
    K                        d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl	m
Z
 ddl	mZ dd	lmZ dd
lmZ dd
lmZ ddlmZ  G d de      Z e
j.                  e
j0                  j2                         G d de
j4                               Z e
j.                  e
j0                  j8                         G d de             Z e
j.                  e
j0                  j<                         G d de             Zy)zaCommand for removing exclusions for preconfigured WAF rule evaluation from security policy rules.    )absolute_import)division)unicode_literals)base_classes)client)base)
exceptions)scope)flags)
propertiesc                       e Zd ZdZed        Ze	 d
d       Zed        Zed        Ze	 	 	 	 dd       Z	ed        Z
ed	        Zy)!RemovePreconfigWafExclusionHelperA  Remove an exclusion configuration for preconfigured WAF evaluation from a security policy rule.

  *{command}* is used to remove an exclusion configuration for preconfigured WAF
  evaluation from a security policy rule.

  Note that request field exclusions are associated with a target, which can be
  a single rule set, or a rule set plus a list of rule IDs under the rule set.

  It is possible to remove request field exclusions at 3 levels:
  - Remove specific request field exclusions that are associated with a matching
    target.
  - Remove all the request field exclusions that are associated with a matching
    target.
  - Remove all the request field exclusions that are configured under the
    security policy rule, regardless of the target.

  ## EXAMPLES

  To remove specific request field exclusions that are associated with the
  target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
  'owasp-crs-v030001-id942120-sqli'], run:

    $ {command} 1000 \
       --security-policy=my-policy \
       --target-rule-set=sqli-stable \
       --target-rule-ids=owasp-crs-v030001-id942110-sqli,owasp-crs-v030001-id942120-sqli
       \
       --request-header-to-exclude=op=EQUALS,val=abc \
       --request-header-to-exclude=op=STARTS_WITH,val=xyz \
       --request-uri-to-exclude=op=EQUALS_ANY

  To remove all the request field exclusions that are associated with the target
  of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
  'owasp-crs-v030001-id942120-sqli'], run:

    $ {command} 1000 \
       --security-policy=my-policy \
       --target-rule-set=sqli-stable \
       --target-rule-ids=owasp-crs-v030001-id942110-sqli,owasp-crs-v030001-id942120-sqli

  To remove all the request field exclusions that are associated with the target
  of 'sqli-stable': [], run:

    $ {command} 1000 \
       --security-policy=my-policy \
       --target-rule-set=sqli-stable

  To remove all the request field exclusions that are configured under the
  security policy rule, regardless of the target, run:

    $ {command} 1000 \
       --security-policy=my-policy \
       --target-rule-set=*
  c                    t        j                  d      | _        | j                  j                  |dd       t        j                  |d       t        j                         | _        | j                  j                  |       t        j                  |d       t        j                  |d       t        j                  |d       t        j                  |d       t        j                  |d       t        j                  |d       y)z@Generates the flagset for a RemovePreconfigWafExclusion command.zCremove the exclusion configuration for preconfigured WAF evaluationPRIORITY)operation_typecust_metavarF)parseris_addN)r   PriorityArgumentNAME_ARGAddArgumentAddRegionFlagsecurity_policy_flags(SecurityPolicyMultiScopeArgumentForRulesSECURITY_POLICY_ARGAddTargetRuleSetAddTargetRuleIdsAddRequestHeaderAddRequestCookieAddRequestQueryParamAddRequestUriclsr   s     Mlib/surface/compute/security_policies/rules/remove_preconfig_waf_exclusion.pyArgsz&RemovePreconfigWafExclusionHelper.ArgsW   s     ))MCL LL     
MO 	FFH ''/	&7	&7	&7	&7	fU;	ve4    Nc                 f    ||j                   k(  xr! t        |      t        |j                        k(  S N)targetRuleSetsettargetRuleIds)r$   existing_exclusiontarget_rule_settarget_rule_idss       r%   _IsIdenticalTargetz4RemovePreconfigWafExclusionHelper._IsIdenticalTargetr   s@    
 0>>> B3D 2 @ @ADB Br'   c                     |j                   j                         }|j                  d      xs d}|r*|j                   j                  j                  |      |_        |j                  d      xs d}|r||_        |S )zConverts RequestFieldToAdd.op val)messages<SecurityPolicyRulePreconfiguredWafConfigExclusionFieldParamsgetOpValueValuesEnumr2   r4   )r$   compute_clientrequest_field_to_removerequest_fieldr2   r4   s         r%   _ConvertRequestFieldToAddz;RemovePreconfigWafExclusionHelper._ConvertRequestFieldToAddz   s     		E	E	G  
!	$	$T	*	0bB	

