Skip to content

Commit 9fddaf0

Browse files
committed
NSOF-5929 trusted_network: introduce resource and data-source
1 parent 0d7dc22 commit 9fddaf0

File tree

12 files changed

+858
-0
lines changed

12 files changed

+858
-0
lines changed
Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "pfptmeta_trusted_network Data Source - terraform-provider-pfptmeta"
4+
subcategory: "Device Management"
5+
description: |-
6+
The trusted networks feature is a mechanism for auto-disconnecting from Proofpoint NaaS when the device is on a trusted network, such as corporate environment. The moment the device leaves the trusted network, it auto-reconnects to the Proofpoint NaaS.
7+
A user can still forcefully connect the device to the Proofpoint NaaS when on a trusted network, by clicking Connect in the Proofpoint Agent UI.
8+
Proofpoint Agent tries to detect if a trusted network is available, before re-connecting to a network (re-connect occurs if the device was connected to the Proofpoint NaaS and then switched networks).
9+
A trusted network is defined according to one of the following criteria:
10+
- DNS resolution of a hostname: When a specific hostname is resolved to an IP address that is within the defined IP range.
11+
- External IP address of the device: When the device external IP address is within the specified IP address range.
12+
---
13+
14+
# pfptmeta_trusted_network (Data Source)
15+
16+
The trusted networks feature is a mechanism for auto-disconnecting from Proofpoint NaaS when the device is on a trusted network, such as corporate environment. The moment the device leaves the trusted network, it auto-reconnects to the Proofpoint NaaS.
17+
A user can still forcefully connect the device to the Proofpoint NaaS when on a trusted network, by clicking Connect in the Proofpoint Agent UI.
18+
19+
Proofpoint Agent tries to detect if a trusted network is available, before re-connecting to a network (re-connect occurs if the device was connected to the Proofpoint NaaS and then switched networks).
20+
A trusted network is defined according to one of the following criteria:
21+
- DNS resolution of a hostname: When a specific hostname is resolved to an IP address that is within the defined IP range.
22+
- External IP address of the device: When the device external IP address is within the specified IP address range.
23+
24+
## Example Usage
25+
26+
```terraform
27+
data "pfptmeta_trusted_network" "network" {
28+
id = "tn-123abc"
29+
}
30+
31+
output "network" {
32+
value = data.pfptmeta_trusted_network.network
33+
}
34+
```
35+
36+
<!-- schema generated by tfplugindocs -->
37+
## Schema
38+
39+
### Required
40+
41+
- **id** (String) The ID of this resource.
42+
43+
### Read-Only
44+
45+
- **apply_to_entities** (List of String) Entities (users, groups or network elements) to be allowed to use trusted networks.
46+
- **apply_to_org** (Boolean) Indicates whether this trusted network setting applies to the entire org. Note: This attribute overrides `apply_to_entities`.
47+
- **criteria** (List of Object) (see [below for nested schema](#nestedatt--criteria))
48+
- **description** (String)
49+
- **enabled** (Boolean)
50+
- **exempt_entities** (List of String) Entities (users, groups or network elements) which are not allowed to use trusted networks.
51+
- **name** (String)
52+
53+
<a id="nestedatt--criteria"></a>
54+
### Nested Schema for `criteria`
55+
56+
Read-Only:
57+
58+
- **external_ip_config** (List of Object) (see [below for nested schema](#nestedobjatt--criteria--external_ip_config))
59+
- **resolved_address_config** (List of Object) (see [below for nested schema](#nestedobjatt--criteria--resolved_address_config))
60+
- **type** (String)
61+
62+
<a id="nestedobjatt--criteria--external_ip_config"></a>
63+
### Nested Schema for `criteria.external_ip_config`
64+
65+
Read-Only:
66+
67+
- **addresses_ranges** (List of String)
68+
69+
70+
<a id="nestedobjatt--criteria--resolved_address_config"></a>
71+
### Nested Schema for `criteria.resolved_address_config`
72+
73+
Read-Only:
74+
75+
- **addresses_ranges** (List of String)
76+
- **hostname** (String)

