BASIS/decort-golang-sdk
9
2
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

v1.16.7

Browse Source 
v1.16.7
This commit is contained in:
dayterr
2026-10-09 16:23:35 +03:00
parent 25e2242360
commit 8cde0e9371
80 changed files with 2303 additions and 606 deletions
Download Patch File Download Diff File Expand all files Collapse all files

174
pkg/sdn/secpolicies/create.go
View File

@@ -15,17 +15,17 @@ type CreateRequest struct {
// Required: true
AccessGroupID string `url:"access_group_id" json:"access_group_id" validate:"required"`
// Applied to net object group ID
// Required: true
AppliedToNetObjectGroupID string `url:"applied_to_net_object_group_id" json:"applied_to_net_object_group_id" validate:"required"`
// Applied to net object groups
// Required: false
AppliedToNetObjectGroupID []AppliedToNetObjectGroup `url:"applied_to_net_object_group_ids,omitempty" json:"applied_to_net_object_group_ids,omitempty" validate:"omitempty,dive"`
// Description of the schedule rule
// Required: true
Description string `url:"description" json:"description"`
Description string `url:"description" json:"description" validate:"required"`
// Display name of the schedule rule
// Required: true
DisplayName string `url:"display_name" json:"display_name"`
DisplayName string `url:"display_name" json:"display_name" validate:"required"`
// Enabled status of the schedule rule
// Required: true
@@ -47,11 +47,175 @@ type CreateRequest struct {
// Required: false
ScheduleCron string `url:"schedule_cron,omitempty" json:"schedule_cron,omitempty"`
// Security rules to create in the security policy
// Required: false
SecurityRulesForCreate []SecurityRuleForCreate `url:"security_rules_for_create,omitempty" json:"security_rules_for_create,omitempty" validate:"omitempty,dive"`
// Start date and time for the schedule rule
// Required: false
StartDateTime string `url:"start_date_time,omitempty" json:"start_date_time,omitempty"`
}
// AppliedToNetObjectGroup struct of network object group to apply the security policy (rule) to
type AppliedToNetObjectGroup struct {
// Network object group ID
// Required: true
ID string `url:"id" json:"id" validate:"required"`
// Network object group version ID
// Required: true
VersionID uint64 `url:"version_id" json:"version_id" validate:"required"`
}
// SecurityRuleForCreate struct of security rule to create in the security policy
type SecurityRuleForCreate struct {
// Action to take (Allow, Deny, etc.)
// Required: true
Action string `url:"action" json:"action" validate:"required"`
// Applied to net object groups
// Required: false
AppliedNetObjectGroups []AppliedToNetObjectGroup `url:"applied_net_object_groups,omitempty" json:"applied_net_object_groups,omitempty" validate:"omitempty,dive"`
// Description
// Required: false
Description string `url:"description,omitempty" json:"description,omitempty"`
// Destination net object groups
// Required: false
DestinationNetObjectGroups []RuleNetObjectGroup `url:"destination_net_object_groups,omitempty" json:"destination_net_object_groups,omitempty" validate:"omitempty,dive"`
// Traffic direction (Ingress, Egress)
// Required: true
Direction string `url:"direction" json:"direction" validate:"required"`
// Display name
// Required: true
DisplayName string `url:"display_name" json:"display_name" validate:"required"`
// Enabled flag
// Required: true
Enabled bool `url:"enabled" json:"enabled"`
// Filter criteria
// Required: false
Filters []RuleFilter `url:"filters,omitempty" json:"filters,omitempty"`
// ID of the rule above which to insert this rule
// Required: false
InsertUpRuleID string `url:"insert_up_rule_id,omitempty" json:"insert_up_rule_id,omitempty"`
// Log enabled flag
// Required: true
LogEnabled bool `url:"log_enabled" json:"log_enabled"`
// Logging profile ID
// Required: false
LoggingProfileID string `url:"logging_profile_id,omitempty" json:"logging_profile_id,omitempty"`
// Security rule condition group IDs
// Required: false
SecurityRuleConditionGroupIDs []string `url:"security_rule_condition_group_ids,omitempty" json:"security_rule_condition_group_ids,omitempty"`
// Security rule condition IDs
// Required: false
SecurityRuleConditionIDs []string `url:"security_rule_condition_ids,omitempty" json:"security_rule_condition_ids,omitempty"`
// Source net object groups
// Required: false
SourceNetObjectGroups []RuleNetObjectGroup `url:"source_net_object_groups,omitempty" json:"source_net_object_groups,omitempty" validate:"omitempty,dive"`
// Statistics enabled flag
// Required: true
StatisticsEnabled bool `url:"statistics_enabled" json:"statistics_enabled"`
}
// RuleNetObjectGroup struct of source or destination network object group of the security rule
type RuleNetObjectGroup struct {
// Network object group ID
// Required: true
ID string `url:"id" json:"id" validate:"required"`
// Is positive flag
// Required: true
IsPositive bool `url:"is_positive" json:"is_positive"`
// Network object group version ID
// Required: true
VersionID uint64 `url:"version_id" json:"version_id" validate:"required"`
}
// RuleFilter struct of filter criteria of the security rule
type RuleFilter struct {
// All traffic
// Required: false
All bool `url:"all,omitempty" json:"all,omitempty"`
// ARP traffic
// Required: false
ARP bool `url:"arp,omitempty" json:"arp,omitempty"`
// Ethernet type
// Required: false
EthType string `url:"eth_type,omitempty" json:"eth_type,omitempty"`
// Filter expression
// Required: false
Expression string `url:"expression,omitempty" json:"expression,omitempty"`
// ICMP traffic
// Required: false
ICMP bool `url:"icmp,omitempty" json:"icmp,omitempty"`
// IP traffic
// Required: false
IP bool `url:"ip,omitempty" json:"ip,omitempty"`
// IP protocol number
// Required: false
IPProto uint64 `url:"ip_proto,omitempty" json:"ip_proto,omitempty"`
// IPv4 traffic
// Required: false
IPv4 bool `url:"ip_v4,omitempty" json:"ip_v4,omitempty"`
// IPv6 traffic
// Required: false
IPv6 bool `url:"ip_v6,omitempty" json:"ip_v6,omitempty"`
// Keep opened sessions
// Required: false
KeepOpenedSessions bool `url:"keep_opened_sessions,omitempty" json:"keep_opened_sessions,omitempty"`
// ND traffic
// Required: false
ND bool `url:"nd,omitempty" json:"nd,omitempty"`
// TCP traffic
// Required: false
TCP bool `url:"tcp,omitempty" json:"tcp,omitempty"`
// TCP source ports
// Required: false
TCPSrcPorts []string `url:"tcp_src_ports,omitempty" json:"tcp_src_ports,omitempty"`
// TCP destination ports
// Required: false
TCPDstPorts []string `url:"tcp_dst_ports,omitempty" json:"tcp_dst_ports,omitempty"`
// UDP traffic
// Required: false
UDP bool `url:"udp,omitempty" json:"udp,omitempty"`
// UDP source ports
// Required: false
UDPSrcPorts []string `url:"udp_src_ports,omitempty" json:"udp_src_ports,omitempty"`
// UDP destination ports
// Required: false
UDPDstPorts []string `url:"udp_dst_ports,omitempty" json:"udp_dst_ports,omitempty"`
}
// Create creates a security policy
func (i SecurityPolicies) Create(ctx context.Context, req CreateRequest) (*SecurityPolicySummary, error) {
err := validators.ValidateRequest(req)

