    string
	httpFileVerdictUnknown         string
	httpInspectionProfile          string
	imapInspectionProfile          string
	name                           string
	smtpInspectionProfile          string
	verdictThreshold               string
}

func resourceServicesAdvancedAntiMalwarePolicy() *schema.Resource {
	return &schema.Resource{
		CreateContext: resourceServicesAdvancedAntiMalwarePolicyCreate,
		ReadContext:   resourceServicesAdvancedAntiMalwarePolicyRead,
		UpdateContext: resourceServicesAdvancedAntiMalwarePolicyUpdate,
		DeleteContext: resourceServicesAdvancedAntiMalwarePolicyDelete,
		Importer: &schema.ResourceImporter{
			State: resourceServicesAdvancedAntiMalwarePolicyImport,
		},
		Schema: map[string]*schema.Schema{
			"name": {
				Type:     schema.TypeString,
				ForceNew: true,
				Required: true,
			},
			"blacklist_notification_log": {
				Type:     schema.TypeBool,
				Optional: true,
			},
			"default_notification_log": {
				Type:     schema.TypeBool,
				Optional: true,
			},
			"fallback_options_action": {
				Type:         schema.TypeString,
				Optional:     true,
				ValidateFunc: validation.StringInSlice([]string{"block", "permit"}, false),
			},
			"fallback_options_notification_log": {
				Type:     schema.TypeBool,
				Optional: true,
			},
			"http_action": {
				Type:         schema.TypeString,
				Optional:     true,
				ValidateFunc: validation.StringInSlice([]string{"block", "permit"}, false),
				RequiredWith: []string{"http_inspection_profile"},
			},
			"http_client_notify_file": {
				Type:          schema.TypeString,
				Optional:      true,
				ConflictsWith: []string{"http_client_notify_message", "http_client_notify_redirect_url"},
				RequiredWith:  []string{"http_action", "http_inspection_profile"},
			},
			"http_client_notify_message": {
				Type:          schema.TypeString,
				Optional:      true,
				ConflictsWith: []string{"http_client_notify_file", "http_client_notify_redirect_url"},
				RequiredWith:  []string{"http_action", "http_inspection_profile"},
			},
			"http_client_notify_redirect_url": {
				Type:          schema.TypeString,
				Optional:      true,
				ConflictsWith: []string{"http_client_notify_file", "http_client_notify_message"},
				RequiredWith:  []string{"http_action", "http_inspection_profile"},
			},
			"http_file_verdict_unknown": {
				Type:         schema.TypeString,
				Optional:     true,
				ValidateFunc: validation.StringInSlice([]string{"block", "permit"}, false),
				RequiredWith: []string{"http_action", "http_inspection_profile"},
			},
			"http_inspection_profile": {
				Type:         schema.TypeString,
				Optional:     true,
				RequiredWith: []string{"http_action"},
			},
			"http_notification_log": {
				Type:         schema.TypeBool,
				Optional:     true,
				RequiredWith: []string{"http_action", "http_inspection_profile"},
			},
			"imap_inspection_profile": {
				Type:     schema.TypeString,
				Optional: true,
			},
			"imap_notification_log": {
				Type:         schema.TypeBool,
				Optional:     true,
				RequiredWith: []string{"imap_inspection_profile"},
			},
			"smtp_inspection_profile": {
				Type:     schema.TypeString,
				Optional: true,
			},
			"smtp_notification_log": {
				Type:         schema.TypeBool,
				Optional:     true,
				RequiredWith: []string{"smtp_inspection_profile"},
			},
			"verdict_threshold": {
				Type:     schema.TypeString,
				Optional: true,
				ValidateFunc: validation.StringInSlice([]string{
					"recommended", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10",
				}, false),
			},
			"whitelist_notification_log": {
				Type:     schema.TypeBool,
				Optional: true,
			},
		},
	}
}

