From 77c8d9f78773267fda2bd3b0e140ba731a897966 Mon Sep 17 00:00:00 2001 From: Qu Xuan Date: Fri, 11 Jun 2021 15:37:05 +0800 Subject: [PATCH 01/10] feat(region): add app gateway resource --- cmd/climc/shell/compute/app_gateways.go | 30 ++ pkg/apis/compute/app_gateways.go | 39 ++ pkg/cloudprovider/app_gateways.go | 49 +++ pkg/cloudprovider/resources.go | 11 + pkg/compute/models/app_gateways.go | 399 ++++++++++++++++++ pkg/compute/models/cloudsync.go | 20 + pkg/compute/policy/resources.go | 1 + pkg/compute/service/handlers.go | 2 + .../tasks/app_gateway_syncstatus_task.go | 54 +++ pkg/mcclient/modules/mod_app_gateways.go | 37 ++ pkg/mcclient/options/compute/app_gateways.go | 29 ++ pkg/multicloud/azure/app_gateways.go | 323 ++++++++++++++ pkg/multicloud/azure/shell/app_gateways.go | 33 ++ pkg/multicloud/region_base.go | 8 + 14 files changed, 1035 insertions(+) create mode 100644 cmd/climc/shell/compute/app_gateways.go create mode 100644 pkg/apis/compute/app_gateways.go create mode 100644 pkg/cloudprovider/app_gateways.go create mode 100644 pkg/compute/models/app_gateways.go create mode 100644 pkg/compute/tasks/app_gateway_syncstatus_task.go create mode 100644 pkg/mcclient/modules/mod_app_gateways.go create mode 100644 pkg/mcclient/options/compute/app_gateways.go create mode 100644 pkg/multicloud/azure/app_gateways.go create mode 100644 pkg/multicloud/azure/shell/app_gateways.go diff --git a/cmd/climc/shell/compute/app_gateways.go b/cmd/climc/shell/compute/app_gateways.go new file mode 100644 index 0000000000..5bd171d8c5 --- /dev/null +++ b/cmd/climc/shell/compute/app_gateways.go @@ -0,0 +1,30 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/cmd/climc/shell" + "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/compute" +) + +func init() { + cmd := shell.NewResourceCmd(&modules.AppGateways) + cmd.List(&compute.AppGatewayListOptions{}) + cmd.Perform("syncstatus", &options.BaseIdOptions{}) + cmd.Get("backends", &options.BaseIdOptions{}) + cmd.Get("frontends", &options.BaseIdOptions{}) +} diff --git a/pkg/apis/compute/app_gateways.go b/pkg/apis/compute/app_gateways.go new file mode 100644 index 0000000000..b4f8c8708f --- /dev/null +++ b/pkg/apis/compute/app_gateways.go @@ -0,0 +1,39 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import "yunion.io/x/onecloud/pkg/apis" + +const ( + APP_GATEWAY_STATUS_AVAILABLE = "available" + APP_GATEWAY_STATUS_DELETING = "deleting" + APP_GATEWAY_STATUS_CREATE_FAILED = "create_failed" + APP_GATEWAY_STATUS_UPDATING = "updating" + APP_GATEWAY_STATUS_UNKNOWN = "unknown" +) + +type AppGatewayDetails struct { + apis.EnabledStatusInfrasResourceBaseDetails + ManagedResourceInfo + CloudregionResourceInfo +} + +type AppGatewayListInput struct { + apis.EnabledStatusInfrasResourceBaseListInput + apis.ExternalizedResourceBaseListInput + + ManagedResourceListInput + RegionalFilterListInput +} diff --git a/pkg/cloudprovider/app_gateways.go b/pkg/cloudprovider/app_gateways.go new file mode 100644 index 0000000000..5a747560f4 --- /dev/null +++ b/pkg/cloudprovider/app_gateways.go @@ -0,0 +1,49 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package cloudprovider + +type SAppGatewayHttpListener struct { + Name string + Port int + Protocol string +} + +type SAppGatewayFrontend struct { + Name string + IpAddr string + Type string + HttpListener []SAppGatewayHttpListener +} + +type SAppGatewayFrontends struct { + Total int `json:"total"` + Data []SAppGatewayFrontend `json:"data"` +} + +type SAppGatewayRoutingRule struct { + Name string + Type string + HttpListener string +} + +type SAppGatewayBackend struct { + Name string + RoutingRules []SAppGatewayRoutingRule +} + +type SAppGatewayBackends struct { + Total int `json:"total"` + Data []SAppGatewayBackend `json:"data"` +} diff --git a/pkg/cloudprovider/resources.go b/pkg/cloudprovider/resources.go index 78ae5506b7..a21987501a 100644 --- a/pkg/cloudprovider/resources.go +++ b/pkg/cloudprovider/resources.go @@ -162,6 +162,9 @@ type ICloudRegion interface { GetICloudAccessGroups() ([]ICloudAccessGroup, error) CreateICloudAccessGroup(opts *SAccessGroup) (ICloudAccessGroup, error) GetICloudAccessGroupById(id string) (ICloudAccessGroup, error) + + GetICloudApplicationGateways() ([]ICloudApplicationGateway, error) + GetICloudApplicationGatewayById(id string) (ICloudApplicationGateway, error) } type ICloudZone interface { @@ -1278,3 +1281,11 @@ type ICloudAccessGroup interface { Delete() error } + +type ICloudApplicationGateway interface { + ICloudResource + + GetInstanceType() string + GetBackends() ([]SAppGatewayBackend, error) + GetFrontends() ([]SAppGatewayFrontend, error) +} diff --git a/pkg/compute/models/app_gateways.go b/pkg/compute/models/app_gateways.go new file mode 100644 index 0000000000..860fb0976c --- /dev/null +++ b/pkg/compute/models/app_gateways.go @@ -0,0 +1,399 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/tristate" + "yunion.io/x/pkg/util/compare" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SAppGatewayManager struct { + db.SEnabledStatusInfrasResourceBaseManager + db.SExternalizedResourceBaseManager + SManagedResourceBaseManager + SCloudregionResourceBaseManager +} + +var AppGatewayManager *SAppGatewayManager + +func init() { + AppGatewayManager = &SAppGatewayManager{ + SEnabledStatusInfrasResourceBaseManager: db.NewEnabledStatusInfrasResourceBaseManager( + SAppGateway{}, + "app_gateways_tbl", + "app_gateway", + "app_gateways", + ), + } + AppGatewayManager.SetVirtualObject(AppGatewayManager) +} + +type SAppGateway struct { + db.SEnabledStatusInfrasResourceBase + db.SExternalizedResourceBase + + SManagedResourceBase + SCloudregionResourceBase `width:"36" charset:"ascii" nullable:"false" list:"domain" create:"domain_required" default:"default"` + + // 类型 + InstanceType string `width:"64" charset:"utf8" nullable:"true" list:"user" create:"optional"` +} + +func (manager *SAppGatewayManager) GetContextManagers() [][]db.IModelManager { + return [][]db.IModelManager{ + {CloudregionManager}, + } +} + +func (self *SAppGateway) ValidateDeleteCondition(ctx context.Context) error { + return self.SEnabledStatusInfrasResourceBase.ValidateDeleteCondition(ctx) +} + +func (manager *SAppGatewayManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.AppGatewayDetails { + rows := make([]api.AppGatewayDetails, len(objs)) + stdRows := manager.SEnabledStatusInfrasResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + managerRows := manager.SManagedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + regionRows := manager.SCloudregionResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + for i := range rows { + rows[i] = api.AppGatewayDetails{ + EnabledStatusInfrasResourceBaseDetails: stdRows[i], + ManagedResourceInfo: managerRows[i], + CloudregionResourceInfo: regionRows[i], + } + } + return rows +} + +func (self *SAppGateway) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SAppGateway) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.SEnabledStatusInfrasResourceBase.Delete(ctx, userCred) +} + +func (self *SAppGateway) syncRemove(ctx context.Context, userCred mcclient.TokenCredential) error { + lockman.LockObject(ctx, self) + defer lockman.ReleaseObject(ctx, self) + + err := self.ValidateDeleteCondition(ctx) + if err != nil { + return errors.Wrapf(err, "ValidateDeleteCondition") + } + return self.RealDelete(ctx, userCred) +} + +// 列出应用程序网关 +func (manager *SAppGatewayManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.AppGatewayListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SEnabledStatusInfrasResourceBaseManager.ListItemFilter(ctx, q, userCred, query.EnabledStatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SEnabledStatusInfrasResourceBaseManager.ListItemFilter") + } + + q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SExternalizedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SManagedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SCloudregionResourceBaseManager.ListItemFilter(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemFilter") + } + return q, nil +} + +func (manager *SAppGatewayManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) { + var err error + q, err = manager.SEnabledStatusInfrasResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SManagedResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SCloudregionResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + return q, httperrors.ErrNotFound +} + +func (manager *SAppGatewayManager) OrderByExtraFields( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.AppGatewayListInput, +) (*sqlchemy.SQuery, error) { + q, err := manager.SEnabledStatusInfrasResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.EnabledStatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SEnabledStatusInfrasResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SManagedResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SCloudregionResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.OrderByExtraFields") + } + return q, nil +} + +func (manager *SAppGatewayManager) ListItemExportKeys(ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + keys stringutils2.SSortedStrings, +) (*sqlchemy.SQuery, error) { + q, err := manager.SEnabledStatusInfrasResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SEnabledStatusInfrasResourceBaseManager.ListItemExportKeys") + } + if keys.ContainsAny(manager.SCloudregionResourceBaseManager.GetExportKeys()...) { + q, err = manager.SCloudregionResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemExportKeys") + } + } + if keys.ContainsAny(manager.SManagedResourceBaseManager.GetExportKeys()...) { + q, err = manager.SManagedResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemExportKeys") + } + } + return q, nil +} + +//同步应用程序网关状态 +func (self *SAppGateway) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "syncstatus") +} + +func (self *SAppGateway) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + return nil, StartResourceSyncStatusTask(ctx, userCred, self, "AppGatewaySyncStatusTask", "") +} + +func (self *SAppGateway) GetRegion() (*SCloudregion, error) { + region, err := CloudregionManager.FetchById(self.CloudregionId) + if err != nil { + return nil, errors.Wrapf(err, "FetchById(%s)", self.CloudregionId) + } + return region.(*SCloudregion), nil +} + +func (self *SAppGateway) GetIRegion() (cloudprovider.ICloudRegion, error) { + provider, err := self.GetDriver() + if err != nil { + return nil, errors.Wrapf(err, "GetDriver") + } + region, err := self.GetRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetRegion") + } + return provider.GetIRegionById(region.ExternalId) +} + +func (self *SAppGateway) GetICloudAppGateway() (cloudprovider.ICloudApplicationGateway, error) { + if len(self.ExternalId) == 0 { + return nil, errors.Wrapf(cloudprovider.ErrNotFound, "empty external id") + } + iRegion, err := self.GetIRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetIRegion") + } + return iRegion.GetICloudApplicationGatewayById(self.ExternalId) +} + +func (self *SCloudregion) GetAppGateways() ([]SAppGateway, error) { + q := AppGatewayManager.Query().Equals("cloudregion_id", self.Id) + ret := []SAppGateway{} + err := db.FetchModelObjects(AppGatewayManager, q, &ret) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchModelObjects") + } + return ret, nil +} + +func (self *SCloudregion) SyncAppGateways(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, exts []cloudprovider.ICloudApplicationGateway) compare.SyncResult { + lockman.LockRawObject(ctx, self.Id, AppGatewayManager.Keyword()) + defer lockman.ReleaseRawObject(ctx, self.Id, AppGatewayManager.Keyword()) + + result := compare.SyncResult{} + + dbApps, err := self.GetAppGateways() + if err != nil { + result.Error(errors.Wrapf(err, "self.GetAppGateways")) + return result + } + + removed := make([]SAppGateway, 0) + commondb := make([]SAppGateway, 0) + commonext := make([]cloudprovider.ICloudApplicationGateway, 0) + added := make([]cloudprovider.ICloudApplicationGateway, 0) + err = compare.CompareSets(dbApps, exts, &removed, &commondb, &commonext, &added) + if err != nil { + result.Error(errors.Wrapf(err, "compare.CompareSets")) + return result + } + + for i := 0; i < len(removed); i += 1 { + err = removed[i].syncRemove(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + for i := 0; i < len(commondb); i += 1 { + err = commondb[i].SyncWithCloudAppGateway(ctx, userCred, commonext[i]) + if err != nil { + result.UpdateError(err) + continue + } + result.Update() + } + for i := 0; i < len(added); i += 1 { + _, err := self.newFromCloudAppGateway(ctx, userCred, provider, added[i]) + if err != nil { + result.AddError(err) + continue + } + result.Add() + } + + return result +} + +func (self *SAppGateway) SyncWithCloudAppGateway(ctx context.Context, userCred mcclient.TokenCredential, ext cloudprovider.ICloudApplicationGateway) error { + _, err := db.Update(self, func() error { + self.Status = ext.GetStatus() + self.InstanceType = ext.GetInstanceType() + return nil + }) + if err != nil { + return errors.Wrapf(err, "db.Update") + } + + syncMetadata(ctx, userCred, self, ext) + provider := self.GetCloudprovider() + if provider != nil { + SyncCloudDomain(userCred, self, provider.GetOwnerId()) + } + + return nil +} + +func (self *SCloudregion) newFromCloudAppGateway(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudApplicationGateway) (*SAppGateway, error) { + app := &SAppGateway{} + app.SetModelManager(AppGatewayManager, app) + app.Status = ext.GetStatus() + app.Enabled = tristate.True + app.CloudregionId = self.Id + app.ManagerId = provider.Id + app.ExternalId = ext.GetGlobalId() + app.InstanceType = ext.GetInstanceType() + + err := func() error { + lockman.LockRawObject(ctx, AppGatewayManager.Keyword(), "name") + defer lockman.ReleaseRawObject(ctx, AppGatewayManager.Keyword(), "name") + + var err error + app.Name, err = db.GenerateName(ctx, AppGatewayManager, userCred, ext.GetName()) + if err != nil { + return errors.Wrapf(err, "db.GenerateName") + } + + return AppGatewayManager.TableSpec().Insert(ctx, app) + }() + if err != nil { + return nil, errors.Wrapf(err, "Insert") + } + + syncMetadata(ctx, userCred, app, ext) + SyncCloudDomain(userCred, app, provider.GetOwnerId()) + + return app, nil +} + +func (self *SAppGateway) AllowGetDetailsBackends(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "backends") +} + +func (self *SAppGateway) GetDetailsBackends(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (cloudprovider.SAppGatewayBackends, error) { + ret := cloudprovider.SAppGatewayBackends{} + iApp, err := self.GetICloudAppGateway() + if err != nil { + return ret, errors.Wrapf(err, "GetICloudAppGateway") + } + ret.Data, err = iApp.GetBackends() + if err != nil { + return ret, errors.Wrapf(err, "GetBackends") + } + ret.Total = len(ret.Data) + return ret, nil +} + +func (self *SAppGateway) AllowGetDetailsFrontends(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "frontends") +} + +func (self *SAppGateway) GetDetailsFrontends(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (cloudprovider.SAppGatewayFrontends, error) { + ret := cloudprovider.SAppGatewayFrontends{} + iApp, err := self.GetICloudAppGateway() + if err != nil { + return ret, errors.Wrapf(err, "GetICloudAppGateway") + } + ret.Data, err = iApp.GetFrontends() + if err != nil { + return ret, errors.Wrapf(err, "GetFrontends") + } + ret.Total = len(ret.Data) + return ret, nil +} diff --git a/pkg/compute/models/cloudsync.go b/pkg/compute/models/cloudsync.go index 65f936a87b..9da8a6f0b9 100644 --- a/pkg/compute/models/cloudsync.go +++ b/pkg/compute/models/cloudsync.go @@ -868,6 +868,24 @@ func syncSkusFromPrivateCloud(ctx context.Context, userCred mcclient.TokenCreden } } +func syncAppGateways(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, provider *SCloudprovider, localRegion *SCloudregion, remoteRegion cloudprovider.ICloudRegion) { + apps, err := remoteRegion.GetICloudApplicationGateways() + if err != nil { + msg := fmt.Sprintf("GetICloudApplicationGateways for region %s failed %s", remoteRegion.GetName(), err) + log.Errorf(msg) + return + } + result := localRegion.SyncAppGateways(ctx, userCred, provider, apps) + syncResults.Add(AppGatewayManager, result) + + msg := result.Result() + log.Infof("SyncAppGateways for region %s result: %s", localRegion.Name, msg) + if result.IsError() { + return + } + +} + func syncRegionDBInstances(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, provider *SCloudprovider, localRegion *SCloudregion, remoteRegion cloudprovider.ICloudRegion, syncRange *SSyncRange) { instances, err := remoteRegion.GetIDBInstances() if err != nil { @@ -1258,6 +1276,8 @@ func syncPublicCloudProviderInfo( syncElasticcaches(ctx, userCred, syncResults, provider, localRegion, remoteRegion, syncRange) } + syncAppGateways(ctx, userCred, syncResults, provider, localRegion, remoteRegion) + if cloudprovider.IsSupportCompute(driver) { log.Debugf("storageCachePairs count %d", len(storageCachePairs)) for i := range storageCachePairs { diff --git a/pkg/compute/policy/resources.go b/pkg/compute/policy/resources.go index e0305fde95..02bf625fd7 100644 --- a/pkg/compute/policy/resources.go +++ b/pkg/compute/policy/resources.go @@ -58,6 +58,7 @@ var ( "policy_assignments", "proxysettings", "project_mappings", + "app_gateways", } computeUserResources = []string{ "keypairs", diff --git a/pkg/compute/service/handlers.go b/pkg/compute/service/handlers.go index 6f8650e3af..4afbfccca8 100644 --- a/pkg/compute/service/handlers.go +++ b/pkg/compute/service/handlers.go @@ -214,6 +214,8 @@ func InitHandlers(app *appsrv.Application) { models.MountTargetManager, models.ProjectMappingManager, + + models.AppGatewayManager, } { db.RegisterModelManager(manager) handler := db.NewModelHandler(manager) diff --git a/pkg/compute/tasks/app_gateway_syncstatus_task.go b/pkg/compute/tasks/app_gateway_syncstatus_task.go new file mode 100644 index 0000000000..5066087427 --- /dev/null +++ b/pkg/compute/tasks/app_gateway_syncstatus_task.go @@ -0,0 +1,54 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type AppGatewaySyncStatusTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(AppGatewaySyncStatusTask{}) +} + +func (self *AppGatewaySyncStatusTask) taskFailed(ctx context.Context, app *models.SAppGateway, err error) { + app.SetStatus(self.UserCred, api.APP_GATEWAY_STATUS_UNKNOWN, err.Error()) + db.OpsLog.LogEvent(app, db.ACT_SYNC_STATUS, err, self.GetUserCred()) + logclient.AddActionLogWithStartable(self, app, logclient.ACT_SYNC_STATUS, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *AppGatewaySyncStatusTask) OnInit(ctx context.Context, obj db.IStandaloneModel, data jsonutils.JSONObject) { + app := obj.(*models.SAppGateway) + iApp, err := app.GetICloudAppGateway() + if err != nil { + self.taskFailed(ctx, app, errors.Wrapf(err, "app.GetIAppGateway")) + return + } + app.SyncWithCloudAppGateway(ctx, self.UserCred, iApp) + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/mcclient/modules/mod_app_gateways.go b/pkg/mcclient/modules/mod_app_gateways.go new file mode 100644 index 0000000000..5a8642319b --- /dev/null +++ b/pkg/mcclient/modules/mod_app_gateways.go @@ -0,0 +1,37 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package modules + +import "yunion.io/x/onecloud/pkg/mcclient/modulebase" + +type AppGatewayManager struct { + modulebase.ResourceManager +} + +var ( + AppGateways AppGatewayManager +) + +func init() { + AppGateways = AppGatewayManager{ + NewComputeManager( + "app_gateway", + "app_gateways", + []string{}, + []string{}, + ), + } + registerCompute(&AppGateways) +} diff --git a/pkg/mcclient/options/compute/app_gateways.go b/pkg/mcclient/options/compute/app_gateways.go new file mode 100644 index 0000000000..e9abe959b5 --- /dev/null +++ b/pkg/mcclient/options/compute/app_gateways.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/jsonutils" + + "yunion.io/x/onecloud/pkg/mcclient/options" +) + +type AppGatewayListOptions struct { + options.BaseListOptions +} + +func (opts *AppGatewayListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} diff --git a/pkg/multicloud/azure/app_gateways.go b/pkg/multicloud/azure/app_gateways.go new file mode 100644 index 0000000000..a44152857b --- /dev/null +++ b/pkg/multicloud/azure/app_gateways.go @@ -0,0 +1,323 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package azure + +import ( + "net/url" + "strings" + + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/multicloud" +) + +type SGatewayipconfiguration struct { + Name string `json:"name"` + ID string `json:"id"` + Etag string `json:"etag"` + Properties struct { + Provisioningstate string `json:"provisioningState"` + Subnet struct { + ID string `json:"id"` + } `json:"subnet"` + } `json:"properties"` + Type string `json:"type"` +} + +type SFrontendipconfiguration struct { + Name string `json:"name"` + ID string `json:"id"` + Etag string `json:"etag"` + Type string `json:"type"` + Properties struct { + Provisioningstate string `json:"provisioningState"` + Privateipallocationmethod string `json:"privateIPAllocationMethod"` + PublicIPAddress struct { + ID string + } + PrivateIPAddress string + Subnet struct { + ID string `json:"id"` + } `json:"subnet"` + Httplisteners []struct { + ID string `json:"id"` + } `json:"httpListeners"` + } `json:"properties"` +} + +type SFrontendport struct { + Name string `json:"name"` + ID string `json:"id"` + Etag string `json:"etag"` + Properties struct { + Provisioningstate string `json:"provisioningState"` + Port int `json:"port"` + Httplisteners []struct { + ID string `json:"id"` + } `json:"httpListeners"` + } `json:"properties"` + Type string `json:"type"` +} + +type SBackendaddresspool struct { + Name string `json:"name"` + ID string `json:"id"` + Etag string `json:"etag"` + Properties struct { + Provisioningstate string `json:"provisioningState"` + Backendaddresses []interface{} `json:"backendAddresses"` + Requestroutingrules []struct { + ID string `json:"id"` + } `json:"requestRoutingRules"` + } `json:"properties"` + Type string `json:"type"` +} + +type SBackendhttpsettingscollection struct { + Name string `json:"name"` + ID string `json:"id"` + Etag string `json:"etag"` + Properties struct { + Provisioningstate string `json:"provisioningState"` + Port int `json:"port"` + Protocol string `json:"protocol"` + Cookiebasedaffinity string `json:"cookieBasedAffinity"` + Pickhostnamefrombackendaddress bool `json:"pickHostNameFromBackendAddress"` + Requesttimeout int `json:"requestTimeout"` + Requestroutingrules []struct { + ID string `json:"id"` + } `json:"requestRoutingRules"` + } `json:"properties"` + Type string `json:"type"` +} + +type SHttplistener struct { + Name string `json:"name"` + ID string `json:"id"` + Etag string `json:"etag"` + Properties struct { + Provisioningstate string `json:"provisioningState"` + Frontendipconfiguration struct { + ID string `json:"id"` + } `json:"frontendIPConfiguration"` + Frontendport struct { + ID string `json:"id"` + } `json:"frontendPort"` + Protocol string `json:"protocol"` + Requireservernameindication bool `json:"requireServerNameIndication"` + Requestroutingrules []struct { + ID string `json:"id"` + } `json:"requestRoutingRules"` + } `json:"properties"` + Type string `json:"type"` +} + +type SRequestroutingrule struct { + Name string `json:"name"` + ID string `json:"id"` + Etag string `json:"etag"` + Properties struct { + Provisioningstate string `json:"provisioningState"` + Ruletype string `json:"ruleType"` + Httplistener struct { + ID string `json:"id"` + } `json:"httpListener"` + Backendaddresspool struct { + ID string `json:"id"` + } `json:"backendAddressPool"` + Backendhttpsettings struct { + ID string `json:"id"` + } `json:"backendHttpSettings"` + } `json:"properties"` + Type string `json:"type"` +} + +type SApplicationGatewayProperties struct { + Provisioningstate string `json:"provisioningState"` + Resourceguid string `json:"resourceGuid"` + Sku struct { + Name string `json:"name"` + Tier string `json:"tier"` + Capacity string `json:"capacity"` + } `json:"sku"` + Operationalstate string `json:"operationalState"` + Gatewayipconfigurations []SGatewayipconfiguration `json:"gatewayIPConfigurations"` + Sslcertificates []interface{} `json:"sslCertificates"` + Authenticationcertificates []interface{} `json:"authenticationCertificates"` + Frontendipconfigurations []SFrontendipconfiguration `json:"frontendIPConfigurations"` + Frontendports []SFrontendport `json:"frontendPorts"` + Backendaddresspools []SBackendaddresspool `json:"backendAddressPools"` + Backendhttpsettingscollection []SBackendhttpsettingscollection `json:"backendHttpSettingsCollection"` + Httplisteners []SHttplistener `json:"httpListeners"` + Urlpathmaps []interface{} `json:"urlPathMaps"` + Requestroutingrules []SRequestroutingrule `json:"requestRoutingRules"` + Probes []interface{} `json:"probes"` + Redirectconfigurations []interface{} `json:"redirectConfigurations"` + Webapplicationfirewallconfiguration struct { + Enabled bool `json:"enabled"` + Firewallmode string `json:"firewallMode"` + Rulesettype string `json:"ruleSetType"` + Rulesetversion string `json:"ruleSetVersion"` + Disabledrulegroups []interface{} `json:"disabledRuleGroups"` + Requestbodycheck bool `json:"requestBodyCheck"` + } `json:"webApplicationFirewallConfiguration"` + Enablehttp2 bool `json:"enableHttp2"` +} + +type SApplicationGateway struct { + region *SRegion + multicloud.SResourceBase + multicloud.AzureTags + + Name string `json:"name"` + ID string `json:"id"` + Etag string `json:"etag"` + Type string `json:"type"` + Location string `json:"location"` + Properties SApplicationGatewayProperties `json:"properties"` +} + +func (self *SApplicationGateway) GetName() string { + return self.Name +} + +func (self *SApplicationGateway) GetId() string { + return self.ID +} + +func (self *SApplicationGateway) GetGlobalId() string { + return strings.ToLower(self.ID) +} + +func (self *SApplicationGateway) GetStatus() string { + switch self.Properties.Provisioningstate { + case "Deleting": + return api.APP_GATEWAY_STATUS_DELETING + case "Failed": + return api.APP_GATEWAY_STATUS_CREATE_FAILED + case "Succeeded": + return api.APP_GATEWAY_STATUS_AVAILABLE + case "Updating": + return api.APP_GATEWAY_STATUS_UPDATING + } + return api.APP_GATEWAY_STATUS_AVAILABLE +} + +func (self *SApplicationGateway) GetInstanceType() string { + return self.Properties.Sku.Name +} + +func (self *SApplicationGateway) GetBackends() ([]cloudprovider.SAppGatewayBackend, error) { + ret := []cloudprovider.SAppGatewayBackend{} + for _, conf := range self.Properties.Backendaddresspools { + backend := cloudprovider.SAppGatewayBackend{ + Name: conf.Name, + RoutingRules: []cloudprovider.SAppGatewayRoutingRule{}, + } + for _, r := range conf.Properties.Requestroutingrules { + rule := cloudprovider.SAppGatewayRoutingRule{} + for _, _rule := range self.Properties.Requestroutingrules { + if r.ID == _rule.ID { + rule.Name = _rule.Name + rule.Type = _rule.Properties.Ruletype + backend.RoutingRules = append(backend.RoutingRules, rule) + break + } + } + } + ret = append(ret, backend) + } + return ret, nil +} + +func (self *SApplicationGateway) GetFrontends() ([]cloudprovider.SAppGatewayFrontend, error) { + ret := []cloudprovider.SAppGatewayFrontend{} + for _, conf := range self.Properties.Frontendipconfigurations { + front := cloudprovider.SAppGatewayFrontend{ + Name: conf.Name, + HttpListener: []cloudprovider.SAppGatewayHttpListener{}, + } + for _, l := range conf.Properties.Httplisteners { + listener := cloudprovider.SAppGatewayHttpListener{} + for _, p := range self.Properties.Httplisteners { + if strings.ToLower(p.ID) == strings.ToLower(l.ID) { + listener.Name = p.Name + listener.Protocol = p.Properties.Protocol + break + } + } + for _, p := range self.Properties.Frontendports { + for _, _p := range self.Properties.Httplisteners { + if strings.ToLower(_p.ID) == strings.ToLower(l.ID) { + listener.Port = p.Properties.Port + break + } + } + if listener.Port > 0 { + break + } + } + if len(listener.Name) > 0 { + front.HttpListener = append(front.HttpListener, listener) + } + } + if len(conf.Properties.PrivateIPAddress) > 0 { + front.IpAddr = conf.Properties.PrivateIPAddress + front.Type = "Vpc" + } else if len(conf.Properties.PublicIPAddress.ID) > 0 { + eip, err := self.region.GetEip(conf.Properties.PublicIPAddress.ID) + if err != nil { + continue + } + front.IpAddr = eip.GetIpAddr() + front.Type = "Eip" + } + ret = append(ret, front) + } + return ret, nil +} + +func (self *SRegion) ListAppGateways() ([]SApplicationGateway, error) { + apps := []SApplicationGateway{} + err := self.list("Microsoft.Network/applicationGateways", url.Values{}, &apps) + if err != nil { + return nil, errors.Wrapf(err, "list") + } + return apps, nil +} + +func (self *SRegion) GetApplicationGateway(id string) (*SApplicationGateway, error) { + ret := &SApplicationGateway{region: self} + return ret, self.get(id, url.Values{}, ret) +} + +func (self *SRegion) GetICloudApplicationGateways() ([]cloudprovider.ICloudApplicationGateway, error) { + apps, err := self.ListAppGateways() + if err != nil { + return nil, errors.Wrapf(err, "ListAppGateways") + } + ret := []cloudprovider.ICloudApplicationGateway{} + for i := range apps { + apps[i].region = self + ret = append(ret, &apps[i]) + } + return ret, nil +} + +func (self *SRegion) GetICloudApplicationGatewayById(id string) (cloudprovider.ICloudApplicationGateway, error) { + return self.GetApplicationGateway(id) +} diff --git a/pkg/multicloud/azure/shell/app_gateways.go b/pkg/multicloud/azure/shell/app_gateways.go new file mode 100644 index 0000000000..58eedcb0c3 --- /dev/null +++ b/pkg/multicloud/azure/shell/app_gateways.go @@ -0,0 +1,33 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package shell + +import ( + "yunion.io/x/onecloud/pkg/multicloud/azure" + "yunion.io/x/onecloud/pkg/util/shellutils" +) + +func init() { + type AppGatewayListOptions struct { + } + shellutils.R(&AppGatewayListOptions{}, "app-gateway-list", "List app gateways", func(cli *azure.SRegion, args *AppGatewayListOptions) error { + apps, err := cli.ListAppGateways() + if err != nil { + return err + } + printList(apps, len(apps), 0, 0, []string{}) + return nil + }) +} diff --git a/pkg/multicloud/region_base.go b/pkg/multicloud/region_base.go index 3ae8f41a17..681e7878bc 100644 --- a/pkg/multicloud/region_base.go +++ b/pkg/multicloud/region_base.go @@ -174,3 +174,11 @@ func (self *SRegion) CreateICloudAccessGroup(opts *cloudprovider.SAccessGroup) ( func (self *SRegion) CreateICloudFileSystem(opts *cloudprovider.FileSystemCraeteOptions) (cloudprovider.ICloudFileSystem, error) { return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "CreateICloudFileSystem") } + +func (self *SRegion) GetICloudApplicationGateways() ([]cloudprovider.ICloudApplicationGateway, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "GetICloudApplicationGateways") +} + +func (self *SRegion) GetICloudApplicationGatewayById(id string) (cloudprovider.ICloudApplicationGateway, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "GetICloudApplicationGatewayById") +} From ed5dac6244af2ad260f31ff5cbdcda337cc723d7 Mon Sep 17 00:00:00 2001 From: rainzm Date: Fri, 18 Jun 2021 15:20:30 +0800 Subject: [PATCH 02/10] feat(notify): filter all recipients in this domain and recipients who have joined projects in this domain --- pkg/notify/models/receiver.go | 58 ++++++++++++++++++++++++++--------- 1 file changed, 44 insertions(+), 14 deletions(-) diff --git a/pkg/notify/models/receiver.go b/pkg/notify/models/receiver.go index e68b5ba22f..79fe4b2c71 100644 --- a/pkg/notify/models/receiver.go +++ b/pkg/notify/models/receiver.go @@ -578,6 +578,44 @@ func (rm *SReceiverManager) filterByOwner(q *sqlchemy.SQuery, owner mcclient.IId return q } +func (rm *SReceiverManager) filterByOwnerAndProjectDomain(ctx context.Context, userCred mcclient.TokenCredential, q *sqlchemy.SQuery, scope rbacutils.TRbacScope) (*sqlchemy.SQuery, error) { + if userCred == nil { + return q, nil + } + + userIds, err := rm.findUserIdsWithProjectDomain(ctx, userCred, userCred.GetProjectDomainId()) + if err != nil { + return nil, errors.Wrap(err, "unable to findUserIdsWithProjectDomain") + } + var projectDomainCondition, ownerCondition sqlchemy.ICondition + switch len(userIds) { + case 0: + projectDomainCondition = nil + case 1: + projectDomainCondition = sqlchemy.Equals(q.Field("id"), userIds[0]) + default: + projectDomainCondition = sqlchemy.In(q.Field("id"), userIds) + } + + switch scope { + case rbacutils.ScopeDomain: + ownerCondition = sqlchemy.Equals(q.Field("domain_id"), userCred.GetProjectDomainId()) + case rbacutils.ScopeProject: + ownerCondition = sqlchemy.Equals(q.Field("id"), userCred.GetUserId()) + } + + if projectDomainCondition != nil && ownerCondition != nil { + return q.Filter(sqlchemy.OR(projectDomainCondition, ownerCondition)), nil + } + if projectDomainCondition != nil { + return q.Filter(projectDomainCondition), nil + } + if ownerCondition != nil { + return q.Filter(ownerCondition), nil + } + return q, nil +} + func (rm *SReceiverManager) FilterByOwner(q *sqlchemy.SQuery, owner mcclient.IIdentityProvider, scope rbacutils.TRbacScope) *sqlchemy.SQuery { return q } @@ -607,24 +645,16 @@ func (rm *SReceiverManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQue if len(input.VerifiedContactType) > 0 { q = rm.VerifiedContactFilter(input.VerifiedContactType, q) } + ownerId, queryScope, err := db.FetchCheckQueryOwnerScope(ctx, userCred, jsonutils.Marshal(input), rm, policy.PolicyActionList, true) + if err != nil { + return nil, httperrors.NewGeneralError(err) + } if input.ProjectDomainFilter && userCred.GetProjectDomainId() != "" { - userIds, err := rm.findUserIdsWithProjectDomain(ctx, userCred, userCred.GetProjectDomainId()) + q, err = rm.filterByOwnerAndProjectDomain(ctx, userCred, q, queryScope) if err != nil { - return nil, errors.Wrap(err, "unable to findUserIdsWithProjectDomain") - } - switch len(userIds) { - case 0: - q = q.Equals("id", "") - case 1: - q = q.Equals("id", userIds[0]) - default: - q = q.In("id", userIds) + return nil, errors.Wrap(err, "unable to filterByOwnerAndProjectDomain") } } else { - ownerId, queryScope, err := db.FetchCheckQueryOwnerScope(ctx, userCred, jsonutils.Marshal(input), rm, policy.PolicyActionList, true) - if err != nil { - return nil, httperrors.NewGeneralError(err) - } q = rm.filterByOwner(q, ownerId, queryScope) } return q, nil From 49749609b4138b6948dc6b851065a9cc26f40505 Mon Sep 17 00:00:00 2001 From: Zexi Li Date: Fri, 18 Jun 2021 12:54:36 +0800 Subject: [PATCH 03/10] fix(region,scheduler): baremetal reuse ip --- pkg/compute/guestdrivers/baremetals.go | 2 +- pkg/compute/models/hosts.go | 33 ++++++++++++++------- pkg/compute/models/networks.go | 5 ++++ pkg/scheduler/cache/candidate/baremetals.go | 14 +++++++++ pkg/scheduler/cache/candidate/base.go | 15 ++++++++++ pkg/scheduler/core/types.go | 2 ++ pkg/scheduler/test/mock/core.go | 14 +++++++++ 7 files changed, 74 insertions(+), 11 deletions(-) diff --git a/pkg/compute/guestdrivers/baremetals.go b/pkg/compute/guestdrivers/baremetals.go index 9acb197b39..12342c9c47 100644 --- a/pkg/compute/guestdrivers/baremetals.go +++ b/pkg/compute/guestdrivers/baremetals.go @@ -160,7 +160,7 @@ func (self *SBaremetalGuestDriver) GetNamedNetworkConfiguration(guest *models.SG } reuseAddr := false hn := host.GetAttach2Network(netConfig.Network) - if hn != nil && netConfig.Address == "" && options.Options.BaremetalServerReuseHostIp { + if hn != nil && options.Options.BaremetalServerReuseHostIp { // try to reuse host network IP address netConfig.Address = hn.IpAddr reuseAddr = true diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index 36970b8d37..817a851e6a 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -2455,7 +2455,7 @@ func (self *SHost) GetNetinterfacesWithIdAndCredential(netId string, userCred mc if err != nil { return nil, nil } - if used == 0 && !reserved { + if used == 0 && !reserved && !options.Options.BaremetalServerReuseHostIp { return nil, nil } matchNetIfs := make([]SNetInterface, 0) @@ -2873,16 +2873,11 @@ func (self *SHost) getMoreDetails(ctx context.Context, out api.HostDetails, show out.ServerIps = strings.Join(server.GetRealIPs(), ",") } } - netifs := self.GetNetInterfaces() - if netifs != nil && len(netifs) > 0 { + nics := self.GetNics() + if nics != nil && len(nics) > 0 { nicInfos := []jsonutils.JSONObject{} - for i := 0; i < len(netifs); i += 1 { - nicInfo := netifs[i].getBaremetalJsonDesc() - if nicInfo == nil { - log.Errorf("netif %s get baremetal desc failed", netifs[i].GetId()) - continue - } - nicInfos = append(nicInfos, nicInfo) + for i := 0; i < len(nics); i += 1 { + nicInfos = append(nicInfos, jsonutils.Marshal(nics[i])) } out.NicCount = len(nicInfos) out.NicInfo = nicInfos @@ -5651,6 +5646,24 @@ func (host *SHost) GetIpmiInfo() (types.SIPMIInfo, error) { return info, nil } +func (host *SHost) GetNics() []*types.SNic { + netifs := host.GetNetInterfaces() + nicInfos := []*types.SNic{} + if netifs != nil && len(netifs) > 0 { + for i := 0; i < len(netifs); i += 1 { + desc := netifs[i].getBaremetalJsonDesc() + if desc == nil { + log.Errorf("netif %s get baremetal desc failed", netifs[i].GetId()) + continue + } + nicInfo := new(types.SNic) + desc.Unmarshal(nicInfo) + nicInfos = append(nicInfos, nicInfo) + } + } + return nicInfos +} + func (host *SHost) GetUEFIInfo() (*types.EFIBootMgrInfo, error) { if host.UefiInfo == nil { return nil, nil diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go index 5883cf1eb9..c81eaad9a1 100644 --- a/pkg/compute/models/networks.go +++ b/pkg/compute/models/networks.go @@ -1056,6 +1056,11 @@ func isValidNetworkInfo(userCred mcclient.TokenCredential, netConfig *api.Networ if netConfig.BwLimit > api.MAX_BANDWIDTH { return httperrors.NewInputParameterError("Bandwidth limit cannot exceed %dMbps", api.MAX_BANDWIDTH) } + if net.ServerType == api.NETWORK_TYPE_BAREMETAL { + // not check baremetal network free address here + // TODO: find better solution ? + return nil + } freeCnt, err := net.getFreeAddressCount() if err != nil { return httperrors.NewInternalServerError("getFreeAddressCount fail %s", err) diff --git a/pkg/scheduler/cache/candidate/baremetals.go b/pkg/scheduler/cache/candidate/baremetals.go index 0789aae0a1..d4da4ca317 100644 --- a/pkg/scheduler/cache/candidate/baremetals.go +++ b/pkg/scheduler/cache/candidate/baremetals.go @@ -57,6 +57,20 @@ func (h baremetalGetter) StorageInfo() []*baremetal.BaremetalStorage { return h.bm.StorageInfo } +func (h baremetalGetter) GetFreePort(netId string) int { + cnt := h.h.GetFreePort(netId) + if cnt < 0 { + cnt = 0 + } + nics := h.GetNics() + for _, nic := range nics { + if len(nic.IpAddr) > 0 && nic.NetId == netId { + cnt += 1 + } + } + return cnt +} + type BaremetalDesc struct { *BaseHostDesc diff --git a/pkg/scheduler/cache/candidate/base.go b/pkg/scheduler/cache/candidate/base.go index a0e00cd105..b797a18efb 100644 --- a/pkg/scheduler/cache/candidate/base.go +++ b/pkg/scheduler/cache/candidate/base.go @@ -52,6 +52,8 @@ type BaseHostDesc struct { InstanceGroups map[string]*api.CandidateGroup `json:"instance_groups"` IpmiInfo types.SIPMIInfo `json:"ipmi_info"` + Nics []*types.SNic `json:"nics"` + SharedDomains []string `json:"shared_domains"` PendingUsage map[string]interface{} `json:"pending_usage"` } @@ -227,6 +229,10 @@ func (b baseHostGetter) GetIpmiInfo() types.SIPMIInfo { return b.h.IpmiInfo } +func (b baseHostGetter) GetNics() []*types.SNic { + return b.h.Nics +} + func (b baseHostGetter) GetQuotaKeys(s *api.SchedInfo) computemodels.SComputeResourceKeys { return b.h.getQuotaKeys(s) } @@ -318,6 +324,10 @@ func newBaseHostDesc(b *baseBuilder, host *computemodels.SHost) (*BaseHostDesc, return nil, fmt.Errorf("Fill ipmi info error: %v", err) } + if err := desc.fillNics(host); err != nil { + return nil, fmt.Errorf("Fill nics info error: %v", err) + } + if err := desc.fillIsolatedDevices(b, host); err != nil { return nil, fmt.Errorf("Fill isolated devices error: %v", err) } @@ -619,6 +629,11 @@ func (b *BaseHostDesc) fillIpmiInfo(host *computemodels.SHost) error { return nil } +func (b *BaseHostDesc) fillNics(host *computemodels.SHost) error { + b.Nics = host.GetNics() + return nil +} + func (h *BaseHostDesc) GetEnableStatus() string { if h.GetEnabled() { return "enable" diff --git a/pkg/scheduler/core/types.go b/pkg/scheduler/core/types.go index a936944fdb..905671eab4 100644 --- a/pkg/scheduler/core/types.go +++ b/pkg/scheduler/core/types.go @@ -106,6 +106,8 @@ type CandidatePropertyGetter interface { GetIpmiInfo() types.SIPMIInfo + GetNics() []*types.SNic + GetQuotaKeys(s *api.SchedInfo) computemodels.SComputeResourceKeys GetPendingUsage() *schedmodels.SPendingUsage diff --git a/pkg/scheduler/test/mock/core.go b/pkg/scheduler/test/mock/core.go index fcbb1df47e..0878a719cb 100644 --- a/pkg/scheduler/test/mock/core.go +++ b/pkg/scheduler/test/mock/core.go @@ -193,6 +193,20 @@ func (mr *MockCandidatePropertyGetterMockRecorder) GetIpmiInfo() *gomock.Call { return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetIpmiInfo", reflect.TypeOf((*MockCandidatePropertyGetter)(nil).GetIpmiInfo)) } +// GetNics mocks base method +func (m *MockCandidatePropertyGetter) GetNics() []*types.SNic { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "GetNics") + ret0, _ := ret[0].([]*types.SNic) + return ret0 +} + +// GetIpmiInfo indicates an expected call of GetIpmiInfo +func (mr *MockCandidatePropertyGetterMockRecorder) GetNics() *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNics", reflect.TypeOf((*MockCandidatePropertyGetter)(nil).GetNics)) +} + // GetIsolatedDevice mocks base method func (m *MockCandidatePropertyGetter) GetIsolatedDevice(arg0 string) *core.IsolatedDeviceDesc { m.ctrl.T.Helper() From 711fbb6c3bee0e6ff5a951e7ecefa395db4ab0fa Mon Sep 17 00:00:00 2001 From: Qu Xuan Date: Fri, 18 Jun 2021 18:04:04 +0800 Subject: [PATCH 04/10] fix(region): skip disabled project mapping --- pkg/compute/models/cloudproviders.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/compute/models/cloudproviders.go b/pkg/compute/models/cloudproviders.go index 41f55dcbae..42f1818d7b 100644 --- a/pkg/compute/models/cloudproviders.go +++ b/pkg/compute/models/cloudproviders.go @@ -123,7 +123,13 @@ type pmCache struct { func (self *pmCache) GetProjectMapping() (*SProjectMapping, error) { if len(self.ManagerProjectMappingId) > 0 { - return GetRuleMapping(self.ManagerProjectMappingId) + pm, err := GetRuleMapping(self.ManagerProjectMappingId) + if err != nil { + return nil, errors.Wrapf(err, "GetRuleMapping(%s)", self.ManagerProjectMappingId) + } + if pm.Enabled.IsTrue() { + return pm, nil + } } if len(self.AccountProjectMappingId) > 0 { return GetRuleMapping(self.AccountProjectMappingId) From 40f33db2a267480c0e77ccf41b0b6d714559cac6 Mon Sep 17 00:00:00 2001 From: zhaoxiangchun <1422928955@qq.com> Date: Fri, 18 Jun 2021 18:52:34 +0800 Subject: [PATCH 05/10] fix(monitor): fix agent monitor query MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1.修复agent监控查询图表显示id的问题 --- pkg/apis/monitor/unifiedmonitor_const.go | 1 + pkg/monitor/alerting/conditions/query.go | 2 ++ 2 files changed, 3 insertions(+) diff --git a/pkg/apis/monitor/unifiedmonitor_const.go b/pkg/apis/monitor/unifiedmonitor_const.go index 287c698348..ca86082c6b 100644 --- a/pkg/apis/monitor/unifiedmonitor_const.go +++ b/pkg/apis/monitor/unifiedmonitor_const.go @@ -20,6 +20,7 @@ var ( METRIC_RES_TYPE_OSS: "oss_name", METRIC_RES_TYPE_CLOUDACCOUNT: "cloudaccount_name", METRIC_RES_TYPE_STORAGE: "storage_name", + METRIC_RES_TYPE_AGENT: "vm_name", } MEASUREMENT_TAG_ID = map[string]string{ METRIC_RES_TYPE_HOST: "host_id", diff --git a/pkg/monitor/alerting/conditions/query.go b/pkg/monitor/alerting/conditions/query.go index ae8e7eead5..bd90e2a9e1 100644 --- a/pkg/monitor/alerting/conditions/query.go +++ b/pkg/monitor/alerting/conditions/query.go @@ -752,6 +752,8 @@ func (c *QueryCondition) getTagKeyRelationMap() map[string]string { relationMap = monitor.DomainTags case monitor.METRIC_RES_TYPE_STORAGE: relationMap = monitor.StorageTags + case monitor.METRIC_RES_TYPE_AGENT: + relationMap = monitor.ServerTags default: relationMap = monitor.HostTags } From f3dbe336717e2371b7268886a73955fa08984cfa Mon Sep 17 00:00:00 2001 From: Qu Xuan Date: Fri, 23 Apr 2021 15:46:52 +0800 Subject: [PATCH 06/10] feat(region): waf --- cmd/climc/shell/compute/waf_instances.go | 33 + cmd/climc/shell/compute/waf_ipset_caches.go | 29 + cmd/climc/shell/compute/waf_ipsets.go | 29 + .../shell/compute/waf_regexset_caches.go | 29 + cmd/climc/shell/compute/waf_regexsets.go | 29 + cmd/climc/shell/compute/waf_rule_groups.go | 29 + cmd/climc/shell/compute/waf_rules.go | 32 + go.sum | 11 - pkg/apis/compute/waf_instance.go | 84 + pkg/apis/compute/waf_ipsets.go | 45 + pkg/apis/compute/waf_regexsets.go | 45 + pkg/apis/compute/waf_rule_groups.go | 50 + pkg/apis/compute/waf_rules.go | 76 + pkg/cloudprovider/consts.go | 1 + pkg/cloudprovider/resources.go | 67 + pkg/cloudprovider/waf.go | 292 + pkg/compute/models/capabilities.go | 4 + pkg/compute/models/cloudsync.go | 91 + pkg/compute/models/regiondrivers.go | 7 + pkg/compute/models/skus_tools.go | 55 + pkg/compute/models/waf_instances.go | 478 + pkg/compute/models/waf_ipset_caches.go | 367 + pkg/compute/models/waf_ipsets.go | 151 + pkg/compute/models/waf_regexset_caches.go | 367 + pkg/compute/models/waf_regexsets.go | 151 + pkg/compute/models/waf_rule_group_caches.go | 367 + pkg/compute/models/waf_rule_groups.go | 305 + pkg/compute/models/waf_rule_statements.go | 193 + pkg/compute/models/waf_rules.go | 583 + pkg/compute/policy/defaults.go | 12 + pkg/compute/policy/resources.go | 5 + pkg/compute/regiondrivers/aliyun.go | 16 + pkg/compute/regiondrivers/aws.go | 30 + pkg/compute/regiondrivers/azure.go | 28 + pkg/compute/regiondrivers/base.go | 8 + pkg/compute/service/handlers.go | 10 + pkg/compute/service/service.go | 1 + pkg/compute/tasks/waf_create_task.go | 77 + pkg/compute/tasks/waf_delete_task.go | 73 + .../tasks/waf_ipset_cache_delete_task.go | 67 + pkg/compute/tasks/waf_ipset_delete_task.go | 75 + .../tasks/waf_regexset_cache_delete_task.go | 67 + pkg/compute/tasks/waf_regexset_delete_task.go | 75 + pkg/compute/tasks/waf_rule_create_task.go | 79 + pkg/compute/tasks/waf_rule_delete_task.go | 67 + pkg/compute/tasks/waf_rule_syncstatus_task.go | 55 + pkg/compute/tasks/waf_rule_update_task.go | 84 + pkg/compute/tasks/waf_syncstatus_task.go | 59 + pkg/mcclient/modules/mod_waf_instances.go | 29 + pkg/mcclient/modules/mod_waf_ipset_caches.go | 29 + pkg/mcclient/modules/mod_waf_ipsets.go | 29 + .../modules/mod_waf_regexset_caches.go | 29 + pkg/mcclient/modules/mod_waf_regexsets.go | 29 + pkg/mcclient/modules/mod_waf_rule_groups.go | 29 + pkg/mcclient/modules/mod_waf_rules.go | 29 + pkg/mcclient/options/compute/waf_instances.go | 40 + pkg/mcclient/options/compute/waf_ipsets.go | 37 + pkg/mcclient/options/compute/waf_regexsets.go | 37 + .../options/compute/waf_rule_groups.go | 39 + pkg/mcclient/options/compute/waf_rules.go | 60 + pkg/multicloud/aliyun/aliyun.go | 7 +- pkg/multicloud/aliyun/region.go | 12 + pkg/multicloud/aliyun/shell/waf.go | 73 + pkg/multicloud/aliyun/waf.go | 61 + pkg/multicloud/aliyun/waf_domain.go | 502 + pkg/multicloud/aws/aws.go | 1 + pkg/multicloud/aws/region.go | 13 + pkg/multicloud/aws/shell/waf.go | 210 + pkg/multicloud/aws/waf.go | 536 + pkg/multicloud/aws/waf_ipsets.go | 146 + pkg/multicloud/aws/waf_regexsets.go | 155 + pkg/multicloud/aws/waf_rule_groups.go | 135 + pkg/multicloud/aws/waf_rules.go | 265 + pkg/multicloud/azure/azure.go | 15 + pkg/multicloud/azure/shell/waf.go | 70 + pkg/multicloud/azure/waf.go | 617 + pkg/multicloud/azure/waf_front_doors.go | 69 + pkg/multicloud/azure/waf_rule_groups.go | 54 + pkg/multicloud/region_base.go | 24 + .../aws/aws-sdk-go/service/wafv2/api.go | 15985 ++++++++++++++++ .../aws/aws-sdk-go/service/wafv2/doc.go | 88 + .../aws/aws-sdk-go/service/wafv2/errors.go | 163 + .../aws/aws-sdk-go/service/wafv2/service.go | 103 + vendor/modules.txt | 1 + 84 files changed, 24597 insertions(+), 12 deletions(-) create mode 100644 cmd/climc/shell/compute/waf_instances.go create mode 100644 cmd/climc/shell/compute/waf_ipset_caches.go create mode 100644 cmd/climc/shell/compute/waf_ipsets.go create mode 100644 cmd/climc/shell/compute/waf_regexset_caches.go create mode 100644 cmd/climc/shell/compute/waf_regexsets.go create mode 100644 cmd/climc/shell/compute/waf_rule_groups.go create mode 100644 cmd/climc/shell/compute/waf_rules.go create mode 100644 pkg/apis/compute/waf_instance.go create mode 100644 pkg/apis/compute/waf_ipsets.go create mode 100644 pkg/apis/compute/waf_regexsets.go create mode 100644 pkg/apis/compute/waf_rule_groups.go create mode 100644 pkg/apis/compute/waf_rules.go create mode 100644 pkg/cloudprovider/waf.go create mode 100644 pkg/compute/models/waf_instances.go create mode 100644 pkg/compute/models/waf_ipset_caches.go create mode 100644 pkg/compute/models/waf_ipsets.go create mode 100644 pkg/compute/models/waf_regexset_caches.go create mode 100644 pkg/compute/models/waf_regexsets.go create mode 100644 pkg/compute/models/waf_rule_group_caches.go create mode 100644 pkg/compute/models/waf_rule_groups.go create mode 100644 pkg/compute/models/waf_rule_statements.go create mode 100644 pkg/compute/models/waf_rules.go create mode 100644 pkg/compute/tasks/waf_create_task.go create mode 100644 pkg/compute/tasks/waf_delete_task.go create mode 100644 pkg/compute/tasks/waf_ipset_cache_delete_task.go create mode 100644 pkg/compute/tasks/waf_ipset_delete_task.go create mode 100644 pkg/compute/tasks/waf_regexset_cache_delete_task.go create mode 100644 pkg/compute/tasks/waf_regexset_delete_task.go create mode 100644 pkg/compute/tasks/waf_rule_create_task.go create mode 100644 pkg/compute/tasks/waf_rule_delete_task.go create mode 100644 pkg/compute/tasks/waf_rule_syncstatus_task.go create mode 100644 pkg/compute/tasks/waf_rule_update_task.go create mode 100644 pkg/compute/tasks/waf_syncstatus_task.go create mode 100644 pkg/mcclient/modules/mod_waf_instances.go create mode 100644 pkg/mcclient/modules/mod_waf_ipset_caches.go create mode 100644 pkg/mcclient/modules/mod_waf_ipsets.go create mode 100644 pkg/mcclient/modules/mod_waf_regexset_caches.go create mode 100644 pkg/mcclient/modules/mod_waf_regexsets.go create mode 100644 pkg/mcclient/modules/mod_waf_rule_groups.go create mode 100644 pkg/mcclient/modules/mod_waf_rules.go create mode 100644 pkg/mcclient/options/compute/waf_instances.go create mode 100644 pkg/mcclient/options/compute/waf_ipsets.go create mode 100644 pkg/mcclient/options/compute/waf_regexsets.go create mode 100644 pkg/mcclient/options/compute/waf_rule_groups.go create mode 100644 pkg/mcclient/options/compute/waf_rules.go create mode 100644 pkg/multicloud/aliyun/shell/waf.go create mode 100644 pkg/multicloud/aliyun/waf.go create mode 100644 pkg/multicloud/aliyun/waf_domain.go create mode 100644 pkg/multicloud/aws/shell/waf.go create mode 100644 pkg/multicloud/aws/waf.go create mode 100644 pkg/multicloud/aws/waf_ipsets.go create mode 100644 pkg/multicloud/aws/waf_regexsets.go create mode 100644 pkg/multicloud/aws/waf_rule_groups.go create mode 100644 pkg/multicloud/aws/waf_rules.go create mode 100644 pkg/multicloud/azure/shell/waf.go create mode 100644 pkg/multicloud/azure/waf.go create mode 100644 pkg/multicloud/azure/waf_front_doors.go create mode 100644 pkg/multicloud/azure/waf_rule_groups.go create mode 100644 vendor/github.com/aws/aws-sdk-go/service/wafv2/api.go create mode 100644 vendor/github.com/aws/aws-sdk-go/service/wafv2/doc.go create mode 100644 vendor/github.com/aws/aws-sdk-go/service/wafv2/errors.go create mode 100644 vendor/github.com/aws/aws-sdk-go/service/wafv2/service.go diff --git a/cmd/climc/shell/compute/waf_instances.go b/cmd/climc/shell/compute/waf_instances.go new file mode 100644 index 0000000000..37af0386cc --- /dev/null +++ b/cmd/climc/shell/compute/waf_instances.go @@ -0,0 +1,33 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/cmd/climc/shell" + "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/compute" +) + +func init() { + cmd := shell.NewResourceCmd(&modules.WafInstances).WithKeyword("waf").WithContextManager(&modules.Cloudregions) + cmd.List(&compute.WafInstanceListOptions{}) + cmd.Delete(&options.BaseIdOptions{}) + cmd.Show(&options.BaseIdOptions{}) + cmd.Update(&options.BaseUpdateOptions{}) + cmd.Get("cloud-resources", &options.BaseIdOptions{}) + cmd.Perform("syncstatus", &options.BaseIdOptions{}) + cmd.Create(&compute.WafInstanceCreateOptions{}) +} diff --git a/cmd/climc/shell/compute/waf_ipset_caches.go b/cmd/climc/shell/compute/waf_ipset_caches.go new file mode 100644 index 0000000000..5d0108c3d8 --- /dev/null +++ b/cmd/climc/shell/compute/waf_ipset_caches.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/cmd/climc/shell" + "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/compute" +) + +func init() { + cmd := shell.NewResourceCmd(&modules.WafIPSetCaches) + cmd.List(&compute.WafIPSetCacheListOptions{}) + cmd.Show(&options.BaseIdOptions{}) + cmd.Delete(&options.BaseIdOptions{}) +} diff --git a/cmd/climc/shell/compute/waf_ipsets.go b/cmd/climc/shell/compute/waf_ipsets.go new file mode 100644 index 0000000000..c1e2f9317d --- /dev/null +++ b/cmd/climc/shell/compute/waf_ipsets.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/cmd/climc/shell" + "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/compute" +) + +func init() { + cmd := shell.NewResourceCmd(&modules.WafIPSets) + cmd.List(&compute.WafIPSetListOptions{}) + cmd.Show(&options.BaseIdOptions{}) + cmd.Delete(&options.BaseIdOptions{}) +} diff --git a/cmd/climc/shell/compute/waf_regexset_caches.go b/cmd/climc/shell/compute/waf_regexset_caches.go new file mode 100644 index 0000000000..a61e3d9022 --- /dev/null +++ b/cmd/climc/shell/compute/waf_regexset_caches.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/cmd/climc/shell" + "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/compute" +) + +func init() { + cmd := shell.NewResourceCmd(&modules.WafRegexSetCaches) + cmd.List(&compute.WafRegexSetCacheListOptions{}) + cmd.Show(&options.BaseIdOptions{}) + cmd.Delete(&options.BaseIdOptions{}) +} diff --git a/cmd/climc/shell/compute/waf_regexsets.go b/cmd/climc/shell/compute/waf_regexsets.go new file mode 100644 index 0000000000..7c28bb9cf6 --- /dev/null +++ b/cmd/climc/shell/compute/waf_regexsets.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/cmd/climc/shell" + "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/compute" +) + +func init() { + cmd := shell.NewResourceCmd(&modules.WafRegexSets) + cmd.List(&compute.WafRegexSetListOptions{}) + cmd.Show(&options.BaseIdOptions{}) + cmd.Delete(&options.BaseIdOptions{}) +} diff --git a/cmd/climc/shell/compute/waf_rule_groups.go b/cmd/climc/shell/compute/waf_rule_groups.go new file mode 100644 index 0000000000..b9ecf5b52b --- /dev/null +++ b/cmd/climc/shell/compute/waf_rule_groups.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/cmd/climc/shell" + "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/compute" +) + +func init() { + cmd := shell.NewResourceCmd(&modules.WafRuleGroups) + cmd.List(&compute.WafRuleGroupListOptions{}) + cmd.Show(&options.BaseIdOptions{}) + cmd.Delete(&options.BaseIdOptions{}) +} diff --git a/cmd/climc/shell/compute/waf_rules.go b/cmd/climc/shell/compute/waf_rules.go new file mode 100644 index 0000000000..aba4640152 --- /dev/null +++ b/cmd/climc/shell/compute/waf_rules.go @@ -0,0 +1,32 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/cmd/climc/shell" + "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/compute" +) + +func init() { + cmd := shell.NewResourceCmd(&modules.WafRules) + cmd.List(&compute.WafRuleListOptions{}) + cmd.Create(&compute.WafRuleOptions{}) + cmd.Update(&compute.WafRuleUpdateOptions{}) + cmd.Show(&options.BaseIdOptions{}) + cmd.Delete(&options.BaseIdOptions{}) + cmd.Perform("syncstatus", &options.BaseIdOptions{}) +} diff --git a/go.sum b/go.sum index 0fe5f89fca..fbc74bc728 100644 --- a/go.sum +++ b/go.sum @@ -2,14 +2,12 @@ bazil.org/fuse v0.0.0-20180421153158-65cc252bf669 h1:FNCRpXiquG1aoyqcIWVFmpTSKVc bazil.org/fuse v0.0.0-20180421153158-65cc252bf669/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8= cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= -cloud.google.com/go v0.38.0 h1:ROfEUZz+Gh5pa62DJWXSaonyu3StP6EA6lPEXPI6mCo= cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU= cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY= cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc= cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0= -cloud.google.com/go v0.50.0 h1:0E3eE8MX426vUOs7aHfI7aN1BrIzzzf4ccKCSfSjGmc= cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To= cloud.google.com/go v0.51.0 h1:PvKAVQWCtlGUSlZkGW3QLelKaWq7KYv/MW1EboG8bfM= cloud.google.com/go v0.51.0/go.mod h1:hWtGJ6gnXH+KgDv+V0zFGDvpi07n3z8ZNj3T1RW0Gcw= @@ -32,16 +30,12 @@ github.com/Azure/azure-sdk-for-go v36.1.0+incompatible h1:smHlbChr/JDmsyUqELZXLs github.com/Azure/azure-sdk-for-go v36.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc= github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs= github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24= -github.com/Azure/go-autorest/autorest v0.9.0 h1:MRvx8gncNaXJqOoLmhNjUAKh33JJF8LyxPhomEtOsjs= github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI= -github.com/Azure/go-autorest/autorest v0.9.3 h1:OZEIaBbMdUE/Js+BQKlpO81XlISgipr6yDJ+PSwsgi4= github.com/Azure/go-autorest/autorest v0.9.3/go.mod h1:GsRuLYvwzLjjjRoWEIyMUaYq8GNUx2nRB378IPt/1p0= github.com/Azure/go-autorest/autorest v0.9.6 h1:5YWtOnckcudzIw8lPPBcWOnmIFWMtHci1ZWAZulMSx0= github.com/Azure/go-autorest/autorest v0.9.6/go.mod h1:/FALq9T/kS7b5J5qsQ+RSTUdAmGFqi0vUdVNNx8q630= -github.com/Azure/go-autorest/autorest/adal v0.5.0 h1:q2gDruN08/guU9vAjuPWff0+QIrpH6ediguzdAzXAUU= github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0= github.com/Azure/go-autorest/autorest/adal v0.8.0/go.mod h1:Z6vX6WXXuyieHAXwMj0S6HY6e6wcHn37qQMBQlvY3lc= -github.com/Azure/go-autorest/autorest/adal v0.8.1 h1:pZdL8o72rK+avFWl+p9nE8RWi1JInZrWJYlnpfXJwHk= github.com/Azure/go-autorest/autorest/adal v0.8.1/go.mod h1:ZjhuQClTqx435SRJ2iMlOxPYt3d2C/T/7TiQCVZSn3Q= github.com/Azure/go-autorest/autorest/adal v0.8.2 h1:O1X4oexUxnZCaEUGsvMnr8ZGj8HI37tNezwY4npRqA0= github.com/Azure/go-autorest/autorest/adal v0.8.2/go.mod h1:ZjhuQClTqx435SRJ2iMlOxPYt3d2C/T/7TiQCVZSn3Q= @@ -49,12 +43,10 @@ github.com/Azure/go-autorest/autorest/azure/auth v0.4.2 h1:iM6UAvjR97ZIeR93qTcwp github.com/Azure/go-autorest/autorest/azure/auth v0.4.2/go.mod h1:90gmfKdlmKgfjUpnCEpOJzsUEjrWDSLwHIG73tSXddM= github.com/Azure/go-autorest/autorest/azure/cli v0.3.1 h1:LXl088ZQlP0SBppGFsRZonW6hSvwgL5gRByMbvUbx8U= github.com/Azure/go-autorest/autorest/azure/cli v0.3.1/go.mod h1:ZG5p860J94/0kI9mNJVoIoLgXcirM2gF5i2kWloofxw= -github.com/Azure/go-autorest/autorest/date v0.1.0 h1:YGrhWfrgtFs84+h0o46rJrlmsZtyZRg470CqAXTZaGM= github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA= github.com/Azure/go-autorest/autorest/date v0.2.0 h1:yW+Zlqf26583pE43KhfnhFcdmSWlm5Ew6bxipnr/tbM= github.com/Azure/go-autorest/autorest/date v0.2.0/go.mod h1:vcORJHLJEh643/Ioh9+vPmf1Ij9AEBM5FuBIXLmIy0g= github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0= -github.com/Azure/go-autorest/autorest/mocks v0.2.0 h1:Ww5g4zThfD/6cLb4z6xxgeyDa7QDkizMkJKe0ysZXp0= github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0= github.com/Azure/go-autorest/autorest/mocks v0.3.0 h1:qJumjCaCudz+OcqE9/XtEPfvtOjOmKaui4EOpFI6zZc= github.com/Azure/go-autorest/autorest/mocks v0.3.0/go.mod h1:a8FDP3DYzQ4RYfVAxAN3SVSiiO77gL2j2ronKKP0syM= @@ -703,10 +695,8 @@ golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20191003171128-d98b1b443823/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= -golang.org/x/net v0.0.0-20200707034311-ab3426394381 h1:VXak5I6aEWmAXeQjA+QSZzlgNrpq9mjcfDemuexIKsU= golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20201110031124-69a78807bb2b h1:uwuIcX0g4Yl1NC5XAz37xsr2lTtcqevgzYNVt49waME= golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= @@ -752,7 +742,6 @@ golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4 h1:5/PjkGUjvEU5Gl6BxmvKRPpqo2uNMv4rcHBMwzk/st8= golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= diff --git a/pkg/apis/compute/waf_instance.go b/pkg/apis/compute/waf_instance.go new file mode 100644 index 0000000000..f73ad0ad28 --- /dev/null +++ b/pkg/apis/compute/waf_instance.go @@ -0,0 +1,84 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/pkg/apis" + "yunion.io/x/onecloud/pkg/cloudprovider" +) + +const ( + WAF_ACTION_ALLOW = "Allow" + WAF_ACTION_BLOCK = "Block" + WAF_ACTION_PREVENTION = "Prevention" + WAF_ACTION_DETECTION = "Detection" + + WAF_STATUS_AVAILABLE = "available" + WAF_STATUS_DELETING = "deleting" + WAF_STATUS_DELETE_FAILED = "delete_failed" + WAF_STATUS_CREATING = "creating" + WAF_STATUS_CREATE_FAILED = "create_failed" + WAF_STATUS_UPDATING = "updating" + WAF_STATUS_UNKNOWN = "unknown" +) + +type WafInstanceCreateInput struct { + apis.EnabledStatusInfrasResourceBaseCreateInput + + // 阿里云CNAME介入回源地址,支持IP和域名,域名仅支持输入一个 + // 此参数和cloud_resources两者必须指定某一个 + SourceIps cloudprovider.WafSourceIps `json:"source_ips"` + + // 关联云资源列表 + // 阿里云要求输入此参数或source_ips + CloudResources []cloudprovider.SCloudResource + + CloudregionResourceInput + CloudproviderResourceInput + + Type cloudprovider.TWafType + + DefaultAction *cloudprovider.DefaultAction +} + +type WafInstanceDetails struct { + apis.EnabledStatusInfrasResourceBaseDetails + ManagedResourceInfo + CloudregionResourceInfo + + Rules []SWafRule +} + +type SWafRule struct { + Id string + Name string + Priority int + Action *cloudprovider.DefaultAction +} + +type WafInstanceListInput struct { + apis.EnabledStatusInfrasResourceBaseListInput + apis.ExternalizedResourceBaseListInput + + ManagedResourceListInput + RegionalFilterListInput +} + +type WafSyncstatusInput struct { +} + +type WafDeleteRuleInput struct { + WafRuleId string +} diff --git a/pkg/apis/compute/waf_ipsets.go b/pkg/apis/compute/waf_ipsets.go new file mode 100644 index 0000000000..160e1e6322 --- /dev/null +++ b/pkg/apis/compute/waf_ipsets.go @@ -0,0 +1,45 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import "yunion.io/x/onecloud/pkg/apis" + +const ( + WAF_IPSET_STATUS_AVAILABLE = "available" + WAF_IPSET_STATUS_DELETING = "deleting" + WAF_IPSET_STATUS_DELETE_FAILED = "delete_failed" +) + +type WafIPSetDetails struct { + apis.StatusInfrasResourceBaseDetails +} + +type WafIPSetListInput struct { + apis.StatusInfrasResourceBaseListInput +} + +type WafIPSetCacheDetails struct { + apis.StatusStandaloneResourceDetails + ManagedResourceInfo + CloudregionResourceInfo +} + +type WafIPSetCacheListInput struct { + apis.StatusStandaloneResourceListInput + apis.ExternalizedResourceBaseListInput + + ManagedResourceListInput + RegionalFilterListInput +} diff --git a/pkg/apis/compute/waf_regexsets.go b/pkg/apis/compute/waf_regexsets.go new file mode 100644 index 0000000000..d6fbcfd5d7 --- /dev/null +++ b/pkg/apis/compute/waf_regexsets.go @@ -0,0 +1,45 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import "yunion.io/x/onecloud/pkg/apis" + +const ( + WAF_REGEX_SET_STATUS_AVAILABLE = "available" + WAF_REGEX_SET_STATUS_DELETING = "deleting" + WAF_REGEX_SET_STATUS_DELETE_FAILED = "delete_failed" +) + +type WafRegexSetDetails struct { + apis.StatusInfrasResourceBaseDetails +} + +type WafRegexSetListInput struct { + apis.StatusInfrasResourceBaseListInput +} + +type WafRegexSetCacheDetails struct { + apis.StatusStandaloneResourceDetails + ManagedResourceInfo + CloudregionResourceInfo +} + +type WafRegexSetCacheListInput struct { + apis.StatusStandaloneResourceListInput + apis.ExternalizedResourceBaseListInput + + ManagedResourceListInput + RegionalFilterListInput +} diff --git a/pkg/apis/compute/waf_rule_groups.go b/pkg/apis/compute/waf_rule_groups.go new file mode 100644 index 0000000000..f721bd1f5b --- /dev/null +++ b/pkg/apis/compute/waf_rule_groups.go @@ -0,0 +1,50 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import "yunion.io/x/onecloud/pkg/apis" + +const ( + WAF_RULE_GROUP_STATUS_AVAILABLE = "available" + WAF_RULE_GROUP_STATUS_DELETING = "deleting" +) + +type WafRuleGroupDetails struct { + apis.StatusInfrasResourceBaseDetails +} + +type WafRuleGroupListInput struct { + apis.StatusInfrasResourceBaseListInput + + // 是否是系统RuleGroup + IsSystem *bool `json:"is_system"` + // 云平台 + Provider string `json:"provider"` + // 云环境 + CloudEnv string `json:"cloud_env"` +} + +type WafRuleGroupCacheDetails struct { + apis.StatusStandaloneResourceDetails + ManagedResourceInfo + CloudregionResourceInfo +} + +type WafRuleGroupCacheListInput struct { + apis.StatusStandaloneResourceListInput + apis.ExternalizedResourceBaseListInput + ManagedResourceListInput + RegionalFilterListInput +} diff --git a/pkg/apis/compute/waf_rules.go b/pkg/apis/compute/waf_rules.go new file mode 100644 index 0000000000..220294f031 --- /dev/null +++ b/pkg/apis/compute/waf_rules.go @@ -0,0 +1,76 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/onecloud/pkg/apis" + "yunion.io/x/onecloud/pkg/cloudprovider" +) + +const ( + WAF_RULE_STATUS_AVAILABLE = "available" + WAF_RULE_STATUS_DELETING = "deleting" + WAF_RULE_STATUS_CREATING = "creating" + WAF_RULE_STATUS_CREATE_FAILED = "create_failed" + WAF_RULE_STATUS_DELETE_FAILED = "delete_failed" + WAF_RULE_STATUS_UPDATING = "updating" + WAF_RULE_STATUS_UPDATE_FAILED = "update_failed" + WAF_RULE_STATUS_UNKNOWN = "unknown" +) + +type WafRuleListInput struct { + apis.StatusStandaloneResourceListInput + apis.ExternalizedResourceBaseListInput + + // WAF实例Id + WafInstanceId string `json:"waf_instance_id"` + + // WAF规则组Id + WafRuleGroupId string `json:"waf_rule_group_id"` +} + +type WafRuleCreateInput struct { + apis.StatusStandaloneResourceCreateInput + + // WAF实例Id + WafInstanceId string `json:"waf_instance_id"` + + // 优先级,不可重复 + // Azure优先级范围1-100 + Priority int `json:"priority"` + // 匹配后默认行为 + Action *cloudprovider.DefaultAction `json:"action"` + // enmu: and, or, not + StatementCondition string `json:"statement_condition"` + + // swagger: ignore + // WAF规则组Id + WafRuleGroupId string `json:"waf_rule_group_id"` + + // 条件表达式 + Statements []cloudprovider.SWafStatement +} + +type WafRuleDetails struct { + apis.StatusStandaloneResourceDetails + + Statements []cloudprovider.SWafStatement +} + +type WafRuleUpdateInput struct { + apis.StatusStandaloneResourceBaseUpdateInput + // 条件表达式 + Statements []cloudprovider.SWafStatement +} diff --git a/pkg/cloudprovider/consts.go b/pkg/cloudprovider/consts.go index eaf97850ed..e9b20039f8 100644 --- a/pkg/cloudprovider/consts.go +++ b/pkg/cloudprovider/consts.go @@ -56,6 +56,7 @@ const ( CLOUD_CAPABILITY_SAML_AUTH = "saml_auth" // 是否支持SAML 2.0 CLOUD_CAPABILITY_NAT = "nat" // NAT网关 CLOUD_CAPABILITY_NAS = "nas" // NAS + CLOUD_CAPABILITY_WAF = "waf" // WAF ) const ( diff --git a/pkg/cloudprovider/resources.go b/pkg/cloudprovider/resources.go index a21987501a..ad098e1377 100644 --- a/pkg/cloudprovider/resources.go +++ b/pkg/cloudprovider/resources.go @@ -44,6 +44,11 @@ type ICloudResource interface { SetTags(tags map[string]string, replace bool) error } +type ICloudEnabledResource interface { + ICloudResource + GetEnabled() bool +} + type IVirtualResource interface { ICloudResource @@ -165,6 +170,13 @@ type ICloudRegion interface { GetICloudApplicationGateways() ([]ICloudApplicationGateway, error) GetICloudApplicationGatewayById(id string) (ICloudApplicationGateway, error) + + GetICloudWafIPSets() ([]ICloudWafIPSet, error) + GetICloudWafRegexSets() ([]ICloudWafRegexSet, error) + GetICloudWafInstances() ([]ICloudWafInstance, error) + GetICloudWafInstanceById(id string) (ICloudWafInstance, error) + CreateICloudWafInstance(opts *WafCreateOptions) (ICloudWafInstance, error) + GetICloudWafRuleGroups() ([]ICloudWafRuleGroup, error) } type ICloudZone interface { @@ -1289,3 +1301,58 @@ type ICloudApplicationGateway interface { GetBackends() ([]SAppGatewayBackend, error) GetFrontends() ([]SAppGatewayFrontend, error) } + +type ICloudWafIPSet interface { + GetName() string + GetDesc() string + GetType() TWafType + GetGlobalId() string + GetAddresses() WafAddresses + + Delete() error +} + +type ICloudWafRegexSet interface { + GetName() string + GetDesc() string + GetType() TWafType + GetGlobalId() string + GetRegexPatterns() WafRegexPatterns + + Delete() error +} + +type ICloudWafInstance interface { + ICloudEnabledResource + + GetWafType() TWafType + GetDefaultAction() *DefaultAction + GetRules() ([]ICloudWafRule, error) + AddRule(opts *SWafRule) (ICloudWafRule, error) + + // 绑定的资源列表 + GetCloudResources() ([]SCloudResource, error) + + Delete() error +} + +type ICloudWafRuleGroup interface { + GetName() string + GetDesc() string + GetGlobalId() string + GetWafType() TWafType + GetRules() ([]ICloudWafRule, error) +} + +type ICloudWafRule interface { + GetName() string + GetDesc() string + GetGlobalId() string + GetPriority() int + GetAction() *DefaultAction + GetStatementCondition() TWafStatementCondition + GetStatements() ([]SWafStatement, error) + + Update(opts *SWafRule) error + Delete() error +} diff --git a/pkg/cloudprovider/waf.go b/pkg/cloudprovider/waf.go new file mode 100644 index 0000000000..f01caa1fe1 --- /dev/null +++ b/pkg/cloudprovider/waf.go @@ -0,0 +1,292 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package cloudprovider + +import ( + "fmt" + "reflect" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/gotypes" +) + +type TWafStatementType string +type TWafStatementCondition string +type TWafAction string +type TWafMatchField string +type TWafType string +type TWafOperator string + +type TWafTextTransformation string + +var ( + WafTypeCloudFront = TWafType("CloudFront") + WafTypeRegional = TWafType("Regional") + WafTypeDefault = TWafType("Default") + WafTypeAppGateway = TWafType("AppGateway") + + WafStatementTypeByteMatch = TWafStatementType("ByteMatch") + WafStatementTypeGeoMatch = TWafStatementType("GeoMatch") + WafStatementTypeIPSet = TWafStatementType("IPSet") + WafStatementTypeLabelMatch = TWafStatementType("LabelMatch") + WafStatementTypeManagedRuleGroup = TWafStatementType("ManagedRuleGroup") + WafStatementTypeRate = TWafStatementType("Rate") + WafStatementTypeRegexSet = TWafStatementType("RegexSet") + WafStatementTypeRuleGroup = TWafStatementType("RuleGroup") + WafStatementTypeSize = TWafStatementType("Size") + WafStatementTypeSqliMatch = TWafStatementType("SqliMatch") + WafStatementTypeXssMatch = TWafStatementType("XssMatch") + + WafStatementConditionAnd = TWafStatementCondition("And") + WafStatementConditionOr = TWafStatementCondition("Or") + WafStatementConditionNot = TWafStatementCondition("Not") + WafStatementConditionNone = TWafStatementCondition("") + + WafActionAllow = TWafAction("Allow") + WafActionBlock = TWafAction("Block") + WafActionLog = TWafAction("Log") + WafActionCount = TWafAction("Count") + WafActionAlert = TWafAction("Alert") + WafActionDetection = TWafAction("Detection") + WafActionPrevention = TWafAction("Prevention") + WafActionNone = TWafAction("") + + WafMatchFieldBody = TWafMatchField("Body") + WafMatchFieldJsonBody = TWafMatchField("JsonBody") + WafMatchFieldQuery = TWafMatchField("Query") + WafMatchFieldMethod = TWafMatchField("Method") + WafMatchFiledHeader = TWafMatchField("Header") + WafMatchFiledUriPath = TWafMatchField("UriPath") + WafMatchFiledPostArgs = TWafMatchField("PostArgs") + WafMatchFiledCookie = TWafMatchField("Cookie") + + // size + WafOperatorEQ = TWafOperator("EQ") + WafOperatorNE = TWafOperator("NE") + WafOperatorLE = TWafOperator("LE") + WafOperatorLT = TWafOperator("LT") + WafOperatorGE = TWafOperator("GE") + WafOperatorGT = TWafOperator("GT") + + // string + WafOperatorExactly = TWafOperator("Exactly") + WafOperatorStartsWith = TWafOperator("StartsWith") + WafOperatorEndsWith = TWafOperator("EndsWith") + WafOperatorContains = TWafOperator("Contains") + WafOperatorContainsWord = TWafOperator("ContainsWord") + WafOperatorRegex = TWafOperator("Regex") + + WafTextTransformationNone = TWafTextTransformation("") + WafTextTransformationCompressWithSpace = TWafTextTransformation("CompressWithSpace") + WafTextTransformationHtmlEntityDecode = TWafTextTransformation("HtmlEntityDecode") + WafTextTransformationLowercase = TWafTextTransformation("Lowercase") + WafTextTransformationCmdLine = TWafTextTransformation("CmdLine") + WafTextTransformationUrlDecode = TWafTextTransformation("UrlDecode") + + // azure + WafTextTransformationTrim = TWafTextTransformation("Trim") + WafTextTransformationUrlEncode = TWafTextTransformation("UrlEncode") + WafTextTransformationRemoveNulls = TWafTextTransformation("RemoveNulls") +) + +type TWafMatchFieldValues []string + +func (self TWafMatchFieldValues) IsZero() bool { + return len(self) == 0 +} + +func (self TWafMatchFieldValues) String() string { + return jsonutils.Marshal(self).String() +} + +type TextTransformations []TWafTextTransformation + +func (self TextTransformations) IsZero() bool { + return len(self) == 0 +} + +func (self TextTransformations) String() string { + return jsonutils.Marshal(self).String() +} + +type SExcludeRule struct { + Name string +} + +type SExcludeRules []SExcludeRule + +func (self SExcludeRules) IsZero() bool { + return len(self) == 0 +} + +func (self SExcludeRules) String() string { + return jsonutils.Marshal(self).String() +} + +type SWafRule struct { + Name string + Desc string + Action *DefaultAction + StatementCondition TWafStatementCondition + Priority int + Statements []SWafStatement +} + +type SWafStatement struct { + // 管理规则组名称 + ManagedRuleGroupName string `width:"64" charset:"utf8" nullable:"false" list:"user"` + // 不包含的规则列表 + ExcludeRules *SExcludeRules `width:"200" charset:"utf8" nullable:"false" list:"user"` + // 表达式类别 + // enmu: ByteMatch, GeoMatch, IPSet, LabelMatch, ManagedRuleGroup, Rate, RegexSet, RuleGroup, Size, SqliMatch, XssMatch + Type TWafStatementType `width:"20" charset:"ascii" nullable:"false" list:"user"` + // 是否取反操作, 仅对Azure生效 + Negation bool `nullable:"false" list:"user"` + // 操作类型 + // enum: EQ, NE, LE, LT, GE, GT + Operator TWafOperator `width:"20" charset:"ascii" nullable:"false" list:"user"` + // 匹配字段 + // enmu: Body, JsonBody, Query, Method, Header, UriPath, PostArgs, Cookie + MatchField TWafMatchField `width:"20" charset:"utf8" nullable:"false" list:"user"` + // 匹配字段的key + MatchFieldKey string `width:"20" charset:"utf8" nullable:"false" list:"user"` + // 匹配字段的值列表 + MatchFieldValues *TWafMatchFieldValues `width:"250" charset:"utf8" nullable:"false" list:"user"` + // 进行转换操作 + // enmu: CompressWithSpace, HtmlEntityDecode, Lowercase, CmdLine, UrlDecode, Trim, UrlEncode, RemoveNulls + Transformations *TextTransformations `width:"250" charset:"ascii" nullable:"false" list:"user"` + ForwardedIPHeader string `width:"20" charset:"ascii" nullable:"false" list:"user"` + // 搜索字段, 仅Aws有用 + SearchString string `width:"64" charset:"utf8" nullable:"false" list:"user"` + IPSetId string `width:"36" charset:"ascii" nullable:"false" list:"user"` + // 正则表达式Id, 目前只读 + RegexSetId string `width:"36" charset:"ascii" nullable:"false" list:"user"` + // 自定义规则组Id, 目前只读 + RuleGroupId string `width:"36" charset:"ascii" nullable:"false" list:"user"` + // 大小, 仅type=Size时必填 + Size *int64 `nullable:"false" list:"user"` + // 速率限制, 仅type=Rate时必填 + Limit *int64 `nullable:"false" list:"user"` +} + +func (self SWafStatement) GetGlobalId() string { + size, limit := int64(0), int64(0) + if self.Size != nil { + size = *self.Size + } + if self.Limit != nil { + limit = *self.Limit + } + return fmt.Sprintf("%s-%s-%s-%s-%s-%d-%d", + self.Type, + self.MatchField, + self.MatchFieldKey, + self.ManagedRuleGroupName, + self.SearchString, + size, + limit, + ) +} + +func (self SWafStatement) GetExternalId() string { + return self.GetGlobalId() +} + +type DefaultAction struct { + // Allow, Block, Log, Count, Alert, Detection, Prevention + Action TWafAction + + // 仅Action为Allow时生效 + InsertHeaders map[string]string + // 仅Action为Block时生效 + Response string + // 仅Action为Block时生效 + ResponseCode *int + // 仅Action为Block时生效 + ResponseHeaders map[string]string +} + +type WafSourceIps []string + +type WafRegexPatterns []string + +func (self WafRegexPatterns) IsZero() bool { + return len(self) == 0 +} + +func (self WafRegexPatterns) String() string { + return jsonutils.Marshal(self).String() +} + +type WafAddresses []string + +func (self WafAddresses) IsZero() bool { + return len(self) == 0 +} + +func (self WafAddresses) String() string { + return jsonutils.Marshal(self).String() +} + +func (self DefaultAction) IsZero() bool { + return false +} + +func (self DefaultAction) String() string { + return jsonutils.Marshal(self).String() +} + +type SCloudResource struct { + // 资源Id + Id string + // 资源类型 + Type string + // 资源映射端口 + Port int + // 是否可以解除关联 + CanDissociate bool +} + +type WafCreateOptions struct { + Name string + Desc string + CloudResources []SCloudResource + SourceIps WafSourceIps + Type TWafType + DefaultAction *DefaultAction +} + +func init() { + gotypes.RegisterSerializable(reflect.TypeOf(&DefaultAction{}), func() gotypes.ISerializable { + return &DefaultAction{} + }) + + gotypes.RegisterSerializable(reflect.TypeOf(&WafAddresses{}), func() gotypes.ISerializable { + return &WafAddresses{} + }) + + gotypes.RegisterSerializable(reflect.TypeOf(&TextTransformations{}), func() gotypes.ISerializable { + return &TextTransformations{} + }) + + gotypes.RegisterSerializable(reflect.TypeOf(&TWafMatchFieldValues{}), func() gotypes.ISerializable { + return &TWafMatchFieldValues{} + }) + + gotypes.RegisterSerializable(reflect.TypeOf(&SExcludeRules{}), func() gotypes.ISerializable { + return &SExcludeRules{} + }) + +} diff --git a/pkg/compute/models/capabilities.go b/pkg/compute/models/capabilities.go index e2d2a65e1f..f106d26d9e 100644 --- a/pkg/compute/models/capabilities.go +++ b/pkg/compute/models/capabilities.go @@ -55,6 +55,8 @@ type SCapabilities struct { DisabledNatBrands []string `json:",allowempty"` NasBrands []string `json:",allowempty"` DisabledNasBrands []string `json:",allowempty"` + WafBrands []string `json:",allowempty"` + DisabledWafBrands []string `json:",allowempty"` PublicIpBrands []string `json:",allowempty"` NetworkManageBrands []string `json:",allowempty"` DisabledNetworkManageBrands []string `json:",allowempty"` @@ -303,6 +305,7 @@ func getBrands(region *SCloudregion, zone *SZone, domainId string, capa *SCapabi capa.SamlAuthBrands, _ = CloudaccountManager.getBrandsOfCapability(region, zone, domainId, tristate.True, cloudprovider.CLOUD_CAPABILITY_SAML_AUTH) capa.NatBrands, _ = CloudaccountManager.getBrandsOfCapability(region, zone, domainId, tristate.True, cloudprovider.CLOUD_CAPABILITY_NAT) capa.NasBrands, _ = CloudaccountManager.getBrandsOfCapability(region, zone, domainId, tristate.True, cloudprovider.CLOUD_CAPABILITY_NAS) + capa.WafBrands, _ = CloudaccountManager.getBrandsOfCapability(region, zone, domainId, tristate.True, cloudprovider.CLOUD_CAPABILITY_WAF) if utils.IsInStringArray(api.HYPERVISOR_KVM, capa.Hypervisors) || utils.IsInStringArray(api.HYPERVISOR_BAREMETAL, capa.Hypervisors) { capa.Brands = append(capa.Brands, api.ONECLOUD_BRAND_ONECLOUD) @@ -324,6 +327,7 @@ func getBrands(region *SCloudregion, zone *SZone, domainId string, capa *SCapabi capa.DisabledSamlAuthBrands, _ = CloudaccountManager.getBrandsOfCapability(region, zone, domainId, tristate.False, cloudprovider.CLOUD_CAPABILITY_SAML_AUTH) capa.DisabledNatBrands, _ = CloudaccountManager.getBrandsOfCapability(region, zone, domainId, tristate.False, cloudprovider.CLOUD_CAPABILITY_NAT) capa.DisabledNasBrands, _ = CloudaccountManager.getBrandsOfCapability(region, zone, domainId, tristate.False, cloudprovider.CLOUD_CAPABILITY_NAS) + capa.DisabledNasBrands, _ = CloudaccountManager.getBrandsOfCapability(region, zone, domainId, tristate.False, cloudprovider.CLOUD_CAPABILITY_WAF) return } diff --git a/pkg/compute/models/cloudsync.go b/pkg/compute/models/cloudsync.go index 9da8a6f0b9..a9d08101a7 100644 --- a/pkg/compute/models/cloudsync.go +++ b/pkg/compute/models/cloudsync.go @@ -1101,6 +1101,91 @@ func syncDBInstanceAccountPrivileges(ctx context.Context, userCred mcclient.Toke return nil } +func syncWafIPSets(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, provider *SCloudprovider, localRegion *SCloudregion, remoteRegion cloudprovider.ICloudRegion) error { + ipSets, err := remoteRegion.GetICloudWafIPSets() + if err != nil { + msg := fmt.Sprintf("GetICloudWafIPSets for region %s failed %s", remoteRegion.GetName(), err) + log.Errorf(msg) + return err + } + result := localRegion.SyncWafIPSets(ctx, userCred, provider, ipSets) + syncResults.Add(WafIPSetManager, result) + log.Infof("SyncWafIPSets for region %s result: %s", localRegion.Name, result.Result()) + if result.IsError() { + return result.AllError() + } + return nil +} + +func syncWafRegexSets(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, provider *SCloudprovider, localRegion *SCloudregion, remoteRegion cloudprovider.ICloudRegion) error { + rSets, err := remoteRegion.GetICloudWafRegexSets() + if err != nil { + msg := fmt.Sprintf("GetICloudWafRegexSets for region %s failed %s", remoteRegion.GetName(), err) + log.Errorf(msg) + return err + } + result := localRegion.SyncWafRegexSets(ctx, userCred, provider, rSets) + syncResults.Add(WafRegexSetManager, result) + log.Infof("SyncWafRegexSets for region %s result: %s", localRegion.Name, result.Result()) + if result.IsError() { + return result.AllError() + } + return nil +} + +func syncWafInstances(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, provider *SCloudprovider, localRegion *SCloudregion, remoteRegion cloudprovider.ICloudRegion) error { + wafIns, err := remoteRegion.GetICloudWafInstances() + if err != nil { + msg := fmt.Sprintf("GetICloudWafInstances for region %s failed %s", remoteRegion.GetName(), err) + log.Errorf(msg) + return err + } + + localWafs, remoteWafs, result := localRegion.SyncWafInstances(ctx, userCred, provider, wafIns) + syncResults.Add(WafInstanceManager, result) + msg := result.Result() + log.Infof("SyncWafInstances for region %s result: %s", localRegion.Name, msg) + if result.IsError() { + return result.AllError() + } + + for i := 0; i < len(localWafs); i++ { + func() { + lockman.LockObject(ctx, &localWafs[i]) + defer lockman.ReleaseObject(ctx, &localWafs[i]) + + if localWafs[i].Deleted { + return + } + + err = syncWafRules(ctx, userCred, syncResults, &localWafs[i], remoteWafs[i]) + if err != nil { + log.Errorf("syncDBInstanceAccountPrivileges error: %v", err) + } + + }() + } + + return nil +} + +func syncWafRules(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, localWaf *SWafInstance, remoteWafs cloudprovider.ICloudWafInstance) error { + rules, err := remoteWafs.GetRules() + if err != nil { + msg := fmt.Sprintf("GetRules for waf instance %s failed %s", localWaf.Name, err) + log.Errorf(msg) + return err + } + result := localWaf.SyncWafRules(ctx, userCred, rules) + syncResults.Add(WafRuleManager, result) + msg := result.Result() + log.Infof("SyncWafRules for waf %s result: %s", localWaf.Name, msg) + if result.IsError() { + return result.AllError() + } + return nil +} + func syncRegionSnapshots(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, provider *SCloudprovider, localRegion *SCloudregion, remoteRegion cloudprovider.ICloudRegion, syncRange *SSyncRange) { snapshots, err := remoteRegion.GetISnapshots() if err != nil { @@ -1278,6 +1363,12 @@ func syncPublicCloudProviderInfo( syncAppGateways(ctx, userCred, syncResults, provider, localRegion, remoteRegion) + if utils.IsInStringArray(cloudprovider.CLOUD_CAPABILITY_WAF, driver.GetCapabilities()) { + syncWafIPSets(ctx, userCred, syncResults, provider, localRegion, remoteRegion) + syncWafRegexSets(ctx, userCred, syncResults, provider, localRegion, remoteRegion) + syncWafInstances(ctx, userCred, syncResults, provider, localRegion, remoteRegion) + } + if cloudprovider.IsSupportCompute(driver) { log.Debugf("storageCachePairs count %d", len(storageCachePairs)) for i := range storageCachePairs { diff --git a/pkg/compute/models/regiondrivers.go b/pkg/compute/models/regiondrivers.go index a4708a5ee6..1b1b199b61 100644 --- a/pkg/compute/models/regiondrivers.go +++ b/pkg/compute/models/regiondrivers.go @@ -178,6 +178,13 @@ type IDBInstanceDriver interface { IElasticIpDriver INasDriver + + IWafDriver +} + +type IWafDriver interface { + ValidateCreateWafInstanceData(ctx context.Context, userCred mcclient.TokenCredential, input api.WafInstanceCreateInput) (api.WafInstanceCreateInput, error) + ValidateCreateWafRuleData(ctx context.Context, userCred mcclient.TokenCredential, waf *SWafInstance, input api.WafRuleCreateInput) (api.WafRuleCreateInput, error) } type INasDriver interface { diff --git a/pkg/compute/models/skus_tools.go b/pkg/compute/models/skus_tools.go index cf3279bc3a..a3477c2a42 100644 --- a/pkg/compute/models/skus_tools.go +++ b/pkg/compute/models/skus_tools.go @@ -52,6 +52,7 @@ type SSkuResourcesMeta struct { ImageBase string `json:"image_base"` NatBase string `json:"nat_base"` NasBase string `json:"nas_base"` + WafBase string `json:"waf_base"` } var skuIndex = map[string]string{} @@ -351,6 +352,19 @@ func (self *SSkuResourcesMeta) getServerSkuIndex() (map[string]string, error) { return ret, nil } +func (self *SSkuResourcesMeta) getWafIndex() (map[string]string, error) { + resp, err := self.request(fmt.Sprintf("%s/index.json", self.WafBase)) + if err != nil { + return map[string]string{}, errors.Wrapf(err, "request") + } + ret := map[string]string{} + err = resp.Unmarshal(ret) + if err != nil { + return map[string]string{}, errors.Wrapf(err, "resp.Unmarshal") + } + return ret, nil +} + func (self *SSkuResourcesMeta) _get(url string) ([]jsonutils.JSONObject, error) { if !strings.HasPrefix(url, "http") { return nil, fmt.Errorf("SkuResourcesMeta.get invalid url %s.expected has prefix 'http'", url) @@ -523,6 +537,20 @@ func FetchSkuResourcesMeta() (*SSkuResourcesMeta, error) { return ret, nil } +func fetchCloudEnvs() ([]string, error) { + accounts := []SCloudaccount{} + q := CloudaccountManager.Query("provider", "access_url").In("provider", CloudproviderManager.GetPublicProviderProvidersQuery()).Distinct() + err := q.All(&accounts) + if err != nil { + return nil, errors.Wrapf(err, "q.All") + } + ret := []string{} + for i := range accounts { + ret = append(ret, apis.GetCloudEnv(accounts[i].Provider, accounts[i].AccessUrl)) + } + return ret, nil +} + func fetchSkuSyncCloudregions() []SCloudregion { cloudregions := []SCloudregion{} q := CloudregionManager.Query() @@ -535,3 +563,30 @@ func fetchSkuSyncCloudregions() []SCloudregion { return cloudregions } + +type sWafGroup struct { + SWafRuleGroup + Rules []SWafRule +} + +func (self sWafGroup) GetGlobalId() string { + return self.ExternalId +} + +func (self SWafRule) GetGlobalId() string { + return self.ExternalId +} + +func (self *SSkuResourcesMeta) getCloudWafGroups(cloudEnv string) ([]sWafGroup, error) { + url := fmt.Sprintf("%s/%s.json", self.WafBase, cloudEnv) + resp, err := self.request(url) + if err != nil { + return nil, errors.Wrapf(err, "_get(%s)", url) + } + ret := []sWafGroup{} + err = resp.Unmarshal(&ret) + if err != nil { + return nil, errors.Wrapf(err, "resp.Unmarshal") + } + return ret, nil +} diff --git a/pkg/compute/models/waf_instances.go b/pkg/compute/models/waf_instances.go new file mode 100644 index 0000000000..184c49221b --- /dev/null +++ b/pkg/compute/models/waf_instances.go @@ -0,0 +1,478 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + "fmt" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/util/compare" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/validators" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SWafInstanceManager struct { + db.SEnabledStatusInfrasResourceBaseManager + db.SExternalizedResourceBaseManager + SManagedResourceBaseManager + SCloudregionResourceBaseManager +} + +var WafInstanceManager *SWafInstanceManager + +func init() { + WafInstanceManager = &SWafInstanceManager{ + SEnabledStatusInfrasResourceBaseManager: db.NewEnabledStatusInfrasResourceBaseManager( + SWafInstance{}, + "waf_instances_tbl", + "waf_instance", + "waf_instances", + ), + } + WafInstanceManager.SetVirtualObject(WafInstanceManager) +} + +type SWafInstance struct { + db.SEnabledStatusInfrasResourceBase + db.SExternalizedResourceBase + + SManagedResourceBase + SCloudregionResourceBase + + Type cloudprovider.TWafType `width:"20" charset:"ascii" nullable:"false" list:"domain" create:"required"` + DefaultAction *cloudprovider.DefaultAction `charset:"ascii" nullable:"true" list:"domain" create:"domain_optional"` +} + +func (manager *SWafInstanceManager) GetContextManagers() [][]db.IModelManager { + return [][]db.IModelManager{ + {CloudregionManager}, + } +} + +func (manager *SWafInstanceManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, input api.WafInstanceCreateInput) (api.WafInstanceCreateInput, error) { + _region, err := validators.ValidateModel(userCred, CloudregionManager, &input.CloudregionId) + if err != nil { + return input, err + } + region := _region.