Skip to content

Commit 01c7717

Browse files
bddvlprbddvlpr
committed
Allow 'all' on security group rule protocol
1 parent f19bffc commit 01c7717

2 files changed

Lines changed: 128 additions & 72 deletions

File tree

‎cloudstack/resource_cloudstack_security_group_rule.go‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,16 @@ func createSecurityGroupRule(d *schema.ResourceData, meta interface{}, rule map[
247247
// Set the protocol
248248
p.SetProtocol(rule["protocol"].(string))
249249

250+
if rule["protocol"].(string) == "all" {
251+
ruleID, err := createIngressOrEgressRule(cs, p)
252+
if err != nil {
253+
return err
254+
}
255+
256+
uuids[uuid+"all"] = ruleID
257+
rule["uuids"] = uuids
258+
}
259+
250260
// If the protocol is ICMP set the needed ICMP parameters
251261
if rule["protocol"].(string) == "icmp" {
252262
p.SetIcmptype(rule["icmp_type"].(int))
@@ -393,6 +403,33 @@ func readSecurityGroupRule(sg *cloudstack.SecurityGroup, ruleIndex map[string]in
393403
uuids := rule["uuids"].(map[string]interface{})
394404
sgRules := append(sg.Ingressrule, sg.Egressrule...)
395405

406+
if rule["protocol"].(string) == "all" {
407+
id, ok := uuids[uuid+"all"]
408+
if !ok {
409+
return
410+
}
411+
412+
// Get the rule
413+
idx, ok := ruleIndex[id.(string)]
414+
if !ok {
415+
delete(uuids, uuid+"all")
416+
return
417+
}
418+
419+
r := sgRules[idx]
420+
421+
// Update the values
422+
if r.Cidr != "" {
423+
rule["cidr_list"].(*schema.Set).Add(r.Cidr)
424+
}
425+
426+
if r.Securitygroupname != "" {
427+
rule["user_security_group_list"].(*schema.Set).Add(r.Securitygroupname)
428+
}
429+
430+
rule["protocol"] = r.Protocol
431+
}
432+
396433
if rule["protocol"].(string) == "icmp" {
397434
id, ok := uuids[uuid+"icmp"]
398435
if !ok {
@@ -610,6 +647,8 @@ func verifySecurityGroupRuleParams(d *schema.ResourceData, rule map[string]inter
610647

611648
protocol := rule["protocol"].(string)
612649
switch protocol {
650+
case "all":
651+
break
613652
case "icmp":
614653
if _, ok := rule["icmp_type"]; !ok {
615654
return fmt.Errorf(
@@ -636,7 +675,7 @@ func verifySecurityGroupRuleParams(d *schema.ResourceData, rule map[string]inter
636675
_, err := strconv.ParseInt(protocol, 0, 0)
637676
if err != nil {
638677
return fmt.Errorf(
639-
"%q is not a valid protocol. Valid options are 'tcp', 'udp' and 'icmp'", protocol)
678+
"%q is not a valid protocol. Valid options are 'tcp', 'udp', 'icmp', 'all' or a protocol number", protocol)
640679
}
641680
}
642681

