
    >                        d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl	m
Z
 ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ  G d de      Z ej4                  ej6                  j8                         G d dej:                               Z ej4                  ej6                  j>                         G d de             Z  ej4                  ej6                  jB                         G d de              Z"y)z]Command for adding exclusions for preconfigured WAF rule evaluation to security policy rules.    )absolute_import)division)unicode_literals)encoding)base_classes)client)base)
exceptions)scope)flags)
properties)	resourcesc                       e Zd ZdZed        Ze	 dd       Zed        Zed        Ze	 	 	 	 dd       Z	e	 	 	 	 	 dd       Z
ed	        Zed
        Zy)AddPreconfigWafExclusionHelper  Add an exclusion configuration for preconfigured WAF evaluation into a security policy rule.

  *{command}* is used to add an exclusion configuration for preconfigured WAF
  evaluation into a security policy rule.

  Note that request field exclusions are associated with a target, which can be
  a single rule set, or a rule set plus a list of rule IDs under the rule set.

  ## EXAMPLES

  To add specific request field exclusions that are associated with the target
  of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
  'owasp-crs-v030001-id942120-sqli'], run:

    $ {command} 1000 \
       --security-policy=my-policy \
       --target-rule-set=sqli-stable \
       --target-rule-ids=owasp-crs-v030001-id942110-sqli,owasp-crs-v030001-id942120-sqli
       \
       --request-header-to-exclude=op=EQUALS,val=abc \
       --request-header-to-exclude=op=STARTS_WITH,val=xyz \
       --request-uri-to-exclude=op=EQUALS_ANY

  To add specific request field exclusions that are associated with the target
  of 'sqli-stable': [], run:

    $ {command} 1000 \
       --security-policy=my-policy \
       --target-rule-set=sqli-stable \
       --request-cookie-to-exclude=op=EQUALS_ANY
  c                    t        j                  d      | _        | j                  j                  |dd       t        j                  |d       t        j                         | _        | j                  j                  |       t        j                  |d       t        j                  |d       t        j                  |d       t        j                  |d       t        j                  |d       t        j                  |d       y)z>Generates the flagset for an AddPreconfigWafExclusion command.z@add the exclusion configuration for preconfigured WAF evaluationPRIORITY)operation_typecust_metavarT)parseris_addN)r   PriorityArgumentNAME_ARGAddArgumentAddRegionFlagsecurity_policy_flags(SecurityPolicyMultiScopeArgumentForRulesSECURITY_POLICY_ARGAddTargetRuleSetAddTargetRuleIdsAddRequestHeaderAddRequestCookieAddRequestQueryParamAddRequestUriclsr   s     Jlib/surface/compute/security_policies/rules/add_preconfig_waf_exclusion.pyArgsz#AddPreconfigWafExclusionHelper.ArgsC   s     ))JCL LLN   
JL 	FFH ''/	&6	&6	&6	&6	fT:	vd3    Nc                 f    ||j                   k(  xr! t        |      t        |j                        k(  S N)targetRuleSetsettargetRuleIds)r&   existing_exclusiontarget_rule_settarget_rule_idss       r'   _IsIdenticalTargetz1AddPreconfigWafExclusionHelper._IsIdenticalTarget]   s@    
 0>>> B3D 2 @ @ADB Br)   c                     |j                   j                         }|j                  d      xs d}|r*|j                   j                  j                  |      |_        |j                  d      xs d}|r||_        |S )zConverts RequestFieldToAdd.op val)messages<SecurityPolicyRulePreconfiguredWafConfigExclusionFieldParamsgetOpValueValuesEnumr4   r6   )r&   compute_clientrequest_field_to_addrequest_fieldr4   r6   s         r'   _ConvertRequestFieldToAddz8AddPreconfigWafExclusionHelper._ConvertRequestFieldToAdde   s     		E	E	G  
	!	!$	'	-2B	

