2015-02-03 20:56:13 +01:00
|
|
|
package openstack
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"log"
|
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/hashicorp/terraform/helper/hashcode"
|
|
|
|
"github.com/hashicorp/terraform/helper/schema"
|
2015-02-17 22:07:01 +01:00
|
|
|
"github.com/rackspace/gophercloud"
|
2015-02-03 20:56:13 +01:00
|
|
|
"github.com/rackspace/gophercloud/openstack/networking/v2/extensions/fwaas/policies"
|
|
|
|
)
|
|
|
|
|
2015-02-19 22:55:54 +01:00
|
|
|
func resourceFWPolicyV1() *schema.Resource {
|
2015-02-03 20:56:13 +01:00
|
|
|
return &schema.Resource{
|
2015-02-19 22:55:54 +01:00
|
|
|
Create: resourceFWPolicyV1Create,
|
|
|
|
Read: resourceFWPolicyV1Read,
|
|
|
|
Update: resourceFWPolicyV1Update,
|
|
|
|
Delete: resourceFWPolicyV1Delete,
|
2015-02-03 20:56:13 +01:00
|
|
|
|
|
|
|
Schema: map[string]*schema.Schema{
|
|
|
|
"region": &schema.Schema{
|
|
|
|
Type: schema.TypeString,
|
|
|
|
Required: true,
|
|
|
|
ForceNew: true,
|
|
|
|
DefaultFunc: envDefaultFunc("OS_REGION_NAME"),
|
|
|
|
},
|
|
|
|
"name": &schema.Schema{
|
|
|
|
Type: schema.TypeString,
|
|
|
|
Optional: true,
|
|
|
|
},
|
|
|
|
"description": &schema.Schema{
|
|
|
|
Type: schema.TypeString,
|
|
|
|
Optional: true,
|
|
|
|
},
|
|
|
|
"audited": &schema.Schema{
|
|
|
|
Type: schema.TypeBool,
|
|
|
|
Optional: true,
|
|
|
|
Default: false,
|
|
|
|
},
|
|
|
|
"shared": &schema.Schema{
|
|
|
|
Type: schema.TypeBool,
|
|
|
|
Optional: true,
|
|
|
|
Default: false,
|
|
|
|
},
|
2015-02-10 00:19:01 +01:00
|
|
|
"tenant_id": &schema.Schema{
|
|
|
|
Type: schema.TypeString,
|
|
|
|
Optional: true,
|
|
|
|
ForceNew: true,
|
|
|
|
},
|
2015-02-03 20:56:13 +01:00
|
|
|
"rules": &schema.Schema{
|
|
|
|
Type: schema.TypeSet,
|
|
|
|
Optional: true,
|
|
|
|
Elem: &schema.Schema{Type: schema.TypeString},
|
|
|
|
Set: func(v interface{}) int {
|
|
|
|
return hashcode.String(v.(string))
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-02-19 22:55:54 +01:00
|
|
|
func resourceFWPolicyV1Create(d *schema.ResourceData, meta interface{}) error {
|
2015-02-03 20:56:13 +01:00
|
|
|
|
|
|
|
config := meta.(*Config)
|
|
|
|
networkingClient, err := config.networkingV2Client(d.Get("region").(string))
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Error creating OpenStack networking client: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
v := d.Get("rules").(*schema.Set)
|
|
|
|
|
|
|
|
log.Printf("[DEBUG] Rules found : %#v", v)
|
|
|
|
log.Printf("[DEBUG] Rules count : %d", v.Len())
|
|
|
|
|
|
|
|
rules := make([]string, v.Len())
|
|
|
|
for i, v := range v.List() {
|
|
|
|
rules[i] = v.(string)
|
|
|
|
}
|
|
|
|
|
2015-02-10 00:19:01 +01:00
|
|
|
audited := d.Get("audited").(bool)
|
|
|
|
shared := d.Get("shared").(bool)
|
|
|
|
|
2015-02-03 20:56:13 +01:00
|
|
|
opts := policies.CreateOpts{
|
|
|
|
Name: d.Get("name").(string),
|
|
|
|
Description: d.Get("description").(string),
|
2015-02-10 00:19:01 +01:00
|
|
|
Audited: &audited,
|
|
|
|
Shared: &shared,
|
|
|
|
TenantID: d.Get("tenant_id").(string),
|
|
|
|
Rules: rules,
|
2015-02-03 20:56:13 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
log.Printf("[DEBUG] Create firewall policy: %#v", opts)
|
|
|
|
|
|
|
|
policy, err := policies.Create(networkingClient, opts).Extract()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
log.Printf("[DEBUG] Firewall policy craeted: %#v", policy)
|
|
|
|
|
|
|
|
d.SetId(policy.ID)
|
|
|
|
|
2015-02-19 23:44:49 +01:00
|
|
|
return resourceFWPolicyV1Read(d, meta)
|
2015-02-03 20:56:13 +01:00
|
|
|
}
|
|
|
|
|
2015-02-19 22:55:54 +01:00
|
|
|
func resourceFWPolicyV1Read(d *schema.ResourceData, meta interface{}) error {
|
2015-02-03 20:56:13 +01:00
|
|
|
log.Printf("[DEBUG] Retrieve information about firewall policy: %s", d.Id())
|
|
|
|
|
|
|
|
config := meta.(*Config)
|
|
|
|
networkingClient, err := config.networkingV2Client(d.Get("region").(string))