docs/resources/trusted_network.md

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "pfptmeta_trusted_network Resource - terraform-provider-pfptmeta"
4+
subcategory: "Device Management"
5+
description: |-
6+
The trusted networks feature is a mechanism for auto-disconnecting from Proofpoint NaaS when the device is on a trusted network, such as corporate environment. The moment the device leaves the trusted network, it auto-reconnects to the Proofpoint NaaS.
7+
A user can still forcefully connect the device to the Proofpoint NaaS when on a trusted network, by clicking Connect in the Proofpoint Agent UI.
8+
Proofpoint Agent tries to detect if a trusted network is available, before re-connecting to a network (re-connect occurs if the device was connected to the Proofpoint NaaS and then switched networks).
9+
A trusted network is defined according to one of the following criteria:
10+
- DNS resolution of a hostname: When a specific hostname is resolved to an IP address that is within the defined IP range.
11+
- External IP address of the device: When the device external IP address is within the specified IP address range.
12+
---
13+
14+
# pfptmeta_trusted_network (Resource)
15+
16+
The trusted networks feature is a mechanism for auto-disconnecting from Proofpoint NaaS when the device is on a trusted network, such as corporate environment. The moment the device leaves the trusted network, it auto-reconnects to the Proofpoint NaaS.
17+
A user can still forcefully connect the device to the Proofpoint NaaS when on a trusted network, by clicking Connect in the Proofpoint Agent UI.
18+
19+
Proofpoint Agent tries to detect if a trusted network is available, before re-connecting to a network (re-connect occurs if the device was connected to the Proofpoint NaaS and then switched networks).
20+
A trusted network is defined according to one of the following criteria:
21+
- DNS resolution of a hostname: When a specific hostname is resolved to an IP address that is within the defined IP range.
22+
- External IP address of the device: When the device external IP address is within the specified IP address range.
23+
24+
## Example Usage
25+
26+
```terraform
27+
resource "pfptmeta_trusted_network" "network" {
28+
name = "trusted network name"
29+
description = "trusted network description"
30+
apply_to_org = true
31+
criteria {
32+
external_ip_config {
33+
addresses_ranges = ["192.1.0.0/16"]
34+
}
35+
}
36+
criteria {
37+
resolved_address_config {
38+
addresses_ranges = ["192.1.0.0/16"]
39+
hostname = "office.address.com"
40+
}
41+
}
42+
}
43+
```
44+
45+
<!-- schema generated by tfplugindocs -->
46+
## Schema
47+
48+
### Required
49+
50+
- **criteria** (Block List, Min: 1) (see [below for nested schema](#nestedblock--criteria))
51+
- **name** (String)
52+
53+
### Optional
54+
55+
- **apply_to_entities** (List of String) Entities (users, groups or network elements) to be allowed to use trusted networks.
56+
- **apply_to_org** (Boolean) Indicates whether this trusted network setting applies to the entire org. Note: This attribute overrides `apply_to_entities`.
57+
- **description** (String)
58+
- **enabled** (Boolean)
59+
- **exempt_entities** (List of String) Entities (users, groups or network elements) which are not allowed to use trusted networks.
60+
61+
### Read-Only
62+
63+
- **id** (String) The ID of this resource.
64+
65+
<a id="nestedblock--criteria"></a>
66+
### Nested Schema for `criteria`
67+
68+
Optional:
69+
70+
- **external_ip_config** (Block List, Max: 1) Specified IP address range to compare with the device's external IP for the network to be trusted. (see [below for nested schema](#nestedblock--criteria--external_ip_config))
71+
- **resolved_address_config** (Block List, Max: 1) A hostname and specified IP address range in which the hostname must be resolved for the network to be trusted. (see [below for nested schema](#nestedblock--criteria--resolved_address_config))
72+
73+
Read-Only:
74+
75+
- **type** (String)
76+
77+
<a id="nestedblock--criteria--external_ip_config"></a>
78+
### Nested Schema for `criteria.external_ip_config`
79+
80+
Required:
81+
82+
- **addresses_ranges** (List of String)
83+
84+
85+
<a id="nestedblock--criteria--resolved_address_config"></a>
86+
### Nested Schema for `criteria.resolved_address_config`
87+
88+
Required:
89+
90+
- **addresses_ranges** (List of String)
91+
- **hostname** (String)
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
data "pfptmeta_trusted_network" "network" {
2+
id = "tn-123abc"
3+
}
4+
5+
output "network" {
6+
value = data.pfptmeta_trusted_network.network
7+
}
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "pfptmeta_trusted_network" "network" {
2+
name = "trusted network name"
3+
description = "trusted network description"
4+
apply_to_org = true
5+
criteria {
6+
external_ip_config {
7+
addresses_ranges = ["192.1.0.0/16"]
8+
}
9+
}
10+
criteria {
11+
resolved_address_config {
12+
addresses_ranges = ["192.1.0.0/16"]
13+
hostname = "office.address.com"
14+
}
15+
}
16+
}

