
    >                        S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK	J
r
  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr   " S S\5      r\R4                  " \R6                  R8                  5       " S S\R:                  5      5       r\R4                  " \R6                  R>                  5       " S S\5      5       r \R4                  " \R6                  RB                  5       " S S\ 5      5       r"g)z]Command for adding exclusions for preconfigured WAF rule evaluation to security policy rules.    )absolute_import)division)unicode_literals)encoding)base_classes)client)base)
exceptions)scope)flags)
properties)	resourcesc                       \ rS rSrSr\S 5       r\ SS j5       r\S 5       r\S 5       r	\    SS j5       r
\     SS	 j5       r\S
 5       r\S 5       rSrg)AddPreconfigWafExclusionHelper"   u  Add an exclusion configuration for preconfigured WAF evaluation into a security policy rule.

*{command}* is used to add an exclusion configuration for preconfigured WAF
evaluation into a security policy rule.

Note that request field exclusions are associated with a target, which can be
a single rule set, or a rule set plus a list of rule IDs under the rule set.

## EXAMPLES

To add specific request field exclusions that are associated with the target
of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
'owasp-crs-v030001-id942120-sqli'], run:

  $ {command} 1000 \
     --security-policy=my-policy \
     --target-rule-set=sqli-stable \
     --target-rule-ids=owasp-crs-v030001-id942110-sqli,owasp-crs-v030001-id942120-sqli
     \
     --request-header-to-exclude=op=EQUALS,val=abc \
     --request-header-to-exclude=op=STARTS_WITH,val=xyz \
     --request-uri-to-exclude=op=EQUALS_ANY

To add specific request field exclusions that are associated with the target
of 'sqli-stable': [], run:

  $ {command} 1000 \
     --security-policy=my-policy \
     --target-rule-set=sqli-stable \
     --request-cookie-to-exclude=op=EQUALS_ANY
c                    [         R                  " S5      U l        U R                  R                  USSS9  [         R                  " US5        [
        R                  " 5       U l        U R                  R                  U5        [         R                  " USS9  [         R                  " USS9  [         R                  " USS9  [         R                  " USS9  [         R                  " USS9  [         R                  " USS9  g)z>Generates the flagset for an AddPreconfigWafExclusion command.z@add the exclusion configuration for preconfigured WAF evaluationPRIORITY)operation_typecust_metavarT)parseris_addN)r   PriorityArgumentNAME_ARGAddArgumentAddRegionFlagsecurity_policy_flags(SecurityPolicyMultiScopeArgumentForRulesSECURITY_POLICY_ARGAddTargetRuleSetAddTargetRuleIdsAddRequestHeaderAddRequestCookieAddRequestQueryParamAddRequestUriclsr   s     Jlib/surface/compute/security_policies/rules/add_preconfig_waf_exclusion.pyArgs#AddPreconfigWafExclusionHelper.ArgsC   s     ))JCL LLN   
JL 	FFH ''/	&6	&6	&6	&6	fT:	vd3    Nc                 n    X!R                   :H  =(       a!    [        U5      [        UR                  5      :H  $ N)targetRuleSetsettargetRuleIds)r'   existing_exclusiontarget_rule_settarget_rule_idss       r(   _IsIdenticalTarget1AddPreconfigWafExclusionHelper._IsIdenticalTarget]   s=    
 >>> B3D 2 @ @ADB Br+   c                    UR                   R                  5       nUR                  S5      =(       d    SnU(       a*  UR                   R                  R                  U5      Ul        UR                  S5      =(       d    SnU(       a  XSl        U$ )zConverts RequestFieldToAdd.op val)messages<SecurityPolicyRulePreconfiguredWafConfigExclusionFieldParamsgetOpValueValuesEnumr7   r9   )r'   compute_clientrequest_field_to_addrequest_fieldr7   r9   s         r(   _ConvertRequestFieldToAdd8AddPreconfigWafExclusionHelper._ConvertRequestFieldToAdde   s}     		E	E	G  
	!	!$	'	-2B	

