Skip to content

Commit

Permalink
provider/aws: Allow updating tuples in WAF SQLInjectionMatchSet + no …
Browse files Browse the repository at this point in the history
…tuples (#14667)

* provider/aws: Allow updating tuples in WAF SQL Injection Match Set

* provider/aws: Allow WAF SQL Injection match set with no tuples
  • Loading branch information
radeksimko authored May 19, 2017
1 parent e2b6370 commit eacece2
Show file tree
Hide file tree
Showing 2 changed files with 172 additions and 26 deletions.
97 changes: 71 additions & 26 deletions resource_aws_waf_sql_injection_match_set.go
Original file line number Diff line number Diff line change
Expand Up @@ -98,30 +98,42 @@ func resourceAwsWafSqlInjectionMatchSetRead(d *schema.ResourceData, meta interfa
}

d.Set("name", resp.SqlInjectionMatchSet.Name)
d.Set("sql_injection_match_tuples", resp.SqlInjectionMatchSet.SqlInjectionMatchTuples)

return nil
}

func resourceAwsWafSqlInjectionMatchSetUpdate(d *schema.ResourceData, meta interface{}) error {
log.Printf("[INFO] Updating SqlInjectionMatchSet: %s", d.Get("name").(string))
err := updateSqlInjectionMatchSetResource(d, meta, waf.ChangeActionInsert)
if err != nil {
return errwrap.Wrapf("[ERROR] Error updating SqlInjectionMatchSet: {{err}}", err)
conn := meta.(*AWSClient).wafconn

if d.HasChange("sql_injection_match_tuples") {
o, n := d.GetChange("sql_injection_match_tuples")
oldT, newT := o.(*schema.Set).List(), n.(*schema.Set).List()

err := updateSqlInjectionMatchSetResource(d.Id(), oldT, newT, conn)
if err != nil {
return errwrap.Wrapf("[ERROR] Error updating SqlInjectionMatchSet: {{err}}", err)
}
}

return resourceAwsWafSqlInjectionMatchSetRead(d, meta)
}

func resourceAwsWafSqlInjectionMatchSetDelete(d *schema.ResourceData, meta interface{}) error {
conn := meta.(*AWSClient).wafconn

log.Printf("[INFO] Deleting SqlInjectionMatchSet: %s", d.Get("name").(string))
err := updateSqlInjectionMatchSetResource(d, meta, waf.ChangeActionDelete)
if err != nil {
return errwrap.Wrapf("[ERROR] Error deleting SqlInjectionMatchSet: {{err}}", err)
oldTuples := d.Get("sql_injection_match_tuples").(*schema.Set).List()

if len(oldTuples) > 0 {
noTuples := []interface{}{}
err := updateSqlInjectionMatchSetResource(d.Id(), oldTuples, noTuples, conn)
if err != nil {
return errwrap.Wrapf("[ERROR] Error deleting SqlInjectionMatchSet: {{err}}", err)
}
}

wr := newWafRetryer(conn, "global")
_, err = wr.RetryWithToken(func(token *string) (interface{}, error) {
_, err := wr.RetryWithToken(func(token *string) (interface{}, error) {
req := &waf.DeleteSqlInjectionMatchSetInput{
ChangeToken: token,
SqlInjectionMatchSetId: aws.String(d.Id()),
Expand All @@ -136,29 +148,16 @@ func resourceAwsWafSqlInjectionMatchSetDelete(d *schema.ResourceData, meta inter
return nil
}

func updateSqlInjectionMatchSetResource(d *schema.ResourceData, meta interface{}, ChangeAction string) error {
conn := meta.(*AWSClient).wafconn

func updateSqlInjectionMatchSetResource(id string, oldT, newT []interface{}, conn *waf.WAF) error {
wr := newWafRetryer(conn, "global")
_, err := wr.RetryWithToken(func(token *string) (interface{}, error) {
req := &waf.UpdateSqlInjectionMatchSetInput{
ChangeToken: token,
SqlInjectionMatchSetId: aws.String(d.Id()),
}

sqlInjectionMatchTuples := d.Get("sql_injection_match_tuples").(*schema.Set)
for _, sqlInjectionMatchTuple := range sqlInjectionMatchTuples.List() {
simt := sqlInjectionMatchTuple.(map[string]interface{})
sizeConstraintUpdate := &waf.SqlInjectionMatchSetUpdate{
Action: aws.String(ChangeAction),
SqlInjectionMatchTuple: &waf.SqlInjectionMatchTuple{
FieldToMatch: expandFieldToMatch(simt["field_to_match"].(*schema.Set).List()[0].(map[string]interface{})),
TextTransformation: aws.String(simt["text_transformation"].(string)),
},
}
req.Updates = append(req.Updates, sizeConstraintUpdate)
SqlInjectionMatchSetId: aws.String(id),
Updates: diffWafSqlInjectionMatchTuples(oldT, newT),
}

log.Printf("[INFO] Updating SqlInjectionMatchSet: %s", req)
return conn.UpdateSqlInjectionMatchSet(req)
})
if err != nil {
Expand All @@ -167,3 +166,49 @@ func updateSqlInjectionMatchSetResource(d *schema.ResourceData, meta interface{}