internal/client/trusted_network.go

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
package client
2+
3+
import (
4+
"bytes"
5+
"context"
6+
"encoding/json"
7+
"fmt"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
9+
"io/ioutil"
10+
"net/http"
11+
)
12+
13+
const trustedNetworkEndpoint = "v1/trusted_networks"
14+
15+
type ExternalIpConfig struct {
16+
AddressesRanges []string `json:"addresses_ranges"`
17+
}
18+
19+
func newExternalIPConfig(input interface{}) *ExternalIpConfig {
20+
newExternalIpConfig := &ExternalIpConfig{}
21+
inputList := input.([]interface{})
22+
if len(inputList) == 0 {
23+
return nil
24+
}
25+
externalIpConfig := inputList[0].(map[string]interface{})
26+
addressesRanges := externalIpConfig["addresses_ranges"].([]interface{})
27+
newExternalIpConfig.AddressesRanges = make([]string, len(addressesRanges))
28+
for j, address := range addressesRanges {
29+
newExternalIpConfig.AddressesRanges[j] = address.(string)
30+
}
31+
return newExternalIpConfig
32+
}
33+
34+
type ResolvedAddressConfig struct {
35+
AddressesRanges []string `json:"addresses_ranges"`
36+
Hostname string `json:"hostname"`
37+
}
38+
39+
func newResolvedAddressConfig(input interface{}) *ResolvedAddressConfig {
40+
newResolvedAddressConfig := &ResolvedAddressConfig{}
41+
inputList := input.([]interface{})
42+
if len(inputList) == 0 {
43+
return nil
44+
}
45+
resolvedAddressConfig := inputList[0].(map[string]interface{})
46+
addressesRanges := resolvedAddressConfig["addresses_ranges"].([]interface{})
47+
newResolvedAddressConfig.AddressesRanges = make([]string, len(addressesRanges))
48+
for j, address := range addressesRanges {
49+
newResolvedAddressConfig.AddressesRanges[j] = address.(string)
50+
}
51+
newResolvedAddressConfig.Hostname = resolvedAddressConfig["hostname"].(string)
52+
return newResolvedAddressConfig
53+
}
54+
55+
type Criteria struct {
56+
ExternalIpConfig *ExternalIpConfig `json:"external_ip_config,omitempty"`
57+
ResolvedAddressConfig *ResolvedAddressConfig `json:"resolved_address_config,omitempty"`
58+
Type string `json:"type,omitempty"`
59+
}
60+
61+
func newCriteria(d *schema.ResourceData) []Criteria {
62+
c := d.Get("criteria").([]interface{})
63+
res := make([]Criteria, len(c))
64+
for i, criteria := range c {
65+
newCriteria := Criteria{}
66+
criteria := criteria.(map[string]interface{})
67+
if externalIpConfig, ok := criteria["external_ip_config"]; ok {
68+
newCriteria.ExternalIpConfig = newExternalIPConfig(externalIpConfig)
69+
}
70+
if resolvedAddressConfig, ok := criteria["resolved_address_config"]; ok {
71+
newCriteria.ResolvedAddressConfig = newResolvedAddressConfig(resolvedAddressConfig)
72+
}
73+
res[i] = newCriteria
74+
}
75+
return res
76+
}
77+
78+
type TrustedNetwork struct {
79+
ID string `json:"id,omitempty"`
80+