207
pkg/sdn/secpolicies/filter_test.go
View File

@@ -6,148 +6,103 @@ import (
var testSecurityPolicies = SecurityPolicyList{
{
ID: "policy1",
DisplayName: "DevelopersPolicy",
Description: "First policy",
CreatedAt: "2023-01-01",
UpdatedAt: "2023-01-10",
AccessGroupID: "group1",
AccessGroupName: "Developers",
AppliedToNetObjectGroupID: "netgroup1",
Enabled: true,
StartPriority: 1,
EndPriority: 100,
VersionID: 1,
ID: "policy1",
DisplayName: "DevelopersPolicy",
Description: "First policy",
CreatedAt: "2023-01-01",
UpdatedAt: "2023-01-10",
AccessGroupID: "group1",
AccessGroupName: "Developers",
AppliedNetObjectGroups: []AppliedNetObjectGroup{
{
ID: "netgroup1",
Name: "NetGroup1",
VersionID: 11,
},
},
Type: "User",
Enabled: true,
StartPriority: 1,
EndPriority: 100,
VersionID: 1,
Status: Status{
Common: "active",
OperationStatus: "Synchronized",
Hypervisors: []HypervisorStatus{
{
Name: "hyp1",
DisplayName: "Hypervisor1",
Status: "synced",
OperationStatus: "Synchronized",
HypervisorStatus: "healthy",
SyncedAt: "2023-01-10T10:00:00Z",
},
},
},
SecurityRules: []SecurityRule{
{
ID: "rule1",
DisplayName: "AllowHTTP",
Description: "Allow HTTP traffic",
Action: "Allow",
Direction: "Ingress",
Enabled: true,
Priority: 10,
SecurityPolicyID: "policy1",
LogEnabled: true,
LogSeverity: "medium",
StatisticsEnabled: true,
VersionID: 1,
Filter: Filter{
Filters: map[string]interface{}{
"protocol": "tcp",
"port": float64(80),
},
},
},
},
},
{
ID: "policy2",
DisplayName: "AdminsPolicy",
Description: "Second policy",
CreatedAt: "2023-01-02",
UpdatedAt: "2023-01-11",
AccessGroupID: "group2",
AccessGroupName: "Admins",
AppliedToNetObjectGroupID: "netgroup2",
Enabled: false,
StartPriority: 101,
EndPriority: 200,
VersionID: 2,
ID: "policy2",
DisplayName: "AdminsPolicy",
Description: "Second policy",
CreatedAt: "2023-01-02",
UpdatedAt: "2023-01-11",
AccessGroupID: "group2",
AccessGroupName: "Admins",
AppliedNetObjectGroups: []AppliedNetObjectGroup{
{
ID: "netgroup2",
Name: "NetGroup2",
VersionID: 12,
},
},
Type: "System",
Enabled: false,
StartPriority: 101,
EndPriority: 200,
VersionID: 2,
Status: Status{
Common: "inactive",
OperationStatus: "Idle",
Hypervisors: []HypervisorStatus{
{
Name: "hyp2",
DisplayName: "Hypervisor2",
Status: "pending",
OperationStatus: "Idle",
HypervisorStatus: "syncing",
SyncedAt: "2023-01-11T10:00:00Z",
},
},
},
SecurityRules: []SecurityRule{
{
ID: "rule2",
DisplayName: "DenySSH",
Description: "Deny SSH traffic",
Action: "Deny",
Direction: "Ingress",
Enabled: true,
Priority: 20,
SecurityPolicyID: "policy2",
LogEnabled: false,
LogSeverity: "high",
StatisticsEnabled: false,
VersionID: 1,
Filter: Filter{
Filters: map[string]interface{}{
"protocol": "tcp",
"port": float64(22),
},
},
},
},
},
{
ID: "policy3",
DisplayName: "UsersPolicy",
Description: "Third policy",
CreatedAt: "2023-01-03",
UpdatedAt: "2023-01-12",
AccessGroupID: "group3",
AccessGroupName: "Users",
