Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add new field ActionValue to types. NsxtFirewallRule to support REJECT action #661

Merged
merged 7 commits into from
Jun 13, 2024
Merged

Add new field ActionValue to types. NsxtFirewallRule to support REJECT action #661

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c0d11cd
Add new field
Didainius Mar 26, 2024
5323f83
Add test
Didainius Mar 27, 2024
ddcaf9e
Add changelog
Didainius Apr 10, 2024
d1efd3b
Address comment
Didainius Apr 12, 2024
8948fad
Merge branch 'main' into pr-firewall-rejection
Didainius Apr 26, 2024
026cbfa
changelog
Didainius Apr 26, 2024
77a9bd0
Merge branch 'main' into pr-firewall-rejection
Didainius Jun 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .changes/v2.24.0/661-improvements.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
* `types.NsxtFirewallRule` adds field `ActionValue` instead of `Action` that is deprecated VCD API. It allows users to use `REJECT` option [GH-661]
Didainius marked this conversation as resolved.
Show resolved Hide resolved
9 changes: 5 additions & 4 deletions govcd/nsxt_firewall_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,13 @@ package govcd
import (
"crypto/rand"
"fmt"
"github.com/vmware/go-vcloud-director/v2/util"
"math/big"
"os"
"strconv"
"text/tabwriter"

"github.com/vmware/go-vcloud-director/v2/util"

"github.com/vmware/go-vcloud-director/v2/types/v56"
. "gopkg.in/check.v1"
)
Expand Down Expand Up @@ -57,7 +58,7 @@ func (vcd *TestVCD) Test_NsxtFirewall(check *C) {
check.Assert(fwCreated.NsxtFirewallRuleContainer.UserDefinedRules[index].Direction, Equals, randomizedFwRuleDefs[index].Direction)
check.Assert(fwCreated.NsxtFirewallRuleContainer.UserDefinedRules[index].IpProtocol, Equals, randomizedFwRuleDefs[index].IpProtocol)
check.Assert(fwCreated.NsxtFirewallRuleContainer.UserDefinedRules[index].Enabled, Equals, randomizedFwRuleDefs[index].Enabled)
check.Assert(fwCreated.NsxtFirewallRuleContainer.UserDefinedRules[index].Action, Equals, randomizedFwRuleDefs[index].Action)
check.Assert(fwCreated.NsxtFirewallRuleContainer.UserDefinedRules[index].ActionValue, Equals, randomizedFwRuleDefs[index].ActionValue)
if vcd.client.Client.IsSysAdmin {
// Only system administrator can handle logging
check.Assert(fwCreated.NsxtFirewallRuleContainer.UserDefinedRules[index].Logging, Equals, randomizedFwRuleDefs[index].Logging)
Expand Down Expand Up @@ -135,7 +136,7 @@ func createFirewallDefinitions(check *C, vcd *TestVCD) []*types.NsxtFirewallRule

firewallRules[a] = &types.NsxtFirewallRule{
Name: check.TestName() + strconv.Itoa(a),
Action: pickRandomString([]string{"ALLOW", "DROP"}),
ActionValue: pickRandomString([]string{"ALLOW", "DROP", "REJECT"}),
Enabled: a%2 == 0,
SourceFirewallGroups: srcValue,
DestinationFirewallGroups: dstValue,
Expand Down Expand Up @@ -238,7 +239,7 @@ func dumpFirewallRulesToScreen(rules []*types.NsxtFirewallRule) {

for _, rule := range rules {
fmt.Fprintf(w, "%s\t%s\t%s\t%t\t%s\t%t\t%d\t%d\t%d\n", rule.Name, rule.Direction, rule.IpProtocol,
rule.Enabled, rule.Action, rule.Logging, len(rule.SourceFirewallGroups), len(rule.DestinationFirewallGroups), len(rule.ApplicationPortProfiles))
rule.Enabled, rule.ActionValue, rule.Logging, len(rule.SourceFirewallGroups), len(rule.DestinationFirewallGroups), len(rule.ApplicationPortProfiles))
}
err := w.Flush()
if err != nil {
Expand Down
14 changes: 12 additions & 2 deletions types/v56/nsxt_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -481,8 +481,18 @@ type NsxtFirewallRule struct {
ID string `json:"id,omitempty"`
// Name - API does not enforce uniqueness
Name string `json:"name"`
// Action 'ALLOW', 'DROP'
Action string `json:"action"`
// Action field. Can be 'ALLOW', 'DROP'
// Deprecated in favor of ActionValue in VCD 10.2.2+ (API V35.2)
Action string `json:"action,omitempty"`

// ActionValue replaces deprecated field Action and defines action to be applied to all the
// traffic that meets the firewall rule criteria. It determines if the rule permits or blocks
// traffic. Property is required if action is not set. Below are valid values:
// * ALLOW permits traffic to go through the firewall.
// * DROP blocks the traffic at the firewall. No response is sent back to the source.
// * REJECT blocks the traffic at the firewall. A response is sent back to the source.
ActionValue string `json:"actionValue,omitempty"`

// Enabled allows to enable or disable the rule
Enabled bool `json:"enabled"`
// SourceFirewallGroups contains a list of references to Firewall Groups. Empty list means 'Any'
Expand Down
Loading