(*SCloudregion) + _provider, err := validators.ValidateModel(userCred, CloudproviderManager, &input.CloudproviderId) + if err != nil { + return input, err + } + provider := _provider.(*SCloudprovider) + if !provider.IsAvailable() { + return input, httperrors.NewInputParameterError("cloudprovider %s not available", provider.Name) + } + for i := range input.CloudResources { + switch input.CloudResources[i].Type { + case LoadbalancerManager.Keyword(): + _lb, err := validators.ValidateModel(userCred, LoadbalancerManager, &input.CloudResources[i].Id) + if err != nil { + return input, err + } + lb := _lb.(*SLoadbalancer) + if lb.ManagerId != provider.GetId() { + return input, httperrors.NewConflictError("lb %s does not belong to account %s", lb.Name, provider.GetName()) + } + case GuestManager.Keyword(): + _server, err := validators.ValidateModel(userCred, GuestManager, &input.CloudResources[i].Id) + if err != nil { + return input, err + } + server := _server.(*SGuest) + host := server.GetHost() + if host.ManagerId != provider.GetId() { + return input, httperrors.NewConflictError("server %s does not belong to account %s", server.Name, provider.GetName()) + } + default: + return input, httperrors.NewInputParameterError("invalid %d resource type %s", i, input.CloudResources[i].Type) + } + } + + input, err = region.GetDriver().ValidateCreateWafInstanceData(ctx, userCred, input) + if err != nil { + return input, err + } + + input.SetEnabled() + input.EnabledStatusInfrasResourceBaseCreateInput, err = manager.SEnabledStatusInfrasResourceBaseManager.ValidateCreateData(ctx, userCred, ownerId, query, input.EnabledStatusInfrasResourceBaseCreateInput) + if err != nil { + return input, err + } + return input, nil +} + +func (self *SWafInstance) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) { + self.SEnabledStatusInfrasResourceBase.PostCreate(ctx, userCred, ownerId, query, data) + self.StartCreateTask(ctx, userCred, data.(*jsonutils.JSONDict)) +} + +func (self *SWafInstance) StartCreateTask(ctx context.Context, userCred mcclient.TokenCredential, params *jsonutils.JSONDict) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafCreateTask", self, userCred, params, "", "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_STATUS_CREATING, "") + return task.ScheduleRun(nil) +} + +func (manager *SWafInstanceManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.WafInstanceDetails { + rows := make([]api.WafInstanceDetails, len(objs)) + stdRows := manager.SEnabledStatusInfrasResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + managerRows := manager.SManagedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + regionRows := manager.SCloudregionResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + insIds := make([]string, len(objs)) + for i := range rows { + rows[i] = api.WafInstanceDetails{ + EnabledStatusInfrasResourceBaseDetails: stdRows[i], + ManagedResourceInfo: managerRows[i], + CloudregionResourceInfo: regionRows[i], + } + ins := objs[i].(*SWafInstance) + insIds[i] = ins.Id + } + type WafRule struct { + api.SWafRule + WafInstanceId string + } + rules := []WafRule{} + q := WafRuleManager.Query().In("waf_instance_id", insIds) + err := q.All(&rules) + if err != nil { + return rows + } + ruleMaps := map[string][]api.SWafRule{} + for _, rule := range rules { + _, ok := ruleMaps[rule.WafInstanceId] + if !ok { + ruleMaps[rule.WafInstanceId] = []api.SWafRule{} + } + ruleMaps[rule.WafInstanceId] = append(ruleMaps[rule.WafInstanceId], rule.SWafRule) + } + for i := range rows { + rows[i].Rules, _ = ruleMaps[insIds[i]] + } + return rows +} + +// 列出WAF实例 +func (manager *SWafInstanceManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafInstanceListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SEnabledStatusInfrasResourceBaseManager.ListItemFilter(ctx, q, userCred, query.EnabledStatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SEnabledStatusInfrasResourceBaseManager.ListItemFilter") + } + + q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SExternalizedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SManagedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SCloudregionResourceBaseManager.ListItemFilter(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemFilter") + } + return q, nil +} + +func (manager *SWafInstanceManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) { + var err error + q, err = manager.SEnabledStatusInfrasResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SManagedResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SCloudregionResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + return q, httperrors.ErrNotFound +} + +func (manager *SWafInstanceManager) OrderByExtraFields( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafInstanceListInput, +) (*sqlchemy.SQuery, error) { + q, err := manager.SEnabledStatusInfrasResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.EnabledStatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SEnabledStatusInfrasResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SManagedResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SCloudregionResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.OrderByExtraFields") + } + return q, nil +} + +func (manager *SWafInstanceManager) ListItemExportKeys(ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + keys stringutils2.SSortedStrings, +) (*sqlchemy.SQuery, error) { + q, err := manager.SEnabledStatusInfrasResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SEnabledStatusInfrasResourceBaseManager.ListItemExportKeys") + } + if keys.ContainsAny(manager.SCloudregionResourceBaseManager.GetExportKeys()...) { + q, err = manager.SCloudregionResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemExportKeys") + } + } + if keys.ContainsAny(manager.SManagedResourceBaseManager.GetExportKeys()...) { + q, err = manager.SManagedResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemExportKeys") + } + } + return q, nil +} + +func (self *SCloudregion) GetWafInstances(managerId string) ([]SWafInstance, error) { + q := WafInstanceManager.Query().Equals("cloudregion_id", self.Id) + if len(managerId) > 0 { + q = q.Equals("manager_id", managerId) + } + wafs := []SWafInstance{} + err := db.FetchModelObjects(WafInstanceManager, q, &wafs) + return wafs, err +} + +func (self *SCloudregion) SyncWafInstances(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, exts []cloudprovider.ICloudWafInstance) ([]SWafInstance, []cloudprovider.ICloudWafInstance, compare.SyncResult) { + lockman.LockRawObject(ctx, WafInstanceManager.Keyword(), fmt.Sprintf("%s-%s", self.Id, provider.Id)) + defer lockman.ReleaseRawObject(ctx, WafInstanceManager.Keyword(), fmt.Sprintf("%s-%s", self.Id, provider.Id)) + + result := compare.SyncResult{} + + localWafs := []SWafInstance{} + remoteWafs := []cloudprovider.ICloudWafInstance{} + + dbWafs, err := self.GetWafInstances(provider.Id) + if err != nil { + result.Error(err) + return nil, nil, result + } + + removed := make([]SWafInstance, 0) + commondb := make([]SWafInstance, 0) + commonext := make([]cloudprovider.ICloudWafInstance, 0) + added := make([]cloudprovider.ICloudWafInstance, 0) + if err := compare.CompareSets(dbWafs, exts, &removed, &commondb, &commonext, &added); err != nil { + result.Error(err) + return nil, nil, result + } + + for i := 0; i < len(removed); i++ { + err := removed[i].syncRemove(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + + for i := 0; i < len(commondb); i++ { + err := commondb[i].SyncWithCloudWafInstance(ctx, userCred, commonext[i]) + if err != nil { + result.UpdateError(err) + continue + } + syncMetadata(ctx, userCred, &commondb[i], commonext[i]) + localWafs = append(localWafs, commondb[i]) + remoteWafs = append(remoteWafs, commonext[i]) + result.Update() + } + + for i := 0; i < len(added); i++ { + newWaf, err := self.newFromCloudWafInstance(ctx, userCred, provider, added[i]) + if err != nil { + result.AddError(err) + continue + } + syncMetadata(ctx, userCred, newWaf, added[i]) + localWafs = append(localWafs, *newWaf) + remoteWafs = append(remoteWafs, added[i]) + result.Add() + } + + return localWafs, remoteWafs, result +} + +func (self *SWafInstance) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { + return self.StartDeleteTask(ctx, userCred) +} + +func (self *SWafInstance) StartDeleteTask(ctx context.Context, userCred mcclient.TokenCredential) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafDeleteTask", self, userCred, nil, "", "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_STATUS_DELETING, "") + return task.ScheduleRun(nil) +} + +func (self *SWafInstance) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SWafInstance) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + rules, err := self.GetWafRules() + if err != nil { + return errors.Wrapf(err, "GetWafRules") + } + for i := range rules { + err = rules[i].RealDelete(ctx, userCred) + if err != nil { + return errors.Wrapf(err, "Delete Rule %s", rules[i].Name) + } + } + return self.SEnabledStatusInfrasResourceBase.Delete(ctx, userCred) +} + +func (self *SWafInstance) syncRemove(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.RealDelete(ctx, userCred) +} + +func (self *SWafInstance) GetRegion() (*SCloudregion, error) { + region, err := CloudregionManager.FetchById(self.CloudregionId) + if err != nil { + return nil, errors.Wrapf(err, "CloudregionManager.FetchById") + } + return region.(*SCloudregion), nil +} + +func (self *SWafInstance) GetIRegion() (cloudprovider.ICloudRegion, error) { + region, err := self.GetRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetRegion") + } + provider, err := self.GetDriver() + if err != nil { + return nil, errors.Wrapf(err, "GetDriver") + } + return provider.GetIRegionById(region.ExternalId) +} + +func (self *SWafInstance) GetICloudWafInstance() (cloudprovider.ICloudWafInstance, error) { + if len(self.ExternalId) == 0 { + return nil, errors.Wrapf(cloudprovider.ErrNotFound, "empty external id") + } + iRegion, err := self.GetIRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetIRegion") + } + return iRegion.GetICloudWafInstanceById(self.ExternalId) +} + +func (self *SWafInstance) SyncWithCloudWafInstance(ctx context.Context, userCred mcclient.TokenCredential, ext cloudprovider.ICloudWafInstance) error { + _, err := db.Update(self, func() error { + self.ExternalId = ext.GetGlobalId() + self.SetEnabled(ext.GetEnabled()) + self.DefaultAction = ext.GetDefaultAction() + self.Status = ext.GetStatus() + return nil + }) + return err +} + +func (self *SCloudregion) newFromCloudWafInstance(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudWafInstance) (*SWafInstance, error) { + waf := &SWafInstance{} + waf.SetModelManager(WafInstanceManager, waf) + waf.SetEnabled(ext.GetEnabled()) + waf.CloudregionId = self.Id + waf.ManagerId = provider.Id + waf.Status = ext.GetStatus() + waf.DefaultAction = ext.GetDefaultAction() + waf.Type = ext.GetWafType() + waf.ExternalId = ext.GetGlobalId() + var err = func() error { + lockman.LockRawObject(ctx, WafInstanceManager.Keyword(), "name") + defer lockman.ReleaseRawObject(ctx, WafInstanceManager.Keyword(), "name") + + var err error + waf.Name, err = db.GenerateName(ctx, WafInstanceManager, userCred, ext.GetName()) + if err != nil { + return errors.Wrapf(err, "db.GenerateName") + } + + return WafInstanceManager.TableSpec().Insert(ctx, waf) + }() + if err != nil { + return nil, err + } + return waf, nil +} + +func (self *SWafInstance) AllowGetDetailsCloudResources(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsDomainAllowGetSpec(userCred, self, "cloud-resources") +} + +// 获取WAF绑定的资源列表 +func (self *SWafInstance) GetDetailsCloudResources(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) ([]cloudprovider.SCloudResource, error) { + iWaf, err := self.GetICloudWafInstance() + if err != nil { + return nil, httperrors.NewGeneralError(errors.Wrapf(err, "GetICloudWafInstance")) + } + return iWaf.GetCloudResources() +} + +func (self *SWafInstance) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "syncstatus") +} + +// 同步WAF状态 +func (self *SWafInstance) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, input api.WafSyncstatusInput) (jsonutils.JSONObject, error) { + return nil, StartResourceSyncStatusTask(ctx, userCred, self, "WafSyncstatusTask", "") +} diff --git a/pkg/compute/models/waf_ipset_caches.go b/pkg/compute/models/waf_ipset_caches.go new file mode 100644 index 0000000000..1aad5f3943 --- /dev/null +++ b/pkg/compute/models/waf_ipset_caches.go @@ -0,0 +1,367 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + "fmt" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/util/compare" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SWafIPSetCacheManager struct { + db.SStatusStandaloneResourceBaseManager + db.SExternalizedResourceBaseManager + SManagedResourceBaseManager + SCloudregionResourceBaseManager +} + +var WafIPSetCacheManager *SWafIPSetCacheManager + +func init() { + WafIPSetCacheManager = &SWafIPSetCacheManager{ + SStatusStandaloneResourceBaseManager: db.NewStatusStandaloneResourceBaseManager( + SWafIPSetCache{}, + "waf_ipset_caches_tbl", + "waf_ipset_cache", + "waf_ipset_caches", + ), + } + WafIPSetCacheManager.SetVirtualObject(WafIPSetCacheManager) +} + +type SWafIPSetCache struct { + db.SStatusStandaloneResourceBase + db.SExternalizedResourceBase + + SManagedResourceBase + SCloudregionResourceBase + + Type cloudprovider.TWafType `width:"20" charset:"utf8" nullable:"false" list:"user"` + WafIPSetId string `width:"36" charset:"ascii" nullable:"false" list:"user"` +} + +func (manager *SWafIPSetCacheManager) GetContextManagers() [][]db.IModelManager { + return [][]db.IModelManager{ + {CloudregionManager}, + } +} + +func (manager *SWafIPSetCacheManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.WafIPSetCacheDetails { + rows := make([]api.WafIPSetCacheDetails, len(objs)) + ssRows := manager.SStatusStandaloneResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + managerRows := manager.SManagedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + regionRows := manager.SCloudregionResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + for i := range rows { + rows[i] = api.WafIPSetCacheDetails{ + StatusStandaloneResourceDetails: ssRows[i], + ManagedResourceInfo: managerRows[i], + CloudregionResourceInfo: regionRows[i], + } + } + return rows +} + +// 列出WAF IPSet缓存 +func (manager *SWafIPSetCacheManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafIPSetCacheListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SStatusStandaloneResourceBaseManager.ListItemFilter(ctx, q, userCred, query.StatusStandaloneResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBase.ListItemFilter") + } + + q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SExternalizedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SManagedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SCloudregionResourceBaseManager.ListItemFilter(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemFilter") + } + return q, nil +} + +func (manager *SWafIPSetCacheManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) { + var err error + q, err = manager.SStatusStandaloneResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SManagedResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SCloudregionResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + return q, httperrors.ErrNotFound +} + +func (manager *SWafIPSetCacheManager) OrderByExtraFields( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafIPSetCacheListInput, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusStandaloneResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.StatusStandaloneResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SManagedResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SCloudregionResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.OrderByExtraFields") + } + return q, nil +} + +func (manager *SWafIPSetCacheManager) ListItemExportKeys(ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + keys stringutils2.SSortedStrings, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusStandaloneResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBaseManager.ListItemExportKeys") + } + if keys.ContainsAny(manager.SCloudregionResourceBaseManager.GetExportKeys()...) { + q, err = manager.SCloudregionResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemExportKeys") + } + } + if keys.ContainsAny(manager.SManagedResourceBaseManager.GetExportKeys()...) { + q, err = manager.SManagedResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemExportKeys") + } + } + return q, nil +} + +func (self *SWafIPSetCache) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SWafIPSetCache) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.SStatusStandaloneResourceBase.Delete(ctx, userCred) +} + +func (self *SWafIPSetCache) syncRemove(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.RealDelete(ctx, userCred) +} + +func (self *SWafIPSetCache) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { + return self.StartDeleteTask(ctx, userCred, "") +} + +func (self *SWafIPSetCache) StartDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafIPSetCacheDeleteTask", self, userCred, nil, parentTaskId, "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_IPSET_STATUS_DELETING, "") + return task.ScheduleRun(nil) +} + +func (self *SWafIPSetCache) GetRegion() (*SCloudregion, error) { + region, err := CloudregionManager.FetchById(self.CloudregionId) + if err != nil { + return nil, errors.Wrapf(err, "CloudregionManager.FetchById") + } + return region.(*SCloudregion), nil +} + +func (self *SWafIPSetCache) GetIRegion() (cloudprovider.ICloudRegion, error) { + region, err := self.GetRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetRegion") + } + provider, err := self.GetDriver() + if err != nil { + return nil, errors.Wrapf(err, "GetDriver") + } + return provider.GetIRegionById(region.ExternalId) +} + +func (self *SWafIPSetCache) GetICloudWafIPSet() (cloudprovider.ICloudWafIPSet, error) { + if len(self.ExternalId) == 0 { + return nil, errors.Wrapf(cloudprovider.ErrNotFound, "empty external id") + } + iRegion, err := self.GetIRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetIRegion") + } + caches, err := iRegion.GetICloudWafIPSets() + if err != nil { + return nil, errors.Wrapf(err, "GetICloudWafIPSets") + } + for i := range caches { + if caches[i].GetGlobalId() == self.ExternalId { + return caches[i], nil + } + } + return nil, errors.Wrapf(cloudprovider.ErrNotFound, self.ExternalId) +} + +func (self *SWafIPSetCache) syncWithCloudIPSet(ctx context.Context, userCred mcclient.TokenCredential, ext cloudprovider.ICloudWafIPSet) error { + _, err := db.Update(self, func() error { + self.Status = api.WAF_IPSET_STATUS_AVAILABLE + self.Name = ext.GetName() + self.Description = ext.GetDesc() + return nil + }) + return err +} + +func (self *SCloudregion) GetIPSets(managerId string) ([]SWafIPSetCache, error) { + q := WafIPSetCacheManager.Query().Equals("cloudregion_id", self.Id) + if len(managerId) > 0 { + q = q.Equals("manager_id", managerId) + } + caches := []SWafIPSetCache{} + err := db.FetchModelObjects(WafIPSetCacheManager, q, &caches) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchModelObjects") + } + return caches, nil +} + +func (self *SCloudregion) findOrCreateWafIPSet(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudWafIPSet) (*SWafIPSet, error) { + q := WafIPSetManager.Query().Equals("domain_id", provider.DomainId).Equals("addresses", ext.GetAddresses().String()) + ipSets := []SWafIPSet{} + err := db.FetchModelObjects(WafIPSetManager, q, &ipSets) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchModelObjects") + } + if len(ipSets) > 0 { + return &ipSets[0], nil + } + ipSet := &SWafIPSet{} + ipSet.SetModelManager(WafIPSetManager, ipSet) + ipSet.Name = ext.GetName() + ipSet.Status = api.WAF_IPSET_STATUS_AVAILABLE + ipSet.DomainId = provider.DomainId + addrs := ext.GetAddresses() + ipSet.Addresses = &addrs + return ipSet, WafIPSetManager.TableSpec().Insert(ctx, ipSet) +} + +func (self *SCloudregion) newFromCloudWafIPSet(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudWafIPSet, ipSetId string) error { + cache := &SWafIPSetCache{} + cache.SetModelManager(WafIPSetCacheManager, cache) + cache.Name = ext.GetName() + cache.WafIPSetId = ipSetId + cache.CloudregionId = self.Id + cache.ManagerId = provider.Id + cache.ExternalId = ext.GetGlobalId() + cache.Status = api.WAF_IPSET_STATUS_AVAILABLE + cache.Type = ext.GetType() + cache.Description = ext.GetDesc() + return WafIPSetCacheManager.TableSpec().Insert(ctx, cache) +} + +func (self *SCloudregion) SyncWafIPSets(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, exts []cloudprovider.ICloudWafIPSet) compare.SyncResult { + lockman.LockRawObject(ctx, WafIPSetCacheManager.Keyword(), fmt.Sprintf("%s-%s", self.Id, provider.Id)) + defer lockman.ReleaseRawObject(ctx, WafIPSetCacheManager.Keyword(), fmt.Sprintf("%s-%s", self.Id, provider.Id)) + + result := compare.SyncResult{} + + dbIPSets, err := self.GetIPSets(provider.Id) + if err != nil { + result.Error(err) + return result + } + + removed := make([]SWafIPSetCache, 0) + commondb := make([]SWafIPSetCache, 0) + commonext := make([]cloudprovider.ICloudWafIPSet, 0) + added := make([]cloudprovider.ICloudWafIPSet, 0) + err = compare.CompareSets(dbIPSets, exts, &removed, &commondb, &commonext, &added) + if err != nil { + result.Error(err) + return result + } + + for i := 0; i < len(removed); i++ { + err := removed[i].syncRemove(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + + for i := 0; i < len(commondb); i++ { + err := commondb[i].syncWithCloudIPSet(ctx, userCred, commonext[i]) + if err != nil { + result.UpdateError(err) + continue + } + result.Update() + } + + for i := 0; i < len(added); i++ { + ipSet, err := self.findOrCreateWafIPSet(ctx, userCred, provider, added[i]) + if err != nil { + result.AddError(err) + continue + } + err = self.newFromCloudWafIPSet(ctx, userCred, provider, added[i], ipSet.Id) + if err != nil { + result.AddError(err) + continue + } + result.Add() + } + return result +} diff --git a/pkg/compute/models/waf_ipsets.go b/pkg/compute/models/waf_ipsets.go new file mode 100644 index 0000000000..a5ebb61827 --- /dev/null +++ b/pkg/compute/models/waf_ipsets.go @@ -0,0 +1,151 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SWafIPSetManager struct { + db.SStatusInfrasResourceBaseManager +} + +var WafIPSetManager *SWafIPSetManager + +func init() { + WafIPSetManager = &SWafIPSetManager{ + SStatusInfrasResourceBaseManager: db.NewStatusInfrasResourceBaseManager( + SWafIPSet{}, + "waf_ipsets_tbl", + "waf_ipset", + "waf_ipsets", + ), + } + WafIPSetManager.SetVirtualObject(WafIPSetManager) +} + +type SWafIPSet struct { + db.SStatusInfrasResourceBase + + Addresses *cloudprovider.WafAddresses `list:"domain" update:"domain" create:"required"` +} + +func (manager *SWafIPSetManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.WafIPSetDetails { + rows := make([]api.WafIPSetDetails, len(objs)) + siRows := manager.SStatusInfrasResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + for i := range rows { + rows[i] = api.WafIPSetDetails{ + StatusInfrasResourceBaseDetails: siRows[i], + } + } + return rows +} + +// 列出WAF IPSets +func (manager *SWafIPSetManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafIPSetListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SStatusInfrasResourceBaseManager.ListItemFilter(ctx, q, userCred, query.StatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.ListItemFilter") + } + return q, nil +} + +func (manager *SWafIPSetManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) { + var err error + q, err = manager.SStatusInfrasResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + return q, httperrors.ErrNotFound +} + +func (manager *SWafIPSetManager) OrderByExtraFields( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafIPSetListInput, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusInfrasResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.StatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.OrderByExtraFields") + } + return q, nil +} + +func (manager *SWafIPSetManager) ListItemExportKeys(ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + keys stringutils2.SSortedStrings, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusInfrasResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.ListItemExportKeys") + } + return q, nil +} + +func (self *SWafIPSet) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SWafIPSet) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.SStatusInfrasResourceBase.Delete(ctx, userCred) +} + +func (self *SWafIPSet) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { + return self.StartDeleteTask(ctx, userCred, "") +} + +func (self *SWafIPSet) StartDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafIPSetDeleteTask", self, userCred, nil, parentTaskId, "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_IPSET_STATUS_DELETING, "") + return task.ScheduleRun(nil) +} + +func (self *SWafIPSet) GetCaches() ([]SWafIPSetCache, error) { + q := WafIPSetCacheManager.Query().Equals("waf_ipset_id", self.Id) + caches := []SWafIPSetCache{} + err := db.FetchModelObjects(WafIPSetCacheManager, q, &caches) + return caches, err +} diff --git a/pkg/compute/models/waf_regexset_caches.go b/pkg/compute/models/waf_regexset_caches.go new file mode 100644 index 0000000000..5cf654d80f --- /dev/null +++ b/pkg/compute/models/waf_regexset_caches.go @@ -0,0 +1,367 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + "fmt" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/util/compare" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SWafRegexSetCacheManager struct { + db.SStatusStandaloneResourceBaseManager + db.SExternalizedResourceBaseManager + SManagedResourceBaseManager + SCloudregionResourceBaseManager +} + +var WafRegexSetCacheManager *SWafRegexSetCacheManager + +func init() { + WafRegexSetCacheManager = &SWafRegexSetCacheManager{ + SStatusStandaloneResourceBaseManager: db.NewStatusStandaloneResourceBaseManager( + SWafRegexSetCache{}, + "waf_regexset_caches_tbl", + "waf_regexset_cache", + "waf_regexset_caches", + ), + } + WafRegexSetCacheManager.SetVirtualObject(WafRegexSetCacheManager) +} + +type SWafRegexSetCache struct { + db.SStatusStandaloneResourceBase + db.SExternalizedResourceBase + + SManagedResourceBase + SCloudregionResourceBase + + Type cloudprovider.TWafType `width:"20" charset:"utf8" nullable:"false" list:"user"` + WafRegexSetId string `width:"36" charset:"ascii" nullable:"false" list:"user"` +} + +func (manager *SWafRegexSetCacheManager) GetContextManagers() [][]db.IModelManager { + return [][]db.IModelManager{ + {CloudregionManager}, + } +} + +func (manager *SWafRegexSetCacheManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.WafRegexSetCacheDetails { + rows := make([]api.WafRegexSetCacheDetails, len(objs)) + ssRows := manager.SStatusStandaloneResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + managerRows := manager.SManagedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + regionRows := manager.SCloudregionResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + for i := range rows { + rows[i] = api.WafRegexSetCacheDetails{ + StatusStandaloneResourceDetails: ssRows[i], + ManagedResourceInfo: managerRows[i], + CloudregionResourceInfo: regionRows[i], + } + } + return rows +} + +// 列出WAF RegexSet缓存 +func (manager *SWafRegexSetCacheManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRegexSetCacheListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SStatusStandaloneResourceBaseManager.ListItemFilter(ctx, q, userCred, query.StatusStandaloneResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBase.ListItemFilter") + } + + q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SExternalizedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SManagedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SCloudregionResourceBaseManager.ListItemFilter(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemFilter") + } + return q, nil +} + +func (manager *SWafRegexSetCacheManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) { + var err error + q, err = manager.SStatusStandaloneResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SManagedResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SCloudregionResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + return q, httperrors.ErrNotFound +} + +func (manager *SWafRegexSetCacheManager) OrderByExtraFields( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRegexSetCacheListInput, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusStandaloneResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.StatusStandaloneResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SManagedResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SCloudregionResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.OrderByExtraFields") + } + return q, nil +} + +func (manager *SWafRegexSetCacheManager) ListItemExportKeys(ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + keys stringutils2.SSortedStrings, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusStandaloneResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBaseManager.ListItemExportKeys") + } + if keys.ContainsAny(manager.SCloudregionResourceBaseManager.GetExportKeys()...) { + q, err = manager.SCloudregionResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemExportKeys") + } + } + if keys.ContainsAny(manager.SManagedResourceBaseManager.GetExportKeys()...) { + q, err = manager.SManagedResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemExportKeys") + } + } + return q, nil +} + +func (self *SWafRegexSetCache) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SWafRegexSetCache) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.SStatusStandaloneResourceBase.Delete(ctx, userCred) +} + +func (self *SWafRegexSetCache) syncRemove(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.RealDelete(ctx, userCred) +} + +func (self *SWafRegexSetCache) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { + return self.StartDeleteTask(ctx, userCred, "") +} + +func (self *SWafRegexSetCache) StartDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafRegexSetCacheDeleteTask", self, userCred, nil, parentTaskId, "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_REGEX_SET_STATUS_DELETING, "") + return task.ScheduleRun(nil) +} + +func (self *SWafRegexSetCache) GetRegion() (*SCloudregion, error) { + region, err := CloudregionManager.FetchById(self.CloudregionId) + if err != nil { + return nil, errors.Wrapf(err, "CloudregionManager.FetchById") + } + return region.(*SCloudregion), nil +} + +func (self *SWafRegexSetCache) GetIRegion() (cloudprovider.ICloudRegion, error) { + region, err := self.GetRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetRegion") + } + provider, err := self.GetDriver() + if err != nil { + return nil, errors.Wrapf(err, "GetDriver") + } + return provider.GetIRegionById(region.ExternalId) +} + +func (self *SWafRegexSetCache) GetICloudWafRegexSet() (cloudprovider.ICloudWafRegexSet, error) { + if len(self.ExternalId) == 0 { + return nil, errors.Wrapf(cloudprovider.ErrNotFound, "empty external id") + } + iRegion, err := self.GetIRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetIRegion") + } + caches, err := iRegion.GetICloudWafRegexSets() + if err != nil { + return nil, errors.Wrapf(err, "GetICloudWafRegexSets") + } + for i := range caches { + if caches[i].GetGlobalId() == self.ExternalId { + return caches[i], nil + } + } + return nil, errors.Wrapf(cloudprovider.ErrNotFound, self.ExternalId) +} + +func (self *SWafRegexSetCache) syncWithCloudRegexSet(ctx context.Context, userCred mcclient.TokenCredential, ext cloudprovider.ICloudWafRegexSet) error { + _, err := db.Update(self, func() error { + self.Status = api.WAF_IPSET_STATUS_AVAILABLE + self.Name = ext.GetName() + self.Description = ext.GetDesc() + return nil + }) + return err +} + +func (self *SCloudregion) GetRegexSets(managerId string) ([]SWafRegexSetCache, error) { + q := WafRegexSetCacheManager.Query().Equals("cloudregion_id", self.Id) + if len(managerId) > 0 { + q = q.Equals("manager_id", managerId) + } + caches := []SWafRegexSetCache{} + err := db.FetchModelObjects(WafRegexSetCacheManager, q, &caches) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchModelObjects") + } + return caches, nil +} + +func (self *SCloudregion) findOrCreateWafRegexSet(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudWafRegexSet) (*SWafRegexSet, error) { + q := WafRegexSetManager.Query().Equals("domain_id", provider.DomainId).Equals("regex_patterns", ext.GetRegexPatterns().String()) + patternSets := []SWafRegexSet{} + err := db.FetchModelObjects(WafRegexSetManager, q, &patternSets) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchModelObjects") + } + if len(patternSets) > 0 { + return &patternSets[0], nil + } + ps := &SWafRegexSet{} + ps.SetModelManager(WafRegexSetManager, ps) + ps.Name = ext.GetName() + ps.Status = api.WAF_IPSET_STATUS_AVAILABLE + ps.DomainId = provider.DomainId + patterns := ext.GetRegexPatterns() + ps.RegexPatterns = &patterns + return ps, WafRegexSetManager.TableSpec().Insert(ctx, ps) +} + +func (self *SCloudregion) newFromCloudWafRegexSet(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudWafRegexSet, ipSetId string) error { + cache := &SWafRegexSetCache{} + cache.SetModelManager(WafRegexSetCacheManager, cache) + cache.Name = ext.GetName() + cache.WafRegexSetId = ipSetId + cache.CloudregionId = self.Id + cache.ManagerId = provider.Id + cache.ExternalId = ext.GetGlobalId() + cache.Status = api.WAF_IPSET_STATUS_AVAILABLE + cache.Type = ext.GetType() + cache.Description = ext.GetDesc() + return WafRegexSetCacheManager.TableSpec().Insert(ctx, cache) +} + +func (self *SCloudregion) SyncWafRegexSets(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, exts []cloudprovider.ICloudWafRegexSet) compare.SyncResult { + lockman.LockRawObject(ctx, WafRegexSetCacheManager.Keyword(), fmt.Sprintf("%s-%s", self.Id, provider.Id)) + defer lockman.ReleaseRawObject(ctx, WafRegexSetCacheManager.Keyword(), fmt.Sprintf("%s-%s", self.Id, provider.Id)) + + result := compare.SyncResult{} + + dbRegexSets, err := self.GetRegexSets(provider.Id) + if err != nil { + result.Error(err) + return result + } + + removed := make([]SWafRegexSetCache, 0) + commondb := make([]SWafRegexSetCache, 0) + commonext := make([]cloudprovider.ICloudWafRegexSet, 0) + added := make([]cloudprovider.ICloudWafRegexSet, 0) + err = compare.CompareSets(dbRegexSets, exts, &removed, &commondb, &commonext, &added) + if err != nil { + result.Error(err) + return result + } + + for i := 0; i < len(removed); i++ { + err := removed[i].syncRemove(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + + for i := 0; i < len(commondb); i++ { + err := commondb[i].syncWithCloudRegexSet(ctx, userCred, commonext[i]) + if err != nil { + result.UpdateError(err) + continue + } + result.Update() + } + + for i := 0; i < len(added); i++ { + ipSet, err := self.findOrCreateWafRegexSet(ctx, userCred, provider, added[i]) + if err != nil { + result.AddError(err) + continue + } + err = self.newFromCloudWafRegexSet(ctx, userCred, provider, added[i], ipSet.Id) + if err != nil { + result.AddError(err) + continue + } + result.Add() + } + return result +} diff --git a/pkg/compute/models/waf_regexsets.go b/pkg/compute/models/waf_regexsets.go new file mode 100644 index 0000000000..b55132da24 --- /dev/null +++ b/pkg/compute/models/waf_regexsets.go @@ -0,0 +1,151 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SWafRegexSetManager struct { + db.SStatusInfrasResourceBaseManager +} + +var WafRegexSetManager *SWafRegexSetManager + +func init() { + WafRegexSetManager = &SWafRegexSetManager{ + SStatusInfrasResourceBaseManager: db.NewStatusInfrasResourceBaseManager( + SWafRegexSet{}, + "waf_regexsets_tbl", + "waf_regexset", + "waf_regexsets", + ), + } + WafRegexSetManager.SetVirtualObject(WafRegexSetManager) +} + +type SWafRegexSet struct { + db.SStatusInfrasResourceBase + + RegexPatterns *cloudprovider.WafRegexPatterns `list:"domain" update:"domain" create:"required"` +} + +func (manager *SWafRegexSetManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.WafRegexSetDetails { + rows := make([]api.WafRegexSetDetails, len(objs)) + siRows := manager.SStatusInfrasResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + for i := range rows { + rows[i] = api.WafRegexSetDetails{ + StatusInfrasResourceBaseDetails: siRows[i], + } + } + return rows +} + +// 列出WAF RegexSets +func (manager *SWafRegexSetManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRegexSetListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SStatusInfrasResourceBaseManager.ListItemFilter(ctx, q, userCred, query.StatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.ListItemFilter") + } + return q, nil +} + +func (manager *SWafRegexSetManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) { + var err error + q, err = manager.SStatusInfrasResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + return q, httperrors.ErrNotFound +} + +func (manager *SWafRegexSetManager) OrderByExtraFields( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRegexSetListInput, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusInfrasResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.StatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.OrderByExtraFields") + } + return q, nil +} + +func (manager *SWafRegexSetManager) ListItemExportKeys(ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + keys stringutils2.SSortedStrings, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusInfrasResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.ListItemExportKeys") + } + return q, nil +} + +func (self *SWafRegexSet) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SWafRegexSet) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.SStatusInfrasResourceBase.Delete(ctx, userCred) +} + +func (self *SWafRegexSet) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { + return self.StartDeleteTask(ctx, userCred, "") +} + +func (self *SWafRegexSet) StartDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafRegexSetDeleteTask", self, userCred, nil, parentTaskId, "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_REGEX_SET_STATUS_DELETING, "") + return task.ScheduleRun(nil) +} + +func (self *SWafRegexSet) GetCaches() ([]SWafRegexSetCache, error) { + q := WafRegexSetCacheManager.Query().Equals("waf_regexset_id", self.Id) + caches := []SWafRegexSetCache{} + err := db.FetchModelObjects(WafRegexSetCacheManager, q, &caches) + return caches, err +} diff --git a/pkg/compute/models/waf_rule_group_caches.go b/pkg/compute/models/waf_rule_group_caches.go new file mode 100644 index 0000000000..0d19f0115c --- /dev/null +++ b/pkg/compute/models/waf_rule_group_caches.go @@ -0,0 +1,367 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + "fmt" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/util/compare" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SWafRuleGroupCacheManager struct { + db.SStatusStandaloneResourceBaseManager + db.SExternalizedResourceBaseManager + SManagedResourceBaseManager + SCloudregionResourceBaseManager +} + +var WafRuleGroupCacheManager *SWafRuleGroupCacheManager + +func init() { + WafRuleGroupCacheManager = &SWafRuleGroupCacheManager{ + SStatusStandaloneResourceBaseManager: db.NewStatusStandaloneResourceBaseManager( + SWafRuleGroupCache{}, + "waf_rule_group_caches_tbl", + "waf_rule_group_cache", + "waf_rule_group_caches", + ), + } + WafRuleGroupCacheManager.SetVirtualObject(WafRuleGroupCacheManager) +} + +type SWafRuleGroupCache struct { + db.SStatusStandaloneResourceBase + db.SExternalizedResourceBase + + SManagedResourceBase + SCloudregionResourceBase + + Type cloudprovider.TWafType `width:"20" charset:"utf8" nullable:"false" list:"user"` + WafRuleGroupId string `width:"36" charset:"ascii" nullable:"false" list:"user"` +} + +func (manager *SWafRuleGroupCacheManager) GetContextManagers() [][]db.IModelManager { + return [][]db.IModelManager{ + {CloudregionManager}, + } +} + +func (manager *SWafRuleGroupCacheManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.WafRuleGroupCacheDetails { + rows := make([]api.WafRuleGroupCacheDetails, len(objs)) + ssRows := manager.SStatusStandaloneResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + managerRows := manager.SManagedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + regionRows := manager.SCloudregionResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + for i := range rows { + rows[i] = api.WafRuleGroupCacheDetails{ + StatusStandaloneResourceDetails: ssRows[i], + ManagedResourceInfo: managerRows[i], + CloudregionResourceInfo: regionRows[i], + } + } + return rows +} + +// 列出WAF RuleGroup缓存 +func (manager *SWafRuleGroupCacheManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRuleGroupCacheListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SStatusStandaloneResourceBaseManager.ListItemFilter(ctx, q, userCred, query.StatusStandaloneResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBase.ListItemFilter") + } + + q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SExternalizedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SManagedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemFilter") + } + + q, err = manager.SCloudregionResourceBaseManager.ListItemFilter(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemFilter") + } + return q, nil +} + +func (manager *SWafRuleGroupCacheManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) { + var err error + q, err = manager.SStatusStandaloneResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SManagedResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + + q, err = manager.SCloudregionResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + return q, httperrors.ErrNotFound +} + +func (manager *SWafRuleGroupCacheManager) OrderByExtraFields( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRuleGroupCacheListInput, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusStandaloneResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.StatusStandaloneResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SManagedResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.ManagedResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.OrderByExtraFields") + } + q, err = manager.SCloudregionResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.RegionalFilterListInput) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.OrderByExtraFields") + } + return q, nil +} + +func (manager *SWafRuleGroupCacheManager) ListItemExportKeys(ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + keys stringutils2.SSortedStrings, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusStandaloneResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SStatusStandaloneResourceBaseManager.ListItemExportKeys") + } + if keys.ContainsAny(manager.SCloudregionResourceBaseManager.GetExportKeys()...) { + q, err = manager.SCloudregionResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SCloudregionResourceBaseManager.ListItemExportKeys") + } + } + if keys.ContainsAny(manager.SManagedResourceBaseManager.GetExportKeys()...) { + q, err = manager.SManagedResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemExportKeys") + } + } + return q, nil +} + +func (self *SWafRuleGroupCache) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SWafRuleGroupCache) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.SStatusStandaloneResourceBase.Delete(ctx, userCred) +} + +func (self *SWafRuleGroupCache) syncRemove(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.RealDelete(ctx, userCred) +} + +func (self *SWafRuleGroupCache) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { + return self.StartDeleteTask(ctx, userCred, "") +} + +func (self *SWafRuleGroupCache) StartDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafRuleGroupCacheDeleteTask", self, userCred, nil, parentTaskId, "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_RULE_GROUP_STATUS_DELETING, "") + return task.ScheduleRun(nil) +} + +func (self *SWafRuleGroupCache) GetRegion() (*SCloudregion, error) { + region, err := CloudregionManager.FetchById(self.CloudregionId) + if err != nil { + return nil, errors.Wrapf(err, "CloudregionManager.FetchById") + } + return region.(*SCloudregion), nil +} + +func (self *SWafRuleGroupCache) GetIRegion() (cloudprovider.ICloudRegion, error) { + region, err := self.GetRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetRegion") + } + provider, err := self.GetDriver() + if err != nil { + return nil, errors.Wrapf(err, "GetDriver") + } + return provider.GetIRegionById(region.ExternalId) +} + +func (self *SWafRuleGroupCache) GetICloudWafRuleGroup() (cloudprovider.ICloudWafRuleGroup, error) { + if len(self.ExternalId) == 0 { + return nil, errors.Wrapf(cloudprovider.ErrNotFound, "empty external id") + } + iRegion, err := self.GetIRegion() + if err != nil { + return nil, errors.Wrapf(err, "GetIRegion") + } + caches, err := iRegion.GetICloudWafRuleGroups() + if err != nil { + return nil, errors.Wrapf(err, "GetICloudWafRuleGroups") + } + for i := range caches { + if caches[i].GetGlobalId() == self.ExternalId { + return caches[i], nil + } + } + return nil, errors.Wrapf(cloudprovider.ErrNotFound, self.ExternalId) +} + +func (self *SWafRuleGroupCache) syncWithCloudRuleGroup(ctx context.Context, userCred mcclient.TokenCredential, ext cloudprovider.ICloudWafRuleGroup) error { + _, err := db.Update(self, func() error { + self.Status = api.WAF_RULE_GROUP_STATUS_AVAILABLE + self.Name = ext.GetName() + self.Type = ext.GetWafType() + self.Description = ext.GetDesc() + return nil + }) + return err +} + +func (self *SCloudregion) GetRuleGroups(managerId string) ([]SWafRuleGroupCache, error) { + q := WafRuleGroupCacheManager.Query().Equals("cloudregion_id", self.Id) + if len(managerId) > 0 { + q = q.Equals("manager_id", managerId) + } + caches := []SWafRuleGroupCache{} + err := db.FetchModelObjects(WafRuleGroupCacheManager, q, &caches) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchModelObjects") + } + return caches, nil +} + +func (self *SCloudregion) createWafRuleGroup(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudWafRuleGroup) (*SWafRuleGroup, error) { + rg := &SWafRuleGroup{} + rg.SetModelManager(WafRuleGroupManager, rg) + rg.Name = ext.GetName() + rg.Status = api.WAF_RULE_GROUP_STATUS_AVAILABLE + rg.Description = ext.GetDesc() + rg.DomainId = provider.DomainId + return rg, WafRuleGroupManager.TableSpec().Insert(ctx, rg) +} + +func (self *SCloudregion) createRuleGroup(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudWafRuleGroup) (*SWafRuleGroup, error) { + rg := &SWafRuleGroup{} + rg.SetModelManager(WafRuleGroupManager, rg) + rg.Name = ext.GetName() + rg.Status = api.WAF_RULE_GROUP_STATUS_AVAILABLE + rg.Description = ext.GetDesc() + rg.DomainId = provider.DomainId + return rg, WafRuleGroupManager.TableSpec().Insert(ctx, rg) +} + +func (self *SCloudregion) newFromCloudWafRuleGroup(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudWafRuleGroup) error { + rg, err := self.createRuleGroup(ctx, userCred, provider, ext) + if err != nil { + return errors.Wrapf(err, "createRuleGroup") + } + cache := &SWafRuleGroupCache{} + cache.SetModelManager(WafRuleGroupCacheManager, cache) + cache.Name = ext.GetName() + cache.WafRuleGroupId = rg.Id + cache.CloudregionId = self.Id + cache.ManagerId = provider.Id + cache.ExternalId = ext.GetGlobalId() + cache.Status = api.WAF_RULE_GROUP_STATUS_AVAILABLE + cache.Type = ext.GetWafType() + cache.Description = ext.GetDesc() + return WafRuleGroupCacheManager.TableSpec().Insert(ctx, cache) +} + +func (self *SCloudregion) SyncWafRuleGroups(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, exts []cloudprovider.ICloudWafRuleGroup) compare.SyncResult { + lockman.LockRawObject(ctx, WafRuleGroupCacheManager.Keyword(), fmt.Sprintf("%s-%s", self.Id, provider.Id)) + defer lockman.ReleaseRawObject(ctx, WafRuleGroupCacheManager.Keyword(), fmt.Sprintf("%s-%s", self.Id, provider.Id)) + + result := compare.SyncResult{} + + dbRuleGroups, err := self.GetRuleGroups(provider.Id) + if err != nil { + result.Error(err) + return result + } + + removed := make([]SWafRuleGroupCache, 0) + commondb := make([]SWafRuleGroupCache, 0) + commonext := make([]cloudprovider.ICloudWafRuleGroup, 0) + added := make([]cloudprovider.ICloudWafRuleGroup, 0) + err = compare.CompareSets(dbRuleGroups, exts, &removed, &commondb, &commonext, &added) + if err != nil { + result.Error(err) + return result + } + + for i := 0; i < len(removed); i++ { + err := removed[i].syncRemove(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + + for i := 0; i < len(commondb); i++ { + err := commondb[i].syncWithCloudRuleGroup(ctx, userCred, commonext[i]) + if err != nil { + result.UpdateError(err) + continue + } + result.Update() + } + + for i := 0; i < len(added); i++ { + err = self.newFromCloudWafRuleGroup(ctx, userCred, provider, added[i]) + if err != nil { + result.AddError(err) + continue + } + result.Add() + } + return result +} diff --git a/pkg/compute/models/waf_rule_groups.go b/pkg/compute/models/waf_rule_groups.go new file mode 100644 index 0000000000..9a2e71690c --- /dev/null +++ b/pkg/compute/models/waf_rule_groups.go @@ -0,0 +1,305 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/log" + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/util/compare" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SWafRuleGroupManager struct { + db.SStatusInfrasResourceBaseManager + db.SExternalizedResourceBaseManager +} + +var wafIndex map[string]string + +var WafRuleGroupManager *SWafRuleGroupManager + +func init() { + WafRuleGroupManager = &SWafRuleGroupManager{ + SStatusInfrasResourceBaseManager: db.NewStatusInfrasResourceBaseManager( + SWafRuleGroup{}, + "waf_rule_groups_tbl", + "waf_rule_group", + "waf_rule_groups", + ), + } + wafIndex = map[string]string{} + WafRuleGroupManager.SetVirtualObject(WafRuleGroupManager) +} + +type SWafRuleGroup struct { + db.SStatusInfrasResourceBase + db.SExternalizedResourceBase + + // 支持的WAF类型,仅is_system=true时有效 + WafType cloudprovider.TWafType `width:"40" charset:"ascii" list:"domain" nullable:"false"` + Provider string `width:"20" charset:"ascii" list:"domain" nullable:"false"` + CloudEnv string `width:"20" charset:"ascii" list:"domain" nullable:"false"` + IsSystem bool `nullable:"false" default:"false" list:"domain" update:"domain" create:"optional"` +} + +func (manager *SWafRuleGroupManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.WafRuleGroupDetails { + rows := make([]api.WafRuleGroupDetails, len(objs)) + siRows := manager.SStatusInfrasResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + for i := range rows { + rows[i] = api.WafRuleGroupDetails{ + StatusInfrasResourceBaseDetails: siRows[i], + } + } + return rows +} + +// 列出WAF RuleGroups +func (manager *SWafRuleGroupManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRuleGroupListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SStatusInfrasResourceBaseManager.ListItemFilter(ctx, q, userCred, query.StatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.ListItemFilter") + } + + if query.IsSystem != nil { + q = q.Equals("is_system", *query.IsSystem) + } + + if len(query.Provider) > 0 { + q = q.Equals("provider", query.Provider) + } + + if len(query.CloudEnv) > 0 { + q = q.Equals("cloud_env", query.CloudEnv) + } + + return q, nil +} + +func (manager *SWafRuleGroupManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) { + var err error + q, err = manager.SStatusInfrasResourceBaseManager.QueryDistinctExtraField(q, field) + if err == nil { + return q, nil + } + return q, httperrors.ErrNotFound +} + +func (manager *SWafRuleGroupManager) OrderByExtraFields( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRuleGroupListInput, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusInfrasResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.StatusInfrasResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.OrderByExtraFields") + } + return q, nil +} + +func (manager *SWafRuleGroupManager) ListItemExportKeys(ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + keys stringutils2.SSortedStrings, +) (*sqlchemy.SQuery, error) { + q, err := manager.SStatusInfrasResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys) + if err != nil { + return nil, errors.Wrap(err, "SStatusInfrasResourceBaseManager.ListItemExportKeys") + } + return q, nil +} + +func (self *SWafRuleGroup) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SWafRuleGroup) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + rules, err := self.GetWafRules() + if err != nil { + return errors.Wrapf(err, "GetWafRules") + } + for i := range rules { + err = rules[i].Delete(ctx, userCred) + if err != nil { + return errors.Wrapf(err, "Delete rule %s %s", rules[i].Id, rules[i].Name) + } + } + return self.SStatusInfrasResourceBase.Delete(ctx, userCred) +} + +func (self *SSkuResourcesMeta) GetWafGroups(cloudEnv string) ([]SWafRuleGroup, error) { + q := WafRuleGroupManager.Query().Equals("cloud_env", cloudEnv).IsTrue("is_system") + groups := []SWafRuleGroup{} + err := db.FetchModelObjects(WafRuleGroupManager, q, &groups) + return groups, err +} + +func (self *SWafRuleGroup) syncWithCloudSku(ctx context.Context, userCred mcclient.TokenCredential, ext sWafGroup) error { + _, err := db.Update(self, func() error { + self.Name = ext.Name + self.Description = ext.Description + self.IsPublic = true + self.Status = api.WAF_RULE_GROUP_STATUS_AVAILABLE + return nil + }) + if err != nil { + return errors.Wrapf(err, "db.Update") + } + result, err := self.SyncManagedWafRules(ctx, userCred, ext.Rules) + if err != nil { + return errors.Wrapf(err, "SyncManagedWafRules") + } + log.Debugf("Sync waf group %s rule result: %s", self.Name, result.Result()) + return nil +} + +func (self *SSkuResourcesMeta) newFromCloudWafGroup(ctx context.Context, userCred mcclient.TokenCredential, ext sWafGroup) error { + group := &ext.SWafRuleGroup + group.SetModelManager(WafRuleGroupManager, group) + group.Status = api.WAF_RULE_GROUP_STATUS_AVAILABLE + group.IsPublic = true + err := WafRuleGroupManager.TableSpec().Insert(ctx, group) + if err != nil { + return errors.Wrapf(err, "Insert") + } + result, err := group.SyncManagedWafRules(ctx, userCred, ext.Rules) + if err != nil { + return errors.Wrapf(err, "SyncManagedWafRules") + } + log.Debugf("Sync waf group %s rule result: %s", group.Name, result.Result()) + return nil +} + +func (self *SSkuResourcesMeta) SyncWafGroups(ctx context.Context, userCred mcclient.TokenCredential, cloudEnv string) compare.SyncResult { + lockman.LockRawObject(ctx, cloudEnv, "waf-rule-group") + defer lockman.ReleaseRawObject(ctx, cloudEnv, "waf-rule-group") + + result := compare.SyncResult{} + exts, err := self.getCloudWafGroups(cloudEnv) + if err != nil { + result.Error(errors.Wrapf(err, "getWafGroups(%s)", cloudEnv)) + return result + } + dbGroup, err := self.GetWafGroups(cloudEnv) + if err != nil { + result.Error(errors.Wrapf(err, "GetWafGroups")) + return result + } + + removed := make([]SWafRuleGroup, 0) + commondb := make([]SWafRuleGroup, 0) + commonext := make([]sWafGroup, 0) + added := make([]sWafGroup, 0) + + err = compare.CompareSets(dbGroup, exts, &removed, &commondb, &commonext, &added) + if err != nil { + result.Error(err) + return result + } + + for i := 0; i < len(removed); i += 1 { + err = removed[i].RealDelete(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + for i := 0; i < len(commondb); i += 1 { + err = commondb[i].syncWithCloudSku(ctx, userCred, commonext[i]) + if err != nil { + result.UpdateError(err) + continue + } + result.Update() + } + for i := 0; i < len(added); i += 1 { + err = self.newFromCloudWafGroup(ctx, userCred, added[i]) + if err != nil { + result.AddError(err) + continue + } + result.Add() + } + + return result +} + +func SyncWafGroups(ctx context.Context, userCred mcclient.TokenCredential, isStart bool) { + err := func() error { + cloudEnvs, err := fetchCloudEnvs() + if err != nil { + return errors.Wrapf(err, "fetchCloudEnvs") + } + + meta, err := FetchSkuResourcesMeta() + if err != nil { + return errors.Wrapf(err, "FetchSkuResourcesMeta") + } + + index, err := meta.getWafIndex() + if err != nil { + return errors.Wrapf(err, "getWafIndex") + } + + for _, cloudEnv := range cloudEnvs { + newMd5, ok := index[cloudEnv] + if !ok { + continue + } + oldMd5, _ := wafIndex[cloudEnv] + if newMd5 == EMPTY_MD5 { + log.Infof("%s Waf group is empty skip syncing", cloudEnv) + continue + } + if len(oldMd5) > 0 && newMd5 == oldMd5 { + log.Infof("%s Waf group not Changed skip syncing", cloudEnv) + continue + } + result := meta.SyncWafGroups(ctx, userCred, cloudEnv) + log.Infof("sync %s waf group result: %s", cloudEnv, result.Result()) + wafIndex[cloudEnv] = newMd5 + } + return nil + }() + if err != nil { + log.Errorf("SyncWafGroups: error: %v", err) + } +} diff --git a/pkg/compute/models/waf_rule_statements.go b/pkg/compute/models/waf_rule_statements.go new file mode 100644 index 0000000000..e252cacb8e --- /dev/null +++ b/pkg/compute/models/waf_rule_statements.go @@ -0,0 +1,193 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + + "yunion.io/x/log" + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/util/compare" + "yunion.io/x/pkg/util/stringutils" + + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/mcclient" +) + +type SWafRuleStatementManager struct { + db.SResourceBaseManager +} + +var WafRuleStatementManager *SWafRuleStatementManager + +func init() { + WafRuleStatementManager = &SWafRuleStatementManager{ + SResourceBaseManager: db.NewResourceBaseManager( + SWafRuleStatement{}, + "waf_rule_statements_tbl", + "waf_rule_statement", + "waf_rule_statements", + ), + } + WafRuleStatementManager.SetVirtualObject(WafRuleStatementManager) +} + +type SWafRuleStatement struct { + db.SResourceBase + + Id string `width:"128" charset:"ascii" primary:"true" list:"user"` + cloudprovider.SWafStatement + + WafRuleId string `width:"36" charset:"ascii" nullable:"false" list:"user"` +} + +func (self *SWafRuleStatement) BeforeInsert() { + if len(self.Id) == 0 { + self.Id = stringutils.UUID4() + } +} + +func (self *SWafRuleStatement) GetId() string { + return self.Id +} + +func (self *SWafRule) GetRuleStatements() ([]SWafRuleStatement, error) { + q := WafRuleStatementManager.Query().Equals("waf_rule_id", self.Id) + statements := []SWafRuleStatement{} + err := db.FetchModelObjects(WafRuleStatementManager, q, &statements) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchModelObjects") + } + return statements, nil +} + +func (self *SWafRuleStatement) syncWithStatement(ctx context.Context, userCred mcclient.TokenCredential, statement cloudprovider.SWafStatement) error { + _, err := db.Update(self, func() error { + self.SWafStatement = statement + switch self.Type { + case cloudprovider.WafStatementTypeIPSet: + if len(self.IPSetId) > 0 { + _cache, err := db.FetchByExternalId(WafIPSetCacheManager, self.IPSetId) + if err != nil { + log.Errorf("WafIPSetCacheManager(%s) error: %v", self.IPSetId, err) + } else { + cache := _cache.(*SWafIPSetCache) + self.IPSetId = cache.WafIPSetId + } + } + case cloudprovider.WafStatementTypeRegexSet: + if len(self.RegexSetId) > 0 { + _cache, err := db.FetchByExternalId(WafRegexSetCacheManager, self.RegexSetId) + if err != nil { + log.Errorf("WafRegexSetCacheManager(%s) error: %v", self.RegexSetId, err) + } else { + cache := _cache.(*SWafRegexSetCache) + self.RegexSetId = cache.WafRegexSetId + } + } + } + + return nil + }) + return err +} + +func (self *SWafRule) newFromCloudStatement(ctx context.Context, userCred mcclient.TokenCredential, ext cloudprovider.SWafStatement) error { + statement := &SWafRuleStatement{} + statement.SetModelManager(WafRuleStatementManager, statement) + statement.WafRuleId = self.Id + statement.SWafStatement = ext + switch statement.Type { + case cloudprovider.WafStatementTypeIPSet: + if len(statement.IPSetId) > 0 { + _cache, err := db.FetchByExternalId(WafIPSetCacheManager, statement.IPSetId) + if err != nil { + log.Errorf("WafIPSetCacheManager(%s) error: %v", statement.IPSetId, err) + } else { + cache := _cache.(*SWafIPSetCache) + statement.IPSetId = cache.WafIPSetId + } + } + case cloudprovider.WafStatementTypeRegexSet: + if len(statement.RegexSetId) > 0 { + _cache, err := db.FetchByExternalId(WafRegexSetCacheManager, statement.RegexSetId) + if err != nil { + log.Errorf("WafRegexSetCacheManager(%s) error: %v", statement.RegexSetId, err) + } else { + cache := _cache.(*SWafRegexSetCache) + statement.RegexSetId = cache.WafRegexSetId + } + } + } + return WafRuleStatementManager.TableSpec().Insert(ctx, statement) +} + +func (self *SWafRule) SyncStatements(ctx context.Context, userCred mcclient.TokenCredential, rule cloudprovider.ICloudWafRule) error { + lockman.LockRawObject(ctx, WafRuleManager.Keyword(), self.Id) + defer lockman.ReleaseRawObject(ctx, WafRuleManager.Keyword(), self.Id) + + dbStatements, err := self.GetRuleStatements() + if err != nil { + return errors.Wrapf(err, "GetRuleStatements") + } + + exts, err := rule.GetStatements() + if err != nil { + return errors.Wrapf(err, "GetStatements") + } + + result := compare.SyncResult{} + + removed := make([]SWafRuleStatement, 0) + commondb := make([]SWafRuleStatement, 0) + commonext := make([]cloudprovider.SWafStatement, 0) + added := make([]cloudprovider.SWafStatement, 0) + err = compare.CompareSets(dbStatements, exts, &removed, &commondb, &commonext, &added) + if err != nil { + return errors.Wrapf(err, "compare.CompareSets") + } + + for i := 0; i < len(removed); i++ { + err := removed[i].Delete(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + + for i := 0; i < len(commondb); i++ { + err := commondb[i].syncWithStatement(ctx, userCred, commonext[i]) + if err != nil { + result.UpdateError(err) + continue + } + result.Update() + } + + for i := 0; i < len(added); i++ { + err := self.newFromCloudStatement(ctx, userCred, added[i]) + if err != nil { + result.AddError(err) + continue + } + result.Add() + } + + log.Debugf("sync statements for rule %s result: %s", self.Name, result.Result()) + return nil +} diff --git a/pkg/compute/models/waf_rules.go b/pkg/compute/models/waf_rules.go new file mode 100644 index 0000000000..d3900e22a7 --- /dev/null +++ b/pkg/compute/models/waf_rules.go @@ -0,0 +1,583 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package models + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/util/compare" + "yunion.io/x/sqlchemy" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/validators" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/rbacutils" + "yunion.io/x/onecloud/pkg/util/stringutils2" +) + +type SWafRuleManager struct { + db.SStatusStandaloneResourceBaseManager + db.SExternalizedResourceBaseManager +} + +var WafRuleManager *SWafRuleManager + +func init() { + WafRuleManager = &SWafRuleManager{ + SStatusStandaloneResourceBaseManager: db.NewStatusStandaloneResourceBaseManager( + SWafRule{}, + "waf_rules_tbl", + "waf_rule", + "waf_rules", + ), + } + WafRuleManager.SetVirtualObject(WafRuleManager) +} + +type SWafRule struct { + db.SStatusStandaloneResourceBase + db.SExternalizedResourceBase + + // 规则优先级 + Priority int `nullable:"false" list:"domain" create:"required"` + // 规则默认行为 + Action *cloudprovider.DefaultAction `charset:"utf8" nullable:"false" list:"user" update:"domain" create:"required"` + // 条件 + StatementConditon cloudprovider.TWafStatementCondition `width:"20" charset:"ascii" nullable:"false" list:"domain" create:"optional"` + // 规则组的id + WafRuleGroupId string `width:"36" charset:"ascii" nullable:"false" list:"domain" create:"optional"` + // 所属waf实例id + WafInstanceId string `width:"36" charset:"ascii" nullable:"false" list:"domain" create:"optional"` +} + +func (manager *SWafRuleManager) FetchUniqValues(ctx context.Context, data jsonutils.JSONObject) jsonutils.JSONObject { + values := struct { + WafRuleGroupId string + WafInstanceId string + }{} + data.Unmarshal(&values) + return jsonutils.Marshal(values) +} + +func (manager *SWafRuleManager) FilterByUniqValues(q *sqlchemy.SQuery, values jsonutils.JSONObject) *sqlchemy.SQuery { + data := struct { + WafRuleGroupId string + WafInstanceId string + }{} + if len(data.WafRuleGroupId) > 0 { + q = q.Equals("waf_rule_group_id", data.WafRuleGroupId) + } + if len(data.WafInstanceId) > 0 { + q = q.Equals("waf_instance_id", data.WafInstanceId) + } + return q +} + +func (manager *SWafRuleManager) FetchOwnerId(ctx context.Context, data jsonutils.JSONObject) (mcclient.IIdentityProvider, error) { + values := struct { + WafRuleGroupId string + WafInstanceId string + }{} + data.Unmarshal(&values) + if len(values.WafInstanceId) > 0 { + ins, err := db.FetchById(WafInstanceManager, values.WafInstanceId) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchById(WafInstanceManager, %s)", values.WafInstanceId) + } + waf := ins.(*SWafInstance) + return waf.GetOwnerId(), nil + } + if len(values.WafRuleGroupId) > 0 { + rg, err := db.FetchById(WafRuleGroupManager, values.WafRuleGroupId) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchById(WafRuleGroupManager, %s)", values.WafRuleGroupId) + } + return rg.GetOwnerId(), nil + } + return db.FetchDomainInfo(ctx, data) +} + +func (manager *SWafRuleManager) FilterByOwner(q *sqlchemy.SQuery, userCred mcclient.IIdentityProvider, scope rbacutils.TRbacScope) *sqlchemy.SQuery { + sq1 := WafInstanceManager.Query("id") + sq1 = db.SharableManagerFilterByOwner(WafInstanceManager, sq1, userCred, scope) + sq2 := WafRuleGroupManager.Query("id") + sq2 = db.SharableManagerFilterByOwner(WafRuleGroupManager, sq2, userCred, scope) + return q.Filter(sqlchemy.OR( + sqlchemy.In(q.Field("waf_instance_id"), sq1.SubQuery()), + sqlchemy.In(q.Field("waf_rule_group_id"), sq2.SubQuery()), + )) +} + +func (manager *SWafRuleManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, input api.WafRuleCreateInput) (api.WafRuleCreateInput, error) { + if len(input.WafInstanceId) > 0 { + ins, err := validators.ValidateModel(userCred, WafInstanceManager, &input.WafInstanceId) + if err != nil { + return input, err + } + waf := ins.(*SWafInstance) + if waf.Status != api.WAF_STATUS_AVAILABLE { + return input, httperrors.NewInvalidStatusError("waf %s status is not available", waf.Name) + } + region, err := waf.GetRegion() + if err != nil { + return input, httperrors.NewGeneralError(errors.Wrapf(err, "GetRegion")) + } + input, err = region.GetDriver().ValidateCreateWafRuleData(ctx, userCred, waf, input) + if err != nil { + return input, err + } + } else if len(input.WafRuleGroupId) > 0 { + return input, httperrors.NewInputParameterError("not implement") + } else { + return input, httperrors.NewMissingParameterError("waf_instance_id") + } + + var err error + input.StatusStandaloneResourceCreateInput, err = manager.SStatusStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerId, query, input.StatusStandaloneResourceCreateInput) + if err != nil { + return input, err + } + + return input, nil +} + +func (self *SWafRule) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) { + self.SStatusStandaloneResourceBase.PostCreate(ctx, userCred, ownerId, query, data) + + input := &api.WafRuleCreateInput{} + data.Unmarshal(input) + + for _, s := range input.Statements { + statement := &SWafRuleStatement{} + statement.SetModelManager(WafRuleStatementManager, statement) + statement.SWafStatement = s + statement.WafRuleId = self.Id + WafRuleStatementManager.TableSpec().Insert(ctx, statement) + } + + self.StartCreateTask(ctx, userCred) +} + +func (self *SWafRule) StartCreateTask(ctx context.Context, userCred mcclient.TokenCredential) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafRuleCreateTask", self, userCred, nil, "", "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_RULE_STATUS_CREATING, "") + return task.ScheduleRun(nil) +} + +// 列出WAF规则 +func (manager *SWafRuleManager) ListItemFilter( + ctx context.Context, + q *sqlchemy.SQuery, + userCred mcclient.TokenCredential, + query api.WafRuleListInput, +) (*sqlchemy.SQuery, error) { + var err error + + q, err = manager.SStatusStandaloneResourceBaseManager.ListItemFilter(ctx, q, userCred, query.StatusStandaloneResourceListInput) + if err != nil { + return nil, errors.Wrap(err, "SEnabledStatusStandaloneResourceBaseManager.ListItemFilter") + } + + q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput) + if err != nil { + return nil, errors.Wrap(err, "SExternalizedResourceBaseManager.ListItemFilter") + } + + if len(query.WafInstanceId) > 0 { + _, err := validators.ValidateModel(userCred, WafInstanceManager, &query.WafInstanceId) + if err != nil { + return nil, err + } + q = q.Equals("waf_instance_id", query.WafInstanceId) + } + if len(query.WafRuleGroupId) > 0 { + _, err := validators.ValidateModel(userCred, WafRuleGroupManager, &query.WafRuleGroupId) + if err != nil { + return nil, err + } + q = q.Equals("waf_rule_group_id", query.WafRuleGroupId) + } + + return q, nil +} + +func (manager *SWafRuleManager) FetchCustomizeColumns( + ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + objs []interface{}, + fields stringutils2.SSortedStrings, + isList bool, +) []api.WafRuleDetails { + rows := make([]api.WafRuleDetails, len(objs)) + stdRows := manager.SStatusStandaloneResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList) + ruleIds := make([]string, len(objs)) + for i := range rows { + rows[i] = api.WafRuleDetails{ + StatusStandaloneResourceDetails: stdRows[i], + } + ruleIds[i] = objs[i].(*SWafRule).Id + } + q := WafRuleStatementManager.Query().In("waf_rule_id", ruleIds) + statements := []SWafRuleStatement{} + err := q.All(&statements) + if err != nil { + return rows + } + statementMaps := map[string][]cloudprovider.SWafStatement{} + for i := range statements { + _, ok := statementMaps[statements[i].WafRuleId] + if !ok { + statementMaps[statements[i].WafRuleId] = []cloudprovider.SWafStatement{} + } + statementMaps[statements[i].WafRuleId] = append(statementMaps[statements[i].WafRuleId], statements[i].SWafStatement) + } + for i := range rows { + rows[i].Statements, _ = statementMaps[ruleIds[i]] + } + + return rows +} + +func (self *SWafRule) GetWafInstance() (*SWafInstance, error) { + waf, err := WafInstanceManager.FetchById(self.WafInstanceId) + if err != nil { + return nil, errors.Wrapf(err, "WafInstanceManager.FetchById(%s)", self.WafInstanceId) + } + return waf.(*SWafInstance), nil +} + +func (self *SWafRule) GetWafRuleGroup() (*SWafRuleGroup, error) { + rg, err := WafRuleGroupManager.FetchById(self.WafRuleGroupId) + if err != nil { + return nil, errors.Wrapf(err, "WafRuleGroupManager.FetchById(%s)", self.WafRuleGroupId) + } + return rg.(*SWafRuleGroup), nil +} + +func (self *SWafRule) GetOwnerId() mcclient.IIdentityProvider { + if len(self.WafInstanceId) > 0 { + ins, err := self.GetWafInstance() + if err != nil { + return nil + } + return ins.GetOwnerId() + } + if len(self.WafRuleGroupId) > 0 { + rg, err := self.GetWafRuleGroup() + if err != nil { + return nil + } + return rg.GetOwnerId() + } + return nil +} + +func (manager *SWafRuleManager) ResourceScope() rbacutils.TRbacScope { + return rbacutils.ScopeDomain +} + +func (self *SWafInstance) GetWafRules() ([]SWafRule, error) { + q := WafRuleManager.Query().Equals("waf_instance_id", self.Id) + rules := []SWafRule{} + err := db.FetchModelObjects(WafRuleManager, q, &rules) + if err != nil { + return nil, errors.Wrapf(err, "db.FetchModelObjects") + } + return rules, nil +} + +func (self *SWafRule) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { + return self.StartDeleteTask(ctx, userCred) +} + +func (self *SWafRule) StartDeleteTask(ctx context.Context, userCred mcclient.TokenCredential) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafRuleDeleteTask", self, userCred, nil, "", "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_RULE_STATUS_DELETING, "") + return task.ScheduleRun(nil) +} + +func (self *SWafRule) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { + return nil +} + +func (self *SWafRule) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { + statements, err := self.GetRuleStatements() + if err != nil { + return errors.Wrapf(err, "GetRuleStatements") + } + for i := range statements { + err = statements[i].Delete(ctx, userCred) + if err != nil { + return errors.Wrapf(err, "Delete statement %s(%s)", statements[i].Type, statements[i].MatchField) + } + } + return self.SStatusStandaloneResourceBase.Delete(ctx, userCred) +} + +func (self *SWafRule) syncRemove(ctx context.Context, userCred mcclient.TokenCredential) error { + return self.RealDelete(ctx, userCred) +} + +func (self *SWafRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, input api.WafRuleUpdateInput) (api.WafRuleUpdateInput, error) { + var err error + if len(input.Name) > 0 && input.Name != self.Name { + return input, httperrors.NewInputParameterError("Not allow update rule name") + } + input.StatusStandaloneResourceBaseUpdateInput, err = self.SStatusStandaloneResourceBase.ValidateUpdateData(ctx, userCred, query, input.StatusStandaloneResourceBaseUpdateInput) + if err != nil { + return input, err + } + return input, nil +} + +func (self *SWafRule) PostUpdate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) { + self.SStatusStandaloneResourceBase.PostUpdate(ctx, userCred, query, data) + + input := api.WafRuleUpdateInput{} + data.Unmarshal(&input) + + statements, err := self.GetRuleStatements() + if err != nil { + return + } + for i := len(input.Statements); i < len(statements); i++ { + statements[i].Delete(ctx, userCred) + } + for i := len(statements); i < len(input.Statements); i++ { + statement := &SWafRuleStatement{} + statement.SetModelManager(WafRuleStatementManager, statement) + statement.SWafStatement = input.Statements[i] + statement.WafRuleId = self.Id + WafRuleStatementManager.TableSpec().Insert(ctx, statement) + } + for i := 0; i < len(input.Statements) && i < len(statements); i++ { + db.Update(&statements[i], func() error { + statements[i].SWafStatement = input.Statements[i] + return nil + }) + } + self.StartUpdateTask(ctx, userCred, "") +} + +func (self *SWafRule) StartUpdateTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + task, err := taskman.TaskManager.NewTask(ctx, "WafRuleUpdateTask", self, userCred, nil, parentTaskId, "", nil) + if err != nil { + return errors.Wrapf(err, "NewTask") + } + self.SetStatus(userCred, api.WAF_RULE_STATUS_UPDATING, "") + return task.ScheduleRun(nil) +} + +func (self *SWafRule) SyncWithCloudRule(ctx context.Context, userCred mcclient.TokenCredential, rule cloudprovider.ICloudWafRule) error { + _, err := db.Update(self, func() error { + self.Action = rule.GetAction() + self.StatementConditon = rule.GetStatementCondition() + self.Priority = rule.GetPriority() + self.Status = api.WAF_RULE_STATUS_AVAILABLE + self.Name = rule.GetName() + self.ExternalId = rule.GetGlobalId() + return nil + }) + if err != nil { + return errors.Wrapf(err, "db.Update") + } + return self.SyncStatements(ctx, userCred, rule) +} + +func (self *SWafInstance) newFromCloudRule(ctx context.Context, userCred mcclient.TokenCredential, ext cloudprovider.ICloudWafRule) error { + rule := &SWafRule{} + rule.SetModelManager(WafRuleManager, rule) + rule.WafInstanceId = self.Id + rule.Name = ext.GetName() + rule.Description = ext.GetDesc() + rule.ExternalId = ext.GetGlobalId() + rule.Action = ext.GetAction() + rule.StatementConditon = ext.GetStatementCondition() + rule.Priority = ext.GetPriority() + rule.Status = api.WAF_RULE_STATUS_AVAILABLE + err := WafRuleManager.TableSpec().Insert(ctx, rule) + if err != nil { + return errors.Wrapf(err, "Insert") + } + return rule.SyncStatements(ctx, userCred, ext) +} + +func (self *SWafInstance) SyncWafRules(ctx context.Context, userCred mcclient.TokenCredential, exts []cloudprovider.ICloudWafRule) compare.SyncResult { + lockman.LockRawObject(ctx, WafInstanceManager.Keyword(), self.Id) + defer lockman.ReleaseRawObject(ctx, WafInstanceManager.Keyword(), self.Id) + + result := compare.SyncResult{} + + dbRules, err := self.GetWafRules() + if err != nil { + result.Error(err) + return result + } + + removed := make([]SWafRule, 0) + commondb := make([]SWafRule, 0) + commonext := make([]cloudprovider.ICloudWafRule, 0) + added := make([]cloudprovider.ICloudWafRule, 0) + if err := compare.CompareSets(dbRules, exts, &removed, &commondb, &commonext, &added); err != nil { + result.Error(err) + return result + } + + for i := 0; i < len(removed); i++ { + err := removed[i].syncRemove(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + + for i := 0; i < len(commondb); i++ { + err := commondb[i].SyncWithCloudRule(ctx, userCred, commonext[i]) + if err != nil { + result.UpdateError(err) + continue + } + result.Update() + } + + for i := 0; i < len(added); i++ { + err := self.newFromCloudRule(ctx, userCred, added[i]) + if err != nil { + result.AddError(err) + continue + } + result.Add() + } + + return result +} + +func (self *SWafRuleGroup) GetWafRules() ([]SWafRule, error) { + q := WafRuleManager.Query().Equals("waf_rule_group_id", self.Id) + rules := []SWafRule{} + err := db.FetchModelObjects(WafRuleManager, q, &rules) + return rules, err +} + +func (self *SWafRuleGroup) newFromManagedRule(ctx context.Context, userCred mcclient.TokenCredential, ext SWafRule) error { + ext.SetModelManager(WafRuleManager, &ext) + ext.WafRuleGroupId = self.Id + return WafRuleManager.TableSpec().Insert(ctx, &ext) +} + +func (self *SWafRuleGroup) SyncManagedWafRules(ctx context.Context, userCred mcclient.TokenCredential, exts []SWafRule) (compare.SyncResult, error) { + lockman.LockRawObject(ctx, WafRuleGroupManager.Keyword(), self.Id) + defer lockman.ReleaseRawObject(ctx, WafRuleGroupManager.Keyword(), self.Id) + + result := compare.SyncResult{} + + dbRules, err := self.GetWafRules() + if err != nil { + return result, errors.Wrapf(err, "GetWafRules") + } + + removed := make([]SWafRule, 0) + commondb := make([]SWafRule, 0) + commonext := make([]SWafRule, 0) + added := make([]SWafRule, 0) + err = compare.CompareSets(dbRules, exts, &removed, &commondb, &commonext, &added) + if err != nil { + return result, errors.Wrapf(err, "compare.CompareSets") + } + + for i := 0; i < len(removed); i++ { + err := removed[i].syncRemove(ctx, userCred) + if err != nil { + result.DeleteError(err) + continue + } + result.Delete() + } + + for i := 0; i < len(added); i++ { + err := self.newFromManagedRule(ctx, userCred, added[i]) + if err != nil { + result.AddError(err) + continue + } + result.Add() + } + + return result, nil +} + +func (self *SWafRule) GetICloudWafInstance() (cloudprovider.ICloudWafInstance, error) { + ins, err := self.GetWafInstance() + if err != nil { + return nil, errors.Wrapf(err, "GetWafInstance") + } + iWaf, err := ins.GetICloudWafInstance() + if err != nil { + return nil, errors.Wrapf(err, "GetICloudWafInstance") + } + return iWaf, nil + +} + +func (self *SWafRule) GetICloudWafRule() (cloudprovider.ICloudWafRule, error) { + if len(self.ExternalId) == 0 { + return nil, errors.Wrapf(cloudprovider.ErrNotFound, "empty external id") + } + if len(self.WafInstanceId) > 0 { + iWaf, err := self.GetICloudWafInstance() + if err != nil { + return nil, errors.Wrapf(err, "GetICloudWafInstance") + } + rules, err := iWaf.GetRules() + if err != nil { + return nil, errors.Wrapf(err, "GetWafRules") + } + for i := range rules { + if rules[i].GetGlobalId() == self.ExternalId { + return rules[i], nil + } + } + return nil, errors.Wrapf(cloudprovider.ErrNotFound, self.ExternalId) + } + return nil, errors.Wrapf(cloudprovider.ErrNotFound, "") +} + +func (self *SWafRule) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + ins, _ := self.GetWafInstance() + if ins != nil { + return ins.IsOwner(userCred) || db.IsDomainAllowPerform(userCred, self, "syncstatus") + } + return db.IsDomainAllowPerform(userCred, self, "syncstatus") +} + +// 同步WAF规则状态 +func (self *SWafRule) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, input api.WafSyncstatusInput) (jsonutils.JSONObject, error) { + return nil, StartResourceSyncStatusTask(ctx, userCred, self, "WafRuleSyncstatusTask", "") +} diff --git a/pkg/compute/policy/defaults.go b/pkg/compute/policy/defaults.go index c3e05a8495..97e4150e11 100644 --- a/pkg/compute/policy/defaults.go +++ b/pkg/compute/policy/defaults.go @@ -162,6 +162,18 @@ var ( Extra: []string{"saml"}, Result: rbacutils.Allow, }, + { + Service: api.SERVICE_TYPE, + Resource: "waf_rules", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "waf_rules", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, }, }, { diff --git a/pkg/compute/policy/resources.go b/pkg/compute/policy/resources.go index 02bf625fd7..68d230cc7a 100644 --- a/pkg/compute/policy/resources.go +++ b/pkg/compute/policy/resources.go @@ -59,6 +59,11 @@ var ( "proxysettings", "project_mappings", "app_gateways", + "waf_instances", + "waf_rules", + "waf_rule_groups", + "waf_ipsets", + "waf_regexsets", } computeUserResources = []string{ "keypairs", diff --git a/pkg/compute/regiondrivers/aliyun.go b/pkg/compute/regiondrivers/aliyun.go index f451d45b80..f6e5bc495f 100644 --- a/pkg/compute/regiondrivers/aliyun.go +++ b/pkg/compute/regiondrivers/aliyun.go @@ -25,6 +25,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/util/regutils" "yunion.io/x/pkg/util/secrules" "yunion.io/x/pkg/utils" @@ -1530,3 +1531,18 @@ func (self *SAliyunRegionDriver) RequestSyncAccessGroup(ctx context.Context, use }) return nil } + +func (self *SAliyunRegionDriver) ValidateCreateWafInstanceData(ctx context.Context, userCred mcclient.TokenCredential, input api.WafInstanceCreateInput) (api.WafInstanceCreateInput, error) { + if !regutils.DOMAINNAME_REG.MatchString(input.Name) { + return input, httperrors.NewInputParameterError("invalid domain name %s", input.Name) + } + input.Type = cloudprovider.WafTypeDefault + if len(input.SourceIps) == 0 && len(input.CloudResources) == 0 { + return input, httperrors.NewMissingParameterError("source_ips") + } + return input, nil +} + +func (self *SAliyunRegionDriver) ValidateCreateWafRuleData(ctx context.Context, userCred mcclient.TokenCredential, waf *models.SWafInstance, input api.WafRuleCreateInput) (api.WafRuleCreateInput, error) { + return input, httperrors.NewUnsupportOperationError("not supported create rule") +} diff --git a/pkg/compute/regiondrivers/aws.go b/pkg/compute/regiondrivers/aws.go index 317fff48b6..358c2bcf44 100644 --- a/pkg/compute/regiondrivers/aws.go +++ b/pkg/compute/regiondrivers/aws.go @@ -1559,3 +1559,33 @@ func (self *SAwsRegionDriver) RequestAssociateEip(ctx context.Context, userCred }) return nil } + +func (self *SAwsRegionDriver) ValidateCreateWafInstanceData(ctx context.Context, userCred mcclient.TokenCredential, input api.WafInstanceCreateInput) (api.WafInstanceCreateInput, error) { + if len(input.Type) == 0 { + input.Type = cloudprovider.WafTypeRegional + } + switch input.Type { + case cloudprovider.WafTypeRegional: + case cloudprovider.WafTypeCloudFront: + _region, err := models.CloudregionManager.FetchById(input.CloudregionId) + if err != nil { + return input, err + } + region := _region.