AppliedToNetObjectGroupID: "netgroup3",
Enabled: true,
StartPriority: 201,
EndPriority: 300,
VersionID: 3,
ID: "policy3",
DisplayName: "UsersPolicy",
Description: "Third policy",
CreatedAt: "2023-01-03",
UpdatedAt: "2023-01-12",
AccessGroupID: "group3",
AccessGroupName: "Users",
AppliedNetObjectGroups: []AppliedNetObjectGroup{
{
ID: "netgroup3",
Name: "NetGroup3",
VersionID: 13,
},
},
Type: "User",
Enabled: true,
StartPriority: 201,
EndPriority: 300,
VersionID: 3,
Status: Status{
Common: "active",
OperationStatus: "Synchronized",
Hypervisors: []HypervisorStatus{
{
Name: "hyp3",
DisplayName: "Hypervisor3",
Status: "synced",
OperationStatus: "Synchronized",
HypervisorStatus: "healthy",
SyncedAt: "2023-01-12T10:00:00Z",
},
},
},
SecurityRules: []SecurityRule{
{
ID: "rule3",
DisplayName: "AllowHTTPS",
Description: "Allow HTTPS traffic",
Action: "Allow",
Direction: "Egress",
Enabled: true,
Priority: 30,
SecurityPolicyID: "policy3",
LogEnabled: true,
LogSeverity: "low",
StatisticsEnabled: true,
VersionID: 1,
Filter: Filter{
Filters: map[string]interface{}{
"protocol": "tcp",
"port": float64(443),
},
},
},
},
},
}
@@ -231,7 +186,7 @@ func TestFilterByAccessGroup(t *testing.T) {
func TestFilterByStatus(t *testing.T) {
actual := testSecurityPolicies.FilterFunc(func(sp SecurityPolicySummary) bool {
return sp.Status.Common == "active"
return sp.Status.OperationStatus == "Synchronized"
})
if len(actual) != 2 {
@@ -249,25 +204,20 @@ func TestFilterByPriorityRange(t *testing.T) {
}
}
func TestFilterByRuleAction(t *testing.T) {
func TestFilterByType(t *testing.T) {
actual := testSecurityPolicies.FilterFunc(func(sp SecurityPolicySummary) bool {
for _, rule := range sp.SecurityRules {
if rule.Action == "Deny" {
return true
}
}
return false
return sp.Type == "System"
})
if len(actual) != 1 || actual[0].ID != "policy2" {
t.Fatal("Expected 1 policy with Deny rule, found:", len(actual))
t.Fatal("Expected 1 System policy, found:", len(actual))
}
}
func TestFilterByRuleDirection(t *testing.T) {
func TestFilterByAppliedNetObjectGroup(t *testing.T) {
actual := testSecurityPolicies.FilterFunc(func(sp SecurityPolicySummary) bool {
for _, rule := range sp.SecurityRules {
if rule.Direction == "Egress" {
for _, group := range sp.AppliedNetObjectGroups {
if group.ID == "netgroup3" {
return true
}
}
@@ -275,21 +225,6 @@ func TestFilterByRuleDirection(t *testing.T) {
})
if len(actual) != 1 || actual[0].ID != "policy3" {
t.Fatal("Expected 1 policy with Egress rule, found:", len(actual))
}
}
func TestFilterByLogEnabled(t *testing.T) {
actual := testSecurityPolicies.FilterFunc(func(sp SecurityPolicySummary) bool {
for _, rule := range sp.SecurityRules {
if rule.LogEnabled {
return true
}
}
return false
})
if len(actual) != 2 {
t.Fatal("Expected 2 policies with log enabled rules, found:", len(actual))
t.Fatal("Expected 1 policy applied to netgroup3, found:", len(actual))
}
}

