Skip to content

Commit f8de2e5

Browse files
bddvlprbddvlpr
committed
Allow 'all' on security group rule protocol
1 parent f19bffc commit f8de2e5

2 files changed

Lines changed: 98 additions & 28 deletions

File tree

‎cloudstack/resource_cloudstack_security_group_rule.go‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,16 @@ func createSecurityGroupRule(d *schema.ResourceData, meta interface{}, rule map[
247247
// Set the protocol
248248
p.SetProtocol(rule["protocol"].(string))
249249

250+
if rule["protocol"].(string) == "all" {
251+
ruleID, err := createIngressOrEgressRule(cs, p)
252+
if err != nil {
253+
return err
254+
}
255+
256+
uuids[uuid+"all"] = ruleID
257+
rule["uuids"] = uuids
258+
}
259+
250260
// If the protocol is ICMP set the needed ICMP parameters
251261
if rule["protocol"].(string) == "icmp" {
252262
p.SetIcmptype(rule["icmp_type"].(int))
@@ -393,6 +403,32 @@ func readSecurityGroupRule(sg *cloudstack.SecurityGroup, ruleIndex map[string]in
393403
uuids := rule["uuids"].(map[string]interface{})
394404
sgRules := append(sg.Ingressrule, sg.Egressrule...)
395405

406+
if rule["protocol"].(string) == "all" {
407+
id, ok := uuids[uuid+"all"]
408+
if !ok {
409+
return
410+
}
411+
412+
// Get the rule
413+
idx, ok := ruleIndex[id.(string)]
414+
if !ok {
415+
return
416+
}
417+
418+
r := sgRules[idx]
419+
420+
// Update the values
421+
if r.Cidr != "" {
422+
rule["cidr_list"].(*schema.Set).Add(r.Cidr)
423+
}
424+
425+
if r.Securitygroupname != "" {
426+
rule["user_security_group_list"].(*schema.Set).Add(r.Securitygroupname)
427+
}
428+
429+
rule["protocol"] = r.Protocol
430+
}
431+
396432
if rule["protocol"].(string) == "icmp" {
397433
id, ok := uuids[uuid+"icmp"]
398434
if !ok {
@@ -610,6 +646,8 @@ func verifySecurityGroupRuleParams(d *schema.ResourceData, rule map[string]inter
610646

611647
protocol := rule["protocol"].(string)
612648
switch protocol {
649+
case "all":
650+
break
613651
case "icmp":
614652
if _, ok := rule["icmp_type"]; !ok {
615653
return fmt.Errorf(

