diff --git a/README.md b/README.md index 219026b..aa485b5 100644 --- a/README.md +++ b/README.md @@ -33,6 +33,9 @@ provider "tomswallapi" { | `tomswallapi_device` | name | `class` = router/firewall, `fabric`, `resolver`, `settings` | | `tomswallapi_binding` | device:zone | zone→interface map (import as `device:zone`) | | `tomswallapi_rule` | id | shorewall-style `source`/`dest` element lists | +| `tomswallapi_snat` | id | masquerade/SNAT; `source` zone-or-CIDR, `egress` zone | +| `tomswallapi_netmap` | id | net-to-net map, anchored `device:zone`\|`device:interface` | +| `tomswallapi_nat` | id | 1:1 static NAT bound to a `device` | ## Example diff --git a/examples/main.tf b/examples/main.tf index 2da76b3..8e028df 100644 --- a/examples/main.tf +++ b/examples/main.tf @@ -88,3 +88,29 @@ resource "tomswallapi_rule" "a_to_cloudflare" { dest = ["net:+asn_cloudflare"] portgroup = tomswallapi_portgroup.https.name } + +# --- NAT tier --------------------------------------------------------------- + +# Masquerade zone-a out the internet edge. Renders on devices binding both +# zone-a and net (i.e. edge firewalls), on their net-facing interface. +resource "tomswallapi_snat" "masq_zone_a" { + action = "masquerade" + source = tomswallapi_zone.zone_a.name + egress = tomswallapi_zone.net.name +} + +# 1:1 static NAT of a public IP to an internal host, on fw-a. +resource "tomswallapi_nat" "web" { + device = tomswallapi_device.fw_a.name + external = "203.0.113.10" + internal = "10.1.0.10" + interface = "eth0" +} + +# Network-to-network map anchored at fw-a's net interface. +resource "tomswallapi_netmap" "remap" { + type = "dnat" + from_net = "10.0.0.0/24" + to_net = "192.168.1.0/24" + anchor = "${tomswallapi_device.fw_a.name}:${tomswallapi_zone.net.name}" +} diff --git a/internal/provider/provider.go b/internal/provider/provider.go index 7f314b2..58c8bb2 100644 --- a/internal/provider/provider.go +++ b/internal/provider/provider.go @@ -75,6 +75,9 @@ func (p *tomswallProvider) Resources(_ context.Context) []func() resource.Resour NewDeviceResource, NewBindingResource, NewRuleResource, + NewSNATResource, + NewNetmapResource, + NewNATResource, } } diff --git a/internal/provider/resource_nat.go b/internal/provider/resource_nat.go new file mode 100644 index 0000000..465a440 --- /dev/null +++ b/internal/provider/resource_nat.go @@ -0,0 +1,173 @@ +package provider + +import ( + "context" + "strconv" + + "github.com/hashicorp/terraform-plugin-framework/path" + "github.com/hashicorp/terraform-plugin-framework/resource" + "github.com/hashicorp/terraform-plugin-framework/resource/schema" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier" + "github.com/hashicorp/terraform-plugin-framework/types" +) + +var ( + _ resource.Resource = &natResource{} + _ resource.ResourceWithImportState = &natResource{} +) + +type natResource struct{ client *apiClient } + +type natModel struct { + ID types.Int64 `tfsdk:"id"` + Device types.String `tfsdk:"device"` + External types.String `tfsdk:"external"` + Internal types.String `tfsdk:"internal"` + Interface types.String `tfsdk:"interface"` + Comment types.String `tfsdk:"comment"` +} + +type natAPI struct { + ID int64 `json:"id,omitempty"` + Device string `json:"device"` + External string `json:"external"` + Internal string `json:"internal"` + Interface string `json:"interface,omitempty"` + Comment string `json:"comment,omitempty"` +} + +func NewNATResource() resource.Resource { return &natResource{} } + +func (r *natResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) { + resp.TypeName = req.ProviderTypeName + "_nat" +} + +func (r *natResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) { + resp.Schema = schema.Schema{ + Description: "A one-to-one static NAT bound to the device that owns the external IP.", + Attributes: map[string]schema.Attribute{ + "id": schema.Int64Attribute{ + Description: "Server-assigned id.", + Computed: true, + PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}, + }, + "device": schema.StringAttribute{ + Description: "Device that holds the external address.", + Required: true, + }, + "external": schema.StringAttribute{ + Description: "External IP address.", + Required: true, + }, + "internal": schema.StringAttribute{ + Description: "Internal IP address.", + Required: true, + }, + "interface": schema.StringAttribute{ + Description: "Interface that has the external address.", + Optional: true, + }, + "comment": schema.StringAttribute{Optional: true}, + }, + } +} + +func (r *natResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) { + r.client = configureClient(req, resp) +} + +func (r *natResource) body(plan natModel) natAPI { + return natAPI{ + Device: plan.Device.ValueString(), + External: plan.External.ValueString(), + Internal: plan.Internal.ValueString(), + Interface: plan.Interface.ValueString(), + Comment: plan.Comment.ValueString(), + } +} + +func (r *natResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { + var plan natModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + var out natAPI + if err := r.client.post(ctx, "/api/v1/nat", r.body(plan), &out); err != nil { + resp.Diagnostics.AddError("create nat failed", err.Error()) + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...) +} + +// Update: the nat API is create/delete only, so recreate and delete the old id. +func (r *natResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) { + var plan, state natModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + var out natAPI + if err := r.client.post(ctx, "/api/v1/nat", r.body(plan), &out); err != nil { + resp.Diagnostics.AddError("recreate nat failed", err.Error()) + return + } + if id := state.ID.ValueInt64(); id != 0 { + if err := r.client.del(ctx, "/api/v1/nat/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) { + resp.Diagnostics.AddError("delete old nat failed", err.Error()) + return + } + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...) +} + +func (r *natResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { + var state natModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + var out natAPI + if err := r.client.get(ctx, "/api/v1/nat/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil { + if isNotFound(err) { + resp.State.RemoveResource(ctx) + return + } + resp.Diagnostics.AddError("read nat failed", err.Error()) + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...) +} + +func (r *natResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { + var state natModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + if err := r.client.del(ctx, "/api/v1/nat/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) { + resp.Diagnostics.AddError("delete nat failed", err.Error()) + } +} + +func (r *natResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) { + id, err := strconv.ParseInt(req.ID, 10, 64) + if err != nil { + resp.Diagnostics.AddError("invalid import ID", "nat id must be an integer") + return + } + resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...) +} + +func (r *natResource) toModel(api natAPI, prior natModel) natModel { + return natModel{ + ID: types.Int64Value(api.ID), + Device: types.StringValue(api.Device), + External: types.StringValue(api.External), + Internal: types.StringValue(api.Internal), + Interface: optionalString(api.Interface, prior.Interface), + Comment: optionalString(api.Comment, prior.Comment), + } +} diff --git a/internal/provider/resource_netmap.go b/internal/provider/resource_netmap.go new file mode 100644 index 0000000..02fc997 --- /dev/null +++ b/internal/provider/resource_netmap.go @@ -0,0 +1,173 @@ +package provider + +import ( + "context" + "strconv" + + "github.com/hashicorp/terraform-plugin-framework/path" + "github.com/hashicorp/terraform-plugin-framework/resource" + "github.com/hashicorp/terraform-plugin-framework/resource/schema" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier" + "github.com/hashicorp/terraform-plugin-framework/types" +) + +var ( + _ resource.Resource = &netmapResource{} + _ resource.ResourceWithImportState = &netmapResource{} +) + +type netmapResource struct{ client *apiClient } + +type netmapModel struct { + ID types.Int64 `tfsdk:"id"` + Type types.String `tfsdk:"type"` + FromNet types.String `tfsdk:"from_net"` + ToNet types.String `tfsdk:"to_net"` + Anchor types.String `tfsdk:"anchor"` + Comment types.String `tfsdk:"comment"` +} + +type netmapAPI struct { + ID int64 `json:"id,omitempty"` + Type string `json:"type"` + FromNet string `json:"from_net"` + ToNet string `json:"to_net"` + Anchor string `json:"anchor"` + Comment string `json:"comment,omitempty"` +} + +func NewNetmapResource() resource.Resource { return &netmapResource{} } + +func (r *netmapResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) { + resp.TypeName = req.ProviderTypeName + "_netmap" +} + +func (r *netmapResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) { + resp.Schema = schema.Schema{ + Description: "A network-to-network mapping (netmap), anchored at a device:zone or device:interface. It renders on the anchored device with the zone resolved to its bound interface.", + Attributes: map[string]schema.Attribute{ + "id": schema.Int64Attribute{ + Description: "Server-assigned id.", + Computed: true, + PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}, + }, + "type": schema.StringAttribute{ + Description: "dnat or snat.", + Required: true, + }, + "from_net": schema.StringAttribute{ + Description: "Network (CIDR) to match.", + Required: true, + }, + "to_net": schema.StringAttribute{ + Description: "Network (CIDR) to rewrite to.", + Required: true, + }, + "anchor": schema.StringAttribute{ + Description: "Anchor as device:zone or device:interface.", + Required: true, + }, + "comment": schema.StringAttribute{Optional: true}, + }, + } +} + +func (r *netmapResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) { + r.client = configureClient(req, resp) +} + +func (r *netmapResource) body(plan netmapModel) netmapAPI { + return netmapAPI{ + Type: plan.Type.ValueString(), + FromNet: plan.FromNet.ValueString(), + ToNet: plan.ToNet.ValueString(), + Anchor: plan.Anchor.ValueString(), + Comment: plan.Comment.ValueString(), + } +} + +func (r *netmapResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { + var plan netmapModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + var out netmapAPI + if err := r.client.post(ctx, "/api/v1/netmap", r.body(plan), &out); err != nil { + resp.Diagnostics.AddError("create netmap failed", err.Error()) + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...) +} + +// Update: the netmap API is create/delete only, so recreate and delete the old id. +func (r *netmapResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) { + var plan, state netmapModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + var out netmapAPI + if err := r.client.post(ctx, "/api/v1/netmap", r.body(plan), &out); err != nil { + resp.Diagnostics.AddError("recreate netmap failed", err.Error()) + return + } + if id := state.ID.ValueInt64(); id != 0 { + if err := r.client.del(ctx, "/api/v1/netmap/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) { + resp.Diagnostics.AddError("delete old netmap failed", err.Error()) + return + } + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...) +} + +func (r *netmapResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { + var state netmapModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + var out netmapAPI + if err := r.client.get(ctx, "/api/v1/netmap/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil { + if isNotFound(err) { + resp.State.RemoveResource(ctx) + return + } + resp.Diagnostics.AddError("read netmap failed", err.Error()) + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...) +} + +func (r *netmapResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { + var state netmapModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + if err := r.client.del(ctx, "/api/v1/netmap/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) { + resp.Diagnostics.AddError("delete netmap failed", err.Error()) + } +} + +func (r *netmapResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) { + id, err := strconv.ParseInt(req.ID, 10, 64) + if err != nil { + resp.Diagnostics.AddError("invalid import ID", "netmap id must be an integer") + return + } + resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...) +} + +func (r *netmapResource) toModel(api netmapAPI, prior netmapModel) netmapModel { + return netmapModel{ + ID: types.Int64Value(api.ID), + Type: types.StringValue(api.Type), + FromNet: types.StringValue(api.FromNet), + ToNet: types.StringValue(api.ToNet), + Anchor: types.StringValue(api.Anchor), + Comment: optionalString(api.Comment, prior.Comment), + } +} diff --git a/internal/provider/resource_snat.go b/internal/provider/resource_snat.go new file mode 100644 index 0000000..2b30608 --- /dev/null +++ b/internal/provider/resource_snat.go @@ -0,0 +1,190 @@ +package provider + +import ( + "context" + "strconv" + + "github.com/hashicorp/terraform-plugin-framework/path" + "github.com/hashicorp/terraform-plugin-framework/resource" + "github.com/hashicorp/terraform-plugin-framework/resource/schema" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier" + "github.com/hashicorp/terraform-plugin-framework/types" +) + +var ( + _ resource.Resource = &snatResource{} + _ resource.ResourceWithImportState = &snatResource{} +) + +type snatResource struct{ client *apiClient } + +type snatModel struct { + ID types.Int64 `tfsdk:"id"` + Action types.String `tfsdk:"action"` + Source types.String `tfsdk:"source"` + Egress types.String `tfsdk:"egress"` + Address types.String `tfsdk:"address"` + Probability types.Float64 `tfsdk:"probability"` + Comment types.String `tfsdk:"comment"` +} + +type snatAPI struct { + ID int64 `json:"id,omitempty"` + Action string `json:"action"` + Source string `json:"source"` + Egress string `json:"egress"` + Address string `json:"address,omitempty"` + Probability *float64 `json:"probability,omitempty"` + Comment string `json:"comment,omitempty"` +} + +func NewSNATResource() resource.Resource { return &snatResource{} } + +func (r *snatResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) { + resp.TypeName = req.ProviderTypeName + "_snat" +} + +func (r *snatResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) { + resp.Schema = schema.Schema{ + Description: "A source-NAT / masquerade intent. It renders on devices that bind the egress zone (and, for a zone source, that zone too) — auto-scoping masquerade to edges.", + Attributes: map[string]schema.Attribute{ + "id": schema.Int64Attribute{ + Description: "Server-assigned id.", + Computed: true, + PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()}, + }, + "action": schema.StringAttribute{ + Description: "masquerade or snat.", + Required: true, + }, + "source": schema.StringAttribute{ + Description: "Source zone name or a literal CIDR to masquerade/SNAT.", + Required: true, + }, + "egress": schema.StringAttribute{ + Description: "Egress zone; resolved per device to its egress interface via bindings.", + Required: true, + }, + "address": schema.StringAttribute{ + Description: "For snat: the address (or range) to rewrite the source to.", + Optional: true, + }, + "probability": schema.Float64Attribute{ + Description: "Match probability (0-1) for load-balanced SNAT.", + Optional: true, + }, + "comment": schema.StringAttribute{Optional: true}, + }, + } +} + +func (r *snatResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) { + r.client = configureClient(req, resp) +} + +func (r *snatResource) body(plan snatModel) snatAPI { + b := snatAPI{ + Action: plan.Action.ValueString(), + Source: plan.Source.ValueString(), + Egress: plan.Egress.ValueString(), + Address: plan.Address.ValueString(), + Comment: plan.Comment.ValueString(), + } + if !plan.Probability.IsNull() && !plan.Probability.IsUnknown() { + p := plan.Probability.ValueFloat64() + b.Probability = &p + } + return b +} + +func (r *snatResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { + var plan snatModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + var out snatAPI + if err := r.client.post(ctx, "/api/v1/snat", r.body(plan), &out); err != nil { + resp.Diagnostics.AddError("create snat failed", err.Error()) + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...) +} + +// Update: the snat API is create/delete only, so recreate and delete the old id. +func (r *snatResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) { + var plan, state snatModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + var out snatAPI + if err := r.client.post(ctx, "/api/v1/snat", r.body(plan), &out); err != nil { + resp.Diagnostics.AddError("recreate snat failed", err.Error()) + return + } + if id := state.ID.ValueInt64(); id != 0 { + if err := r.client.del(ctx, "/api/v1/snat/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) { + resp.Diagnostics.AddError("delete old snat failed", err.Error()) + return + } + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...) +} + +func (r *snatResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { + var state snatModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + var out snatAPI + if err := r.client.get(ctx, "/api/v1/snat/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil { + if isNotFound(err) { + resp.State.RemoveResource(ctx) + return + } + resp.Diagnostics.AddError("read snat failed", err.Error()) + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...) +} + +func (r *snatResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { + var state snatModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + if err := r.client.del(ctx, "/api/v1/snat/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) { + resp.Diagnostics.AddError("delete snat failed", err.Error()) + } +} + +func (r *snatResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) { + id, err := strconv.ParseInt(req.ID, 10, 64) + if err != nil { + resp.Diagnostics.AddError("invalid import ID", "snat id must be an integer") + return + } + resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...) +} + +func (r *snatResource) toModel(api snatAPI, prior snatModel) snatModel { + m := snatModel{ + ID: types.Int64Value(api.ID), + Action: types.StringValue(api.Action), + Source: types.StringValue(api.Source), + Egress: types.StringValue(api.Egress), + Address: optionalString(api.Address, prior.Address), + Comment: optionalString(api.Comment, prior.Comment), + } + if api.Probability != nil { + m.Probability = types.Float64Value(*api.Probability) + } else { + m.Probability = prior.Probability + } + return m +}