‎cloudstack/resource_cloudstack_security_group_rule_test.go‎

Lines changed: 88 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -40,27 +40,29 @@ func TestAccCloudStackSecurityGroupRule_basic(t *testing.T) {
4040
Check: resource.ComposeTestCheckFunc(
4141
testAccCheckCloudStackSecurityGroupRulesExist("cloudstack_security_group.foo"),
4242
resource.TestCheckResourceAttr(
43-
"cloudstack_security_group_rule.foo", "rule.#", "2"),
44-
resource.TestCheckResourceAttr(
45-
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.0", "172.18.100.0/24"),
46-
resource.TestCheckResourceAttr(
47-
"cloudstack_security_group_rule.foo", "rule.0.protocol", "tcp"),
48-
resource.TestCheckResourceAttr(
49-
"cloudstack_security_group_rule.foo", "rule.0.ports.#", "1"),
50-
resource.TestCheckResourceAttr(
51-
"cloudstack_security_group_rule.foo", "rule.0.ports.0", "80"),
52-
resource.TestCheckResourceAttr(
53-
"cloudstack_security_group_rule.foo", "rule.0.traffic_type", "ingress"),
54-
resource.TestCheckResourceAttr(
55-
"cloudstack_security_group_rule.foo", "rule.1.protocol", "tcp"),
56-
resource.TestCheckResourceAttr(
57-
"cloudstack_security_group_rule.foo", "rule.1.ports.1", "80"),
58-
resource.TestCheckResourceAttr(
59-
"cloudstack_security_group_rule.foo", "rule.1.ports.0", "443"),
60-
resource.TestCheckResourceAttr(
61-
"cloudstack_security_group_rule.foo", "rule.1.traffic_type", "egress"),
62-
resource.TestCheckResourceAttr(
63-
"cloudstack_security_group_rule.foo", "rule.1.user_security_group_list.0", "terraform-security-group-bar"),
43+
"cloudstack_security_group_rule.foo", "rule.#", "3"),
44+
resource.TestCheckTypeSetElemNestedAttrs(
45+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
46+
"protocol": "all",
47+
"traffic_type": "egress",
48+
"cidr_list.#": "1",
49+
"cidr_list.0": "172.0.0.0/8",
50+
}),
51+
resource.TestCheckTypeSetElemNestedAttrs(
52+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
53+
"protocol": "tcp",
54+
"traffic_type": "ingress",
55+
"cidr_list.0": "172.18.100.0/24",
56+
"ports.#": "1",
57+
"ports.0": "80",
58+
}),
59+
resource.TestCheckTypeSetElemNestedAttrs(
60+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
61+
"protocol": "tcp",
62+
"traffic_type": "egress",
63+
"ports.#": "2",
64+
"user_security_group_list.0": "terraform-security-group-bar",
65+
}),
6466
),
6567
},
6668
},
@@ -78,27 +80,29 @@ func TestAccCloudStackSecurityGroupRule_update(t *testing.T) {
7880
Check: resource.ComposeTestCheckFunc(
7981
testAccCheckCloudStackSecurityGroupRulesExist("cloudstack_security_group.foo"),
8082
resource.TestCheckResourceAttr(
81-
"cloudstack_security_group_rule.foo", "rule.#", "2"),
82-
resource.TestCheckResourceAttr(
83-
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.0", "172.18.100.0/24"),
84-
resource.TestCheckResourceAttr(
85-
"cloudstack_security_group_rule.foo", "rule.0.protocol", "tcp"),
86-
resource.TestCheckResourceAttr(
87-
"cloudstack_security_group_rule.foo", "rule.0.ports.#", "1"),
88-
resource.TestCheckResourceAttr(
89-
"cloudstack_security_group_rule.foo", "rule.0.ports.0", "80"),
90-
resource.TestCheckResourceAttr(
91-
"cloudstack_security_group_rule.foo", "rule.0.traffic_type", "ingress"),
92-
resource.TestCheckResourceAttr(
93-
"cloudstack_security_group_rule.foo", "rule.1.protocol", "tcp"),
94-
resource.TestCheckResourceAttr(
95-
"cloudstack_security_group_rule.foo", "rule.1.ports.1", "80"),
96-
resource.TestCheckResourceAttr(
97-
"cloudstack_security_group_rule.foo", "rule.1.ports.0", "443"),
98-
resource.TestCheckResourceAttr(
99-
"cloudstack_security_group_rule.foo", "rule.1.traffic_type", "egress"),
100-
resource.TestCheckResourceAttr(
101-
"cloudstack_security_group_rule.foo", "rule.1.user_security_group_list.0", "terraform-security-group-bar"),
83+
"cloudstack_security_group_rule.foo", "rule.#", "3"),
84+
resource.TestCheckTypeSetElemNestedAttrs(
85+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
86+
"protocol": "all",
87+
"traffic_type": "egress",
88+
"cidr_list.#": "1",
89+
"cidr_list.0": "172.0.0.0/8",
90+
}),
91+
resource.TestCheckTypeSetElemNestedAttrs(
92+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
93+
"protocol": "tcp",
94+
"traffic_type": "ingress",
95+
"cidr_list.0": "172.18.100.0/24",
96+
"ports.#": "1",
97+
"ports.0": "80",
98+
}),
99+
resource.TestCheckTypeSetElemNestedAttrs(
100+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
101+
"protocol": "tcp",
102+
"traffic_type": "egress",
103+
"ports.#": "2",
104+
"user_security_group_list.0": "terraform-security-group-bar",
105+
}),
102106
),
103107
},
104108