!
!GGR  
 
"
"5
)
/RC
mr)   c                 f    | j                  ||      }|D ]	  }||k(  s	 y |j                  |       y)zAdds Request Field.N)r>   append)r&   r;   existing_request_fieldsr<   new_request_fieldexisting_request_fields         r'   _AddRequestFieldz/AddPreconfigWafExclusionHelper._AddRequestFieldy   sC     55n6JL"9	#4	4 #: ""#45r)   c                 D   |xs g D ]  }| j                  ||j                  |       ! |xs g D ]  }| j                  ||j                  |       ! |xs g D ]  }	| j                  ||j                  |	       ! |xs g D ]  }
| j                  ||j                  |
       ! y)zUpdates Exclusion.N)rD   requestHeadersToExcluderequestCookiesToExcluderequestQueryParamsToExcluderequestUrisToExclude)r&   r;   r/   request_headersrequest_cookiesrequest_query_paramsrequest_urisrequest_headerrequest_cookierequest_query_paramrequest_uris              r'   _UpdateExclusionz/AddPreconfigWafExclusionHelper._UpdateExclusion   s     */R/	>-EE)+ 0 */R/	>-EE)+ 0  49r9	>-II.0  : $)r)	>-BBKQ *r)   c                     |j                   j                         }||_        |xs g D ]  }	|j                  j	                  |	        | j                  ||||||       |S )zCreates Exclusion.)r7   1SecurityPolicyRulePreconfiguredWafConfigExclusionr,   r.   r@   rR   )
r&   r;   r0   r1   rJ   rK   rL   rM   new_exclusiontarget_rule_ids
             r'   _CreateExclusionz/AddPreconfigWafExclusionHelper._CreateExclusion   sn     		:	:	<  #2M)/R/!!((8 0(*>Nr)   c           	      j   |j                   r t        j                  |j                         }n|j                  j	                         }|j
                  D ]o  }| j                  ||j                  |j                  xs g       s/| j                  |||j                  |j                  |j                  |j                         |c S  | j                  ||j                  |j                  |j                  |j                  |j                  |j                        }|j
                  j                  |       |S )zUpdates Preconfig WafConfig.)preconfiguredWafConfigr   CopyProtoMessager7   (SecurityPolicyRulePreconfiguredWafConfig
exclusionsr2   r0   r1   rR   request_header_to_excluderequest_cookie_to_excluderequest_query_param_to_excluderequest_uri_to_excluderW   r@   )r&   r;   existing_ruleargsnew_preconfig_waf_config	exclusionrU   s          r'   _UpdatePreconfigWafConfigz8AddPreconfigWafExclusionHelper._UpdatePreconfigWafConfig   s    ++!)!:!:

