decort-golang-sdk/pkg/sdn/secpolicies/create.go

package secpolicies

import (
	"context"
	"encoding/json"
	"net/http"

	"repository.basistech.ru/BASIS/decort-golang-sdk/internal/constants"
	"repository.basistech.ru/BASIS/decort-golang-sdk/internal/validators"
)

// CreateRequest struct to create security policy
type CreateRequest struct {
	// Access group ID
	// Required: true
	AccessGroupID string `url:"access_group_id" json:"access_group_id" validate:"required"`

	// Applied to net object groups
	// Required: false
	AppliedToNetObjectGroupID []AppliedToNetObjectGroup `url:"applied_to_net_object_group_ids,omitempty" json:"applied_to_net_object_group_ids,omitempty" validate:"omitempty,dive"`

	// Description of the schedule rule
	// Required: true
	Description string `url:"description" json:"description" validate:"required"`

	// Display name of the schedule rule
	// Required: true
	DisplayName string `url:"display_name" json:"display_name" validate:"required"`

	// Enabled status of the schedule rule
	// Required: true
	Enabled bool `url:"enabled" json:"enabled"`

	// End date and time for the schedule rule
	// Required: false
	EndDateTime string `url:"end_date_time,omitempty" json:"end_date_time,omitempty"`

	// Insert up reference
	// Required: false
	InsertUp string `url:"insert_up,omitempty" json:"insert_up,omitempty"`

	// Locked at timestamp
	// Required: false
	LockedAt string `url:"locked_at,omitempty" json:"locked_at,omitempty"`

	// Schedule cron expression
	// Required: false
	ScheduleCron string `url:"schedule_cron,omitempty" json:"schedule_cron,omitempty"`

	// Security rules to create in the security policy
	// Required: false
	SecurityRulesForCreate []SecurityRuleForCreate `url:"security_rules_for_create,omitempty" json:"security_rules_for_create,omitempty" validate:"omitempty,dive"`

	// Start date and time for the schedule rule
	// Required: false
	StartDateTime string `url:"start_date_time,omitempty" json:"start_date_time,omitempty"`
}

// AppliedToNetObjectGroup struct of network object group to apply the security policy (rule) to
type AppliedToNetObjectGroup struct {
	// Network object group ID
	// Required: true
	ID string `url:"id" json:"id" validate:"required"`

	// Network object group version ID
	// Required: true
	VersionID uint64 `url:"version_id" json:"version_id" validate:"required"`
}

// SecurityRuleForCreate struct of security rule to create in the security policy
type SecurityRuleForCreate struct {
	// Action to take (Allow, Deny, etc.)
	// Required: true
	Action string `url:"action" json:"action" validate:"required"`

	// Applied to net object groups
	// Required: false
	AppliedNetObjectGroups []AppliedToNetObjectGroup `url:"applied_net_object_groups,omitempty" json:"applied_net_object_groups,omitempty" validate:"omitempty,dive"`

	// Description
	// Required: false
	Description string `url:"description,omitempty" json:"description,omitempty"`

	// Destination net object groups
	// Required: false
	DestinationNetObjectGroups []RuleNetObjectGroup `url:"destination_net_object_groups,omitempty" json:"destination_net_object_groups,omitempty" validate:"omitempty,dive"`

	// Traffic direction (Ingress, Egress)
	// Required: true
	Direction string `url:"direction" json:"direction" validate:"required"`

	// Display name
	// Required: true
	DisplayName string `url:"display_name" json:"display_name" validate:"required"`

	// Enabled flag
	// Required: true
	Enabled bool `url:"enabled" json:"enabled"`

	// Filter criteria
	// Required: false
	Filters []RuleFilter `url:"filters,omitempty" json:"filters,omitempty"`

	// ID of the rule above which to insert this rule
	// Required: false
	InsertUpRuleID string `url:"insert_up_rule_id,omitempty" json:"insert_up_rule_id,omitempty"`

	// Log enabled flag
	// Required: true
	LogEnabled bool `url:"log_enabled" json:"log_enabled"`

	// Logging profile ID
	// Required: false
	LoggingProfileID string `url:"logging_profile_id,omitempty" json:"logging_profile_id,omitempty"`