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Error creating OpenStack networking client: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
policy, err := policies.Get(networkingClient, d.Id()).Extract()
|
|
|
|
|
|
|
|
if err != nil {
|
2015-02-19 23:31:19 +01:00
|
|
|
return CheckDeleted(d, err, "LB pool")
|
2015-02-03 20:56:13 +01:00
|
|
|
}
|
|
|
|
|
2015-02-18 01:27:45 +01:00
|
|
|
if t, exists := d.GetOk("name"); exists && t != "" {
|
|
|
|
d.Set("name", policy.Name)
|
|
|
|
} else {
|
|
|
|
d.Set("name", "")
|
|
|
|
}
|
|
|
|
|
|
|
|
if t, exists := d.GetOk("description"); exists && t != "" {
|
|
|
|
d.Set("description", policy.Description)
|
|
|
|
} else {
|
|
|
|
d.Set("description", "")
|
|
|
|
}
|
|
|
|
|
|
|
|
if t, exists := d.GetOk("shared"); exists && t != "" {
|
|
|
|
d.Set("shared", policy.Shared)
|
|
|
|
} else {
|
|
|
|
d.Set("shared", "")
|
|
|
|
}
|
|
|
|
|
|
|
|
if t, exists := d.GetOk("audited"); exists && t != "" {
|
|
|
|
d.Set("audited", policy.Audited)
|
|
|
|
} else {
|
|
|
|
d.Set("audited", "")
|
|
|
|
}
|
|
|
|
|
|
|
|
if t, exists := d.GetOk("tenant_id"); exists && t != "" {
|
|
|
|
d.Set("tenant_id", policy.TenantID)
|
|
|
|
} else {
|
|
|
|
d.Set("tenant_id", "")
|
|
|
|
}
|
2015-02-03 20:56:13 +01:00
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2015-02-19 22:55:54 +01:00
|
|
|
func resourceFWPolicyV1Update(d *schema.ResourceData, meta interface{}) error {
|
2015-02-03 20:56:13 +01:00
|
|
|
|
|
|
|
config := meta.(*Config)
|
|
|
|
networkingClient, err := config.networkingV2Client(d.Get("region").(string))
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Error creating OpenStack networking client: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
opts := policies.UpdateOpts{}
|
|
|
|
|
|
|
|
if d.HasChange("name") {
|
2015-02-17 22:07:01 +01:00
|
|
|
opts.Name = d.Get("name").(string)
|
2015-02-03 20:56:13 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
if d.HasChange("description") {
|
2015-02-17 22:07:01 +01:00
|
|
|
opts.Description = d.Get("description").(string)
|
2015-02-03 20:56:13 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
if d.HasChange("rules") {
|
|
|
|
v := d.Get("rules").(*schema.Set)
|
|
|
|
|
|
|
|
log.Printf("[DEBUG] Rules found : %#v", v)
|
|
|
|
log.Printf("[DEBUG] Rules count : %d", v.Len())
|
|
|
|
|
|
|
|
rules := make([]string, v.Len())
|
|
|
|
for i, v := range v.List() {
|
|
|
|
rules[i] = v.(string)
|
|
|
|
}
|
|
|
|
opts.Rules = rules
|
|
|
|
}
|
|
|
|
|
|
|
|
log.Printf("[DEBUG] Updating firewall policy with id %s: %#v", d.Id(), opts)
|
|
|
|
|
2015-02-19 23:44:49 +01:00
|
|
|
err = policies.Update(networkingClient, d.Id(), opts).Err
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return resourceFWPolicyV1Read(d, meta)
|
2015-02-03 20:56:13 +01:00
|
|
|
}
|
|
|
|
|
2015-02-19 22:55:54 +01:00
|
|
|
func resourceFWPolicyV1Delete(d *schema.ResourceData, meta interface{}) error {
|
2015-02-03 20:56:13 +01:00
|
|
|
log.Printf("[DEBUG] Destroy firewall policy: %s", d.Id())
|
|
|
|
|
|
|
|
config := meta.(*Config)
|
|
|
|
networkingClient, err := config.networkingV2Client(d.Get("region").(string))
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Error creating OpenStack networking client: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
for i := 0; i < 15; i++ {
|
|
|
|
|
|
|
|
err = policies.Delete(networkingClient, d.Id()).Err
|
|
|
|
if err == nil {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
|
2015-02-17 22:07:01 +01:00
|
|
|
httpError, ok := err.(*gophercloud.UnexpectedResponseCodeError)
|
2015-02-03 20:56:13 +01:00
|
|
|
if !ok || httpError.Actual != 409 {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// This error usualy means that the policy is attached
|
|
|
|
// to a firewall. At this point, the firewall is probably
|
|
|
|
// being delete. So, we retry a few times.
|
|
|
|
|
|
|
|
time.Sleep(time.Second * 2)
|
|
|
|
}
|
|
|
|
|
|
|
|
return err
|
|
|
|
}
|