func resourceServicesAdvancedAntiMalwarePolicyCreate(ctx context.Context,
	d *schema.ResourceData, m interface{}) diag.Diagnostics {
	sess := m.(*Session)
	if sess.junosFakeCreateSetFile != "" {
		if err := setServicesAdvancedAntiMalwarePolicy(d, m, nil); err != nil {
			return diag.FromErr(err)
		}
		d.SetId(d.Get("name").(string))

		return nil
	}
	jnprSess, err := sess.startNewSession()
	if err != nil {
		return diag.FromErr(err)
	}
	defer sess.closeSession(jnprSess)
	sess.configLock(jnprSess)
	var diagWarns diag.Diagnostics
	svcAdvancedAntiMalwarePolicyExists, err :=
		checkServicesAdvancedAntiMalwarePolicyExists(d.Get("name").(string), m, jnprSess)
	if err != nil {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	if svcAdvancedAntiMalwarePolicyExists {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns,
			diag.FromErr(fmt.Errorf(
				"services advanced-anti-malware policy %v already exists", d.Get("name").(string)))...)
	}

	if err := setServicesAdvancedAntiMalwarePolicy(d, m, jnprSess); err != nil {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	warns, err := sess.commitConf("create resource junos_services_advanced_anti_malware_policy", jnprSess)
	appendDiagWarns(&diagWarns, warns)
	if err != nil {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	svcAdvancedAntiMalwarePolicyExists, err =
		checkServicesAdvancedAntiMalwarePolicyExists(d.Get("name").(string), m, jnprSess)
	if err != nil {
		return append(diagWarns, diag.FromErr(err)...)
	}
	if svcAdvancedAntiMalwarePolicyExists {
		d.SetId(d.Get("name").(string))
	} else {
		return append(diagWarns, diag.FromErr(fmt.Errorf(
			"services advanced-anti-malware policy %v "+
				"not exists after commit => check your config", d.Get("name").(string)))...)
	}

	return append(diagWarns, resourceServicesAdvancedAntiMalwarePolicyReadWJnprSess(d, m, jnprSess)...)
}

func resourceServicesAdvancedAntiMalwarePolicyRead(ctx context.Context,
	d *schema.ResourceData, m interface{}) diag.Diagnostics {
	sess := m.(*Session)
	jnprSess, err := sess.startNewSession()
	if err != nil {
		return diag.FromErr(err)
	}
	defer sess.closeSession(jnprSess)

	return resourceServicesAdvancedAntiMalwarePolicyReadWJnprSess(d, m, jnprSess)
}

func resourceServicesAdvancedAntiMalwarePolicyReadWJnprSess(
	d *schema.ResourceData, m interface{}, jnprSess *NetconfObject) diag.Diagnostics {
	mutex.Lock()
	svcAdvancedAntiMalwarePolicyOptions, err :=
		readServicesAdvancedAntiMalwarePolicy(d.Get("name").(string), m, jnprSess)
	mutex.Unlock()
	if err != nil {
		return diag.FromErr(err)
	}
	if svcAdvancedAntiMalwarePolicyOptions.name == "" {
		d.SetId("")
	} else {
		fillServicesAdvancedAntiMalwarePolicyData(d, svcAdvancedAntiMalwarePolicyOptions)
	}

	return nil
}

func resourceServicesAdvancedAntiMalwarePolicyUpdate(ctx context.Context,
	d *schema.ResourceData, m interface{}) diag.Diagnostics {
	d.Partial(true)
	sess := m.(*Session)
	jnprSess, err := sess.startNewSession()
	if err != nil {
		return diag.FromErr(err)
	}
	defer sess.closeSession(jnprSess)
	sess.configLock(jnprSess)
	var diagWarns diag.Diagnostics
	if err := delServicesAdvancedAntiMalwarePolicy(d.Get("name").(string), m, jnprSess); err != nil {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	if err := setServicesAdvancedAntiMalwarePolicy(d, m, jnprSess); err != nil {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	warns, err := sess.commitConf("update resource junos_services_advanced_anti_malware_policy", jnprSess)
	appendDiagWarns(&diagWarns, warns)
	if err != nil {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	d.Partial(false)