‎cloudstack/resource_cloudstack_security_group_rule_test.go‎

Lines changed: 60 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -40,27 +40,33 @@ func TestAccCloudStackSecurityGroupRule_basic(t *testing.T) {
4040
Check: resource.ComposeTestCheckFunc(
4141
testAccCheckCloudStackSecurityGroupRulesExist("cloudstack_security_group.foo"),
4242
resource.TestCheckResourceAttr(
43-
"cloudstack_security_group_rule.foo", "rule.#", "2"),
43+
"cloudstack_security_group_rule.foo", "rule.#", "3"),
4444
resource.TestCheckResourceAttr(
45-
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.0", "172.18.100.0/24"),
45+
"cloudstack_security_group_rule.foo", "rule.0.protocol", "all"),
4646
resource.TestCheckResourceAttr(
47-
"cloudstack_security_group_rule.foo", "rule.0.protocol", "tcp"),
47+
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.0", "172.0.0.0/8"),
4848
resource.TestCheckResourceAttr(
49-
"cloudstack_security_group_rule.foo", "rule.0.ports.#", "1"),
49+
"cloudstack_security_group_rule.foo", "rule.0.traffic_type", "egress"),
5050
resource.TestCheckResourceAttr(
51-
"cloudstack_security_group_rule.foo", "rule.0.ports.0", "80"),
52-
resource.TestCheckResourceAttr(
53-
"cloudstack_security_group_rule.foo", "rule.0.traffic_type", "ingress"),
51+
"cloudstack_security_group_rule.foo", "rule.1.cidr_list.0", "172.18.100.0/24"),
5452
resource.TestCheckResourceAttr(
5553
"cloudstack_security_group_rule.foo", "rule.1.protocol", "tcp"),
5654
resource.TestCheckResourceAttr(
57-
"cloudstack_security_group_rule.foo", "rule.1.ports.1", "80"),
55+
"cloudstack_security_group_rule.foo", "rule.1.ports.#", "1"),
56+
resource.TestCheckResourceAttr(
57+
"cloudstack_security_group_rule.foo", "rule.1.ports.0", "80"),
58+
resource.TestCheckResourceAttr(
59+
"cloudstack_security_group_rule.foo", "rule.1.traffic_type", "ingress"),
60+
resource.TestCheckResourceAttr(
61+
"cloudstack_security_group_rule.foo", "rule.2.protocol", "tcp"),
62+
resource.TestCheckResourceAttr(
63+
"cloudstack_security_group_rule.foo", "rule.2.ports.1", "80"),
5864
resource.TestCheckResourceAttr(
59-
"cloudstack_security_group_rule.foo", "rule.1.ports.0", "443"),
65+
"cloudstack_security_group_rule.foo", "rule.2.ports.0", "443"),
6066
resource.TestCheckResourceAttr(
61-
"cloudstack_security_group_rule.foo", "rule.1.traffic_type", "egress"),
67+
"cloudstack_security_group_rule.foo", "rule.2.traffic_type", "egress"),
6268
resource.TestCheckResourceAttr(
63-
"cloudstack_security_group_rule.foo", "rule.1.user_security_group_list.0", "terraform-security-group-bar"),
69+
"cloudstack_security_group_rule.foo", "rule.2.user_security_group_list.0", "terraform-security-group-bar"),
6470
),
6571
},
6672
},
@@ -78,27 +84,33 @@ func TestAccCloudStackSecurityGroupRule_update(t *testing.T) {
7884
Check: resource.ComposeTestCheckFunc(
7985
testAccCheckCloudStackSecurityGroupRulesExist("cloudstack_security_group.foo"),
8086
resource.TestCheckResourceAttr(
81-
"cloudstack_security_group_rule.foo", "rule.#", "2"),
82-
resource.TestCheckResourceAttr(
83-
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.0", "172.18.100.0/24"),
87+
"cloudstack_security_group_rule.foo", "rule.#", "3"),
8488
resource.TestCheckResourceAttr(
85-
"cloudstack_security_group_rule.foo", "rule.0.protocol", "tcp"),
89+
"cloudstack_security_group_rule.foo", "rule.0.protocol", "all"),
8690
resource.TestCheckResourceAttr(
87-
"cloudstack_security_group_rule.foo", "rule.0.ports.#", "1"),
91+
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.0", "172.0.0.0/8"),
8892
resource.TestCheckResourceAttr(
89-
"cloudstack_security_group_rule.foo", "rule.0.ports.0", "80"),
93+
"cloudstack_security_group_rule.foo", "rule.0.traffic_type", "egress"),
9094
resource.TestCheckResourceAttr(
91-
"cloudstack_security_group_rule.foo", "rule.0.traffic_type", "ingress"),
95+
"cloudstack_security_group_rule.foo", "rule.1.cidr_list.0", "172.18.100.0/24"),
9296
resource.TestCheckResourceAttr(
9397
"cloudstack_security_group_rule.foo", "rule.1.protocol", "tcp"),
9498
resource.TestCheckResourceAttr(
95-
"cloudstack_security_group_rule.foo", "rule.1.ports.1", "80"),
99+
"cloudstack_security_group_rule.foo", "rule.1.ports.#", "1"),
100+
resource.TestCheckResourceAttr(
101+
"cloudstack_security_group_rule.foo", "rule.1.ports.0", "80"),
102+
resource.TestCheckResourceAttr(
103+
"cloudstack_security_group_rule.foo", "rule.1.traffic_type", "ingress"),
104+
resource.TestCheckResourceAttr(
105+
"cloudstack_security_group_rule.foo", "rule.2.protocol", "tcp"),
106+
resource.TestCheckResourceAttr(
107+
"cloudstack_security_group_rule.foo", "rule.2.ports.1", "80"),
96108
resource.TestCheckResourceAttr(
97-
"cloudstack_security_group_rule.foo", "rule.1.ports.0", "443"),
109+
"cloudstack_security_group_rule.foo", "rule.2.ports.0", "443"),
98110
resource.TestCheckResourceAttr(
99-
"cloudstack_security_group_rule.foo", "rule.1.traffic_type", "egress"),
111+
"cloudstack_security_group_rule.foo", "rule.2.traffic_type", "egress"),
100112
resource.TestCheckResourceAttr(
101-
"cloudstack_security_group_rule.foo", "rule.1.user_security_group_list.0", "terraform-security-group-bar"),
113+
"cloudstack_security_group_rule.foo", "rule.2.user_security_group_list.0", "terraform-security-group-bar"),
102114
),
103115
},
104116