return nil
}

func flattenWafSqlInjectionMatchTuples(ts []*waf.SqlInjectionMatchTuple) []interface{} {
out := make([]interface{}, len(ts), len(ts))
for i, t := range ts {
m := make(map[string]interface{})
m["text_transformation"] = *t.TextTransformation
m["field_to_match"] = flattenFieldToMatch(t.FieldToMatch)
out[i] = m
}

return out
}

func diffWafSqlInjectionMatchTuples(oldT, newT []interface{}) []*waf.SqlInjectionMatchSetUpdate {
updates := make([]*waf.SqlInjectionMatchSetUpdate, 0)

for _, od := range oldT {
tuple := od.(map[string]interface{})

if idx, contains := sliceContainsMap(newT, tuple); contains {
newT = append(newT[:idx], newT[idx+1:]...)
continue
}

updates = append(updates, &waf.SqlInjectionMatchSetUpdate{
Action: aws.String(waf.ChangeActionDelete),
SqlInjectionMatchTuple: &waf.SqlInjectionMatchTuple{
FieldToMatch: expandFieldToMatch(tuple["field_to_match"].(*schema.Set).List()[0].(map[string]interface{})),
TextTransformation: aws.String(tuple["text_transformation"].(string)),
},
})
}

for _, nd := range newT {
tuple := nd.(map[string]interface{})

updates = append(updates, &waf.SqlInjectionMatchSetUpdate{
Action: aws.String(waf.ChangeActionInsert),
SqlInjectionMatchTuple: &waf.SqlInjectionMatchTuple{
FieldToMatch: expandFieldToMatch(tuple["field_to_match"].(*schema.Set).List()[0].(map[string]interface{})),
TextTransformation: aws.String(tuple["text_transformation"].(string)),
},
})
}
return updates
}
101 changes: 101 additions & 0 deletions resource_aws_waf_sql_injection_match_set_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,14 @@ func TestAccAWSWafSqlInjectionMatchSet_basic(t *testing.T) {
"aws_waf_sql_injection_match_set.sql_injection_match_set", "name", sqlInjectionMatchSet),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.#", "1"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.#", "1"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.2316364334.data", ""),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.2316364334.type", "QUERY_STRING"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.text_transformation", "URL_DECODE"),
),
},
},
Expand Down Expand Up @@ -92,6 +100,78 @@ func TestAccAWSWafSqlInjectionMatchSet_disappears(t *testing.T) {
})
}

func TestAccAWSWafSqlInjectionMatchSet_changeTuples(t *testing.T) {
var before, after waf.SqlInjectionMatchSet
setName := fmt.Sprintf("sqlInjectionMatchSet-%s", acctest.RandString(5))

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAWSWafSqlInjectionMatchSetDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSWafSqlInjectionMatchSetConfig(setName),
Check: resource.ComposeAggregateTestCheckFunc(
testAccCheckAWSWafSqlInjectionMatchSetExists("aws_waf_sql_injection_match_set.sql_injection_match_set", &before),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "name", setName),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.#", "1"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.#", "1"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.2316364334.data", ""),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.2316364334.type", "QUERY_STRING"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.text_transformation", "URL_DECODE"),
),
},
{
Config: testAccAWSWafSqlInjectionMatchSetConfig_changeTuples(setName),
Check: resource.ComposeAggregateTestCheckFunc(
testAccCheckAWSWafSqlInjectionMatchSetExists("aws_waf_sql_injection_match_set.sql_injection_match_set", &after),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "name", setName),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.#", "1"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3333510133.field_to_match.#", "1"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3333510133.field_to_match.4253810390.data", "GET"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3333510133.field_to_match.4253810390.type", "METHOD"),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3333510133.text_transformation", "NONE"),
),
},
},
})
}

func TestAccAWSWafSqlInjectionMatchSet_noTuples(t *testing.T) {
var ipset waf.SqlInjectionMatchSet
setName := fmt.Sprintf("sqlInjectionMatchSet-%s", acctest.RandString(5))

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAWSWafSqlInjectionMatchSetDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSWafSqlInjectionMatchSetConfig_noTuples(setName),
Check: resource.ComposeAggregateTestCheckFunc(
testAccCheckAWSWafSqlInjectionMatchSetExists("aws_waf_sql_injection_match_set.sql_injection_match_set", &ipset),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "name", setName),
resource.TestCheckResourceAttr(
"aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.#", "0"),
),
},
},
})
}

func testAccCheckAWSWafSqlInjectionMatchSetDisappears(v *waf.SqlInjectionMatchSet) resource.TestCheckFunc {
return func(s *terraform.State) error {
conn := testAccProvider.Meta().(*AWSClient).wafconn
Expand Down Expand Up @@ -218,3 +298,24 @@ resource "aws_waf_sql_injection_match_set" "sql_injection_match_set" {
}
}`, name)
}

func testAccAWSWafSqlInjectionMatchSetConfig_changeTuples(name string) string {
return fmt.Sprintf(`
resource "aws_waf_sql_injection_match_set" "sql_injection_match_set" {
name = "%s"
sql_injection_match_tuples {
text_transformation = "NONE"
field_to_match {
type = "METHOD"
data = "GET"
}
}
}`, name)
}

func testAccAWSWafSqlInjectionMatchSetConfig_noTuples(name string) string {
return fmt.Sprintf(`
resource "aws_waf_sql_injection_match_set" "sql_injection_match_set" {
name = "%s"
}`, name)
}

0 comments on commit eacece2

Please sign in to comment.