!
!GGR  
 "
%
%e
,
2C
mr'   c                 D    g }|D ]  }||vs|j                  |        |S r)   )append)r$   existing_request_fieldsrequest_fields_to_removenew_request_fieldsexisting_request_fields        r%   _RemoveRequestFieldsz6RemovePreconfigWafExclusionHelper._RemoveRequestFields   s5     "9	'?	?!!"89 #: r'   c                 6   |j                   j                         }|j                  |_        |j                  xs g D ]  }|j                  j	                  |        g }	|xs g D ]#  }
|	j	                  | j                  ||
             % |j                  j                  | j                  |j                  |	             g }|xs g D ]#  }|j	                  | j                  ||             % |j                  j                  | j                  |j                  |             g }|xs g D ]#  }|j	                  | j                  ||             % |j                  j                  | j                  |j                  |             g }|xs g D ]#  }|j	                  | j                  ||             % |j                  j                  | j                  |j                  |             |j                  s%|j                  s|j                  s|j                  sy|S )zUpdates Exclusion.N)r5   1SecurityPolicyRulePreconfiguredWafConfigExclusionr*   r,   r>   r<   requestHeadersToExcludeextendrC   requestCookiesToExcluderequestQueryParamsToExcluderequestUrisToExclude)r$   r9   r-   request_headersrequest_cookiesrequest_query_paramsrequest_urisnew_exclusiontarget_rule_idrequest_headers_to_removerequest_headerrequest_cookies_to_removerequest_cookierequest_query_params_to_removerequest_query_paramrequest_uris_to_removerequest_uris                    r%   _UpdateExclusionz2RemovePreconfigWafExclusionHelper._UpdateExclusion   s-    		:	:	<  #5"B"BM,::@b@!!((8 A !#)/R/&&

