Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add FirewallRule class #86

Closed
wants to merge 2 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ and this project adheres to

## [Unreleased]

- Added the `FirewallRule` class.
- Stop requiring `ipAddress` on `NetworkEndpoint` class. Azure private endpoints
actually relate to a `NetworkInterface` entity, where the IP address lives.

Expand Down
4 changes: 4 additions & 0 deletions src/IntegrationSchema.ts
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,10 @@ import FrameworkJson from './schemas/Framework.json';
export const Framework = FrameworkJson;
IntegrationSchema.addSchema(Framework);

import FirewallRuleJson from './schemas/FirewallRule.json';
export const FirewallRule = FirewallRuleJson;
IntegrationSchema.addSchema(FirewallRule);

import FirewallJson from './schemas/Firewall.json';
export const Firewall = FirewallJson;
IntegrationSchema.addSchema(Firewall);
Expand Down
59 changes: 59 additions & 0 deletions src/schemas/FirewallRule.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
{
"$schema": "http://json-schema.org/draft-07/schema#",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will we need to port these changes to the AWS integration? It looks like we just put these rules in an array on a key for that integration.
https://bitbucket.org/jupiterone/jupiter-integration-aws/src/b1b082a76600f85738911adbea9d4112869059e7/src/integration-aws/ec2/converters/entities.ts?at=master#entities.ts-583

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also assume you already took a look at Rule, but thought I'd bring that up as well.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, if this goes through I think it'd be good to get it into existing integrations like AWS, since the JSON.stringify(ipPermission) operation makes these properties useless from a query language perspective.

I have looked at Rule but IMO a firewall rule is a super-specific class of configuration (as indicated by the common properties shared across all firewall rules)

"$id": "#FirewallRule",
"description": "A network rule defined on a Firewall or host.",
"type": "object",
"allOf": [
{ "$ref": "#Entity" },
{
"properties": {
"priority": {
"description": "Priority of the firewall rule. Typically, a number between 0 and 65535.",
"type": "integer"
},
"source": {
"description": "Source of the firewall rule. Can be IP address, CIDR range, '*', or other firewall-defined options.",
"type": "string"
},
"sourceIp": {
"description": "Source IP of the firewall rule.",
"type": "string",
"format": "ip"
},
"sourcePort": {
"description": "Source port of the firewall rule. Typically an integer between 0 and 65535, but could also be '*' or range of ports.",
"type": ["integer", "string"]
},
"destination": {
"description": "Destination of the firewall rule. Can be IP address, CIDR range, '*', or other firewall-defined options.",
"type": "string"
},
"destinationIp": {
"description": "Destination IP of the firewall rule.",
"type": "string",
"format": "ip"
},
"destinationPort": {
"description": "Destination port of the firewall rule. Typically an integer between 0 and 65535, but could also be 'Any', '*', or range of ports.",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we recommend only * instead of Any?

"type": ["integer", "string"]
},
"protocol": {
"description": "The protocol of the firewall rule.",
"type": "string",
"examples": ["TCP", "UDP", "*"]
},
"direction": {
"description": "The direction defined by the firewall rule, typically 'ingress' or 'egress'",
"type": "string",
"examples": ["ingress", "egress"]
},
"action": {
"description": "The action defined by the firewall rule, typically 'Allow' or 'Deny'",
"type": "string",
"examples": ["allow", "deny"]
}
},
"required": []
}
]
}