(*models.SCloudregion) + if !strings.HasSuffix(region.ExternalId, "us-east-1") { + return input, httperrors.NewUnsupportOperationError("only us-east-1 support %s", input.Type) + } + default: + return input, httperrors.NewInputParameterError("Invalid aws waf type %s", input.Type) + } + if input.DefaultAction == nil { + input.DefaultAction = &cloudprovider.DefaultAction{ + Action: cloudprovider.WafActionAllow, + } + } + return input, nil +} + +func (self *SAwsRegionDriver) ValidateCreateWafRuleData(ctx context.Context, userCred mcclient.TokenCredential, waf *models.SWafInstance, input api.WafRuleCreateInput) (api.WafRuleCreateInput, error) { + return input, nil +} diff --git a/pkg/compute/regiondrivers/azure.go b/pkg/compute/regiondrivers/azure.go index 003783299d..4d1f8370a9 100644 --- a/pkg/compute/regiondrivers/azure.go +++ b/pkg/compute/regiondrivers/azure.go @@ -83,3 +83,31 @@ func (self *SAzureRegionDriver) ValidateCreateVpcData(ctx context.Context, userC } return input, nil } + +func (self *SAzureRegionDriver) ValidateCreateWafInstanceData(ctx context.Context, userCred mcclient.TokenCredential, input api.WafInstanceCreateInput) (api.WafInstanceCreateInput, error) { + if len(input.Type) == 0 { + input.Type = cloudprovider.WafTypeAppGateway + } + switch input.Type { + case cloudprovider.WafTypeAppGateway: + default: + return input, httperrors.NewInputParameterError("Invalid azure waf type %s", input.Type) + } + if input.DefaultAction == nil { + input.DefaultAction = &cloudprovider.DefaultAction{} + } + if len(input.DefaultAction.Action) == 0 { + input.DefaultAction.Action = cloudprovider.WafActionDetection + } + switch input.DefaultAction.Action { + case cloudprovider.WafActionPrevention: + case cloudprovider.WafActionDetection: + default: + return input, httperrors.NewInputParameterError("invalid default action %s", input.DefaultAction.Action) + } + return input, nil +} + +func (self *SAzureRegionDriver) ValidateCreateWafRuleData(ctx context.Context, userCred mcclient.TokenCredential, waf *models.SWafInstance, input api.WafRuleCreateInput) (api.WafRuleCreateInput, error) { + return input, nil +} diff --git a/pkg/compute/regiondrivers/base.go b/pkg/compute/regiondrivers/base.go index 8f2ad36155..99a0c8898c 100644 --- a/pkg/compute/regiondrivers/base.go +++ b/pkg/compute/regiondrivers/base.go @@ -451,3 +451,11 @@ func (self *SBaseRegionDriver) RequestAssociatEip(ctx context.Context, userCred func (self *SBaseRegionDriver) RequestSyncAccessGroup(ctx context.Context, userCred mcclient.TokenCredential, fs *models.SFileSystem, mt *models.SMountTarget, ag *models.SAccessGroup, task taskman.ITask) error { return errors.Wrapf(cloudprovider.ErrNotImplemented, "RequestSyncAccessGroup") } + +func (self *SBaseRegionDriver) ValidateCreateWafInstanceData(ctx context.Context, userCred mcclient.TokenCredential, input api.WafInstanceCreateInput) (api.WafInstanceCreateInput, error) { + return input, errors.Wrapf(cloudprovider.ErrNotImplemented, "ValidateCreateWafInstanceData") +} + +func (self *SBaseRegionDriver) ValidateCreateWafRuleData(ctx context.Context, userCred mcclient.TokenCredential, waf *models.SWafInstance, input api.WafRuleCreateInput) (api.WafRuleCreateInput, error) { + return input, errors.Wrapf(cloudprovider.ErrNotImplemented, "ValidateCreateWafRuleData") +} diff --git a/pkg/compute/service/handlers.go b/pkg/compute/service/handlers.go index 4afbfccca8..c7594644bb 100644 --- a/pkg/compute/service/handlers.go +++ b/pkg/compute/service/handlers.go @@ -93,6 +93,8 @@ func InitHandlers(app *appsrv.Application) { models.ScheduledTaskLabelManager, models.DnsRecordSetTrafficPolicyManager, models.CloudimageManager, + + models.WafRuleStatementManager, } { db.RegisterModelManager(manager) } @@ -216,6 +218,14 @@ func InitHandlers(app *appsrv.Application) { models.ProjectMappingManager, models.AppGatewayManager, + + models.WafRuleGroupManager, + models.WafIPSetManager, + models.WafIPSetCacheManager, + models.WafRegexSetManager, + models.WafRegexSetCacheManager, + models.WafInstanceManager, + models.WafRuleManager, } { db.RegisterModelManager(manager) handler := db.NewModelHandler(manager) diff --git a/pkg/compute/service/service.go b/pkg/compute/service/service.go index f5d23db195..ab83ade848 100644 --- a/pkg/compute/service/service.go +++ b/pkg/compute/service/service.go @@ -152,6 +152,7 @@ func StartService() { cron.AddJobEveryFewHour("SnapshotsCleanup", 1, 35, 0, models.SnapshotManager.CleanupSnapshots, false) cron.AddJobAtIntervalsWithStartRun("SyncSkus", time.Duration(opts.ServerSkuSyncIntervalMinutes)*time.Minute, models.SyncServerSkus, true) + cron.AddJobAtIntervalsWithStartRun("SyncManagedWafGroups", time.Duration(opts.ServerSkuSyncIntervalMinutes)*time.Minute, models.SyncWafGroups, true) cron.AddJobEveryFewDays("SyncDBInstanceSkus", opts.SyncSkusDay, opts.SyncSkusHour, 0, 0, models.SyncDBInstanceSkus, true) cron.AddJobEveryFewDays("SyncNatSkus", opts.SyncSkusDay, opts.SyncSkusHour, 0, 0, models.SyncNatSkus, false) diff --git a/pkg/compute/tasks/waf_create_task.go b/pkg/compute/tasks/waf_create_task.go new file mode 100644 index 0000000000..3a2171e306 --- /dev/null +++ b/pkg/compute/tasks/waf_create_task.go @@ -0,0 +1,77 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + "time" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafCreateTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafCreateTask{}) +} + +func (self *WafCreateTask) taskFailed(ctx context.Context, waf *models.SWafInstance, err error) { + waf.SetStatus(self.UserCred, api.WAF_STATUS_CREATE_FAILED, err.Error()) + db.OpsLog.LogEvent(waf, db.ACT_ALLOCATE_FAIL, err, self.UserCred) + logclient.AddActionLogWithStartable(self, waf, logclient.ACT_ALLOCATE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafCreateTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + waf := obj.(*models.SWafInstance) + + iRegion, err := waf.GetIRegion() + if err != nil { + self.taskFailed(ctx, waf, errors.Wrapf(err, "GetIRegion")) + return + } + params := api.WafInstanceCreateInput{} + self.GetParams().Unmarshal(¶ms) + opts := &cloudprovider.WafCreateOptions{ + Name: waf.Name, + Desc: waf.Description, + Type: waf.Type, + DefaultAction: waf.DefaultAction, + CloudResources: params.CloudResources, + SourceIps: params.SourceIps, + } + iWaf, err := iRegion.CreateICloudWafInstance(opts) + if err != nil { + self.taskFailed(ctx, waf, errors.Wrapf(err, "CreateICloudWafInstance")) + return + } + cloudprovider.WaitStatus(iWaf, api.WAF_STATUS_AVAILABLE, time.Second*5, time.Minute*5) + waf.SyncWithCloudWafInstance(ctx, self.GetUserCred(), iWaf) + rules, err := iWaf.GetRules() + if err == nil { + waf.SyncWafRules(ctx, self.GetUserCred(), rules) + } + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_delete_task.go b/pkg/compute/tasks/waf_delete_task.go new file mode 100644 index 0000000000..fb95b2a2c7 --- /dev/null +++ b/pkg/compute/tasks/waf_delete_task.go @@ -0,0 +1,73 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + "time" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafDeleteTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafDeleteTask{}) +} + +func (self *WafDeleteTask) taskFailed(ctx context.Context, waf *models.SWafInstance, err error) { + waf.SetStatus(self.UserCred, api.WAF_STATUS_DELETE_FAILED, err.Error()) + logclient.AddActionLogWithStartable(self, waf, logclient.ACT_DELETE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafDeleteTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + waf := obj.(*models.SWafInstance) + iWaf, err := waf.GetICloudWafInstance() + if err != nil { + if errors.Cause(err) == cloudprovider.ErrNotFound { + self.taskComplete(ctx, waf) + return + } + self.taskFailed(ctx, waf, errors.Wrapf(err, "GetICloudWafInstance")) + return + } + err = iWaf.Delete() + if err != nil { + self.taskFailed(ctx, waf, errors.Wrapf(err, "iWaf.Delete")) + return + } + err = cloudprovider.WaitDeleted(iWaf, time.Second*5, time.Minute*5) + if err != nil { + self.taskFailed(ctx, waf, errors.Wrapf(err, "WaitDeleted")) + return + } + self.taskComplete(ctx, waf) +} + +func (self *WafDeleteTask) taskComplete(ctx context.Context, waf *models.SWafInstance) { + waf.RealDelete(ctx, self.GetUserCred()) + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_ipset_cache_delete_task.go b/pkg/compute/tasks/waf_ipset_cache_delete_task.go new file mode 100644 index 0000000000..638b109c0a --- /dev/null +++ b/pkg/compute/tasks/waf_ipset_cache_delete_task.go @@ -0,0 +1,67 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafIPSetCacheDeleteTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafIPSetCacheDeleteTask{}) +} + +func (self *WafIPSetCacheDeleteTask) taskFailed(ctx context.Context, cache *models.SWafIPSetCache, err error) { + cache.SetStatus(self.UserCred, api.WAF_IPSET_STATUS_DELETE_FAILED, err.Error()) + logclient.AddActionLogWithStartable(self, cache, logclient.ACT_DELETE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafIPSetCacheDeleteTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + cache := obj.(*models.SWafIPSetCache) + iCache, err := cache.GetICloudWafIPSet() + if err != nil { + if errors.Cause(err) == cloudprovider.ErrNotFound { + self.taskComplete(ctx, cache) + return + } + self.taskFailed(ctx, cache, errors.Wrapf(err, "GetICloudWafIPSet")) + return + } + err = iCache.Delete() + if err != nil { + self.taskFailed(ctx, cache, errors.Wrapf(err, "iCache.Delete")) + return + } + self.taskComplete(ctx, cache) +} + +func (self *WafIPSetCacheDeleteTask) taskComplete(ctx context.Context, cache *models.SWafIPSetCache) { + cache.RealDelete(ctx, self.GetUserCred()) + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_ipset_delete_task.go b/pkg/compute/tasks/waf_ipset_delete_task.go new file mode 100644 index 0000000000..a6e9e6dd23 --- /dev/null +++ b/pkg/compute/tasks/waf_ipset_delete_task.go @@ -0,0 +1,75 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafIPSetDeleteTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafIPSetDeleteTask{}) +} + +func (self *WafIPSetDeleteTask) taskFailed(ctx context.Context, ipset *models.SWafIPSet, err error) { + ipset.SetStatus(self.UserCred, api.WAF_IPSET_STATUS_DELETE_FAILED, err.Error()) + logclient.AddActionLogWithStartable(self, ipset, logclient.ACT_DELETE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafIPSetDeleteTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + ipset := obj.(*models.SWafIPSet) + caches, err := ipset.GetCaches() + if err != nil { + self.taskFailed(ctx, ipset, errors.Wrapf(err, "GetCaches")) + return + } + for i := range caches { + iCache, err := caches[i].GetICloudWafIPSet() + if err != nil { + if errors.Cause(err) == cloudprovider.ErrNotFound { + caches[i].RealDelete(ctx, self.GetUserCred()) + continue + } + self.taskFailed(ctx, ipset, errors.Wrapf(err, "GetICloudWafIPSet")) + return + } + err = iCache.Delete() + if err != nil { + self.taskFailed(ctx, ipset, errors.Wrapf(err, "iCache.Delete")) + return + } + caches[i].RealDelete(ctx, self.GetUserCred()) + } + self.taskComplete(ctx, ipset) +} + +func (self *WafIPSetDeleteTask) taskComplete(ctx context.Context, ipset *models.SWafIPSet) { + ipset.RealDelete(ctx, self.GetUserCred()) + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_regexset_cache_delete_task.go b/pkg/compute/tasks/waf_regexset_cache_delete_task.go new file mode 100644 index 0000000000..7927fbc2f6 --- /dev/null +++ b/pkg/compute/tasks/waf_regexset_cache_delete_task.go @@ -0,0 +1,67 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafRegexSetCacheDeleteTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafRegexSetCacheDeleteTask{}) +} + +func (self *WafRegexSetCacheDeleteTask) taskFailed(ctx context.Context, cache *models.SWafRegexSetCache, err error) { + cache.SetStatus(self.UserCred, api.WAF_REGEX_SET_STATUS_DELETE_FAILED, err.Error()) + logclient.AddActionLogWithStartable(self, cache, logclient.ACT_DELETE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafRegexSetCacheDeleteTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + cache := obj.(*models.SWafRegexSetCache) + iCache, err := cache.GetICloudWafRegexSet() + if err != nil { + if errors.Cause(err) == cloudprovider.ErrNotFound { + self.taskComplete(ctx, cache) + return + } + self.taskFailed(ctx, cache, errors.Wrapf(err, "GetICloudWafRegexSet")) + return + } + err = iCache.Delete() + if err != nil { + self.taskFailed(ctx, cache, errors.Wrapf(err, "iCache.Delete")) + return + } + self.taskComplete(ctx, cache) +} + +func (self *WafRegexSetCacheDeleteTask) taskComplete(ctx context.Context, cache *models.SWafRegexSetCache) { + cache.RealDelete(ctx, self.GetUserCred()) + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_regexset_delete_task.go b/pkg/compute/tasks/waf_regexset_delete_task.go new file mode 100644 index 0000000000..bf2279bd5c --- /dev/null +++ b/pkg/compute/tasks/waf_regexset_delete_task.go @@ -0,0 +1,75 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafRegexSetDeleteTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafRegexSetDeleteTask{}) +} + +func (self *WafRegexSetDeleteTask) taskFailed(ctx context.Context, regexset *models.SWafRegexSet, err error) { + regexset.SetStatus(self.UserCred, api.WAF_REGEX_SET_STATUS_DELETE_FAILED, err.Error()) + logclient.AddActionLogWithStartable(self, regexset, logclient.ACT_DELETE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafRegexSetDeleteTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + regexset := obj.(*models.SWafRegexSet) + caches, err := regexset.GetCaches() + if err != nil { + self.taskFailed(ctx, regexset, errors.Wrapf(err, "GetCaches")) + return + } + for i := range caches { + iCache, err := caches[i].GetICloudWafRegexSet() + if err != nil { + if errors.Cause(err) == cloudprovider.ErrNotFound { + caches[i].RealDelete(ctx, self.GetUserCred()) + continue + } + self.taskFailed(ctx, regexset, errors.Wrapf(err, "GetICloudWafRegexSet")) + return + } + err = iCache.Delete() + if err != nil { + self.taskFailed(ctx, regexset, errors.Wrapf(err, "iCache.Delete")) + return + } + caches[i].RealDelete(ctx, self.GetUserCred()) + } + self.taskComplete(ctx, regexset) +} + +func (self *WafRegexSetDeleteTask) taskComplete(ctx context.Context, regexset *models.SWafRegexSet) { + regexset.RealDelete(ctx, self.GetUserCred()) + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_rule_create_task.go b/pkg/compute/tasks/waf_rule_create_task.go new file mode 100644 index 0000000000..a73d67ef22 --- /dev/null +++ b/pkg/compute/tasks/waf_rule_create_task.go @@ -0,0 +1,79 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafRuleCreateTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafRuleCreateTask{}) +} + +func (self *WafRuleCreateTask) taskFailed(ctx context.Context, rule *models.SWafRule, err error) { + rule.SetStatus(self.UserCred, api.WAF_RULE_STATUS_CREATE_FAILED, err.Error()) + logclient.AddActionLogWithStartable(self, rule, logclient.ACT_ALLOCATE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafRuleCreateTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + rule := obj.(*models.SWafRule) + iWaf, err := rule.GetICloudWafInstance() + if err != nil { + self.taskFailed(ctx, rule, errors.Wrapf(err, "GetICloudWafInstance")) + return + } + opts := cloudprovider.SWafRule{ + Name: rule.Name, + Desc: rule.Description, + Action: rule.Action, + Priority: rule.Priority, + Statements: []cloudprovider.SWafStatement{}, + } + opts.StatementCondition = rule.StatementConditon + statements, err := rule.GetRuleStatements() + if err != nil { + self.taskFailed(ctx, rule, errors.Wrapf(err, "GetRuleStatements")) + return + } + for i := range statements { + opts.Statements = append(opts.Statements, statements[i].SWafStatement) + } + iRule, err := iWaf.AddRule(&opts) + if err != nil { + self.taskFailed(ctx, rule, errors.Wrapf(err, "iWaf.AddRule")) + return + } + rule.SyncWithCloudRule(ctx, self.GetUserCred(), iRule) + self.taskComplete(ctx, rule) +} + +func (self *WafRuleCreateTask) taskComplete(ctx context.Context, rule *models.SWafRule) { + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_rule_delete_task.go b/pkg/compute/tasks/waf_rule_delete_task.go new file mode 100644 index 0000000000..22b04159e0 --- /dev/null +++ b/pkg/compute/tasks/waf_rule_delete_task.go @@ -0,0 +1,67 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafRuleDeleteTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafRuleDeleteTask{}) +} + +func (self *WafRuleDeleteTask) taskFailed(ctx context.Context, rule *models.SWafRule, err error) { + rule.SetStatus(self.UserCred, api.WAF_RULE_STATUS_DELETE_FAILED, err.Error()) + logclient.AddActionLogWithStartable(self, rule, logclient.ACT_DELETE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafRuleDeleteTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + rule := obj.(*models.SWafRule) + iRule, err := rule.GetICloudWafRule() + if err != nil { + if errors.Cause(err) == cloudprovider.ErrNotFound { + self.taskComplete(ctx, rule) + return + } + self.taskFailed(ctx, rule, errors.Wrapf(err, "GetICloudWafRule")) + return + } + err = iRule.Delete() + if err != nil { + self.taskFailed(ctx, rule, errors.Wrapf(err, "iRule.Delete")) + return + } + self.taskComplete(ctx, rule) +} + +func (self *WafRuleDeleteTask) taskComplete(ctx context.Context, rule *models.SWafRule) { + rule.RealDelete(ctx, self.GetUserCred()) + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_rule_syncstatus_task.go b/pkg/compute/tasks/waf_rule_syncstatus_task.go new file mode 100644 index 0000000000..a82f4068dc --- /dev/null +++ b/pkg/compute/tasks/waf_rule_syncstatus_task.go @@ -0,0 +1,55 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafRuleSyncstatusTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafRuleSyncstatusTask{}) +} + +func (self *WafRuleSyncstatusTask) taskFailed(ctx context.Context, rule *models.SWafRule, err error) { + rule.SetStatus(self.UserCred, api.WAF_RULE_STATUS_UNKNOWN, err.Error()) + logclient.AddActionLogWithStartable(self, rule, logclient.ACT_SYNC_STATUS, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafRuleSyncstatusTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + rule := obj.(*models.SWafRule) + + iRule, err := rule.GetICloudWafRule() + if err != nil { + self.taskFailed(ctx, rule, errors.Wrapf(err, "GetICloudWafRule")) + return + } + + rule.SyncWithCloudRule(ctx, self.GetUserCred(), iRule) + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_rule_update_task.go b/pkg/compute/tasks/waf_rule_update_task.go new file mode 100644 index 0000000000..e0f718fcd3 --- /dev/null +++ b/pkg/compute/tasks/waf_rule_update_task.go @@ -0,0 +1,84 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafRuleUpdateTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafRuleUpdateTask{}) +} + +func (self *WafRuleUpdateTask) taskFailed(ctx context.Context, rule *models.SWafRule, err error) { + rule.SetStatus(self.UserCred, api.WAF_RULE_STATUS_UPDATE_FAILED, err.Error()) + logclient.AddActionLogWithStartable(self, rule, logclient.ACT_UPDATE, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafRuleUpdateTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + rule := obj.(*models.SWafRule) + + iRule, err := rule.GetICloudWafRule() + if err != nil { + self.taskFailed(ctx, rule, errors.Wrapf(err, "GetICloudWafRule")) + return + } + + opts := cloudprovider.SWafRule{ + Name: rule.Name, + Desc: rule.Description, + Action: rule.Action, + Priority: rule.Priority, + Statements: []cloudprovider.SWafStatement{}, + } + + opts.StatementCondition = rule.StatementConditon + statements, err := rule.GetRuleStatements() + if err != nil { + self.taskFailed(ctx, rule, errors.Wrapf(err, "GetRuleStatements")) + return + } + for i := range statements { + opts.Statements = append(opts.Statements, statements[i].SWafStatement) + } + + err = iRule.Update(&opts) + if err != nil { + self.taskFailed(ctx, rule, errors.Wrapf(err, "iRule.Update")) + return + } + + self.taskComplete(ctx, rule) +} + +func (self *WafRuleUpdateTask) taskComplete(ctx context.Context, rule *models.SWafRule) { + rule.SetStatus(self.UserCred, api.WAF_RULE_STATUS_AVAILABLE, "") + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/compute/tasks/waf_syncstatus_task.go b/pkg/compute/tasks/waf_syncstatus_task.go new file mode 100644 index 0000000000..730df8697a --- /dev/null +++ b/pkg/compute/tasks/waf_syncstatus_task.go @@ -0,0 +1,59 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package tasks + +import ( + "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/log" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/compute/models" + "yunion.io/x/onecloud/pkg/util/logclient" +) + +type WafSyncstatusTask struct { + taskman.STask +} + +func init() { + taskman.RegisterTask(WafSyncstatusTask{}) +} + +func (self *WafSyncstatusTask) taskFailed(ctx context.Context, waf *models.SWafInstance, err error) { + waf.SetStatus(self.UserCred, api.WAF_STATUS_UNKNOWN, err.Error()) + logclient.AddActionLogWithStartable(self, waf, logclient.ACT_SYNC_STATUS, err, self.UserCred, false) + self.SetStageFailed(ctx, jsonutils.NewString(err.Error())) +} + +func (self *WafSyncstatusTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) { + waf := obj.(*models.SWafInstance) + iWaf, err := waf.GetICloudWafInstance() + if err != nil { + self.taskFailed(ctx, waf, errors.Wrapf(err, "GetICloudWafInstance")) + return + } + waf.SyncWithCloudWafInstance(ctx, self.GetUserCred(), iWaf) + rules, err := iWaf.GetRules() + if err == nil { + result := waf.SyncWafRules(ctx, self.GetUserCred(), rules) + log.Infof("Sync waf %s rules result: %s", waf.Name, result.Result()) + } + self.SetStageComplete(ctx, nil) +} diff --git a/pkg/mcclient/modules/mod_waf_instances.go b/pkg/mcclient/modules/mod_waf_instances.go new file mode 100644 index 0000000000..3d2efc19f2 --- /dev/null +++ b/pkg/mcclient/modules/mod_waf_instances.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package modules + +import "yunion.io/x/onecloud/pkg/mcclient/modulebase" + +var ( + WafInstances modulebase.ResourceManager +) + +func init() { + WafInstances = NewComputeManager("waf_instance", "waf_instances", + []string{"ID", "Name", "Enabled", "Status", "Cloudregion_Id", "Region", "Rules", "Public_Scope", "Domain_Id", "Domain", "Metadata"}, + []string{}) + + registerCompute(&WafInstances) +} diff --git a/pkg/mcclient/modules/mod_waf_ipset_caches.go b/pkg/mcclient/modules/mod_waf_ipset_caches.go new file mode 100644 index 0000000000..a953636318 --- /dev/null +++ b/pkg/mcclient/modules/mod_waf_ipset_caches.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package modules + +import "yunion.io/x/onecloud/pkg/mcclient/modulebase" + +var ( + WafIPSetCaches modulebase.ResourceManager +) + +func init() { + WafIPSetCaches = NewComputeManager("waf_ipset_cache", "waf_ipset_caches", + []string{"ID", "Name", "Status", "Cloudregion", "Provider", "Account", "Type", "Domain_Id", "Domain", "Metadata"}, + []string{}) + + registerCompute(&WafIPSetCaches) +} diff --git a/pkg/mcclient/modules/mod_waf_ipsets.go b/pkg/mcclient/modules/mod_waf_ipsets.go new file mode 100644 index 0000000000..dcf8464df1 --- /dev/null +++ b/pkg/mcclient/modules/mod_waf_ipsets.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package modules + +import "yunion.io/x/onecloud/pkg/mcclient/modulebase" + +var ( + WafIPSets modulebase.ResourceManager +) + +func init() { + WafIPSets = NewComputeManager("waf_ipset", "waf_ipsets", + []string{"ID", "Name", "Status", "Addresses", "Domain_Id", "Domain", "Metadata"}, + []string{}) + + registerCompute(&WafIPSets) +} diff --git a/pkg/mcclient/modules/mod_waf_regexset_caches.go b/pkg/mcclient/modules/mod_waf_regexset_caches.go new file mode 100644 index 0000000000..777b902423 --- /dev/null +++ b/pkg/mcclient/modules/mod_waf_regexset_caches.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package modules + +import "yunion.io/x/onecloud/pkg/mcclient/modulebase" + +var ( + WafRegexSetCaches modulebase.ResourceManager +) + +func init() { + WafRegexSetCaches = NewComputeManager("waf_regexset_cache", "waf_regexset_caches", + []string{"ID", "Name", "Status", "Cloudregion", "Provider", "Account", "Type", "Domain_Id", "Domain", "Metadata"}, + []string{}) + + registerCompute(&WafRegexSetCaches) +} diff --git a/pkg/mcclient/modules/mod_waf_regexsets.go b/pkg/mcclient/modules/mod_waf_regexsets.go new file mode 100644 index 0000000000..d559b491fe --- /dev/null +++ b/pkg/mcclient/modules/mod_waf_regexsets.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package modules + +import "yunion.io/x/onecloud/pkg/mcclient/modulebase" + +var ( + WafRegexSets modulebase.ResourceManager +) + +func init() { + WafRegexSets = NewComputeManager("waf_regexset", "waf_regexsets", + []string{"ID", "Name", "Status", "Addresses", "Domain_Id", "Domain", "Metadata"}, + []string{}) + + registerCompute(&WafRegexSets) +} diff --git a/pkg/mcclient/modules/mod_waf_rule_groups.go b/pkg/mcclient/modules/mod_waf_rule_groups.go new file mode 100644 index 0000000000..d8982af99e --- /dev/null +++ b/pkg/mcclient/modules/mod_waf_rule_groups.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package modules + +import "yunion.io/x/onecloud/pkg/mcclient/modulebase" + +var ( + WafRuleGroups modulebase.ResourceManager +) + +func init() { + WafRuleGroups = NewComputeManager("waf_rule_group", "waf_rule_groups", + []string{"ID", "Name", "Status", "Domain_Id", "Domain", "Is_System", "Rules"}, + []string{}) + + registerCompute(&WafRuleGroups) +} diff --git a/pkg/mcclient/modules/mod_waf_rules.go b/pkg/mcclient/modules/mod_waf_rules.go new file mode 100644 index 0000000000..cf45b17e71 --- /dev/null +++ b/pkg/mcclient/modules/mod_waf_rules.go @@ -0,0 +1,29 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package modules + +import "yunion.io/x/onecloud/pkg/mcclient/modulebase" + +var ( + WafRules modulebase.ResourceManager +) + +func init() { + WafRules = NewComputeManager("waf_rule", "waf_rules", + []string{"ID", "Name", "Status", "Priority", "Action", "Statement_Condition", "Statements"}, + []string{}) + + registerCompute(&WafRules) +} diff --git a/pkg/mcclient/options/compute/waf_instances.go b/pkg/mcclient/options/compute/waf_instances.go new file mode 100644 index 0000000000..a8a4ae3534 --- /dev/null +++ b/pkg/mcclient/options/compute/waf_instances.go @@ -0,0 +1,40 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/jsonutils" + + "yunion.io/x/onecloud/pkg/mcclient/options" +) + +type WafInstanceListOptions struct { + options.BaseListOptions +} + +func (opts *WafInstanceListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} + +type WafInstanceCreateOptions struct { + options.BaseCreateOptions + CloudregionId string + CloudproviderId string + SourceIps []string +} + +func (opts *WafInstanceCreateOptions) Params() (jsonutils.JSONObject, error) { + return jsonutils.Marshal(opts), nil +} diff --git a/pkg/mcclient/options/compute/waf_ipsets.go b/pkg/mcclient/options/compute/waf_ipsets.go new file mode 100644 index 0000000000..65b1c5dcc3 --- /dev/null +++ b/pkg/mcclient/options/compute/waf_ipsets.go @@ -0,0 +1,37 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/jsonutils" + + "yunion.io/x/onecloud/pkg/mcclient/options" +) + +type WafIPSetListOptions struct { + options.BaseListOptions +} + +func (opts *WafIPSetListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} + +type WafIPSetCacheListOptions struct { + options.BaseListOptions +} + +func (opts *WafIPSetCacheListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} diff --git a/pkg/mcclient/options/compute/waf_regexsets.go b/pkg/mcclient/options/compute/waf_regexsets.go new file mode 100644 index 0000000000..99bb622497 --- /dev/null +++ b/pkg/mcclient/options/compute/waf_regexsets.go @@ -0,0 +1,37 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/jsonutils" + + "yunion.io/x/onecloud/pkg/mcclient/options" +) + +type WafRegexSetListOptions struct { + options.BaseListOptions +} + +func (opts *WafRegexSetListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} + +type WafRegexSetCacheListOptions struct { + options.BaseListOptions +} + +func (opts *WafRegexSetCacheListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} diff --git a/pkg/mcclient/options/compute/waf_rule_groups.go b/pkg/mcclient/options/compute/waf_rule_groups.go new file mode 100644 index 0000000000..fbebfe9e15 --- /dev/null +++ b/pkg/mcclient/options/compute/waf_rule_groups.go @@ -0,0 +1,39 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "yunion.io/x/jsonutils" + + "yunion.io/x/onecloud/pkg/mcclient/options" +) + +type WafRuleGroupListOptions struct { + options.BaseListOptions + + IsSystem bool +} + +func (opts *WafRuleGroupListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} + +type WafRuleGroupCacheListOptions struct { + options.BaseListOptions +} + +func (opts *WafRuleGroupCacheListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} diff --git a/pkg/mcclient/options/compute/waf_rules.go b/pkg/mcclient/options/compute/waf_rules.go new file mode 100644 index 0000000000..452790098d --- /dev/null +++ b/pkg/mcclient/options/compute/waf_rules.go @@ -0,0 +1,60 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package compute + +import ( + "io/ioutil" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + "yunion.io/x/onecloud/pkg/mcclient/options" +) + +type WafRuleListOptions struct { + options.BaseListOptions + + WafInstanceId string + WafRuleGroupId string +} + +func (opts *WafRuleListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} + +type WafRuleOptions struct { + RULE_FILE string +} + +func (opts *WafRuleOptions) Params() (jsonutils.JSONObject, error) { + data, err := ioutil.ReadFile(opts.RULE_FILE) + if err != nil { + return nil, errors.Wrapf(err, "ioutils.ReadFile") + } + ret, err := jsonutils.Parse(data) + if err != nil { + return nil, err + } + return ret, nil +} + +type WafRuleUpdateOptions struct { + options.BaseIdOptions + WafRuleOptions +} + +func (opts *WafRuleUpdateOptions) Params() (jsonutils.JSONObject, error) { + return opts.WafRuleOptions.Params() +} diff --git a/pkg/multicloud/aliyun/aliyun.go b/pkg/multicloud/aliyun/aliyun.go index 991c9d2e87..4c16d6cf3f 100644 --- a/pkg/multicloud/aliyun/aliyun.go +++ b/pkg/multicloud/aliyun/aliyun.go @@ -65,6 +65,7 @@ const ( ALIYUN_CDN_API_VERSION = "2018-05-10" ALIYUN_IMS_API_VERSION = "2019-08-15" ALIYUN_NAS_API_VERSION = "2017-06-26" + ALIYUN_WAF_API_VERSION = "2019-09-10" ALIYUN_SERVICE_ECS = "ecs" ALIYUN_SERVICE_VPC = "vpc" @@ -179,7 +180,10 @@ func jsonRequest(client *sdk.Client, domain, apiVersion, apiName string, params "OperationUnsupported.EipNatBWPCheck": // create nat snat retry = true default: - if strings.HasPrefix(code, "EntityNotExist.") || strings.HasSuffix(code, ".NotFound") { + if strings.HasPrefix(code, "EntityNotExist.") || strings.HasSuffix(code, ".NotFound") || strings.HasSuffix(code, "NotExist") { + if strings.HasPrefix(apiName, "Delete") { + return jsonutils.NewDict(), nil + } return nil, errors.Wrap(cloudprovider.ErrNotFound, err.Error()) } return nil, err @@ -639,6 +643,7 @@ func (region *SAliyunClient) GetCapabilities() []string { cloudprovider.CLOUD_CAPABILITY_SAML_AUTH, cloudprovider.CLOUD_CAPABILITY_NAT, cloudprovider.CLOUD_CAPABILITY_NAS, + cloudprovider.CLOUD_CAPABILITY_WAF, } return caps } diff --git a/pkg/multicloud/aliyun/region.go b/pkg/multicloud/aliyun/region.go index dcdba34b47..3c4934a0f9 100644 --- a/pkg/multicloud/aliyun/region.go +++ b/pkg/multicloud/aliyun/region.go @@ -136,6 +136,18 @@ func (self *SRegion) ecsRequest(apiName string, params map[string]string) (jsonu return jsonRequest(client, endpoint, ALIYUN_API_VERSION, apiName, params, self.client.debug) } +func (self *SRegion) wafRequest(apiName string, params map[string]string) (jsonutils.JSONObject, error) { + client, err := self.getSdkClient() + if err != nil { + return nil, err + } + if self.RegionId != "cn-hangzhou" && self.RegionId != "ap-southeast-1" { + return nil, cloudprovider.ErrNotSupported + } + endpoint := fmt.Sprintf("wafopenapi.%s.aliyuncs.com", self.RegionId) + return jsonRequest(client, endpoint, ALIYUN_WAF_API_VERSION, apiName, params, self.client.debug) +} + func (self *SRegion) rdsRequest(apiName string, params map[string]string) (jsonutils.JSONObject, error) { client, err := self.getSdkClient() if err != nil { diff --git a/pkg/multicloud/aliyun/shell/waf.go b/pkg/multicloud/aliyun/shell/waf.go new file mode 100644 index 0000000000..91a3da9f7d --- /dev/null +++ b/pkg/multicloud/aliyun/shell/waf.go @@ -0,0 +1,73 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package shell + +import ( + "fmt" + + "yunion.io/x/pkg/errors" + + "yunion.io/x/onecloud/pkg/multicloud/aliyun" + "yunion.io/x/onecloud/pkg/util/shellutils" +) + +func init() { + type WafShowOptions struct { + } + shellutils.R(&WafShowOptions{}, "waf-instance-show", "Show waf instance", func(cli *aliyun.SRegion, args *WafShowOptions) error { + waf, err := cli.DescribeInstanceSpecInfo() + if err != nil { + return err + } + printObject(waf) + return nil + }) + + type WafIdOptions struct { + ID string + } + + shellutils.R(&WafIdOptions{}, "waf-instance-delete", "Delete waf instance", func(cli *aliyun.SRegion, args *WafIdOptions) error { + return cli.DeleteInstance(args.ID) + }) + + shellutils.R(&WafIdOptions{}, "waf-domain-list", "List waf instance domains", func(cli *aliyun.SRegion, args *WafIdOptions) error { + domains, err := cli.DescribeDomainNames(args.ID) + if err != nil { + return errors.Wrapf(err, "DescribeDomainNames") + } + fmt.Println("domains: ", domains) + return nil + }) + + type WafDomainIdOptions struct { + ID string + DOMAIN string + } + + shellutils.R(&WafDomainIdOptions{}, "waf-domain-show", "Show waf domain", func(cli *aliyun.SRegion, args *WafDomainIdOptions) error { + domain, err := cli.DescribeDomain(args.ID, args.DOMAIN) + if err != nil { + return err + } + printObject(domain) + return nil + }) + + shellutils.R(&WafDomainIdOptions{}, "waf-domain-delete", "Delete waf domain", func(cli *aliyun.SRegion, args *WafDomainIdOptions) error { + return cli.DeleteDomain(args.ID, args.DOMAIN) + }) + +} diff --git a/pkg/multicloud/aliyun/waf.go b/pkg/multicloud/aliyun/waf.go new file mode 100644 index 0000000000..ef8a2f7d97 --- /dev/null +++ b/pkg/multicloud/aliyun/waf.go @@ -0,0 +1,61 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package aliyun + +import ( + "yunion.io/x/pkg/errors" + + "yunion.io/x/onecloud/pkg/cloudprovider" +) + +type SInstanceSpecs struct { + Code int + Value bool +} + +type SWafInstance struct { + Version string + InstanceSpecInfos []SInstanceSpecs + InstanceId string + ExpireTime uint64 +} + +func (self *SRegion) DescribeInstanceSpecInfo() (*SWafInstance, error) { + params := map[string]string{ + "RegionId": self.RegionId, + } + resp, err := self.wafRequest("DescribeInstanceSpecInfo", params) + if err != nil { + return nil, errors.Wrapf(err, "DescribeInstanceSpecInfo") + } + ret := &SWafInstance{} + err = resp.Unmarshal(&ret) + if err != nil { + return nil, errors.Wrapf(err, "resp.Unmarshal") + } + if len(ret.InstanceId) == 0 { + return nil, cloudprovider.ErrNotFound + } + return ret, nil +} + +func (self *SRegion) DeleteInstance(id string) error { + params := map[string]string{ + "RegionId": self.RegionId, + "InstanceId": id, + } + _, err := self.wafRequest("DeleteInstance", params) + return errors.Wrapf(err, "DeleteInstance") +} diff --git a/pkg/multicloud/aliyun/waf_domain.go b/pkg/multicloud/aliyun/waf_domain.go new file mode 100644 index 0000000000..e59eac0806 --- /dev/null +++ b/pkg/multicloud/aliyun/waf_domain.go @@ -0,0 +1,502 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package aliyun + +import ( + "fmt" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/multicloud" +) + +type SWafDomain struct { + multicloud.SResourceBase + multicloud.AliyunTags + region *SRegion + + insId string + name string + Httptouserip int `json:"HttpToUserIp"` + Httpport []int `json:"HttpPort"` + Isaccessproduct int `json:"IsAccessProduct"` + Resourcegroupid string `json:"ResourceGroupId"` + Readtime int `json:"ReadTime"` + Sourceips []string `json:"SourceIps"` + Ipfollowstatus int `json:"IpFollowStatus"` + Clustertype int `json:"ClusterType"` + Loadbalancing int `json:"LoadBalancing"` + Cname string `json:"Cname"` + Writetime int `json:"WriteTime"` + HTTP2Port []interface{} `json:"Http2Port"` + Version int `json:"Version"` + Httpsredirect int `json:"HttpsRedirect"` + Connectiontime int `json:"ConnectionTime"` + Accesstype string `json:"AccessType"` + Httpsport []interface{} `json:"HttpsPort"` +} + +func (self *SRegion) DescribeDomain(id, domain string) (*SWafDomain, error) { + params := map[string]string{ + "RegionId": self.RegionId, + "InstanceId": id, + "Domain": domain, + } + resp, err := self.wafRequest("DescribeDomain", params) + if err != nil { + return nil, errors.Wrapf(err, "DescribeDomain") + } + ret := &SWafDomain{region: self, name: domain, insId: id} + err = resp.Unmarshal(ret, "Domain") + if err != nil { + return nil, errors.Wrapf(err, "resp.Unmarshal") + } + return ret, nil +} + +func (self *SRegion) DeleteDomain(id, domain string) error { + params := map[string]string{ + "RegionId": self.RegionId, + "InstanceId": id, + "Domain": domain, + } + _, err := self.wafRequest("DeleteDomain", params) + return errors.Wrapf(err, "DeleteDomain") +} + +func (self *SRegion) DescribeDomainNames(id string) ([]string, error) { + params := map[string]string{ + "RegionId": self.RegionId, + "InstanceId": id, + } + resp, err := self.wafRequest("DescribeDomainNames", params) + if err != nil { + return nil, errors.Wrapf(err, "DescribeDomainNames") + } + domains := []string{} + err = resp.Unmarshal(&domains, "DomainNames") + return domains, errors.Wrapf(err, "resp.Unmarshal") +} + +func (self *SRegion) SetDomainRuleGroup(insId, domain, ruleGroupId string) error { + params := map[string]string{ + "RegionId": self.RegionId, + "InstanceId": insId, + "Domains": domain, + "RuleGroupId": ruleGroupId, + } + _, err := self.wafRequest("SetDomainRuleGroup", params) + return err +} + +func (self *SRegion) DescribeDomainRuleGroup(insId, domain string) (string, error) { + params := map[string]string{ + "RegionId": self.RegionId, + "InstanceId": insId, + "Domain": domain, + } + resp, err := self.wafRequest("DescribeDomainRuleGroup", params) + if err != nil { + return "", errors.Wrapf(err, "DescribeDomainRuleGroup") + } + return resp.GetString("RuleGroupId") +} + +func (self *SRegion) GetICloudWafInstances() ([]cloudprovider.ICloudWafInstance, error) { + ins, err := self.DescribeInstanceSpecInfo() + if err != nil { + if errors.Cause(err) == cloudprovider.ErrNotFound { + return []cloudprovider.ICloudWafInstance{}, nil + } + return nil, errors.Wrapf(err, "DescribeInstanceSpecInfo") + } + domains, err := self.DescribeDomainNames(ins.InstanceId) + if err != nil { + return nil, errors.Wrapf(err, "DescribeDomainNames") + } + ret := []cloudprovider.ICloudWafInstance{} + for i := range domains { + domain, err := self.DescribeDomain(ins.InstanceId, domains[i]) + if err != nil { + return nil, errors.Wrapf(err, "DescribeDomain %s", domains[i]) + } + domain.region = self + domain.insId = ins.InstanceId + domain.name = domains[i] + ret = append(ret, domain) + } + return ret, nil +} + +func (self *SRegion) GetICloudWafInstanceById(id string) (cloudprovider.ICloudWafInstance, error) { + ins, err := self.DescribeInstanceSpecInfo() + if err != nil { + return nil, errors.Wrapf(err, "DescribeInstanceSpecInfo") + } + return self.DescribeDomain(ins.InstanceId, id) +} + +func (self *SWafDomain) GetId() string { + return self.name +} + +func (self *SWafDomain) GetStatus() string { + return api.WAF_STATUS_AVAILABLE +} + +func (self *SWafDomain) GetWafType() cloudprovider.TWafType { + return cloudprovider.WafTypeDefault +} + +func (self *SWafDomain) GetEnabled() bool { + return true +} + +func (self *SWafDomain) GetName() string { + return self.name +} + +func (self *SWafDomain) GetGlobalId() string { + return self.name +} + +func (self *SWafDomain) Delete() error { + return self.region.DeleteDomain(self.insId, self.name) +} + +func (self *SWafDomain) GetDefaultAction() *cloudprovider.DefaultAction { + return &cloudprovider.DefaultAction{ + Action: cloudprovider.WafActionAllow, + InsertHeaders: map[string]string{}, + } +} + +type ManagedRuleGroup struct { + waf *SWafDomain + + insId string + domain string + ruleGroupId string +} + +func (self *ManagedRuleGroup) GetName() string { + return "RuleGroup" +} + +func (self *ManagedRuleGroup) GetDesc() string { + return "规则组" +} + +func (self *ManagedRuleGroup) GetGlobalId() string { + return fmt.Sprintf("%s-%s", self.insId, self.domain) +} + +func (self *ManagedRuleGroup) GetPriority() int { + return 0 +} + +func (self *ManagedRuleGroup) GetAction() *cloudprovider.DefaultAction { + return nil +} + +func (self *ManagedRuleGroup) Delete() error { + return cloudprovider.ErrNotSupported +} + +func (self *ManagedRuleGroup) Update(opts *cloudprovider.SWafRule) error { + for _, statement := range opts.Statements { + if len(statement.RuleGroupId) == 0 { + return self.waf.region.SetDomainRuleGroup(self.insId, self.domain, statement.RuleGroupId) + } else if len(statement.ManagedRuleGroupName) > 0 { + switch statement.ManagedRuleGroupName { + case "严格规则": + return self.waf.region.SetDomainRuleGroup(self.insId, self.domain, "1011") + case "中等规则": + return self.waf.region.SetDomainRuleGroup(self.insId, self.domain, "1012") + case "宽松规则": + return self.waf.region.SetDomainRuleGroup(self.insId, self.domain, "1013") + } + } + } + return nil +} + +func (self *ManagedRuleGroup) GetStatementCondition() cloudprovider.TWafStatementCondition { + return cloudprovider.WafStatementConditionNone +} + +func (self *ManagedRuleGroup) GetStatements() ([]cloudprovider.SWafStatement, error) { + groupName := self.ruleGroupId + switch self.ruleGroupId { + case "1011": + groupName = "严格规则" + case "1012": + groupName = "中等规则" + case "1013": + groupName = "宽松规则" + } + return []cloudprovider.SWafStatement{ + cloudprovider.SWafStatement{ + ManagedRuleGroupName: groupName, + RuleGroupId: self.ruleGroupId, + }, + }, nil +} + +type SDefenseTypeRule struct { + insId string + domain string + defenseType string + action cloudprovider.TWafAction +} + +func (self *SDefenseTypeRule) GetName() string { + switch self.defenseType { + case "waf": + return "正则防护引擎" + case "dld": + return "大数据深度学习引擎" + case "ac_cc": + return "CC安全防护" + case "antifraud": + return "数据风控" + case "normalized": + return "主动防御" + } + return self.defenseType +} + +func (self *SDefenseTypeRule) GetDesc() string { + return "" +} + +func (self *SDefenseTypeRule) GetGlobalId() string { + return fmt.Sprintf("%s-%s-%s", self.insId, self.domain, self.defenseType) +} + +func (self *SDefenseTypeRule) GetPriority() int { + return 0 +} + +func (self *SDefenseTypeRule) GetAction() *cloudprovider.DefaultAction { + return &cloudprovider.DefaultAction{ + Action: self.action, + } +} + +func (self *SDefenseTypeRule) GetStatementCondition() cloudprovider.TWafStatementCondition { + return cloudprovider.WafStatementConditionNone +} + +func (self *SDefenseTypeRule) GetStatements() ([]cloudprovider.SWafStatement, error) { + return []cloudprovider.SWafStatement{}, nil +} + +func (self *SDefenseTypeRule) Delete() error { + return cloudprovider.ErrNotSupported +} + +func (self *SDefenseTypeRule) Update(opts *cloudprovider.SWafRule) error { + return cloudprovider.ErrNotSupported +} + +func (self *SWafDomain) GetRules() ([]cloudprovider.ICloudWafRule, error) { + ruleGroupId, err := self.region.DescribeDomainRuleGroup(self.insId, self.name) + if err != nil { + return nil, errors.Wrapf(err, "DescribeDomainRuleGroup") + } + ret := []cloudprovider.ICloudWafRule{} + ret = append(ret, &ManagedRuleGroup{ + waf: self, + insId: self.insId, + domain: self.name, + ruleGroupId: ruleGroupId, + }) + for _, defenseType := range []string{ + "waf", + "dld", + "ac_cc", + "antifraud", + "normalized", + } { + act, _ := self.region.DescribeProtectionModuleMode(self.insId, self.name, defenseType) + ret = append(ret, &SDefenseTypeRule{ + insId: self.insId, + domain: self.name, + defenseType: defenseType, + action: act, + }) + } + return ret, nil +} + +type SIpSegement struct { + IpV6s string + Ips string +} + +func (self *SRegion) DescribeWafSourceIpSegment(insId string) (*SIpSegement, error) { + params := map[string]string{ + "RegionId": self.RegionId, + "InstanceId": insId, + } + resp, err := self.wafRequest("DescribeWafSourceIpSegment", params) + if err != nil { + return nil, errors.Wrapf(err, "DescribeWafSourceIpSegment") + } + ret := &SIpSegement{} + err = resp.Unmarshal(ret) + if err != nil { + return nil, errors.Wrapf(err, "") + } + return ret, nil +} + +func (self *SRegion) CreateICloudWafInstance(opts *cloudprovider.WafCreateOptions) (cloudprovider.ICloudWafInstance, error) { + ins, err := self.DescribeInstanceSpecInfo() + if err != nil { + return nil, errors.Wrapf(err, "DescribeInstanceSpecInfo") + } + waf, err := self.CreateDomain(ins.InstanceId, opts.Name, opts.SourceIps, opts.CloudResources) + if err != nil { + return nil, errors.Wrapf(err, "CreateDomain") + } + return waf, nil +} + +func (self *SRegion) CreateDomain(insId, domain string, sourceIps []string, cloudResources []cloudprovider.SCloudResource) (*SWafDomain, error) { + params := map[string]string{ + "RegionId": self.RegionId, + "InstanceId": insId, + "Domain": domain, + "IsAccessProduct": "0", + "HttpPort": `["80"]`, + "HttpsPort": `["443"]`, + "Http2Port": `["80", "443"]`, + } + if len(sourceIps) > 0 { + params["SourceIps"] = jsonutils.Marshal(sourceIps).String() + params["AccessType"] = "waf-cloud-dns" + } else if len(cloudResources) > 0 { + ins := jsonutils.NewArray() + for _, res := range cloudResources { + ins.Add(jsonutils.Marshal(map[string]interface{}{"InstanceId": res.Id, "Port": res.Port})) + } + params["CloudNativeInstances"] = ins.String() + params["AccessType"] = "waf-cloud-native" + } else { + return nil, errors.Error("missing source ips") + } + _, err := self.wafRequest("CreateDomain", params) + if err != nil { + return nil, errors.Wrapf(err, "CreateDomain") + } + return self.DescribeDomain(insId, domain) +} + +func (self *SWafDomain) AddRule(opts *cloudprovider.SWafRule) (cloudprovider.ICloudWafRule, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotSupported, "AddRule") +} + +func (self *SWafDomain) Refresh() error { + domain, err := self.region.DescribeDomain(self.insId, self.name) + if err != nil { + return errors.Wrapf(err, "DescribeDomain") + } + return jsonutils.Update(self, domain) +} + +func (self *SWafDomain) GetCloudResources() ([]cloudprovider.SCloudResource, error) { + ret := []cloudprovider.SCloudResource{} + if len(self.Cname) > 0 { + ret = append(ret, cloudprovider.SCloudResource{ + Type: "cname", + Id: self.Cname, + CanDissociate: false, + }) + } + ipseg, err := self.region.DescribeWafSourceIpSegment(self.insId) + if err == nil { + ret = append(ret, cloudprovider.SCloudResource{ + Type: "segment_ipv4", + Id: ipseg.Ips, + CanDissociate: false, + }) + ret = append(ret, cloudprovider.SCloudResource{ + Type: "segment_ipv6", + Id: ipseg.IpV6s, + CanDissociate: false, + }) + } + return ret, nil +} + +func (self *SRegion) DescribeProtectionModuleMode(insId, domain, defenseType string) (cloudprovider.TWafAction, error) { + params := map[string]string{ + "RegionId": self.RegionId, + "Domain": domain, + "InstanceId": insId, + "DefenseType": defenseType, + } + resp, err := self.wafRequest("DescribeProtectionModuleMode", params) + if err != nil { + return cloudprovider.WafActionNone, errors.Wrapf(err, "DescribeProtectionModuleMode %s", defenseType) + } + if !resp.Contains("Mode") { + return cloudprovider.WafActionNone, nil + } + mode, _ := resp.Int("Mode") + switch defenseType { + case "waf": + if mode == 0 { + return cloudprovider.WafActionBlock, nil + } + if mode == 1 { + return cloudprovider.WafActionAlert, nil + } + case "dld": + if mode == 0 { + return cloudprovider.WafActionAlert, nil + } + if mode == 1 { + return cloudprovider.WafActionBlock, nil + } + case "ac_cc": + if mode == 0 { + return cloudprovider.WafActionAllow, nil + } + if mode == 1 { + return cloudprovider.WafActionBlock, nil + } + case "antifraud": + if mode == 0 { + return cloudprovider.WafActionAlert, nil + } + if mode == 1 || mode == 2 { + return cloudprovider.WafActionBlock, nil + } + case "normalized": + if mode == 0 { + return cloudprovider.WafActionAlert, nil + } + if mode == 1 { + return cloudprovider.WafActionBlock, nil + } + } + return cloudprovider.WafActionNone, nil +} diff --git a/pkg/multicloud/aws/aws.go b/pkg/multicloud/aws/aws.go index e7f1b68fd1..ecc6117c95 100644 --- a/pkg/multicloud/aws/aws.go +++ b/pkg/multicloud/aws/aws.go @@ -586,6 +586,7 @@ func (self *SAwsClient) GetCapabilities() []string { cloudprovider.CLOUD_CAPABILITY_CLOUDID, cloudprovider.CLOUD_CAPABILITY_DNSZONE, cloudprovider.CLOUD_CAPABILITY_SAML_AUTH, + cloudprovider.CLOUD_CAPABILITY_WAF, } return caps } diff --git a/pkg/multicloud/aws/region.go b/pkg/multicloud/aws/region.go index 5e02e6da88..358991d795 100644 --- a/pkg/multicloud/aws/region.go +++ b/pkg/multicloud/aws/region.go @@ -39,6 +39,7 @@ import ( "github.com/aws/aws-sdk-go/service/organizations" "github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi" "github.com/aws/aws-sdk-go/service/s3" + "github.com/aws/aws-sdk-go/service/wafv2" "yunion.io/x/jsonutils" "yunion.io/x/log" @@ -139,6 +140,7 @@ type SRegion struct { s3Client *s3.S3 elbv2Client *elbv2.ELBV2 acmClient *acm.ACM + wafClient *wafv2.WAFV2 organizationClient *organizations.Organizations resourceGroupTagClient *resourcegroupstaggingapi.ResourceGroupsTaggingAPI @@ -189,6 +191,17 @@ func (self *SRegion) getIamClient() (*iam.IAM, error) { return self.iamClient, nil } +func (self *SRegion) getWafClient() (*wafv2.WAFV2, error) { + if self.wafClient == nil { + s, err := self.getAwsSession() + if err != nil { + return nil, errors.Wrapf(err, "getAwsSession") + } + self.wafClient = wafv2.New(s) + } + return self.wafClient, nil +} + func (self *SRegion) GetS3Client() (*s3.S3, error) { if self.s3Client == nil { s, err := self.getAwsSession() diff --git a/pkg/multicloud/aws/shell/waf.go b/pkg/multicloud/aws/shell/waf.go new file mode 100644 index 0000000000..85e95160ba --- /dev/null +++ b/pkg/multicloud/aws/shell/waf.go @@ -0,0 +1,210 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package shell + +import ( + "fmt" + "io/ioutil" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/multicloud/aws" + "yunion.io/x/onecloud/pkg/util/shellutils" +) + +func init() { + type WafRuleGroupListOptions struct { + Scope string `choices:"CLOUDFRONT|REGIONAL" default:"REGIONAL"` + } + + shellutils.R(&WafRuleGroupListOptions{}, "waf-managed-rule-group-list", "List waf managed rule group", func(cli *aws.SRegion, args *WafRuleGroupListOptions) error { + groups, err := cli.ListAvailableManagedRuleGroups(args.Scope) + if err != nil { + return err + } + printList(groups, 0, 0, 0, []string{}) + return nil + }) + + shellutils.R(&WafRuleGroupListOptions{}, "waf-rule-group-list", "List waf rule group", func(cli *aws.SRegion, args *WafRuleGroupListOptions) error { + groups, err := cli.ListRuleGroups(args.Scope) + if err != nil { + return err + } + printList(groups, 0, 0, 0, []string{}) + return nil + }) + + type WafRuleGroupShowOptions struct { + ID string + NAME string + SCOPE string + } + + shellutils.R(&WafRuleGroupShowOptions{}, "waf-rule-group-show", "Show waf rule group", func(cli *aws.SRegion, args *WafRuleGroupShowOptions) error { + group, err := cli.GetRuleGroup(args.ID, args.NAME, args.SCOPE) + if err != nil { + return err + } + printObject(group) + return nil + }) + + type WafManagedRuleGroupShowOptions struct { + NAME string + SCOPE string + VendorName string `default:"AWS"` + } + + shellutils.R(&WafManagedRuleGroupShowOptions{}, "waf-managed-rule-group-show", "Show waf rule group", func(cli *aws.SRegion, args *WafManagedRuleGroupShowOptions) error { + group, err := cli.DescribeManagedRuleGroup(args.NAME, args.SCOPE, args.VendorName) + if err != nil { + return err + } + printObject(group) + return nil + }) + + type RuleGroupDeleteOptions struct { + ID string + NAME string + SCOPE string + LOCK_TOKEN string + } + + shellutils.R(&RuleGroupDeleteOptions{}, "waf-rule-group-delete", "Delete waf ip set", func(cli *aws.SRegion, args *RuleGroupDeleteOptions) error { + return cli.DeleteRuleGroup(args.ID, args.NAME, args.SCOPE, args.LOCK_TOKEN) + }) + + type IPSetListOptions struct { + Scope string `choices:"CLOUDFRONT|REGIONAL" default:"REGIONAL"` + } + + shellutils.R(&IPSetListOptions{}, "waf-ipset-list", "List waf ip sets", func(cli *aws.SRegion, args *IPSetListOptions) error { + ipsets, err := cli.ListIPSets(args.Scope) + if err != nil { + return err + } + printList(ipsets, 0, 0, 0, []string{}) + return nil + }) + + type WafIPSetShowOptions struct { + ID string + NAME string + SCOPE string + } + + shellutils.R(&WafIPSetShowOptions{}, "waf-ipset-show", "Show waf ip sets", func(cli *aws.SRegion, args *WafIPSetShowOptions) error { + ipset, err := cli.GetIPSet(args.ID, args.NAME, args.SCOPE) + if err != nil { + return err + } + printObject(ipset) + return nil + }) + + type WafIPSetDeleteOptions struct { + ID string + NAME string + SCOPE string + LOCK_TOKEN string + } + + shellutils.R(&WafIPSetDeleteOptions{}, "waf-ipset-delete", "Delete waf ip set", func(cli *aws.SRegion, args *WafIPSetDeleteOptions) error { + return cli.DeleteIPSet(args.ID, args.NAME, args.SCOPE, args.LOCK_TOKEN) + }) + + type WafListOptions struct { + Scope string `choices:"CLOUDFRONT|REGIONAL" default:"REGIONAL"` + } + + shellutils.R(&WafListOptions{}, "waf-list", "List web acls", func(cli *aws.SRegion, args *WafListOptions) error { + acls, err := cli.ListWebACLs(args.Scope) + if err != nil { + return err + } + printList(acls, 0, 0, 0, []string{}) + return nil + }) + + type WafShowOptions struct { + ID string + NAME string + SCOPE string + } + + shellutils.R(&WafShowOptions{}, "waf-show", "Show web acl", func(cli *aws.SRegion, args *WafShowOptions) error { + webAcl, err := cli.GetWebAcl(args.ID, args.NAME, args.SCOPE) + if err != nil { + return err + } + printObject(webAcl) + return nil + }) + + type WafDeleteOptions struct { + ID string + NAME string + SCOPE string + LOCK_TOKEN string + } + + shellutils.R(&WafDeleteOptions{}, "waf-delete", "Delete web acl", func(cli *aws.SRegion, args *WafDeleteOptions) error { + return cli.DeleteWebAcl(args.ID, args.NAME, args.SCOPE, args.LOCK_TOKEN) + }) + + type WafResourceListOptions struct { + ResType string `choices:"APPLICATION_LOAD_BALANCER|API_GATEWAY|APPSYNC"` + ARN string + } + + shellutils.R(&WafResourceListOptions{}, "waf-res-list", "List web acl resource", func(cli *aws.SRegion, args *WafResourceListOptions) error { + res, err := cli.ListResourcesForWebACL(args.ResType, args.ARN) + if err != nil { + return err + } + fmt.Println("res:", res) + return nil + }) + + type WafAddRuleOptions struct { + WafShowOptions + + RULE_FILE string + } + + shellutils.R(&WafAddRuleOptions{}, "waf-add-rule", "Add web acl rule", func(cli *aws.SRegion, args *WafAddRuleOptions) error { + waf, err := cli.GetWebAcl(args.ID, args.NAME, args.SCOPE) + if err != nil { + return errors.Wrapf(err, "GetWebAcl") + } + data, err := ioutil.ReadFile(args.RULE_FILE) + if err != nil { + return errors.Wrapf(err, "ReadFile") + } + params, err := jsonutils.Parse(data) + if err != nil { + return errors.Wrapf(err, "Parse") + } + rule := &cloudprovider.SWafRule{} + params.Unmarshal(rule) + _, err = waf.AddRule(rule) + return err + }) + +} diff --git a/pkg/multicloud/aws/waf.go b/pkg/multicloud/aws/waf.go new file mode 100644 index 0000000000..6b6b0c4f87 --- /dev/null +++ b/pkg/multicloud/aws/waf.go @@ -0,0 +1,536 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package aws + +import ( + "strings" + + "github.com/aws/aws-sdk-go/service/wafv2" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/multicloud" +) + +const ( + SCOPE_REGIONAL = "REGIONAL" + SCOPE_CLOUDFRONT = "CLOUDFRONT" +) + +var ( + WAF_SCOPES = []string{ + SCOPE_REGIONAL, + SCOPE_CLOUDFRONT, + } +) + +type SWafRule struct { + Action struct { + Block struct { + } `json:"Block"` + } `json:"Action"` + Name string `json:"Name"` +} + +type SVisibilityConfig struct { + CloudWatchMetricsEnabled bool + MetricName string + SampledRequestsEnabled bool +} + +type SWebAcl struct { + multicloud.SResourceBase + multicloud.AwsTags + region *SRegion + sWebDetails + + scope string + ARN string + Description string + Id string + LockToken string + Name string + LabelNamespace string + Capacity int + ManagedByFirewallManager bool + VisibilityConfig SVisibilityConfig +} + +func (self *SRegion) ListWebACLs(scope string) ([]SWebAcl, error) { + if scope == SCOPE_CLOUDFRONT && self.RegionId != "us-east-1" { + return []SWebAcl{}, nil + } + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + ret := []SWebAcl{} + input := wafv2.ListWebACLsInput{} + input.SetScope(scope) + for { + resp, err := client.ListWebACLs(&input) + if err != nil { + return nil, errors.Wrapf(err, "ListWebACLs") + } + part := []SWebAcl{} + jsonutils.Update(&part, resp.WebACLs) + ret = append(ret, part...) + if resp.NextMarker == nil || len(*resp.NextMarker) == 0 { + break + } + input.SetNextMarker(*resp.NextMarker) + } + return ret, nil +} + +func (self *SRegion) GetWebAcl(id, name, scope string) (*SWebAcl, error) { + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + input := wafv2.GetWebACLInput{} + input.SetId(id) + input.SetName(name) + input.SetScope(scope) + resp, err := client.GetWebACL(&input) + if err != nil { + if _, ok := err.(*wafv2.WAFNonexistentItemException); ok { + return nil, errors.Wrapf(cloudprovider.ErrNotFound, err.Error()) + } + return nil, errors.Wrapf(err, "GetWebAcl") + } + ret := &SWebAcl{region: self, scope: scope, sWebDetails: sWebDetails{resp.WebACL}, LockToken: *resp.LockToken} + return ret, jsonutils.Update(ret, resp.WebACL) +} + +func (self *SRegion) DeleteWebAcl(id, name, scope, lockToken string) error { + client, err := self.getWafClient() + if err != nil { + return errors.Wrapf(err, "getWafClient") + } + input := wafv2.DeleteWebACLInput{} + input.SetId(id) + input.SetName(name) + input.SetScope(scope) + input.SetLockToken(lockToken) + _, err = client.DeleteWebACL(&input) + return errors.Wrapf(err, "DeleteWebACL") +} + +func (self *SRegion) ListResourcesForWebACL(resType, arn string) ([]string, error) { + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + input := wafv2.ListResourcesForWebACLInput{} + input.SetResourceType(resType) + input.SetWebACLArn(arn) + resp, err := client.ListResourcesForWebACL(&input) + if err != nil { + return nil, errors.Wrapf(err, "ListResourcesForWebACL") + } + ret := []string{} + for _, id := range resp.ResourceArns { + ret = append(ret, *id) + } + return ret, nil +} + +func (self *SRegion) GetICloudWafInstanceById(id string) (cloudprovider.ICloudWafInstance, error) { + idInfo := strings.Split(id, "/") + if len(idInfo) != 4 { + return nil, errors.Wrapf(cloudprovider.ErrNotFound, "invalid arn %s", id) + } + scope := SCOPE_CLOUDFRONT + if strings.HasSuffix(idInfo[0], "regional") { + scope = SCOPE_REGIONAL + } + ins, err := self.GetWebAcl(idInfo[3], idInfo[2], scope) + if err != nil { + return nil, errors.Wrapf(err, "GetWebAcl(%s, %s, %s)", idInfo[3], idInfo[2], scope) + } + return ins, nil +} + +func (self *SRegion) GetICloudWafInstances() ([]cloudprovider.ICloudWafInstance, error) { + ret := []cloudprovider.ICloudWafInstance{} + for _, scope := range WAF_SCOPES { + ins, err := self.ListWebACLs(scope) + if err != nil { + return nil, errors.Wrapf(err, "ListWebACLs") + } + for i := range ins { + ins[i].region = self + ins[i].scope = scope + ret = append(ret, &ins[i]) + } + } + return ret, nil +} + +func (self *SWebAcl) GetEnabled() bool { + return true +} + +func (self *SWebAcl) GetGlobalId() string { + return self.ARN +} + +func (self *SWebAcl) GetName() string { + return self.Name +} + +func (self *SWebAcl) GetId() string { + return self.ARN +} + +func (self *SWebAcl) GetWafType() cloudprovider.TWafType { + if self.scope == SCOPE_CLOUDFRONT { + return cloudprovider.WafTypeCloudFront + } + return cloudprovider.WafTypeRegional +} + +func (self *SWebAcl) GetStatus() string { + return api.WAF_STATUS_AVAILABLE +} + +func (self *SWebAcl) GetDefaultAction() *cloudprovider.DefaultAction { + ret := &cloudprovider.DefaultAction{} + if self.WebACL != nil && self.WebACL.DefaultAction != nil { + action := self.WebACL.DefaultAction + if action.Allow != nil { + ret.Action = cloudprovider.WafActionAllow + } else if action.Block != nil { + ret.Action = cloudprovider.WafActionBlock + } + } + return ret +} + +func (self *SWebAcl) Refresh() error { + acl, err := self.region.GetWebAcl(self.Id, self.Name, self.scope) + if err != nil { + return errors.Wrapf(err, "GetWebAcl") + } + return jsonutils.Update(self, acl) +} + +func (self *SWebAcl) Delete() error { + return self.region.DeleteWebAcl(self.Id, self.Name, self.scope, self.LockToken) +} + +func (self *SRegion) CreateICloudWafInstance(opts *cloudprovider.WafCreateOptions) (cloudprovider.ICloudWafInstance, error) { + waf, err := self.CreateWebAcl(opts.Name, opts.Desc, opts.Type, opts.DefaultAction) + if err != nil { + return nil, errors.Wrapf(err, "CreateWebAcl") + } + return waf, nil +} + +func (self *SRegion) CreateWebAcl(name, desc string, wafType cloudprovider.TWafType, action *cloudprovider.DefaultAction) (*SWebAcl, error) { + input := wafv2.CreateWebACLInput{} + input.SetName(name) + if len(desc) > 0 { + input.SetDescription(desc) + } + switch wafType { + case cloudprovider.WafTypeRegional, cloudprovider.WafTypeCloudFront: + input.SetScope(strings.ToUpper(string(wafType))) + default: + return nil, errors.Errorf("invalid waf type %s", wafType) + } + if action != nil { + defaultAction := wafv2.DefaultAction{} + switch action.Action { + case cloudprovider.WafActionAllow: + defaultAction.Allow = &wafv2.AllowAction{} + case cloudprovider.WafActionBlock: + defaultAction.Block = &wafv2.BlockAction{} + } + input.SetDefaultAction(&defaultAction) + } + visib := &wafv2.VisibilityConfig{} + visib.SetSampledRequestsEnabled(true) + visib.SetCloudWatchMetricsEnabled(true) + visib.SetMetricName(name) + input.SetVisibilityConfig(visib) + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + output, err := client.CreateWebACL(&input) + if err != nil { + return nil, errors.Wrapf(err, "CreateWebAcl") + } + return self.GetWebAcl(*output.Summary.Id, name, *input.Scope) +} + +func reverseConvertField(opts cloudprovider.SWafStatement) *wafv2.FieldToMatch { + ret := &wafv2.FieldToMatch{} + switch opts.MatchField { + case cloudprovider.WafMatchFieldBody: + body := &wafv2.Body{} + ret.SetBody(body) + case cloudprovider.WafMatchFieldJsonBody: + case cloudprovider.WafMatchFieldMethod: + method := &wafv2.Method{} + ret.SetMethod(method) + case cloudprovider.WafMatchFieldQuery: + switch opts.MatchFieldKey { + case "SingleArgument": + query := &wafv2.SingleQueryArgument{} + ret.SetSingleQueryArgument(query) + case "AllArguments": + query := &wafv2.AllQueryArguments{} + ret.SetAllQueryArguments(query) + default: + query := &wafv2.QueryString{} + ret.SetQueryString(query) + } + case cloudprovider.WafMatchFiledHeader: + head := &wafv2.SingleHeader{} + head.SetName(opts.MatchFieldKey) + ret.SetSingleHeader(head) + case cloudprovider.WafMatchFiledUriPath: + uri := &wafv2.UriPath{} + ret.SetUriPath(uri) + } + return ret +} + +func reverseConvertStatement(statement cloudprovider.SWafStatement) *wafv2.Statement { + ret := &wafv2.Statement{} + trans := []*wafv2.TextTransformation{} + if statement.Transformations != nil { + for i, tran := range *statement.Transformations { + t := &wafv2.TextTransformation{} + switch tran { + case cloudprovider.WafTextTransformationNone: + t.SetType(wafv2.TextTransformationTypeNone) + case cloudprovider.WafTextTransformationLowercase: + t.SetType(wafv2.TextTransformationTypeLowercase) + case cloudprovider.WafTextTransformationCmdLine: + t.SetType(wafv2.TextTransformationTypeCmdLine) + case cloudprovider.WafTextTransformationUrlDecode: + t.SetType(wafv2.TextTransformationTypeUrlDecode) + case cloudprovider.WafTextTransformationHtmlEntityDecode: + t.SetType(wafv2.TextTransformationTypeHtmlEntityDecode) + case cloudprovider.WafTextTransformationCompressWithSpace: + t.SetType(wafv2.TextTransformationTypeCompressWhiteSpace) + } + t.SetPriority(int64(i)) + trans = append(trans, t) + } + } + rules := []*wafv2.ExcludedRule{} + if statement.ExcludeRules != nil { + for _, r := range *statement.ExcludeRules { + name := r.Name + rules = append(rules, &wafv2.ExcludedRule{ + Name: &name, + }) + } + } + field := reverseConvertField(statement) + switch statement.Type { + case cloudprovider.WafStatementTypeRate: + rate := &wafv2.RateBasedStatement{} + rate.SetLimit(*statement.Limit) + fd := &wafv2.ForwardedIPConfig{} + if len(statement.ForwardedIPHeader) > 0 { + fd.SetHeaderName(statement.ForwardedIPHeader) + rate.SetForwardedIPConfig(fd) + } + ret.SetRateBasedStatement(rate) + case cloudprovider.WafStatementTypeIPSet: + ipset := &wafv2.IPSetReferenceStatement{} + ipset.SetARN(statement.IPSetId) + fd := &wafv2.IPSetForwardedIPConfig{} + if len(statement.ForwardedIPHeader) > 0 { + fd.SetHeaderName(statement.ForwardedIPHeader) + ipset.SetIPSetForwardedIPConfig(fd) + } + ret.SetIPSetReferenceStatement(ipset) + case cloudprovider.WafStatementTypeXssMatch: + xss := &wafv2.XssMatchStatement{} + if len(trans) > 0 { + xss.SetTextTransformations(trans) + } + field := &wafv2.FieldToMatch{} + xss.SetFieldToMatch(field) + xss.SetTextTransformations(trans) + ret.SetXssMatchStatement(xss) + case cloudprovider.WafStatementTypeSize: + size := &wafv2.SizeConstraintStatement{} + size.SetFieldToMatch(field) + size.SetSize(*statement.Size) + ret.SetSizeConstraintStatement(size) + case cloudprovider.WafStatementTypeGeoMatch: + geo := &wafv2.GeoMatchStatement{} + values := []*string{} + if statement.MatchFieldValues != nil { + for i := range *statement.MatchFieldValues { + v := (*statement.MatchFieldValues)[i] + values = append(values, &v) + } + geo.SetCountryCodes(values) + } + fd := &wafv2.ForwardedIPConfig{} + if len(statement.ForwardedIPHeader) > 0 { + fd.SetHeaderName(statement.ForwardedIPHeader) + geo.SetForwardedIPConfig(fd) + } + ret.SetGeoMatchStatement(geo) + case cloudprovider.WafStatementTypeRegexSet: + regex := &wafv2.RegexPatternSetReferenceStatement{} + regex.SetARN(statement.RegexSetId) + if len(trans) > 0 { + regex.SetTextTransformations(trans) + } + regex.SetFieldToMatch(field) + ret.SetRegexPatternSetReferenceStatement(regex) + case cloudprovider.WafStatementTypeByteMatch: + bm := &wafv2.ByteMatchStatement{} + if len(trans) > 0 { + bm.SetTextTransformations(trans) + } + bm.SetSearchString([]byte(statement.SearchString)) + if len(statement.Operator) > 0 { + bm.SetPositionalConstraint(string(statement.Operator)) + } + bm.SetFieldToMatch(field) + ret.SetByteMatchStatement(bm) + case cloudprovider.WafStatementTypeRuleGroup: + rg := &wafv2.RuleGroupReferenceStatement{} + rg.SetARN(statement.RuleGroupId) + if len(rules) > 0 { + rg.SetExcludedRules(rules) + } + ret.SetRuleGroupReferenceStatement(rg) + case cloudprovider.WafStatementTypeSqliMatch: + sqli := &wafv2.SqliMatchStatement{} + if len(trans) > 0 { + sqli.SetTextTransformations(trans) + } + sqli.SetFieldToMatch(field) + ret.SetSqliMatchStatement(sqli) + case cloudprovider.WafStatementTypeLabelMatch: + case cloudprovider.WafStatementTypeManagedRuleGroup: + rg := &wafv2.ManagedRuleGroupStatement{} + rg.SetName(statement.ManagedRuleGroupName) + rg.SetVendorName("aws") + if len(rules) > 0 { + rg.SetExcludedRules(rules) + } + ret.SetManagedRuleGroupStatement(rg) + } + return ret +} + +func (self *SWebAcl) AddRule(opts *cloudprovider.SWafRule) (cloudprovider.ICloudWafRule, error) { + input := &wafv2.UpdateWebACLInput{} + input.SetLockToken(self.LockToken) + input.SetId(self.Id) + input.SetName(self.Name) + input.SetScope(self.scope) + input.SetDescription(self.Description) + input.SetDefaultAction(self.sWebDetails.DefaultAction) + input.SetVisibilityConfig(self.sWebDetails.VisibilityConfig) + rules := self.sWebDetails.Rules + rule := &wafv2.Rule{} + rule.SetName(opts.Name) + rule.SetPriority(int64(opts.Priority)) + action := &wafv2.RuleAction{} + if opts.Action != nil { + switch opts.Action.Action { + case cloudprovider.WafActionAllow: + allow := &wafv2.AllowAction{} + action.SetAllow(allow) + case cloudprovider.WafActionBlock: + block := &wafv2.BlockAction{} + action.SetBlock(block) + case cloudprovider.WafActionCount: + count := &wafv2.CountAction{} + action.SetCount(count) + } + } + rule.SetAction(action) + visib := &wafv2.VisibilityConfig{} + visib.SetSampledRequestsEnabled(false) + visib.SetCloudWatchMetricsEnabled(true) + visib.SetMetricName(opts.Name) + rule.SetVisibilityConfig(visib) + statement := &wafv2.Statement{} + switch opts.StatementCondition { + case cloudprovider.WafStatementConditionOr: + ss := &wafv2.OrStatement{} + for _, s := range opts.Statements { + ss.Statements = append(ss.Statements, reverseConvertStatement(s)) + } + statement.SetOrStatement(ss) + case cloudprovider.WafStatementConditionAnd: + ss := &wafv2.AndStatement{} + for _, s := range opts.Statements { + ss.Statements = append(ss.Statements, reverseConvertStatement(s)) + } + statement.SetAndStatement(ss) + case cloudprovider.WafStatementConditionNot: + ss := &wafv2.NotStatement{} + for _, s := range opts.Statements { + ss.SetStatement(reverseConvertStatement(s)) + break + } + statement.SetNotStatement(ss) + case cloudprovider.WafStatementConditionNone: + for _, s := range opts.Statements { + statement = reverseConvertStatement(s) + break + } + } + rule.SetStatement(statement) + rules = append(rules, rule) + input.SetRules(rules) + client, err := self.region.