'
'
GI 0 ))00  !3!K!K!:	<= !#)/R/&&

'
'
GI 0 ))00  !3!K!K!:	<= &("39r9$++

'
'8K
LN  : --44  ::*	,-
  #)r)##

'
'
DF * &&--  !3!H!H!7	9: 111155..r'   c           	         |j                   j                         }|j                  dk(  r|S d}|j                  d      s3|j                  d      s"|j                  d      s|j                  d      rd}|j                  r|j                  j
                  }ng }|D ]  }| j                  ||j                  |j                  xs g       r`|s1| j                  |||j                  |j                  |j                  |j                        }|sr|j
                  j                  |       |j
                  j                  |        |S )zUpdates Preconfig WafConfig.*Frequest_header_to_excluderequest_cookie_to_excluderequest_query_param_to_excluderequest_uri_to_excludeT)r5   (SecurityPolicyRulePreconfiguredWafConfigr.   IsSpecifiedpreconfiguredWafConfig
exclusionsr0   r/   rY   r\   r]   r^   r_   r>   )	r$   r9   existing_ruleargsnew_preconfig_waf_confighas_request_field_argsrc   	exclusionrO   s	            r%   _UpdatePreconfigWafConfigz;RemovePreconfigWafExclusionHelper._UpdatePreconfigWafConfig   s6    	HHJ s"%%"45459:12#++ 77BBjj					4+?+? $ 4 4 :
<!..i)G)G,,1143N3NP- $//66}E ++229=   $#r'   c                    |j                   dk(  rk|j                  d      sD|j                  d      s3|j                  d      s"|j                  d      s|j                  d      rt        j                  dd      |j                  xs g |j
                  xs g |j                  xs g |j                  xs g fD ]:  }|D ]3  }|j                  d	      xs d
}|r|dvst        j                  d	d       < t        j                  |      }|j                  }d}| j                  j                  ||j                  t        j                   j"                        }	t%        |	dd      m|j                  j'                  |j(                  dt*        j,                  j.                  j0                  j2                  |	j4                  |j6                  d      }na|j                  j'                  |j(                  dt*        j,                  j.                  j0                  j2                  |j6                  d      }t        j8                  ||      }
|
j;                         d   }| j=                  |||      }|
j?                  |      S )z7Validates arguments and patches a security policy rule.r[   r/   r\   r]   r^   r_   ztarget-rule-setzArguments in [--target-rule-ids, --request-header-to-exclude, --request-cookie-to-exclude, --request-query-param-to-exclude, --request-uri-to-exclude] cannot be specified when --target-rule-set is set to *.r2   r3   )EQUALSSTARTS_WITH	ENDS_WITHCONTAINS
EQUALS_ANYz_A request field operator must be one of [EQUALS, STARTS_WITH, ENDS_WITH, CONTAINS, EQUALS_ANY].N)default_scoperegionz!compute.regionSecurityPolicyRules)projectrq   securityPolicy)
collectionparamszcompute.securityPolicyRules)rr   rs   )r9   r   )preconfig_waf_config) r.   ra   r	   InvalidArgumentExceptionr\   r]   r^   r_   r7   r   ComputeApiHolderr   r   ResolveAsResource	resourcescompute_scope	ScopeEnumGLOBALgetattrParsenamer   VALUEScorerr   	GetOrFailrq   security_policySecurityPolicyRuleDescriberi   Patch)r$   release_trackre   request_fieldsr;   r2   holderr9   refsecurity_policy_refsecurity_policy_rulerd   rf   s                r%   Runz%RemovePreconfigWafExclusionHelper.Run   sx    s"


,
-


6
7


6
7


;
<


3
411-. 	. 	&&,"d.L.L /
D//52##)r
 *-t$*R  
 
 3323 3 * **=9F]]N
C11CCfm.E.E.L.L D N"Hd3?""
))8#**//77AA+22 $ 4 4 # c ""
))2#**//77AA $ 4 4 # c "44N,(113A6M"<<t -%%5 & 7 7r'   r)   )NNNN)__name__
__module____qualname____doc__classmethodr&   r0   r<   rC   rY   ri   r    r'   r%   r   r      s    5n 5 54  *.B B  &    (,'+,0$(5 5n  $  $D ;7 ;7r'   r   c                   .    e Zd ZdZdZdZed        Zd Zy)RemovePreconfigWafExclusionGAr   Nc                 .    t         j                  |       y r)   )r   r&   r#   s     r%   r&   z"RemovePreconfigWafExclusionGA.Argsm  s    %**r'   c                 J    t         j                  | j                         |      S r)   )r   r   ReleaseTrack)selfre   s     r%   r   z!RemovePreconfigWafExclusionGA.Runs  s$    ,00 r'   )	r   r   r   r   r   r   r   r&   r   r   r'   r%   r   r   1  s,    5n ( 
r'   r   c                       e Zd ZdZy)RemovePreconfigWafExclusionBetar   Nr   r   r   r   r   r'   r%   r   r   z      5r'   r   c                       e Zd ZdZy) RemovePreconfigWafExclusionAlphar   Nr   r   r'   r%   r   r     r   r'   r   N) r   
__future__r   r   r   googlecloudsdk.api_lib.computer   0googlecloudsdk.api_lib.compute.security_policiesr   googlecloudsdk.callioper   r	   "googlecloudsdk.command_lib.computer
   r{   4googlecloudsdk.command_lib.compute.security_policiesr   r   :googlecloudsdk.command_lib.compute.security_policies.rulesgooglecloudsdk.corer   objectr   ReleaseTracksr   GAUpdateCommandr   BETAr   ALPHAr   r   r'   r%   <module>r      s    h &  ' 7 C ( . E _ L *O7 O7d D%%(()ED$6$6 E *EP D%%**+6&C 6 ,6r D%%++,6'F 6 -6r'   