2
pkg/sdn/secpolicies/get.go
View File

@@ -40,7 +40,7 @@ func (a SecurityPolicies) GetRaw(ctx context.Context, req GetRequest) ([]byte, e
return nil, validators.ValidationErrors(validators.GetErrors(err))
}
url := "/sdn/security_policies/get"
url := "/sdn/security_policy/get"
res, err := a.client.DecortApiCall(ctx, http.MethodGet, url, req)
return res, err

12
pkg/sdn/secpolicies/list.go
View File

@@ -22,9 +22,17 @@ type ListRequest struct {
// Required: false
AccessGroupID string `url:"access_group_id,omitempty" json:"access_group_id,omitempty"`
// Filter by applied to net object group ID
// Filter by applied to net object group IDs
// Required: false
AppliedToNetObjectGroupID string `url:"applied_to_net_object_group_id,omitempty" json:"applied_to_net_object_group_id,omitempty"`
AppliedToNetObjectGroupID []string `url:"applied_to_net_object_group_ids,omitempty" json:"applied_to_net_object_group_ids,omitempty"`
// Filter by operation status
// Required: false
OperationStatus string `url:"operation_status,omitempty" json:"operation_status,omitempty"`
// Filter by type (User, System)
// Required: false
Type string `url:"type,omitempty" json:"type,omitempty"`
// Page number for pagination
// Required: false