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + _, err = client.UpdateWebACL(input) + if err != nil { + return nil, errors.Wrapf(err, "UpdateWebACL") + } + ret := &sWafRule{waf: self, Rule: rule} + return ret, nil +} + +func (self *SWebAcl) GetCloudResources() ([]cloudprovider.SCloudResource, error) { + ret := []cloudprovider.SCloudResource{} + for _, resType := range []string{"APPLICATION_LOAD_BALANCER", "API_GATEWAY", "APPSYNC"} { + resIds, err := self.region.ListResourcesForWebACL(resType, self.ARN) + if err != nil { + return nil, errors.Wrapf(err, "ListResourcesForWebACL(%s, %s)", resType, self.ARN) + } + for _, resId := range resIds { + ret = append(ret, cloudprovider.SCloudResource{ + Id: resId, + Type: resType, + }) + } + } + return ret, nil +} diff --git a/pkg/multicloud/aws/waf_ipsets.go b/pkg/multicloud/aws/waf_ipsets.go new file mode 100644 index 0000000000..afc09b84e4 --- /dev/null +++ b/pkg/multicloud/aws/waf_ipsets.go @@ -0,0 +1,146 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package aws + +import ( + "github.com/aws/aws-sdk-go/service/wafv2" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + "yunion.io/x/onecloud/pkg/cloudprovider" +) + +type SWafIPSet struct { + region *SRegion + scope string + Addresses []string + ARN string + Description string + Id string + LockToken string + Name string +} + +func (self *SWafIPSet) GetName() string { + return self.Name +} + +func (self *SWafIPSet) GetDesc() string { + return self.Description +} + +func (self *SWafIPSet) GetGlobalId() string { + return self.ARN +} + +func (self *SWafIPSet) GetType() cloudprovider.TWafType { + switch self.scope { + case SCOPE_CLOUDFRONT: + return cloudprovider.WafTypeCloudFront + case SCOPE_REGIONAL: + return cloudprovider.WafTypeRegional + } + return cloudprovider.TWafType(self.scope) +} + +func (self *SWafIPSet) GetAddresses() cloudprovider.WafAddresses { + if len(self.Addresses) == 0 { + ipSet, err := self.region.GetIPSet(self.Id, self.Name, self.scope) + if err != nil { + return cloudprovider.WafAddresses{} + } + return ipSet.Addresses + } + return self.Addresses +} + +func (self *SWafIPSet) Delete() error { + return self.region.DeleteIPSet(self.Id, self.Name, self.scope, self.LockToken) +} + +func (self *SRegion) ListIPSets(scope string) ([]SWafIPSet, error) { + if scope == SCOPE_CLOUDFRONT && self.RegionId != "us-east-1" { + return []SWafIPSet{}, nil + } + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + ret := []SWafIPSet{} + input := wafv2.ListIPSetsInput{} + input.SetScope(scope) + for { + resp, err := client.ListIPSets(&input) + if err != nil { + return nil, errors.Wrapf(err, "ListIPSets") + } + part := []SWafIPSet{} + jsonutils.Update(&part, resp.IPSets) + ret = append(ret, part...) + if resp.NextMarker == nil || len(*resp.NextMarker) == 0 { + break + } + input.SetNextMarker(*resp.NextMarker) + } + return ret, nil +} + +func (self *SRegion) GetIPSet(id, name, scope string) (*SWafIPSet, error) { + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + input := wafv2.GetIPSetInput{} + input.SetId(id) + input.SetName(name) + input.SetScope(scope) + resp, err := client.GetIPSet(&input) + if err != nil { + return nil, errors.Wrapf(err, "GetIPSet") + } + ret := &SWafIPSet{LockToken: *resp.LockToken} + return ret, jsonutils.Update(ret, resp.IPSet) +} + +func (self *SRegion) DeleteIPSet(id, name, scope, lockToken string) error { + client, err := self.getWafClient() + if err != nil { + return errors.Wrapf(err, "getWafClient") + } + input := wafv2.DeleteIPSetInput{} + input.SetId(id) + input.SetName(name) + input.SetScope(scope) + input.SetLockToken(lockToken) + _, err = client.DeleteIPSet(&input) + return errors.Wrapf(err, "DeleteIPSet") +} + +func (self *SRegion) GetICloudWafIPSets() ([]cloudprovider.ICloudWafIPSet, error) { + ret := []cloudprovider.ICloudWafIPSet{} + for _, scope := range WAF_SCOPES { + part, err := self.ListIPSets(scope) + if err != nil { + return nil, errors.Wrapf(err, "ListIPSets(%s)", scope) + } + for i := range part { + part[i].scope = scope + part[i].region = self + ret = append(ret, &part[i]) + } + } + return ret, nil +} diff --git a/pkg/multicloud/aws/waf_regexsets.go b/pkg/multicloud/aws/waf_regexsets.go new file mode 100644 index 0000000000..5c7ae8995b --- /dev/null +++ b/pkg/multicloud/aws/waf_regexsets.go @@ -0,0 +1,155 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package aws + +import ( + "github.com/aws/aws-sdk-go/service/wafv2" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + "yunion.io/x/onecloud/pkg/cloudprovider" +) + +type RegularExpression struct { + RegexString string +} + +type SWafRegexSet struct { + region *SRegion + scope string + RegularExpressionList []RegularExpression + ARN string + Description string + Id string + LockToken string + Name string +} + +func (self *SWafRegexSet) GetName() string { + return self.Name +} + +func (self *SWafRegexSet) GetDesc() string { + return self.Description +} + +func (self *SWafRegexSet) GetGlobalId() string { + return self.ARN +} + +func (self *SWafRegexSet) GetType() cloudprovider.TWafType { + switch self.scope { + case SCOPE_REGIONAL: + return cloudprovider.WafTypeRegional + case SCOPE_CLOUDFRONT: + return cloudprovider.WafTypeCloudFront + default: + return cloudprovider.TWafType(self.scope) + } +} + +func (self *SWafRegexSet) GetRegexPatterns() cloudprovider.WafRegexPatterns { + if len(self.RegularExpressionList) == 0 { + rSet, err := self.region.GetRegexSet(self.Id, self.Name, self.scope) + if err != nil { + return cloudprovider.WafRegexPatterns{} + } + jsonutils.Update(self, rSet) + } + ret := cloudprovider.WafRegexPatterns{} + for _, r := range self.RegularExpressionList { + ret = append(ret, r.RegexString) + } + return ret +} + +func (self *SWafRegexSet) Delete() error { + return self.region.DeleteRegexSet(self.Id, self.Name, self.scope, self.LockToken) +} + +func (self *SRegion) ListRegexSets(scope string) ([]SWafRegexSet, error) { + if scope == SCOPE_CLOUDFRONT && self.RegionId != "us-east-1" { + return []SWafRegexSet{}, nil + } + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + ret := []SWafRegexSet{} + input := wafv2.ListRegexPatternSetsInput{} + input.SetScope(scope) + for { + resp, err := client.ListRegexPatternSets(&input) + if err != nil { + return nil, errors.Wrapf(err, "ListRegexPatternSets") + } + part := []SWafRegexSet{} + jsonutils.Update(&part, resp.RegexPatternSets) + ret = append(ret, part...) + if resp.NextMarker == nil || len(*resp.NextMarker) == 0 { + break + } + input.SetNextMarker(*resp.NextMarker) + } + return ret, nil +} + +func (self *SRegion) GetRegexSet(id, name, scope string) (*SWafRegexSet, error) { + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + input := wafv2.GetRegexPatternSetInput{} + input.SetId(id) + input.SetName(name) + input.SetScope(scope) + resp, err := client.GetRegexPatternSet(&input) + if err != nil { + return nil, errors.Wrapf(err, "GetRegexPatternSet") + } + ret := &SWafRegexSet{LockToken: *resp.LockToken} + return ret, jsonutils.Update(ret, resp.RegexPatternSet) +} + +func (self *SRegion) DeleteRegexSet(id, name, scope, lockToken string) error { + client, err := self.getWafClient() + if err != nil { + return errors.Wrapf(err, "getWafClient") + } + input := wafv2.DeleteRegexPatternSetInput{} + input.SetId(id) + input.SetName(name) + input.SetScope(scope) + input.SetLockToken(lockToken) + _, err = client.DeleteRegexPatternSet(&input) + return errors.Wrapf(err, "DeleteRegexPatternSet") +} + +func (self *SRegion) GetICloudWafRegexSets() ([]cloudprovider.ICloudWafRegexSet, error) { + ret := []cloudprovider.ICloudWafRegexSet{} + for _, scope := range WAF_SCOPES { + part, err := self.ListRegexSets(scope) + if err != nil { + return nil, errors.Wrapf(err, "ListRegexSets(%s)", scope) + } + for i := range part { + part[i].scope = scope + part[i].region = self + ret = append(ret, &part[i]) + } + } + return ret, nil +} diff --git a/pkg/multicloud/aws/waf_rule_groups.go b/pkg/multicloud/aws/waf_rule_groups.go new file mode 100644 index 0000000000..fa5ee0d380 --- /dev/null +++ b/pkg/multicloud/aws/waf_rule_groups.go @@ -0,0 +1,135 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package aws + +import ( + "github.com/aws/aws-sdk-go/service/wafv2" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" +) + +type SWafRuleGroup struct { + Description string + Name string + VendorName string + Capacity int `json:"Capacity"` + Rules []SWafRule +} + +func (self *SRegion) ListAvailableManagedRuleGroups(scope string) ([]SWafRuleGroup, error) { + if scope == SCOPE_CLOUDFRONT && self.RegionId != "us-east-1" { + return []SWafRuleGroup{}, nil + } + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + ret := []SWafRuleGroup{} + input := wafv2.ListAvailableManagedRuleGroupsInput{} + input.SetScope(scope) + for { + resp, err := client.ListAvailableManagedRuleGroups(&input) + if err != nil { + return nil, errors.Wrapf(err, "ListAvailableManagedRuleGroups") + } + part := []SWafRuleGroup{} + jsonutils.Update(&part, resp.ManagedRuleGroups) + ret = append(ret, part...) + if resp.NextMarker == nil || len(*resp.NextMarker) == 0 { + break + } + input.SetNextMarker(*resp.NextMarker) + } + return ret, nil +} + +func (self *SRegion) DescribeManagedRuleGroup(name, scope, vendorName string) (*SWafRuleGroup, error) { + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + input := wafv2.DescribeManagedRuleGroupInput{} + input.SetName(name) + input.SetScope(scope) + input.SetVendorName(vendorName) + resp, err := client.DescribeManagedRuleGroup(&input) + if err != nil { + return nil, err + } + ret := &SWafRuleGroup{ + Name: name, + VendorName: vendorName, + } + return ret, jsonutils.Update(ret, resp) +} + +func (self *SRegion) ListRuleGroups(scope string) ([]SWafRuleGroup, error) { + if scope == SCOPE_CLOUDFRONT && self.RegionId != "us-east-1" { + return []SWafRuleGroup{}, nil + } + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + ret := []SWafRuleGroup{} + input := wafv2.ListRuleGroupsInput{} + input.SetScope(scope) + for { + resp, err := client.ListRuleGroups(&input) + if err != nil { + return nil, errors.Wrapf(err, "ListRuleGroups") + } + part := []SWafRuleGroup{} + jsonutils.Update(&part, resp.RuleGroups) + ret = append(ret, part...) + if resp.NextMarker == nil || len(*resp.NextMarker) == 0 { + break + } + input.SetNextMarker(*resp.NextMarker) + } + return ret, nil +} + +func (self *SRegion) GetRuleGroup(id, name, scope string) (*SWafRuleGroup, error) { + client, err := self.getWafClient() + if err != nil { + return nil, errors.Wrapf(err, "getWafClient") + } + input := wafv2.GetRuleGroupInput{} + input.SetId(id) + input.SetName(name) + input.SetScope(scope) + resp, err := client.GetRuleGroup(&input) + if err != nil { + return nil, errors.Wrapf(err, "GetRuleGroup") + } + ret := &SWafRuleGroup{} + return ret, jsonutils.Update(ret, resp.RuleGroup) +} + +func (self *SRegion) DeleteRuleGroup(id, name, scope, lockToken string) error { + client, err := self.getWafClient() + if err != nil { + return errors.Wrapf(err, "getWafClient") + } + input := wafv2.DeleteRuleGroupInput{} + input.SetId(id) + input.SetName(name) + input.SetScope(scope) + input.SetLockToken(lockToken) + _, err = client.DeleteRuleGroup(&input) + return errors.Wrapf(err, "DeleteRuleGroup") +} diff --git a/pkg/multicloud/aws/waf_rules.go b/pkg/multicloud/aws/waf_rules.go new file mode 100644 index 0000000000..a4efe271df --- /dev/null +++ b/pkg/multicloud/aws/waf_rules.go @@ -0,0 +1,265 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package aws + +import ( + "strings" + + "github.com/aws/aws-sdk-go/service/wafv2" + + "yunion.io/x/pkg/errors" + "yunion.io/x/pkg/utils" + + "yunion.io/x/onecloud/pkg/cloudprovider" +) + +type sWebDetails struct { + *wafv2.WebACL +} + +type sWafRule struct { + waf *SWebAcl + *wafv2.Rule +} + +func (self *sWafRule) GetAction() *cloudprovider.DefaultAction { + ret := &cloudprovider.DefaultAction{} + if self.Action.Allow != nil { + ret.Action = cloudprovider.WafActionAllow + } else if self.Action.Block != nil { + ret.Action = cloudprovider.WafActionBlock + } else if self.Action.Count != nil { + ret.Action = cloudprovider.WafActionCount + } + return ret +} + +func (self *sWafRule) GetDesc() string { + return "" +} + +func (self *sWafRule) GetName() string { + return *self.Rule.Name +} + +func (self *sWafRule) GetGlobalId() string { + return self.GetName() +} + +func (self *sWafRule) GetPriority() int { + return int(*self.Rule.Priority) +} + +func (self *sWafRule) Delete() error { + input := wafv2.UpdateWebACLInput{} + rules := []*wafv2.Rule{} + for _, rule := range self.waf.sWebDetails.Rules { + if *rule.Name == *self.Name { + continue + } + rules = append(rules, rule) + } + input.SetRules(rules) + input.SetLockToken(self.waf.LockToken) + input.SetId(self.waf.Id) + input.SetName(self.waf.Name) + input.SetScope(self.waf.scope) + input.SetDescription(self.waf.Description) + input.SetDefaultAction(self.waf.DefaultAction) + input.SetVisibilityConfig(self.waf.sWebDetails.VisibilityConfig) + client, err := self.waf.region.getWafClient() + if err != nil { + return errors.Wrapf(err, "getWafClient") + } + _, err = client.UpdateWebACL(&input) + return errors.Wrapf(err, "UpdateWebACL") +} + +func (self *sWafRule) Update(opts *cloudprovider.SWafRule) error { + return cloudprovider.ErrNotImplemented +} + +func (self *sWafRule) GetStatementCondition() cloudprovider.TWafStatementCondition { + if self.Rule.Statement == nil { + return cloudprovider.WafStatementConditionNone + } + if self.Rule.Statement.AndStatement != nil { + return cloudprovider.WafStatementConditionAnd + } else if self.Rule.Statement.OrStatement != nil { + return cloudprovider.WafStatementConditionOr + } else if self.Rule.Statement.NotStatement != nil { + return cloudprovider.WafStatementConditionNot + } + return cloudprovider.WafStatementConditionNone +} + +type sWafStatement struct { + *wafv2.Statement +} + +func (self *sWafStatement) convert() cloudprovider.SWafStatement { + statement := cloudprovider.SWafStatement{ + Transformations: &cloudprovider.TextTransformations{}, + } + if self.ByteMatchStatement != nil { + statement.Type = cloudprovider.WafStatementTypeByteMatch + if self.ByteMatchStatement.PositionalConstraint != nil { + operator := strings.ReplaceAll(utils.CamelSplit(*self.ByteMatchStatement.PositionalConstraint, "_"), "_", "") + if operator == "None" { + operator = "" + } + statement.Operator = cloudprovider.TWafOperator(operator) + } + fillStatement(&statement, self.ByteMatchStatement.FieldToMatch) + statement.SearchString = string(self.ByteMatchStatement.SearchString) + fillTransformations(&statement, self.ByteMatchStatement.TextTransformations) + } else if self.GeoMatchStatement != nil { + statement.Type = cloudprovider.WafStatementTypeGeoMatch + statement.MatchFieldKey = "CountryCodes" + values := cloudprovider.TWafMatchFieldValues{} + for _, code := range self.GeoMatchStatement.CountryCodes { + values = append(values, *code) + } + statement.MatchFieldValues = &values + if self.GeoMatchStatement.ForwardedIPConfig != nil { + statement.ForwardedIPHeader = *self.GeoMatchStatement.ForwardedIPConfig.HeaderName + } + } else if self.IPSetReferenceStatement != nil { + statement.Type = cloudprovider.WafStatementTypeIPSet + statement.IPSetId = *self.IPSetReferenceStatement.ARN + if self.IPSetReferenceStatement.IPSetForwardedIPConfig != nil { + statement.ForwardedIPHeader = *self.IPSetReferenceStatement.IPSetForwardedIPConfig.HeaderName + } + } else if self.ManagedRuleGroupStatement != nil { + statement.Type = cloudprovider.WafStatementTypeManagedRuleGroup + statement.ManagedRuleGroupName = *self.ManagedRuleGroupStatement.Name + fillExcludeRules(&statement, self.ManagedRuleGroupStatement.ExcludedRules) + } else if self.RateBasedStatement != nil { + statement.Type = cloudprovider.WafStatementTypeRate + statement.Limit = self.RateBasedStatement.Limit + if self.RateBasedStatement.ForwardedIPConfig != nil { + statement.ForwardedIPHeader = *self.RateBasedStatement.ForwardedIPConfig.HeaderName + } + } else if self.RegexPatternSetReferenceStatement != nil { + statement.Type = cloudprovider.WafStatementTypeRegexSet + statement.RegexSetId = *self.RegexPatternSetReferenceStatement.ARN + fillStatement(&statement, self.RegexPatternSetReferenceStatement.FieldToMatch) + } else if self.RuleGroupReferenceStatement != nil { + statement.Type = cloudprovider.WafStatementTypeRuleGroup + statement.RuleGroupId = *self.RuleGroupReferenceStatement.ARN + fillExcludeRules(&statement, self.RuleGroupReferenceStatement.ExcludedRules) + } else if self.SizeConstraintStatement != nil { + statement.Type = cloudprovider.WafStatementTypeSize + statement.Operator = cloudprovider.TWafOperator(*self.SizeConstraintStatement.ComparisonOperator) + statement.Size = self.SizeConstraintStatement.Size + fillStatement(&statement, self.SizeConstraintStatement.FieldToMatch) + fillTransformations(&statement, self.SizeConstraintStatement.TextTransformations) + } else if self.SqliMatchStatement != nil { + statement.Type = cloudprovider.WafStatementTypeSqliMatch + fillStatement(&statement, self.SqliMatchStatement.FieldToMatch) + fillTransformations(&statement, self.SqliMatchStatement.TextTransformations) + } else if self.XssMatchStatement != nil { + statement.Type = cloudprovider.WafStatementTypeXssMatch + fillStatement(&statement, self.XssMatchStatement.FieldToMatch) + fillTransformations(&statement, self.XssMatchStatement.TextTransformations) + } + return statement +} + +func fillStatement(statement *cloudprovider.SWafStatement, field *wafv2.FieldToMatch) { + if field.AllQueryArguments != nil { + statement.MatchField = cloudprovider.WafMatchFieldQuery + statement.MatchFieldKey = "AllArguments" + } else if field.Body != nil { + statement.MatchField = cloudprovider.WafMatchFieldBody + } else if field.Method != nil { + statement.MatchField = cloudprovider.WafMatchFieldMethod + } else if field.QueryString != nil { + statement.MatchField = cloudprovider.WafMatchFieldQuery + } else if field.SingleHeader != nil { + statement.MatchField = cloudprovider.WafMatchFiledHeader + statement.MatchFieldKey = *field.SingleHeader.Name + } else if field.SingleQueryArgument != nil { + statement.MatchField = cloudprovider.WafMatchFieldQuery + statement.MatchFieldKey = "SingleArgument" + } else if field.UriPath != nil { + statement.MatchField = cloudprovider.WafMatchFiledUriPath + } +} + +func fillTransformations(statement *cloudprovider.SWafStatement, trans []*wafv2.TextTransformation) { + values := cloudprovider.TextTransformations{} + for _, tran := range trans { + switch *tran.Type { + case wafv2.TextTransformationTypeNone: + values = append(values, cloudprovider.WafTextTransformationNone) + case wafv2.TextTransformationTypeLowercase: + values = append(values, cloudprovider.WafTextTransformationLowercase) + case wafv2.TextTransformationTypeCmdLine: + values = append(values, cloudprovider.WafTextTransformationCmdLine) + case wafv2.TextTransformationTypeUrlDecode: + values = append(values, cloudprovider.WafTextTransformationUrlDecode) + case wafv2.TextTransformationTypeHtmlEntityDecode: + values = append(values, cloudprovider.WafTextTransformationHtmlEntityDecode) + case wafv2.TextTransformationTypeCompressWhiteSpace: + values = append(values, cloudprovider.WafTextTransformationCompressWithSpace) + } + } + statement.Transformations = &values +} + +func fillExcludeRules(statement *cloudprovider.SWafStatement, rules []*wafv2.ExcludedRule) { + values := cloudprovider.SExcludeRules{} + for _, rule := range rules { + values = append(values, cloudprovider.SExcludeRule{Name: *rule.Name}) + } + statement.ExcludeRules = &values +} + +func (self *sWafRule) GetStatements() ([]cloudprovider.SWafStatement, error) { + if self.Rule.Statement == nil { + return []cloudprovider.SWafStatement{}, nil + } + ret := []cloudprovider.SWafStatement{} + if self.Rule.Statement.AndStatement != nil { + for i := range self.Rule.Statement.AndStatement.Statements { + statement := sWafStatement{self.Rule.Statement.AndStatement.Statements[i]} + ret = append(ret, statement.convert()) + } + } else if self.Rule.Statement.OrStatement != nil { + for i := range self.Rule.Statement.OrStatement.Statements { + statement := sWafStatement{self.Rule.Statement.OrStatement.Statements[i]} + ret = append(ret, statement.convert()) + } + } else if self.Rule.Statement.NotStatement != nil { + statement := sWafStatement{self.Rule.Statement.NotStatement.Statement} + ret = append(ret, statement.convert()) + } else { + statement := sWafStatement{self.Rule.Statement} + ret = append(ret, statement.convert()) + } + return ret, nil +} + +func (self *SWebAcl) GetRules() ([]cloudprovider.ICloudWafRule, error) { + ret := []cloudprovider.ICloudWafRule{} + for i := range self.sWebDetails.Rules { + ret = append(ret, &sWafRule{ + waf: self, + Rule: self.sWebDetails.Rules[i], + }) + } + return ret, nil +} diff --git a/pkg/multicloud/azure/azure.go b/pkg/multicloud/azure/azure.go index dcbd3af6fc..6b9295f68a 100644 --- a/pkg/multicloud/azure/azure.go +++ b/pkg/multicloud/azure/azure.go @@ -435,6 +435,18 @@ func (self *SAzureClient) _apiVersion(resource string, params url.Values) string if utils.IsInStringArray("publicipaddresses", info) { return "2018-03-01" } + if utils.IsInStringArray("frontdoorwebapplicationfirewallmanagedrulesets", info) { + return "2020-11-01" + } + if utils.IsInStringArray("frontdoorwebapplicationfirewallpolicies", info) { + return "2020-11-01" + } + if utils.IsInStringArray("applicationgatewaywebapplicationfirewallpolicies", info) { + return "2020-11-01" + } + if utils.IsInStringArray("applicationgatewayavailablewafrulesets", info) { + return "2018-06-01" + } return "2018-06-01" } else if utils.IsInStringArray("microsoft.classicnetwork", info) { return "2016-04-01" @@ -488,6 +500,9 @@ func (self *SAzureClient) _list(resource string, params url.Values) (jsonutils.J return nil, fmt.Errorf("no avaiable subscriptions") } path = fmt.Sprintf("subscriptions/%s/%s", subId, resource) + case "Microsoft.Network/frontdoorWebApplicationFirewallPolicies": + path = fmt.Sprintf("subscriptions/%s/resourceGroups/%s/providers/%s", subId, params.Get("resourceGroups"), resource) + params.Del("resourceGroups") default: if len(subId) == 0 { return nil, fmt.Errorf("no avaiable subscriptions") diff --git a/pkg/multicloud/azure/shell/waf.go b/pkg/multicloud/azure/shell/waf.go new file mode 100644 index 0000000000..b3b3b2d200 --- /dev/null +++ b/pkg/multicloud/azure/shell/waf.go @@ -0,0 +1,70 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package shell + +import ( + "yunion.io/x/onecloud/pkg/multicloud/azure" + "yunion.io/x/onecloud/pkg/util/shellutils" +) + +func init() { + type RuleGroupListOptions struct { + } + shellutils.R(&RuleGroupListOptions{}, "waf-rule-group-list", "List waf rule groups", func(cli *azure.SRegion, args *RuleGroupListOptions) error { + groups, err := cli.ListAppWafManagedRuleGroup() + if err != nil { + return err + } + printList(groups, len(groups), 0, 0, []string{}) + return nil + }) + + type FrontDoorPolicyListOptions struct { + RESOURCE_GROUP string + } + shellutils.R(&FrontDoorPolicyListOptions{}, "front-door-policy-list", "List front door policies", func(cli *azure.SRegion, args *FrontDoorPolicyListOptions) error { + policies, err := cli.ListFrontDoorWafs(args.RESOURCE_GROUP) + if err != nil { + return err + } + printList(policies, 0, 0, 0, []string{}) + return nil + }) + + type AppGatewayWafListOptions struct { + } + + shellutils.R(&AppGatewayWafListOptions{}, "app-gateway-waf-list", "List app gateway wafs", func(cli *azure.SRegion, args *AppGatewayWafListOptions) error { + wafs, err := cli.ListAppWafs() + if err != nil { + return err + } + printList(wafs, 0, 0, 0, []string{}) + return nil + }) + + type AppGatewayWafRuleGroupListOptions struct { + } + + shellutils.R(&AppGatewayWafRuleGroupListOptions{}, "app-gateway-waf-rule-group-list", "List app gateway wafs", func(cli *azure.SRegion, args *AppGatewayWafRuleGroupListOptions) error { + group, err := cli.ListAppWafManagedRuleGroup() + if err != nil { + return err + } + printList(group, 0, 0, 0, []string{}) + return nil + }) + +} diff --git a/pkg/multicloud/azure/waf.go b/pkg/multicloud/azure/waf.go new file mode 100644 index 0000000000..c1fa910ef7 --- /dev/null +++ b/pkg/multicloud/azure/waf.go @@ -0,0 +1,617 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package azure + +import ( + "fmt" + "net/url" + "strings" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/errors" + + api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/multicloud" +) + +type SMatchvariable struct { + Variablename string `json:"variableName"` + Selector string `json:"selector"` +} + +type SMatchcondition struct { + Matchvariables []SMatchvariable `json:"matchVariables"` + Operator string `json:"operator"` + Negationconditon bool `json:"negationConditon"` + Matchvalues []string `json:"matchValues"` + Transforms []string `json:"transforms"` +} + +type CustomRule struct { + waf *SAppGatewayWaf + + Name string `json:"name"` + Priority int `json:"priority"` + Ruletype string `json:"ruleType"` + //RateLimitThreshold *int `json:"rateLimitThreshold"` + Matchconditions []SMatchcondition `json:"matchConditions"` + Action string `json:"action"` +} + +func (self *CustomRule) GetName() string { + return self.Name +} + +func (self *CustomRule) GetGlobalId() string { + return fmt.Sprintf("%s-%s", self.waf.GetGlobalId(), self.GetName()) +} + +func (self *CustomRule) GetDesc() string { + return "" +} + +func (self *CustomRule) GetPriority() int { + return self.Priority +} + +func (self *CustomRule) Delete() error { + rules := []CustomRule{} + for _, rule := range self.waf.Properties.Customrules { + if rule.Name != self.Name { + rules = append(rules, rule) + } + } + self.waf.Properties.Customrules = rules + return self.waf.region.update(jsonutils.Marshal(self.waf), nil) +} + +func wafMatchFieldAndKeyLocal2Cloud(opts cloudprovider.SWafStatement) ([]SMatchvariable, error) { + ret := []SMatchvariable{} + switch opts.MatchField { + case cloudprovider.WafMatchFieldQuery: + ret = append(ret, SMatchvariable{ + Variablename: "QueryString", + }) + case cloudprovider.WafMatchFieldMethod: + ret = append(ret, SMatchvariable{ + Variablename: "RequestMethod", + }) + case cloudprovider.WafMatchFiledUriPath: + ret = append(ret, SMatchvariable{ + Variablename: "RequestUri", + }) + case cloudprovider.WafMatchFiledHeader: + ret = append(ret, SMatchvariable{ + Variablename: "RequestHeaders", + Selector: opts.MatchFieldKey, + }) + case cloudprovider.WafMatchFiledPostArgs: + ret = append(ret, SMatchvariable{ + Variablename: "PostArgs", + Selector: opts.MatchFieldKey, + }) + case cloudprovider.WafMatchFieldBody: + ret = append(ret, SMatchvariable{ + Variablename: "RequestBody", + }) + case cloudprovider.WafMatchFiledCookie: + ret = append(ret, SMatchvariable{ + Variablename: "RequestCookies", + Selector: opts.MatchFieldKey, + }) + default: + return ret, fmt.Errorf("unsupported match filed %s", opts.MatchField) + } + return ret, nil +} + +func wafMatchFieldAndKeyCloud2Local(vars []SMatchvariable) (cloudprovider.TWafMatchField, string, error) { + for _, v := range vars { + switch v.Variablename { + case "QueryString": + return cloudprovider.WafMatchFieldQuery, v.Selector, nil + case "RequestMethod": + return cloudprovider.WafMatchFieldMethod, "", nil + case "RequestUri": + return cloudprovider.WafMatchFiledUriPath, "", nil + case "RequestHeaders": + return cloudprovider.WafMatchFiledHeader, v.Selector, nil + case "PostArgs": + return cloudprovider.WafMatchFiledPostArgs, v.Selector, nil + case "RequestBody": + return cloudprovider.WafMatchFieldBody, "", nil + case "RequestCookies": + return cloudprovider.WafMatchFiledCookie, v.Selector, nil + default: + return "", "", fmt.Errorf("invalid variablename %s", v.Variablename) + } + } + return "", "", nil +} + +func wafStatementLocal2Cloud(opts cloudprovider.SWafStatement) (SMatchcondition, error) { + ret := SMatchcondition{} + if opts.Transformations != nil { + for _, tran := range *opts.Transformations { + ret.Transforms = append(ret.Transforms, string(tran)) + } + } + if opts.MatchFieldValues != nil { + ret.Matchvalues = *opts.MatchFieldValues + } + ret.Negationconditon = opts.Negation + ret.Operator = string(opts.Operator) + var err error + switch opts.Type { + case cloudprovider.WafStatementTypeIPSet: + ret.Operator = "IPMatch" + ret.Matchvariables = []SMatchvariable{ + SMatchvariable{ + Variablename: "RemoteAddr", + }, + } + case cloudprovider.WafStatementTypeGeoMatch: + ret.Operator = "GeoMatch" + if len(opts.ForwardedIPHeader) == 0 { + ret.Matchvariables = []SMatchvariable{ + SMatchvariable{ + Variablename: "RemoteAddr", + }, + } + } else { + ret.Matchvariables = []SMatchvariable{ + SMatchvariable{ + Variablename: "RequestHeaders", + Selector: opts.ForwardedIPHeader, + }, + } + } + case cloudprovider.WafStatementTypeSize: + switch opts.Operator { + case "LT": + ret.Operator = "LessThan" + case "LE": + ret.Operator = "LessThanOrEqual" + case "GT": + ret.Operator = "GreaterThan" + default: + return ret, fmt.Errorf("invalid operator %s for %s", opts.Operator, opts.Type) + } + ret.Matchvariables, err = wafMatchFieldAndKeyLocal2Cloud(opts) + if err != nil { + return ret, errors.Wrapf(err, "wafMatchFieldAndKeyLocal2Cloud") + } + case cloudprovider.WafStatementTypeByteMatch: + switch opts.Operator { + case "Contains", "EndsWith", "Regex": + case "StartsWith": + ret.Operator = "BeginsWith" + case "Exactly": + ret.Operator = "Equal" + default: + return ret, fmt.Errorf("invalid operator %s for %s", opts.Operator, opts.Type) + } + ret.Matchvariables, err = wafMatchFieldAndKeyLocal2Cloud(opts) + if err != nil { + return ret, errors.Wrapf(err, "wafMatchFieldAndKeyLocal2Cloud") + } + } + return ret, nil +} + +func wafRuleLocal2Cloud(opts *cloudprovider.SWafRule) (*CustomRule, error) { + ret := &CustomRule{} + ret.Name = opts.Name + ret.Priority = opts.Priority + ret.Ruletype = "MatchRule" + ret.Matchconditions = []SMatchcondition{} + for _, s := range opts.Statements { + cds, err := wafStatementLocal2Cloud(s) + if err != nil { + return nil, errors.Wrapf(err, "wafStatementLocal2Cloud") + } + ret.Matchconditions = append(ret.Matchconditions, cds) + } + ret.Action = "Block" + if opts.Action != nil { + ret.Action = string(opts.Action.Action) + } + return ret, nil +} + +func (self *CustomRule) Update(opts *cloudprovider.SWafRule) error { + rules := []CustomRule{} + for _, rule := range self.waf.Properties.Customrules { + if rule.Name != self.Name { + rules = append(rules, rule) + } else { + rule, err := wafRuleLocal2Cloud(opts) + if err != nil { + return errors.Wrapf(err, "wafRuleLocal2Cloud") + } + rules = append(rules, *rule) + } + } + self.waf.Properties.Customrules = rules + return self.waf.region.update(jsonutils.Marshal(self.waf), nil) +} + +func (self *CustomRule) GetAction() *cloudprovider.DefaultAction { + return &cloudprovider.DefaultAction{ + Action: cloudprovider.TWafAction(self.Action), + } +} + +func (self *CustomRule) GetStatementCondition() cloudprovider.TWafStatementCondition { + return cloudprovider.WafStatementConditionAnd +} + +func (self *CustomRule) GetStatements() ([]cloudprovider.SWafStatement, error) { + ret := []cloudprovider.SWafStatement{} + for _, condition := range self.Matchconditions { + trans := cloudprovider.TextTransformations{} + for _, tran := range condition.Transforms { + trans = append(trans, cloudprovider.TWafTextTransformation(tran)) + } + values := cloudprovider.TWafMatchFieldValues(condition.Matchvalues) + statement := cloudprovider.SWafStatement{ + Negation: condition.Negationconditon, + Transformations: &trans, + MatchFieldValues: &values, + } + statement.MatchField, statement.MatchFieldKey, _ = wafMatchFieldAndKeyCloud2Local(condition.Matchvariables) + switch condition.Operator { + case "IPMatch": + statement.Type = cloudprovider.WafStatementTypeIPSet + case "GeoMatch": + statement.Type = cloudprovider.WafStatementTypeGeoMatch + case "LessThan": + statement.Type = cloudprovider.WafStatementTypeSize + statement.Operator = cloudprovider.WafOperatorLT + case "LessThanOrEqual": + statement.Type = cloudprovider.WafStatementTypeSize + statement.Operator = cloudprovider.WafOperatorLE + case "GreaterThan": + statement.Type = cloudprovider.WafStatementTypeSize + statement.Operator = cloudprovider.WafOperatorGT + case "BeginsWith": + statement.Type = cloudprovider.WafStatementTypeByteMatch + statement.Operator = cloudprovider.WafOperatorStartsWith + case "Contains", "EndsWith", "Regex": + statement.Type = cloudprovider.WafStatementTypeByteMatch + statement.Operator = cloudprovider.TWafOperator(condition.Operator) + case "Equal": + statement.Type = cloudprovider.WafStatementTypeByteMatch + statement.Operator = cloudprovider.WafOperatorExactly + default: + statement.Type = cloudprovider.WafStatementTypeByteMatch + } + ret = append(ret, statement) + } + return ret, nil +} + +type ManagedRule struct { + Rulesettype string `json:"ruleSetType"` + Rulesetversion string `json:"ruleSetVersion"` +} + +type ManagedRules struct { + waf *SAppGatewayWaf + Managedrulesets []ManagedRule `json:"managedRuleSets"` +} + +func (self *ManagedRules) GetName() string { + return fmt.Sprintf("%s Managed rules", self.waf.GetName()) +} + +func (self *ManagedRules) GetGlobalId() string { + return self.waf.GetGlobalId() +} + +func (self *ManagedRules) GetDesc() string { + return "" +} + +func (self *ManagedRules) GetPriority() int { + return 0 +} + +func (self *ManagedRules) GetAction() *cloudprovider.DefaultAction { + return nil +} + +func (self *ManagedRules) Delete() error { + return cloudprovider.ErrNotSupported +} + +func (self *ManagedRules) Update(opts *cloudprovider.SWafRule) error { + rules := []ManagedRule{} + for _, s := range opts.Statements { + if len(s.ManagedRuleGroupName) == 0 { + return fmt.Errorf("missing managed rule group name") + } + names := strings.Split(s.ManagedRuleGroupName, "_") + if len(names) != 2 { + return fmt.Errorf("invalid managed rule group name %s", s.ManagedRuleGroupName) + } + rules = append(rules, ManagedRule{ + Rulesettype: names[0], + Rulesetversion: names[1], + }) + } + if len(rules) == 0 { + return fmt.Errorf("missing statements") + } + self.waf.Properties.Managedrules = ManagedRules{ + Managedrulesets: rules, + } + return self.waf.region.update(jsonutils.Marshal(self.waf), nil) +} + +func (self *ManagedRules) GetStatementCondition() cloudprovider.TWafStatementCondition { + return cloudprovider.WafStatementConditionAnd +} + +func (self *ManagedRules) GetStatements() ([]cloudprovider.SWafStatement, error) { + ret := []cloudprovider.SWafStatement{} + for i := range self.Managedrulesets { + ruleGroupName := fmt.Sprintf("%s_%s", self.Managedrulesets[i].Rulesettype, self.Managedrulesets[i].Rulesetversion) + ret = append(ret, cloudprovider.SWafStatement{ + ManagedRuleGroupName: ruleGroupName, + Type: cloudprovider.WafStatementTypeManagedRuleGroup, + RuleGroupId: ruleGroupName, + }) + } + return ret, nil +} + +type SAppGatewayWaf struct { + multicloud.SResourceBase + multicloud.AzureTags + region *SRegion + + Name string `json:"name"` + ID string `json:"id"` + Type string `json:"type"` + Location string `json:"location"` + Properties struct { + ApplicationGateways []SApplicationGateway + HttpListeners []struct { + Id string + } + Resourcestate string `json:"resourceState"` + Provisioningstate string `json:"provisioningState"` + Policysettings struct { + State string `json:"state"` + Mode string `json:"mode"` + Maxrequestbodysizeinkb int `json:"maxRequestBodySizeInKb"` + Fileuploadlimitinmb int `json:"fileUploadLimitInMb"` + Requestbodycheck bool `json:"requestBodyCheck"` + } `json:"policySettings"` + Customrules []CustomRule `json:"customRules"` + Managedrules ManagedRules `json:"managedRules"` + } `json:"properties"` +} + +func (self *SAppGatewayWaf) GetEnabled() bool { + return self.Properties.Policysettings.State == "Enabled" +} + +func (self *SAppGatewayWaf) GetName() string { + return self.Name +} + +func (self *SAppGatewayWaf) GetId() string { + return self.ID +} + +func (self *SAppGatewayWaf) GetGlobalId() string { + return strings.ToLower(self.ID) +} + +func (self *SAppGatewayWaf) Delete() error { + return self.region.del(self.ID) +} + +func (self *SAppGatewayWaf) GetWafType() cloudprovider.TWafType { + return cloudprovider.WafTypeAppGateway +} + +func (self *SAppGatewayWaf) AddRule(opts *cloudprovider.SWafRule) (cloudprovider.ICloudWafRule, error) { + rule, err := wafRuleLocal2Cloud(opts) + if err != nil { + return nil, errors.Wrapf(err, "wafRuleLocal2Cloud") + } + rule.waf = self + self.Properties.Customrules = append(self.Properties.Customrules, *rule) + err = self.region.update(jsonutils.Marshal(self), nil) + if err != nil { + return nil, errors.Wrapf(err, "update") + } + return rule, nil +} + +func (self *SAppGatewayWaf) GetStatus() string { + switch self.Properties.Provisioningstate { + case "Deleting": + return api.WAF_STATUS_DELETING + case "Failed": + return api.WAF_STATUS_CREATE_FAILED + case "Succeeded": + return api.WAF_STATUS_AVAILABLE + case "Updating": + return api.WAF_STATUS_UPDATING + default: + return self.Properties.Provisioningstate + } +} + +func (self *SAppGatewayWaf) GetRules() ([]cloudprovider.ICloudWafRule, error) { + ret := []cloudprovider.ICloudWafRule{} + for i := range self.Properties.Customrules { + self.Properties.Customrules[i].waf = self + ret = append(ret, &self.Properties.Customrules[i]) + } + self.Properties.Managedrules.waf = self + ret = append(ret, &self.Properties.Managedrules) + return ret, nil +} + +func (self *SAppGatewayWaf) Refresh() error { + waf, err := self.region.GetAppGatewayWaf(self.ID) + if err != nil { + return errors.Wrapf(err, "GetAppGatewayWa") + } + return jsonutils.Update(self, waf) +} + +func (self *SAppGatewayWaf) GetDefaultAction() *cloudprovider.DefaultAction { + return &cloudprovider.DefaultAction{} +} + +func (self *SRegion) ListAppWafs() ([]SAppGatewayWaf, error) { + ret := []SAppGatewayWaf{} + err := self.list("Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies", url.Values{}, &ret) + if err != nil { + return nil, errors.Wrapf(err, "list") + } + return ret, nil +} + +type SAppWafRuleGroup struct { + Name string `json:"name"` + ID string `json:"id"` + Type string `json:"type"` + Properties struct { + Provisioningstate string `json:"provisioningState"` + Rulesettype string `json:"ruleSetType"` + Rulesetversion string `json:"ruleSetVersion"` + Rulegroups []struct { + Rulegroupname string `json:"ruleGroupName"` + Description string `json:"description"` + Rules []struct { + Ruleid int `json:"ruleId"` + Description string `json:"description"` + } `json:"rules"` + } `json:"ruleGroups"` + } `json:"properties"` +} + +func (self *SRegion) CreateICloudWafInstance(opts *cloudprovider.WafCreateOptions) (cloudprovider.ICloudWafInstance, error) { + switch opts.Type { + case cloudprovider.WafTypeAppGateway: + return self.CreateAppWafInstance(opts.Name, opts.DefaultAction) + default: + return nil, errors.Wrapf(cloudprovider.ErrNoSuchProvder, "invalid waf type %s", opts.Type) + } +} + +func (self *SRegion) GetICloudWafInstanceById(id string) (cloudprovider.ICloudWafInstance, error) { + if strings.Contains(id, "microsoft.network/applicationgatewaywebapplicationfirewallpolicies") { + return self.GetAppGatewayWaf(id) + } + return nil, errors.Wrapf(cloudprovider.ErrNotSupported, id) +} + +func (self *SRegion) CreateAppWafInstance(name string, action *cloudprovider.DefaultAction) (*SAppGatewayWaf, error) { + mode := cloudprovider.WafActionDetection + if action != nil { + switch action.Action { + case cloudprovider.WafActionDetection, cloudprovider.WafActionPrevention: + mode = action.Action + default: + return nil, errors.Wrapf(cloudprovider.ErrNotSupported, "invalid action %s", action.Action) + } + } + params := map[string]interface{}{ + "Type": "Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies", + "Name": name, + "Location": self.Name, + "properties": map[string]interface{}{ + "customRules": []string{}, + "policySettings": map[string]interface{}{ + "fileUploadLimitInMb": 100, + "maxRequestBodySizeInKb": 128, + "mode": mode, + "requestBodyCheck": true, + "state": "Enabled", + }, + "managedRules": map[string]interface{}{ + "exclusions": []string{}, + "managedRuleSets": []map[string]interface{}{ + map[string]interface{}{ + "ruleSetType": "OWASP", + "ruleSetVersion": "3.1", + "ruleGroupOverrides": []string{}, + }, + }, + }, + }, + } + ret := &SAppGatewayWaf{region: self} + err := self.create("", jsonutils.Marshal(params), ret) + if err != nil { + return nil, err + } + return ret, nil +} + +func (self *SRegion) GetAppGatewayWaf(id string) (*SAppGatewayWaf, error) { + res := &SAppGatewayWaf{region: self} + return res, self.get(id, nil, &res) +} + +func (self *SRegion) ListAppWafManagedRuleGroup() ([]SAppWafRuleGroup, error) { + ret := []SAppWafRuleGroup{} + err := self.list("Microsoft.Network/applicationGatewayAvailableWafRuleSets", url.Values{}, &ret) + if err != nil { + return nil, errors.Wrapf(err, "list") + } + return ret, nil +} + +func (self *SRegion) GetICloudWafInstances() ([]cloudprovider.ICloudWafInstance, error) { + wafs, err := self.ListAppWafs() + if err != nil { + return nil, errors.Wrapf(err, "ListAppWafs") + } + ret := []cloudprovider.ICloudWafInstance{} + for i := range wafs { + wafs[i].region = self + ret = append(ret, &wafs[i]) + } + return ret, nil +} + +func (self *SAppGatewayWaf) GetCloudResources() ([]cloudprovider.SCloudResource, error) { + ret := []cloudprovider.SCloudResource{} + for _, ag := range self.Properties.ApplicationGateways { + ret = append(ret, cloudprovider.SCloudResource{ + Id: ag.ID, + Type: "app_gateway", + CanDissociate: true, + }) + } + for _, lis := range self.Properties.HttpListeners { + ret = append(ret, cloudprovider.SCloudResource{ + Id: lis.Id, + Type: "http_listener", + CanDissociate: true, + }) + } + return ret, nil +} diff --git a/pkg/multicloud/azure/waf_front_doors.go b/pkg/multicloud/azure/waf_front_doors.go new file mode 100644 index 0000000000..e44e5e9433 --- /dev/null +++ b/pkg/multicloud/azure/waf_front_doors.go @@ -0,0 +1,69 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package azure + +import "net/url" + +type SFrontDoorProperties struct { + ResourceState string + ProvisioningState string + PolicySettings struct { + EnabledState string + Mode string + RedirectUrl string + CustomBlockResponseStatusCode int + CustomBlockResponseBody string + RequestBodyCheck string + } + CustomRules struct { + Rules []struct{} + } + ManagedRules struct { + ManagedRuleSets []struct { + RuleSetType string + RuleSetVersion string + RuleSetAction string + RuleGroupOverrides []struct { + } + Exclusions []struct{} + } + } + FrontendEndpointLinks []struct{} + RoutingRuleLinks []struct{} + SecurityPolicyLinks []struct{} +} + +type SFrontDoorWaf struct { + Id string + Name string + Type string + Tags map[string]string + Location string + Sku struct { + Name string + } + Properties SFrontDoorProperties +} + +func (self *SRegion) ListFrontDoorWafs(resGroup string) ([]SFrontDoorWaf, error) { + params := url.Values{} + params.Set("resourceGroups", resGroup) + ret := []SFrontDoorWaf{} + err := self.list("Microsoft.Network/frontdoorWebApplicationFirewallPolicies", params, &ret) + if err != nil { + return nil, err + } + return ret, nil +} diff --git a/pkg/multicloud/azure/waf_rule_groups.go b/pkg/multicloud/azure/waf_rule_groups.go new file mode 100644 index 0000000000..ea853f2ffe --- /dev/null +++ b/pkg/multicloud/azure/waf_rule_groups.go @@ -0,0 +1,54 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package azure + +import "net/url" + +type SWafRule struct { + RuleId string + Description string + DefaultAction string + DefaultState string +} + +type SRuleGroup struct { + ruleGroupName string + description string + Rules []SWafRule +} + +type SManagedRuleGroupProperties struct { + ProvisioningState string + RuleSetId string + RuleSetType string + RuleSetVersion string + RuleGroups []SRuleGroup +} + +type SManagedRuleGroup struct { + Name string + Id string + Type string + Properties SManagedRuleGroupProperties +} + +func (self *SRegion) ListManagedRuleGroups() ([]SManagedRuleGroup, error) { + groups := []SManagedRuleGroup{} + err := self.list("Microsoft.Network/FrontDoorWebApplicationFirewallManagedRuleSets", url.Values{}, &groups) + if err != nil { + return nil, err + } + return groups, nil +} diff --git a/pkg/multicloud/region_base.go b/pkg/multicloud/region_base.go index 681e7878bc..86353eccba 100644 --- a/pkg/multicloud/region_base.go +++ b/pkg/multicloud/region_base.go @@ -182,3 +182,27 @@ func (self *SRegion) GetICloudApplicationGateways() ([]cloudprovider.ICloudAppli func (self *SRegion) GetICloudApplicationGatewayById(id string) (cloudprovider.ICloudApplicationGateway, error) { return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "GetICloudApplicationGatewayById") } + +func (self *SRegion) GetICloudWafIPSets() ([]cloudprovider.ICloudWafIPSet, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "GetICloudWafIPSets") +} + +func (self *SRegion) GetICloudWafRegexSets() ([]cloudprovider.ICloudWafRegexSet, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "GetICloudWafRegexSets") +} + +func (self *SRegion) GetICloudWafInstances() ([]cloudprovider.ICloudWafInstance, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "GetICloudWafInstances") +} + +func (self *SRegion) GetICloudWafInstanceById(id string) (cloudprovider.ICloudWafInstance, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "GetICloudWafInstanceById") +} + +func (self *SRegion) CreateICloudWafInstance(opts *cloudprovider.WafCreateOptions) (cloudprovider.ICloudWafInstance, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "CreateICloudWafInstance") +} + +func (self *SRegion) GetICloudWafRuleGroups() ([]cloudprovider.ICloudWafRuleGroup, error) { + return nil, errors.Wrapf(cloudprovider.ErrNotImplemented, "GetICloudWafRuleGroups") +} diff --git a/vendor/github.com/aws/aws-sdk-go/service/wafv2/api.go b/vendor/github.com/aws/aws-sdk-go/service/wafv2/api.go new file mode 100644 index 0000000000..a7112a2513 --- /dev/null +++ b/vendor/github.com/aws/aws-sdk-go/service/wafv2/api.go @@ -0,0 +1,15985 @@ +// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. + +package wafv2 + +import ( + "fmt" + "time" + + "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/awsutil" + "github.com/aws/aws-sdk-go/aws/request" + "github.com/aws/aws-sdk-go/private/protocol" + "github.com/aws/aws-sdk-go/private/protocol/jsonrpc" +) + +const opAssociateWebACL = "AssociateWebACL" + +// AssociateWebACLRequest generates a "aws/request.Request" representing the +// client's request for the AssociateWebACL operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See AssociateWebACL for more information on using the AssociateWebACL +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the AssociateWebACLRequest method. +// req, resp := client.AssociateWebACLRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/AssociateWebACL +func (c *WAFV2) AssociateWebACLRequest(input *AssociateWebACLInput) (req *request.Request, output *AssociateWebACLOutput) { + op := &request.Operation{ + Name: opAssociateWebACL, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &AssociateWebACLInput{} + } + + output = &AssociateWebACLOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// AssociateWebACL API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Associates a Web ACL with a regional application resource, to protect the +// resource. A regional application can be an Application Load Balancer (ALB), +// an API Gateway REST API, or an AppSync GraphQL API. +// +// For AWS CloudFront, don't use this call. Instead, use your CloudFront distribution +// configuration. To associate a Web ACL, in the CloudFront call UpdateDistribution, +// set the web ACL ID to the Amazon Resource Name (ARN) of the Web ACL. For +// information, see UpdateDistribution (https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html). +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation AssociateWebACL for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFUnavailableEntityException +// AWS WAF couldn’t retrieve the resource that you requested. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/AssociateWebACL +func (c *WAFV2) AssociateWebACL(input *AssociateWebACLInput) (*AssociateWebACLOutput, error) { + req, out := c.AssociateWebACLRequest(input) + return out, req.Send() +} + +// AssociateWebACLWithContext is the same as AssociateWebACL with the addition of +// the ability to pass a context and additional request options. +// +// See AssociateWebACL for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) AssociateWebACLWithContext(ctx aws.Context, input *AssociateWebACLInput, opts ...request.Option) (*AssociateWebACLOutput, error) { + req, out := c.AssociateWebACLRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opCheckCapacity = "CheckCapacity" + +// CheckCapacityRequest generates a "aws/request.Request" representing the +// client's request for the CheckCapacity operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See CheckCapacity for more information on using the CheckCapacity +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the CheckCapacityRequest method. +// req, resp := client.CheckCapacityRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CheckCapacity +func (c *WAFV2) CheckCapacityRequest(input *CheckCapacityInput) (req *request.Request, output *CheckCapacityOutput) { + op := &request.Operation{ + Name: opCheckCapacity, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &CheckCapacityInput{} + } + + output = &CheckCapacityOutput{} + req = c.newRequest(op, input, output) + return +} + +// CheckCapacity API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Returns the web ACL capacity unit (WCU) requirements for a specified scope +// and set of rules. You can use this to check the capacity requirements for +// the rules you want to use in a RuleGroup or WebACL. +// +// AWS WAF uses WCUs to calculate and control the operating resources that are +// used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity +// differently for each rule type, to reflect the relative cost of each rule. +// Simple rules that cost little to run use fewer WCUs than more complex rules +// that use more processing power. Rule group capacity is fixed at creation, +// which helps users plan their web ACL WCU usage when they use a rule group. +// The WCU limit for web ACLs is 1,500. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation CheckCapacity for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFInvalidResourceException +// AWS WAF couldn’t perform the operation because the resource that you requested +// isn’t valid. Check the resource, and try again. +// +// * WAFUnavailableEntityException +// AWS WAF couldn’t retrieve the resource that you requested. Retry your request. +// +// * WAFSubscriptionNotFoundException +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CheckCapacity +func (c *WAFV2) CheckCapacity(input *CheckCapacityInput) (*CheckCapacityOutput, error) { + req, out := c.CheckCapacityRequest(input) + return out, req.Send() +} + +// CheckCapacityWithContext is the same as CheckCapacity with the addition of +// the ability to pass a context and additional request options. +// +// See CheckCapacity for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) CheckCapacityWithContext(ctx aws.Context, input *CheckCapacityInput, opts ...request.Option) (*CheckCapacityOutput, error) { + req, out := c.CheckCapacityRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opCreateIPSet = "CreateIPSet" + +// CreateIPSetRequest generates a "aws/request.Request" representing the +// client's request for the CreateIPSet operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See CreateIPSet for more information on using the CreateIPSet +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the CreateIPSetRequest method. +// req, resp := client.CreateIPSetRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CreateIPSet +func (c *WAFV2) CreateIPSetRequest(input *CreateIPSetInput) (req *request.Request, output *CreateIPSetOutput) { + op := &request.Operation{ + Name: opCreateIPSet, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &CreateIPSetInput{} + } + + output = &CreateIPSetOutput{} + req = c.newRequest(op, input, output) + return +} + +// CreateIPSet API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Creates an IPSet, which you use to identify web requests that originate from +// specific IP addresses or ranges of IP addresses. For example, if you're receiving +// a lot of requests from a ranges of IP addresses, you can configure AWS WAF +// to block them using an IPSet that lists those IP addresses. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation CreateIPSet for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFDuplicateItemException +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CreateIPSet +func (c *WAFV2) CreateIPSet(input *CreateIPSetInput) (*CreateIPSetOutput, error) { + req, out := c.CreateIPSetRequest(input) + return out, req.Send() +} + +// CreateIPSetWithContext is the same as CreateIPSet with the addition of +// the ability to pass a context and additional request options. +// +// See CreateIPSet for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) CreateIPSetWithContext(ctx aws.Context, input *CreateIPSetInput, opts ...request.Option) (*CreateIPSetOutput, error) { + req, out := c.CreateIPSetRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opCreateRegexPatternSet = "CreateRegexPatternSet" + +// CreateRegexPatternSetRequest generates a "aws/request.Request" representing the +// client's request for the CreateRegexPatternSet operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See CreateRegexPatternSet for more information on using the CreateRegexPatternSet +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the CreateRegexPatternSetRequest method. +// req, resp := client.CreateRegexPatternSetRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CreateRegexPatternSet +func (c *WAFV2) CreateRegexPatternSetRequest(input *CreateRegexPatternSetInput) (req *request.Request, output *CreateRegexPatternSetOutput) { + op := &request.Operation{ + Name: opCreateRegexPatternSet, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &CreateRegexPatternSetInput{} + } + + output = &CreateRegexPatternSetOutput{} + req = c.newRequest(op, input, output) + return +} + +// CreateRegexPatternSet API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Creates a RegexPatternSet, which you reference in a RegexPatternSetReferenceStatement, +// to have AWS WAF inspect a web request component for the specified patterns. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation CreateRegexPatternSet for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFDuplicateItemException +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CreateRegexPatternSet +func (c *WAFV2) CreateRegexPatternSet(input *CreateRegexPatternSetInput) (*CreateRegexPatternSetOutput, error) { + req, out := c.CreateRegexPatternSetRequest(input) + return out, req.Send() +} + +// CreateRegexPatternSetWithContext is the same as CreateRegexPatternSet with the addition of +// the ability to pass a context and additional request options. +// +// See CreateRegexPatternSet for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) CreateRegexPatternSetWithContext(ctx aws.Context, input *CreateRegexPatternSetInput, opts ...request.Option) (*CreateRegexPatternSetOutput, error) { + req, out := c.CreateRegexPatternSetRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opCreateRuleGroup = "CreateRuleGroup" + +// CreateRuleGroupRequest generates a "aws/request.Request" representing the +// client's request for the CreateRuleGroup operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See CreateRuleGroup for more information on using the CreateRuleGroup +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the CreateRuleGroupRequest method. +// req, resp := client.CreateRuleGroupRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CreateRuleGroup +func (c *WAFV2) CreateRuleGroupRequest(input *CreateRuleGroupInput) (req *request.Request, output *CreateRuleGroupOutput) { + op := &request.Operation{ + Name: opCreateRuleGroup, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &CreateRuleGroupInput{} + } + + output = &CreateRuleGroupOutput{} + req = c.newRequest(op, input, output) + return +} + +// CreateRuleGroup API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Creates a RuleGroup per the specifications provided. +// +// A rule group defines a collection of rules to inspect and control web requests +// that you can use in a WebACL. When you create a rule group, you define an +// immutable capacity limit. If you update a rule group, you must stay within +// the capacity. This allows others to reuse the rule group with confidence +// in its capacity requirements. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation CreateRuleGroup for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFDuplicateItemException +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFUnavailableEntityException +// AWS WAF couldn’t retrieve the resource that you requested. Retry your request. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFSubscriptionNotFoundException +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CreateRuleGroup +func (c *WAFV2) CreateRuleGroup(input *CreateRuleGroupInput) (*CreateRuleGroupOutput, error) { + req, out := c.CreateRuleGroupRequest(input) + return out, req.Send() +} + +// CreateRuleGroupWithContext is the same as CreateRuleGroup with the addition of +// the ability to pass a context and additional request options. +// +// See CreateRuleGroup for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) CreateRuleGroupWithContext(ctx aws.Context, input *CreateRuleGroupInput, opts ...request.Option) (*CreateRuleGroupOutput, error) { + req, out := c.CreateRuleGroupRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opCreateWebACL = "CreateWebACL" + +// CreateWebACLRequest generates a "aws/request.Request" representing the +// client's request for the CreateWebACL operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See CreateWebACL for more information on using the CreateWebACL +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the CreateWebACLRequest method. +// req, resp := client.CreateWebACLRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CreateWebACL +func (c *WAFV2) CreateWebACLRequest(input *CreateWebACLInput) (req *request.Request, output *CreateWebACLOutput) { + op := &request.Operation{ + Name: opCreateWebACL, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &CreateWebACLInput{} + } + + output = &CreateWebACLOutput{} + req = c.newRequest(op, input, output) + return +} + +// CreateWebACL API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Creates a WebACL per the specifications provided. +// +// A Web ACL defines a collection of rules to use to inspect and control web +// requests. Each rule has an action defined (allow, block, or count) for requests +// that match the statement of the rule. In the Web ACL, you assign a default +// action to take (allow, block) for any request that does not match any of +// the rules. The rules in a Web ACL can be a combination of the types Rule, +// RuleGroup, and managed rule group. You can associate a Web ACL with one or +// more AWS resources to protect. The resources can be Amazon CloudFront, an +// Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync +// GraphQL API. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation CreateWebACL for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFDuplicateItemException +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFInvalidResourceException +// AWS WAF couldn’t perform the operation because the resource that you requested +// isn’t valid. Check the resource, and try again. +// +// * WAFUnavailableEntityException +// AWS WAF couldn’t retrieve the resource that you requested. Retry your request. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFSubscriptionNotFoundException +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/CreateWebACL +func (c *WAFV2) CreateWebACL(input *CreateWebACLInput) (*CreateWebACLOutput, error) { + req, out := c.CreateWebACLRequest(input) + return out, req.Send() +} + +// CreateWebACLWithContext is the same as CreateWebACL with the addition of +// the ability to pass a context and additional request options. +// +// See CreateWebACL for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) CreateWebACLWithContext(ctx aws.Context, input *CreateWebACLInput, opts ...request.Option) (*CreateWebACLOutput, error) { + req, out := c.CreateWebACLRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDeleteFirewallManagerRuleGroups = "DeleteFirewallManagerRuleGroups" + +// DeleteFirewallManagerRuleGroupsRequest generates a "aws/request.Request" representing the +// client's request for the DeleteFirewallManagerRuleGroups operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DeleteFirewallManagerRuleGroups for more information on using the DeleteFirewallManagerRuleGroups +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DeleteFirewallManagerRuleGroupsRequest method. +// req, resp := client.DeleteFirewallManagerRuleGroupsRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteFirewallManagerRuleGroups +func (c *WAFV2) DeleteFirewallManagerRuleGroupsRequest(input *DeleteFirewallManagerRuleGroupsInput) (req *request.Request, output *DeleteFirewallManagerRuleGroupsOutput) { + op := &request.Operation{ + Name: opDeleteFirewallManagerRuleGroups, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DeleteFirewallManagerRuleGroupsInput{} + } + + output = &DeleteFirewallManagerRuleGroupsOutput{} + req = c.newRequest(op, input, output) + return +} + +// DeleteFirewallManagerRuleGroups API operation for AWS WAFV2. +// +// Deletes all rule groups that are managed by AWS Firewall Manager for the +// specified web ACL. +// +// You can only use this if ManagedByFirewallManager is false in the specified +// WebACL. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DeleteFirewallManagerRuleGroups for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteFirewallManagerRuleGroups +func (c *WAFV2) DeleteFirewallManagerRuleGroups(input *DeleteFirewallManagerRuleGroupsInput) (*DeleteFirewallManagerRuleGroupsOutput, error) { + req, out := c.DeleteFirewallManagerRuleGroupsRequest(input) + return out, req.Send() +} + +// DeleteFirewallManagerRuleGroupsWithContext is the same as DeleteFirewallManagerRuleGroups with the addition of +// the ability to pass a context and additional request options. +// +// See DeleteFirewallManagerRuleGroups for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DeleteFirewallManagerRuleGroupsWithContext(ctx aws.Context, input *DeleteFirewallManagerRuleGroupsInput, opts ...request.Option) (*DeleteFirewallManagerRuleGroupsOutput, error) { + req, out := c.DeleteFirewallManagerRuleGroupsRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDeleteIPSet = "DeleteIPSet" + +// DeleteIPSetRequest generates a "aws/request.Request" representing the +// client's request for the DeleteIPSet operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DeleteIPSet for more information on using the DeleteIPSet +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DeleteIPSetRequest method. +// req, resp := client.DeleteIPSetRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteIPSet +func (c *WAFV2) DeleteIPSetRequest(input *DeleteIPSetInput) (req *request.Request, output *DeleteIPSetOutput) { + op := &request.Operation{ + Name: opDeleteIPSet, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DeleteIPSetInput{} + } + + output = &DeleteIPSetOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// DeleteIPSet API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Deletes the specified IPSet. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DeleteIPSet for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFAssociatedItemException +// AWS WAF couldn’t perform the operation because your resource is being used +// by another resource or it’s associated with another resource. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteIPSet +func (c *WAFV2) DeleteIPSet(input *DeleteIPSetInput) (*DeleteIPSetOutput, error) { + req, out := c.DeleteIPSetRequest(input) + return out, req.Send() +} + +// DeleteIPSetWithContext is the same as DeleteIPSet with the addition of +// the ability to pass a context and additional request options. +// +// See DeleteIPSet for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DeleteIPSetWithContext(ctx aws.Context, input *DeleteIPSetInput, opts ...request.Option) (*DeleteIPSetOutput, error) { + req, out := c.DeleteIPSetRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDeleteLoggingConfiguration = "DeleteLoggingConfiguration" + +// DeleteLoggingConfigurationRequest generates a "aws/request.Request" representing the +// client's request for the DeleteLoggingConfiguration operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DeleteLoggingConfiguration for more information on using the DeleteLoggingConfiguration +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DeleteLoggingConfigurationRequest method. +// req, resp := client.DeleteLoggingConfigurationRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteLoggingConfiguration +func (c *WAFV2) DeleteLoggingConfigurationRequest(input *DeleteLoggingConfigurationInput) (req *request.Request, output *DeleteLoggingConfigurationOutput) { + op := &request.Operation{ + Name: opDeleteLoggingConfiguration, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DeleteLoggingConfigurationInput{} + } + + output = &DeleteLoggingConfigurationOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// DeleteLoggingConfiguration API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Deletes the LoggingConfiguration from the specified web ACL. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DeleteLoggingConfiguration for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteLoggingConfiguration +func (c *WAFV2) DeleteLoggingConfiguration(input *DeleteLoggingConfigurationInput) (*DeleteLoggingConfigurationOutput, error) { + req, out := c.DeleteLoggingConfigurationRequest(input) + return out, req.Send() +} + +// DeleteLoggingConfigurationWithContext is the same as DeleteLoggingConfiguration with the addition of +// the ability to pass a context and additional request options. +// +// See DeleteLoggingConfiguration for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DeleteLoggingConfigurationWithContext(ctx aws.Context, input *DeleteLoggingConfigurationInput, opts ...request.Option) (*DeleteLoggingConfigurationOutput, error) { + req, out := c.DeleteLoggingConfigurationRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDeletePermissionPolicy = "DeletePermissionPolicy" + +// DeletePermissionPolicyRequest generates a "aws/request.Request" representing the +// client's request for the DeletePermissionPolicy operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DeletePermissionPolicy for more information on using the DeletePermissionPolicy +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DeletePermissionPolicyRequest method. +// req, resp := client.DeletePermissionPolicyRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeletePermissionPolicy +func (c *WAFV2) DeletePermissionPolicyRequest(input *DeletePermissionPolicyInput) (req *request.Request, output *DeletePermissionPolicyOutput) { + op := &request.Operation{ + Name: opDeletePermissionPolicy, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DeletePermissionPolicyInput{} + } + + output = &DeletePermissionPolicyOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// DeletePermissionPolicy API operation for AWS WAFV2. +// +// Permanently deletes an IAM policy from the specified rule group. +// +// You must be the owner of the rule group to perform this operation. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DeletePermissionPolicy for usage and error information. +// +// Returned Error Types: +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeletePermissionPolicy +func (c *WAFV2) DeletePermissionPolicy(input *DeletePermissionPolicyInput) (*DeletePermissionPolicyOutput, error) { + req, out := c.DeletePermissionPolicyRequest(input) + return out, req.Send() +} + +// DeletePermissionPolicyWithContext is the same as DeletePermissionPolicy with the addition of +// the ability to pass a context and additional request options. +// +// See DeletePermissionPolicy for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DeletePermissionPolicyWithContext(ctx aws.Context, input *DeletePermissionPolicyInput, opts ...request.Option) (*DeletePermissionPolicyOutput, error) { + req, out := c.DeletePermissionPolicyRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDeleteRegexPatternSet = "DeleteRegexPatternSet" + +// DeleteRegexPatternSetRequest generates a "aws/request.Request" representing the +// client's request for the DeleteRegexPatternSet operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DeleteRegexPatternSet for more information on using the DeleteRegexPatternSet +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DeleteRegexPatternSetRequest method. +// req, resp := client.DeleteRegexPatternSetRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteRegexPatternSet +func (c *WAFV2) DeleteRegexPatternSetRequest(input *DeleteRegexPatternSetInput) (req *request.Request, output *DeleteRegexPatternSetOutput) { + op := &request.Operation{ + Name: opDeleteRegexPatternSet, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DeleteRegexPatternSetInput{} + } + + output = &DeleteRegexPatternSetOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// DeleteRegexPatternSet API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Deletes the specified RegexPatternSet. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DeleteRegexPatternSet for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFAssociatedItemException +// AWS WAF couldn’t perform the operation because your resource is being used +// by another resource or it’s associated with another resource. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteRegexPatternSet +func (c *WAFV2) DeleteRegexPatternSet(input *DeleteRegexPatternSetInput) (*DeleteRegexPatternSetOutput, error) { + req, out := c.DeleteRegexPatternSetRequest(input) + return out, req.Send() +} + +// DeleteRegexPatternSetWithContext is the same as DeleteRegexPatternSet with the addition of +// the ability to pass a context and additional request options. +// +// See DeleteRegexPatternSet for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DeleteRegexPatternSetWithContext(ctx aws.Context, input *DeleteRegexPatternSetInput, opts ...request.Option) (*DeleteRegexPatternSetOutput, error) { + req, out := c.DeleteRegexPatternSetRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDeleteRuleGroup = "DeleteRuleGroup" + +// DeleteRuleGroupRequest generates a "aws/request.Request" representing the +// client's request for the DeleteRuleGroup operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DeleteRuleGroup for more information on using the DeleteRuleGroup +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DeleteRuleGroupRequest method. +// req, resp := client.DeleteRuleGroupRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteRuleGroup +func (c *WAFV2) DeleteRuleGroupRequest(input *DeleteRuleGroupInput) (req *request.Request, output *DeleteRuleGroupOutput) { + op := &request.Operation{ + Name: opDeleteRuleGroup, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DeleteRuleGroupInput{} + } + + output = &DeleteRuleGroupOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// DeleteRuleGroup API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Deletes the specified RuleGroup. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DeleteRuleGroup for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFAssociatedItemException +// AWS WAF couldn’t perform the operation because your resource is being used +// by another resource or it’s associated with another resource. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteRuleGroup +func (c *WAFV2) DeleteRuleGroup(input *DeleteRuleGroupInput) (*DeleteRuleGroupOutput, error) { + req, out := c.DeleteRuleGroupRequest(input) + return out, req.Send() +} + +// DeleteRuleGroupWithContext is the same as DeleteRuleGroup with the addition of +// the ability to pass a context and additional request options. +// +// See DeleteRuleGroup for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DeleteRuleGroupWithContext(ctx aws.Context, input *DeleteRuleGroupInput, opts ...request.Option) (*DeleteRuleGroupOutput, error) { + req, out := c.DeleteRuleGroupRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDeleteWebACL = "DeleteWebACL" + +// DeleteWebACLRequest generates a "aws/request.Request" representing the +// client's request for the DeleteWebACL operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DeleteWebACL for more information on using the DeleteWebACL +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DeleteWebACLRequest method. +// req, resp := client.DeleteWebACLRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteWebACL +func (c *WAFV2) DeleteWebACLRequest(input *DeleteWebACLInput) (req *request.Request, output *DeleteWebACLOutput) { + op := &request.Operation{ + Name: opDeleteWebACL, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DeleteWebACLInput{} + } + + output = &DeleteWebACLOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// DeleteWebACL API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Deletes the specified WebACL. +// +// You can only use this if ManagedByFirewallManager is false in the specified +// WebACL. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DeleteWebACL for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFAssociatedItemException +// AWS WAF couldn’t perform the operation because your resource is being used +// by another resource or it’s associated with another resource. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DeleteWebACL +func (c *WAFV2) DeleteWebACL(input *DeleteWebACLInput) (*DeleteWebACLOutput, error) { + req, out := c.DeleteWebACLRequest(input) + return out, req.Send() +} + +// DeleteWebACLWithContext is the same as DeleteWebACL with the addition of +// the ability to pass a context and additional request options. +// +// See DeleteWebACL for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DeleteWebACLWithContext(ctx aws.Context, input *DeleteWebACLInput, opts ...request.Option) (*DeleteWebACLOutput, error) { + req, out := c.DeleteWebACLRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDescribeManagedRuleGroup = "DescribeManagedRuleGroup" + +// DescribeManagedRuleGroupRequest generates a "aws/request.Request" representing the +// client's request for the DescribeManagedRuleGroup operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DescribeManagedRuleGroup for more information on using the DescribeManagedRuleGroup +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DescribeManagedRuleGroupRequest method. +// req, resp := client.DescribeManagedRuleGroupRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DescribeManagedRuleGroup +func (c *WAFV2) DescribeManagedRuleGroupRequest(input *DescribeManagedRuleGroupInput) (req *request.Request, output *DescribeManagedRuleGroupOutput) { + op := &request.Operation{ + Name: opDescribeManagedRuleGroup, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DescribeManagedRuleGroupInput{} + } + + output = &DescribeManagedRuleGroupOutput{} + req = c.newRequest(op, input, output) + return +} + +// DescribeManagedRuleGroup API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Provides high-level information for a managed rule group, including descriptions +// of the rules. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DescribeManagedRuleGroup for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidResourceException +// AWS WAF couldn’t perform the operation because the resource that you requested +// isn’t valid. Check the resource, and try again. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DescribeManagedRuleGroup +func (c *WAFV2) DescribeManagedRuleGroup(input *DescribeManagedRuleGroupInput) (*DescribeManagedRuleGroupOutput, error) { + req, out := c.DescribeManagedRuleGroupRequest(input) + return out, req.Send() +} + +// DescribeManagedRuleGroupWithContext is the same as DescribeManagedRuleGroup with the addition of +// the ability to pass a context and additional request options. +// +// See DescribeManagedRuleGroup for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DescribeManagedRuleGroupWithContext(ctx aws.Context, input *DescribeManagedRuleGroupInput, opts ...request.Option) (*DescribeManagedRuleGroupOutput, error) { + req, out := c.DescribeManagedRuleGroupRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opDisassociateWebACL = "DisassociateWebACL" + +// DisassociateWebACLRequest generates a "aws/request.Request" representing the +// client's request for the DisassociateWebACL operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See DisassociateWebACL for more information on using the DisassociateWebACL +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the DisassociateWebACLRequest method. +// req, resp := client.DisassociateWebACLRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DisassociateWebACL +func (c *WAFV2) DisassociateWebACLRequest(input *DisassociateWebACLInput) (req *request.Request, output *DisassociateWebACLOutput) { + op := &request.Operation{ + Name: opDisassociateWebACL, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &DisassociateWebACLInput{} + } + + output = &DisassociateWebACLOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// DisassociateWebACL API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Disassociates a Web ACL from a regional application resource. A regional +// application can be an Application Load Balancer (ALB), an API Gateway REST +// API, or an AppSync GraphQL API. +// +// For AWS CloudFront, don't use this call. Instead, use your CloudFront distribution +// configuration. To disassociate a Web ACL, provide an empty web ACL ID in +// the CloudFront call UpdateDistribution. For information, see UpdateDistribution +// (https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html). +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation DisassociateWebACL for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/DisassociateWebACL +func (c *WAFV2) DisassociateWebACL(input *DisassociateWebACLInput) (*DisassociateWebACLOutput, error) { + req, out := c.DisassociateWebACLRequest(input) + return out, req.Send() +} + +// DisassociateWebACLWithContext is the same as DisassociateWebACL with the addition of +// the ability to pass a context and additional request options. +// +// See DisassociateWebACL for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) DisassociateWebACLWithContext(ctx aws.Context, input *DisassociateWebACLInput, opts ...request.Option) (*DisassociateWebACLOutput, error) { + req, out := c.DisassociateWebACLRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetIPSet = "GetIPSet" + +// GetIPSetRequest generates a "aws/request.Request" representing the +// client's request for the GetIPSet operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetIPSet for more information on using the GetIPSet +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetIPSetRequest method. +// req, resp := client.GetIPSetRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetIPSet +func (c *WAFV2) GetIPSetRequest(input *GetIPSetInput) (req *request.Request, output *GetIPSetOutput) { + op := &request.Operation{ + Name: opGetIPSet, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetIPSetInput{} + } + + output = &GetIPSetOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetIPSet API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves the specified IPSet. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetIPSet for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetIPSet +func (c *WAFV2) GetIPSet(input *GetIPSetInput) (*GetIPSetOutput, error) { + req, out := c.GetIPSetRequest(input) + return out, req.Send() +} + +// GetIPSetWithContext is the same as GetIPSet with the addition of +// the ability to pass a context and additional request options. +// +// See GetIPSet for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetIPSetWithContext(ctx aws.Context, input *GetIPSetInput, opts ...request.Option) (*GetIPSetOutput, error) { + req, out := c.GetIPSetRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetLoggingConfiguration = "GetLoggingConfiguration" + +// GetLoggingConfigurationRequest generates a "aws/request.Request" representing the +// client's request for the GetLoggingConfiguration operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetLoggingConfiguration for more information on using the GetLoggingConfiguration +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetLoggingConfigurationRequest method. +// req, resp := client.GetLoggingConfigurationRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetLoggingConfiguration +func (c *WAFV2) GetLoggingConfigurationRequest(input *GetLoggingConfigurationInput) (req *request.Request, output *GetLoggingConfigurationOutput) { + op := &request.Operation{ + Name: opGetLoggingConfiguration, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetLoggingConfigurationInput{} + } + + output = &GetLoggingConfigurationOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetLoggingConfiguration API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Returns the LoggingConfiguration for the specified web ACL. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetLoggingConfiguration for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetLoggingConfiguration +func (c *WAFV2) GetLoggingConfiguration(input *GetLoggingConfigurationInput) (*GetLoggingConfigurationOutput, error) { + req, out := c.GetLoggingConfigurationRequest(input) + return out, req.Send() +} + +// GetLoggingConfigurationWithContext is the same as GetLoggingConfiguration with the addition of +// the ability to pass a context and additional request options. +// +// See GetLoggingConfiguration for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetLoggingConfigurationWithContext(ctx aws.Context, input *GetLoggingConfigurationInput, opts ...request.Option) (*GetLoggingConfigurationOutput, error) { + req, out := c.GetLoggingConfigurationRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetPermissionPolicy = "GetPermissionPolicy" + +// GetPermissionPolicyRequest generates a "aws/request.Request" representing the +// client's request for the GetPermissionPolicy operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetPermissionPolicy for more information on using the GetPermissionPolicy +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetPermissionPolicyRequest method. +// req, resp := client.GetPermissionPolicyRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetPermissionPolicy +func (c *WAFV2) GetPermissionPolicyRequest(input *GetPermissionPolicyInput) (req *request.Request, output *GetPermissionPolicyOutput) { + op := &request.Operation{ + Name: opGetPermissionPolicy, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetPermissionPolicyInput{} + } + + output = &GetPermissionPolicyOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetPermissionPolicy API operation for AWS WAFV2. +// +// Returns the IAM policy that is attached to the specified rule group. +// +// You must be the owner of the rule group to perform this operation. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetPermissionPolicy for usage and error information. +// +// Returned Error Types: +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetPermissionPolicy +func (c *WAFV2) GetPermissionPolicy(input *GetPermissionPolicyInput) (*GetPermissionPolicyOutput, error) { + req, out := c.GetPermissionPolicyRequest(input) + return out, req.Send() +} + +// GetPermissionPolicyWithContext is the same as GetPermissionPolicy with the addition of +// the ability to pass a context and additional request options. +// +// See GetPermissionPolicy for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetPermissionPolicyWithContext(ctx aws.Context, input *GetPermissionPolicyInput, opts ...request.Option) (*GetPermissionPolicyOutput, error) { + req, out := c.GetPermissionPolicyRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetRateBasedStatementManagedKeys = "GetRateBasedStatementManagedKeys" + +// GetRateBasedStatementManagedKeysRequest generates a "aws/request.Request" representing the +// client's request for the GetRateBasedStatementManagedKeys operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetRateBasedStatementManagedKeys for more information on using the GetRateBasedStatementManagedKeys +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetRateBasedStatementManagedKeysRequest method. +// req, resp := client.GetRateBasedStatementManagedKeysRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetRateBasedStatementManagedKeys +func (c *WAFV2) GetRateBasedStatementManagedKeysRequest(input *GetRateBasedStatementManagedKeysInput) (req *request.Request, output *GetRateBasedStatementManagedKeysOutput) { + op := &request.Operation{ + Name: opGetRateBasedStatementManagedKeys, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetRateBasedStatementManagedKeysInput{} + } + + output = &GetRateBasedStatementManagedKeysOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetRateBasedStatementManagedKeys API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves the keys that are currently blocked by a rate-based rule. The maximum +// number of managed keys that can be blocked for a single rate-based rule is +// 10,000. If more than 10,000 addresses exceed the rate limit, those with the +// highest rates are blocked. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetRateBasedStatementManagedKeys for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetRateBasedStatementManagedKeys +func (c *WAFV2) GetRateBasedStatementManagedKeys(input *GetRateBasedStatementManagedKeysInput) (*GetRateBasedStatementManagedKeysOutput, error) { + req, out := c.GetRateBasedStatementManagedKeysRequest(input) + return out, req.Send() +} + +// GetRateBasedStatementManagedKeysWithContext is the same as GetRateBasedStatementManagedKeys with the addition of +// the ability to pass a context and additional request options. +// +// See GetRateBasedStatementManagedKeys for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetRateBasedStatementManagedKeysWithContext(ctx aws.Context, input *GetRateBasedStatementManagedKeysInput, opts ...request.Option) (*GetRateBasedStatementManagedKeysOutput, error) { + req, out := c.GetRateBasedStatementManagedKeysRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetRegexPatternSet = "GetRegexPatternSet" + +// GetRegexPatternSetRequest generates a "aws/request.Request" representing the +// client's request for the GetRegexPatternSet operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetRegexPatternSet for more information on using the GetRegexPatternSet +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetRegexPatternSetRequest method. +// req, resp := client.GetRegexPatternSetRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetRegexPatternSet +func (c *WAFV2) GetRegexPatternSetRequest(input *GetRegexPatternSetInput) (req *request.Request, output *GetRegexPatternSetOutput) { + op := &request.Operation{ + Name: opGetRegexPatternSet, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetRegexPatternSetInput{} + } + + output = &GetRegexPatternSetOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetRegexPatternSet API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves the specified RegexPatternSet. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetRegexPatternSet for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetRegexPatternSet +func (c *WAFV2) GetRegexPatternSet(input *GetRegexPatternSetInput) (*GetRegexPatternSetOutput, error) { + req, out := c.GetRegexPatternSetRequest(input) + return out, req.Send() +} + +// GetRegexPatternSetWithContext is the same as GetRegexPatternSet with the addition of +// the ability to pass a context and additional request options. +// +// See GetRegexPatternSet for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetRegexPatternSetWithContext(ctx aws.Context, input *GetRegexPatternSetInput, opts ...request.Option) (*GetRegexPatternSetOutput, error) { + req, out := c.GetRegexPatternSetRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetRuleGroup = "GetRuleGroup" + +// GetRuleGroupRequest generates a "aws/request.Request" representing the +// client's request for the GetRuleGroup operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetRuleGroup for more information on using the GetRuleGroup +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetRuleGroupRequest method. +// req, resp := client.GetRuleGroupRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetRuleGroup +func (c *WAFV2) GetRuleGroupRequest(input *GetRuleGroupInput) (req *request.Request, output *GetRuleGroupOutput) { + op := &request.Operation{ + Name: opGetRuleGroup, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetRuleGroupInput{} + } + + output = &GetRuleGroupOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetRuleGroup API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves the specified RuleGroup. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetRuleGroup for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetRuleGroup +func (c *WAFV2) GetRuleGroup(input *GetRuleGroupInput) (*GetRuleGroupOutput, error) { + req, out := c.GetRuleGroupRequest(input) + return out, req.Send() +} + +// GetRuleGroupWithContext is the same as GetRuleGroup with the addition of +// the ability to pass a context and additional request options. +// +// See GetRuleGroup for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetRuleGroupWithContext(ctx aws.Context, input *GetRuleGroupInput, opts ...request.Option) (*GetRuleGroupOutput, error) { + req, out := c.GetRuleGroupRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetSampledRequests = "GetSampledRequests" + +// GetSampledRequestsRequest generates a "aws/request.Request" representing the +// client's request for the GetSampledRequests operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetSampledRequests for more information on using the GetSampledRequests +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetSampledRequestsRequest method. +// req, resp := client.GetSampledRequestsRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetSampledRequests +func (c *WAFV2) GetSampledRequestsRequest(input *GetSampledRequestsInput) (req *request.Request, output *GetSampledRequestsOutput) { + op := &request.Operation{ + Name: opGetSampledRequests, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetSampledRequestsInput{} + } + + output = &GetSampledRequestsOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetSampledRequests API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Gets detailed information about a specified number of requests--a sample--that +// AWS WAF randomly selects from among the first 5,000 requests that your AWS +// resource received during a time range that you choose. You can specify a +// sample size of up to 500 requests, and you can specify any time range in +// the previous three hours. +// +// GetSampledRequests returns a time range, which is usually the time range +// that you specified. However, if your resource (such as a CloudFront distribution) +// received 5,000 requests before the specified time range elapsed, GetSampledRequests +// returns an updated time range. This new time range indicates the actual period +// during which AWS WAF selected the requests in the sample. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetSampledRequests for usage and error information. +// +// Returned Error Types: +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetSampledRequests +func (c *WAFV2) GetSampledRequests(input *GetSampledRequestsInput) (*GetSampledRequestsOutput, error) { + req, out := c.GetSampledRequestsRequest(input) + return out, req.Send() +} + +// GetSampledRequestsWithContext is the same as GetSampledRequests with the addition of +// the ability to pass a context and additional request options. +// +// See GetSampledRequests for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetSampledRequestsWithContext(ctx aws.Context, input *GetSampledRequestsInput, opts ...request.Option) (*GetSampledRequestsOutput, error) { + req, out := c.GetSampledRequestsRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetWebACL = "GetWebACL" + +// GetWebACLRequest generates a "aws/request.Request" representing the +// client's request for the GetWebACL operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetWebACL for more information on using the GetWebACL +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetWebACLRequest method. +// req, resp := client.GetWebACLRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetWebACL +func (c *WAFV2) GetWebACLRequest(input *GetWebACLInput) (req *request.Request, output *GetWebACLOutput) { + op := &request.Operation{ + Name: opGetWebACL, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetWebACLInput{} + } + + output = &GetWebACLOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetWebACL API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves the specified WebACL. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetWebACL for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetWebACL +func (c *WAFV2) GetWebACL(input *GetWebACLInput) (*GetWebACLOutput, error) { + req, out := c.GetWebACLRequest(input) + return out, req.Send() +} + +// GetWebACLWithContext is the same as GetWebACL with the addition of +// the ability to pass a context and additional request options. +// +// See GetWebACL for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetWebACLWithContext(ctx aws.Context, input *GetWebACLInput, opts ...request.Option) (*GetWebACLOutput, error) { + req, out := c.GetWebACLRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opGetWebACLForResource = "GetWebACLForResource" + +// GetWebACLForResourceRequest generates a "aws/request.Request" representing the +// client's request for the GetWebACLForResource operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See GetWebACLForResource for more information on using the GetWebACLForResource +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the GetWebACLForResourceRequest method. +// req, resp := client.GetWebACLForResourceRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetWebACLForResource +func (c *WAFV2) GetWebACLForResourceRequest(input *GetWebACLForResourceInput) (req *request.Request, output *GetWebACLForResourceOutput) { + op := &request.Operation{ + Name: opGetWebACLForResource, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &GetWebACLForResourceInput{} + } + + output = &GetWebACLForResourceOutput{} + req = c.newRequest(op, input, output) + return +} + +// GetWebACLForResource API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves the WebACL for the specified resource. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation GetWebACLForResource for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFUnavailableEntityException +// AWS WAF couldn’t retrieve the resource that you requested. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetWebACLForResource +func (c *WAFV2) GetWebACLForResource(input *GetWebACLForResourceInput) (*GetWebACLForResourceOutput, error) { + req, out := c.GetWebACLForResourceRequest(input) + return out, req.Send() +} + +// GetWebACLForResourceWithContext is the same as GetWebACLForResource with the addition of +// the ability to pass a context and additional request options. +// +// See GetWebACLForResource for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) GetWebACLForResourceWithContext(ctx aws.Context, input *GetWebACLForResourceInput, opts ...request.Option) (*GetWebACLForResourceOutput, error) { + req, out := c.GetWebACLForResourceRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opListAvailableManagedRuleGroups = "ListAvailableManagedRuleGroups" + +// ListAvailableManagedRuleGroupsRequest generates a "aws/request.Request" representing the +// client's request for the ListAvailableManagedRuleGroups operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See ListAvailableManagedRuleGroups for more information on using the ListAvailableManagedRuleGroups +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the ListAvailableManagedRuleGroupsRequest method. +// req, resp := client.ListAvailableManagedRuleGroupsRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListAvailableManagedRuleGroups +func (c *WAFV2) ListAvailableManagedRuleGroupsRequest(input *ListAvailableManagedRuleGroupsInput) (req *request.Request, output *ListAvailableManagedRuleGroupsOutput) { + op := &request.Operation{ + Name: opListAvailableManagedRuleGroups, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &ListAvailableManagedRuleGroupsInput{} + } + + output = &ListAvailableManagedRuleGroupsOutput{} + req = c.newRequest(op, input, output) + return +} + +// ListAvailableManagedRuleGroups API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves an array of managed rule groups that are available for you to use. +// This list includes all AWS Managed Rules rule groups and the AWS Marketplace +// managed rule groups that you're subscribed to. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation ListAvailableManagedRuleGroups for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListAvailableManagedRuleGroups +func (c *WAFV2) ListAvailableManagedRuleGroups(input *ListAvailableManagedRuleGroupsInput) (*ListAvailableManagedRuleGroupsOutput, error) { + req, out := c.ListAvailableManagedRuleGroupsRequest(input) + return out, req.Send() +} + +// ListAvailableManagedRuleGroupsWithContext is the same as ListAvailableManagedRuleGroups with the addition of +// the ability to pass a context and additional request options. +// +// See ListAvailableManagedRuleGroups for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) ListAvailableManagedRuleGroupsWithContext(ctx aws.Context, input *ListAvailableManagedRuleGroupsInput, opts ...request.Option) (*ListAvailableManagedRuleGroupsOutput, error) { + req, out := c.ListAvailableManagedRuleGroupsRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opListIPSets = "ListIPSets" + +// ListIPSetsRequest generates a "aws/request.Request" representing the +// client's request for the ListIPSets operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See ListIPSets for more information on using the ListIPSets +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the ListIPSetsRequest method. +// req, resp := client.ListIPSetsRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListIPSets +func (c *WAFV2) ListIPSetsRequest(input *ListIPSetsInput) (req *request.Request, output *ListIPSetsOutput) { + op := &request.Operation{ + Name: opListIPSets, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &ListIPSetsInput{} + } + + output = &ListIPSetsOutput{} + req = c.newRequest(op, input, output) + return +} + +// ListIPSets API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves an array of IPSetSummary objects for the IP sets that you manage. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation ListIPSets for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListIPSets +func (c *WAFV2) ListIPSets(input *ListIPSetsInput) (*ListIPSetsOutput, error) { + req, out := c.ListIPSetsRequest(input) + return out, req.Send() +} + +// ListIPSetsWithContext is the same as ListIPSets with the addition of +// the ability to pass a context and additional request options. +// +// See ListIPSets for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) ListIPSetsWithContext(ctx aws.Context, input *ListIPSetsInput, opts ...request.Option) (*ListIPSetsOutput, error) { + req, out := c.ListIPSetsRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opListLoggingConfigurations = "ListLoggingConfigurations" + +// ListLoggingConfigurationsRequest generates a "aws/request.Request" representing the +// client's request for the ListLoggingConfigurations operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See ListLoggingConfigurations for more information on using the ListLoggingConfigurations +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the ListLoggingConfigurationsRequest method. +// req, resp := client.ListLoggingConfigurationsRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListLoggingConfigurations +func (c *WAFV2) ListLoggingConfigurationsRequest(input *ListLoggingConfigurationsInput) (req *request.Request, output *ListLoggingConfigurationsOutput) { + op := &request.Operation{ + Name: opListLoggingConfigurations, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &ListLoggingConfigurationsInput{} + } + + output = &ListLoggingConfigurationsOutput{} + req = c.newRequest(op, input, output) + return +} + +// ListLoggingConfigurations API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves an array of your LoggingConfiguration objects. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation ListLoggingConfigurations for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListLoggingConfigurations +func (c *WAFV2) ListLoggingConfigurations(input *ListLoggingConfigurationsInput) (*ListLoggingConfigurationsOutput, error) { + req, out := c.ListLoggingConfigurationsRequest(input) + return out, req.Send() +} + +// ListLoggingConfigurationsWithContext is the same as ListLoggingConfigurations with the addition of +// the ability to pass a context and additional request options. +// +// See ListLoggingConfigurations for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) ListLoggingConfigurationsWithContext(ctx aws.Context, input *ListLoggingConfigurationsInput, opts ...request.Option) (*ListLoggingConfigurationsOutput, error) { + req, out := c.ListLoggingConfigurationsRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opListRegexPatternSets = "ListRegexPatternSets" + +// ListRegexPatternSetsRequest generates a "aws/request.Request" representing the +// client's request for the ListRegexPatternSets operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See ListRegexPatternSets for more information on using the ListRegexPatternSets +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the ListRegexPatternSetsRequest method. +// req, resp := client.ListRegexPatternSetsRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListRegexPatternSets +func (c *WAFV2) ListRegexPatternSetsRequest(input *ListRegexPatternSetsInput) (req *request.Request, output *ListRegexPatternSetsOutput) { + op := &request.Operation{ + Name: opListRegexPatternSets, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &ListRegexPatternSetsInput{} + } + + output = &ListRegexPatternSetsOutput{} + req = c.newRequest(op, input, output) + return +} + +// ListRegexPatternSets API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves an array of RegexPatternSetSummary objects for the regex pattern +// sets that you manage. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation ListRegexPatternSets for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListRegexPatternSets +func (c *WAFV2) ListRegexPatternSets(input *ListRegexPatternSetsInput) (*ListRegexPatternSetsOutput, error) { + req, out := c.ListRegexPatternSetsRequest(input) + return out, req.Send() +} + +// ListRegexPatternSetsWithContext is the same as ListRegexPatternSets with the addition of +// the ability to pass a context and additional request options. +// +// See ListRegexPatternSets for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) ListRegexPatternSetsWithContext(ctx aws.Context, input *ListRegexPatternSetsInput, opts ...request.Option) (*ListRegexPatternSetsOutput, error) { + req, out := c.ListRegexPatternSetsRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opListResourcesForWebACL = "ListResourcesForWebACL" + +// ListResourcesForWebACLRequest generates a "aws/request.Request" representing the +// client's request for the ListResourcesForWebACL operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See ListResourcesForWebACL for more information on using the ListResourcesForWebACL +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the ListResourcesForWebACLRequest method. +// req, resp := client.ListResourcesForWebACLRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListResourcesForWebACL +func (c *WAFV2) ListResourcesForWebACLRequest(input *ListResourcesForWebACLInput) (req *request.Request, output *ListResourcesForWebACLOutput) { + op := &request.Operation{ + Name: opListResourcesForWebACL, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &ListResourcesForWebACLInput{} + } + + output = &ListResourcesForWebACLOutput{} + req = c.newRequest(op, input, output) + return +} + +// ListResourcesForWebACL API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves an array of the Amazon Resource Names (ARNs) for the regional resources +// that are associated with the specified web ACL. If you want the list of AWS +// CloudFront resources, use the AWS CloudFront call ListDistributionsByWebACLId. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation ListResourcesForWebACL for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListResourcesForWebACL +func (c *WAFV2) ListResourcesForWebACL(input *ListResourcesForWebACLInput) (*ListResourcesForWebACLOutput, error) { + req, out := c.ListResourcesForWebACLRequest(input) + return out, req.Send() +} + +// ListResourcesForWebACLWithContext is the same as ListResourcesForWebACL with the addition of +// the ability to pass a context and additional request options. +// +// See ListResourcesForWebACL for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) ListResourcesForWebACLWithContext(ctx aws.Context, input *ListResourcesForWebACLInput, opts ...request.Option) (*ListResourcesForWebACLOutput, error) { + req, out := c.ListResourcesForWebACLRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opListRuleGroups = "ListRuleGroups" + +// ListRuleGroupsRequest generates a "aws/request.Request" representing the +// client's request for the ListRuleGroups operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See ListRuleGroups for more information on using the ListRuleGroups +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the ListRuleGroupsRequest method. +// req, resp := client.ListRuleGroupsRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListRuleGroups +func (c *WAFV2) ListRuleGroupsRequest(input *ListRuleGroupsInput) (req *request.Request, output *ListRuleGroupsOutput) { + op := &request.Operation{ + Name: opListRuleGroups, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &ListRuleGroupsInput{} + } + + output = &ListRuleGroupsOutput{} + req = c.newRequest(op, input, output) + return +} + +// ListRuleGroups API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves an array of RuleGroupSummary objects for the rule groups that you +// manage. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation ListRuleGroups for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListRuleGroups +func (c *WAFV2) ListRuleGroups(input *ListRuleGroupsInput) (*ListRuleGroupsOutput, error) { + req, out := c.ListRuleGroupsRequest(input) + return out, req.Send() +} + +// ListRuleGroupsWithContext is the same as ListRuleGroups with the addition of +// the ability to pass a context and additional request options. +// +// See ListRuleGroups for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) ListRuleGroupsWithContext(ctx aws.Context, input *ListRuleGroupsInput, opts ...request.Option) (*ListRuleGroupsOutput, error) { + req, out := c.ListRuleGroupsRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opListTagsForResource = "ListTagsForResource" + +// ListTagsForResourceRequest generates a "aws/request.Request" representing the +// client's request for the ListTagsForResource operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See ListTagsForResource for more information on using the ListTagsForResource +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the ListTagsForResourceRequest method. +// req, resp := client.ListTagsForResourceRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListTagsForResource +func (c *WAFV2) ListTagsForResourceRequest(input *ListTagsForResourceInput) (req *request.Request, output *ListTagsForResourceOutput) { + op := &request.Operation{ + Name: opListTagsForResource, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &ListTagsForResourceInput{} + } + + output = &ListTagsForResourceOutput{} + req = c.newRequest(op, input, output) + return +} + +// ListTagsForResource API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves the TagInfoForResource for the specified resource. Tags are key:value +// pairs that you can use to categorize and manage your resources, for purposes +// like billing. For example, you might set the tag key to "customer" and the +// value to the customer name or ID. You can specify one or more tags to add +// to each AWS resource, up to 50 tags for a resource. +// +// You can tag the AWS resources that you manage through AWS WAF: web ACLs, +// rule groups, IP sets, and regex pattern sets. You can't manage or view tags +// through the AWS WAF console. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation ListTagsForResource for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListTagsForResource +func (c *WAFV2) ListTagsForResource(input *ListTagsForResourceInput) (*ListTagsForResourceOutput, error) { + req, out := c.ListTagsForResourceRequest(input) + return out, req.Send() +} + +// ListTagsForResourceWithContext is the same as ListTagsForResource with the addition of +// the ability to pass a context and additional request options. +// +// See ListTagsForResource for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) ListTagsForResourceWithContext(ctx aws.Context, input *ListTagsForResourceInput, opts ...request.Option) (*ListTagsForResourceOutput, error) { + req, out := c.ListTagsForResourceRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opListWebACLs = "ListWebACLs" + +// ListWebACLsRequest generates a "aws/request.Request" representing the +// client's request for the ListWebACLs operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See ListWebACLs for more information on using the ListWebACLs +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the ListWebACLsRequest method. +// req, resp := client.ListWebACLsRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListWebACLs +func (c *WAFV2) ListWebACLsRequest(input *ListWebACLsInput) (req *request.Request, output *ListWebACLsOutput) { + op := &request.Operation{ + Name: opListWebACLs, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &ListWebACLsInput{} + } + + output = &ListWebACLsOutput{} + req = c.newRequest(op, input, output) + return +} + +// ListWebACLs API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Retrieves an array of WebACLSummary objects for the web ACLs that you manage. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation ListWebACLs for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ListWebACLs +func (c *WAFV2) ListWebACLs(input *ListWebACLsInput) (*ListWebACLsOutput, error) { + req, out := c.ListWebACLsRequest(input) + return out, req.Send() +} + +// ListWebACLsWithContext is the same as ListWebACLs with the addition of +// the ability to pass a context and additional request options. +// +// See ListWebACLs for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) ListWebACLsWithContext(ctx aws.Context, input *ListWebACLsInput, opts ...request.Option) (*ListWebACLsOutput, error) { + req, out := c.ListWebACLsRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opPutLoggingConfiguration = "PutLoggingConfiguration" + +// PutLoggingConfigurationRequest generates a "aws/request.Request" representing the +// client's request for the PutLoggingConfiguration operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See PutLoggingConfiguration for more information on using the PutLoggingConfiguration +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the PutLoggingConfigurationRequest method. +// req, resp := client.PutLoggingConfigurationRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/PutLoggingConfiguration +func (c *WAFV2) PutLoggingConfigurationRequest(input *PutLoggingConfigurationInput) (req *request.Request, output *PutLoggingConfigurationOutput) { + op := &request.Operation{ + Name: opPutLoggingConfiguration, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &PutLoggingConfigurationInput{} + } + + output = &PutLoggingConfigurationOutput{} + req = c.newRequest(op, input, output) + return +} + +// PutLoggingConfiguration API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Enables the specified LoggingConfiguration, to start logging from a web ACL, +// according to the configuration provided. +// +// You can access information about all traffic that AWS WAF inspects using +// the following steps: +// +// Create an Amazon Kinesis Data Firehose. +// +// Create the data firehose with a PUT source and in the Region that you are +// operating. If you are capturing logs for Amazon CloudFront, always create +// the firehose in US East (N. Virginia). +// +// Give the data firehose a name that starts with the prefix aws-waf-logs-. +// For example, aws-waf-logs-us-east-2-analytics. +// +// Do not create the data firehose using a Kinesis stream as your source. +// +// Associate that firehose to your web ACL using a PutLoggingConfiguration request. +// +// When you successfully enable logging using a PutLoggingConfiguration request, +// AWS WAF will create a service linked role with the necessary permissions +// to write logs to the Amazon Kinesis Data Firehose. For more information, +// see Logging Web ACL Traffic Information (https://docs.aws.amazon.com/waf/latest/developerguide/logging.html) +// in the AWS WAF Developer Guide. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation PutLoggingConfiguration for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFServiceLinkedRoleErrorException +// AWS WAF is not able to access the service linked role. This can be caused +// by a previous PutLoggingConfiguration request, which can lock the service +// linked role for about 20 seconds. Please try your request again. The service +// linked role can also be locked by a previous DeleteServiceLinkedRole request, +// which can lock the role for 15 minutes or more. If you recently made a call +// to DeleteServiceLinkedRole, wait at least 15 minutes and try the request +// again. If you receive this same exception again, you will have to wait additional +// time until the role is unlocked. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/PutLoggingConfiguration +func (c *WAFV2) PutLoggingConfiguration(input *PutLoggingConfigurationInput) (*PutLoggingConfigurationOutput, error) { + req, out := c.PutLoggingConfigurationRequest(input) + return out, req.Send() +} + +// PutLoggingConfigurationWithContext is the same as PutLoggingConfiguration with the addition of +// the ability to pass a context and additional request options. +// +// See PutLoggingConfiguration for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) PutLoggingConfigurationWithContext(ctx aws.Context, input *PutLoggingConfigurationInput, opts ...request.Option) (*PutLoggingConfigurationOutput, error) { + req, out := c.PutLoggingConfigurationRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opPutPermissionPolicy = "PutPermissionPolicy" + +// PutPermissionPolicyRequest generates a "aws/request.Request" representing the +// client's request for the PutPermissionPolicy operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See PutPermissionPolicy for more information on using the PutPermissionPolicy +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the PutPermissionPolicyRequest method. +// req, resp := client.PutPermissionPolicyRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/PutPermissionPolicy +func (c *WAFV2) PutPermissionPolicyRequest(input *PutPermissionPolicyInput) (req *request.Request, output *PutPermissionPolicyOutput) { + op := &request.Operation{ + Name: opPutPermissionPolicy, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &PutPermissionPolicyInput{} + } + + output = &PutPermissionPolicyOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// PutPermissionPolicy API operation for AWS WAFV2. +// +// Attaches an IAM policy to the specified resource. Use this to share a rule +// group across accounts. +// +// You must be the owner of the rule group to perform this operation. +// +// This action is subject to the following restrictions: +// +// * You can attach only one policy with each PutPermissionPolicy request. +// +// * The ARN in the request must be a valid WAF RuleGroup ARN and the rule +// group must exist in the same region. +// +// * The user making the request must be the owner of the rule group. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation PutPermissionPolicy for usage and error information. +// +// Returned Error Types: +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFInvalidPermissionPolicyException +// The operation failed because the specified policy isn't in the proper format. +// +// The policy specifications must conform to the following: +// +// * The policy must be composed using IAM Policy version 2012-10-17 or version +// 2015-01-01. +// +// * The policy must include specifications for Effect, Action, and Principal. +// +// * Effect must specify Allow. +// +// * Action must specify wafv2:CreateWebACL, wafv2:UpdateWebACL, and wafv2:PutFirewallManagerRuleGroups. +// AWS WAF rejects any extra actions or wildcard actions in the policy. +// +// * The policy must not include a Resource parameter. +// +// For more information, see IAM Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html). +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/PutPermissionPolicy +func (c *WAFV2) PutPermissionPolicy(input *PutPermissionPolicyInput) (*PutPermissionPolicyOutput, error) { + req, out := c.PutPermissionPolicyRequest(input) + return out, req.Send() +} + +// PutPermissionPolicyWithContext is the same as PutPermissionPolicy with the addition of +// the ability to pass a context and additional request options. +// +// See PutPermissionPolicy for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) PutPermissionPolicyWithContext(ctx aws.Context, input *PutPermissionPolicyInput, opts ...request.Option) (*PutPermissionPolicyOutput, error) { + req, out := c.PutPermissionPolicyRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opTagResource = "TagResource" + +// TagResourceRequest generates a "aws/request.Request" representing the +// client's request for the TagResource operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See TagResource for more information on using the TagResource +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the TagResourceRequest method. +// req, resp := client.TagResourceRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/TagResource +func (c *WAFV2) TagResourceRequest(input *TagResourceInput) (req *request.Request, output *TagResourceOutput) { + op := &request.Operation{ + Name: opTagResource, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &TagResourceInput{} + } + + output = &TagResourceOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// TagResource API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Associates tags with the specified AWS resource. Tags are key:value pairs +// that you can use to categorize and manage your resources, for purposes like +// billing. For example, you might set the tag key to "customer" and the value +// to the customer name or ID. You can specify one or more tags to add to each +// AWS resource, up to 50 tags for a resource. +// +// You can tag the AWS resources that you manage through AWS WAF: web ACLs, +// rule groups, IP sets, and regex pattern sets. You can't manage or view tags +// through the AWS WAF console. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation TagResource for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/TagResource +func (c *WAFV2) TagResource(input *TagResourceInput) (*TagResourceOutput, error) { + req, out := c.TagResourceRequest(input) + return out, req.Send() +} + +// TagResourceWithContext is the same as TagResource with the addition of +// the ability to pass a context and additional request options. +// +// See TagResource for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) TagResourceWithContext(ctx aws.Context, input *TagResourceInput, opts ...request.Option) (*TagResourceOutput, error) { + req, out := c.TagResourceRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opUntagResource = "UntagResource" + +// UntagResourceRequest generates a "aws/request.Request" representing the +// client's request for the UntagResource operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See UntagResource for more information on using the UntagResource +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the UntagResourceRequest method. +// req, resp := client.UntagResourceRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UntagResource +func (c *WAFV2) UntagResourceRequest(input *UntagResourceInput) (req *request.Request, output *UntagResourceOutput) { + op := &request.Operation{ + Name: opUntagResource, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &UntagResourceInput{} + } + + output = &UntagResourceOutput{} + req = c.newRequest(op, input, output) + req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler) + return +} + +// UntagResource API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Disassociates tags from an AWS resource. Tags are key:value pairs that you +// can associate with AWS resources. For example, the tag key might be "customer" +// and the tag value might be "companyA." You can specify one or more tags to +// add to each container. You can add up to 50 tags to each AWS resource. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation UntagResource for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFTagOperationException +// An error occurred during the tagging operation. Retry your request. +// +// * WAFTagOperationInternalErrorException +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UntagResource +func (c *WAFV2) UntagResource(input *UntagResourceInput) (*UntagResourceOutput, error) { + req, out := c.UntagResourceRequest(input) + return out, req.Send() +} + +// UntagResourceWithContext is the same as UntagResource with the addition of +// the ability to pass a context and additional request options. +// +// See UntagResource for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) UntagResourceWithContext(ctx aws.Context, input *UntagResourceInput, opts ...request.Option) (*UntagResourceOutput, error) { + req, out := c.UntagResourceRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opUpdateIPSet = "UpdateIPSet" + +// UpdateIPSetRequest generates a "aws/request.Request" representing the +// client's request for the UpdateIPSet operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See UpdateIPSet for more information on using the UpdateIPSet +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the UpdateIPSetRequest method. +// req, resp := client.UpdateIPSetRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UpdateIPSet +func (c *WAFV2) UpdateIPSetRequest(input *UpdateIPSetInput) (req *request.Request, output *UpdateIPSetOutput) { + op := &request.Operation{ + Name: opUpdateIPSet, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &UpdateIPSetInput{} + } + + output = &UpdateIPSetOutput{} + req = c.newRequest(op, input, output) + return +} + +// UpdateIPSet API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Updates the specified IPSet. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation UpdateIPSet for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFDuplicateItemException +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UpdateIPSet +func (c *WAFV2) UpdateIPSet(input *UpdateIPSetInput) (*UpdateIPSetOutput, error) { + req, out := c.UpdateIPSetRequest(input) + return out, req.Send() +} + +// UpdateIPSetWithContext is the same as UpdateIPSet with the addition of +// the ability to pass a context and additional request options. +// +// See UpdateIPSet for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) UpdateIPSetWithContext(ctx aws.Context, input *UpdateIPSetInput, opts ...request.Option) (*UpdateIPSetOutput, error) { + req, out := c.UpdateIPSetRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opUpdateRegexPatternSet = "UpdateRegexPatternSet" + +// UpdateRegexPatternSetRequest generates a "aws/request.Request" representing the +// client's request for the UpdateRegexPatternSet operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See UpdateRegexPatternSet for more information on using the UpdateRegexPatternSet +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the UpdateRegexPatternSetRequest method. +// req, resp := client.UpdateRegexPatternSetRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UpdateRegexPatternSet +func (c *WAFV2) UpdateRegexPatternSetRequest(input *UpdateRegexPatternSetInput) (req *request.Request, output *UpdateRegexPatternSetOutput) { + op := &request.Operation{ + Name: opUpdateRegexPatternSet, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &UpdateRegexPatternSetInput{} + } + + output = &UpdateRegexPatternSetOutput{} + req = c.newRequest(op, input, output) + return +} + +// UpdateRegexPatternSet API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Updates the specified RegexPatternSet. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation UpdateRegexPatternSet for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFDuplicateItemException +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UpdateRegexPatternSet +func (c *WAFV2) UpdateRegexPatternSet(input *UpdateRegexPatternSetInput) (*UpdateRegexPatternSetOutput, error) { + req, out := c.UpdateRegexPatternSetRequest(input) + return out, req.Send() +} + +// UpdateRegexPatternSetWithContext is the same as UpdateRegexPatternSet with the addition of +// the ability to pass a context and additional request options. +// +// See UpdateRegexPatternSet for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) UpdateRegexPatternSetWithContext(ctx aws.Context, input *UpdateRegexPatternSetInput, opts ...request.Option) (*UpdateRegexPatternSetOutput, error) { + req, out := c.UpdateRegexPatternSetRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opUpdateRuleGroup = "UpdateRuleGroup" + +// UpdateRuleGroupRequest generates a "aws/request.Request" representing the +// client's request for the UpdateRuleGroup operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See UpdateRuleGroup for more information on using the UpdateRuleGroup +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the UpdateRuleGroupRequest method. +// req, resp := client.UpdateRuleGroupRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UpdateRuleGroup +func (c *WAFV2) UpdateRuleGroupRequest(input *UpdateRuleGroupInput) (req *request.Request, output *UpdateRuleGroupOutput) { + op := &request.Operation{ + Name: opUpdateRuleGroup, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &UpdateRuleGroupInput{} + } + + output = &UpdateRuleGroupOutput{} + req = c.newRequest(op, input, output) + return +} + +// UpdateRuleGroup API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Updates the specified RuleGroup. +// +// A rule group defines a collection of rules to inspect and control web requests +// that you can use in a WebACL. When you create a rule group, you define an +// immutable capacity limit. If you update a rule group, you must stay within +// the capacity. This allows others to reuse the rule group with confidence +// in its capacity requirements. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation UpdateRuleGroup for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFDuplicateItemException +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFUnavailableEntityException +// AWS WAF couldn’t retrieve the resource that you requested. Retry your request. +// +// * WAFSubscriptionNotFoundException +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UpdateRuleGroup +func (c *WAFV2) UpdateRuleGroup(input *UpdateRuleGroupInput) (*UpdateRuleGroupOutput, error) { + req, out := c.UpdateRuleGroupRequest(input) + return out, req.Send() +} + +// UpdateRuleGroupWithContext is the same as UpdateRuleGroup with the addition of +// the ability to pass a context and additional request options. +// +// See UpdateRuleGroup for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) UpdateRuleGroupWithContext(ctx aws.Context, input *UpdateRuleGroupInput, opts ...request.Option) (*UpdateRuleGroupOutput, error) { + req, out := c.UpdateRuleGroupRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +const opUpdateWebACL = "UpdateWebACL" + +// UpdateWebACLRequest generates a "aws/request.Request" representing the +// client's request for the UpdateWebACL operation. The "output" return +// value will be populated with the request's response once the request completes +// successfully. +// +// Use "Send" method on the returned Request to send the API call to the service. +// the "output" return value is not valid until after Send returns without error. +// +// See UpdateWebACL for more information on using the UpdateWebACL +// API call, and error handling. +// +// This method is useful when you want to inject custom logic or configuration +// into the SDK's request lifecycle. Such as custom headers, or retry logic. +// +// +// // Example sending a request using the UpdateWebACLRequest method. +// req, resp := client.UpdateWebACLRequest(params) +// +// err := req.Send() +// if err == nil { // resp is now filled +// fmt.Println(resp) +// } +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UpdateWebACL +func (c *WAFV2) UpdateWebACLRequest(input *UpdateWebACLInput) (req *request.Request, output *UpdateWebACLOutput) { + op := &request.Operation{ + Name: opUpdateWebACL, + HTTPMethod: "POST", + HTTPPath: "/", + } + + if input == nil { + input = &UpdateWebACLInput{} + } + + output = &UpdateWebACLOutput{} + req = c.newRequest(op, input, output) + return +} + +// UpdateWebACL API operation for AWS WAFV2. +// +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Updates the specified WebACL. +// +// A Web ACL defines a collection of rules to use to inspect and control web +// requests. Each rule has an action defined (allow, block, or count) for requests +// that match the statement of the rule. In the Web ACL, you assign a default +// action to take (allow, block) for any request that does not match any of +// the rules. The rules in a Web ACL can be a combination of the types Rule, +// RuleGroup, and managed rule group. You can associate a Web ACL with one or +// more AWS resources to protect. The resources can be Amazon CloudFront, an +// Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync +// GraphQL API. +// +// Returns awserr.Error for service API and SDK errors. Use runtime type assertions +// with awserr.Error's Code and Message methods to get detailed information about +// the error. +// +// See the AWS API reference guide for AWS WAFV2's +// API operation UpdateWebACL for usage and error information. +// +// Returned Error Types: +// * WAFInternalErrorException +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +// +// * WAFInvalidParameterException +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +// +// * WAFNonexistentItemException +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +// +// * WAFDuplicateItemException +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +// +// * WAFOptimisticLockException +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +// +// * WAFLimitsExceededException +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +// +// * WAFInvalidResourceException +// AWS WAF couldn’t perform the operation because the resource that you requested +// isn’t valid. Check the resource, and try again. +// +// * WAFUnavailableEntityException +// AWS WAF couldn’t retrieve the resource that you requested. Retry your request. +// +// * WAFSubscriptionNotFoundException +// +// * WAFInvalidOperationException +// The operation isn't valid. +// +// See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/UpdateWebACL +func (c *WAFV2) UpdateWebACL(input *UpdateWebACLInput) (*UpdateWebACLOutput, error) { + req, out := c.UpdateWebACLRequest(input) + return out, req.Send() +} + +// UpdateWebACLWithContext is the same as UpdateWebACL with the addition of +// the ability to pass a context and additional request options. +// +// See UpdateWebACL for details on how to use this API operation. +// +// The context must be non-nil and will be used for request cancellation. If +// the context is nil a panic will occur. In the future the SDK may create +// sub-contexts for http.Requests. See https://golang.org/pkg/context/ +// for more information on using Contexts. +func (c *WAFV2) UpdateWebACLWithContext(ctx aws.Context, input *UpdateWebACLInput, opts ...request.Option) (*UpdateWebACLOutput, error) { + req, out := c.UpdateWebACLRequest(input) + req.SetContext(ctx) + req.ApplyOptions(opts...) + return out, req.Send() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// All query arguments of a web request. +// +// This is used only to indicate the web request component for AWS WAF to inspect, +// in the FieldToMatch specification. +type AllQueryArguments struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s AllQueryArguments) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s AllQueryArguments) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Specifies that AWS WAF should allow requests. +// +// This is used only in the context of other settings, for example to specify +// values for RuleAction and web ACL DefaultAction. +type AllowAction struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s AllowAction) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s AllowAction) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A logical rule statement used to combine other rule statements with AND logic. +// You provide more than one Statement within the AndStatement. +type AndStatement struct { + _ struct{} `type:"structure"` + + // The statements to combine with AND logic. You can use any statements that + // can be nested. + // + // Statements is a required field + Statements []*Statement `type:"list" required:"true"` +} + +// String returns the string representation +func (s AndStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s AndStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *AndStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "AndStatement"} + if s.Statements == nil { + invalidParams.Add(request.NewErrParamRequired("Statements")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetStatements sets the Statements field's value. +func (s *AndStatement) SetStatements(v []*Statement) *AndStatement { + s.Statements = v + return s +} + +type AssociateWebACLInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the resource to associate with the web + // ACL. + // + // The ARN must be in one of the following formats: + // + // * For an Application Load Balancer: arn:aws:elasticloadbalancing:region:account-id:loadbalancer/app/load-balancer-name/load-balancer-id + // + // * For an API Gateway REST API: arn:aws:apigateway:region::/restapis/api-id/stages/stage-name + // + // * For an AppSync GraphQL API: arn:aws:appsync:region:account-id:apis/GraphQLApiId + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` + + // The Amazon Resource Name (ARN) of the Web ACL that you want to associate + // with the resource. + // + // WebACLArn is a required field + WebACLArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s AssociateWebACLInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s AssociateWebACLInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *AssociateWebACLInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "AssociateWebACLInput"} + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + if s.WebACLArn == nil { + invalidParams.Add(request.NewErrParamRequired("WebACLArn")) + } + if s.WebACLArn != nil && len(*s.WebACLArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("WebACLArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *AssociateWebACLInput) SetResourceArn(v string) *AssociateWebACLInput { + s.ResourceArn = &v + return s +} + +// SetWebACLArn sets the WebACLArn field's value. +func (s *AssociateWebACLInput) SetWebACLArn(v string) *AssociateWebACLInput { + s.WebACLArn = &v + return s +} + +type AssociateWebACLOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s AssociateWebACLOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s AssociateWebACLOutput) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Specifies that AWS WAF should block requests. +// +// This is used only in the context of other settings, for example to specify +// values for RuleAction and web ACL DefaultAction. +type BlockAction struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s BlockAction) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s BlockAction) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The body of a web request. This immediately follows the request headers. +// +// This is used only to indicate the web request component for AWS WAF to inspect, +// in the FieldToMatch specification. +type Body struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s Body) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s Body) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule statement that defines a string match search for AWS WAF to apply +// to web requests. The byte match statement provides the bytes to search for, +// the location in requests that you want AWS WAF to search, and other settings. +// The bytes to search for are typically a string that corresponds with ASCII +// characters. In the AWS WAF console and the developer guide, this is refered +// to as a string match statement. +type ByteMatchStatement struct { + _ struct{} `type:"structure"` + + // The part of a web request that you want AWS WAF to inspect. For more information, + // see FieldToMatch. + // + // FieldToMatch is a required field + FieldToMatch *FieldToMatch `type:"structure" required:"true"` + + // The area within the portion of a web request that you want AWS WAF to search + // for SearchString. Valid values include the following: + // + // CONTAINS + // + // The specified part of the web request must include the value of SearchString, + // but the location doesn't matter. + // + // CONTAINS_WORD + // + // The specified part of the web request must include the value of SearchString, + // and SearchString must contain only alphanumeric characters or underscore + // (A-Z, a-z, 0-9, or _). In addition, SearchString must be a word, which means + // that both of the following are true: + // + // * SearchString is at the beginning of the specified part of the web request + // or is preceded by a character other than an alphanumeric character or + // underscore (_). Examples include the value of a header and ;BadBot. + // + // * SearchString is at the end of the specified part of the web request + // or is followed by a character other than an alphanumeric character or + // underscore (_), for example, BadBot; and -BadBot;. + // + // EXACTLY + // + // The value of the specified part of the web request must exactly match the + // value of SearchString. + // + // STARTS_WITH + // + // The value of SearchString must appear at the beginning of the specified part + // of the web request. + // + // ENDS_WITH + // + // The value of SearchString must appear at the end of the specified part of + // the web request. + // + // PositionalConstraint is a required field + PositionalConstraint *string `type:"string" required:"true" enum:"PositionalConstraint"` + + // A string value that you want AWS WAF to search for. AWS WAF searches only + // in the part of web requests that you designate for inspection in FieldToMatch. + // The maximum length of the value is 50 bytes. + // + // Valid values depend on the component that you specify for inspection in FieldToMatch: + // + // * Method: The HTTP method that you want AWS WAF to search for. This indicates + // the type of operation specified in the request. + // + // * UriPath: The value that you want AWS WAF to search for in the URI path, + // for example, /images/daily-ad.jpg. + // + // If SearchString includes alphabetic characters A-Z and a-z, note that the + // value is case sensitive. + // + // If you're using the AWS WAF API + // + // Specify a base64-encoded version of the value. The maximum length of the + // value before you base64-encode it is 50 bytes. + // + // For example, suppose the value of Type is HEADER and the value of Data is + // User-Agent. If you want to search the User-Agent header for the value BadBot, + // you base64-encode BadBot using MIME base64-encoding and include the resulting + // value, QmFkQm90, in the value of SearchString. + // + // If you're using the AWS CLI or one of the AWS SDKs + // + // The value that you want AWS WAF to search for. The SDK automatically base64 + // encodes the value. + // + // SearchString is automatically base64 encoded/decoded by the SDK. + // + // SearchString is a required field + SearchString []byte `type:"blob" required:"true"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. If you specify one + // or more transformations in a rule statement, AWS WAF performs all transformations + // on the content of the request component identified by FieldToMatch, starting + // from the lowest priority setting, before inspecting the content for a match. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation +func (s ByteMatchStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ByteMatchStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ByteMatchStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ByteMatchStatement"} + if s.FieldToMatch == nil { + invalidParams.Add(request.NewErrParamRequired("FieldToMatch")) + } + if s.PositionalConstraint == nil { + invalidParams.Add(request.NewErrParamRequired("PositionalConstraint")) + } + if s.SearchString == nil { + invalidParams.Add(request.NewErrParamRequired("SearchString")) + } + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.FieldToMatch != nil { + if err := s.FieldToMatch.Validate(); err != nil { + invalidParams.AddNested("FieldToMatch", err.(request.ErrInvalidParams)) + } + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetFieldToMatch sets the FieldToMatch field's value. +func (s *ByteMatchStatement) SetFieldToMatch(v *FieldToMatch) *ByteMatchStatement { + s.FieldToMatch = v + return s +} + +// SetPositionalConstraint sets the PositionalConstraint field's value. +func (s *ByteMatchStatement) SetPositionalConstraint(v string) *ByteMatchStatement { + s.PositionalConstraint = &v + return s +} + +// SetSearchString sets the SearchString field's value. +func (s *ByteMatchStatement) SetSearchString(v []byte) *ByteMatchStatement { + s.SearchString = v + return s +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *ByteMatchStatement) SetTextTransformations(v []*TextTransformation) *ByteMatchStatement { + s.TextTransformations = v + return s +} + +type CheckCapacityInput struct { + _ struct{} `type:"structure"` + + // An array of Rule that you're configuring to use in a rule group or web ACL. + // + // Rules is a required field + Rules []*Rule `type:"list" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s CheckCapacityInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CheckCapacityInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *CheckCapacityInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "CheckCapacityInput"} + if s.Rules == nil { + invalidParams.Add(request.NewErrParamRequired("Rules")) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.Rules != nil { + for i, v := range s.Rules { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Rules", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetRules sets the Rules field's value. +func (s *CheckCapacityInput) SetRules(v []*Rule) *CheckCapacityInput { + s.Rules = v + return s +} + +// SetScope sets the Scope field's value. +func (s *CheckCapacityInput) SetScope(v string) *CheckCapacityInput { + s.Scope = &v + return s +} + +type CheckCapacityOutput struct { + _ struct{} `type:"structure"` + + // The capacity required by the rules and scope. + Capacity *int64 `type:"long"` +} + +// String returns the string representation +func (s CheckCapacityOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CheckCapacityOutput) GoString() string { + return s.String() +} + +// SetCapacity sets the Capacity field's value. +func (s *CheckCapacityOutput) SetCapacity(v int64) *CheckCapacityOutput { + s.Capacity = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Specifies that AWS WAF should count requests. +// +// This is used only in the context of other settings, for example to specify +// values for RuleAction and web ACL DefaultAction. +type CountAction struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s CountAction) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CountAction) GoString() string { + return s.String() +} + +type CreateIPSetInput struct { + _ struct{} `type:"structure"` + + // Contains an array of strings that specify one or more IP addresses or blocks + // of IP addresses in Classless Inter-Domain Routing (CIDR) notation. AWS WAF + // supports all address ranges for IP versions IPv4 and IPv6. + // + // Examples: + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from the IP address 192.0.2.44, specify 192.0.2.44/32. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from IP addresses 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, + // specify 1111:0000:0000:0000:0000:0000:0000:0000/64. + // + // For more information about CIDR notation, see the Wikipedia entry Classless + // Inter-Domain Routing (https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). + // + // Addresses is a required field + Addresses []*string `type:"list" required:"true"` + + // A description of the IP set that helps with identification. You cannot change + // the description of an IP set after you create it. + Description *string `min:"1" type:"string"` + + // Specify IPV4 or IPV6. + // + // IPAddressVersion is a required field + IPAddressVersion *string `type:"string" required:"true" enum:"IPAddressVersion"` + + // The name of the IP set. You cannot change the name of an IPSet after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // An array of key:value pairs to associate with the resource. + Tags []*Tag `min:"1" type:"list"` +} + +// String returns the string representation +func (s CreateIPSetInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CreateIPSetInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *CreateIPSetInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "CreateIPSetInput"} + if s.Addresses == nil { + invalidParams.Add(request.NewErrParamRequired("Addresses")) + } + if s.Description != nil && len(*s.Description) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Description", 1)) + } + if s.IPAddressVersion == nil { + invalidParams.Add(request.NewErrParamRequired("IPAddressVersion")) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.Tags != nil && len(s.Tags) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Tags", 1)) + } + if s.Tags != nil { + for i, v := range s.Tags { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetAddresses sets the Addresses field's value. +func (s *CreateIPSetInput) SetAddresses(v []*string) *CreateIPSetInput { + s.Addresses = v + return s +} + +// SetDescription sets the Description field's value. +func (s *CreateIPSetInput) SetDescription(v string) *CreateIPSetInput { + s.Description = &v + return s +} + +// SetIPAddressVersion sets the IPAddressVersion field's value. +func (s *CreateIPSetInput) SetIPAddressVersion(v string) *CreateIPSetInput { + s.IPAddressVersion = &v + return s +} + +// SetName sets the Name field's value. +func (s *CreateIPSetInput) SetName(v string) *CreateIPSetInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *CreateIPSetInput) SetScope(v string) *CreateIPSetInput { + s.Scope = &v + return s +} + +// SetTags sets the Tags field's value. +func (s *CreateIPSetInput) SetTags(v []*Tag) *CreateIPSetInput { + s.Tags = v + return s +} + +type CreateIPSetOutput struct { + _ struct{} `type:"structure"` + + // High-level information about an IPSet, returned by operations like create + // and list. This provides information like the ID, that you can use to retrieve + // and manage an IPSet, and the ARN, that you provide to the IPSetReferenceStatement + // to use the address set in a Rule. + Summary *IPSetSummary `type:"structure"` +} + +// String returns the string representation +func (s CreateIPSetOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CreateIPSetOutput) GoString() string { + return s.String() +} + +// SetSummary sets the Summary field's value. +func (s *CreateIPSetOutput) SetSummary(v *IPSetSummary) *CreateIPSetOutput { + s.Summary = v + return s +} + +type CreateRegexPatternSetInput struct { + _ struct{} `type:"structure"` + + // A description of the set that helps with identification. You cannot change + // the description of a set after you create it. + Description *string `min:"1" type:"string"` + + // The name of the set. You cannot change the name after you create the set. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Array of regular expression strings. + // + // RegularExpressionList is a required field + RegularExpressionList []*Regex `type:"list" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // An array of key:value pairs to associate with the resource. + Tags []*Tag `min:"1" type:"list"` +} + +// String returns the string representation +func (s CreateRegexPatternSetInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CreateRegexPatternSetInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *CreateRegexPatternSetInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "CreateRegexPatternSetInput"} + if s.Description != nil && len(*s.Description) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Description", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.RegularExpressionList == nil { + invalidParams.Add(request.NewErrParamRequired("RegularExpressionList")) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.Tags != nil && len(s.Tags) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Tags", 1)) + } + if s.RegularExpressionList != nil { + for i, v := range s.RegularExpressionList { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "RegularExpressionList", i), err.(request.ErrInvalidParams)) + } + } + } + if s.Tags != nil { + for i, v := range s.Tags { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetDescription sets the Description field's value. +func (s *CreateRegexPatternSetInput) SetDescription(v string) *CreateRegexPatternSetInput { + s.Description = &v + return s +} + +// SetName sets the Name field's value. +func (s *CreateRegexPatternSetInput) SetName(v string) *CreateRegexPatternSetInput { + s.Name = &v + return s +} + +// SetRegularExpressionList sets the RegularExpressionList field's value. +func (s *CreateRegexPatternSetInput) SetRegularExpressionList(v []*Regex) *CreateRegexPatternSetInput { + s.RegularExpressionList = v + return s +} + +// SetScope sets the Scope field's value. +func (s *CreateRegexPatternSetInput) SetScope(v string) *CreateRegexPatternSetInput { + s.Scope = &v + return s +} + +// SetTags sets the Tags field's value. +func (s *CreateRegexPatternSetInput) SetTags(v []*Tag) *CreateRegexPatternSetInput { + s.Tags = v + return s +} + +type CreateRegexPatternSetOutput struct { + _ struct{} `type:"structure"` + + // High-level information about a RegexPatternSet, returned by operations like + // create and list. This provides information like the ID, that you can use + // to retrieve and manage a RegexPatternSet, and the ARN, that you provide to + // the RegexPatternSetReferenceStatement to use the pattern set in a Rule. + Summary *RegexPatternSetSummary `type:"structure"` +} + +// String returns the string representation +func (s CreateRegexPatternSetOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CreateRegexPatternSetOutput) GoString() string { + return s.String() +} + +// SetSummary sets the Summary field's value. +func (s *CreateRegexPatternSetOutput) SetSummary(v *RegexPatternSetSummary) *CreateRegexPatternSetOutput { + s.Summary = v + return s +} + +type CreateRuleGroupInput struct { + _ struct{} `type:"structure"` + + // The web ACL capacity units (WCUs) required for this rule group. + // + // When you create your own rule group, you define this, and you cannot change + // it after creation. When you add or modify the rules in a rule group, AWS + // WAF enforces this limit. You can check the capacity for a set of rules using + // CheckCapacity. + // + // AWS WAF uses WCUs to calculate and control the operating resources that are + // used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity + // differently for each rule type, to reflect the relative cost of each rule. + // Simple rules that cost little to run use fewer WCUs than more complex rules + // that use more processing power. Rule group capacity is fixed at creation, + // which helps users plan their web ACL WCU usage when they use a rule group. + // The WCU limit for web ACLs is 1,500. + // + // Capacity is a required field + Capacity *int64 `min:"1" type:"long" required:"true"` + + // A description of the rule group that helps with identification. You cannot + // change the description of a rule group after you create it. + Description *string `min:"1" type:"string"` + + // The name of the rule group. You cannot change the name of a rule group after + // you create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The Rule statements used to identify the web requests that you want to allow, + // block, or count. Each rule includes one top-level statement that AWS WAF + // uses to identify matching web requests, and parameters that govern how AWS + // WAF handles them. + Rules []*Rule `type:"list"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // An array of key:value pairs to associate with the resource. + Tags []*Tag `min:"1" type:"list"` + + // Defines and enables Amazon CloudWatch metrics and web request sample collection. + // + // VisibilityConfig is a required field + VisibilityConfig *VisibilityConfig `type:"structure" required:"true"` +} + +// String returns the string representation +func (s CreateRuleGroupInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CreateRuleGroupInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *CreateRuleGroupInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "CreateRuleGroupInput"} + if s.Capacity == nil { + invalidParams.Add(request.NewErrParamRequired("Capacity")) + } + if s.Capacity != nil && *s.Capacity < 1 { + invalidParams.Add(request.NewErrParamMinValue("Capacity", 1)) + } + if s.Description != nil && len(*s.Description) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Description", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.Tags != nil && len(s.Tags) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Tags", 1)) + } + if s.VisibilityConfig == nil { + invalidParams.Add(request.NewErrParamRequired("VisibilityConfig")) + } + if s.Rules != nil { + for i, v := range s.Rules { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Rules", i), err.(request.ErrInvalidParams)) + } + } + } + if s.Tags != nil { + for i, v := range s.Tags { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams)) + } + } + } + if s.VisibilityConfig != nil { + if err := s.VisibilityConfig.Validate(); err != nil { + invalidParams.AddNested("VisibilityConfig", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetCapacity sets the Capacity field's value. +func (s *CreateRuleGroupInput) SetCapacity(v int64) *CreateRuleGroupInput { + s.Capacity = &v + return s +} + +// SetDescription sets the Description field's value. +func (s *CreateRuleGroupInput) SetDescription(v string) *CreateRuleGroupInput { + s.Description = &v + return s +} + +// SetName sets the Name field's value. +func (s *CreateRuleGroupInput) SetName(v string) *CreateRuleGroupInput { + s.Name = &v + return s +} + +// SetRules sets the Rules field's value. +func (s *CreateRuleGroupInput) SetRules(v []*Rule) *CreateRuleGroupInput { + s.Rules = v + return s +} + +// SetScope sets the Scope field's value. +func (s *CreateRuleGroupInput) SetScope(v string) *CreateRuleGroupInput { + s.Scope = &v + return s +} + +// SetTags sets the Tags field's value. +func (s *CreateRuleGroupInput) SetTags(v []*Tag) *CreateRuleGroupInput { + s.Tags = v + return s +} + +// SetVisibilityConfig sets the VisibilityConfig field's value. +func (s *CreateRuleGroupInput) SetVisibilityConfig(v *VisibilityConfig) *CreateRuleGroupInput { + s.VisibilityConfig = v + return s +} + +type CreateRuleGroupOutput struct { + _ struct{} `type:"structure"` + + // High-level information about a RuleGroup, returned by operations like create + // and list. This provides information like the ID, that you can use to retrieve + // and manage a RuleGroup, and the ARN, that you provide to the RuleGroupReferenceStatement + // to use the rule group in a Rule. + Summary *RuleGroupSummary `type:"structure"` +} + +// String returns the string representation +func (s CreateRuleGroupOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CreateRuleGroupOutput) GoString() string { + return s.String() +} + +// SetSummary sets the Summary field's value. +func (s *CreateRuleGroupOutput) SetSummary(v *RuleGroupSummary) *CreateRuleGroupOutput { + s.Summary = v + return s +} + +type CreateWebACLInput struct { + _ struct{} `type:"structure"` + + // The action to perform if none of the Rules contained in the WebACL match. + // + // DefaultAction is a required field + DefaultAction *DefaultAction `type:"structure" required:"true"` + + // A description of the Web ACL that helps with identification. You cannot change + // the description of a Web ACL after you create it. + Description *string `min:"1" type:"string"` + + // The name of the Web ACL. You cannot change the name of a Web ACL after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The Rule statements used to identify the web requests that you want to allow, + // block, or count. Each rule includes one top-level statement that AWS WAF + // uses to identify matching web requests, and parameters that govern how AWS + // WAF handles them. + Rules []*Rule `type:"list"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // An array of key:value pairs to associate with the resource. + Tags []*Tag `min:"1" type:"list"` + + // Defines and enables Amazon CloudWatch metrics and web request sample collection. + // + // VisibilityConfig is a required field + VisibilityConfig *VisibilityConfig `type:"structure" required:"true"` +} + +// String returns the string representation +func (s CreateWebACLInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CreateWebACLInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *CreateWebACLInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "CreateWebACLInput"} + if s.DefaultAction == nil { + invalidParams.Add(request.NewErrParamRequired("DefaultAction")) + } + if s.Description != nil && len(*s.Description) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Description", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.Tags != nil && len(s.Tags) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Tags", 1)) + } + if s.VisibilityConfig == nil { + invalidParams.Add(request.NewErrParamRequired("VisibilityConfig")) + } + if s.Rules != nil { + for i, v := range s.Rules { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Rules", i), err.(request.ErrInvalidParams)) + } + } + } + if s.Tags != nil { + for i, v := range s.Tags { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams)) + } + } + } + if s.VisibilityConfig != nil { + if err := s.VisibilityConfig.Validate(); err != nil { + invalidParams.AddNested("VisibilityConfig", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetDefaultAction sets the DefaultAction field's value. +func (s *CreateWebACLInput) SetDefaultAction(v *DefaultAction) *CreateWebACLInput { + s.DefaultAction = v + return s +} + +// SetDescription sets the Description field's value. +func (s *CreateWebACLInput) SetDescription(v string) *CreateWebACLInput { + s.Description = &v + return s +} + +// SetName sets the Name field's value. +func (s *CreateWebACLInput) SetName(v string) *CreateWebACLInput { + s.Name = &v + return s +} + +// SetRules sets the Rules field's value. +func (s *CreateWebACLInput) SetRules(v []*Rule) *CreateWebACLInput { + s.Rules = v + return s +} + +// SetScope sets the Scope field's value. +func (s *CreateWebACLInput) SetScope(v string) *CreateWebACLInput { + s.Scope = &v + return s +} + +// SetTags sets the Tags field's value. +func (s *CreateWebACLInput) SetTags(v []*Tag) *CreateWebACLInput { + s.Tags = v + return s +} + +// SetVisibilityConfig sets the VisibilityConfig field's value. +func (s *CreateWebACLInput) SetVisibilityConfig(v *VisibilityConfig) *CreateWebACLInput { + s.VisibilityConfig = v + return s +} + +type CreateWebACLOutput struct { + _ struct{} `type:"structure"` + + // High-level information about a WebACL, returned by operations like create + // and list. This provides information like the ID, that you can use to retrieve + // and manage a WebACL, and the ARN, that you provide to operations like AssociateWebACL. + Summary *WebACLSummary `type:"structure"` +} + +// String returns the string representation +func (s CreateWebACLOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s CreateWebACLOutput) GoString() string { + return s.String() +} + +// SetSummary sets the Summary field's value. +func (s *CreateWebACLOutput) SetSummary(v *WebACLSummary) *CreateWebACLOutput { + s.Summary = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// In a WebACL, this is the action that you want AWS WAF to perform when a web +// request doesn't match any of the rules in the WebACL. The default action +// must be a terminating action, so count is not allowed. +type DefaultAction struct { + _ struct{} `type:"structure"` + + // Specifies that AWS WAF should allow requests by default. + Allow *AllowAction `type:"structure"` + + // Specifies that AWS WAF should block requests by default. + Block *BlockAction `type:"structure"` +} + +// String returns the string representation +func (s DefaultAction) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DefaultAction) GoString() string { + return s.String() +} + +// SetAllow sets the Allow field's value. +func (s *DefaultAction) SetAllow(v *AllowAction) *DefaultAction { + s.Allow = v + return s +} + +// SetBlock sets the Block field's value. +func (s *DefaultAction) SetBlock(v *BlockAction) *DefaultAction { + s.Block = v + return s +} + +type DeleteFirewallManagerRuleGroupsInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the web ACL. + // + // WebACLArn is a required field + WebACLArn *string `min:"20" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // WebACLLockToken is a required field + WebACLLockToken *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s DeleteFirewallManagerRuleGroupsInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteFirewallManagerRuleGroupsInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DeleteFirewallManagerRuleGroupsInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DeleteFirewallManagerRuleGroupsInput"} + if s.WebACLArn == nil { + invalidParams.Add(request.NewErrParamRequired("WebACLArn")) + } + if s.WebACLArn != nil && len(*s.WebACLArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("WebACLArn", 20)) + } + if s.WebACLLockToken == nil { + invalidParams.Add(request.NewErrParamRequired("WebACLLockToken")) + } + if s.WebACLLockToken != nil && len(*s.WebACLLockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("WebACLLockToken", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetWebACLArn sets the WebACLArn field's value. +func (s *DeleteFirewallManagerRuleGroupsInput) SetWebACLArn(v string) *DeleteFirewallManagerRuleGroupsInput { + s.WebACLArn = &v + return s +} + +// SetWebACLLockToken sets the WebACLLockToken field's value. +func (s *DeleteFirewallManagerRuleGroupsInput) SetWebACLLockToken(v string) *DeleteFirewallManagerRuleGroupsInput { + s.WebACLLockToken = &v + return s +} + +type DeleteFirewallManagerRuleGroupsOutput struct { + _ struct{} `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + NextWebACLLockToken *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s DeleteFirewallManagerRuleGroupsOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteFirewallManagerRuleGroupsOutput) GoString() string { + return s.String() +} + +// SetNextWebACLLockToken sets the NextWebACLLockToken field's value. +func (s *DeleteFirewallManagerRuleGroupsOutput) SetNextWebACLLockToken(v string) *DeleteFirewallManagerRuleGroupsOutput { + s.NextWebACLLockToken = &v + return s +} + +type DeleteIPSetInput struct { + _ struct{} `type:"structure"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // LockToken is a required field + LockToken *string `min:"1" type:"string" required:"true"` + + // The name of the IP set. You cannot change the name of an IPSet after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s DeleteIPSetInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteIPSetInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DeleteIPSetInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DeleteIPSetInput"} + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.LockToken == nil { + invalidParams.Add(request.NewErrParamRequired("LockToken")) + } + if s.LockToken != nil && len(*s.LockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LockToken", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetId sets the Id field's value. +func (s *DeleteIPSetInput) SetId(v string) *DeleteIPSetInput { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *DeleteIPSetInput) SetLockToken(v string) *DeleteIPSetInput { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *DeleteIPSetInput) SetName(v string) *DeleteIPSetInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *DeleteIPSetInput) SetScope(v string) *DeleteIPSetInput { + s.Scope = &v + return s +} + +type DeleteIPSetOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s DeleteIPSetOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteIPSetOutput) GoString() string { + return s.String() +} + +type DeleteLoggingConfigurationInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the web ACL from which you want to delete + // the LoggingConfiguration. + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s DeleteLoggingConfigurationInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteLoggingConfigurationInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DeleteLoggingConfigurationInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DeleteLoggingConfigurationInput"} + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *DeleteLoggingConfigurationInput) SetResourceArn(v string) *DeleteLoggingConfigurationInput { + s.ResourceArn = &v + return s +} + +type DeleteLoggingConfigurationOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s DeleteLoggingConfigurationOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteLoggingConfigurationOutput) GoString() string { + return s.String() +} + +type DeletePermissionPolicyInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the rule group from which you want to delete + // the policy. + // + // You must be the owner of the rule group to perform this operation. + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s DeletePermissionPolicyInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeletePermissionPolicyInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DeletePermissionPolicyInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DeletePermissionPolicyInput"} + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *DeletePermissionPolicyInput) SetResourceArn(v string) *DeletePermissionPolicyInput { + s.ResourceArn = &v + return s +} + +type DeletePermissionPolicyOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s DeletePermissionPolicyOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeletePermissionPolicyOutput) GoString() string { + return s.String() +} + +type DeleteRegexPatternSetInput struct { + _ struct{} `type:"structure"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // LockToken is a required field + LockToken *string `min:"1" type:"string" required:"true"` + + // The name of the set. You cannot change the name after you create the set. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s DeleteRegexPatternSetInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteRegexPatternSetInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DeleteRegexPatternSetInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DeleteRegexPatternSetInput"} + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.LockToken == nil { + invalidParams.Add(request.NewErrParamRequired("LockToken")) + } + if s.LockToken != nil && len(*s.LockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LockToken", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetId sets the Id field's value. +func (s *DeleteRegexPatternSetInput) SetId(v string) *DeleteRegexPatternSetInput { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *DeleteRegexPatternSetInput) SetLockToken(v string) *DeleteRegexPatternSetInput { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *DeleteRegexPatternSetInput) SetName(v string) *DeleteRegexPatternSetInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *DeleteRegexPatternSetInput) SetScope(v string) *DeleteRegexPatternSetInput { + s.Scope = &v + return s +} + +type DeleteRegexPatternSetOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s DeleteRegexPatternSetOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteRegexPatternSetOutput) GoString() string { + return s.String() +} + +type DeleteRuleGroupInput struct { + _ struct{} `type:"structure"` + + // A unique identifier for the rule group. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // LockToken is a required field + LockToken *string `min:"1" type:"string" required:"true"` + + // The name of the rule group. You cannot change the name of a rule group after + // you create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s DeleteRuleGroupInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteRuleGroupInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DeleteRuleGroupInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DeleteRuleGroupInput"} + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.LockToken == nil { + invalidParams.Add(request.NewErrParamRequired("LockToken")) + } + if s.LockToken != nil && len(*s.LockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LockToken", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetId sets the Id field's value. +func (s *DeleteRuleGroupInput) SetId(v string) *DeleteRuleGroupInput { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *DeleteRuleGroupInput) SetLockToken(v string) *DeleteRuleGroupInput { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *DeleteRuleGroupInput) SetName(v string) *DeleteRuleGroupInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *DeleteRuleGroupInput) SetScope(v string) *DeleteRuleGroupInput { + s.Scope = &v + return s +} + +type DeleteRuleGroupOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s DeleteRuleGroupOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteRuleGroupOutput) GoString() string { + return s.String() +} + +type DeleteWebACLInput struct { + _ struct{} `type:"structure"` + + // The unique identifier for the Web ACL. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // LockToken is a required field + LockToken *string `min:"1" type:"string" required:"true"` + + // The name of the Web ACL. You cannot change the name of a Web ACL after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s DeleteWebACLInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteWebACLInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DeleteWebACLInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DeleteWebACLInput"} + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.LockToken == nil { + invalidParams.Add(request.NewErrParamRequired("LockToken")) + } + if s.LockToken != nil && len(*s.LockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LockToken", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetId sets the Id field's value. +func (s *DeleteWebACLInput) SetId(v string) *DeleteWebACLInput { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *DeleteWebACLInput) SetLockToken(v string) *DeleteWebACLInput { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *DeleteWebACLInput) SetName(v string) *DeleteWebACLInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *DeleteWebACLInput) SetScope(v string) *DeleteWebACLInput { + s.Scope = &v + return s +} + +type DeleteWebACLOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s DeleteWebACLOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DeleteWebACLOutput) GoString() string { + return s.String() +} + +type DescribeManagedRuleGroupInput struct { + _ struct{} `type:"structure"` + + // The name of the managed rule group. You use this, along with the vendor name, + // to identify the rule group. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // The name of the managed rule group vendor. You use this, along with the rule + // group name, to identify the rule group. + // + // VendorName is a required field + VendorName *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s DescribeManagedRuleGroupInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DescribeManagedRuleGroupInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DescribeManagedRuleGroupInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DescribeManagedRuleGroupInput"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.VendorName == nil { + invalidParams.Add(request.NewErrParamRequired("VendorName")) + } + if s.VendorName != nil && len(*s.VendorName) < 1 { + invalidParams.Add(request.NewErrParamMinLen("VendorName", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetName sets the Name field's value. +func (s *DescribeManagedRuleGroupInput) SetName(v string) *DescribeManagedRuleGroupInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *DescribeManagedRuleGroupInput) SetScope(v string) *DescribeManagedRuleGroupInput { + s.Scope = &v + return s +} + +// SetVendorName sets the VendorName field's value. +func (s *DescribeManagedRuleGroupInput) SetVendorName(v string) *DescribeManagedRuleGroupInput { + s.VendorName = &v + return s +} + +type DescribeManagedRuleGroupOutput struct { + _ struct{} `type:"structure"` + + // The web ACL capacity units (WCUs) required for this rule group. AWS WAF uses + // web ACL capacity units (WCU) to calculate and control the operating resources + // that are used to run your rules, rule groups, and web ACLs. AWS WAF calculates + // capacity differently for each rule type, to reflect each rule's relative + // cost. Rule group capacity is fixed at creation, so users can plan their web + // ACL WCU usage when they use a rule group. The WCU limit for web ACLs is 1,500. + Capacity *int64 `min:"1" type:"long"` + + Rules []*RuleSummary `type:"list"` +} + +// String returns the string representation +func (s DescribeManagedRuleGroupOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DescribeManagedRuleGroupOutput) GoString() string { + return s.String() +} + +// SetCapacity sets the Capacity field's value. +func (s *DescribeManagedRuleGroupOutput) SetCapacity(v int64) *DescribeManagedRuleGroupOutput { + s.Capacity = &v + return s +} + +// SetRules sets the Rules field's value. +func (s *DescribeManagedRuleGroupOutput) SetRules(v []*RuleSummary) *DescribeManagedRuleGroupOutput { + s.Rules = v + return s +} + +type DisassociateWebACLInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the resource to disassociate from the web + // ACL. + // + // The ARN must be in one of the following formats: + // + // * For an Application Load Balancer: arn:aws:elasticloadbalancing:region:account-id:loadbalancer/app/load-balancer-name/load-balancer-id + // + // * For an API Gateway REST API: arn:aws:apigateway:region::/restapis/api-id/stages/stage-name + // + // * For an AppSync GraphQL API: arn:aws:appsync:region:account-id:apis/GraphQLApiId + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s DisassociateWebACLInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DisassociateWebACLInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *DisassociateWebACLInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "DisassociateWebACLInput"} + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *DisassociateWebACLInput) SetResourceArn(v string) *DisassociateWebACLInput { + s.ResourceArn = &v + return s +} + +type DisassociateWebACLOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s DisassociateWebACLOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s DisassociateWebACLOutput) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Specifies a single rule to exclude from the rule group. Excluding a rule +// overrides its action setting for the rule group in the web ACL, setting it +// to COUNT. This effectively excludes the rule from acting on web requests. +type ExcludedRule struct { + _ struct{} `type:"structure"` + + // The name of the rule to exclude. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s ExcludedRule) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ExcludedRule) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ExcludedRule) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ExcludedRule"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetName sets the Name field's value. +func (s *ExcludedRule) SetName(v string) *ExcludedRule { + s.Name = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The part of a web request that you want AWS WAF to inspect. Include the single +// FieldToMatch type that you want to inspect, with additional specifications +// as needed, according to the type. You specify a single request component +// in FieldToMatch for each rule statement that requires it. To inspect more +// than one component of a web request, create a separate rule statement for +// each component. +type FieldToMatch struct { + _ struct{} `type:"structure"` + + // Inspect all query arguments. + AllQueryArguments *AllQueryArguments `type:"structure"` + + // Inspect the request body, which immediately follows the request headers. + // This is the part of a request that contains any additional data that you + // want to send to your web server as the HTTP request body, such as data from + // a form. + // + // Note that only the first 8 KB (8192 bytes) of the request body are forwarded + // to AWS WAF for inspection by the underlying host service. If you don't need + // to inspect more than 8 KB, you can guarantee that you don't allow additional + // bytes in by combining a statement that inspects the body of the web request, + // such as ByteMatchStatement or RegexPatternSetReferenceStatement, with a SizeConstraintStatement + // that enforces an 8 KB size limit on the body of the request. AWS WAF doesn't + // support inspecting the entire contents of web requests whose bodies exceed + // the 8 KB limit. + Body *Body `type:"structure"` + + // Inspect the HTTP method. The method indicates the type of operation that + // the request is asking the origin to perform. + Method *Method `type:"structure"` + + // Inspect the query string. This is the part of a URL that appears after a + // ? character, if any. + QueryString *QueryString `type:"structure"` + + // Inspect a single header. Provide the name of the header to inspect, for example, + // User-Agent or Referer. This setting isn't case sensitive. + SingleHeader *SingleHeader `type:"structure"` + + // Inspect a single query argument. Provide the name of the query argument to + // inspect, such as UserName or SalesRegion. The name can be up to 30 characters + // long and isn't case sensitive. + // + // This is used only to indicate the web request component for AWS WAF to inspect, + // in the FieldToMatch specification. + SingleQueryArgument *SingleQueryArgument `type:"structure"` + + // Inspect the request URI path. This is the part of a web request that identifies + // a resource, for example, /images/daily-ad.jpg. + UriPath *UriPath `type:"structure"` +} + +// String returns the string representation +func (s FieldToMatch) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s FieldToMatch) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *FieldToMatch) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "FieldToMatch"} + if s.SingleHeader != nil { + if err := s.SingleHeader.Validate(); err != nil { + invalidParams.AddNested("SingleHeader", err.(request.ErrInvalidParams)) + } + } + if s.SingleQueryArgument != nil { + if err := s.SingleQueryArgument.Validate(); err != nil { + invalidParams.AddNested("SingleQueryArgument", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetAllQueryArguments sets the AllQueryArguments field's value. +func (s *FieldToMatch) SetAllQueryArguments(v *AllQueryArguments) *FieldToMatch { + s.AllQueryArguments = v + return s +} + +// SetBody sets the Body field's value. +func (s *FieldToMatch) SetBody(v *Body) *FieldToMatch { + s.Body = v + return s +} + +// SetMethod sets the Method field's value. +func (s *FieldToMatch) SetMethod(v *Method) *FieldToMatch { + s.Method = v + return s +} + +// SetQueryString sets the QueryString field's value. +func (s *FieldToMatch) SetQueryString(v *QueryString) *FieldToMatch { + s.QueryString = v + return s +} + +// SetSingleHeader sets the SingleHeader field's value. +func (s *FieldToMatch) SetSingleHeader(v *SingleHeader) *FieldToMatch { + s.SingleHeader = v + return s +} + +// SetSingleQueryArgument sets the SingleQueryArgument field's value. +func (s *FieldToMatch) SetSingleQueryArgument(v *SingleQueryArgument) *FieldToMatch { + s.SingleQueryArgument = v + return s +} + +// SetUriPath sets the UriPath field's value. +func (s *FieldToMatch) SetUriPath(v *UriPath) *FieldToMatch { + s.UriPath = v + return s +} + +// A rule group that's defined for an AWS Firewall Manager WAF policy. +type FirewallManagerRuleGroup struct { + _ struct{} `type:"structure"` + + // The processing guidance for an AWS Firewall Manager rule. This is like a + // regular rule Statement, but it can only contain a rule group reference. + // + // FirewallManagerStatement is a required field + FirewallManagerStatement *FirewallManagerStatement `type:"structure" required:"true"` + + // The name of the rule group. You cannot change the name of a rule group after + // you create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The override action to apply to the rules in a rule group. Used only for + // rule statements that reference a rule group, like RuleGroupReferenceStatement + // and ManagedRuleGroupStatement. + // + // Set the override action to none to leave the rule actions in effect. Set + // it to count to only count matches, regardless of the rule action settings. + // + // In a Rule, you must specify either this OverrideAction setting or the rule + // Action setting, but not both: + // + // * If the rule statement references a rule group, use this override action + // setting and not the action setting. + // + // * If the rule statement does not reference a rule group, use the rule + // action setting and not this rule override action setting. + // + // OverrideAction is a required field + OverrideAction *OverrideAction `type:"structure" required:"true"` + + // If you define more than one rule group in the first or last Firewall Manager + // rule groups, AWS WAF evaluates each request against the rule groups in order, + // starting from the lowest priority setting. The priorities don't need to be + // consecutive, but they must all be different. + // + // Priority is a required field + Priority *int64 `type:"integer" required:"true"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // Defines and enables Amazon CloudWatch metrics and web request sample collection. + // + // VisibilityConfig is a required field + VisibilityConfig *VisibilityConfig `type:"structure" required:"true"` +} + +// String returns the string representation +func (s FirewallManagerRuleGroup) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s FirewallManagerRuleGroup) GoString() string { + return s.String() +} + +// SetFirewallManagerStatement sets the FirewallManagerStatement field's value. +func (s *FirewallManagerRuleGroup) SetFirewallManagerStatement(v *FirewallManagerStatement) *FirewallManagerRuleGroup { + s.FirewallManagerStatement = v + return s +} + +// SetName sets the Name field's value. +func (s *FirewallManagerRuleGroup) SetName(v string) *FirewallManagerRuleGroup { + s.Name = &v + return s +} + +// SetOverrideAction sets the OverrideAction field's value. +func (s *FirewallManagerRuleGroup) SetOverrideAction(v *OverrideAction) *FirewallManagerRuleGroup { + s.OverrideAction = v + return s +} + +// SetPriority sets the Priority field's value. +func (s *FirewallManagerRuleGroup) SetPriority(v int64) *FirewallManagerRuleGroup { + s.Priority = &v + return s +} + +// SetVisibilityConfig sets the VisibilityConfig field's value. +func (s *FirewallManagerRuleGroup) SetVisibilityConfig(v *VisibilityConfig) *FirewallManagerRuleGroup { + s.VisibilityConfig = v + return s +} + +// The processing guidance for an AWS Firewall Manager rule. This is like a +// regular rule Statement, but it can only contain a rule group reference. +type FirewallManagerStatement struct { + _ struct{} `type:"structure"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // A rule statement used to run the rules that are defined in a managed rule + // group. To use this, provide the vendor name and the name of the rule group + // in this statement. You can retrieve the required names by calling ListAvailableManagedRuleGroups. + // + // You can't nest a ManagedRuleGroupStatement, for example for use inside a + // NotStatement or OrStatement. It can only be referenced as a top-level statement + // within a rule. + ManagedRuleGroupStatement *ManagedRuleGroupStatement `type:"structure"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // A rule statement used to run the rules that are defined in a RuleGroup. To + // use this, create a rule group with your rules, then provide the ARN of the + // rule group in this statement. + // + // You cannot nest a RuleGroupReferenceStatement, for example for use inside + // a NotStatement or OrStatement. It can only be referenced as a top-level statement + // within a rule. + RuleGroupReferenceStatement *RuleGroupReferenceStatement `type:"structure"` +} + +// String returns the string representation +func (s FirewallManagerStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s FirewallManagerStatement) GoString() string { + return s.String() +} + +// SetManagedRuleGroupStatement sets the ManagedRuleGroupStatement field's value. +func (s *FirewallManagerStatement) SetManagedRuleGroupStatement(v *ManagedRuleGroupStatement) *FirewallManagerStatement { + s.ManagedRuleGroupStatement = v + return s +} + +// SetRuleGroupReferenceStatement sets the RuleGroupReferenceStatement field's value. +func (s *FirewallManagerStatement) SetRuleGroupReferenceStatement(v *RuleGroupReferenceStatement) *FirewallManagerStatement { + s.RuleGroupReferenceStatement = v + return s +} + +// The configuration for inspecting IP addresses in an HTTP header that you +// specify, instead of using the IP address that's reported by the web request +// origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify +// any header name. +// +// If the specified header isn't present in the request, AWS WAF doesn't apply +// the rule to the web request at all. +// +// This configuration is used for GeoMatchStatement and RateBasedStatement. +// For IPSetReferenceStatement, use IPSetForwardedIPConfig instead. +// +// AWS WAF only evaluates the first IP address found in the specified HTTP header. +type ForwardedIPConfig struct { + _ struct{} `type:"structure"` + + // The match status to assign to the web request if the request doesn't have + // a valid IP address in the specified position. + // + // If the specified header isn't present in the request, AWS WAF doesn't apply + // the rule to the web request at all. + // + // You can specify the following fallback behaviors: + // + // * MATCH - Treat the web request as matching the rule statement. AWS WAF + // applies the rule action to the request. + // + // * NO_MATCH - Treat the web request as not matching the rule statement. + // + // FallbackBehavior is a required field + FallbackBehavior *string `type:"string" required:"true" enum:"FallbackBehavior"` + + // The name of the HTTP header to use for the IP address. For example, to use + // the X-Forwarded-For (XFF) header, set this to X-Forwarded-For. + // + // If the specified header isn't present in the request, AWS WAF doesn't apply + // the rule to the web request at all. + // + // HeaderName is a required field + HeaderName *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s ForwardedIPConfig) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ForwardedIPConfig) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ForwardedIPConfig) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ForwardedIPConfig"} + if s.FallbackBehavior == nil { + invalidParams.Add(request.NewErrParamRequired("FallbackBehavior")) + } + if s.HeaderName == nil { + invalidParams.Add(request.NewErrParamRequired("HeaderName")) + } + if s.HeaderName != nil && len(*s.HeaderName) < 1 { + invalidParams.Add(request.NewErrParamMinLen("HeaderName", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetFallbackBehavior sets the FallbackBehavior field's value. +func (s *ForwardedIPConfig) SetFallbackBehavior(v string) *ForwardedIPConfig { + s.FallbackBehavior = &v + return s +} + +// SetHeaderName sets the HeaderName field's value. +func (s *ForwardedIPConfig) SetHeaderName(v string) *ForwardedIPConfig { + s.HeaderName = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule statement used to identify web requests based on country of origin. +type GeoMatchStatement struct { + _ struct{} `type:"structure"` + + // An array of two-character country codes, for example, [ "US", "CN" ], from + // the alpha-2 country ISO codes of the ISO 3166 international standard. + CountryCodes []*string `min:"1" type:"list"` + + // The configuration for inspecting IP addresses in an HTTP header that you + // specify, instead of using the IP address that's reported by the web request + // origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify + // any header name. + // + // If the specified header isn't present in the request, AWS WAF doesn't apply + // the rule to the web request at all. + ForwardedIPConfig *ForwardedIPConfig `type:"structure"` +} + +// String returns the string representation +func (s GeoMatchStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GeoMatchStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GeoMatchStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GeoMatchStatement"} + if s.CountryCodes != nil && len(s.CountryCodes) < 1 { + invalidParams.Add(request.NewErrParamMinLen("CountryCodes", 1)) + } + if s.ForwardedIPConfig != nil { + if err := s.ForwardedIPConfig.Validate(); err != nil { + invalidParams.AddNested("ForwardedIPConfig", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetCountryCodes sets the CountryCodes field's value. +func (s *GeoMatchStatement) SetCountryCodes(v []*string) *GeoMatchStatement { + s.CountryCodes = v + return s +} + +// SetForwardedIPConfig sets the ForwardedIPConfig field's value. +func (s *GeoMatchStatement) SetForwardedIPConfig(v *ForwardedIPConfig) *GeoMatchStatement { + s.ForwardedIPConfig = v + return s +} + +type GetIPSetInput struct { + _ struct{} `type:"structure"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // The name of the IP set. You cannot change the name of an IPSet after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s GetIPSetInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetIPSetInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetIPSetInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetIPSetInput"} + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetId sets the Id field's value. +func (s *GetIPSetInput) SetId(v string) *GetIPSetInput { + s.Id = &v + return s +} + +// SetName sets the Name field's value. +func (s *GetIPSetInput) SetName(v string) *GetIPSetInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *GetIPSetInput) SetScope(v string) *GetIPSetInput { + s.Scope = &v + return s +} + +type GetIPSetOutput struct { + _ struct{} `type:"structure"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // Contains one or more IP addresses or blocks of IP addresses specified in + // Classless Inter-Domain Routing (CIDR) notation. AWS WAF supports any CIDR + // range. For information about CIDR notation, see the Wikipedia entry Classless + // Inter-Domain Routing (https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). + // + // AWS WAF assigns an ARN to each IPSet that you create. To use an IP set in + // a rule, you provide the ARN to the Rule statement IPSetReferenceStatement. + IPSet *IPSet `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + LockToken *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s GetIPSetOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetIPSetOutput) GoString() string { + return s.String() +} + +// SetIPSet sets the IPSet field's value. +func (s *GetIPSetOutput) SetIPSet(v *IPSet) *GetIPSetOutput { + s.IPSet = v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *GetIPSetOutput) SetLockToken(v string) *GetIPSetOutput { + s.LockToken = &v + return s +} + +type GetLoggingConfigurationInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the web ACL for which you want to get the + // LoggingConfiguration. + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s GetLoggingConfigurationInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetLoggingConfigurationInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetLoggingConfigurationInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetLoggingConfigurationInput"} + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *GetLoggingConfigurationInput) SetResourceArn(v string) *GetLoggingConfigurationInput { + s.ResourceArn = &v + return s +} + +type GetLoggingConfigurationOutput struct { + _ struct{} `type:"structure"` + + // The LoggingConfiguration for the specified web ACL. + LoggingConfiguration *LoggingConfiguration `type:"structure"` +} + +// String returns the string representation +func (s GetLoggingConfigurationOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetLoggingConfigurationOutput) GoString() string { + return s.String() +} + +// SetLoggingConfiguration sets the LoggingConfiguration field's value. +func (s *GetLoggingConfigurationOutput) SetLoggingConfiguration(v *LoggingConfiguration) *GetLoggingConfigurationOutput { + s.LoggingConfiguration = v + return s +} + +type GetPermissionPolicyInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the rule group for which you want to get + // the policy. + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s GetPermissionPolicyInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetPermissionPolicyInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetPermissionPolicyInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetPermissionPolicyInput"} + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *GetPermissionPolicyInput) SetResourceArn(v string) *GetPermissionPolicyInput { + s.ResourceArn = &v + return s +} + +type GetPermissionPolicyOutput struct { + _ struct{} `type:"structure"` + + // The IAM policy that is attached to the specified rule group. + Policy *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s GetPermissionPolicyOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetPermissionPolicyOutput) GoString() string { + return s.String() +} + +// SetPolicy sets the Policy field's value. +func (s *GetPermissionPolicyOutput) SetPolicy(v string) *GetPermissionPolicyOutput { + s.Policy = &v + return s +} + +type GetRateBasedStatementManagedKeysInput struct { + _ struct{} `type:"structure"` + + // The name of the rate-based rule to get the keys for. + // + // RuleName is a required field + RuleName *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // The unique identifier for the Web ACL. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + // + // WebACLId is a required field + WebACLId *string `min:"1" type:"string" required:"true"` + + // The name of the Web ACL. You cannot change the name of a Web ACL after you + // create it. + // + // WebACLName is a required field + WebACLName *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s GetRateBasedStatementManagedKeysInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetRateBasedStatementManagedKeysInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetRateBasedStatementManagedKeysInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetRateBasedStatementManagedKeysInput"} + if s.RuleName == nil { + invalidParams.Add(request.NewErrParamRequired("RuleName")) + } + if s.RuleName != nil && len(*s.RuleName) < 1 { + invalidParams.Add(request.NewErrParamMinLen("RuleName", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.WebACLId == nil { + invalidParams.Add(request.NewErrParamRequired("WebACLId")) + } + if s.WebACLId != nil && len(*s.WebACLId) < 1 { + invalidParams.Add(request.NewErrParamMinLen("WebACLId", 1)) + } + if s.WebACLName == nil { + invalidParams.Add(request.NewErrParamRequired("WebACLName")) + } + if s.WebACLName != nil && len(*s.WebACLName) < 1 { + invalidParams.Add(request.NewErrParamMinLen("WebACLName", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetRuleName sets the RuleName field's value. +func (s *GetRateBasedStatementManagedKeysInput) SetRuleName(v string) *GetRateBasedStatementManagedKeysInput { + s.RuleName = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *GetRateBasedStatementManagedKeysInput) SetScope(v string) *GetRateBasedStatementManagedKeysInput { + s.Scope = &v + return s +} + +// SetWebACLId sets the WebACLId field's value. +func (s *GetRateBasedStatementManagedKeysInput) SetWebACLId(v string) *GetRateBasedStatementManagedKeysInput { + s.WebACLId = &v + return s +} + +// SetWebACLName sets the WebACLName field's value. +func (s *GetRateBasedStatementManagedKeysInput) SetWebACLName(v string) *GetRateBasedStatementManagedKeysInput { + s.WebACLName = &v + return s +} + +type GetRateBasedStatementManagedKeysOutput struct { + _ struct{} `type:"structure"` + + // The keys that are of Internet Protocol version 4 (IPv4). + ManagedKeysIPV4 *RateBasedStatementManagedKeysIPSet `type:"structure"` + + // The keys that are of Internet Protocol version 6 (IPv6). + ManagedKeysIPV6 *RateBasedStatementManagedKeysIPSet `type:"structure"` +} + +// String returns the string representation +func (s GetRateBasedStatementManagedKeysOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetRateBasedStatementManagedKeysOutput) GoString() string { + return s.String() +} + +// SetManagedKeysIPV4 sets the ManagedKeysIPV4 field's value. +func (s *GetRateBasedStatementManagedKeysOutput) SetManagedKeysIPV4(v *RateBasedStatementManagedKeysIPSet) *GetRateBasedStatementManagedKeysOutput { + s.ManagedKeysIPV4 = v + return s +} + +// SetManagedKeysIPV6 sets the ManagedKeysIPV6 field's value. +func (s *GetRateBasedStatementManagedKeysOutput) SetManagedKeysIPV6(v *RateBasedStatementManagedKeysIPSet) *GetRateBasedStatementManagedKeysOutput { + s.ManagedKeysIPV6 = v + return s +} + +type GetRegexPatternSetInput struct { + _ struct{} `type:"structure"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // The name of the set. You cannot change the name after you create the set. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s GetRegexPatternSetInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetRegexPatternSetInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetRegexPatternSetInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetRegexPatternSetInput"} + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetId sets the Id field's value. +func (s *GetRegexPatternSetInput) SetId(v string) *GetRegexPatternSetInput { + s.Id = &v + return s +} + +// SetName sets the Name field's value. +func (s *GetRegexPatternSetInput) SetName(v string) *GetRegexPatternSetInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *GetRegexPatternSetInput) SetScope(v string) *GetRegexPatternSetInput { + s.Scope = &v + return s +} + +type GetRegexPatternSetOutput struct { + _ struct{} `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + LockToken *string `min:"1" type:"string"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // Contains one or more regular expressions. + // + // AWS WAF assigns an ARN to each RegexPatternSet that you create. To use a + // set in a rule, you provide the ARN to the Rule statement RegexPatternSetReferenceStatement. + RegexPatternSet *RegexPatternSet `type:"structure"` +} + +// String returns the string representation +func (s GetRegexPatternSetOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetRegexPatternSetOutput) GoString() string { + return s.String() +} + +// SetLockToken sets the LockToken field's value. +func (s *GetRegexPatternSetOutput) SetLockToken(v string) *GetRegexPatternSetOutput { + s.LockToken = &v + return s +} + +// SetRegexPatternSet sets the RegexPatternSet field's value. +func (s *GetRegexPatternSetOutput) SetRegexPatternSet(v *RegexPatternSet) *GetRegexPatternSetOutput { + s.RegexPatternSet = v + return s +} + +type GetRuleGroupInput struct { + _ struct{} `type:"structure"` + + // A unique identifier for the rule group. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // The name of the rule group. You cannot change the name of a rule group after + // you create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s GetRuleGroupInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetRuleGroupInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetRuleGroupInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetRuleGroupInput"} + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetId sets the Id field's value. +func (s *GetRuleGroupInput) SetId(v string) *GetRuleGroupInput { + s.Id = &v + return s +} + +// SetName sets the Name field's value. +func (s *GetRuleGroupInput) SetName(v string) *GetRuleGroupInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *GetRuleGroupInput) SetScope(v string) *GetRuleGroupInput { + s.Scope = &v + return s +} + +type GetRuleGroupOutput struct { + _ struct{} `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + LockToken *string `min:"1" type:"string"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // A rule group defines a collection of rules to inspect and control web requests + // that you can use in a WebACL. When you create a rule group, you define an + // immutable capacity limit. If you update a rule group, you must stay within + // the capacity. This allows others to reuse the rule group with confidence + // in its capacity requirements. + RuleGroup *RuleGroup `type:"structure"` +} + +// String returns the string representation +func (s GetRuleGroupOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetRuleGroupOutput) GoString() string { + return s.String() +} + +// SetLockToken sets the LockToken field's value. +func (s *GetRuleGroupOutput) SetLockToken(v string) *GetRuleGroupOutput { + s.LockToken = &v + return s +} + +// SetRuleGroup sets the RuleGroup field's value. +func (s *GetRuleGroupOutput) SetRuleGroup(v *RuleGroup) *GetRuleGroupOutput { + s.RuleGroup = v + return s +} + +type GetSampledRequestsInput struct { + _ struct{} `type:"structure"` + + // The number of requests that you want AWS WAF to return from among the first + // 5,000 requests that your AWS resource received during the time range. If + // your resource received fewer requests than the value of MaxItems, GetSampledRequests + // returns information about all of them. + // + // MaxItems is a required field + MaxItems *int64 `min:"1" type:"long" required:"true"` + + // The metric name assigned to the Rule or RuleGroup for which you want a sample + // of requests. + // + // RuleMetricName is a required field + RuleMetricName *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // The start date and time and the end date and time of the range for which + // you want GetSampledRequests to return a sample of requests. You must specify + // the times in Coordinated Universal Time (UTC) format. UTC format includes + // the special designator, Z. For example, "2016-09-27T14:50Z". You can specify + // any time range in the previous three hours. + // + // TimeWindow is a required field + TimeWindow *TimeWindow `type:"structure" required:"true"` + + // The Amazon resource name (ARN) of the WebACL for which you want a sample + // of requests. + // + // WebAclArn is a required field + WebAclArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s GetSampledRequestsInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetSampledRequestsInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetSampledRequestsInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetSampledRequestsInput"} + if s.MaxItems == nil { + invalidParams.Add(request.NewErrParamRequired("MaxItems")) + } + if s.MaxItems != nil && *s.MaxItems < 1 { + invalidParams.Add(request.NewErrParamMinValue("MaxItems", 1)) + } + if s.RuleMetricName == nil { + invalidParams.Add(request.NewErrParamRequired("RuleMetricName")) + } + if s.RuleMetricName != nil && len(*s.RuleMetricName) < 1 { + invalidParams.Add(request.NewErrParamMinLen("RuleMetricName", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.TimeWindow == nil { + invalidParams.Add(request.NewErrParamRequired("TimeWindow")) + } + if s.WebAclArn == nil { + invalidParams.Add(request.NewErrParamRequired("WebAclArn")) + } + if s.WebAclArn != nil && len(*s.WebAclArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("WebAclArn", 20)) + } + if s.TimeWindow != nil { + if err := s.TimeWindow.Validate(); err != nil { + invalidParams.AddNested("TimeWindow", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetMaxItems sets the MaxItems field's value. +func (s *GetSampledRequestsInput) SetMaxItems(v int64) *GetSampledRequestsInput { + s.MaxItems = &v + return s +} + +// SetRuleMetricName sets the RuleMetricName field's value. +func (s *GetSampledRequestsInput) SetRuleMetricName(v string) *GetSampledRequestsInput { + s.RuleMetricName = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *GetSampledRequestsInput) SetScope(v string) *GetSampledRequestsInput { + s.Scope = &v + return s +} + +// SetTimeWindow sets the TimeWindow field's value. +func (s *GetSampledRequestsInput) SetTimeWindow(v *TimeWindow) *GetSampledRequestsInput { + s.TimeWindow = v + return s +} + +// SetWebAclArn sets the WebAclArn field's value. +func (s *GetSampledRequestsInput) SetWebAclArn(v string) *GetSampledRequestsInput { + s.WebAclArn = &v + return s +} + +type GetSampledRequestsOutput struct { + _ struct{} `type:"structure"` + + // The total number of requests from which GetSampledRequests got a sample of + // MaxItems requests. If PopulationSize is less than MaxItems, the sample includes + // every request that your AWS resource received during the specified time range. + PopulationSize *int64 `type:"long"` + + // A complex type that contains detailed information about each of the requests + // in the sample. + SampledRequests []*SampledHTTPRequest `type:"list"` + + // Usually, TimeWindow is the time range that you specified in the GetSampledRequests + // request. However, if your AWS resource received more than 5,000 requests + // during the time range that you specified in the request, GetSampledRequests + // returns the time range for the first 5,000 requests. Times are in Coordinated + // Universal Time (UTC) format. + TimeWindow *TimeWindow `type:"structure"` +} + +// String returns the string representation +func (s GetSampledRequestsOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetSampledRequestsOutput) GoString() string { + return s.String() +} + +// SetPopulationSize sets the PopulationSize field's value. +func (s *GetSampledRequestsOutput) SetPopulationSize(v int64) *GetSampledRequestsOutput { + s.PopulationSize = &v + return s +} + +// SetSampledRequests sets the SampledRequests field's value. +func (s *GetSampledRequestsOutput) SetSampledRequests(v []*SampledHTTPRequest) *GetSampledRequestsOutput { + s.SampledRequests = v + return s +} + +// SetTimeWindow sets the TimeWindow field's value. +func (s *GetSampledRequestsOutput) SetTimeWindow(v *TimeWindow) *GetSampledRequestsOutput { + s.TimeWindow = v + return s +} + +type GetWebACLForResourceInput struct { + _ struct{} `type:"structure"` + + // The ARN (Amazon Resource Name) of the resource. + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s GetWebACLForResourceInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetWebACLForResourceInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetWebACLForResourceInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetWebACLForResourceInput"} + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *GetWebACLForResourceInput) SetResourceArn(v string) *GetWebACLForResourceInput { + s.ResourceArn = &v + return s +} + +type GetWebACLForResourceOutput struct { + _ struct{} `type:"structure"` + + // The Web ACL that is associated with the resource. If there is no associated + // resource, AWS WAF returns a null Web ACL. + WebACL *WebACL `type:"structure"` +} + +// String returns the string representation +func (s GetWebACLForResourceOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetWebACLForResourceOutput) GoString() string { + return s.String() +} + +// SetWebACL sets the WebACL field's value. +func (s *GetWebACLForResourceOutput) SetWebACL(v *WebACL) *GetWebACLForResourceOutput { + s.WebACL = v + return s +} + +type GetWebACLInput struct { + _ struct{} `type:"structure"` + + // The unique identifier for the Web ACL. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // The name of the Web ACL. You cannot change the name of a Web ACL after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s GetWebACLInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetWebACLInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *GetWebACLInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "GetWebACLInput"} + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetId sets the Id field's value. +func (s *GetWebACLInput) SetId(v string) *GetWebACLInput { + s.Id = &v + return s +} + +// SetName sets the Name field's value. +func (s *GetWebACLInput) SetName(v string) *GetWebACLInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *GetWebACLInput) SetScope(v string) *GetWebACLInput { + s.Scope = &v + return s +} + +type GetWebACLOutput struct { + _ struct{} `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + LockToken *string `min:"1" type:"string"` + + // The Web ACL specification. You can modify the settings in this Web ACL and + // use it to update this Web ACL or create a new one. + WebACL *WebACL `type:"structure"` +} + +// String returns the string representation +func (s GetWebACLOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s GetWebACLOutput) GoString() string { + return s.String() +} + +// SetLockToken sets the LockToken field's value. +func (s *GetWebACLOutput) SetLockToken(v string) *GetWebACLOutput { + s.LockToken = &v + return s +} + +// SetWebACL sets the WebACL field's value. +func (s *GetWebACLOutput) SetWebACL(v *WebACL) *GetWebACLOutput { + s.WebACL = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Part of the response from GetSampledRequests. This is a complex type that +// appears as Headers in the response syntax. HTTPHeader contains the names +// and values of all of the headers that appear in one of the web requests. +type HTTPHeader struct { + _ struct{} `type:"structure"` + + // The name of the HTTP header. + Name *string `type:"string"` + + // The value of the HTTP header. + Value *string `type:"string"` +} + +// String returns the string representation +func (s HTTPHeader) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s HTTPHeader) GoString() string { + return s.String() +} + +// SetName sets the Name field's value. +func (s *HTTPHeader) SetName(v string) *HTTPHeader { + s.Name = &v + return s +} + +// SetValue sets the Value field's value. +func (s *HTTPHeader) SetValue(v string) *HTTPHeader { + s.Value = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Part of the response from GetSampledRequests. This is a complex type that +// appears as Request in the response syntax. HTTPRequest contains information +// about one of the web requests. +type HTTPRequest struct { + _ struct{} `type:"structure"` + + // The IP address that the request originated from. If the web ACL is associated + // with a CloudFront distribution, this is the value of one of the following + // fields in CloudFront access logs: + // + // * c-ip, if the viewer did not use an HTTP proxy or a load balancer to + // send the request + // + // * x-forwarded-for, if the viewer did use an HTTP proxy or a load balancer + // to send the request + ClientIP *string `type:"string"` + + // The two-letter country code for the country that the request originated from. + // For a current list of country codes, see the Wikipedia entry ISO 3166-1 alpha-2 + // (https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). + Country *string `type:"string"` + + // The HTTP version specified in the sampled web request, for example, HTTP/1.1. + HTTPVersion *string `type:"string"` + + // A complex type that contains the name and value for each header in the sampled + // web request. + Headers []*HTTPHeader `type:"list"` + + // The HTTP method specified in the sampled web request. + Method *string `type:"string"` + + // The URI path of the request, which identifies the resource, for example, + // /images/daily-ad.jpg. + URI *string `type:"string"` +} + +// String returns the string representation +func (s HTTPRequest) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s HTTPRequest) GoString() string { + return s.String() +} + +// SetClientIP sets the ClientIP field's value. +func (s *HTTPRequest) SetClientIP(v string) *HTTPRequest { + s.ClientIP = &v + return s +} + +// SetCountry sets the Country field's value. +func (s *HTTPRequest) SetCountry(v string) *HTTPRequest { + s.Country = &v + return s +} + +// SetHTTPVersion sets the HTTPVersion field's value. +func (s *HTTPRequest) SetHTTPVersion(v string) *HTTPRequest { + s.HTTPVersion = &v + return s +} + +// SetHeaders sets the Headers field's value. +func (s *HTTPRequest) SetHeaders(v []*HTTPHeader) *HTTPRequest { + s.Headers = v + return s +} + +// SetMethod sets the Method field's value. +func (s *HTTPRequest) SetMethod(v string) *HTTPRequest { + s.Method = &v + return s +} + +// SetURI sets the URI field's value. +func (s *HTTPRequest) SetURI(v string) *HTTPRequest { + s.URI = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Contains one or more IP addresses or blocks of IP addresses specified in +// Classless Inter-Domain Routing (CIDR) notation. AWS WAF supports any CIDR +// range. For information about CIDR notation, see the Wikipedia entry Classless +// Inter-Domain Routing (https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). +// +// AWS WAF assigns an ARN to each IPSet that you create. To use an IP set in +// a rule, you provide the ARN to the Rule statement IPSetReferenceStatement. +type IPSet struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + // + // ARN is a required field + ARN *string `min:"20" type:"string" required:"true"` + + // Contains an array of strings that specify one or more IP addresses or blocks + // of IP addresses in Classless Inter-Domain Routing (CIDR) notation. AWS WAF + // supports all address ranges for IP versions IPv4 and IPv6. + // + // Examples: + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from the IP address 192.0.2.44, specify 192.0.2.44/32. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from IP addresses 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, + // specify 1111:0000:0000:0000:0000:0000:0000:0000/64. + // + // For more information about CIDR notation, see the Wikipedia entry Classless + // Inter-Domain Routing (https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). + // + // Addresses is a required field + Addresses []*string `type:"list" required:"true"` + + // A description of the IP set that helps with identification. You cannot change + // the description of an IP set after you create it. + Description *string `min:"1" type:"string"` + + // Specify IPV4 or IPV6. + // + // IPAddressVersion is a required field + IPAddressVersion *string `type:"string" required:"true" enum:"IPAddressVersion"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // The name of the IP set. You cannot change the name of an IPSet after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s IPSet) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s IPSet) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *IPSet) SetARN(v string) *IPSet { + s.ARN = &v + return s +} + +// SetAddresses sets the Addresses field's value. +func (s *IPSet) SetAddresses(v []*string) *IPSet { + s.Addresses = v + return s +} + +// SetDescription sets the Description field's value. +func (s *IPSet) SetDescription(v string) *IPSet { + s.Description = &v + return s +} + +// SetIPAddressVersion sets the IPAddressVersion field's value. +func (s *IPSet) SetIPAddressVersion(v string) *IPSet { + s.IPAddressVersion = &v + return s +} + +// SetId sets the Id field's value. +func (s *IPSet) SetId(v string) *IPSet { + s.Id = &v + return s +} + +// SetName sets the Name field's value. +func (s *IPSet) SetName(v string) *IPSet { + s.Name = &v + return s +} + +// The configuration for inspecting IP addresses in an HTTP header that you +// specify, instead of using the IP address that's reported by the web request +// origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify +// any header name. +// +// If the specified header isn't present in the request, AWS WAF doesn't apply +// the rule to the web request at all. +// +// This configuration is used only for IPSetReferenceStatement. For GeoMatchStatement +// and RateBasedStatement, use ForwardedIPConfig instead. +type IPSetForwardedIPConfig struct { + _ struct{} `type:"structure"` + + // The match status to assign to the web request if the request doesn't have + // a valid IP address in the specified position. + // + // If the specified header isn't present in the request, AWS WAF doesn't apply + // the rule to the web request at all. + // + // You can specify the following fallback behaviors: + // + // * MATCH - Treat the web request as matching the rule statement. AWS WAF + // applies the rule action to the request. + // + // * NO_MATCH - Treat the web request as not matching the rule statement. + // + // FallbackBehavior is a required field + FallbackBehavior *string `type:"string" required:"true" enum:"FallbackBehavior"` + + // The name of the HTTP header to use for the IP address. For example, to use + // the X-Forwarded-For (XFF) header, set this to X-Forwarded-For. + // + // If the specified header isn't present in the request, AWS WAF doesn't apply + // the rule to the web request at all. + // + // HeaderName is a required field + HeaderName *string `min:"1" type:"string" required:"true"` + + // The position in the header to search for the IP address. The header can contain + // IP addresses of the original client and also of proxies. For example, the + // header value could be 10.1.1.1, 127.0.0.0, 10.10.10.10 where the first IP + // address identifies the original client and the rest identify proxies that + // the request went through. + // + // The options for this setting are the following: + // + // * FIRST - Inspect the first IP address in the list of IP addresses in + // the header. This is usually the client's original IP. + // + // * LAST - Inspect the last IP address in the list of IP addresses in the + // header. + // + // * ANY - Inspect all IP addresses in the header for a match. If the header + // contains more than 10 IP addresses, AWS WAF inspects the last 10. + // + // Position is a required field + Position *string `type:"string" required:"true" enum:"ForwardedIPPosition"` +} + +// String returns the string representation +func (s IPSetForwardedIPConfig) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s IPSetForwardedIPConfig) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *IPSetForwardedIPConfig) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "IPSetForwardedIPConfig"} + if s.FallbackBehavior == nil { + invalidParams.Add(request.NewErrParamRequired("FallbackBehavior")) + } + if s.HeaderName == nil { + invalidParams.Add(request.NewErrParamRequired("HeaderName")) + } + if s.HeaderName != nil && len(*s.HeaderName) < 1 { + invalidParams.Add(request.NewErrParamMinLen("HeaderName", 1)) + } + if s.Position == nil { + invalidParams.Add(request.NewErrParamRequired("Position")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetFallbackBehavior sets the FallbackBehavior field's value. +func (s *IPSetForwardedIPConfig) SetFallbackBehavior(v string) *IPSetForwardedIPConfig { + s.FallbackBehavior = &v + return s +} + +// SetHeaderName sets the HeaderName field's value. +func (s *IPSetForwardedIPConfig) SetHeaderName(v string) *IPSetForwardedIPConfig { + s.HeaderName = &v + return s +} + +// SetPosition sets the Position field's value. +func (s *IPSetForwardedIPConfig) SetPosition(v string) *IPSetForwardedIPConfig { + s.Position = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule statement used to detect web requests coming from particular IP addresses +// or address ranges. To use this, create an IPSet that specifies the addresses +// you want to detect, then use the ARN of that set in this statement. To create +// an IP set, see CreateIPSet. +// +// Each IP set rule statement references an IP set. You create and maintain +// the set independent of your rules. This allows you to use the single set +// in multiple rules. When you update the referenced set, AWS WAF automatically +// updates all rules that reference it. +type IPSetReferenceStatement struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the IPSet that this statement references. + // + // ARN is a required field + ARN *string `min:"20" type:"string" required:"true"` + + // The configuration for inspecting IP addresses in an HTTP header that you + // specify, instead of using the IP address that's reported by the web request + // origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify + // any header name. + // + // If the specified header isn't present in the request, AWS WAF doesn't apply + // the rule to the web request at all. + IPSetForwardedIPConfig *IPSetForwardedIPConfig `type:"structure"` +} + +// String returns the string representation +func (s IPSetReferenceStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s IPSetReferenceStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *IPSetReferenceStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "IPSetReferenceStatement"} + if s.ARN == nil { + invalidParams.Add(request.NewErrParamRequired("ARN")) + } + if s.ARN != nil && len(*s.ARN) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ARN", 20)) + } + if s.IPSetForwardedIPConfig != nil { + if err := s.IPSetForwardedIPConfig.Validate(); err != nil { + invalidParams.AddNested("IPSetForwardedIPConfig", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetARN sets the ARN field's value. +func (s *IPSetReferenceStatement) SetARN(v string) *IPSetReferenceStatement { + s.ARN = &v + return s +} + +// SetIPSetForwardedIPConfig sets the IPSetForwardedIPConfig field's value. +func (s *IPSetReferenceStatement) SetIPSetForwardedIPConfig(v *IPSetForwardedIPConfig) *IPSetReferenceStatement { + s.IPSetForwardedIPConfig = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// High-level information about an IPSet, returned by operations like create +// and list. This provides information like the ID, that you can use to retrieve +// and manage an IPSet, and the ARN, that you provide to the IPSetReferenceStatement +// to use the address set in a Rule. +type IPSetSummary struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + ARN *string `min:"20" type:"string"` + + // A description of the IP set that helps with identification. You cannot change + // the description of an IP set after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + Id *string `min:"1" type:"string"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + LockToken *string `min:"1" type:"string"` + + // The name of the IP set. You cannot change the name of an IPSet after you + // create it. + Name *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s IPSetSummary) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s IPSetSummary) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *IPSetSummary) SetARN(v string) *IPSetSummary { + s.ARN = &v + return s +} + +// SetDescription sets the Description field's value. +func (s *IPSetSummary) SetDescription(v string) *IPSetSummary { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *IPSetSummary) SetId(v string) *IPSetSummary { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *IPSetSummary) SetLockToken(v string) *IPSetSummary { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *IPSetSummary) SetName(v string) *IPSetSummary { + s.Name = &v + return s +} + +type ListAvailableManagedRuleGroupsInput struct { + _ struct{} `type:"structure"` + + // The maximum number of objects that you want AWS WAF to return for this request. + // If more objects are available, in the response, AWS WAF provides a NextMarker + // value that you can use in a subsequent call to get the next batch of objects. + Limit *int64 `min:"1" type:"integer"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s ListAvailableManagedRuleGroupsInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListAvailableManagedRuleGroupsInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ListAvailableManagedRuleGroupsInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ListAvailableManagedRuleGroupsInput"} + if s.Limit != nil && *s.Limit < 1 { + invalidParams.Add(request.NewErrParamMinValue("Limit", 1)) + } + if s.NextMarker != nil && len(*s.NextMarker) < 1 { + invalidParams.Add(request.NewErrParamMinLen("NextMarker", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLimit sets the Limit field's value. +func (s *ListAvailableManagedRuleGroupsInput) SetLimit(v int64) *ListAvailableManagedRuleGroupsInput { + s.Limit = &v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListAvailableManagedRuleGroupsInput) SetNextMarker(v string) *ListAvailableManagedRuleGroupsInput { + s.NextMarker = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *ListAvailableManagedRuleGroupsInput) SetScope(v string) *ListAvailableManagedRuleGroupsInput { + s.Scope = &v + return s +} + +type ListAvailableManagedRuleGroupsOutput struct { + _ struct{} `type:"structure"` + + ManagedRuleGroups []*ManagedRuleGroupSummary `type:"list"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s ListAvailableManagedRuleGroupsOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListAvailableManagedRuleGroupsOutput) GoString() string { + return s.String() +} + +// SetManagedRuleGroups sets the ManagedRuleGroups field's value. +func (s *ListAvailableManagedRuleGroupsOutput) SetManagedRuleGroups(v []*ManagedRuleGroupSummary) *ListAvailableManagedRuleGroupsOutput { + s.ManagedRuleGroups = v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListAvailableManagedRuleGroupsOutput) SetNextMarker(v string) *ListAvailableManagedRuleGroupsOutput { + s.NextMarker = &v + return s +} + +type ListIPSetsInput struct { + _ struct{} `type:"structure"` + + // The maximum number of objects that you want AWS WAF to return for this request. + // If more objects are available, in the response, AWS WAF provides a NextMarker + // value that you can use in a subsequent call to get the next batch of objects. + Limit *int64 `min:"1" type:"integer"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s ListIPSetsInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListIPSetsInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ListIPSetsInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ListIPSetsInput"} + if s.Limit != nil && *s.Limit < 1 { + invalidParams.Add(request.NewErrParamMinValue("Limit", 1)) + } + if s.NextMarker != nil && len(*s.NextMarker) < 1 { + invalidParams.Add(request.NewErrParamMinLen("NextMarker", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLimit sets the Limit field's value. +func (s *ListIPSetsInput) SetLimit(v int64) *ListIPSetsInput { + s.Limit = &v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListIPSetsInput) SetNextMarker(v string) *ListIPSetsInput { + s.NextMarker = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *ListIPSetsInput) SetScope(v string) *ListIPSetsInput { + s.Scope = &v + return s +} + +type ListIPSetsOutput struct { + _ struct{} `type:"structure"` + + // Array of IPSets. This may not be the full list of IPSets that you have defined. + // See the Limit specification for this request. + IPSets []*IPSetSummary `type:"list"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s ListIPSetsOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListIPSetsOutput) GoString() string { + return s.String() +} + +// SetIPSets sets the IPSets field's value. +func (s *ListIPSetsOutput) SetIPSets(v []*IPSetSummary) *ListIPSetsOutput { + s.IPSets = v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListIPSetsOutput) SetNextMarker(v string) *ListIPSetsOutput { + s.NextMarker = &v + return s +} + +type ListLoggingConfigurationsInput struct { + _ struct{} `type:"structure"` + + // The maximum number of objects that you want AWS WAF to return for this request. + // If more objects are available, in the response, AWS WAF provides a NextMarker + // value that you can use in a subsequent call to get the next batch of objects. + Limit *int64 `min:"1" type:"integer"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + Scope *string `type:"string" enum:"Scope"` +} + +// String returns the string representation +func (s ListLoggingConfigurationsInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListLoggingConfigurationsInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ListLoggingConfigurationsInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ListLoggingConfigurationsInput"} + if s.Limit != nil && *s.Limit < 1 { + invalidParams.Add(request.NewErrParamMinValue("Limit", 1)) + } + if s.NextMarker != nil && len(*s.NextMarker) < 1 { + invalidParams.Add(request.NewErrParamMinLen("NextMarker", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLimit sets the Limit field's value. +func (s *ListLoggingConfigurationsInput) SetLimit(v int64) *ListLoggingConfigurationsInput { + s.Limit = &v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListLoggingConfigurationsInput) SetNextMarker(v string) *ListLoggingConfigurationsInput { + s.NextMarker = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *ListLoggingConfigurationsInput) SetScope(v string) *ListLoggingConfigurationsInput { + s.Scope = &v + return s +} + +type ListLoggingConfigurationsOutput struct { + _ struct{} `type:"structure"` + + LoggingConfigurations []*LoggingConfiguration `type:"list"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s ListLoggingConfigurationsOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListLoggingConfigurationsOutput) GoString() string { + return s.String() +} + +// SetLoggingConfigurations sets the LoggingConfigurations field's value. +func (s *ListLoggingConfigurationsOutput) SetLoggingConfigurations(v []*LoggingConfiguration) *ListLoggingConfigurationsOutput { + s.LoggingConfigurations = v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListLoggingConfigurationsOutput) SetNextMarker(v string) *ListLoggingConfigurationsOutput { + s.NextMarker = &v + return s +} + +type ListRegexPatternSetsInput struct { + _ struct{} `type:"structure"` + + // The maximum number of objects that you want AWS WAF to return for this request. + // If more objects are available, in the response, AWS WAF provides a NextMarker + // value that you can use in a subsequent call to get the next batch of objects. + Limit *int64 `min:"1" type:"integer"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s ListRegexPatternSetsInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListRegexPatternSetsInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ListRegexPatternSetsInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ListRegexPatternSetsInput"} + if s.Limit != nil && *s.Limit < 1 { + invalidParams.Add(request.NewErrParamMinValue("Limit", 1)) + } + if s.NextMarker != nil && len(*s.NextMarker) < 1 { + invalidParams.Add(request.NewErrParamMinLen("NextMarker", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLimit sets the Limit field's value. +func (s *ListRegexPatternSetsInput) SetLimit(v int64) *ListRegexPatternSetsInput { + s.Limit = &v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListRegexPatternSetsInput) SetNextMarker(v string) *ListRegexPatternSetsInput { + s.NextMarker = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *ListRegexPatternSetsInput) SetScope(v string) *ListRegexPatternSetsInput { + s.Scope = &v + return s +} + +type ListRegexPatternSetsOutput struct { + _ struct{} `type:"structure"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + RegexPatternSets []*RegexPatternSetSummary `type:"list"` +} + +// String returns the string representation +func (s ListRegexPatternSetsOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListRegexPatternSetsOutput) GoString() string { + return s.String() +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListRegexPatternSetsOutput) SetNextMarker(v string) *ListRegexPatternSetsOutput { + s.NextMarker = &v + return s +} + +// SetRegexPatternSets sets the RegexPatternSets field's value. +func (s *ListRegexPatternSetsOutput) SetRegexPatternSets(v []*RegexPatternSetSummary) *ListRegexPatternSetsOutput { + s.RegexPatternSets = v + return s +} + +type ListResourcesForWebACLInput struct { + _ struct{} `type:"structure"` + + // Used for web ACLs that are scoped for regional applications. A regional application + // can be an Application Load Balancer (ALB), an API Gateway REST API, or an + // AppSync GraphQL API. + ResourceType *string `type:"string" enum:"ResourceType"` + + // The Amazon Resource Name (ARN) of the Web ACL. + // + // WebACLArn is a required field + WebACLArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s ListResourcesForWebACLInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListResourcesForWebACLInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ListResourcesForWebACLInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ListResourcesForWebACLInput"} + if s.WebACLArn == nil { + invalidParams.Add(request.NewErrParamRequired("WebACLArn")) + } + if s.WebACLArn != nil && len(*s.WebACLArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("WebACLArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceType sets the ResourceType field's value. +func (s *ListResourcesForWebACLInput) SetResourceType(v string) *ListResourcesForWebACLInput { + s.ResourceType = &v + return s +} + +// SetWebACLArn sets the WebACLArn field's value. +func (s *ListResourcesForWebACLInput) SetWebACLArn(v string) *ListResourcesForWebACLInput { + s.WebACLArn = &v + return s +} + +type ListResourcesForWebACLOutput struct { + _ struct{} `type:"structure"` + + // The array of Amazon Resource Names (ARNs) of the associated resources. + ResourceArns []*string `type:"list"` +} + +// String returns the string representation +func (s ListResourcesForWebACLOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListResourcesForWebACLOutput) GoString() string { + return s.String() +} + +// SetResourceArns sets the ResourceArns field's value. +func (s *ListResourcesForWebACLOutput) SetResourceArns(v []*string) *ListResourcesForWebACLOutput { + s.ResourceArns = v + return s +} + +type ListRuleGroupsInput struct { + _ struct{} `type:"structure"` + + // The maximum number of objects that you want AWS WAF to return for this request. + // If more objects are available, in the response, AWS WAF provides a NextMarker + // value that you can use in a subsequent call to get the next batch of objects. + Limit *int64 `min:"1" type:"integer"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s ListRuleGroupsInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListRuleGroupsInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ListRuleGroupsInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ListRuleGroupsInput"} + if s.Limit != nil && *s.Limit < 1 { + invalidParams.Add(request.NewErrParamMinValue("Limit", 1)) + } + if s.NextMarker != nil && len(*s.NextMarker) < 1 { + invalidParams.Add(request.NewErrParamMinLen("NextMarker", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLimit sets the Limit field's value. +func (s *ListRuleGroupsInput) SetLimit(v int64) *ListRuleGroupsInput { + s.Limit = &v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListRuleGroupsInput) SetNextMarker(v string) *ListRuleGroupsInput { + s.NextMarker = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *ListRuleGroupsInput) SetScope(v string) *ListRuleGroupsInput { + s.Scope = &v + return s +} + +type ListRuleGroupsOutput struct { + _ struct{} `type:"structure"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + RuleGroups []*RuleGroupSummary `type:"list"` +} + +// String returns the string representation +func (s ListRuleGroupsOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListRuleGroupsOutput) GoString() string { + return s.String() +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListRuleGroupsOutput) SetNextMarker(v string) *ListRuleGroupsOutput { + s.NextMarker = &v + return s +} + +// SetRuleGroups sets the RuleGroups field's value. +func (s *ListRuleGroupsOutput) SetRuleGroups(v []*RuleGroupSummary) *ListRuleGroupsOutput { + s.RuleGroups = v + return s +} + +type ListTagsForResourceInput struct { + _ struct{} `type:"structure"` + + // The maximum number of objects that you want AWS WAF to return for this request. + // If more objects are available, in the response, AWS WAF provides a NextMarker + // value that you can use in a subsequent call to get the next batch of objects. + Limit *int64 `min:"1" type:"integer"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + // The Amazon Resource Name (ARN) of the resource. + // + // ResourceARN is a required field + ResourceARN *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s ListTagsForResourceInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListTagsForResourceInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ListTagsForResourceInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ListTagsForResourceInput"} + if s.Limit != nil && *s.Limit < 1 { + invalidParams.Add(request.NewErrParamMinValue("Limit", 1)) + } + if s.NextMarker != nil && len(*s.NextMarker) < 1 { + invalidParams.Add(request.NewErrParamMinLen("NextMarker", 1)) + } + if s.ResourceARN == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceARN")) + } + if s.ResourceARN != nil && len(*s.ResourceARN) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceARN", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLimit sets the Limit field's value. +func (s *ListTagsForResourceInput) SetLimit(v int64) *ListTagsForResourceInput { + s.Limit = &v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListTagsForResourceInput) SetNextMarker(v string) *ListTagsForResourceInput { + s.NextMarker = &v + return s +} + +// SetResourceARN sets the ResourceARN field's value. +func (s *ListTagsForResourceInput) SetResourceARN(v string) *ListTagsForResourceInput { + s.ResourceARN = &v + return s +} + +type ListTagsForResourceOutput struct { + _ struct{} `type:"structure"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + // The collection of tagging definitions for the resource. + TagInfoForResource *TagInfoForResource `type:"structure"` +} + +// String returns the string representation +func (s ListTagsForResourceOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListTagsForResourceOutput) GoString() string { + return s.String() +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListTagsForResourceOutput) SetNextMarker(v string) *ListTagsForResourceOutput { + s.NextMarker = &v + return s +} + +// SetTagInfoForResource sets the TagInfoForResource field's value. +func (s *ListTagsForResourceOutput) SetTagInfoForResource(v *TagInfoForResource) *ListTagsForResourceOutput { + s.TagInfoForResource = v + return s +} + +type ListWebACLsInput struct { + _ struct{} `type:"structure"` + + // The maximum number of objects that you want AWS WAF to return for this request. + // If more objects are available, in the response, AWS WAF provides a NextMarker + // value that you can use in a subsequent call to get the next batch of objects. + Limit *int64 `min:"1" type:"integer"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s ListWebACLsInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListWebACLsInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ListWebACLsInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ListWebACLsInput"} + if s.Limit != nil && *s.Limit < 1 { + invalidParams.Add(request.NewErrParamMinValue("Limit", 1)) + } + if s.NextMarker != nil && len(*s.NextMarker) < 1 { + invalidParams.Add(request.NewErrParamMinLen("NextMarker", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLimit sets the Limit field's value. +func (s *ListWebACLsInput) SetLimit(v int64) *ListWebACLsInput { + s.Limit = &v + return s +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListWebACLsInput) SetNextMarker(v string) *ListWebACLsInput { + s.NextMarker = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *ListWebACLsInput) SetScope(v string) *ListWebACLsInput { + s.Scope = &v + return s +} + +type ListWebACLsOutput struct { + _ struct{} `type:"structure"` + + // When you request a list of objects with a Limit setting, if the number of + // objects that are still available for retrieval exceeds the limit, AWS WAF + // returns a NextMarker value in the response. To retrieve the next batch of + // objects, provide the marker from the prior call in your next request. + NextMarker *string `min:"1" type:"string"` + + WebACLs []*WebACLSummary `type:"list"` +} + +// String returns the string representation +func (s ListWebACLsOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ListWebACLsOutput) GoString() string { + return s.String() +} + +// SetNextMarker sets the NextMarker field's value. +func (s *ListWebACLsOutput) SetNextMarker(v string) *ListWebACLsOutput { + s.NextMarker = &v + return s +} + +// SetWebACLs sets the WebACLs field's value. +func (s *ListWebACLsOutput) SetWebACLs(v []*WebACLSummary) *ListWebACLsOutput { + s.WebACLs = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Defines an association between Amazon Kinesis Data Firehose destinations +// and a web ACL resource, for logging from AWS WAF. As part of the association, +// you can specify parts of the standard logging fields to keep out of the logs. +type LoggingConfiguration struct { + _ struct{} `type:"structure"` + + // The Amazon Kinesis Data Firehose Amazon Resource Name (ARNs) that you want + // to associate with the web ACL. + // + // LogDestinationConfigs is a required field + LogDestinationConfigs []*string `min:"1" type:"list" required:"true"` + + // Indicates whether the logging configuration was created by AWS Firewall Manager, + // as part of an AWS WAF policy configuration. If true, only Firewall Manager + // can modify or delete the configuration. + ManagedByFirewallManager *bool `type:"boolean"` + + // The parts of the request that you want to keep out of the logs. For example, + // if you redact the HEADER field, the HEADER field in the firehose will be + // xxx. + // + // You must use one of the following values: URI, QUERY_STRING, HEADER, or METHOD. + RedactedFields []*FieldToMatch `type:"list"` + + // The Amazon Resource Name (ARN) of the web ACL that you want to associate + // with LogDestinationConfigs. + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s LoggingConfiguration) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s LoggingConfiguration) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *LoggingConfiguration) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "LoggingConfiguration"} + if s.LogDestinationConfigs == nil { + invalidParams.Add(request.NewErrParamRequired("LogDestinationConfigs")) + } + if s.LogDestinationConfigs != nil && len(s.LogDestinationConfigs) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LogDestinationConfigs", 1)) + } + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + if s.RedactedFields != nil { + for i, v := range s.RedactedFields { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "RedactedFields", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLogDestinationConfigs sets the LogDestinationConfigs field's value. +func (s *LoggingConfiguration) SetLogDestinationConfigs(v []*string) *LoggingConfiguration { + s.LogDestinationConfigs = v + return s +} + +// SetManagedByFirewallManager sets the ManagedByFirewallManager field's value. +func (s *LoggingConfiguration) SetManagedByFirewallManager(v bool) *LoggingConfiguration { + s.ManagedByFirewallManager = &v + return s +} + +// SetRedactedFields sets the RedactedFields field's value. +func (s *LoggingConfiguration) SetRedactedFields(v []*FieldToMatch) *LoggingConfiguration { + s.RedactedFields = v + return s +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *LoggingConfiguration) SetResourceArn(v string) *LoggingConfiguration { + s.ResourceArn = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule statement used to run the rules that are defined in a managed rule +// group. To use this, provide the vendor name and the name of the rule group +// in this statement. You can retrieve the required names by calling ListAvailableManagedRuleGroups. +// +// You can't nest a ManagedRuleGroupStatement, for example for use inside a +// NotStatement or OrStatement. It can only be referenced as a top-level statement +// within a rule. +type ManagedRuleGroupStatement struct { + _ struct{} `type:"structure"` + + // The rules whose actions are set to COUNT by the web ACL, regardless of the + // action that is set on the rule. This effectively excludes the rule from acting + // on web requests. + ExcludedRules []*ExcludedRule `type:"list"` + + // The name of the managed rule group. You use this, along with the vendor name, + // to identify the rule group. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The name of the managed rule group vendor. You use this, along with the rule + // group name, to identify the rule group. + // + // VendorName is a required field + VendorName *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s ManagedRuleGroupStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ManagedRuleGroupStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *ManagedRuleGroupStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "ManagedRuleGroupStatement"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.VendorName == nil { + invalidParams.Add(request.NewErrParamRequired("VendorName")) + } + if s.VendorName != nil && len(*s.VendorName) < 1 { + invalidParams.Add(request.NewErrParamMinLen("VendorName", 1)) + } + if s.ExcludedRules != nil { + for i, v := range s.ExcludedRules { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "ExcludedRules", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetExcludedRules sets the ExcludedRules field's value. +func (s *ManagedRuleGroupStatement) SetExcludedRules(v []*ExcludedRule) *ManagedRuleGroupStatement { + s.ExcludedRules = v + return s +} + +// SetName sets the Name field's value. +func (s *ManagedRuleGroupStatement) SetName(v string) *ManagedRuleGroupStatement { + s.Name = &v + return s +} + +// SetVendorName sets the VendorName field's value. +func (s *ManagedRuleGroupStatement) SetVendorName(v string) *ManagedRuleGroupStatement { + s.VendorName = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// High-level information about a managed rule group, returned by ListAvailableManagedRuleGroups. +// This provides information like the name and vendor name, that you provide +// when you add a ManagedRuleGroupStatement to a web ACL. Managed rule groups +// include AWS Managed Rules rule groups, which are free of charge to AWS WAF +// customers, and AWS Marketplace managed rule groups, which you can subscribe +// to through AWS Marketplace. +type ManagedRuleGroupSummary struct { + _ struct{} `type:"structure"` + + // The description of the managed rule group, provided by AWS Managed Rules + // or the AWS Marketplace seller who manages it. + Description *string `min:"1" type:"string"` + + // The name of the managed rule group. You use this, along with the vendor name, + // to identify the rule group. + Name *string `min:"1" type:"string"` + + // The name of the managed rule group vendor. You use this, along with the rule + // group name, to identify the rule group. + VendorName *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s ManagedRuleGroupSummary) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s ManagedRuleGroupSummary) GoString() string { + return s.String() +} + +// SetDescription sets the Description field's value. +func (s *ManagedRuleGroupSummary) SetDescription(v string) *ManagedRuleGroupSummary { + s.Description = &v + return s +} + +// SetName sets the Name field's value. +func (s *ManagedRuleGroupSummary) SetName(v string) *ManagedRuleGroupSummary { + s.Name = &v + return s +} + +// SetVendorName sets the VendorName field's value. +func (s *ManagedRuleGroupSummary) SetVendorName(v string) *ManagedRuleGroupSummary { + s.VendorName = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The HTTP method of a web request. The method indicates the type of operation +// that the request is asking the origin to perform. +// +// This is used only to indicate the web request component for AWS WAF to inspect, +// in the FieldToMatch specification. +type Method struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s Method) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s Method) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Specifies that AWS WAF should do nothing. This is generally used to try out +// a rule without performing any actions. You set the OverrideAction on the +// Rule. +// +// This is used only in the context of other settings, for example to specify +// values for RuleAction and web ACL DefaultAction. +type NoneAction struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s NoneAction) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s NoneAction) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A logical rule statement used to negate the results of another rule statement. +// You provide one Statement within the NotStatement. +type NotStatement struct { + _ struct{} `type:"structure"` + + // The statement to negate. You can use any statement that can be nested. + // + // Statement is a required field + Statement *Statement `type:"structure" required:"true"` +} + +// String returns the string representation +func (s NotStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s NotStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *NotStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "NotStatement"} + if s.Statement == nil { + invalidParams.Add(request.NewErrParamRequired("Statement")) + } + if s.Statement != nil { + if err := s.Statement.Validate(); err != nil { + invalidParams.AddNested("Statement", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetStatement sets the Statement field's value. +func (s *NotStatement) SetStatement(v *Statement) *NotStatement { + s.Statement = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A logical rule statement used to combine other rule statements with OR logic. +// You provide more than one Statement within the OrStatement. +type OrStatement struct { + _ struct{} `type:"structure"` + + // The statements to combine with OR logic. You can use any statements that + // can be nested. + // + // Statements is a required field + Statements []*Statement `type:"list" required:"true"` +} + +// String returns the string representation +func (s OrStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s OrStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *OrStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "OrStatement"} + if s.Statements == nil { + invalidParams.Add(request.NewErrParamRequired("Statements")) + } + if s.Statements != nil { + for i, v := range s.Statements { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Statements", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetStatements sets the Statements field's value. +func (s *OrStatement) SetStatements(v []*Statement) *OrStatement { + s.Statements = v + return s +} + +// The override action to apply to the rules in a rule group. Used only for +// rule statements that reference a rule group, like RuleGroupReferenceStatement +// and ManagedRuleGroupStatement. +// +// Set the override action to none to leave the rule actions in effect. Set +// it to count to only count matches, regardless of the rule action settings. +// +// In a Rule, you must specify either this OverrideAction setting or the rule +// Action setting, but not both: +// +// * If the rule statement references a rule group, use this override action +// setting and not the action setting. +// +// * If the rule statement does not reference a rule group, use the rule +// action setting and not this rule override action setting. +type OverrideAction struct { + _ struct{} `type:"structure"` + + // Override the rule action setting to count. + Count *CountAction `type:"structure"` + + // Don't override the rule action setting. + None *NoneAction `type:"structure"` +} + +// String returns the string representation +func (s OverrideAction) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s OverrideAction) GoString() string { + return s.String() +} + +// SetCount sets the Count field's value. +func (s *OverrideAction) SetCount(v *CountAction) *OverrideAction { + s.Count = v + return s +} + +// SetNone sets the None field's value. +func (s *OverrideAction) SetNone(v *NoneAction) *OverrideAction { + s.None = v + return s +} + +type PutLoggingConfigurationInput struct { + _ struct{} `type:"structure"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // Defines an association between Amazon Kinesis Data Firehose destinations + // and a web ACL resource, for logging from AWS WAF. As part of the association, + // you can specify parts of the standard logging fields to keep out of the logs. + // + // LoggingConfiguration is a required field + LoggingConfiguration *LoggingConfiguration `type:"structure" required:"true"` +} + +// String returns the string representation +func (s PutLoggingConfigurationInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s PutLoggingConfigurationInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *PutLoggingConfigurationInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "PutLoggingConfigurationInput"} + if s.LoggingConfiguration == nil { + invalidParams.Add(request.NewErrParamRequired("LoggingConfiguration")) + } + if s.LoggingConfiguration != nil { + if err := s.LoggingConfiguration.Validate(); err != nil { + invalidParams.AddNested("LoggingConfiguration", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetLoggingConfiguration sets the LoggingConfiguration field's value. +func (s *PutLoggingConfigurationInput) SetLoggingConfiguration(v *LoggingConfiguration) *PutLoggingConfigurationInput { + s.LoggingConfiguration = v + return s +} + +type PutLoggingConfigurationOutput struct { + _ struct{} `type:"structure"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // Defines an association between Amazon Kinesis Data Firehose destinations + // and a web ACL resource, for logging from AWS WAF. As part of the association, + // you can specify parts of the standard logging fields to keep out of the logs. + LoggingConfiguration *LoggingConfiguration `type:"structure"` +} + +// String returns the string representation +func (s PutLoggingConfigurationOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s PutLoggingConfigurationOutput) GoString() string { + return s.String() +} + +// SetLoggingConfiguration sets the LoggingConfiguration field's value. +func (s *PutLoggingConfigurationOutput) SetLoggingConfiguration(v *LoggingConfiguration) *PutLoggingConfigurationOutput { + s.LoggingConfiguration = v + return s +} + +type PutPermissionPolicyInput struct { + _ struct{} `type:"structure"` + + // The policy to attach to the specified rule group. + // + // The policy specifications must conform to the following: + // + // * The policy must be composed using IAM Policy version 2012-10-17 or version + // 2015-01-01. + // + // * The policy must include specifications for Effect, Action, and Principal. + // + // * Effect must specify Allow. + // + // * Action must specify wafv2:CreateWebACL, wafv2:UpdateWebACL, and wafv2:PutFirewallManagerRuleGroups. + // AWS WAF rejects any extra actions or wildcard actions in the policy. + // + // * The policy must not include a Resource parameter. + // + // For more information, see IAM Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html). + // + // Policy is a required field + Policy *string `min:"1" type:"string" required:"true"` + + // The Amazon Resource Name (ARN) of the RuleGroup to which you want to attach + // the policy. + // + // ResourceArn is a required field + ResourceArn *string `min:"20" type:"string" required:"true"` +} + +// String returns the string representation +func (s PutPermissionPolicyInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s PutPermissionPolicyInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *PutPermissionPolicyInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "PutPermissionPolicyInput"} + if s.Policy == nil { + invalidParams.Add(request.NewErrParamRequired("Policy")) + } + if s.Policy != nil && len(*s.Policy) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Policy", 1)) + } + if s.ResourceArn == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceArn")) + } + if s.ResourceArn != nil && len(*s.ResourceArn) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceArn", 20)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetPolicy sets the Policy field's value. +func (s *PutPermissionPolicyInput) SetPolicy(v string) *PutPermissionPolicyInput { + s.Policy = &v + return s +} + +// SetResourceArn sets the ResourceArn field's value. +func (s *PutPermissionPolicyInput) SetResourceArn(v string) *PutPermissionPolicyInput { + s.ResourceArn = &v + return s +} + +type PutPermissionPolicyOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s PutPermissionPolicyOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s PutPermissionPolicyOutput) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The query string of a web request. This is the part of a URL that appears +// after a ? character, if any. +// +// This is used only to indicate the web request component for AWS WAF to inspect, +// in the FieldToMatch specification. +type QueryString struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s QueryString) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s QueryString) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rate-based rule tracks the rate of requests for each originating IP address, +// and triggers the rule action when the rate exceeds a limit that you specify +// on the number of requests in any 5-minute time span. You can use this to +// put a temporary block on requests from an IP address that is sending excessive +// requests. +// +// When the rule action triggers, AWS WAF blocks additional requests from the +// IP address until the request rate falls below the limit. +// +// You can optionally nest another statement inside the rate-based statement, +// to narrow the scope of the rule so that it only counts requests that match +// the nested statement. For example, based on recent requests that you have +// seen from an attacker, you might create a rate-based rule with a nested AND +// rule statement that contains the following nested statements: +// +// * An IP match statement with an IP set that specified the address 192.0.2.44. +// +// * A string match statement that searches in the User-Agent header for +// the string BadBot. +// +// In this rate-based rule, you also define a rate limit. For this example, +// the rate limit is 1,000. Requests that meet both of the conditions in the +// statements are counted. If the count exceeds 1,000 requests per five minutes, +// the rule action triggers. Requests that do not meet both conditions are not +// counted towards the rate limit and are not affected by this rule. +// +// You cannot nest a RateBasedStatement, for example for use inside a NotStatement +// or OrStatement. It can only be referenced as a top-level statement within +// a rule. +type RateBasedStatement struct { + _ struct{} `type:"structure"` + + // Setting that indicates how to aggregate the request counts. The options are + // the following: + // + // * IP - Aggregate the request counts on the IP address from the web request + // origin. + // + // * FORWARDED_IP - Aggregate the request counts on the first IP address + // in an HTTP header. If you use this, configure the ForwardedIPConfig, to + // specify the header to use. + // + // AggregateKeyType is a required field + AggregateKeyType *string `type:"string" required:"true" enum:"RateBasedStatementAggregateKeyType"` + + // The configuration for inspecting IP addresses in an HTTP header that you + // specify, instead of using the IP address that's reported by the web request + // origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify + // any header name. + // + // If the specified header isn't present in the request, AWS WAF doesn't apply + // the rule to the web request at all. + // + // This is required if AggregateKeyType is set to FORWARDED_IP. + ForwardedIPConfig *ForwardedIPConfig `type:"structure"` + + // The limit on requests per 5-minute period for a single originating IP address. + // If the statement includes a ScopeDownStatement, this limit is applied only + // to the requests that match the statement. + // + // Limit is a required field + Limit *int64 `min:"100" type:"long" required:"true"` + + // An optional nested statement that narrows the scope of the rate-based statement + // to matching web requests. This can be any nestable statement, and you can + // nest statements at any level below this scope-down statement. + ScopeDownStatement *Statement `type:"structure"` +} + +// String returns the string representation +func (s RateBasedStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RateBasedStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *RateBasedStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RateBasedStatement"} + if s.AggregateKeyType == nil { + invalidParams.Add(request.NewErrParamRequired("AggregateKeyType")) + } + if s.Limit == nil { + invalidParams.Add(request.NewErrParamRequired("Limit")) + } + if s.Limit != nil && *s.Limit < 100 { + invalidParams.Add(request.NewErrParamMinValue("Limit", 100)) + } + if s.ForwardedIPConfig != nil { + if err := s.ForwardedIPConfig.Validate(); err != nil { + invalidParams.AddNested("ForwardedIPConfig", err.