!
!GGR  
 
"
"5
)
/RC
r+   c                 j    U R                  UU5      nU H
  nXT:X  d  M
    g   UR                  U5        g)zAdds Request Field.N)rA   append)r'   r>   existing_request_fieldsr?   new_request_fieldexisting_request_fields         r(   _AddRequestField/AddPreconfigWafExclusionHelper._AddRequestFieldy   s@     55n6JL"9		4 #: ""#45r+   c                 |   U=(       d    /  H   nU R                  UUR                  U5        M"     U=(       d    /  H   nU R                  UUR                  U5        M"     U=(       d    /  H   n	U R                  UUR                  U	5        M"     U=(       d    /  H   n
U R                  UUR                  U
5        M"     g)zUpdates Exclusion.N)rH   requestHeadersToExcluderequestCookiesToExcluderequestQueryParamsToExcluderequestUrisToExclude)r'   r>   r1   request_headersrequest_cookiesrequest_query_paramsrequest_urisrequest_headerrequest_cookierequest_query_paramrequest_uris              r(   _UpdateExclusion/AddPreconfigWafExclusionHelper._UpdateExclusion   s     */R/	>-EE)+ 0 */R/	>-EE)+ 0  49r9	>-II.0  : $)r)	>-BBKQ *r+   c                     UR                   R                  5       nX(l        U=(       d    /  H  n	UR                  R	                  U	5        M      U R                  XUXVU5        U$ )zCreates Exclusion.)r:   1SecurityPolicyRulePreconfiguredWafConfigExclusionr.   r0   rD   rW   )
r'   r>   r2   r3   rO   rP   rQ   rR   new_exclusiontarget_rule_ids
             r(   _CreateExclusion/AddPreconfigWafExclusionHelper._CreateExclusion   sg     		:	:	<  #2)/R/!!((8 0(Nr+   c           	         UR                   (       a!  [        R                  " UR                   5      nOUR                  R	                  5       nUR
                   Hx  nU R                  XSR                  UR                  =(       d    / 5      (       d  M9  U R                  XUR                  UR                  UR                  UR                  5        Us  $    U R                  XR                  UR                  UR                  UR                  UR                  UR                  5      nUR
                  R                  U5        U$ )zUpdates Preconfig WafConfig.)preconfiguredWafConfigr   CopyProtoMessager:   (SecurityPolicyRulePreconfiguredWafConfig
exclusionsr4   r2   r3   rW   request_header_to_excluderequest_cookie_to_excluderequest_query_param_to_excluderequest_uri_to_excluder]   rD   )r'   r>   existing_ruleargsnew_preconfig_waf_config	exclusionr[   s          r(   _UpdatePreconfigWafConfig8AddPreconfigWafExclusionHelper._UpdatePreconfigWafConfig   s    ++!)!:!:

.
."0 
!
!
J
J
L  .88					+?+? $ 4 4 :
< 
<^!;;!;;!@@!88		:
 (' 9 ((9M9M)-)=)=)-)G)G)-)G)G)-)L)L)-)D)DFM ''..}=##r+   c           
         UR                  S5      (       d]  UR                  S5      (       dG  UR                  S5      (       d1  UR                  S5      (       d  / SQn[        R                  " US5      eUR                  =(       d    / UR                  =(       d    / UR
                  =(       d    / UR                  =(       d    / 4 HJ  nU HA  nUR                  S5      =(       d    SnU(       a  US	;  d  M,  [        R                  " SS
5      e   ML     [        R                  " U5      nUR                  nSn	UR                  (       Ga  U R                  R                  UUR                  [         R"                  R$                  S9n
['        U
SS5      bj  UR                  R)                  UR*                  S[,        R.                  R0                  R2                  R4                  U
R6                  UR                  S.S9n	OUR                  R)                  UR*                  S[,        R.                  R0                  R2                  R4                  UR                  S.S9n	O` UR                  R)                  UR*                  S[,        R.                  R0                  R2                  R4                  ['        USS5      S.S9n	[        R<                  " XS9nUR?                  5       S   nU RA                  XU5      nURC                  US9$ ! [        R8                  [        R:                  4 aV    UR                  R)                  UR*                  SS[,        R.                  R0                  R2                  R4                  0S9n	 Nf = f)z7Validates arguments and patches a security policy rule.rd   re   rf   rg   )z--request-header-to-excludez--request-cookie-to-excludez --request-query-param-to-excludez--request-uri-to-excludez-At least one request field must be specified.r7   r8   )EQUALSSTARTS_WITH	ENDS_WITHCONTAINS
EQUALS_ANYz_A request field operator must be one of [EQUALS, STARTS_WITH, ENDS_WITH, CONTAINS, EQUALS_ANY].N)default_scoperegionz!compute.regionSecurityPolicyRules)projectru   securityPolicy)
collectionparamszcompute.securityPolicyRules)rv   rw   )rv   ru   rv   )r>   r   )preconfig_waf_config)"IsSpecifiedr
   MinimumArgumentExceptionrd   re   rf   rg   r<   InvalidArgumentExceptionr   ComputeApiHolderr   security_policyr   ResolveAsResourcer   compute_scope	ScopeEnumGLOBALgetattrParsenamer   VALUEScorerv   	GetOrFailru   RequiredFieldOmittedException WrongResourceCollectionExceptionSecurityPolicyRuleDescriberl   Patch)r'   release_trackri   request_field_namesrequest_fieldsr@   r7   holderr>   refsecurity_policy_refsecurity_policy_rulerh   rj   s                 r(   Run"AddPreconfigWafExclusionHelper.Run   s@    899899=>>566 //
NP P 	&&,"d.L.L /
D//52##)r
 *-t$*R  
 
 3323 3 * **=9F]]N
C33EE



%//66 F 8 
$h	5	A$$II:%,,1199CC-44"&"6"6 %  $$II4%,,1199CC"&"6"6 % 

$$II:%,,1199CC!$$7 % 
& "44,(113A6M"<<t -%%5 & 7 7! 
1
1

4
4 

 $$II4:,,1199CC % 
	

s   AL A7N ?N  r-   )NNNN)NNNNN)__name__
__module____qualname____firstlineno____doc__classmethodr)   r4   rA   rH   rW   r]   rl   r   __static_attributes__r   r+   r(   r   r   "   s    @ 4 42  *.B B  & 6 6  (,'+,0$(Q Q0  (,'+'+,0$( & $ $8 R7 R7r+   r   c                   2    \ rS rSrSrSr\S 5       rS rSr	g)AddPreconfigWafExclusionGAi$  r   Nc                 .    [         R                  U5        g r-   )r   r)   r&   s     r(   r)   AddPreconfigWafExclusionGA.ArgsH  s    "''r+   c                 J    [         R                  U R                  5       U5      $ r-   )r   r   ReleaseTrack)selfri   s     r(   r   AddPreconfigWafExclusionGA.RunN  s$    )-- r+   r   )
r   r   r   r   r   r   r   r)   r   r   r   r+   r(   r   r   $  s&    @ ( 
r+   r   c                       \ rS rSrSrSrg)AddPreconfigWafExclusionBetaiU  r   r   Nr   r   r   r   r   r   r   r+   r(   r   r   U      r+   r   c                       \ rS rSrSrSrg)AddPreconfigWafExclusionAlphaix  r   r   Nr   r   r+   r(   r   r   x  r   r+   r   N)#r   
__future__r   r   r   apitools.base.pyr   googlecloudsdk.api_lib.computer   0googlecloudsdk.api_lib.compute.security_policiesr   googlecloudsdk.callioper	   r
   "googlecloudsdk.command_lib.computer   r   4googlecloudsdk.command_lib.compute.security_policiesr   r   :googlecloudsdk.command_lib.compute.security_policies.rulesgooglecloudsdk.corer   r   objectr   ReleaseTracksr   GAUpdateCommandr   BETAr   ALPHAr   r   r+   r(   <module>r      s    d &  ' % 7 C ( . E _ L * )7V 7D D%%(()-!3!3 - *-` D%%**+#=  ,D D%%++,$@  -r+   