94
pkg/sdn/secpolicies/models.go
View File

@@ -10,8 +10,8 @@ type SecurityPolicySummary struct {
// Access group name
AccessGroupName string `json:"access_group_name"`
// Applied to network object group ID
AppliedToNetObjectGroupID string `json:"applied_to_net_object_group_id"`
// Applied network object groups
AppliedNetObjectGroups []AppliedNetObjectGroup `json:"applied_net_object_groups"`
// Created time
CreatedAt string `json:"created_at"`
@@ -25,14 +25,23 @@ type SecurityPolicySummary struct {
// Enabled flag
Enabled bool `json:"enabled"`
// End date and time
EndDateTime string `json:"end_date_time"`
// End priority
EndPriority int `json:"end_priority"`
// ID
ID string `json:"id"`
// Security rules
SecurityRules []SecurityRule `json:"security_rules"`
// Locked at timestamp
LockedAt string `json:"locked_at"`
// Schedule cron expression
ScheduleCron string `json:"schedule_cron"`
// Start date and time
StartDateTime string `json:"start_date_time"`
// Start priority
StartPriority int `json:"start_priority"`
@@ -40,6 +49,9 @@ type SecurityPolicySummary struct {
// Status information
Status Status `json:"status"`
// Type
Type string `json:"type"`
// Version ID
VersionID uint64 `json:"version_id"`
@@ -47,10 +59,25 @@ type SecurityPolicySummary struct {
UpdatedAt string `json:"updated_at"`
}
// AppliedNetObjectGroup information about network object group the security policy is applied to
type AppliedNetObjectGroup struct {
// ID
ID string `json:"id"`
// Name
Name string `json:"name"`
// Version ID
VersionID uint64 `json:"version_id"`
}
// Status information
type Status struct {
// Common status
Common string `json:"common"`
// Operation status
OperationStatus string `json:"operation_status"`
// Hypervisor status
HypervisorStatus string `json:"hypervisor_status"`
// Hypervisor statuses
Hypervisors []HypervisorStatus `json:"hypervisors"`
@@ -58,8 +85,8 @@ type Status struct {
// HypervisorStatus information
type HypervisorStatus struct {
// Status
Status string `json:"status"`
// Operation status
OperationStatus string `json:"operation_status"`
// Name
Name string `json:"name"`
@@ -73,54 +100,3 @@ type HypervisorStatus struct {
// Last sync time
SyncedAt string `json:"synced_at"`
}
// Security rules
type SecurityRule struct {
// Access group ID
AccessGroupID string `json:"access_group_id"`
// Action to take (Allow, Deny, etc.)
Action string `json:"action"`
// Description
Description string `json:"description"`
// Traffic direction (Ingress, Egress)
Direction string `json:"direction"`
// Display name
DisplayName string `json:"display_name"`
// Enabled flag
Enabled bool `json:"enabled"`
// Filter criteria
Filter Filter `json:"filter"`
// ID
ID string `json:"id"`
// Log enabled flag
LogEnabled bool `json:"log_enabled"`
// Log severity level
LogSeverity string `json:"log_severity"`
// Priority
Priority int `json:"priority"`
// Security policy ID
SecurityPolicyID string `json:"security_policy_id"`
// Statistics enabled flag
StatisticsEnabled bool `json:"statistics_enabled"`
// Version ID
VersionID uint64 `json:"version_id"`
}
// Filter represents the filter criteria for the security rule
type Filter struct {
// Filters map
Filters map[string]interface{} `json:"filters"`
}

6
pkg/sdn/secpolicies/move.go
View File

@@ -19,9 +19,9 @@ type MoveRequest struct {
// Required: true
VersionID uint64 `url:"version_id" json:"version_id" validate:"required"`
// Security policy ID
// Required: true
InsertUp string `url:"insert_up" json:"insert_up" validate:"required"`
// ID of the security policy above which to insert the policy. Empty value inserts to the top
// Required: false
InsertUp string `url:"insert_up,omitempty" json:"insert_up,omitempty"`
}
// Move a security policy

16
pkg/sdn/secpolicies/update.go
View File

@@ -18,17 +18,21 @@ type UpdateRequest struct {
// Required: true
VersionID uint64 `url:"version_id" json:"version_id" validate:"required"`
// Applied to net object group ID
// Access group ID
// Required: true
AppliedToNetObjectGroupID string `url:"applied_to_net_object_group_id" json:"applied_to_net_object_group_id" validate:"required"`
AccessGroupID string `url:"access_group_id" json:"access_group_id" validate:"required"`
// Applied net object groups
// Required: false
AppliedNetObjectGroups []AppliedToNetObjectGroup `url:"applied_net_object_groups,omitempty" json:"applied_net_object_groups,omitempty" validate:"omitempty,dive"`
// Description of the schedule rule
// Required: true
Description string `url:"description" json:"description"`
Description string `url:"description" json:"description" validate:"required"`
// Display name of the schedule rule
// Required: true
DisplayName string `url:"display_name" json:"display_name"`
DisplayName string `url:"display_name" json:"display_name" validate:"required"`
// Enabled status of the schedule rule
// Required: true
@@ -38,10 +42,6 @@ type UpdateRequest struct {
// Required: false
EndDateTime string `url:"end_date_time,omitempty" json:"end_date_time,omitempty"`
// Insert up reference
// Required: false
InsertUp string `url:"insert_up,omitempty" json:"insert_up,omitempty"`
// Locked at timestamp
// Required: false
LockedAt string `url:"locked_at,omitempty" json:"locked_at,omitempty"`