.
."0 
!
!
J
J
L  .88					4+?+? $ 4 4 :
<^Y!;;!;;!@@!88		:
 (' 9 ((9M9M)-)=)=)-)G)G)-)G)G)-)L)L)-)D)DFM ''..}=##r)   c           
         |j                  d      sM|j                  d      s<|j                  d      s+|j                  d      sg d}t        j                  |d      |j                  xs g |j                  xs g |j
                  xs g |j                  xs g fD ]:  }|D ]3  }|j                  d      xs d}|r|d	vst        j                  dd
       < t        j                  |      }|j                  }d}	|j                  r| j                  j                  ||j                  t         j"                  j$                        }
t'        |
dd      m|j                  j)                  |j*                  dt,        j.                  j0                  j2                  j4                  |
j6                  |j                  d      }	n|j                  j)                  |j*                  dt,        j.                  j0                  j2                  j4                  |j                  d      }	nc	 |j                  j)                  |j*                  dt,        j.                  j0                  j2                  j4                  t'        |dd      d      }	t        j<                  |	|      }|j?                         d   }| jA                  |||      }|jC                  |      S # t        j8                  t        j:                  f$ rY |j                  j)                  |j*                  ddt,        j.                  j0                  j2                  j4                  i      }	Y w xY w)z7Validates arguments and patches a security policy rule.r]   r^   r_   r`   )z--request-header-to-excludez--request-cookie-to-excludez --request-query-param-to-excludez--request-uri-to-excludez-At least one request field must be specified.r4   r5   )EQUALSSTARTS_WITH	ENDS_WITHCONTAINS
EQUALS_ANYz_A request field operator must be one of [EQUALS, STARTS_WITH, ENDS_WITH, CONTAINS, EQUALS_ANY].N)default_scoperegionz!compute.regionSecurityPolicyRules)projectrm   securityPolicy)
collectionparamszcompute.securityPolicyRules)rn   ro   )rn   rm   rn   )r;   r   )preconfig_waf_config)"IsSpecifiedr
   MinimumArgumentExceptionr]   r^   r_   r`   r9   InvalidArgumentExceptionr   ComputeApiHolderr   security_policyr   ResolveAsResourcer   compute_scope	ScopeEnumGLOBALgetattrParsenamer   VALUEScorern   	GetOrFailrm   RequiredFieldOmittedException WrongResourceCollectionExceptionSecurityPolicyRuleDescribere   Patch)r&   release_trackrb   request_field_namesrequest_fieldsr=   r4   holderr;   refsecurity_policy_refsecurity_policy_rulera   rc   s                 r'   Runz"AddPreconfigWafExclusionHelper.Run   s5    8989=>56 //
NP P 	&&,"d.L.L /
D//52##)r
 *-t$*R  
 
 3323 3 * **=9F]]N
C33EE



%//66 F 8 
$h	5	A$$II:%,,1199CC-44"&"6"6 %  $$II4%,,1199CC"&"6"6 % 

$$II:%,,1199CC!$$7 % 
& "44N,(113A6M"<<t -%%5 & 7 7! 
1
1

4
4 

 $$II4:,,1199CC % 
	

s   'A"K A9MMr+   )NNNN)NNNNN)__name__
__module____qualname____doc__classmethodr(   r2   r>   rD   rR   rW   re   r    r)   r'   r   r   "   s    @ 4 42  *.B B  & 6 6  (,'+,0$(Q Q0  (,'+'+,0$( & $ $8 R7 R7r)   r   c                   *    e Zd ZdZdZed        Zd Zy)AddPreconfigWafExclusionGAr   Nc                 .    t         j                  |       y r+   )r   r(   r%   s     r'   r(   zAddPreconfigWafExclusionGA.ArgsH  s    "''r)   c                 J    t         j                  | j                         |      S r+   )r   r   ReleaseTrack)selfrb   s     r'   r   zAddPreconfigWafExclusionGA.RunN  s$    )-- r)   )r   r   r   r   r   r   r(   r   r   r)   r'   r   r   $  s&    @ ( 
r)   r   c                       e Zd ZdZy)AddPreconfigWafExclusionBetar   Nr   r   r   r   r   r)   r'   r   r   U      r)   r   c                       e Zd ZdZy)AddPreconfigWafExclusionAlphar   Nr   r   r)   r'   r   r   x  r   r)   r   N)#r   
__future__r   r   r   apitools.base.pyr   googlecloudsdk.api_lib.computer   0googlecloudsdk.api_lib.compute.security_policiesr   googlecloudsdk.callioper	   r
   "googlecloudsdk.command_lib.computer   ry   4googlecloudsdk.command_lib.compute.security_policiesr   r   :googlecloudsdk.command_lib.compute.security_policies.rulesgooglecloudsdk.corer   r   objectr   ReleaseTracksr   GAUpdateCommandr   BETAr   ALPHAr   r   r)   r'   <module>r      s    d &  ' % 7 C ( . E _ L * )7V 7D D%%(()-!3!3 - *-` D%%**+#=  ,D D%%++,$@  -r)   