	return append(diagWarns, resourceServicesAdvancedAntiMalwarePolicyReadWJnprSess(d, m, jnprSess)...)
}

func resourceServicesAdvancedAntiMalwarePolicyDelete(ctx context.Context,
	d *schema.ResourceData, m interface{}) diag.Diagnostics {
	sess := m.(*Session)
	jnprSess, err := sess.startNewSession()
	if err != nil {
		return diag.FromErr(err)
	}
	defer sess.closeSession(jnprSess)
	sess.configLock(jnprSess)
	var diagWarns diag.Diagnostics
	if err := delServicesAdvancedAntiMalwarePolicy(d.Get("name").(string), m, jnprSess); err != nil {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns, diag.FromErr(err)...)
	}
	warns, err := sess.commitConf("delete resource junos_services_advanced_anti_malware_policy", jnprSess)
	appendDiagWarns(&diagWarns, warns)
	if err != nil {
		appendDiagWarns(&diagWarns, sess.configClear(jnprSess))

		return append(diagWarns, diag.FromErr(err)...)
	}

	return diagWarns
}

func resourceServicesAdvancedAntiMalwarePolicyImport(
	d *schema.ResourceData, m interface{}) ([]*schema.ResourceData, error) {
	sess := m.(*Session)
	jnprSess, err := sess.startNewSession()
	if err != nil {
		return nil, err
	}
	defer sess.closeSession(jnprSess)
	result := make([]*schema.ResourceData, 1)
	svcAdvancedAntiMalwarePolicyExists, err := checkServicesAdvancedAntiMalwarePolicyExists(d.Id(), m, jnprSess)
	if err != nil {
		return nil, err
	}
	if !svcAdvancedAntiMalwarePolicyExists {
		return nil, fmt.Errorf("don't find services advanced-anti-malware policy with id '%v' (id must be <name>)", d.Id())
	}
	svcAdvancedAntiMalwarePolicyOptions, err := readServicesAdvancedAntiMalwarePolicy(d.Id(), m, jnprSess)
	if err != nil {
		return nil, err
	}
	fillServicesAdvancedAntiMalwarePolicyData(d, svcAdvancedAntiMalwarePolicyOptions)

	result[0] = d

	return result, nil
}

func checkServicesAdvancedAntiMalwarePolicyExists(
	policy string, m interface{}, jnprSess *NetconfObject) (bool, error) {
	sess := m.(*Session)
	policyConfig, err := sess.command(
		"show configuration services advanced-anti-malware policy \""+policy+"\" | display set", jnprSess)
	if err != nil {
		return false, err
	}
	if policyConfig == emptyWord {
		return false, nil
	}

	return true, nil
}

func setServicesAdvancedAntiMalwarePolicy(d *schema.ResourceData, m interface{}, jnprSess *NetconfObject) error {
	sess := m.(*Session)
	configSet := make([]string, 0)