(request.ErrInvalidParams)) + } + } + if s.ScopeDownStatement != nil { + if err := s.ScopeDownStatement.Validate(); err != nil { + invalidParams.AddNested("ScopeDownStatement", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetAggregateKeyType sets the AggregateKeyType field's value. +func (s *RateBasedStatement) SetAggregateKeyType(v string) *RateBasedStatement { + s.AggregateKeyType = &v + return s +} + +// SetForwardedIPConfig sets the ForwardedIPConfig field's value. +func (s *RateBasedStatement) SetForwardedIPConfig(v *ForwardedIPConfig) *RateBasedStatement { + s.ForwardedIPConfig = v + return s +} + +// SetLimit sets the Limit field's value. +func (s *RateBasedStatement) SetLimit(v int64) *RateBasedStatement { + s.Limit = &v + return s +} + +// SetScopeDownStatement sets the ScopeDownStatement field's value. +func (s *RateBasedStatement) SetScopeDownStatement(v *Statement) *RateBasedStatement { + s.ScopeDownStatement = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The set of IP addresses that are currently blocked for a rate-based statement. +type RateBasedStatementManagedKeysIPSet struct { + _ struct{} `type:"structure"` + + // The IP addresses that are currently blocked. + Addresses []*string `type:"list"` + + IPAddressVersion *string `type:"string" enum:"IPAddressVersion"` +} + +// String returns the string representation +func (s RateBasedStatementManagedKeysIPSet) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RateBasedStatementManagedKeysIPSet) GoString() string { + return s.String() +} + +// SetAddresses sets the Addresses field's value. +func (s *RateBasedStatementManagedKeysIPSet) SetAddresses(v []*string) *RateBasedStatementManagedKeysIPSet { + s.Addresses = v + return s +} + +// SetIPAddressVersion sets the IPAddressVersion field's value. +func (s *RateBasedStatementManagedKeysIPSet) SetIPAddressVersion(v string) *RateBasedStatementManagedKeysIPSet { + s.IPAddressVersion = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A single regular expression. This is used in a RegexPatternSet. +type Regex struct { + _ struct{} `type:"structure"` + + // The string representing the regular expression. + RegexString *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s Regex) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s Regex) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *Regex) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "Regex"} + if s.RegexString != nil && len(*s.RegexString) < 1 { + invalidParams.Add(request.NewErrParamMinLen("RegexString", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetRegexString sets the RegexString field's value. +func (s *Regex) SetRegexString(v string) *Regex { + s.RegexString = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Contains one or more regular expressions. +// +// AWS WAF assigns an ARN to each RegexPatternSet that you create. To use a +// set in a rule, you provide the ARN to the Rule statement RegexPatternSetReferenceStatement. +type RegexPatternSet struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + ARN *string `min:"20" type:"string"` + + // A description of the set that helps with identification. You cannot change + // the description of a set after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + Id *string `min:"1" type:"string"` + + // The name of the set. You cannot change the name after you create the set. + Name *string `min:"1" type:"string"` + + // The regular expression patterns in the set. + RegularExpressionList []*Regex `type:"list"` +} + +// String returns the string representation +func (s RegexPatternSet) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RegexPatternSet) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *RegexPatternSet) SetARN(v string) *RegexPatternSet { + s.ARN = &v + return s +} + +// SetDescription sets the Description field's value. +func (s *RegexPatternSet) SetDescription(v string) *RegexPatternSet { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *RegexPatternSet) SetId(v string) *RegexPatternSet { + s.Id = &v + return s +} + +// SetName sets the Name field's value. +func (s *RegexPatternSet) SetName(v string) *RegexPatternSet { + s.Name = &v + return s +} + +// SetRegularExpressionList sets the RegularExpressionList field's value. +func (s *RegexPatternSet) SetRegularExpressionList(v []*Regex) *RegexPatternSet { + s.RegularExpressionList = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule statement used to search web request components for matches with regular +// expressions. To use this, create a RegexPatternSet that specifies the expressions +// that you want to detect, then use the ARN of that set in this statement. +// A web request matches the pattern set rule statement if the request component +// matches any of the patterns in the set. To create a regex pattern set, see +// CreateRegexPatternSet. +// +// Each regex pattern set rule statement references a regex pattern set. You +// create and maintain the set independent of your rules. This allows you to +// use the single set in multiple rules. When you update the referenced set, +// AWS WAF automatically updates all rules that reference it. +type RegexPatternSetReferenceStatement struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the RegexPatternSet that this statement + // references. + // + // ARN is a required field + ARN *string `min:"20" type:"string" required:"true"` + + // The part of a web request that you want AWS WAF to inspect. For more information, + // see FieldToMatch. + // + // FieldToMatch is a required field + FieldToMatch *FieldToMatch `type:"structure" required:"true"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. If you specify one + // or more transformations in a rule statement, AWS WAF performs all transformations + // on the content of the request component identified by FieldToMatch, starting + // from the lowest priority setting, before inspecting the content for a match. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation +func (s RegexPatternSetReferenceStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RegexPatternSetReferenceStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *RegexPatternSetReferenceStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RegexPatternSetReferenceStatement"} + if s.ARN == nil { + invalidParams.Add(request.NewErrParamRequired("ARN")) + } + if s.ARN != nil && len(*s.ARN) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ARN", 20)) + } + if s.FieldToMatch == nil { + invalidParams.Add(request.NewErrParamRequired("FieldToMatch")) + } + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.FieldToMatch != nil { + if err := s.FieldToMatch.Validate(); err != nil { + invalidParams.AddNested("FieldToMatch", err.(request.ErrInvalidParams)) + } + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetARN sets the ARN field's value. +func (s *RegexPatternSetReferenceStatement) SetARN(v string) *RegexPatternSetReferenceStatement { + s.ARN = &v + return s +} + +// SetFieldToMatch sets the FieldToMatch field's value. +func (s *RegexPatternSetReferenceStatement) SetFieldToMatch(v *FieldToMatch) *RegexPatternSetReferenceStatement { + s.FieldToMatch = v + return s +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *RegexPatternSetReferenceStatement) SetTextTransformations(v []*TextTransformation) *RegexPatternSetReferenceStatement { + s.TextTransformations = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// High-level information about a RegexPatternSet, returned by operations like +// create and list. This provides information like the ID, that you can use +// to retrieve and manage a RegexPatternSet, and the ARN, that you provide to +// the RegexPatternSetReferenceStatement to use the pattern set in a Rule. +type RegexPatternSetSummary struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + ARN *string `min:"20" type:"string"` + + // A description of the set that helps with identification. You cannot change + // the description of a set after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + Id *string `min:"1" type:"string"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + LockToken *string `min:"1" type:"string"` + + // The name of the data type instance. You cannot change the name after you + // create the instance. + Name *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s RegexPatternSetSummary) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RegexPatternSetSummary) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *RegexPatternSetSummary) SetARN(v string) *RegexPatternSetSummary { + s.ARN = &v + return s +} + +// SetDescription sets the Description field's value. +func (s *RegexPatternSetSummary) SetDescription(v string) *RegexPatternSetSummary { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *RegexPatternSetSummary) SetId(v string) *RegexPatternSetSummary { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *RegexPatternSetSummary) SetLockToken(v string) *RegexPatternSetSummary { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *RegexPatternSetSummary) SetName(v string) *RegexPatternSetSummary { + s.Name = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A single rule, which you can use in a WebACL or RuleGroup to identify web +// requests that you want to allow, block, or count. Each rule includes one +// top-level Statement that AWS WAF uses to identify matching web requests, +// and parameters that govern how AWS WAF handles them. +type Rule struct { + _ struct{} `type:"structure"` + + // The action that AWS WAF should take on a web request when it matches the + // rule statement. Settings at the web ACL level can override the rule action + // setting. + // + // This is used only for rules whose statements do not reference a rule group. + // Rule statements that reference a rule group include RuleGroupReferenceStatement + // and ManagedRuleGroupStatement. + // + // You must specify either this Action setting or the rule OverrideAction setting, + // but not both: + // + // * If the rule statement does not reference a rule group, use this rule + // action setting and not the rule override action setting. + // + // * If the rule statement references a rule group, use the override action + // setting and not this action setting. + Action *RuleAction `type:"structure"` + + // The name of the rule. You can't change the name of a Rule after you create + // it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The override action to apply to the rules in a rule group. Used only for + // rule statements that reference a rule group, like RuleGroupReferenceStatement + // and ManagedRuleGroupStatement. + // + // Set the override action to none to leave the rule actions in effect. Set + // it to count to only count matches, regardless of the rule action settings. + // + // In a Rule, you must specify either this OverrideAction setting or the rule + // Action setting, but not both: + // + // * If the rule statement references a rule group, use this override action + // setting and not the action setting. + // + // * If the rule statement does not reference a rule group, use the rule + // action setting and not this rule override action setting. + OverrideAction *OverrideAction `type:"structure"` + + // If you define more than one Rule in a WebACL, AWS WAF evaluates each request + // against the Rules in order based on the value of Priority. AWS WAF processes + // rules with lower priority first. The priorities don't need to be consecutive, + // but they must all be different. + // + // Priority is a required field + Priority *int64 `type:"integer" required:"true"` + + // The AWS WAF processing statement for the rule, for example ByteMatchStatement + // or SizeConstraintStatement. + // + // Statement is a required field + Statement *Statement `type:"structure" required:"true"` + + // Defines and enables Amazon CloudWatch metrics and web request sample collection. + // + // VisibilityConfig is a required field + VisibilityConfig *VisibilityConfig `type:"structure" required:"true"` +} + +// String returns the string representation +func (s Rule) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s Rule) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *Rule) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "Rule"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Priority == nil { + invalidParams.Add(request.NewErrParamRequired("Priority")) + } + if s.Statement == nil { + invalidParams.Add(request.NewErrParamRequired("Statement")) + } + if s.VisibilityConfig == nil { + invalidParams.Add(request.NewErrParamRequired("VisibilityConfig")) + } + if s.Statement != nil { + if err := s.Statement.Validate(); err != nil { + invalidParams.AddNested("Statement", err.(request.ErrInvalidParams)) + } + } + if s.VisibilityConfig != nil { + if err := s.VisibilityConfig.Validate(); err != nil { + invalidParams.AddNested("VisibilityConfig", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetAction sets the Action field's value. +func (s *Rule) SetAction(v *RuleAction) *Rule { + s.Action = v + return s +} + +// SetName sets the Name field's value. +func (s *Rule) SetName(v string) *Rule { + s.Name = &v + return s +} + +// SetOverrideAction sets the OverrideAction field's value. +func (s *Rule) SetOverrideAction(v *OverrideAction) *Rule { + s.OverrideAction = v + return s +} + +// SetPriority sets the Priority field's value. +func (s *Rule) SetPriority(v int64) *Rule { + s.Priority = &v + return s +} + +// SetStatement sets the Statement field's value. +func (s *Rule) SetStatement(v *Statement) *Rule { + s.Statement = v + return s +} + +// SetVisibilityConfig sets the VisibilityConfig field's value. +func (s *Rule) SetVisibilityConfig(v *VisibilityConfig) *Rule { + s.VisibilityConfig = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The action that AWS WAF should take on a web request when it matches a rule's +// statement. Settings at the web ACL level can override the rule action setting. +type RuleAction struct { + _ struct{} `type:"structure"` + + // Instructs AWS WAF to allow the web request. + Allow *AllowAction `type:"structure"` + + // Instructs AWS WAF to block the web request. + Block *BlockAction `type:"structure"` + + // Instructs AWS WAF to count the web request and allow it. + Count *CountAction `type:"structure"` +} + +// String returns the string representation +func (s RuleAction) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RuleAction) GoString() string { + return s.String() +} + +// SetAllow sets the Allow field's value. +func (s *RuleAction) SetAllow(v *AllowAction) *RuleAction { + s.Allow = v + return s +} + +// SetBlock sets the Block field's value. +func (s *RuleAction) SetBlock(v *BlockAction) *RuleAction { + s.Block = v + return s +} + +// SetCount sets the Count field's value. +func (s *RuleAction) SetCount(v *CountAction) *RuleAction { + s.Count = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule group defines a collection of rules to inspect and control web requests +// that you can use in a WebACL. When you create a rule group, you define an +// immutable capacity limit. If you update a rule group, you must stay within +// the capacity. This allows others to reuse the rule group with confidence +// in its capacity requirements. +type RuleGroup struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + // + // ARN is a required field + ARN *string `min:"20" type:"string" required:"true"` + + // The web ACL capacity units (WCUs) required for this rule group. + // + // When you create your own rule group, you define this, and you cannot change + // it after creation. When you add or modify the rules in a rule group, AWS + // WAF enforces this limit. You can check the capacity for a set of rules using + // CheckCapacity. + // + // AWS WAF uses WCUs to calculate and control the operating resources that are + // used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity + // differently for each rule type, to reflect the relative cost of each rule. + // Simple rules that cost little to run use fewer WCUs than more complex rules + // that use more processing power. Rule group capacity is fixed at creation, + // which helps users plan their web ACL WCU usage when they use a rule group. + // The WCU limit for web ACLs is 1,500. + // + // Capacity is a required field + Capacity *int64 `min:"1" type:"long" required:"true"` + + // A description of the rule group that helps with identification. You cannot + // change the description of a rule group after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the rule group. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // The name of the rule group. You cannot change the name of a rule group after + // you create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The Rule statements used to identify the web requests that you want to allow, + // block, or count. Each rule includes one top-level statement that AWS WAF + // uses to identify matching web requests, and parameters that govern how AWS + // WAF handles them. + Rules []*Rule `type:"list"` + + // Defines and enables Amazon CloudWatch metrics and web request sample collection. + // + // VisibilityConfig is a required field + VisibilityConfig *VisibilityConfig `type:"structure" required:"true"` +} + +// String returns the string representation +func (s RuleGroup) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RuleGroup) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *RuleGroup) SetARN(v string) *RuleGroup { + s.ARN = &v + return s +} + +// SetCapacity sets the Capacity field's value. +func (s *RuleGroup) SetCapacity(v int64) *RuleGroup { + s.Capacity = &v + return s +} + +// SetDescription sets the Description field's value. +func (s *RuleGroup) SetDescription(v string) *RuleGroup { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *RuleGroup) SetId(v string) *RuleGroup { + s.Id = &v + return s +} + +// SetName sets the Name field's value. +func (s *RuleGroup) SetName(v string) *RuleGroup { + s.Name = &v + return s +} + +// SetRules sets the Rules field's value. +func (s *RuleGroup) SetRules(v []*Rule) *RuleGroup { + s.Rules = v + return s +} + +// SetVisibilityConfig sets the VisibilityConfig field's value. +func (s *RuleGroup) SetVisibilityConfig(v *VisibilityConfig) *RuleGroup { + s.VisibilityConfig = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule statement used to run the rules that are defined in a RuleGroup. To +// use this, create a rule group with your rules, then provide the ARN of the +// rule group in this statement. +// +// You cannot nest a RuleGroupReferenceStatement, for example for use inside +// a NotStatement or OrStatement. It can only be referenced as a top-level statement +// within a rule. +type RuleGroupReferenceStatement struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + // + // ARN is a required field + ARN *string `min:"20" type:"string" required:"true"` + + // The names of rules that are in the referenced rule group, but that you want + // AWS WAF to exclude from processing for this rule statement. + ExcludedRules []*ExcludedRule `type:"list"` +} + +// String returns the string representation +func (s RuleGroupReferenceStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RuleGroupReferenceStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *RuleGroupReferenceStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RuleGroupReferenceStatement"} + if s.ARN == nil { + invalidParams.Add(request.NewErrParamRequired("ARN")) + } + if s.ARN != nil && len(*s.ARN) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ARN", 20)) + } + if s.ExcludedRules != nil { + for i, v := range s.ExcludedRules { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "ExcludedRules", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetARN sets the ARN field's value. +func (s *RuleGroupReferenceStatement) SetARN(v string) *RuleGroupReferenceStatement { + s.ARN = &v + return s +} + +// SetExcludedRules sets the ExcludedRules field's value. +func (s *RuleGroupReferenceStatement) SetExcludedRules(v []*ExcludedRule) *RuleGroupReferenceStatement { + s.ExcludedRules = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// High-level information about a RuleGroup, returned by operations like create +// and list. This provides information like the ID, that you can use to retrieve +// and manage a RuleGroup, and the ARN, that you provide to the RuleGroupReferenceStatement +// to use the rule group in a Rule. +type RuleGroupSummary struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + ARN *string `min:"20" type:"string"` + + // A description of the rule group that helps with identification. You cannot + // change the description of a rule group after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the rule group. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + Id *string `min:"1" type:"string"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + LockToken *string `min:"1" type:"string"` + + // The name of the data type instance. You cannot change the name after you + // create the instance. + Name *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s RuleGroupSummary) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RuleGroupSummary) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *RuleGroupSummary) SetARN(v string) *RuleGroupSummary { + s.ARN = &v + return s +} + +// SetDescription sets the Description field's value. +func (s *RuleGroupSummary) SetDescription(v string) *RuleGroupSummary { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *RuleGroupSummary) SetId(v string) *RuleGroupSummary { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *RuleGroupSummary) SetLockToken(v string) *RuleGroupSummary { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *RuleGroupSummary) SetName(v string) *RuleGroupSummary { + s.Name = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// High-level information about a Rule, returned by operations like DescribeManagedRuleGroup. +// This provides information like the ID, that you can use to retrieve and manage +// a RuleGroup, and the ARN, that you provide to the RuleGroupReferenceStatement +// to use the rule group in a Rule. +type RuleSummary struct { + _ struct{} `type:"structure"` + + // + // This is the latest version of AWS WAF, named AWS WAFV2, released in November, + // 2019. For information, including how to migrate your AWS WAF resources from + // the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). + // + // The action that AWS WAF should take on a web request when it matches a rule's + // statement. Settings at the web ACL level can override the rule action setting. + Action *RuleAction `type:"structure"` + + // The name of the rule. + Name *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s RuleSummary) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s RuleSummary) GoString() string { + return s.String() +} + +// SetAction sets the Action field's value. +func (s *RuleSummary) SetAction(v *RuleAction) *RuleSummary { + s.Action = v + return s +} + +// SetName sets the Name field's value. +func (s *RuleSummary) SetName(v string) *RuleSummary { + s.Name = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Represents a single sampled web request. The response from GetSampledRequests +// includes a SampledHTTPRequests complex type that appears as SampledRequests +// in the response syntax. SampledHTTPRequests contains an array of SampledHTTPRequest +// objects. +type SampledHTTPRequest struct { + _ struct{} `type:"structure"` + + // The action for the Rule that the request matched: ALLOW, BLOCK, or COUNT. + Action *string `type:"string"` + + // A complex type that contains detailed information about the request. + // + // Request is a required field + Request *HTTPRequest `type:"structure" required:"true"` + + // The name of the Rule that the request matched. For managed rule groups, the + // format for this name is ##. + // For your own rule groups, the format for this name is #. If the rule is not in a rule group, this field is absent. + RuleNameWithinRuleGroup *string `min:"1" type:"string"` + + // The time at which AWS WAF received the request from your AWS resource, in + // Unix time format (in seconds). + Timestamp *time.Time `type:"timestamp"` + + // A value that indicates how one result in the response relates proportionally + // to other results in the response. For example, a result that has a weight + // of 2 represents roughly twice as many web requests as a result that has a + // weight of 1. + // + // Weight is a required field + Weight *int64 `type:"long" required:"true"` +} + +// String returns the string representation +func (s SampledHTTPRequest) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s SampledHTTPRequest) GoString() string { + return s.String() +} + +// SetAction sets the Action field's value. +func (s *SampledHTTPRequest) SetAction(v string) *SampledHTTPRequest { + s.Action = &v + return s +} + +// SetRequest sets the Request field's value. +func (s *SampledHTTPRequest) SetRequest(v *HTTPRequest) *SampledHTTPRequest { + s.Request = v + return s +} + +// SetRuleNameWithinRuleGroup sets the RuleNameWithinRuleGroup field's value. +func (s *SampledHTTPRequest) SetRuleNameWithinRuleGroup(v string) *SampledHTTPRequest { + s.RuleNameWithinRuleGroup = &v + return s +} + +// SetTimestamp sets the Timestamp field's value. +func (s *SampledHTTPRequest) SetTimestamp(v time.Time) *SampledHTTPRequest { + s.Timestamp = &v + return s +} + +// SetWeight sets the Weight field's value. +func (s *SampledHTTPRequest) SetWeight(v int64) *SampledHTTPRequest { + s.Weight = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// One of the headers in a web request, identified by name, for example, User-Agent +// or Referer. This setting isn't case sensitive. +// +// This is used only to indicate the web request component for AWS WAF to inspect, +// in the FieldToMatch specification. +type SingleHeader struct { + _ struct{} `type:"structure"` + + // The name of the query header to inspect. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s SingleHeader) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s SingleHeader) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *SingleHeader) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "SingleHeader"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetName sets the Name field's value. +func (s *SingleHeader) SetName(v string) *SingleHeader { + s.Name = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// One query argument in a web request, identified by name, for example UserName +// or SalesRegion. The name can be up to 30 characters long and isn't case sensitive. +type SingleQueryArgument struct { + _ struct{} `type:"structure"` + + // The name of the query argument to inspect. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation +func (s SingleQueryArgument) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s SingleQueryArgument) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *SingleQueryArgument) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "SingleQueryArgument"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetName sets the Name field's value. +func (s *SingleQueryArgument) SetName(v string) *SingleQueryArgument { + s.Name = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule statement that compares a number of bytes against the size of a request +// component, using a comparison operator, such as greater than (>) or less +// than (<). For example, you can use a size constraint statement to look for +// query strings that are longer than 100 bytes. +// +// If you configure AWS WAF to inspect the request body, AWS WAF inspects only +// the first 8192 bytes (8 KB). If the request body for your web requests never +// exceeds 8192 bytes, you can create a size constraint condition and block +// requests that have a request body greater than 8192 bytes. +// +// If you choose URI for the value of Part of the request to filter on, the +// slash (/) in the URI counts as one character. For example, the URI /logo.jpg +// is nine characters long. +type SizeConstraintStatement struct { + _ struct{} `type:"structure"` + + // The operator to use to compare the request part to the size setting. + // + // ComparisonOperator is a required field + ComparisonOperator *string `type:"string" required:"true" enum:"ComparisonOperator"` + + // The part of a web request that you want AWS WAF to inspect. For more information, + // see FieldToMatch. + // + // FieldToMatch is a required field + FieldToMatch *FieldToMatch `type:"structure" required:"true"` + + // The size, in byte, to compare to the request part, after any transformations. + // + // Size is a required field + Size *int64 `type:"long" required:"true"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. If you specify one + // or more transformations in a rule statement, AWS WAF performs all transformations + // on the content of the request component identified by FieldToMatch, starting + // from the lowest priority setting, before inspecting the content for a match. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation +func (s SizeConstraintStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s SizeConstraintStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *SizeConstraintStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "SizeConstraintStatement"} + if s.ComparisonOperator == nil { + invalidParams.Add(request.NewErrParamRequired("ComparisonOperator")) + } + if s.FieldToMatch == nil { + invalidParams.Add(request.NewErrParamRequired("FieldToMatch")) + } + if s.Size == nil { + invalidParams.Add(request.NewErrParamRequired("Size")) + } + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.FieldToMatch != nil { + if err := s.FieldToMatch.Validate(); err != nil { + invalidParams.AddNested("FieldToMatch", err.(request.ErrInvalidParams)) + } + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetComparisonOperator sets the ComparisonOperator field's value. +func (s *SizeConstraintStatement) SetComparisonOperator(v string) *SizeConstraintStatement { + s.ComparisonOperator = &v + return s +} + +// SetFieldToMatch sets the FieldToMatch field's value. +func (s *SizeConstraintStatement) SetFieldToMatch(v *FieldToMatch) *SizeConstraintStatement { + s.FieldToMatch = v + return s +} + +// SetSize sets the Size field's value. +func (s *SizeConstraintStatement) SetSize(v int64) *SizeConstraintStatement { + s.Size = &v + return s +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *SizeConstraintStatement) SetTextTransformations(v []*TextTransformation) *SizeConstraintStatement { + s.TextTransformations = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Attackers sometimes insert malicious SQL code into web requests in an effort +// to extract data from your database. To allow or block web requests that appear +// to contain malicious SQL code, create one or more SQL injection match conditions. +// An SQL injection match condition identifies the part of web requests, such +// as the URI or the query string, that you want AWS WAF to inspect. Later in +// the process, when you create a web ACL, you specify whether to allow or block +// requests that appear to contain malicious SQL code. +type SqliMatchStatement struct { + _ struct{} `type:"structure"` + + // The part of a web request that you want AWS WAF to inspect. For more information, + // see FieldToMatch. + // + // FieldToMatch is a required field + FieldToMatch *FieldToMatch `type:"structure" required:"true"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. If you specify one + // or more transformations in a rule statement, AWS WAF performs all transformations + // on the content of the request component identified by FieldToMatch, starting + // from the lowest priority setting, before inspecting the content for a match. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation +func (s SqliMatchStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s SqliMatchStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *SqliMatchStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "SqliMatchStatement"} + if s.FieldToMatch == nil { + invalidParams.Add(request.NewErrParamRequired("FieldToMatch")) + } + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.FieldToMatch != nil { + if err := s.FieldToMatch.Validate(); err != nil { + invalidParams.AddNested("FieldToMatch", err.(request.ErrInvalidParams)) + } + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetFieldToMatch sets the FieldToMatch field's value. +func (s *SqliMatchStatement) SetFieldToMatch(v *FieldToMatch) *SqliMatchStatement { + s.FieldToMatch = v + return s +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *SqliMatchStatement) SetTextTransformations(v []*TextTransformation) *SqliMatchStatement { + s.TextTransformations = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The processing guidance for a Rule, used by AWS WAF to determine whether +// a web request matches the rule. +type Statement struct { + _ struct{} `type:"structure"` + + // A logical rule statement used to combine other rule statements with AND logic. + // You provide more than one Statement within the AndStatement. + AndStatement *AndStatement `type:"structure"` + + // A rule statement that defines a string match search for AWS WAF to apply + // to web requests. The byte match statement provides the bytes to search for, + // the location in requests that you want AWS WAF to search, and other settings. + // The bytes to search for are typically a string that corresponds with ASCII + // characters. In the AWS WAF console and the developer guide, this is refered + // to as a string match statement. + ByteMatchStatement *ByteMatchStatement `type:"structure"` + + // A rule statement used to identify web requests based on country of origin. + GeoMatchStatement *GeoMatchStatement `type:"structure"` + + // A rule statement used to detect web requests coming from particular IP addresses + // or address ranges. To use this, create an IPSet that specifies the addresses + // you want to detect, then use the ARN of that set in this statement. To create + // an IP set, see CreateIPSet. + // + // Each IP set rule statement references an IP set. You create and maintain + // the set independent of your rules. This allows you to use the single set + // in multiple rules. When you update the referenced set, AWS WAF automatically + // updates all rules that reference it. + IPSetReferenceStatement *IPSetReferenceStatement `type:"structure"` + + // A rule statement used to run the rules that are defined in a managed rule + // group. To use this, provide the vendor name and the name of the rule group + // in this statement. You can retrieve the required names by calling ListAvailableManagedRuleGroups. + // + // You can't nest a ManagedRuleGroupStatement, for example for use inside a + // NotStatement or OrStatement. It can only be referenced as a top-level statement + // within a rule. + ManagedRuleGroupStatement *ManagedRuleGroupStatement `type:"structure"` + + // A logical rule statement used to negate the results of another rule statement. + // You provide one Statement within the NotStatement. + NotStatement *NotStatement `type:"structure"` + + // A logical rule statement used to combine other rule statements with OR logic. + // You provide more than one Statement within the OrStatement. + OrStatement *OrStatement `type:"structure"` + + // A rate-based rule tracks the rate of requests for each originating IP address, + // and triggers the rule action when the rate exceeds a limit that you specify + // on the number of requests in any 5-minute time span. You can use this to + // put a temporary block on requests from an IP address that is sending excessive + // requests. + // + // When the rule action triggers, AWS WAF blocks additional requests from the + // IP address until the request rate falls below the limit. + // + // You can optionally nest another statement inside the rate-based statement, + // to narrow the scope of the rule so that it only counts requests that match + // the nested statement. For example, based on recent requests that you have + // seen from an attacker, you might create a rate-based rule with a nested AND + // rule statement that contains the following nested statements: + // + // * An IP match statement with an IP set that specified the address 192.0.2.44. + // + // * A string match statement that searches in the User-Agent header for + // the string BadBot. + // + // In this rate-based rule, you also define a rate limit. For this example, + // the rate limit is 1,000. Requests that meet both of the conditions in the + // statements are counted. If the count exceeds 1,000 requests per five minutes, + // the rule action triggers. Requests that do not meet both conditions are not + // counted towards the rate limit and are not affected by this rule. + // + // You cannot nest a RateBasedStatement, for example for use inside a NotStatement + // or OrStatement. It can only be referenced as a top-level statement within + // a rule. + RateBasedStatement *RateBasedStatement `type:"structure"` + + // A rule statement used to search web request components for matches with regular + // expressions. To use this, create a RegexPatternSet that specifies the expressions + // that you want to detect, then use the ARN of that set in this statement. + // A web request matches the pattern set rule statement if the request component + // matches any of the patterns in the set. To create a regex pattern set, see + // CreateRegexPatternSet. + // + // Each regex pattern set rule statement references a regex pattern set. You + // create and maintain the set independent of your rules. This allows you to + // use the single set in multiple rules. When you update the referenced set, + // AWS WAF automatically updates all rules that reference it. + RegexPatternSetReferenceStatement *RegexPatternSetReferenceStatement `type:"structure"` + + // A rule statement used to run the rules that are defined in a RuleGroup. To + // use this, create a rule group with your rules, then provide the ARN of the + // rule group in this statement. + // + // You cannot nest a RuleGroupReferenceStatement, for example for use inside + // a NotStatement or OrStatement. It can only be referenced as a top-level statement + // within a rule. + RuleGroupReferenceStatement *RuleGroupReferenceStatement `type:"structure"` + + // A rule statement that compares a number of bytes against the size of a request + // component, using a comparison operator, such as greater than (>) or less + // than (<). For example, you can use a size constraint statement to look for + // query strings that are longer than 100 bytes. + // + // If you configure AWS WAF to inspect the request body, AWS WAF inspects only + // the first 8192 bytes (8 KB). If the request body for your web requests never + // exceeds 8192 bytes, you can create a size constraint condition and block + // requests that have a request body greater than 8192 bytes. + // + // If you choose URI for the value of Part of the request to filter on, the + // slash (/) in the URI counts as one character. For example, the URI /logo.jpg + // is nine characters long. + SizeConstraintStatement *SizeConstraintStatement `type:"structure"` + + // Attackers sometimes insert malicious SQL code into web requests in an effort + // to extract data from your database. To allow or block web requests that appear + // to contain malicious SQL code, create one or more SQL injection match conditions. + // An SQL injection match condition identifies the part of web requests, such + // as the URI or the query string, that you want AWS WAF to inspect. Later in + // the process, when you create a web ACL, you specify whether to allow or block + // requests that appear to contain malicious SQL code. + SqliMatchStatement *SqliMatchStatement `type:"structure"` + + // A rule statement that defines a cross-site scripting (XSS) match search for + // AWS WAF to apply to web requests. XSS attacks are those where the attacker + // uses vulnerabilities in a benign website as a vehicle to inject malicious + // client-site scripts into other legitimate web browsers. The XSS match statement + // provides the location in requests that you want AWS WAF to search and text + // transformations to use on the search area before AWS WAF searches for character + // sequences that are likely to be malicious strings. + XssMatchStatement *XssMatchStatement `type:"structure"` +} + +// String returns the string representation +func (s Statement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s Statement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *Statement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "Statement"} + if s.AndStatement != nil { + if err := s.AndStatement.Validate(); err != nil { + invalidParams.AddNested("AndStatement", err.(request.ErrInvalidParams)) + } + } + if s.ByteMatchStatement != nil { + if err := s.ByteMatchStatement.Validate(); err != nil { + invalidParams.AddNested("ByteMatchStatement", err.(request.ErrInvalidParams)) + } + } + if s.GeoMatchStatement != nil { + if err := s.GeoMatchStatement.Validate(); err != nil { + invalidParams.AddNested("GeoMatchStatement", err.(request.ErrInvalidParams)) + } + } + if s.IPSetReferenceStatement != nil { + if err := s.IPSetReferenceStatement.Validate(); err != nil { + invalidParams.AddNested("IPSetReferenceStatement", err.(request.ErrInvalidParams)) + } + } + if s.ManagedRuleGroupStatement != nil { + if err := s.ManagedRuleGroupStatement.Validate(); err != nil { + invalidParams.AddNested("ManagedRuleGroupStatement", err.(request.ErrInvalidParams)) + } + } + if s.NotStatement != nil { + if err := s.NotStatement.Validate(); err != nil { + invalidParams.AddNested("NotStatement", err.(request.ErrInvalidParams)) + } + } + if s.OrStatement != nil { + if err := s.OrStatement.Validate(); err != nil { + invalidParams.AddNested("OrStatement", err.(request.ErrInvalidParams)) + } + } + if s.RateBasedStatement != nil { + if err := s.RateBasedStatement.Validate(); err != nil { + invalidParams.AddNested("RateBasedStatement", err.(request.ErrInvalidParams)) + } + } + if s.RegexPatternSetReferenceStatement != nil { + if err := s.RegexPatternSetReferenceStatement.Validate(); err != nil { + invalidParams.AddNested("RegexPatternSetReferenceStatement", err.(request.ErrInvalidParams)) + } + } + if s.RuleGroupReferenceStatement != nil { + if err := s.RuleGroupReferenceStatement.Validate(); err != nil { + invalidParams.AddNested("RuleGroupReferenceStatement", err.(request.ErrInvalidParams)) + } + } + if s.SizeConstraintStatement != nil { + if err := s.SizeConstraintStatement.Validate(); err != nil { + invalidParams.AddNested("SizeConstraintStatement", err.(request.ErrInvalidParams)) + } + } + if s.SqliMatchStatement != nil { + if err := s.SqliMatchStatement.Validate(); err != nil { + invalidParams.AddNested("SqliMatchStatement", err.(request.ErrInvalidParams)) + } + } + if s.XssMatchStatement != nil { + if err := s.XssMatchStatement.Validate(); err != nil { + invalidParams.AddNested("XssMatchStatement", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetAndStatement sets the AndStatement field's value. +func (s *Statement) SetAndStatement(v *AndStatement) *Statement { + s.AndStatement = v + return s +} + +// SetByteMatchStatement sets the ByteMatchStatement field's value. +func (s *Statement) SetByteMatchStatement(v *ByteMatchStatement) *Statement { + s.ByteMatchStatement = v + return s +} + +// SetGeoMatchStatement sets the GeoMatchStatement field's value. +func (s *Statement) SetGeoMatchStatement(v *GeoMatchStatement) *Statement { + s.GeoMatchStatement = v + return s +} + +// SetIPSetReferenceStatement sets the IPSetReferenceStatement field's value. +func (s *Statement) SetIPSetReferenceStatement(v *IPSetReferenceStatement) *Statement { + s.IPSetReferenceStatement = v + return s +} + +// SetManagedRuleGroupStatement sets the ManagedRuleGroupStatement field's value. +func (s *Statement) SetManagedRuleGroupStatement(v *ManagedRuleGroupStatement) *Statement { + s.ManagedRuleGroupStatement = v + return s +} + +// SetNotStatement sets the NotStatement field's value. +func (s *Statement) SetNotStatement(v *NotStatement) *Statement { + s.NotStatement = v + return s +} + +// SetOrStatement sets the OrStatement field's value. +func (s *Statement) SetOrStatement(v *OrStatement) *Statement { + s.OrStatement = v + return s +} + +// SetRateBasedStatement sets the RateBasedStatement field's value. +func (s *Statement) SetRateBasedStatement(v *RateBasedStatement) *Statement { + s.RateBasedStatement = v + return s +} + +// SetRegexPatternSetReferenceStatement sets the RegexPatternSetReferenceStatement field's value. +func (s *Statement) SetRegexPatternSetReferenceStatement(v *RegexPatternSetReferenceStatement) *Statement { + s.RegexPatternSetReferenceStatement = v + return s +} + +// SetRuleGroupReferenceStatement sets the RuleGroupReferenceStatement field's value. +func (s *Statement) SetRuleGroupReferenceStatement(v *RuleGroupReferenceStatement) *Statement { + s.RuleGroupReferenceStatement = v + return s +} + +// SetSizeConstraintStatement sets the SizeConstraintStatement field's value. +func (s *Statement) SetSizeConstraintStatement(v *SizeConstraintStatement) *Statement { + s.SizeConstraintStatement = v + return s +} + +// SetSqliMatchStatement sets the SqliMatchStatement field's value. +func (s *Statement) SetSqliMatchStatement(v *SqliMatchStatement) *Statement { + s.SqliMatchStatement = v + return s +} + +// SetXssMatchStatement sets the XssMatchStatement field's value. +func (s *Statement) SetXssMatchStatement(v *XssMatchStatement) *Statement { + s.XssMatchStatement = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A tag associated with an AWS resource. Tags are key:value pairs that you +// can use to categorize and manage your resources, for purposes like billing +// or other management. Typically, the tag key represents a category, such as +// "environment", and the tag value represents a specific value within that +// category, such as "test," "development," or "production". Or you might set +// the tag key to "customer" and the value to the customer name or ID. You can +// specify one or more tags to add to each AWS resource, up to 50 tags for a +// resource. +// +// You can tag the AWS resources that you manage through AWS WAF: web ACLs, +// rule groups, IP sets, and regex pattern sets. You can't manage or view tags +// through the AWS WAF console. +type Tag struct { + _ struct{} `type:"structure"` + + // Part of the key:value pair that defines a tag. You can use a tag key to describe + // a category of information, such as "customer." Tag keys are case-sensitive. + // + // Key is a required field + Key *string `min:"1" type:"string" required:"true"` + + // Part of the key:value pair that defines a tag. You can use a tag value to + // describe a specific value within a category, such as "companyA" or "companyB." + // Tag values are case-sensitive. + // + // Value is a required field + Value *string `type:"string" required:"true"` +} + +// String returns the string representation +func (s Tag) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s Tag) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *Tag) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "Tag"} + if s.Key == nil { + invalidParams.Add(request.NewErrParamRequired("Key")) + } + if s.Key != nil && len(*s.Key) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Key", 1)) + } + if s.Value == nil { + invalidParams.Add(request.NewErrParamRequired("Value")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetKey sets the Key field's value. +func (s *Tag) SetKey(v string) *Tag { + s.Key = &v + return s +} + +// SetValue sets the Value field's value. +func (s *Tag) SetValue(v string) *Tag { + s.Value = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The collection of tagging definitions for an AWS resource. Tags are key:value +// pairs that you can use to categorize and manage your resources, for purposes +// like billing or other management. Typically, the tag key represents a category, +// such as "environment", and the tag value represents a specific value within +// that category, such as "test," "development," or "production". Or you might +// set the tag key to "customer" and the value to the customer name or ID. You +// can specify one or more tags to add to each AWS resource, up to 50 tags for +// a resource. +// +// You can tag the AWS resources that you manage through AWS WAF: web ACLs, +// rule groups, IP sets, and regex pattern sets. You can't manage or view tags +// through the AWS WAF console. +type TagInfoForResource struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the resource. + ResourceARN *string `min:"20" type:"string"` + + // The array of Tag objects defined for the resource. + TagList []*Tag `min:"1" type:"list"` +} + +// String returns the string representation +func (s TagInfoForResource) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s TagInfoForResource) GoString() string { + return s.String() +} + +// SetResourceARN sets the ResourceARN field's value. +func (s *TagInfoForResource) SetResourceARN(v string) *TagInfoForResource { + s.ResourceARN = &v + return s +} + +// SetTagList sets the TagList field's value. +func (s *TagInfoForResource) SetTagList(v []*Tag) *TagInfoForResource { + s.TagList = v + return s +} + +type TagResourceInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the resource. + // + // ResourceARN is a required field + ResourceARN *string `min:"20" type:"string" required:"true"` + + // An array of key:value pairs to associate with the resource. + // + // Tags is a required field + Tags []*Tag `min:"1" type:"list" required:"true"` +} + +// String returns the string representation +func (s TagResourceInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s TagResourceInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *TagResourceInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "TagResourceInput"} + if s.ResourceARN == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceARN")) + } + if s.ResourceARN != nil && len(*s.ResourceARN) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceARN", 20)) + } + if s.Tags == nil { + invalidParams.Add(request.NewErrParamRequired("Tags")) + } + if s.Tags != nil && len(s.Tags) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Tags", 1)) + } + if s.Tags != nil { + for i, v := range s.Tags { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceARN sets the ResourceARN field's value. +func (s *TagResourceInput) SetResourceARN(v string) *TagResourceInput { + s.ResourceARN = &v + return s +} + +// SetTags sets the Tags field's value. +func (s *TagResourceInput) SetTags(v []*Tag) *TagResourceInput { + s.Tags = v + return s +} + +type TagResourceOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s TagResourceOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s TagResourceOutput) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Text transformations eliminate some of the unusual formatting that attackers +// use in web requests in an effort to bypass detection. +type TextTransformation struct { + _ struct{} `type:"structure"` + + // Sets the relative processing order for multiple transformations that are + // defined for a rule statement. AWS WAF processes all transformations, from + // lowest priority to highest, before inspecting the transformed content. The + // priorities don't need to be consecutive, but they must all be different. + // + // Priority is a required field + Priority *int64 `type:"integer" required:"true"` + + // You can specify the following transformation types: + // + // CMD_LINE + // + // When you're concerned that attackers are injecting an operating system command + // line command and using unusual formatting to disguise some or all of the + // command, use this option to perform the following transformations: + // + // * Delete the following characters: \ " ' ^ + // + // * Delete spaces before the following characters: / ( + // + // * Replace the following characters with a space: , ; + // + // * Replace multiple spaces with one space + // + // * Convert uppercase letters (A-Z) to lowercase (a-z) + // + // COMPRESS_WHITE_SPACE + // + // Use this option to replace the following characters with a space character + // (decimal 32): + // + // * \f, formfeed, decimal 12 + // + // * \t, tab, decimal 9 + // + // * \n, newline, decimal 10 + // + // * \r, carriage return, decimal 13 + // + // * \v, vertical tab, decimal 11 + // + // * non-breaking space, decimal 160 + // + // COMPRESS_WHITE_SPACE also replaces multiple spaces with one space. + // + // HTML_ENTITY_DECODE + // + // Use this option to replace HTML-encoded characters with unencoded characters. + // HTML_ENTITY_DECODE performs the following operations: + // + // * Replaces (ampersand)quot; with " + // + // * Replaces (ampersand)nbsp; with a non-breaking space, decimal 160 + // + // * Replaces (ampersand)lt; with a "less than" symbol + // + // * Replaces (ampersand)gt; with > + // + // * Replaces characters that are represented in hexadecimal format, (ampersand)#xhhhh;, + // with the corresponding characters + // + // * Replaces characters that are represented in decimal format, (ampersand)#nnnn;, + // with the corresponding characters + // + // LOWERCASE + // + // Use this option to convert uppercase letters (A-Z) to lowercase (a-z). + // + // URL_DECODE + // + // Use this option to decode a URL-encoded value. + // + // NONE + // + // Specify NONE if you don't want any text transformations. + // + // Type is a required field + Type *string `type:"string" required:"true" enum:"TextTransformationType"` +} + +// String returns the string representation +func (s TextTransformation) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s TextTransformation) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *TextTransformation) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "TextTransformation"} + if s.Priority == nil { + invalidParams.Add(request.NewErrParamRequired("Priority")) + } + if s.Type == nil { + invalidParams.Add(request.NewErrParamRequired("Type")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetPriority sets the Priority field's value. +func (s *TextTransformation) SetPriority(v int64) *TextTransformation { + s.Priority = &v + return s +} + +// SetType sets the Type field's value. +func (s *TextTransformation) SetType(v string) *TextTransformation { + s.Type = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// In a GetSampledRequests request, the StartTime and EndTime objects specify +// the time range for which you want AWS WAF to return a sample of web requests. +// +// You must specify the times in Coordinated Universal Time (UTC) format. UTC +// format includes the special designator, Z. For example, "2016-09-27T14:50Z". +// You can specify any time range in the previous three hours. +// +// In a GetSampledRequests response, the StartTime and EndTime objects specify +// the time range for which AWS WAF actually returned a sample of web requests. +// AWS WAF gets the specified number of requests from among the first 5,000 +// requests that your AWS resource receives during the specified time period. +// If your resource receives more than 5,000 requests during that period, AWS +// WAF stops sampling after the 5,000th request. In that case, EndTime is the +// time that AWS WAF received the 5,000th request. +type TimeWindow struct { + _ struct{} `type:"structure"` + + // The end of the time range from which you want GetSampledRequests to return + // a sample of the requests that your AWS resource received. You must specify + // the times in Coordinated Universal Time (UTC) format. UTC format includes + // the special designator, Z. For example, "2016-09-27T14:50Z". You can specify + // any time range in the previous three hours. + // + // EndTime is a required field + EndTime *time.Time `type:"timestamp" required:"true"` + + // The beginning of the time range from which you want GetSampledRequests to + // return a sample of the requests that your AWS resource received. You must + // specify the times in Coordinated Universal Time (UTC) format. UTC format + // includes the special designator, Z. For example, "2016-09-27T14:50Z". You + // can specify any time range in the previous three hours. + // + // StartTime is a required field + StartTime *time.Time `type:"timestamp" required:"true"` +} + +// String returns the string representation +func (s TimeWindow) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s TimeWindow) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *TimeWindow) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "TimeWindow"} + if s.EndTime == nil { + invalidParams.Add(request.NewErrParamRequired("EndTime")) + } + if s.StartTime == nil { + invalidParams.Add(request.NewErrParamRequired("StartTime")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetEndTime sets the EndTime field's value. +func (s *TimeWindow) SetEndTime(v time.Time) *TimeWindow { + s.EndTime = &v + return s +} + +// SetStartTime sets the StartTime field's value. +func (s *TimeWindow) SetStartTime(v time.Time) *TimeWindow { + s.StartTime = &v + return s +} + +type UntagResourceInput struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the resource. + // + // ResourceARN is a required field + ResourceARN *string `min:"20" type:"string" required:"true"` + + // An array of keys identifying the tags to disassociate from the resource. + // + // TagKeys is a required field + TagKeys []*string `min:"1" type:"list" required:"true"` +} + +// String returns the string representation +func (s UntagResourceInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UntagResourceInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *UntagResourceInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "UntagResourceInput"} + if s.ResourceARN == nil { + invalidParams.Add(request.NewErrParamRequired("ResourceARN")) + } + if s.ResourceARN != nil && len(*s.ResourceARN) < 20 { + invalidParams.Add(request.NewErrParamMinLen("ResourceARN", 20)) + } + if s.TagKeys == nil { + invalidParams.Add(request.NewErrParamRequired("TagKeys")) + } + if s.TagKeys != nil && len(s.TagKeys) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TagKeys", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetResourceARN sets the ResourceARN field's value. +func (s *UntagResourceInput) SetResourceARN(v string) *UntagResourceInput { + s.ResourceARN = &v + return s +} + +// SetTagKeys sets the TagKeys field's value. +func (s *UntagResourceInput) SetTagKeys(v []*string) *UntagResourceInput { + s.TagKeys = v + return s +} + +type UntagResourceOutput struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s UntagResourceOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UntagResourceOutput) GoString() string { + return s.String() +} + +type UpdateIPSetInput struct { + _ struct{} `type:"structure"` + + // Contains an array of strings that specify one or more IP addresses or blocks + // of IP addresses in Classless Inter-Domain Routing (CIDR) notation. AWS WAF + // supports all address ranges for IP versions IPv4 and IPv6. + // + // Examples: + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from the IP address 192.0.2.44, specify 192.0.2.44/32. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128. + // + // * To configure AWS WAF to allow, block, or count requests that originated + // from IP addresses 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, + // specify 1111:0000:0000:0000:0000:0000:0000:0000/64. + // + // For more information about CIDR notation, see the Wikipedia entry Classless + // Inter-Domain Routing (https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). + // + // Addresses is a required field + Addresses []*string `type:"list" required:"true"` + + // A description of the IP set that helps with identification. You cannot change + // the description of an IP set after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // LockToken is a required field + LockToken *string `min:"1" type:"string" required:"true"` + + // The name of the IP set. You cannot change the name of an IPSet after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s UpdateIPSetInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UpdateIPSetInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *UpdateIPSetInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "UpdateIPSetInput"} + if s.Addresses == nil { + invalidParams.Add(request.NewErrParamRequired("Addresses")) + } + if s.Description != nil && len(*s.Description) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Description", 1)) + } + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.LockToken == nil { + invalidParams.Add(request.NewErrParamRequired("LockToken")) + } + if s.LockToken != nil && len(*s.LockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LockToken", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetAddresses sets the Addresses field's value. +func (s *UpdateIPSetInput) SetAddresses(v []*string) *UpdateIPSetInput { + s.Addresses = v + return s +} + +// SetDescription sets the Description field's value. +func (s *UpdateIPSetInput) SetDescription(v string) *UpdateIPSetInput { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *UpdateIPSetInput) SetId(v string) *UpdateIPSetInput { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *UpdateIPSetInput) SetLockToken(v string) *UpdateIPSetInput { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *UpdateIPSetInput) SetName(v string) *UpdateIPSetInput { + s.Name = &v + return s +} + +// SetScope sets the Scope field's value. +func (s *UpdateIPSetInput) SetScope(v string) *UpdateIPSetInput { + s.Scope = &v + return s +} + +type UpdateIPSetOutput struct { + _ struct{} `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns this token to your update + // requests. You use NextLockToken in the same manner as you use LockToken. + NextLockToken *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s UpdateIPSetOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UpdateIPSetOutput) GoString() string { + return s.String() +} + +// SetNextLockToken sets the NextLockToken field's value. +func (s *UpdateIPSetOutput) SetNextLockToken(v string) *UpdateIPSetOutput { + s.NextLockToken = &v + return s +} + +type UpdateRegexPatternSetInput struct { + _ struct{} `type:"structure"` + + // A description of the set that helps with identification. You cannot change + // the description of a set after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // LockToken is a required field + LockToken *string `min:"1" type:"string" required:"true"` + + // The name of the set. You cannot change the name after you create the set. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // RegularExpressionList is a required field + RegularExpressionList []*Regex `type:"list" required:"true"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` +} + +// String returns the string representation +func (s UpdateRegexPatternSetInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UpdateRegexPatternSetInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *UpdateRegexPatternSetInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "UpdateRegexPatternSetInput"} + if s.Description != nil && len(*s.Description) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Description", 1)) + } + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.LockToken == nil { + invalidParams.Add(request.NewErrParamRequired("LockToken")) + } + if s.LockToken != nil && len(*s.LockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LockToken", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.RegularExpressionList == nil { + invalidParams.Add(request.NewErrParamRequired("RegularExpressionList")) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.RegularExpressionList != nil { + for i, v := range s.RegularExpressionList { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "RegularExpressionList", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetDescription sets the Description field's value. +func (s *UpdateRegexPatternSetInput) SetDescription(v string) *UpdateRegexPatternSetInput { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *UpdateRegexPatternSetInput) SetId(v string) *UpdateRegexPatternSetInput { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *UpdateRegexPatternSetInput) SetLockToken(v string) *UpdateRegexPatternSetInput { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *UpdateRegexPatternSetInput) SetName(v string) *UpdateRegexPatternSetInput { + s.Name = &v + return s +} + +// SetRegularExpressionList sets the RegularExpressionList field's value. +func (s *UpdateRegexPatternSetInput) SetRegularExpressionList(v []*Regex) *UpdateRegexPatternSetInput { + s.RegularExpressionList = v + return s +} + +// SetScope sets the Scope field's value. +func (s *UpdateRegexPatternSetInput) SetScope(v string) *UpdateRegexPatternSetInput { + s.Scope = &v + return s +} + +type UpdateRegexPatternSetOutput struct { + _ struct{} `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns this token to your update + // requests. You use NextLockToken in the same manner as you use LockToken. + NextLockToken *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s UpdateRegexPatternSetOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UpdateRegexPatternSetOutput) GoString() string { + return s.String() +} + +// SetNextLockToken sets the NextLockToken field's value. +func (s *UpdateRegexPatternSetOutput) SetNextLockToken(v string) *UpdateRegexPatternSetOutput { + s.NextLockToken = &v + return s +} + +type UpdateRuleGroupInput struct { + _ struct{} `type:"structure"` + + // A description of the rule group that helps with identification. You cannot + // change the description of a rule group after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the rule group. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // LockToken is a required field + LockToken *string `min:"1" type:"string" required:"true"` + + // The name of the rule group. You cannot change the name of a rule group after + // you create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The Rule statements used to identify the web requests that you want to allow, + // block, or count. Each rule includes one top-level statement that AWS WAF + // uses to identify matching web requests, and parameters that govern how AWS + // WAF handles them. + Rules []*Rule `type:"list"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // Defines and enables Amazon CloudWatch metrics and web request sample collection. + // + // VisibilityConfig is a required field + VisibilityConfig *VisibilityConfig `type:"structure" required:"true"` +} + +// String returns the string representation +func (s UpdateRuleGroupInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UpdateRuleGroupInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *UpdateRuleGroupInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "UpdateRuleGroupInput"} + if s.Description != nil && len(*s.Description) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Description", 1)) + } + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.LockToken == nil { + invalidParams.Add(request.NewErrParamRequired("LockToken")) + } + if s.LockToken != nil && len(*s.LockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LockToken", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.VisibilityConfig == nil { + invalidParams.Add(request.NewErrParamRequired("VisibilityConfig")) + } + if s.Rules != nil { + for i, v := range s.Rules { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Rules", i), err.(request.ErrInvalidParams)) + } + } + } + if s.VisibilityConfig != nil { + if err := s.VisibilityConfig.Validate(); err != nil { + invalidParams.AddNested("VisibilityConfig", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetDescription sets the Description field's value. +func (s *UpdateRuleGroupInput) SetDescription(v string) *UpdateRuleGroupInput { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *UpdateRuleGroupInput) SetId(v string) *UpdateRuleGroupInput { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *UpdateRuleGroupInput) SetLockToken(v string) *UpdateRuleGroupInput { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *UpdateRuleGroupInput) SetName(v string) *UpdateRuleGroupInput { + s.Name = &v + return s +} + +// SetRules sets the Rules field's value. +func (s *UpdateRuleGroupInput) SetRules(v []*Rule) *UpdateRuleGroupInput { + s.Rules = v + return s +} + +// SetScope sets the Scope field's value. +func (s *UpdateRuleGroupInput) SetScope(v string) *UpdateRuleGroupInput { + s.Scope = &v + return s +} + +// SetVisibilityConfig sets the VisibilityConfig field's value. +func (s *UpdateRuleGroupInput) SetVisibilityConfig(v *VisibilityConfig) *UpdateRuleGroupInput { + s.VisibilityConfig = v + return s +} + +type UpdateRuleGroupOutput struct { + _ struct{} `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns this token to your update + // requests. You use NextLockToken in the same manner as you use LockToken. + NextLockToken *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s UpdateRuleGroupOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UpdateRuleGroupOutput) GoString() string { + return s.String() +} + +// SetNextLockToken sets the NextLockToken field's value. +func (s *UpdateRuleGroupOutput) SetNextLockToken(v string) *UpdateRuleGroupOutput { + s.NextLockToken = &v + return s +} + +type UpdateWebACLInput struct { + _ struct{} `type:"structure"` + + // The action to perform if none of the Rules contained in the WebACL match. + // + // DefaultAction is a required field + DefaultAction *DefaultAction `type:"structure" required:"true"` + + // A description of the Web ACL that helps with identification. You cannot change + // the description of a Web ACL after you create it. + Description *string `min:"1" type:"string"` + + // The unique identifier for the Web ACL. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + // + // LockToken is a required field + LockToken *string `min:"1" type:"string" required:"true"` + + // The name of the Web ACL. You cannot change the name of a Web ACL after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The Rule statements used to identify the web requests that you want to allow, + // block, or count. Each rule includes one top-level statement that AWS WAF + // uses to identify matching web requests, and parameters that govern how AWS + // WAF handles them. + Rules []*Rule `type:"list"` + + // Specifies whether this is for an AWS CloudFront distribution or for a regional + // application. A regional application can be an Application Load Balancer (ALB), + // an API Gateway REST API, or an AppSync GraphQL API. + // + // To work with CloudFront, you must also specify the Region US East (N. Virginia) + // as follows: + // + // * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT + // --region=us-east-1. + // + // * API and SDKs - For all calls, use the Region endpoint us-east-1. + // + // Scope is a required field + Scope *string `type:"string" required:"true" enum:"Scope"` + + // Defines and enables Amazon CloudWatch metrics and web request sample collection. + // + // VisibilityConfig is a required field + VisibilityConfig *VisibilityConfig `type:"structure" required:"true"` +} + +// String returns the string representation +func (s UpdateWebACLInput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UpdateWebACLInput) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *UpdateWebACLInput) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "UpdateWebACLInput"} + if s.DefaultAction == nil { + invalidParams.Add(request.NewErrParamRequired("DefaultAction")) + } + if s.Description != nil && len(*s.Description) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Description", 1)) + } + if s.Id == nil { + invalidParams.Add(request.NewErrParamRequired("Id")) + } + if s.Id != nil && len(*s.Id) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Id", 1)) + } + if s.LockToken == nil { + invalidParams.Add(request.NewErrParamRequired("LockToken")) + } + if s.LockToken != nil && len(*s.LockToken) < 1 { + invalidParams.Add(request.NewErrParamMinLen("LockToken", 1)) + } + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.Scope == nil { + invalidParams.Add(request.NewErrParamRequired("Scope")) + } + if s.VisibilityConfig == nil { + invalidParams.Add(request.NewErrParamRequired("VisibilityConfig")) + } + if s.Rules != nil { + for i, v := range s.Rules { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Rules", i), err.