@@ -107,35 +111,36 @@ func TestAccCloudStackSecurityGroupRule_update(t *testing.T) {
107111
Check: resource.ComposeTestCheckFunc(
108112
testAccCheckCloudStackSecurityGroupRulesExist("cloudstack_security_group.foo"),
109113
resource.TestCheckResourceAttr(
110-
"cloudstack_security_group_rule.foo", "rule.#", "3"),
111-
resource.TestCheckResourceAttr(
112-
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.0", "172.18.100.0/24"),
113-
resource.TestCheckResourceAttr(
114-
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.1", "172.18.200.0/24"),
115-
resource.TestCheckResourceAttr(
116-
"cloudstack_security_group_rule.foo", "rule.0.protocol", "tcp"),
117-
resource.TestCheckResourceAttr(
118-
"cloudstack_security_group_rule.foo", "rule.0.ports.1", "80"),
119-
resource.TestCheckResourceAttr(
120-
"cloudstack_security_group_rule.foo", "rule.0.ports.0", "443"),
121-
resource.TestCheckResourceAttr(
122-
"cloudstack_security_group_rule.foo", "rule.1.cidr_list.#", "1"),
123-
resource.TestCheckResourceAttr(
124-
"cloudstack_security_group_rule.foo", "rule.1.cidr_list.0", "172.18.100.0/24"),
125-
resource.TestCheckResourceAttr(
126-
"cloudstack_security_group_rule.foo", "rule.1.icmp_code", "-1"),
127-
resource.TestCheckResourceAttr(
128-
"cloudstack_security_group_rule.foo", "rule.1.icmp_type", "-1"),
129-
resource.TestCheckResourceAttr(
130-
"cloudstack_security_group_rule.foo", "rule.2.protocol", "tcp"),
131-
resource.TestCheckResourceAttr(
132-
"cloudstack_security_group_rule.foo", "rule.2.ports.#", "1"),
133-
resource.TestCheckResourceAttr(
134-
"cloudstack_security_group_rule.foo", "rule.2.ports.0", "80"),
135-
resource.TestCheckResourceAttr(
136-
"cloudstack_security_group_rule.foo", "rule.2.traffic_type", "egress"),
137-
resource.TestCheckResourceAttr(
138-
"cloudstack_security_group_rule.foo", "rule.2.user_security_group_list.0", "terraform-security-group-bar"),
114+
"cloudstack_security_group_rule.foo", "rule.#", "4"),
115+
resource.TestCheckTypeSetElemNestedAttrs(
116+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
117+
"protocol": "tcp",
118+
"cidr_list.#": "2",
119+
"ports.#": "2",
120+
}),
121+
resource.TestCheckTypeSetElemNestedAttrs(
122+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
123+
"protocol": "icmp",
124+
"traffic_type": "ingress",
125+
"cidr_list.#": "1",
126+
"cidr_list.0": "172.18.100.0/24",
127+
"icmp_code": "-1",
128+
"icmp_type": "-1",
129+
}),
130+
resource.TestCheckTypeSetElemNestedAttrs(
131+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
132+
"protocol": "all",
133+
"traffic_type": "ingress",
134+
"cidr_list.#": "2",
135+
}),
136+
resource.TestCheckTypeSetElemNestedAttrs(
137+
"cloudstack_security_group_rule.foo", "rule.*", map[string]string{
138+
"protocol": "tcp",
139+
"traffic_type": "egress",
140+
"ports.#": "1",
141+
"ports.0": "80",
142+
"user_security_group_list.0": "terraform-security-group-bar",
143+
}),
139144
),
140145
},
141146
},
@@ -238,6 +243,12 @@ resource "cloudstack_security_group" "bar" {
238243
resource "cloudstack_security_group_rule" "foo" {
239244
security_group_id = cloudstack_security_group.foo.id
240245
246+
rule {
247+
protocol = "all"
248+
cidr_list = ["172.0.0.0/8"]
249+
traffic_type = "egress"
250+
}
251+
241252
rule {
242253
cidr_list = ["172.18.100.0/24"]
243254
protocol = "tcp"
@@ -268,6 +279,12 @@ resource "cloudstack_security_group" "bar" {
268279
resource "cloudstack_security_group_rule" "foo" {
269280
security_group_id = cloudstack_security_group.foo.id
270281
282+
rule {
283+
protocol = "all"
284+
cidr_list = ["172.20.100.0/24", "192.168.0.0/32"]
285+
traffic_type = "ingress"
286+
}
287+
271288
rule {
272289
cidr_list = ["172.18.100.0/24", "172.18.200.0/24"]
273290
protocol = "tcp"

0 commit comments

Comments
 (0)