	setPrefix := "set services advanced-anti-malware policy \"" + d.Get("name").(string) + "\" "
	if d.Get("blacklist_notification_log").(bool) {
		configSet = append(configSet, setPrefix+"blacklist-notification log")
	}
	if d.Get("default_notification_log").(bool) {
		configSet = append(configSet, setPrefix+"default-notification log")
	}
	if v := d.Get("fallback_options_action").(string); v != "" {
		configSet = append(configSet, setPrefix+"fallback-options action "+v)
	}
	if d.Get("fallback_options_notification_log").(bool) {
		configSet = append(configSet, setPrefix+"fallback-options notification log")
	}
	if v := d.Get("http_action").(string); v != "" {
		configSet = append(configSet, setPrefix+"http action "+v)
	}
	if v := d.Get("http_client_notify_file").(string); v != "" {
		configSet = append(configSet, setPrefix+"http client-notify file \""+v+"\"")
	}
	if v := d.Get("http_client_notify_message").(string); v != "" {
		configSet = append(configSet, setPrefix+"http client-notify message \""+v+"\"")
	}
	if v := d.Get("http_client_notify_redirect_url").(string); v != "" {
		configSet = append(configSet, setPrefix+"http client-notify redirect-url \""+v+"\"")
	}
	if v := d.Get("http_file_verdict_unknown").(string); v != "" {
		configSet = append(configSet, setPrefix+"http file-verdict-unknown "+v)
	}
	if v := d.Get("http_inspection_profile").(string); v != "" {
		configSet = append(configSet, setPrefix+"http inspection-profile \""+v+"\"")
	}
	if d.Get("http_notification_log").(bool) {
		configSet = append(configSet, setPrefix+"http notification log")
	}
	if v := d.Get("imap_inspection_profile").(string); v != "" {
		configSet = append(configSet, setPrefix+"imap inspection-profile \""+v+"\"")
	}
	if d.Get("imap_notification_log").(bool) {
		configSet = append(configSet, setPrefix+"imap notification log")
	}
	if v := d.Get("smtp_inspection_profile").(string); v != "" {
		configSet = append(configSet, setPrefix+"smtp inspection-profile \""+v+"\"")
	}
	if d.Get("smtp_notification_log").(bool) {
		configSet = append(configSet, setPrefix+"smtp notification log")
	}
	if v := d.Get("verdict_threshold").(string); v != "" {
		configSet = append(configSet, setPrefix+"verdict-threshold "+v)
	}
	if d.Get("whitelist_notification_log").(bool) {
		configSet = append(configSet, setPrefix+"whitelist-notification log")
	}

	return sess.configSet(configSet, jnprSess)
}

func readServicesAdvancedAntiMalwarePolicy(policy string, m interface{}, jnprSess *NetconfObject) (
	svcAdvancedAntiMalwarePolicyOptions, error) {
	sess := m.(*Session)
	var confRead svcAdvancedAntiMalwarePolicyOptions

	policyConfig, err := sess.command(
		"show configuration services advanced-anti-malware policy \""+policy+"\" | display set relative", jnprSess)
	if err != nil {
		return confRead, err
	}
	if policyConfig != emptyWord {
		confRead.name = policy
		for _, item := range strings.Split(policyConfig, "\n") {
			if strings.Contains(item, "<configuration-output>") {
				continue
			}
			if strings.Contains(item, "</configuration-output>") {
				break
			}
			itemTrim := strings.TrimPrefix(item, setLineStart)
			switch {
			case itemTrim == "blacklist-notification log":
				confRead.blacklistNotificationLog = true
			case itemTrim == "default-notification log":
				confRead.defaultNotificationLog = true
			case strings.HasPrefix(itemTrim, "fallback-options action "):
				confRead.fallbackOptionsAction = strings.TrimPrefix(itemTrim, "fallback-options action ")
			case itemTrim == "fallback-options notification log":
				confRead.fallbackOptionsNotificationLog = true
			case strings.HasPrefix(itemTrim, "http action "):
				confRead.httpAction = strings.TrimPrefix(itemTrim, "http action ")
			case strings.HasPrefix(itemTrim, "http client-notify file "):
				confRead.httpClientNotifyFile = strings.Trim(strings.TrimPrefix(itemTrim, "http client-notify file "), "\"")
			case strings.HasPrefix(itemTrim, "http client-notify message "):
				confRead.httpClientNotifyMessage = strings.Trim(strings.TrimPrefix(itemTrim, "http client-notify message "), "\"")
			case strings.HasPrefix(itemTrim, "http client-notify redirect-url "):
				confRead.httpClientNotifyRedirectURL =
					strings.Trim(strings.TrimPrefix(itemTrim, "http client-notify redirect-url "), "\"")
			case strings.HasPrefix(itemTrim, "http file-verdict-unknown "):
				confRead.httpFileVerdictUnknown = strings.TrimPrefix(itemTrim, "http file-verdict-unknown ")
			case strings.HasPrefix(itemTrim, "http inspection-profile "):
				confRead.httpInspectionProfile = strings.Trim(strings.TrimPrefix(itemTrim, "http inspection-profile "), "\"")
			case itemTrim == "http notification log":
				confRead.httpNotificationLog = true
			case strings.HasPrefix(itemTrim, "imap inspection-profile "):
				confRead.imapInspectionProfile = strings.Trim(strings.TrimPrefix(itemTrim, "imap inspection-profile "), "\"")
			case itemTrim == "imap notification log":
				confRead.imapNotificationLog = true
			case strings.HasPrefix(itemTrim, "smtp inspection-profile "):
				confRead.smtpInspectionProfile = strings.Trim(strings.TrimPrefix(itemTrim, "smtp inspection-profile "), "\"")
			case itemTrim == "smtp notification log":
				confRead.smtpNotificationLog = true
			case strings.HasPrefix(itemTrim, "verdict-threshold "):
				confRead.verdictThreshold = strings.TrimPrefix(itemTrim, "verdict-threshold ")
			case itemTrim == "whitelist-notification log":
				confRead.whitelistNotificationLog = true
			}
		}
	}