	// Security rule condition group IDs
	// Required: false
	SecurityRuleConditionGroupIDs []string `url:"security_rule_condition_group_ids,omitempty" json:"security_rule_condition_group_ids,omitempty"`

	// Security rule condition IDs
	// Required: false
	SecurityRuleConditionIDs []string `url:"security_rule_condition_ids,omitempty" json:"security_rule_condition_ids,omitempty"`

	// Source net object groups
	// Required: false
	SourceNetObjectGroups []RuleNetObjectGroup `url:"source_net_object_groups,omitempty" json:"source_net_object_groups,omitempty" validate:"omitempty,dive"`

	// Statistics enabled flag
	// Required: true
	StatisticsEnabled bool `url:"statistics_enabled" json:"statistics_enabled"`
}

// RuleNetObjectGroup struct of source or destination network object group of the security rule
type RuleNetObjectGroup struct {
	// Network object group ID
	// Required: true
	ID string `url:"id" json:"id" validate:"required"`

	// Is positive flag
	// Required: true
	IsPositive bool `url:"is_positive" json:"is_positive"`

	// Network object group version ID
	// Required: true
	VersionID uint64 `url:"version_id" json:"version_id" validate:"required"`
}

// RuleFilter struct of filter criteria of the security rule
type RuleFilter struct {
	// All traffic
	// Required: false
	All bool `url:"all,omitempty" json:"all,omitempty"`

	// ARP traffic
	// Required: false
	ARP bool `url:"arp,omitempty" json:"arp,omitempty"`

	// Ethernet type
	// Required: false
	EthType string `url:"eth_type,omitempty" json:"eth_type,omitempty"`

	// Filter expression
	// Required: false
	Expression string `url:"expression,omitempty" json:"expression,omitempty"`

	// ICMP traffic
	// Required: false
	ICMP bool `url:"icmp,omitempty" json:"icmp,omitempty"`

	// IP traffic
	// Required: false
	IP bool `url:"ip,omitempty" json:"ip,omitempty"`

	// IP protocol number
	// Required: false
	IPProto uint64 `url:"ip_proto,omitempty" json:"ip_proto,omitempty"`

	// IPv4 traffic
	// Required: false
	IPv4 bool `url:"ip_v4,omitempty" json:"ip_v4,omitempty"`

	// IPv6 traffic
	// Required: false
	IPv6 bool `url:"ip_v6,omitempty" json:"ip_v6,omitempty"`

	// Keep opened sessions
	// Required: false
	KeepOpenedSessions bool `url:"keep_opened_sessions,omitempty" json:"keep_opened_sessions,omitempty"`

	// ND traffic
	// Required: false
	ND bool `url:"nd,omitempty" json:"nd,omitempty"`

	// TCP traffic
	// Required: false
	TCP bool `url:"tcp,omitempty" json:"tcp,omitempty"`

	// TCP source ports
	// Required: false
	TCPSrcPorts []string `url:"tcp_src_ports,omitempty" json:"tcp_src_ports,omitempty"`

	// TCP destination ports
	// Required: false
	TCPDstPorts []string `url:"tcp_dst_ports,omitempty" json:"tcp_dst_ports,omitempty"`

	// UDP traffic
	// Required: false
	UDP bool `url:"udp,omitempty" json:"udp,omitempty"`

	// UDP source ports
	// Required: false
	UDPSrcPorts []string `url:"udp_src_ports,omitempty" json:"udp_src_ports,omitempty"`

	// UDP destination ports
	// Required: false
	UDPDstPorts []string `url:"udp_dst_ports,omitempty" json:"udp_dst_ports,omitempty"`
}

// Create creates a security policy
func (i SecurityPolicies) Create(ctx context.Context, req CreateRequest) (*SecurityPolicySummary, error) {
	err := validators.ValidateRequest(req)
	if err != nil {
		return nil, validators.ValidationErrors(validators.GetErrors(err))
	}

	url := "/sdn/security_policy/create"

	res, err := i.client.DecortApiCallCtype(ctx, http.MethodPost, url, constants.MIMEJSON, req)
	if err != nil {
		return nil, err
	}

	info := SecurityPolicySummary{}

	err = json.Unmarshal(res, &info)
	if err != nil {
		return nil, err
	}

	return &info, nil
}