@@ -107,7 +119,7 @@ func TestAccCloudStackSecurityGroupRule_update(t *testing.T) {
107119
Check: resource.ComposeTestCheckFunc(
108120
testAccCheckCloudStackSecurityGroupRulesExist("cloudstack_security_group.foo"),
109121
resource.TestCheckResourceAttr(
110-
"cloudstack_security_group_rule.foo", "rule.#", "3"),
122+
"cloudstack_security_group_rule.foo", "rule.#", "4"),
111123
resource.TestCheckResourceAttr(
112124
"cloudstack_security_group_rule.foo", "rule.0.cidr_list.0", "172.18.100.0/24"),
113125
resource.TestCheckResourceAttr(
@@ -127,15 +139,23 @@ func TestAccCloudStackSecurityGroupRule_update(t *testing.T) {
127139
resource.TestCheckResourceAttr(
128140
"cloudstack_security_group_rule.foo", "rule.1.icmp_type", "-1"),
129141
resource.TestCheckResourceAttr(
130-
"cloudstack_security_group_rule.foo", "rule.2.protocol", "tcp"),
142+
"cloudstack_security_group_rule.foo", "rule.2.protocol", "all"),
131143
resource.TestCheckResourceAttr(
132-
"cloudstack_security_group_rule.foo", "rule.2.ports.#", "1"),
144+
"cloudstack_security_group_rule.foo", "rule.2.cidr_list.0", "172.20.100.0/24"),
133145
resource.TestCheckResourceAttr(
134-
"cloudstack_security_group_rule.foo", "rule.2.ports.0", "80"),
146+
"cloudstack_security_group_rule.foo", "rule.2.cidr_list.1", "192.168.0.0/32"),
135147
resource.TestCheckResourceAttr(
136-
"cloudstack_security_group_rule.foo", "rule.2.traffic_type", "egress"),
148+
"cloudstack_security_group_rule.foo", "rule.2.traffic_type", "ingress"),
137149
resource.TestCheckResourceAttr(
138-
"cloudstack_security_group_rule.foo", "rule.2.user_security_group_list.0", "terraform-security-group-bar"),
150+
"cloudstack_security_group_rule.foo", "rule.3.protocol", "tcp"),
151+
resource.TestCheckResourceAttr(
152+
"cloudstack_security_group_rule.foo", "rule.3.ports.#", "1"),
153+
resource.TestCheckResourceAttr(
154+
"cloudstack_security_group_rule.foo", "rule.3.ports.0", "80"),
155+
resource.TestCheckResourceAttr(
156+
"cloudstack_security_group_rule.foo", "rule.3.traffic_type", "egress"),
157+
resource.TestCheckResourceAttr(
158+
"cloudstack_security_group_rule.foo", "rule.3.user_security_group_list.0", "terraform-security-group-bar"),
139159
),
140160
},
141161
},
@@ -238,6 +258,12 @@ resource "cloudstack_security_group" "bar" {
238258
resource "cloudstack_security_group_rule" "foo" {
239259
security_group_id = cloudstack_security_group.foo.id
240260
261+
rule {
262+
protocol = "all"
263+
cidr_list = ["172.0.0.0/8"]
264+
traffic_type = "egress"
265+
}
266+
241267
rule {
242268
cidr_list = ["172.18.100.0/24"]
243269
protocol = "tcp"
@@ -268,6 +294,12 @@ resource "cloudstack_security_group" "bar" {
268294
resource "cloudstack_security_group_rule" "foo" {
269295
security_group_id = cloudstack_security_group.foo.id
270296
297+
rule {
298+
protocol = "all"
299+
cidr_list = ["172.20.100.0/24", "192.168.0.0/32"]
300+
traffic_type = "ingress"
301+
}
302+
271303
rule {
272304
cidr_list = ["172.18.100.0/24", "172.18.200.0/24"]
273305
protocol = "tcp"

0 commit comments

Comments
 (0)