	return confRead, nil
}

func delServicesAdvancedAntiMalwarePolicy(policy string, m interface{}, jnprSess *NetconfObject) error {
	sess := m.(*Session)
	configSet := []string{
		"delete services advanced-anti-malware policy \"" + policy + "\"",
	}

	return sess.configSet(configSet, jnprSess)
}

func fillServicesAdvancedAntiMalwarePolicyData(
	d *schema.ResourceData, svcAdvancedAntiMalwarePolicyOptions svcAdvancedAntiMalwarePolicyOptions) {
	if tfErr := d.Set("name",
		svcAdvancedAntiMalwarePolicyOptions.name); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("blacklist_notification_log",
		svcAdvancedAntiMalwarePolicyOptions.blacklistNotificationLog); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("default_notification_log",
		svcAdvancedAntiMalwarePolicyOptions.defaultNotificationLog); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("fallback_options_action",
		svcAdvancedAntiMalwarePolicyOptions.fallbackOptionsAction); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("fallback_options_notification_log",
		svcAdvancedAntiMalwarePolicyOptions.fallbackOptionsNotificationLog); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("http_action",
		svcAdvancedAntiMalwarePolicyOptions.httpAction); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("http_client_notify_file",
		svcAdvancedAntiMalwarePolicyOptions.httpClientNotifyFile); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("http_client_notify_message",
		svcAdvancedAntiMalwarePolicyOptions.httpClientNotifyMessage); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("http_client_notify_redirect_url",
		svcAdvancedAntiMalwarePolicyOptions.httpClientNotifyRedirectURL); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("http_file_verdict_unknown",
		svcAdvancedAntiMalwarePolicyOptions.httpFileVerdictUnknown); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("http_inspection_profile",
		svcAdvancedAntiMalwarePolicyOptions.httpInspectionProfile); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("http_notification_log",
		svcAdvancedAntiMalwarePolicyOptions.httpNotificationLog); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("imap_inspection_profile",
		svcAdvancedAntiMalwarePolicyOptions.imapInspectionProfile); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("imap_notification_log",
		svcAdvancedAntiMalwarePolicyOptions.imapNotificationLog); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("smtp_inspection_profile",
		svcAdvancedAntiMalwarePolicyOptions.smtpInspectionProfile); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("smtp_notification_log",
		svcAdvancedAntiMalwarePolicyOptions.smtpNotificationLog); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("verdict_threshold",
		svcAdvancedAntiMalwarePolicyOptions.verdictThreshold); tfErr != nil {
		panic(tfErr)
	}
	if tfErr := d.Set("whitelist_notification_log",
		svcAdvancedAntiMalwarePolicyOptions.whitelistNotificationLog); tfErr != nil {
		panic(tfErr)
	}
}