Name string `json:"name,omitempty"`
81+
Description string `json:"description"`
82+
Enabled bool `json:"enabled"`
83+
ApplyToOrg bool `json:"apply_to_org"`
84+
ApplyToEntities []string `json:"apply_to_entities"`
85+
ExemptEntities []string `json:"exempt_entities"`
86+
Criteria []Criteria `json:"criteria"`
87+
}
88+
89+
func NewTrustedNetwork(d *schema.ResourceData) *TrustedNetwork {
90+
res := &TrustedNetwork{}
91+
if d.HasChange("name") {
92+
res.Name = d.Get("name").(string)
93+
}
94+
res.Description = d.Get("description").(string)
95+
res.Enabled = d.Get("enabled").(bool)
96+
res.ApplyToOrg = d.Get("apply_to_org").(bool)
97+
res.ApplyToEntities = ConfigToStringSlice("apply_to_entities", d)
98+
res.ExemptEntities = ConfigToStringSlice("exempt_entities", d)
99+
res.Criteria = newCriteria(d)
100+
return res
101+
}
102+
103+
func parseTrustedNetwork(resp *http.Response) (*TrustedNetwork, error) {
104+
defer resp.Body.Close()
105+
body, err := ioutil.ReadAll(resp.Body)
106+
e := &TrustedNetwork{}
107+
err = json.Unmarshal(body, e)
108+
if err != nil {
109+
return nil, fmt.Errorf("could not parse trusted network response: %v", err)
110+
}
111+
return e, nil
112+
}
113+
114+
func CreateTrustedNetwork(ctx context.Context, c *Client, e *TrustedNetwork) (*TrustedNetwork, error) {
115+
url := fmt.Sprintf("%s/%s", c.BaseURL, trustedNetworkEndpoint)
116+
body, err := json.Marshal(e)
117+
if err != nil {
118+
return nil, fmt.Errorf("could not convert trusted network to json: %v", err)
119+
}
120+
resp, err := c.Post(ctx, url, bytes.NewReader(body))
121+
if err != nil {
122+
return nil, err
123+
}
124+
return parseTrustedNetwork(resp)
125+
}
126+
127+
func GetTrustedNetwork(ctx context.Context, c *Client, eID string) (*TrustedNetwork, error) {
128+
url := fmt.Sprintf("%s/%s/%s", c.BaseURL, trustedNetworkEndpoint, eID)
129+
resp, err := c.Get(ctx, url, nil)
130+
if err != nil {
131+
return nil, err
132+
}
133+
return parseTrustedNetwork(resp)
134+
}
135+
136+
func UpdateTrustedNetwork(ctx context.Context, c *Client, eID string, e *TrustedNetwork) (*TrustedNetwork, error) {
137+
url := fmt.Sprintf("%s/%s/%s", c.BaseURL, trustedNetworkEndpoint, eID)
138+
body, err := json.Marshal(e)
139+
if err != nil {
140+
return nil, fmt.Errorf("could not convert trusted network to json: %v", err)
141+
}
142+
resp, err := c.Patch(ctx, url, bytes.NewReader(body))
143+
if err != nil {
144+
return nil, err
145+
}
146+
return parseTrustedNetwork(resp)
147+
}
148+
149+
func DeleteTrustedNetwork(ctx context.Context, c *Client, mID string) (*TrustedNetwork, error) {
150+
url := fmt.Sprintf("%s/%s/%s", c.BaseURL, trustedNetworkEndpoint, mID)
151+
resp, err := c.Delete(ctx, url, nil)
152+
if err != nil {
153+
return nil, err
154+
}
155+
return parseTrustedNetwork(resp)
156+
}

0 commit comments

Comments
 (0)