(request.ErrInvalidParams)) + } + } + } + if s.VisibilityConfig != nil { + if err := s.VisibilityConfig.Validate(); err != nil { + invalidParams.AddNested("VisibilityConfig", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetDefaultAction sets the DefaultAction field's value. +func (s *UpdateWebACLInput) SetDefaultAction(v *DefaultAction) *UpdateWebACLInput { + s.DefaultAction = v + return s +} + +// SetDescription sets the Description field's value. +func (s *UpdateWebACLInput) SetDescription(v string) *UpdateWebACLInput { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *UpdateWebACLInput) SetId(v string) *UpdateWebACLInput { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *UpdateWebACLInput) SetLockToken(v string) *UpdateWebACLInput { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *UpdateWebACLInput) SetName(v string) *UpdateWebACLInput { + s.Name = &v + return s +} + +// SetRules sets the Rules field's value. +func (s *UpdateWebACLInput) SetRules(v []*Rule) *UpdateWebACLInput { + s.Rules = v + return s +} + +// SetScope sets the Scope field's value. +func (s *UpdateWebACLInput) SetScope(v string) *UpdateWebACLInput { + s.Scope = &v + return s +} + +// SetVisibilityConfig sets the VisibilityConfig field's value. +func (s *UpdateWebACLInput) SetVisibilityConfig(v *VisibilityConfig) *UpdateWebACLInput { + s.VisibilityConfig = v + return s +} + +type UpdateWebACLOutput struct { + _ struct{} `type:"structure"` + + // A token used for optimistic locking. AWS WAF returns this token to your update + // requests. You use NextLockToken in the same manner as you use LockToken. + NextLockToken *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s UpdateWebACLOutput) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UpdateWebACLOutput) GoString() string { + return s.String() +} + +// SetNextLockToken sets the NextLockToken field's value. +func (s *UpdateWebACLOutput) SetNextLockToken(v string) *UpdateWebACLOutput { + s.NextLockToken = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// The path component of the URI of a web request. This is the part of a web +// request that identifies a resource, for example, /images/daily-ad.jpg. +// +// This is used only to indicate the web request component for AWS WAF to inspect, +// in the FieldToMatch specification. +type UriPath struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation +func (s UriPath) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s UriPath) GoString() string { + return s.String() +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// Defines and enables Amazon CloudWatch metrics and web request sample collection. +type VisibilityConfig struct { + _ struct{} `type:"structure"` + + // A boolean indicating whether the associated resource sends metrics to CloudWatch. + // For the list of available metrics, see AWS WAF Metrics (https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html#waf-metrics). + // + // CloudWatchMetricsEnabled is a required field + CloudWatchMetricsEnabled *bool `type:"boolean" required:"true"` + + // A name of the CloudWatch metric. The name can contain only the characters: + // A-Z, a-z, 0-9, - (hyphen), and _ (underscore). The name can be from one to + // 128 characters long. It can't contain whitespace or metric names reserved + // for AWS WAF, for example "All" and "Default_Action." + // + // MetricName is a required field + MetricName *string `min:"1" type:"string" required:"true"` + + // A boolean indicating whether AWS WAF should store a sampling of the web requests + // that match the rules. You can view the sampled requests through the AWS WAF + // console. + // + // SampledRequestsEnabled is a required field + SampledRequestsEnabled *bool `type:"boolean" required:"true"` +} + +// String returns the string representation +func (s VisibilityConfig) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s VisibilityConfig) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *VisibilityConfig) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "VisibilityConfig"} + if s.CloudWatchMetricsEnabled == nil { + invalidParams.Add(request.NewErrParamRequired("CloudWatchMetricsEnabled")) + } + if s.MetricName == nil { + invalidParams.Add(request.NewErrParamRequired("MetricName")) + } + if s.MetricName != nil && len(*s.MetricName) < 1 { + invalidParams.Add(request.NewErrParamMinLen("MetricName", 1)) + } + if s.SampledRequestsEnabled == nil { + invalidParams.Add(request.NewErrParamRequired("SampledRequestsEnabled")) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetCloudWatchMetricsEnabled sets the CloudWatchMetricsEnabled field's value. +func (s *VisibilityConfig) SetCloudWatchMetricsEnabled(v bool) *VisibilityConfig { + s.CloudWatchMetricsEnabled = &v + return s +} + +// SetMetricName sets the MetricName field's value. +func (s *VisibilityConfig) SetMetricName(v string) *VisibilityConfig { + s.MetricName = &v + return s +} + +// SetSampledRequestsEnabled sets the SampledRequestsEnabled field's value. +func (s *VisibilityConfig) SetSampledRequestsEnabled(v bool) *VisibilityConfig { + s.SampledRequestsEnabled = &v + return s +} + +// AWS WAF couldn’t perform the operation because your resource is being used +// by another resource or it’s associated with another resource. +type WAFAssociatedItemException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFAssociatedItemException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFAssociatedItemException) GoString() string { + return s.String() +} + +func newErrorWAFAssociatedItemException(v protocol.ResponseMetadata) error { + return &WAFAssociatedItemException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFAssociatedItemException) Code() string { + return "WAFAssociatedItemException" +} + +// Message returns the exception's message. +func (s *WAFAssociatedItemException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFAssociatedItemException) OrigErr() error { + return nil +} + +func (s *WAFAssociatedItemException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFAssociatedItemException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFAssociatedItemException) RequestID() string { + return s.RespMetadata.RequestID +} + +// AWS WAF couldn’t perform the operation because the resource that you tried +// to save is a duplicate of an existing one. +type WAFDuplicateItemException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFDuplicateItemException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFDuplicateItemException) GoString() string { + return s.String() +} + +func newErrorWAFDuplicateItemException(v protocol.ResponseMetadata) error { + return &WAFDuplicateItemException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFDuplicateItemException) Code() string { + return "WAFDuplicateItemException" +} + +// Message returns the exception's message. +func (s *WAFDuplicateItemException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFDuplicateItemException) OrigErr() error { + return nil +} + +func (s *WAFDuplicateItemException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFDuplicateItemException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFDuplicateItemException) RequestID() string { + return s.RespMetadata.RequestID +} + +// Your request is valid, but AWS WAF couldn’t perform the operation because +// of a system problem. Retry your request. +type WAFInternalErrorException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFInternalErrorException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFInternalErrorException) GoString() string { + return s.String() +} + +func newErrorWAFInternalErrorException(v protocol.ResponseMetadata) error { + return &WAFInternalErrorException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFInternalErrorException) Code() string { + return "WAFInternalErrorException" +} + +// Message returns the exception's message. +func (s *WAFInternalErrorException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFInternalErrorException) OrigErr() error { + return nil +} + +func (s *WAFInternalErrorException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFInternalErrorException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFInternalErrorException) RequestID() string { + return s.RespMetadata.RequestID +} + +// The operation isn't valid. +type WAFInvalidOperationException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFInvalidOperationException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFInvalidOperationException) GoString() string { + return s.String() +} + +func newErrorWAFInvalidOperationException(v protocol.ResponseMetadata) error { + return &WAFInvalidOperationException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFInvalidOperationException) Code() string { + return "WAFInvalidOperationException" +} + +// Message returns the exception's message. +func (s *WAFInvalidOperationException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFInvalidOperationException) OrigErr() error { + return nil +} + +func (s *WAFInvalidOperationException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFInvalidOperationException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFInvalidOperationException) RequestID() string { + return s.RespMetadata.RequestID +} + +// The operation failed because AWS WAF didn't recognize a parameter in the +// request. For example: +// +// * You specified an invalid parameter name or value. +// +// * Your nested statement isn't valid. You might have tried to nest a statement +// that can’t be nested. +// +// * You tried to update a WebACL with a DefaultAction that isn't among the +// types available at DefaultAction. +// +// * Your request references an ARN that is malformed, or corresponds to +// a resource with which a Web ACL cannot be associated. +type WAFInvalidParameterException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Field *string `type:"string" enum:"ParameterExceptionField"` + + Message_ *string `locationName:"message" type:"string"` + + Parameter *string `min:"1" type:"string"` + + Reason *string `type:"string"` +} + +// String returns the string representation +func (s WAFInvalidParameterException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFInvalidParameterException) GoString() string { + return s.String() +} + +func newErrorWAFInvalidParameterException(v protocol.ResponseMetadata) error { + return &WAFInvalidParameterException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFInvalidParameterException) Code() string { + return "WAFInvalidParameterException" +} + +// Message returns the exception's message. +func (s *WAFInvalidParameterException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFInvalidParameterException) OrigErr() error { + return nil +} + +func (s *WAFInvalidParameterException) Error() string { + return fmt.Sprintf("%s: %s\n%s", s.Code(), s.Message(), s.String()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFInvalidParameterException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFInvalidParameterException) RequestID() string { + return s.RespMetadata.RequestID +} + +// The operation failed because the specified policy isn't in the proper format. +// +// The policy specifications must conform to the following: +// +// * The policy must be composed using IAM Policy version 2012-10-17 or version +// 2015-01-01. +// +// * The policy must include specifications for Effect, Action, and Principal. +// +// * Effect must specify Allow. +// +// * Action must specify wafv2:CreateWebACL, wafv2:UpdateWebACL, and wafv2:PutFirewallManagerRuleGroups. +// AWS WAF rejects any extra actions or wildcard actions in the policy. +// +// * The policy must not include a Resource parameter. +// +// For more information, see IAM Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html). +type WAFInvalidPermissionPolicyException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFInvalidPermissionPolicyException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFInvalidPermissionPolicyException) GoString() string { + return s.String() +} + +func newErrorWAFInvalidPermissionPolicyException(v protocol.ResponseMetadata) error { + return &WAFInvalidPermissionPolicyException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFInvalidPermissionPolicyException) Code() string { + return "WAFInvalidPermissionPolicyException" +} + +// Message returns the exception's message. +func (s *WAFInvalidPermissionPolicyException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFInvalidPermissionPolicyException) OrigErr() error { + return nil +} + +func (s *WAFInvalidPermissionPolicyException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFInvalidPermissionPolicyException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFInvalidPermissionPolicyException) RequestID() string { + return s.RespMetadata.RequestID +} + +// AWS WAF couldn’t perform the operation because the resource that you requested +// isn’t valid. Check the resource, and try again. +type WAFInvalidResourceException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFInvalidResourceException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFInvalidResourceException) GoString() string { + return s.String() +} + +func newErrorWAFInvalidResourceException(v protocol.ResponseMetadata) error { + return &WAFInvalidResourceException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFInvalidResourceException) Code() string { + return "WAFInvalidResourceException" +} + +// Message returns the exception's message. +func (s *WAFInvalidResourceException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFInvalidResourceException) OrigErr() error { + return nil +} + +func (s *WAFInvalidResourceException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFInvalidResourceException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFInvalidResourceException) RequestID() string { + return s.RespMetadata.RequestID +} + +// AWS WAF couldn’t perform the operation because you exceeded your resource +// limit. For example, the maximum number of WebACL objects that you can create +// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) +// in the AWS WAF Developer Guide. +type WAFLimitsExceededException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFLimitsExceededException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFLimitsExceededException) GoString() string { + return s.String() +} + +func newErrorWAFLimitsExceededException(v protocol.ResponseMetadata) error { + return &WAFLimitsExceededException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFLimitsExceededException) Code() string { + return "WAFLimitsExceededException" +} + +// Message returns the exception's message. +func (s *WAFLimitsExceededException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFLimitsExceededException) OrigErr() error { + return nil +} + +func (s *WAFLimitsExceededException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFLimitsExceededException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFLimitsExceededException) RequestID() string { + return s.RespMetadata.RequestID +} + +// AWS WAF couldn’t perform the operation because your resource doesn’t +// exist. +type WAFNonexistentItemException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFNonexistentItemException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFNonexistentItemException) GoString() string { + return s.String() +} + +func newErrorWAFNonexistentItemException(v protocol.ResponseMetadata) error { + return &WAFNonexistentItemException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFNonexistentItemException) Code() string { + return "WAFNonexistentItemException" +} + +// Message returns the exception's message. +func (s *WAFNonexistentItemException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFNonexistentItemException) OrigErr() error { + return nil +} + +func (s *WAFNonexistentItemException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFNonexistentItemException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFNonexistentItemException) RequestID() string { + return s.RespMetadata.RequestID +} + +// AWS WAF couldn’t save your changes because you tried to update or delete +// a resource that has changed since you last retrieved it. Get the resource +// again, make any changes you need to make to the new copy, and retry your +// operation. +type WAFOptimisticLockException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFOptimisticLockException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFOptimisticLockException) GoString() string { + return s.String() +} + +func newErrorWAFOptimisticLockException(v protocol.ResponseMetadata) error { + return &WAFOptimisticLockException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFOptimisticLockException) Code() string { + return "WAFOptimisticLockException" +} + +// Message returns the exception's message. +func (s *WAFOptimisticLockException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFOptimisticLockException) OrigErr() error { + return nil +} + +func (s *WAFOptimisticLockException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFOptimisticLockException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFOptimisticLockException) RequestID() string { + return s.RespMetadata.RequestID +} + +// AWS WAF is not able to access the service linked role. This can be caused +// by a previous PutLoggingConfiguration request, which can lock the service +// linked role for about 20 seconds. Please try your request again. The service +// linked role can also be locked by a previous DeleteServiceLinkedRole request, +// which can lock the role for 15 minutes or more. If you recently made a call +// to DeleteServiceLinkedRole, wait at least 15 minutes and try the request +// again. If you receive this same exception again, you will have to wait additional +// time until the role is unlocked. +type WAFServiceLinkedRoleErrorException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"message" type:"string"` +} + +// String returns the string representation +func (s WAFServiceLinkedRoleErrorException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFServiceLinkedRoleErrorException) GoString() string { + return s.String() +} + +func newErrorWAFServiceLinkedRoleErrorException(v protocol.ResponseMetadata) error { + return &WAFServiceLinkedRoleErrorException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFServiceLinkedRoleErrorException) Code() string { + return "WAFServiceLinkedRoleErrorException" +} + +// Message returns the exception's message. +func (s *WAFServiceLinkedRoleErrorException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFServiceLinkedRoleErrorException) OrigErr() error { + return nil +} + +func (s *WAFServiceLinkedRoleErrorException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFServiceLinkedRoleErrorException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFServiceLinkedRoleErrorException) RequestID() string { + return s.RespMetadata.RequestID +} + +type WAFSubscriptionNotFoundException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFSubscriptionNotFoundException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFSubscriptionNotFoundException) GoString() string { + return s.String() +} + +func newErrorWAFSubscriptionNotFoundException(v protocol.ResponseMetadata) error { + return &WAFSubscriptionNotFoundException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFSubscriptionNotFoundException) Code() string { + return "WAFSubscriptionNotFoundException" +} + +// Message returns the exception's message. +func (s *WAFSubscriptionNotFoundException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFSubscriptionNotFoundException) OrigErr() error { + return nil +} + +func (s *WAFSubscriptionNotFoundException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFSubscriptionNotFoundException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFSubscriptionNotFoundException) RequestID() string { + return s.RespMetadata.RequestID +} + +// An error occurred during the tagging operation. Retry your request. +type WAFTagOperationException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFTagOperationException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFTagOperationException) GoString() string { + return s.String() +} + +func newErrorWAFTagOperationException(v protocol.ResponseMetadata) error { + return &WAFTagOperationException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFTagOperationException) Code() string { + return "WAFTagOperationException" +} + +// Message returns the exception's message. +func (s *WAFTagOperationException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFTagOperationException) OrigErr() error { + return nil +} + +func (s *WAFTagOperationException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFTagOperationException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFTagOperationException) RequestID() string { + return s.RespMetadata.RequestID +} + +// AWS WAF couldn’t perform your tagging operation because of an internal +// error. Retry your request. +type WAFTagOperationInternalErrorException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFTagOperationInternalErrorException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFTagOperationInternalErrorException) GoString() string { + return s.String() +} + +func newErrorWAFTagOperationInternalErrorException(v protocol.ResponseMetadata) error { + return &WAFTagOperationInternalErrorException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFTagOperationInternalErrorException) Code() string { + return "WAFTagOperationInternalErrorException" +} + +// Message returns the exception's message. +func (s *WAFTagOperationInternalErrorException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFTagOperationInternalErrorException) OrigErr() error { + return nil +} + +func (s *WAFTagOperationInternalErrorException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFTagOperationInternalErrorException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFTagOperationInternalErrorException) RequestID() string { + return s.RespMetadata.RequestID +} + +// AWS WAF couldn’t retrieve the resource that you requested. Retry your request. +type WAFUnavailableEntityException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation +func (s WAFUnavailableEntityException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WAFUnavailableEntityException) GoString() string { + return s.String() +} + +func newErrorWAFUnavailableEntityException(v protocol.ResponseMetadata) error { + return &WAFUnavailableEntityException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFUnavailableEntityException) Code() string { + return "WAFUnavailableEntityException" +} + +// Message returns the exception's message. +func (s *WAFUnavailableEntityException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFUnavailableEntityException) OrigErr() error { + return nil +} + +func (s *WAFUnavailableEntityException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFUnavailableEntityException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFUnavailableEntityException) RequestID() string { + return s.RespMetadata.RequestID +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A Web ACL defines a collection of rules to use to inspect and control web +// requests. Each rule has an action defined (allow, block, or count) for requests +// that match the statement of the rule. In the Web ACL, you assign a default +// action to take (allow, block) for any request that does not match any of +// the rules. The rules in a Web ACL can be a combination of the types Rule, +// RuleGroup, and managed rule group. You can associate a Web ACL with one or +// more AWS resources to protect. The resources can be Amazon CloudFront, an +// Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync +// GraphQL API. +type WebACL struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the Web ACL that you want to associate + // with the resource. + // + // ARN is a required field + ARN *string `min:"20" type:"string" required:"true"` + + // The web ACL capacity units (WCUs) currently being used by this web ACL. + // + // AWS WAF uses WCUs to calculate and control the operating resources that are + // used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity + // differently for each rule type, to reflect the relative cost of each rule. + // Simple rules that cost little to run use fewer WCUs than more complex rules + // that use more processing power. Rule group capacity is fixed at creation, + // which helps users plan their web ACL WCU usage when they use a rule group. + // The WCU limit for web ACLs is 1,500. + Capacity *int64 `type:"long"` + + // The action to perform if none of the Rules contained in the WebACL match. + // + // DefaultAction is a required field + DefaultAction *DefaultAction `type:"structure" required:"true"` + + // A description of the Web ACL that helps with identification. You cannot change + // the description of a Web ACL after you create it. + Description *string `min:"1" type:"string"` + + // A unique identifier for the WebACL. This ID is returned in the responses + // to create and list commands. You use this ID to do things like get, update, + // and delete a WebACL. + // + // Id is a required field + Id *string `min:"1" type:"string" required:"true"` + + // Indicates whether this web ACL is managed by AWS Firewall Manager. If true, + // then only AWS Firewall Manager can delete the web ACL or any Firewall Manager + // rule groups in the web ACL. + ManagedByFirewallManager *bool `type:"boolean"` + + // The name of the Web ACL. You cannot change the name of a Web ACL after you + // create it. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // The last set of rules for AWS WAF to process in the web ACL. This is defined + // in an AWS Firewall Manager WAF policy and contains only rule group references. + // You can't alter these. Any rules and rule groups that you define for the + // web ACL are prioritized before these. + // + // In the Firewall Manager WAF policy, the Firewall Manager administrator can + // define a set of rule groups to run first in the web ACL and a set of rule + // groups to run last. Within each set, the administrator prioritizes the rule + // groups, to determine their relative processing order. + PostProcessFirewallManagerRuleGroups []*FirewallManagerRuleGroup `type:"list"` + + // The first set of rules for AWS WAF to process in the web ACL. This is defined + // in an AWS Firewall Manager WAF policy and contains only rule group references. + // You can't alter these. Any rules and rule groups that you define for the + // web ACL are prioritized after these. + // + // In the Firewall Manager WAF policy, the Firewall Manager administrator can + // define a set of rule groups to run first in the web ACL and a set of rule + // groups to run last. Within each set, the administrator prioritizes the rule + // groups, to determine their relative processing order. + PreProcessFirewallManagerRuleGroups []*FirewallManagerRuleGroup `type:"list"` + + // The Rule statements used to identify the web requests that you want to allow, + // block, or count. Each rule includes one top-level statement that AWS WAF + // uses to identify matching web requests, and parameters that govern how AWS + // WAF handles them. + Rules []*Rule `type:"list"` + + // Defines and enables Amazon CloudWatch metrics and web request sample collection. + // + // VisibilityConfig is a required field + VisibilityConfig *VisibilityConfig `type:"structure" required:"true"` +} + +// String returns the string representation +func (s WebACL) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WebACL) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *WebACL) SetARN(v string) *WebACL { + s.ARN = &v + return s +} + +// SetCapacity sets the Capacity field's value. +func (s *WebACL) SetCapacity(v int64) *WebACL { + s.Capacity = &v + return s +} + +// SetDefaultAction sets the DefaultAction field's value. +func (s *WebACL) SetDefaultAction(v *DefaultAction) *WebACL { + s.DefaultAction = v + return s +} + +// SetDescription sets the Description field's value. +func (s *WebACL) SetDescription(v string) *WebACL { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *WebACL) SetId(v string) *WebACL { + s.Id = &v + return s +} + +// SetManagedByFirewallManager sets the ManagedByFirewallManager field's value. +func (s *WebACL) SetManagedByFirewallManager(v bool) *WebACL { + s.ManagedByFirewallManager = &v + return s +} + +// SetName sets the Name field's value. +func (s *WebACL) SetName(v string) *WebACL { + s.Name = &v + return s +} + +// SetPostProcessFirewallManagerRuleGroups sets the PostProcessFirewallManagerRuleGroups field's value. +func (s *WebACL) SetPostProcessFirewallManagerRuleGroups(v []*FirewallManagerRuleGroup) *WebACL { + s.PostProcessFirewallManagerRuleGroups = v + return s +} + +// SetPreProcessFirewallManagerRuleGroups sets the PreProcessFirewallManagerRuleGroups field's value. +func (s *WebACL) SetPreProcessFirewallManagerRuleGroups(v []*FirewallManagerRuleGroup) *WebACL { + s.PreProcessFirewallManagerRuleGroups = v + return s +} + +// SetRules sets the Rules field's value. +func (s *WebACL) SetRules(v []*Rule) *WebACL { + s.Rules = v + return s +} + +// SetVisibilityConfig sets the VisibilityConfig field's value. +func (s *WebACL) SetVisibilityConfig(v *VisibilityConfig) *WebACL { + s.VisibilityConfig = v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// High-level information about a WebACL, returned by operations like create +// and list. This provides information like the ID, that you can use to retrieve +// and manage a WebACL, and the ARN, that you provide to operations like AssociateWebACL. +type WebACLSummary struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + ARN *string `min:"20" type:"string"` + + // A description of the Web ACL that helps with identification. You cannot change + // the description of a Web ACL after you create it. + Description *string `min:"1" type:"string"` + + // The unique identifier for the Web ACL. This ID is returned in the responses + // to create and list commands. You provide it to operations like update and + // delete. + Id *string `min:"1" type:"string"` + + // A token used for optimistic locking. AWS WAF returns a token to your get + // and list requests, to mark the state of the entity at the time of the request. + // To make changes to the entity associated with the token, you provide the + // token to operations like update and delete. AWS WAF uses the token to ensure + // that no changes have been made to the entity since you last retrieved it. + // If a change has been made, the update fails with a WAFOptimisticLockException. + // If this happens, perform another get, and use the new token returned by that + // operation. + LockToken *string `min:"1" type:"string"` + + // The name of the Web ACL. You cannot change the name of a Web ACL after you + // create it. + Name *string `min:"1" type:"string"` +} + +// String returns the string representation +func (s WebACLSummary) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s WebACLSummary) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *WebACLSummary) SetARN(v string) *WebACLSummary { + s.ARN = &v + return s +} + +// SetDescription sets the Description field's value. +func (s *WebACLSummary) SetDescription(v string) *WebACLSummary { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *WebACLSummary) SetId(v string) *WebACLSummary { + s.Id = &v + return s +} + +// SetLockToken sets the LockToken field's value. +func (s *WebACLSummary) SetLockToken(v string) *WebACLSummary { + s.LockToken = &v + return s +} + +// SetName sets the Name field's value. +func (s *WebACLSummary) SetName(v string) *WebACLSummary { + s.Name = &v + return s +} + +// +// This is the latest version of AWS WAF, named AWS WAFV2, released in November, +// 2019. For information, including how to migrate your AWS WAF resources from +// the prior release, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// A rule statement that defines a cross-site scripting (XSS) match search for +// AWS WAF to apply to web requests. XSS attacks are those where the attacker +// uses vulnerabilities in a benign website as a vehicle to inject malicious +// client-site scripts into other legitimate web browsers. The XSS match statement +// provides the location in requests that you want AWS WAF to search and text +// transformations to use on the search area before AWS WAF searches for character +// sequences that are likely to be malicious strings. +type XssMatchStatement struct { + _ struct{} `type:"structure"` + + // The part of a web request that you want AWS WAF to inspect. For more information, + // see FieldToMatch. + // + // FieldToMatch is a required field + FieldToMatch *FieldToMatch `type:"structure" required:"true"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. If you specify one + // or more transformations in a rule statement, AWS WAF performs all transformations + // on the content of the request component identified by FieldToMatch, starting + // from the lowest priority setting, before inspecting the content for a match. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation +func (s XssMatchStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation +func (s XssMatchStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *XssMatchStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "XssMatchStatement"} + if s.FieldToMatch == nil { + invalidParams.Add(request.NewErrParamRequired("FieldToMatch")) + } + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.FieldToMatch != nil { + if err := s.FieldToMatch.Validate(); err != nil { + invalidParams.AddNested("FieldToMatch", err.(request.ErrInvalidParams)) + } + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetFieldToMatch sets the FieldToMatch field's value. +func (s *XssMatchStatement) SetFieldToMatch(v *FieldToMatch) *XssMatchStatement { + s.FieldToMatch = v + return s +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *XssMatchStatement) SetTextTransformations(v []*TextTransformation) *XssMatchStatement { + s.TextTransformations = v + return s +} + +const ( + // ComparisonOperatorEq is a ComparisonOperator enum value + ComparisonOperatorEq = "EQ" + + // ComparisonOperatorNe is a ComparisonOperator enum value + ComparisonOperatorNe = "NE" + + // ComparisonOperatorLe is a ComparisonOperator enum value + ComparisonOperatorLe = "LE" + + // ComparisonOperatorLt is a ComparisonOperator enum value + ComparisonOperatorLt = "LT" + + // ComparisonOperatorGe is a ComparisonOperator enum value + ComparisonOperatorGe = "GE" + + // ComparisonOperatorGt is a ComparisonOperator enum value + ComparisonOperatorGt = "GT" +) + +// ComparisonOperator_Values returns all elements of the ComparisonOperator enum +func ComparisonOperator_Values() []string { + return []string{ + ComparisonOperatorEq, + ComparisonOperatorNe, + ComparisonOperatorLe, + ComparisonOperatorLt, + ComparisonOperatorGe, + ComparisonOperatorGt, + } +} + +const ( + // CountryCodeAf is a CountryCode enum value + CountryCodeAf = "AF" + + // CountryCodeAx is a CountryCode enum value + CountryCodeAx = "AX" + + // CountryCodeAl is a CountryCode enum value + CountryCodeAl = "AL" + + // CountryCodeDz is a CountryCode enum value + CountryCodeDz = "DZ" + + // CountryCodeAs is a CountryCode enum value + CountryCodeAs = "AS" + + // CountryCodeAd is a CountryCode enum value + CountryCodeAd = "AD" + + // CountryCodeAo is a CountryCode enum value + CountryCodeAo = "AO" + + // CountryCodeAi is a CountryCode enum value + CountryCodeAi = "AI" + + // CountryCodeAq is a CountryCode enum value + CountryCodeAq = "AQ" + + // CountryCodeAg is a CountryCode enum value + CountryCodeAg = "AG" + + // CountryCodeAr is a CountryCode enum value + CountryCodeAr = "AR" + + // CountryCodeAm is a CountryCode enum value + CountryCodeAm = "AM" + + // CountryCodeAw is a CountryCode enum value + CountryCodeAw = "AW" + + // CountryCodeAu is a CountryCode enum value + CountryCodeAu = "AU" + + // CountryCodeAt is a CountryCode enum value + CountryCodeAt = "AT" + + // CountryCodeAz is a CountryCode enum value + CountryCodeAz = "AZ" + + // CountryCodeBs is a CountryCode enum value + CountryCodeBs = "BS" + + // CountryCodeBh is a CountryCode enum value + CountryCodeBh = "BH" + + // CountryCodeBd is a CountryCode enum value + CountryCodeBd = "BD" + + // CountryCodeBb is a CountryCode enum value + CountryCodeBb = "BB" + + // CountryCodeBy is a CountryCode enum value + CountryCodeBy = "BY" + + // CountryCodeBe is a CountryCode enum value + CountryCodeBe = "BE" + + // CountryCodeBz is a CountryCode enum value + CountryCodeBz = "BZ" + + // CountryCodeBj is a CountryCode enum value + CountryCodeBj = "BJ" + + // CountryCodeBm is a CountryCode enum value + CountryCodeBm = "BM" + + // CountryCodeBt is a CountryCode enum value + CountryCodeBt = "BT" + + // CountryCodeBo is a CountryCode enum value + CountryCodeBo = "BO" + + // CountryCodeBq is a CountryCode enum value + CountryCodeBq = "BQ" + + // CountryCodeBa is a CountryCode enum value + CountryCodeBa = "BA" + + // CountryCodeBw is a CountryCode enum value + CountryCodeBw = "BW" + + // CountryCodeBv is a CountryCode enum value + CountryCodeBv = "BV" + + // CountryCodeBr is a CountryCode enum value + CountryCodeBr = "BR" + + // CountryCodeIo is a CountryCode enum value + CountryCodeIo = "IO" + + // CountryCodeBn is a CountryCode enum value + CountryCodeBn = "BN" + + // CountryCodeBg is a CountryCode enum value + CountryCodeBg = "BG" + + // CountryCodeBf is a CountryCode enum value + CountryCodeBf = "BF" + + // CountryCodeBi is a CountryCode enum value + CountryCodeBi = "BI" + + // CountryCodeKh is a CountryCode enum value + CountryCodeKh = "KH" + + // CountryCodeCm is a CountryCode enum value + CountryCodeCm = "CM" + + // CountryCodeCa is a CountryCode enum value + CountryCodeCa = "CA" + + // CountryCodeCv is a CountryCode enum value + CountryCodeCv = "CV" + + // CountryCodeKy is a CountryCode enum value + CountryCodeKy = "KY" + + // CountryCodeCf is a CountryCode enum value + CountryCodeCf = "CF" + + // CountryCodeTd is a CountryCode enum value + CountryCodeTd = "TD" + + // CountryCodeCl is a CountryCode enum value + CountryCodeCl = "CL" + + // CountryCodeCn is a CountryCode enum value + CountryCodeCn = "CN" + + // CountryCodeCx is a CountryCode enum value + CountryCodeCx = "CX" + + // CountryCodeCc is a CountryCode enum value + CountryCodeCc = "CC" + + // CountryCodeCo is a CountryCode enum value + CountryCodeCo = "CO" + + // CountryCodeKm is a CountryCode enum value + CountryCodeKm = "KM" + + // CountryCodeCg is a CountryCode enum value + CountryCodeCg = "CG" + + // CountryCodeCd is a CountryCode enum value + CountryCodeCd = "CD" + + // CountryCodeCk is a CountryCode enum value + CountryCodeCk = "CK" + + // CountryCodeCr is a CountryCode enum value + CountryCodeCr = "CR" + + // CountryCodeCi is a CountryCode enum value + CountryCodeCi = "CI" + + // CountryCodeHr is a CountryCode enum value + CountryCodeHr = "HR" + + // CountryCodeCu is a CountryCode enum value + CountryCodeCu = "CU" + + // CountryCodeCw is a CountryCode enum value + CountryCodeCw = "CW" + + // CountryCodeCy is a CountryCode enum value + CountryCodeCy = "CY" + + // CountryCodeCz is a CountryCode enum value + CountryCodeCz = "CZ" + + // CountryCodeDk is a CountryCode enum value + CountryCodeDk = "DK" + + // CountryCodeDj is a CountryCode enum value + CountryCodeDj = "DJ" + + // CountryCodeDm is a CountryCode enum value + CountryCodeDm = "DM" + + // CountryCodeDo is a CountryCode enum value + CountryCodeDo = "DO" + + // CountryCodeEc is a CountryCode enum value + CountryCodeEc = "EC" + + // CountryCodeEg is a CountryCode enum value + CountryCodeEg = "EG" + + // CountryCodeSv is a CountryCode enum value + CountryCodeSv = "SV" + + // CountryCodeGq is a CountryCode enum value + CountryCodeGq = "GQ" + + // CountryCodeEr is a CountryCode enum value + CountryCodeEr = "ER" + + // CountryCodeEe is a CountryCode enum value + CountryCodeEe = "EE" + + // CountryCodeEt is a CountryCode enum value + CountryCodeEt = "ET" + + // CountryCodeFk is a CountryCode enum value + CountryCodeFk = "FK" + + // CountryCodeFo is a CountryCode enum value + CountryCodeFo = "FO" + + // CountryCodeFj is a CountryCode enum value + CountryCodeFj = "FJ" + + // CountryCodeFi is a CountryCode enum value + CountryCodeFi = "FI" + + // CountryCodeFr is a CountryCode enum value + CountryCodeFr = "FR" + + // CountryCodeGf is a CountryCode enum value + CountryCodeGf = "GF" + + // CountryCodePf is a CountryCode enum value + CountryCodePf = "PF" + + // CountryCodeTf is a CountryCode enum value + CountryCodeTf = "TF" + + // CountryCodeGa is a CountryCode enum value + CountryCodeGa = "GA" + + // CountryCodeGm is a CountryCode enum value + CountryCodeGm = "GM" + + // CountryCodeGe is a CountryCode enum value + CountryCodeGe = "GE" + + // CountryCodeDe is a CountryCode enum value + CountryCodeDe = "DE" + + // CountryCodeGh is a CountryCode enum value + CountryCodeGh = "GH" + + // CountryCodeGi is a CountryCode enum value + CountryCodeGi = "GI" + + // CountryCodeGr is a CountryCode enum value + CountryCodeGr = "GR" + + // CountryCodeGl is a CountryCode enum value + CountryCodeGl = "GL" + + // CountryCodeGd is a CountryCode enum value + CountryCodeGd = "GD" + + // CountryCodeGp is a CountryCode enum value + CountryCodeGp = "GP" + + // CountryCodeGu is a CountryCode enum value + CountryCodeGu = "GU" + + // CountryCodeGt is a CountryCode enum value + CountryCodeGt = "GT" + + // CountryCodeGg is a CountryCode enum value + CountryCodeGg = "GG" + + // CountryCodeGn is a CountryCode enum value + CountryCodeGn = "GN" + + // CountryCodeGw is a CountryCode enum value + CountryCodeGw = "GW" + + // CountryCodeGy is a CountryCode enum value + CountryCodeGy = "GY" + + // CountryCodeHt is a CountryCode enum value + CountryCodeHt = "HT" + + // CountryCodeHm is a CountryCode enum value + CountryCodeHm = "HM" + + // CountryCodeVa is a CountryCode enum value + CountryCodeVa = "VA" + + // CountryCodeHn is a CountryCode enum value + CountryCodeHn = "HN" + + // CountryCodeHk is a CountryCode enum value + CountryCodeHk = "HK" + + // CountryCodeHu is a CountryCode enum value + CountryCodeHu = "HU" + + // CountryCodeIs is a CountryCode enum value + CountryCodeIs = "IS" + + // CountryCodeIn is a CountryCode enum value + CountryCodeIn = "IN" + + // CountryCodeId is a CountryCode enum value + CountryCodeId = "ID" + + // CountryCodeIr is a CountryCode enum value + CountryCodeIr = "IR" + + // CountryCodeIq is a CountryCode enum value + CountryCodeIq = "IQ" + + // CountryCodeIe is a CountryCode enum value + CountryCodeIe = "IE" + + // CountryCodeIm is a CountryCode enum value + CountryCodeIm = "IM" + + // CountryCodeIl is a CountryCode enum value + CountryCodeIl = "IL" + + // CountryCodeIt is a CountryCode enum value + CountryCodeIt = "IT" + + // CountryCodeJm is a CountryCode enum value + CountryCodeJm = "JM" + + // CountryCodeJp is a CountryCode enum value + CountryCodeJp = "JP" + + // CountryCodeJe is a CountryCode enum value + CountryCodeJe = "JE" + + // CountryCodeJo is a CountryCode enum value + CountryCodeJo = "JO" + + // CountryCodeKz is a CountryCode enum value + CountryCodeKz = "KZ" + + // CountryCodeKe is a CountryCode enum value + CountryCodeKe = "KE" + + // CountryCodeKi is a CountryCode enum value + CountryCodeKi = "KI" + + // CountryCodeKp is a CountryCode enum value + CountryCodeKp = "KP" + + // CountryCodeKr is a CountryCode enum value + CountryCodeKr = "KR" + + // CountryCodeKw is a CountryCode enum value + CountryCodeKw = "KW" + + // CountryCodeKg is a CountryCode enum value + CountryCodeKg = "KG" + + // CountryCodeLa is a CountryCode enum value + CountryCodeLa = "LA" + + // CountryCodeLv is a CountryCode enum value + CountryCodeLv = "LV" + + // CountryCodeLb is a CountryCode enum value + CountryCodeLb = "LB" + + // CountryCodeLs is a CountryCode enum value + CountryCodeLs = "LS" + + // CountryCodeLr is a CountryCode enum value + CountryCodeLr = "LR" + + // CountryCodeLy is a CountryCode enum value + CountryCodeLy = "LY" + + // CountryCodeLi is a CountryCode enum value + CountryCodeLi = "LI" + + // CountryCodeLt is a CountryCode enum value + CountryCodeLt = "LT" + + // CountryCodeLu is a CountryCode enum value + CountryCodeLu = "LU" + + // CountryCodeMo is a CountryCode enum value + CountryCodeMo = "MO" + + // CountryCodeMk is a CountryCode enum value + CountryCodeMk = "MK" + + // CountryCodeMg is a CountryCode enum value + CountryCodeMg = "MG" + + // CountryCodeMw is a CountryCode enum value + CountryCodeMw = "MW" + + // CountryCodeMy is a CountryCode enum value + CountryCodeMy = "MY" + + // CountryCodeMv is a CountryCode enum value + CountryCodeMv = "MV" + + // CountryCodeMl is a CountryCode enum value + CountryCodeMl = "ML" + + // CountryCodeMt is a CountryCode enum value + CountryCodeMt = "MT" + + // CountryCodeMh is a CountryCode enum value + CountryCodeMh = "MH" + + // CountryCodeMq is a CountryCode enum value + CountryCodeMq = "MQ" + + // CountryCodeMr is a CountryCode enum value + CountryCodeMr = "MR" + + // CountryCodeMu is a CountryCode enum value + CountryCodeMu = "MU" + + // CountryCodeYt is a CountryCode enum value + CountryCodeYt = "YT" + + // CountryCodeMx is a CountryCode enum value + CountryCodeMx = "MX" + + // CountryCodeFm is a CountryCode enum value + CountryCodeFm = "FM" + + // CountryCodeMd is a CountryCode enum value + CountryCodeMd = "MD" + + // CountryCodeMc is a CountryCode enum value + CountryCodeMc = "MC" + + // CountryCodeMn is a CountryCode enum value + CountryCodeMn = "MN" + + // CountryCodeMe is a CountryCode enum value + CountryCodeMe = "ME" + + // CountryCodeMs is a CountryCode enum value + CountryCodeMs = "MS" + + // CountryCodeMa is a CountryCode enum value + CountryCodeMa = "MA" + + // CountryCodeMz is a CountryCode enum value + CountryCodeMz = "MZ" + + // CountryCodeMm is a CountryCode enum value + CountryCodeMm = "MM" + + // CountryCodeNa is a CountryCode enum value + CountryCodeNa = "NA" + + // CountryCodeNr is a CountryCode enum value + CountryCodeNr = "NR" + + // CountryCodeNp is a CountryCode enum value + CountryCodeNp = "NP" + + // CountryCodeNl is a CountryCode enum value + CountryCodeNl = "NL" + + // CountryCodeNc is a CountryCode enum value + CountryCodeNc = "NC" + + // CountryCodeNz is a CountryCode enum value + CountryCodeNz = "NZ" + + // CountryCodeNi is a CountryCode enum value + CountryCodeNi = "NI" + + // CountryCodeNe is a CountryCode enum value + CountryCodeNe = "NE" + + // CountryCodeNg is a CountryCode enum value + CountryCodeNg = "NG" + + // CountryCodeNu is a CountryCode enum value + CountryCodeNu = "NU" + + // CountryCodeNf is a CountryCode enum value + CountryCodeNf = "NF" + + // CountryCodeMp is a CountryCode enum value + CountryCodeMp = "MP" + + // CountryCodeNo is a CountryCode enum value + CountryCodeNo = "NO" + + // CountryCodeOm is a CountryCode enum value + CountryCodeOm = "OM" + + // CountryCodePk is a CountryCode enum value + CountryCodePk = "PK" + + // CountryCodePw is a CountryCode enum value + CountryCodePw = "PW" + + // CountryCodePs is a CountryCode enum value + CountryCodePs = "PS" + + // CountryCodePa is a CountryCode enum value + CountryCodePa = "PA" + + // CountryCodePg is a CountryCode enum value + CountryCodePg = "PG" + + // CountryCodePy is a CountryCode enum value + CountryCodePy = "PY" + + // CountryCodePe is a CountryCode enum value + CountryCodePe = "PE" + + // CountryCodePh is a CountryCode enum value + CountryCodePh = "PH" + + // CountryCodePn is a CountryCode enum value + CountryCodePn = "PN" + + // CountryCodePl is a CountryCode enum value + CountryCodePl = "PL" + + // CountryCodePt is a CountryCode enum value + CountryCodePt = "PT" + + // CountryCodePr is a CountryCode enum value + CountryCodePr = "PR" + + // CountryCodeQa is a CountryCode enum value + CountryCodeQa = "QA" + + // CountryCodeRe is a CountryCode enum value + CountryCodeRe = "RE" + + // CountryCodeRo is a CountryCode enum value + CountryCodeRo = "RO" + + // CountryCodeRu is a CountryCode enum value + CountryCodeRu = "RU" + + // CountryCodeRw is a CountryCode enum value + CountryCodeRw = "RW" + + // CountryCodeBl is a CountryCode enum value + CountryCodeBl = "BL" + + // CountryCodeSh is a CountryCode enum value + CountryCodeSh = "SH" + + // CountryCodeKn is a CountryCode enum value + CountryCodeKn = "KN" + + // CountryCodeLc is a CountryCode enum value + CountryCodeLc = "LC" + + // CountryCodeMf is a CountryCode enum value + CountryCodeMf = "MF" + + // CountryCodePm is a CountryCode enum value + CountryCodePm = "PM" + + // CountryCodeVc is a CountryCode enum value + CountryCodeVc = "VC" + + // CountryCodeWs is a CountryCode enum value + CountryCodeWs = "WS" + + // CountryCodeSm is a CountryCode enum value + CountryCodeSm = "SM" + + // CountryCodeSt is a CountryCode enum value + CountryCodeSt = "ST" + + // CountryCodeSa is a CountryCode enum value + CountryCodeSa = "SA" + + // CountryCodeSn is a CountryCode enum value + CountryCodeSn = "SN" + + // CountryCodeRs is a CountryCode enum value + CountryCodeRs = "RS" + + // CountryCodeSc is a CountryCode enum value + CountryCodeSc = "SC" + + // CountryCodeSl is a CountryCode enum value + CountryCodeSl = "SL" + + // CountryCodeSg is a CountryCode enum value + CountryCodeSg = "SG" + + // CountryCodeSx is a CountryCode enum value + CountryCodeSx = "SX" + + // CountryCodeSk is a CountryCode enum value + CountryCodeSk = "SK" + + // CountryCodeSi is a CountryCode enum value + CountryCodeSi = "SI" + + // CountryCodeSb is a CountryCode enum value + CountryCodeSb = "SB" + + // CountryCodeSo is a CountryCode enum value + CountryCodeSo = "SO" + + // CountryCodeZa is a CountryCode enum value + CountryCodeZa = "ZA" + + // CountryCodeGs is a CountryCode enum value + CountryCodeGs = "GS" + + // CountryCodeSs is a CountryCode enum value + CountryCodeSs = "SS" + + // CountryCodeEs is a CountryCode enum value + CountryCodeEs = "ES" + + // CountryCodeLk is a CountryCode enum value + CountryCodeLk = "LK" + + // CountryCodeSd is a CountryCode enum value + CountryCodeSd = "SD" + + // CountryCodeSr is a CountryCode enum value + CountryCodeSr = "SR" + + // CountryCodeSj is a CountryCode enum value + CountryCodeSj = "SJ" + + // CountryCodeSz is a CountryCode enum value + CountryCodeSz = "SZ" + + // CountryCodeSe is a CountryCode enum value + CountryCodeSe = "SE" + + // CountryCodeCh is a CountryCode enum value + CountryCodeCh = "CH" + + // CountryCodeSy is a CountryCode enum value + CountryCodeSy = "SY" + + // CountryCodeTw is a CountryCode enum value + CountryCodeTw = "TW" + + // CountryCodeTj is a CountryCode enum value + CountryCodeTj = "TJ" + + // CountryCodeTz is a CountryCode enum value + CountryCodeTz = "TZ" + + // CountryCodeTh is a CountryCode enum value + CountryCodeTh = "TH" + + // CountryCodeTl is a CountryCode enum value + CountryCodeTl = "TL" + + // CountryCodeTg is a CountryCode enum value + CountryCodeTg = "TG" + + // CountryCodeTk is a CountryCode enum value + CountryCodeTk = "TK" + + // CountryCodeTo is a CountryCode enum value + CountryCodeTo = "TO" + + // CountryCodeTt is a CountryCode enum value + CountryCodeTt = "TT" + + // CountryCodeTn is a CountryCode enum value + CountryCodeTn = "TN" + + // CountryCodeTr is a CountryCode enum value + CountryCodeTr = "TR" + + // CountryCodeTm is a CountryCode enum value + CountryCodeTm = "TM" + + // CountryCodeTc is a CountryCode enum value + CountryCodeTc = "TC" + + // CountryCodeTv is a CountryCode enum value + CountryCodeTv = "TV" + + // CountryCodeUg is a CountryCode enum value + CountryCodeUg = "UG" + + // CountryCodeUa is a CountryCode enum value + CountryCodeUa = "UA" + + // CountryCodeAe is a CountryCode enum value + CountryCodeAe = "AE" + + // CountryCodeGb is a CountryCode enum value + CountryCodeGb = "GB" + + // CountryCodeUs is a CountryCode enum value + CountryCodeUs = "US" + + // CountryCodeUm is a CountryCode enum value + CountryCodeUm = "UM" + + // CountryCodeUy is a CountryCode enum value + CountryCodeUy = "UY" + + // CountryCodeUz is a CountryCode enum value + CountryCodeUz = "UZ" + + // CountryCodeVu is a CountryCode enum value + CountryCodeVu = "VU" + + // CountryCodeVe is a CountryCode enum value + CountryCodeVe = "VE" + + // CountryCodeVn is a CountryCode enum value + CountryCodeVn = "VN" + + // CountryCodeVg is a CountryCode enum value + CountryCodeVg = "VG" + + // CountryCodeVi is a CountryCode enum value + CountryCodeVi = "VI" + + // CountryCodeWf is a CountryCode enum value + CountryCodeWf = "WF" + + // CountryCodeEh is a CountryCode enum value + CountryCodeEh = "EH" + + // CountryCodeYe is a CountryCode enum value + CountryCodeYe = "YE" + + // CountryCodeZm is a CountryCode enum value + CountryCodeZm = "ZM" + + // CountryCodeZw is a CountryCode enum value + CountryCodeZw = "ZW" +) + +// CountryCode_Values returns all elements of the CountryCode enum +func CountryCode_Values() []string { + return []string{ + CountryCodeAf, + CountryCodeAx, + CountryCodeAl, + CountryCodeDz, + CountryCodeAs, + CountryCodeAd, + CountryCodeAo, + CountryCodeAi, + CountryCodeAq, + CountryCodeAg, + CountryCodeAr, + CountryCodeAm, + CountryCodeAw, + CountryCodeAu, + CountryCodeAt, + CountryCodeAz, + CountryCodeBs, + CountryCodeBh, + CountryCodeBd, + CountryCodeBb, + CountryCodeBy, + CountryCodeBe, + CountryCodeBz, + CountryCodeBj, + CountryCodeBm, + CountryCodeBt, + CountryCodeBo, + CountryCodeBq, + CountryCodeBa, + CountryCodeBw, + CountryCodeBv, + CountryCodeBr, + CountryCodeIo, + CountryCodeBn, + CountryCodeBg, + CountryCodeBf, + CountryCodeBi, + CountryCodeKh, + CountryCodeCm, + CountryCodeCa, + CountryCodeCv, + CountryCodeKy, + CountryCodeCf, + CountryCodeTd, + CountryCodeCl, + CountryCodeCn, + CountryCodeCx, + CountryCodeCc, + CountryCodeCo, + CountryCodeKm, + CountryCodeCg, + CountryCodeCd, + CountryCodeCk, + CountryCodeCr, + CountryCodeCi, + CountryCodeHr, + CountryCodeCu, + CountryCodeCw, + CountryCodeCy, + CountryCodeCz, + CountryCodeDk, + CountryCodeDj, + CountryCodeDm, + CountryCodeDo, + CountryCodeEc, + CountryCodeEg, + CountryCodeSv, + CountryCodeGq, + CountryCodeEr, + CountryCodeEe, + CountryCodeEt, + CountryCodeFk, + CountryCodeFo, + CountryCodeFj, + CountryCodeFi, + CountryCodeFr, + CountryCodeGf, + CountryCodePf, + CountryCodeTf, + CountryCodeGa, + CountryCodeGm, + CountryCodeGe, + CountryCodeDe, + CountryCodeGh, + CountryCodeGi, + CountryCodeGr, + CountryCodeGl, + CountryCodeGd, + CountryCodeGp, + CountryCodeGu, + CountryCodeGt, + CountryCodeGg, + CountryCodeGn, + CountryCodeGw, + CountryCodeGy, + CountryCodeHt, + CountryCodeHm, + CountryCodeVa, + CountryCodeHn, + CountryCodeHk, + CountryCodeHu, + CountryCodeIs, + CountryCodeIn, + CountryCodeId, + CountryCodeIr, + CountryCodeIq, + CountryCodeIe, + CountryCodeIm, + CountryCodeIl, + CountryCodeIt, + CountryCodeJm, + CountryCodeJp, + CountryCodeJe, + CountryCodeJo, + CountryCodeKz, + CountryCodeKe, + CountryCodeKi, + CountryCodeKp, + CountryCodeKr, + CountryCodeKw, + CountryCodeKg, + CountryCodeLa, + CountryCodeLv, + CountryCodeLb, + CountryCodeLs, + CountryCodeLr, + CountryCodeLy, + CountryCodeLi, + CountryCodeLt, + CountryCodeLu, + CountryCodeMo, + CountryCodeMk, + CountryCodeMg, + CountryCodeMw, + CountryCodeMy, + CountryCodeMv, + CountryCodeMl, + CountryCodeMt, + CountryCodeMh, + CountryCodeMq, + CountryCodeMr, + CountryCodeMu, + CountryCodeYt, + CountryCodeMx, + CountryCodeFm, + CountryCodeMd, + CountryCodeMc, + CountryCodeMn, + CountryCodeMe, + CountryCodeMs, + CountryCodeMa, + CountryCodeMz, + CountryCodeMm, + CountryCodeNa, + CountryCodeNr, + CountryCodeNp, + CountryCodeNl, + CountryCodeNc, + CountryCodeNz, + CountryCodeNi, + CountryCodeNe, + CountryCodeNg, + CountryCodeNu, + CountryCodeNf, + CountryCodeMp, + CountryCodeNo, + CountryCodeOm, + CountryCodePk, + CountryCodePw, + CountryCodePs, + CountryCodePa, + CountryCodePg, + CountryCodePy, + CountryCodePe, + CountryCodePh, + CountryCodePn, + CountryCodePl, + CountryCodePt, + CountryCodePr, + CountryCodeQa, + CountryCodeRe, + CountryCodeRo, + CountryCodeRu, + CountryCodeRw, + CountryCodeBl, + CountryCodeSh, + CountryCodeKn, + CountryCodeLc, + CountryCodeMf, + CountryCodePm, + CountryCodeVc, + CountryCodeWs, + CountryCodeSm, + CountryCodeSt, + CountryCodeSa, + CountryCodeSn, + CountryCodeRs, + CountryCodeSc, + CountryCodeSl, + CountryCodeSg, + CountryCodeSx, + CountryCodeSk, + CountryCodeSi, + CountryCodeSb, + CountryCodeSo, + CountryCodeZa, + CountryCodeGs, + CountryCodeSs, + CountryCodeEs, + CountryCodeLk, + CountryCodeSd, + CountryCodeSr, + CountryCodeSj, + CountryCodeSz, + CountryCodeSe, + CountryCodeCh, + CountryCodeSy, + CountryCodeTw, + CountryCodeTj, + CountryCodeTz, + CountryCodeTh, + CountryCodeTl, + CountryCodeTg, + CountryCodeTk, + CountryCodeTo, + CountryCodeTt, + CountryCodeTn, + CountryCodeTr, + CountryCodeTm, + CountryCodeTc, + CountryCodeTv, + CountryCodeUg, + CountryCodeUa, + CountryCodeAe, + CountryCodeGb, + CountryCodeUs, + CountryCodeUm, + CountryCodeUy, + CountryCodeUz, + CountryCodeVu, + CountryCodeVe, + CountryCodeVn, + CountryCodeVg, + CountryCodeVi, + CountryCodeWf, + CountryCodeEh, + CountryCodeYe, + CountryCodeZm, + CountryCodeZw, + } +} + +const ( + // FallbackBehaviorMatch is a FallbackBehavior enum value + FallbackBehaviorMatch = "MATCH" + + // FallbackBehaviorNoMatch is a FallbackBehavior enum value + FallbackBehaviorNoMatch = "NO_MATCH" +) + +// FallbackBehavior_Values returns all elements of the FallbackBehavior enum +func FallbackBehavior_Values() []string { + return []string{ + FallbackBehaviorMatch, + FallbackBehaviorNoMatch, + } +} + +const ( + // ForwardedIPPositionFirst is a ForwardedIPPosition enum value + ForwardedIPPositionFirst = "FIRST" + + // ForwardedIPPositionLast is a ForwardedIPPosition enum value + ForwardedIPPositionLast = "LAST" + + // ForwardedIPPositionAny is a ForwardedIPPosition enum value + ForwardedIPPositionAny = "ANY" +) + +// ForwardedIPPosition_Values returns all elements of the ForwardedIPPosition enum +func ForwardedIPPosition_Values() []string { + return []string{ + ForwardedIPPositionFirst, + ForwardedIPPositionLast, + ForwardedIPPositionAny, + } +} + +const ( + // IPAddressVersionIpv4 is a IPAddressVersion enum value + IPAddressVersionIpv4 = "IPV4" + + // IPAddressVersionIpv6 is a IPAddressVersion enum value + IPAddressVersionIpv6 = "IPV6" +) + +// IPAddressVersion_Values returns all elements of the IPAddressVersion enum +func IPAddressVersion_Values() []string { + return []string{ + IPAddressVersionIpv4, + IPAddressVersionIpv6, + } +} + +const ( + // ParameterExceptionFieldWebAcl is a ParameterExceptionField enum value + ParameterExceptionFieldWebAcl = "WEB_ACL" + + // ParameterExceptionFieldRuleGroup is a ParameterExceptionField enum value + ParameterExceptionFieldRuleGroup = "RULE_GROUP" + + // ParameterExceptionFieldRegexPatternSet is a ParameterExceptionField enum value + ParameterExceptionFieldRegexPatternSet = "REGEX_PATTERN_SET" + + // ParameterExceptionFieldIpSet is a ParameterExceptionField enum value + ParameterExceptionFieldIpSet = "IP_SET" + + // ParameterExceptionFieldManagedRuleSet is a ParameterExceptionField enum value + ParameterExceptionFieldManagedRuleSet = "MANAGED_RULE_SET" + + // ParameterExceptionFieldRule is a ParameterExceptionField enum value + ParameterExceptionFieldRule = "RULE" + + // ParameterExceptionFieldExcludedRule is a ParameterExceptionField enum value + ParameterExceptionFieldExcludedRule = "EXCLUDED_RULE" + + // ParameterExceptionFieldStatement is a ParameterExceptionField enum value + ParameterExceptionFieldStatement = "STATEMENT" + + // ParameterExceptionFieldByteMatchStatement is a ParameterExceptionField enum value + ParameterExceptionFieldByteMatchStatement = "BYTE_MATCH_STATEMENT" + + // ParameterExceptionFieldSqliMatchStatement is a ParameterExceptionField enum value + ParameterExceptionFieldSqliMatchStatement = "SQLI_MATCH_STATEMENT" + + // ParameterExceptionFieldXssMatchStatement is a ParameterExceptionField enum value + ParameterExceptionFieldXssMatchStatement = "XSS_MATCH_STATEMENT" + + // ParameterExceptionFieldSizeConstraintStatement is a ParameterExceptionField enum value + ParameterExceptionFieldSizeConstraintStatement = "SIZE_CONSTRAINT_STATEMENT" + + // ParameterExceptionFieldGeoMatchStatement is a ParameterExceptionField enum value + ParameterExceptionFieldGeoMatchStatement = "GEO_MATCH_STATEMENT" + + // ParameterExceptionFieldRateBasedStatement is a ParameterExceptionField enum value + ParameterExceptionFieldRateBasedStatement = "RATE_BASED_STATEMENT" + + // ParameterExceptionFieldRuleGroupReferenceStatement is a ParameterExceptionField enum value + ParameterExceptionFieldRuleGroupReferenceStatement = "RULE_GROUP_REFERENCE_STATEMENT" + + // ParameterExceptionFieldRegexPatternReferenceStatement is a ParameterExceptionField enum value + ParameterExceptionFieldRegexPatternReferenceStatement = "REGEX_PATTERN_REFERENCE_STATEMENT" + + // ParameterExceptionFieldIpSetReferenceStatement is a ParameterExceptionField enum value + ParameterExceptionFieldIpSetReferenceStatement = "IP_SET_REFERENCE_STATEMENT" + + // ParameterExceptionFieldManagedRuleSetStatement is a ParameterExceptionField enum value + ParameterExceptionFieldManagedRuleSetStatement = "MANAGED_RULE_SET_STATEMENT" + + // ParameterExceptionFieldAndStatement is a ParameterExceptionField enum value + ParameterExceptionFieldAndStatement = "AND_STATEMENT" + + // ParameterExceptionFieldOrStatement is a ParameterExceptionField enum value + ParameterExceptionFieldOrStatement = "OR_STATEMENT" + + // ParameterExceptionFieldNotStatement is a ParameterExceptionField enum value + ParameterExceptionFieldNotStatement = "NOT_STATEMENT" + + // ParameterExceptionFieldIpAddress is a ParameterExceptionField enum value + ParameterExceptionFieldIpAddress = "IP_ADDRESS" + + // ParameterExceptionFieldIpAddressVersion is a ParameterExceptionField enum value + ParameterExceptionFieldIpAddressVersion = "IP_ADDRESS_VERSION" + + // ParameterExceptionFieldFieldToMatch is a ParameterExceptionField enum value + ParameterExceptionFieldFieldToMatch = "FIELD_TO_MATCH" + + // ParameterExceptionFieldTextTransformation is a ParameterExceptionField enum value + ParameterExceptionFieldTextTransformation = "TEXT_TRANSFORMATION" + + // ParameterExceptionFieldSingleQueryArgument is a ParameterExceptionField enum value + ParameterExceptionFieldSingleQueryArgument = "SINGLE_QUERY_ARGUMENT" + + // ParameterExceptionFieldSingleHeader is a ParameterExceptionField enum value + ParameterExceptionFieldSingleHeader = "SINGLE_HEADER" + + // ParameterExceptionFieldDefaultAction is a ParameterExceptionField enum value + ParameterExceptionFieldDefaultAction = "DEFAULT_ACTION" + + // ParameterExceptionFieldRuleAction is a ParameterExceptionField enum value + ParameterExceptionFieldRuleAction = "RULE_ACTION" + + // ParameterExceptionFieldEntityLimit is a ParameterExceptionField enum value + ParameterExceptionFieldEntityLimit = "ENTITY_LIMIT" + + // ParameterExceptionFieldOverrideAction is a ParameterExceptionField enum value + ParameterExceptionFieldOverrideAction = "OVERRIDE_ACTION" + + // ParameterExceptionFieldScopeValue is a ParameterExceptionField enum value + ParameterExceptionFieldScopeValue = "SCOPE_VALUE" + + // ParameterExceptionFieldResourceArn is a ParameterExceptionField enum value + ParameterExceptionFieldResourceArn = "RESOURCE_ARN" + + // ParameterExceptionFieldResourceType is a ParameterExceptionField enum value + ParameterExceptionFieldResourceType = "RESOURCE_TYPE" + + // ParameterExceptionFieldTags is a ParameterExceptionField enum value + ParameterExceptionFieldTags = "TAGS" + + // ParameterExceptionFieldTagKeys is a ParameterExceptionField enum value + ParameterExceptionFieldTagKeys = "TAG_KEYS" + + // ParameterExceptionFieldMetricName is a ParameterExceptionField enum value + ParameterExceptionFieldMetricName = "METRIC_NAME" + + // ParameterExceptionFieldFirewallManagerStatement is a ParameterExceptionField enum value + ParameterExceptionFieldFirewallManagerStatement = "FIREWALL_MANAGER_STATEMENT" + + // ParameterExceptionFieldFallbackBehavior is a ParameterExceptionField enum value + ParameterExceptionFieldFallbackBehavior = "FALLBACK_BEHAVIOR" + + // ParameterExceptionFieldPosition is a ParameterExceptionField enum value + ParameterExceptionFieldPosition = "POSITION" + + // ParameterExceptionFieldForwardedIpConfig is a ParameterExceptionField enum value + ParameterExceptionFieldForwardedIpConfig = "FORWARDED_IP_CONFIG" + + // ParameterExceptionFieldIpSetForwardedIpConfig is a ParameterExceptionField enum value + ParameterExceptionFieldIpSetForwardedIpConfig = "IP_SET_FORWARDED_IP_CONFIG" + + // ParameterExceptionFieldHeaderName is a ParameterExceptionField enum value + ParameterExceptionFieldHeaderName = "HEADER_NAME" +) + +// ParameterExceptionField_Values returns all elements of the ParameterExceptionField enum +func ParameterExceptionField_Values() []string { + return []string{ + ParameterExceptionFieldWebAcl, + ParameterExceptionFieldRuleGroup, + ParameterExceptionFieldRegexPatternSet, + ParameterExceptionFieldIpSet, + ParameterExceptionFieldManagedRuleSet, + ParameterExceptionFieldRule, + ParameterExceptionFieldExcludedRule, + ParameterExceptionFieldStatement, + ParameterExceptionFieldByteMatchStatement, + ParameterExceptionFieldSqliMatchStatement, + ParameterExceptionFieldXssMatchStatement, + ParameterExceptionFieldSizeConstraintStatement, + ParameterExceptionFieldGeoMatchStatement, + ParameterExceptionFieldRateBasedStatement, + ParameterExceptionFieldRuleGroupReferenceStatement, + ParameterExceptionFieldRegexPatternReferenceStatement, + ParameterExceptionFieldIpSetReferenceStatement, + ParameterExceptionFieldManagedRuleSetStatement, + ParameterExceptionFieldAndStatement, + ParameterExceptionFieldOrStatement, + ParameterExceptionFieldNotStatement, + ParameterExceptionFieldIpAddress, + ParameterExceptionFieldIpAddressVersion, + ParameterExceptionFieldFieldToMatch, + ParameterExceptionFieldTextTransformation, + ParameterExceptionFieldSingleQueryArgument, + ParameterExceptionFieldSingleHeader, + ParameterExceptionFieldDefaultAction, + ParameterExceptionFieldRuleAction, + ParameterExceptionFieldEntityLimit, + ParameterExceptionFieldOverrideAction, + ParameterExceptionFieldScopeValue, + ParameterExceptionFieldResourceArn, + ParameterExceptionFieldResourceType, + ParameterExceptionFieldTags, + ParameterExceptionFieldTagKeys, + ParameterExceptionFieldMetricName, + ParameterExceptionFieldFirewallManagerStatement, + ParameterExceptionFieldFallbackBehavior, + ParameterExceptionFieldPosition, + ParameterExceptionFieldForwardedIpConfig, + ParameterExceptionFieldIpSetForwardedIpConfig, + ParameterExceptionFieldHeaderName, + } +} + +const ( + // PositionalConstraintExactly is a PositionalConstraint enum value + PositionalConstraintExactly = "EXACTLY" + + // PositionalConstraintStartsWith is a PositionalConstraint enum value + PositionalConstraintStartsWith = "STARTS_WITH" + + // PositionalConstraintEndsWith is a PositionalConstraint enum value + PositionalConstraintEndsWith = "ENDS_WITH" + + // PositionalConstraintContains is a PositionalConstraint enum value + PositionalConstraintContains = "CONTAINS" + + // PositionalConstraintContainsWord is a PositionalConstraint enum value + PositionalConstraintContainsWord = "CONTAINS_WORD" +) + +// PositionalConstraint_Values returns all elements of the PositionalConstraint enum +func PositionalConstraint_Values() []string { + return []string{ + PositionalConstraintExactly, + PositionalConstraintStartsWith, + PositionalConstraintEndsWith, + PositionalConstraintContains, + PositionalConstraintContainsWord, + } +} + +const ( + // RateBasedStatementAggregateKeyTypeIp is a RateBasedStatementAggregateKeyType enum value + RateBasedStatementAggregateKeyTypeIp = "IP" + + // RateBasedStatementAggregateKeyTypeForwardedIp is a RateBasedStatementAggregateKeyType enum value + RateBasedStatementAggregateKeyTypeForwardedIp = "FORWARDED_IP" +) + +// RateBasedStatementAggregateKeyType_Values returns all elements of the RateBasedStatementAggregateKeyType enum +func RateBasedStatementAggregateKeyType_Values() []string { + return []string{ + RateBasedStatementAggregateKeyTypeIp, + RateBasedStatementAggregateKeyTypeForwardedIp, + } +} + +const ( + // ResourceTypeApplicationLoadBalancer is a ResourceType enum value + ResourceTypeApplicationLoadBalancer = "APPLICATION_LOAD_BALANCER" + + // ResourceTypeApiGateway is a ResourceType enum value + ResourceTypeApiGateway = "API_GATEWAY" + + // ResourceTypeAppsync is a ResourceType enum value + ResourceTypeAppsync = "APPSYNC" +) + +// ResourceType_Values returns all elements of the ResourceType enum +func ResourceType_Values() []string { + return []string{ + ResourceTypeApplicationLoadBalancer, + ResourceTypeApiGateway, + ResourceTypeAppsync, + } +} + +const ( + // ScopeCloudfront is a Scope enum value + ScopeCloudfront = "CLOUDFRONT" + + // ScopeRegional is a Scope enum value + ScopeRegional = "REGIONAL" +) + +// Scope_Values returns all elements of the Scope enum +func Scope_Values() []string { + return []string{ + ScopeCloudfront, + ScopeRegional, + } +} + +const ( + // TextTransformationTypeNone is a TextTransformationType enum value + TextTransformationTypeNone = "NONE" + + // TextTransformationTypeCompressWhiteSpace is a TextTransformationType enum value + TextTransformationTypeCompressWhiteSpace = "COMPRESS_WHITE_SPACE" + + // TextTransformationTypeHtmlEntityDecode is a TextTransformationType enum value + TextTransformationTypeHtmlEntityDecode = "HTML_ENTITY_DECODE" + + // TextTransformationTypeLowercase is a TextTransformationType enum value + TextTransformationTypeLowercase = "LOWERCASE" + + // TextTransformationTypeCmdLine is a TextTransformationType enum value + TextTransformationTypeCmdLine = "CMD_LINE" + + // TextTransformationTypeUrlDecode is a TextTransformationType enum value + TextTransformationTypeUrlDecode = "URL_DECODE" +) + +// TextTransformationType_Values returns all elements of the TextTransformationType enum +func TextTransformationType_Values() []string { + return []string{ + TextTransformationTypeNone, + TextTransformationTypeCompressWhiteSpace, + TextTransformationTypeHtmlEntityDecode, + TextTransformationTypeLowercase, + TextTransformationTypeCmdLine, + TextTransformationTypeUrlDecode, + } +} diff --git a/vendor/github.com/aws/aws-sdk-go/service/wafv2/doc.go b/vendor/github.com/aws/aws-sdk-go/service/wafv2/doc.go new file mode 100644 index 0000000000..7b4202efbe --- /dev/null +++ b/vendor/github.com/aws/aws-sdk-go/service/wafv2/doc.go @@ -0,0 +1,88 @@ +// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. + +// Package wafv2 provides the client and types for making API +// requests to AWS WAFV2. +// +// +// This is the latest version of the AWS WAF API, released in November, 2019. +// The names of the entities that you use to access this API, like endpoints +// and namespaces, all have the versioning information added, like "V2" or "v2", +// to distinguish from the prior version. We recommend migrating your resources +// to this version, because it has a number of significant improvements. +// +// If you used AWS WAF prior to this release, you can't use this AWS WAFV2 API +// to access any AWS WAF resources that you created before. You can access your +// old rules, web ACLs, and other AWS WAF resources only through the AWS WAF +// Classic APIs. The AWS WAF Classic APIs have retained the prior names, endpoints, +// and namespaces. +// +// For information, including how to migrate your AWS WAF resources to this +// version, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). +// +// AWS WAF is a web application firewall that lets you monitor the HTTP and +// HTTPS requests that are forwarded to Amazon CloudFront, an Amazon API Gateway +// REST API, an Application Load Balancer, or an AWS AppSync GraphQL API. AWS +// WAF also lets you control access to your content. Based on conditions that +// you specify, such as the IP addresses that requests originate from or the +// values of query strings, the API Gateway REST API, CloudFront distribution, +// the Application Load Balancer, or the AWS AppSync GraphQL API responds to +// requests either with the requested content or with an HTTP 403 status code +// (Forbidden). You also can configure CloudFront to return a custom error page +// when a request is blocked. +// +// This API guide is for developers who need detailed information about AWS +// WAF API actions, data types, and errors. For detailed information about AWS +// WAF features and an overview of how to use AWS WAF, see the AWS WAF Developer +// Guide (https://docs.aws.amazon.com/waf/latest/developerguide/). +// +// You can make calls using the endpoints listed in AWS Service Endpoints for +// AWS WAF (https://docs.aws.amazon.com/general/latest/gr/rande.html#waf_region). +// +// * For regional applications, you can use any of the endpoints in the list. +// A regional application can be an Application Load Balancer (ALB), an API +// Gateway REST API, or an AppSync GraphQL API. +// +// * For AWS CloudFront applications, you must use the API endpoint listed +// for US East (N. Virginia): us-east-1. +// +// Alternatively, you can use one of the AWS SDKs to access an API that's tailored +// to the programming language or platform that you're using. For more information, +// see AWS SDKs (http://aws.amazon.com/tools/#SDKs). +// +// We currently provide two versions of the AWS WAF API: this API and the prior +// versions, the classic AWS WAF APIs. This new API provides the same functionality +// as the older versions, with the following major improvements: +// +// * You use one API for both global and regional applications. Where you +// need to distinguish the scope, you specify a Scope parameter and set it +// to CLOUDFRONT or REGIONAL. +// +// * You can define a Web ACL or rule group with a single call, and update +// it with a single call. You define all rule specifications in JSON format, +// and pass them to your rule group or Web ACL calls. +// +// * The limits AWS WAF places on the use of rules more closely reflects +// the cost of running each type of rule. Rule groups include capacity settings, +// so you know the maximum cost of a rule group when you use it. +// +// See https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29 for more information on this service. +// +// See wafv2 package documentation for more information. +// https://docs.aws.amazon.com/sdk-for-go/api/service/wafv2/ +// +// Using the Client +// +// To contact AWS WAFV2 with the SDK use the New function to create +// a new service client. With that client you can make API requests to the service. +// These clients are safe to use concurrently. +// +// See the SDK's documentation for more information on how to use the SDK. +// https://docs.aws.amazon.com/sdk-for-go/api/ +// +// See aws.Config documentation for more information on configuring SDK clients. +// https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config +// +// See the AWS WAFV2 client WAFV2 for more +// information on creating client for this service. +// https://docs.aws.amazon.com/sdk-for-go/api/service/wafv2/#New +package wafv2 diff --git a/vendor/github.com/aws/aws-sdk-go/service/wafv2/errors.go b/vendor/github.com/aws/aws-sdk-go/service/wafv2/errors.go new file mode 100644 index 0000000000..e3d65731f7 --- /dev/null +++ b/vendor/github.com/aws/aws-sdk-go/service/wafv2/errors.go @@ -0,0 +1,163 @@ +// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. + +package wafv2 + +import ( + "github.com/aws/aws-sdk-go/private/protocol" +) + +const ( + + // ErrCodeWAFAssociatedItemException for service response error code + // "WAFAssociatedItemException". + // + // AWS WAF couldn’t perform the operation because your resource is being used + // by another resource or it’s associated with another resource. + ErrCodeWAFAssociatedItemException = "WAFAssociatedItemException" + + // ErrCodeWAFDuplicateItemException for service response error code + // "WAFDuplicateItemException". + // + // AWS WAF couldn’t perform the operation because the resource that you tried + // to save is a duplicate of an existing one. + ErrCodeWAFDuplicateItemException = "WAFDuplicateItemException" + + // ErrCodeWAFInternalErrorException for service response error code + // "WAFInternalErrorException". + // + // Your request is valid, but AWS WAF couldn’t perform the operation because + // of a system problem. Retry your request. + ErrCodeWAFInternalErrorException = "WAFInternalErrorException" + + // ErrCodeWAFInvalidOperationException for service response error code + // "WAFInvalidOperationException". + // + // The operation isn't valid. + ErrCodeWAFInvalidOperationException = "WAFInvalidOperationException" + + // ErrCodeWAFInvalidParameterException for service response error code + // "WAFInvalidParameterException". + // + // The operation failed because AWS WAF didn't recognize a parameter in the + // request. For example: + // + // * You specified an invalid parameter name or value. + // + // * Your nested statement isn't valid. You might have tried to nest a statement + // that can’t be nested. + // + // * You tried to update a WebACL with a DefaultAction that isn't among the + // types available at DefaultAction. + // + // * Your request references an ARN that is malformed, or corresponds to + // a resource with which a Web ACL cannot be associated. + ErrCodeWAFInvalidParameterException = "WAFInvalidParameterException" + + // ErrCodeWAFInvalidPermissionPolicyException for service response error code + // "WAFInvalidPermissionPolicyException". + // + // The operation failed because the specified policy isn't in the proper format. + // + // The policy specifications must conform to the following: + // + // * The policy must be composed using IAM Policy version 2012-10-17 or version + // 2015-01-01. + // + // * The policy must include specifications for Effect, Action, and Principal. + // + // * Effect must specify Allow. + // + // * Action must specify wafv2:CreateWebACL, wafv2:UpdateWebACL, and wafv2:PutFirewallManagerRuleGroups. + // AWS WAF rejects any extra actions or wildcard actions in the policy. + // + // * The policy must not include a Resource parameter. + // + // For more information, see IAM Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html). + ErrCodeWAFInvalidPermissionPolicyException = "WAFInvalidPermissionPolicyException" + + // ErrCodeWAFInvalidResourceException for service response error code + // "WAFInvalidResourceException". + // + // AWS WAF couldn’t perform the operation because the resource that you requested + // isn’t valid. Check the resource, and try again. + ErrCodeWAFInvalidResourceException = "WAFInvalidResourceException" + + // ErrCodeWAFLimitsExceededException for service response error code + // "WAFLimitsExceededException". + // + // AWS WAF couldn’t perform the operation because you exceeded your resource + // limit. For example, the maximum number of WebACL objects that you can create + // for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) + // in the AWS WAF Developer Guide. + ErrCodeWAFLimitsExceededException = "WAFLimitsExceededException" + + // ErrCodeWAFNonexistentItemException for service response error code + // "WAFNonexistentItemException". + // + // AWS WAF couldn’t perform the operation because your resource doesn’t + // exist. + ErrCodeWAFNonexistentItemException = "WAFNonexistentItemException" + + // ErrCodeWAFOptimisticLockException for service response error code + // "WAFOptimisticLockException". + // + // AWS WAF couldn’t save your changes because you tried to update or delete + // a resource that has changed since you last retrieved it. Get the resource + // again, make any changes you need to make to the new copy, and retry your + // operation. + ErrCodeWAFOptimisticLockException = "WAFOptimisticLockException" + + // ErrCodeWAFServiceLinkedRoleErrorException for service response error code + // "WAFServiceLinkedRoleErrorException". + // + // AWS WAF is not able to access the service linked role. This can be caused + // by a previous PutLoggingConfiguration request, which can lock the service + // linked role for about 20 seconds. Please try your request again. The service + // linked role can also be locked by a previous DeleteServiceLinkedRole request, + // which can lock the role for 15 minutes or more. If you recently made a call + // to DeleteServiceLinkedRole, wait at least 15 minutes and try the request + // again. If you receive this same exception again, you will have to wait additional + // time until the role is unlocked. + ErrCodeWAFServiceLinkedRoleErrorException = "WAFServiceLinkedRoleErrorException" + + // ErrCodeWAFSubscriptionNotFoundException for service response error code + // "WAFSubscriptionNotFoundException". + ErrCodeWAFSubscriptionNotFoundException = "WAFSubscriptionNotFoundException" + + // ErrCodeWAFTagOperationException for service response error code + // "WAFTagOperationException". + // + // An error occurred during the tagging operation. Retry your request. + ErrCodeWAFTagOperationException = "WAFTagOperationException" + + // ErrCodeWAFTagOperationInternalErrorException for service response error code + // "WAFTagOperationInternalErrorException". + // + // AWS WAF couldn’t perform your tagging operation because of an internal + // error. Retry your request. + ErrCodeWAFTagOperationInternalErrorException = "WAFTagOperationInternalErrorException" + + // ErrCodeWAFUnavailableEntityException for service response error code + // "WAFUnavailableEntityException". + // + // AWS WAF couldn’t retrieve the resource that you requested. Retry your request. + ErrCodeWAFUnavailableEntityException = "WAFUnavailableEntityException" +) + +var exceptionFromCode = map[string]func(protocol.ResponseMetadata) error{ + "WAFAssociatedItemException": newErrorWAFAssociatedItemException, + "WAFDuplicateItemException": newErrorWAFDuplicateItemException, + "WAFInternalErrorException": newErrorWAFInternalErrorException, + "WAFInvalidOperationException": newErrorWAFInvalidOperationException, + "WAFInvalidParameterException": newErrorWAFInvalidParameterException, + "WAFInvalidPermissionPolicyException": newErrorWAFInvalidPermissionPolicyException, + "WAFInvalidResourceException": newErrorWAFInvalidResourceException, + "WAFLimitsExceededException": newErrorWAFLimitsExceededException, + "WAFNonexistentItemException": newErrorWAFNonexistentItemException, + "WAFOptimisticLockException": newErrorWAFOptimisticLockException, + "WAFServiceLinkedRoleErrorException": newErrorWAFServiceLinkedRoleErrorException, + "WAFSubscriptionNotFoundException": newErrorWAFSubscriptionNotFoundException, + "WAFTagOperationException": newErrorWAFTagOperationException, + "WAFTagOperationInternalErrorException": newErrorWAFTagOperationInternalErrorException, + "WAFUnavailableEntityException": newErrorWAFUnavailableEntityException, +} diff --git a/vendor/github.com/aws/aws-sdk-go/service/wafv2/service.go b/vendor/github.com/aws/aws-sdk-go/service/wafv2/service.go new file mode 100644 index 0000000000..26dda56194 --- /dev/null +++ b/vendor/github.com/aws/aws-sdk-go/service/wafv2/service.go @@ -0,0 +1,103 @@ +// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. + +package wafv2 + +import ( + "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/client" + "github.com/aws/aws-sdk-go/aws/client/metadata" + "github.com/aws/aws-sdk-go/aws/request" + "github.com/aws/aws-sdk-go/aws/signer/v4" + "github.com/aws/aws-sdk-go/private/protocol" + "github.com/aws/aws-sdk-go/private/protocol/jsonrpc" +) + +// WAFV2 provides the API operation methods for making requests to +// AWS WAFV2. See this package's package overview docs +// for details on the service. +// +// WAFV2 methods are safe to use concurrently. It is not safe to +// modify mutate any of the struct's properties though. +type WAFV2 struct { + *client.Client +} + +// Used for custom client initialization logic +var initClient func(*client.Client) + +// Used for custom request initialization logic +var initRequest func(*request.Request) + +// Service information constants +const ( + ServiceName = "WAFV2" // Name of service. + EndpointsID = "wafv2" // ID to lookup a service endpoint with. + ServiceID = "WAFV2" // ServiceID is a unique identifier of a specific service. +) + +// New creates a new instance of the WAFV2 client with a session. +// If additional configuration is needed for the client instance use the optional +// aws.Config parameter to add your extra config. +// +// Example: +// mySession := session.Must(session.NewSession()) +// +// // Create a WAFV2 client from just a session. +// svc := wafv2.New(mySession) +// +// // Create a WAFV2 client with additional configuration +// svc := wafv2.New(mySession, aws.NewConfig().WithRegion("us-west-2")) +func New(p client.ConfigProvider, cfgs ...*aws.Config) *WAFV2 { + c := p.ClientConfig(EndpointsID, cfgs...) + return newClient(*c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName) +} + +// newClient creates, initializes and returns a new service client instance. +func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint, signingRegion, signingName string) *WAFV2 { + svc := &WAFV2{ + Client: client.New( + cfg, + metadata.ClientInfo{ + ServiceName: ServiceName, + ServiceID: ServiceID, + SigningName: signingName, + SigningRegion: signingRegion, + PartitionID: partitionID, + Endpoint: endpoint, + APIVersion: "2019-07-29", + JSONVersion: "1.1", + TargetPrefix: "AWSWAF_20190729", + }, + handlers, + ), + } + + // Handlers + svc.Handlers.Sign.PushBackNamed(v4.SignRequestHandler) + svc.Handlers.Build.PushBackNamed(jsonrpc.BuildHandler) + svc.Handlers.Unmarshal.PushBackNamed(jsonrpc.UnmarshalHandler) + svc.Handlers.UnmarshalMeta.PushBackNamed(jsonrpc.UnmarshalMetaHandler) + svc.Handlers.UnmarshalError.PushBackNamed( + protocol.NewUnmarshalErrorHandler(jsonrpc.NewUnmarshalTypedError(exceptionFromCode)).NamedHandler(), + ) + + // Run custom client initialization if present + if initClient != nil { + initClient(svc.Client) + } + + return svc +} + +// newRequest creates a new request for a WAFV2 operation and runs any +// custom request initialization. +func (c *WAFV2) newRequest(op *request.Operation, params, data interface{}) *request.Request { + req := c.NewRequest(op, params, data) + + // Run custom request initialization if present + if initRequest != nil { + initRequest(req) + } + + return req +} diff --git a/vendor/modules.txt b/vendor/modules.txt index 1455c84829..8be7800a12 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -183,6 +183,7 @@ github.com/aws/aws-sdk-go/service/route53 github.com/aws/aws-sdk-go/service/s3 github.com/aws/aws-sdk-go/service/sts github.com/aws/aws-sdk-go/service/sts/stsiface +github.com/aws/aws-sdk-go/service/wafv2 # github.com/beevik/etree v1.1.0 github.com/beevik/etree # github.com/benbjohnson/clock v1.0.0 From 32bfd5211f19cbf1d53d7116ad565dd2b758dc6e Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Fri, 18 Jun 2021 23:42:14 +0800 Subject: [PATCH 07/10] fix: update README to add user list and bilibili URL --- README-CN.md | 6 ++++++ README.md | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/README-CN.md b/README-CN.md index 6408e1bf15..506c878837 100644 --- a/README-CN.md +++ b/README-CN.md @@ -122,12 +122,18 @@ $ git clone https://github.com/yunionio/ocboot && cd ./ocboot && ./run.py 10.168 * [Swagger API文档](https://www.cloudpods.org/zh/docs/swagger/) +## 谁在使用Cloudpods？ + +请在[这里](https://github.com/yunionio/cloudpods/issues/11427)查看Cloudpods用户列表。如果你正在使用Cloudpods，欢迎回复留下你的信息。谢谢对Cloudpods的支持！ + ## 联系我们 您可以通过如下方式联系我们： * Reddit: [r/Cloudpods](https://www.reddit.com/r/Cloudpods/) +* 哔哩哔哩: [Cloudpods](https://space.bilibili.com/623431553/) + * 微信: 请扫描如下二维码联系我们 WeChat QRCode diff --git a/README.md b/README.md index f3958c85f6..966f39fdf9 100644 --- a/README.md +++ b/README.md @@ -127,12 +127,18 @@ For more detailed instructions, please refers to [quick start](https://www.cloud * [Swagger API](https://www.cloudpods.org/en/docs/swagger/) +## Who is using Cloudpods? + +Please check this [issue](https://github.com/yunionio/cloudpods/issues/11427) for the user list of Cloudpods. If you are using Cloudpods, you are welcome to leave your information by responding the issue. Thank you for your support. + ## Contact You may contact us by: * Reddit: [r/Cloudpods](https://www.reddit.com/r/Cloudpods/) +* Bilibili: [Cloudpods](https://space.bilibili.com/623431553/) + * WeChat: please scan the following QRCode to contact us WeChat QRCode From d0a7d89f3e908e51971ec694e6a73e3458056602 Mon Sep 17 00:00:00 2001 From: Jian Qiu Date: Sat, 19 Jun 2021 00:03:50 +0800 Subject: [PATCH 08/10] Create CODE_OF_CONDUCT.md --- CODE_OF_CONDUCT.md | 128 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 128 insertions(+) create mode 100644 CODE_OF_CONDUCT.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000000..dea6d60b50 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,128 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity +and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +abuse@cloudpods.org. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series +of actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or +permanent ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within +the community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.0, available at +https://www.contributor-covenant.org/version/2/0/code_of_conduct.html. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct +enforcement ladder](https://github.com/mozilla/diversity). + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see the FAQ at +https://www.contributor-covenant.org/faq. Translations are available at +https://www.contributor-covenant.org/translations. From 54250d3d800c5074c6718ec6d476d5c89cecf0a1 Mon Sep 17 00:00:00 2001 From: Zexi Li Date: Mon, 21 Jun 2021 10:29:41 +0800 Subject: [PATCH 09/10] fix(baremetal): remove bundle libs build --- build/docker/Dockerfile.baremetal-agent | 8 +++++--- scripts/docker_push.sh | 24 ++++++++++++------------ 2 files changed, 17 insertions(+), 15 deletions(-) diff --git a/build/docker/Dockerfile.baremetal-agent b/build/docker/Dockerfile.baremetal-agent index f076ce22d0..613c0d8062 100644 --- a/build/docker/Dockerfile.baremetal-agent +++ b/build/docker/Dockerfile.baremetal-agent @@ -4,6 +4,8 @@ MAINTAINER "Zexi Li " RUN mkdir -p /opt/yunion/bin -ADD ./_output/bin/baremetal-agent /opt/yunion/bin/baremetal-agent -ADD ./_output/bin/.baremetal-agent.bin /opt/yunion/bin/.baremetal-agent.bin -ADD ./_output/bin/bundles/baremetal-agent /opt/yunion/bin/bundles/baremetal-agent +#ADD ./_output/bin/baremetal-agent /opt/yunion/bin/baremetal-agent +#ADD ./_output/bin/.baremetal-agent.bin /opt/yunion/bin/.baremetal-agent.bin +#ADD ./_output/bin/bundles/baremetal-agent /opt/yunion/bin/bundles/baremetal-agent +RUN apk add librados librbd +ADD ./_output/alpine-build/bin/baremetal-agent /opt/yunion/bin/baremetal-agent diff --git a/scripts/docker_push.sh b/scripts/docker_push.sh index 7a3238ed2a..f46161e708 100755 --- a/scripts/docker_push.sh +++ b/scripts/docker_push.sh @@ -63,11 +63,11 @@ build_bin() { local BUILD_ARCH=$2 local BUILD_CGO=$3 case "$1" in - baremetal-agent) - rm -vf _output/bin/$1 - rm -rvf _output/bin/bundles/$1 - GOOS=linux make cmd/$1 - ;; + # baremetal-agent) + # rm -vf _output/bin/$1 + # rm -rvf _output/bin/bundles/$1 + # GOOS=linux make cmd/$1 + # ;; climc) if [[ "$BUILD_ARCH" == *arm64 ]]; then # exclude rbdcli for arm64 @@ -206,13 +206,13 @@ for component in $COMPONENTS; do continue fi echo "Start to build component: $component" - if [[ $component == baremetal-agent ]]; then - if [[ "$ARCH" == "arm64" ]]; then - continue - fi - build_process $component - continue - fi + # if [[ $component == baremetal-agent ]]; then + # if [[ "$ARCH" == "arm64" ]]; then + # continue + # fi + # build_process $component + # continue + # fi case "$ARCH" in all) From 9b493fb59317e96bec791f7e33f86639b4e139ec Mon Sep 17 00:00:00 2001 From: zhaoxiangchun <1422928955@qq.com> Date: Mon, 21 Jun 2021 16:08:48 +0800 Subject: [PATCH 10/10] fix(monitor): exit monitor engine in time when happen err --- pkg/monitor/alerting/engine.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/monitor/alerting/engine.go b/pkg/monitor/alerting/engine.go index 622a629486..18986c270e 100644 --- a/pkg/monitor/alerting/engine.go +++ b/pkg/monitor/alerting/engine.go @@ -211,6 +211,9 @@ func (e *AlertEngine) processJob(attemptID int, attemptChan chan int, cancelChan attemptChan <- (attemptID + 1) return } + log.Errorf("gt AlertingMaxAttempts, error: %v", evalContext.Error) + close(attemptChan) + return } // create new context with timeout for notifications