diff --git a/README.md b/README.md index 9a377b9d..3d826c0d 100644 --- a/README.md +++ b/README.md @@ -125,7 +125,7 @@ make local.run | [阿里云](https://www.aliyun.com/) | 可部署到阿里云 OSS、CDN、DCDN、ESA、SLB（CLB/ALB/NLB）、WAF、Live 等服务 | | [腾讯云](https://cloud.tencent.com/) | 可部署到腾讯云 COS、CDN、ECDN、EdgeOne、CLB、CSS 等服务 | | [百度智能云](https://cloud.baidu.com/) | 可部署到百度智能云 CDN 等服务 | -| [华为云](https://www.huaweicloud.com/) | 可部署到华为云 CDN、ELB 等服务 | +| [华为云](https://www.huaweicloud.com/) | 可部署到华为云 CDN、ELB、WAF 等服务 | | [火山引擎](https://www.volcengine.com/) | 可部署到火山引擎 TOS、CDN、DCDN、CLB、ImageX、Live 等服务 | | [七牛云](https://www.qiniu.com/) | 可部署到七牛云 CDN、直播云等服务 | | [多吉云](https://www.dogecloud.com/) | 可部署到多吉云 CDN | diff --git a/README_EN.md b/README_EN.md index 47c654f2..31713b7a 100644 --- a/README_EN.md +++ b/README_EN.md @@ -124,7 +124,7 @@ The following hosting providers are supported: | [Alibaba Cloud](https://www.alibabacloud.com/) | Supports deployment to Alibaba Cloud OSS, CDN, DCDN, SLB(CLB/ALB/NLB), WAF, Live | | [Tencent Cloud](https://www.tencentcloud.com/) | Supports deployment to Tencent Cloud COS, CDN, ECDN, EdgeOne, CLB, CSS | | [Baidu AI Cloud](https://intl.cloud.baidu.com/) | Supports deployment to Baidu AI CLoud CDN | -| [Huawei Cloud](https://www.huaweicloud.com/) | Supports deployment to Huawei Cloud CDN, ELB | +| [Huawei Cloud](https://www.huaweicloud.com/) | Supports deployment to Huawei Cloud CDN, ELB, WAF | | [Volcengine](https://www.volcengine.com/) | Supports deployment to Volcengine TOS, CDN, DCDN, CLB, ImageX, Live | | [Qiniu Cloud](https://www.qiniu.com/) | Supports deployment to Qiniu Cloud CDN, Pili | | [Doge Cloud](https://www.dogecloud.com/) | Supports deployment to Doge Cloud CDN | diff --git a/internal/deployer/providers.go b/internal/deployer/providers.go index 8d92b10f..22d294c8 100644 --- a/internal/deployer/providers.go +++ b/internal/deployer/providers.go @@ -25,6 +25,7 @@ import ( pEdgioApplications "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/edgio-applications" pHuaweiCloudCDN "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/huaweicloud-cdn" pHuaweiCloudELB "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/huaweicloud-elb" + pHuaweiCloudWAF "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/huaweicloud-waf" pK8sSecret "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/k8s-secret" pLocal "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/local" pQiniuCDN "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/qiniu-cdn" @@ -72,7 +73,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger, AccessKeyId: access.AccessKeyId, AccessKeySecret: access.AccessKeySecret, Region: maps.GetValueAsString(options.ProviderDeployConfig, "region"), - ResourceType: pAliyunALB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), + ResourceType: pAliyunALB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), LoadbalancerId: maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"), ListenerId: maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"), Domain: maps.GetValueAsString(options.ProviderDeployConfig, "domain"), @@ -102,7 +103,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger, AccessKeyId: access.AccessKeyId, AccessKeySecret: access.AccessKeySecret, Region: maps.GetValueAsString(options.ProviderDeployConfig, "region"), - ResourceType: pAliyunCLB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), + ResourceType: pAliyunCLB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), LoadbalancerId: maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"), ListenerPort: maps.GetValueOrDefaultAsInt32(options.ProviderDeployConfig, "listenerPort", 443), Domain: maps.GetValueAsString(options.ProviderDeployConfig, "domain"), @@ -140,7 +141,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger, AccessKeyId: access.AccessKeyId, AccessKeySecret: access.AccessKeySecret, Region: maps.GetValueAsString(options.ProviderDeployConfig, "region"), - ResourceType: pAliyunNLB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), + ResourceType: pAliyunNLB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), LoadbalancerId: maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"), ListenerId: maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"), }, logger) @@ -293,7 +294,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger, return deployer, logger, err } - case domain.DeployProviderTypeHuaweiCloudCDN, domain.DeployProviderTypeHuaweiCloudELB: + case domain.DeployProviderTypeHuaweiCloudCDN, domain.DeployProviderTypeHuaweiCloudELB, domain.DeployProviderTypeHuaweiCloudWAF: { access := domain.AccessConfigForHuaweiCloud{} if err := maps.Populate(options.ProviderAccessConfig, &access); err != nil { @@ -315,13 +316,24 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger, AccessKeyId: access.AccessKeyId, SecretAccessKey: access.SecretAccessKey, Region: maps.GetValueAsString(options.ProviderDeployConfig, "region"), - ResourceType: pHuaweiCloudELB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), + ResourceType: pHuaweiCloudELB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), CertificateId: maps.GetValueAsString(options.ProviderDeployConfig, "certificateId"), LoadbalancerId: maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"), ListenerId: maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"), }, logger) return deployer, logger, err + case domain.DeployProviderTypeHuaweiCloudWAF: + deployer, err := pHuaweiCloudWAF.NewWithLogger(&pHuaweiCloudWAF.HuaweiCloudWAFDeployerConfig{ + AccessKeyId: access.AccessKeyId, + SecretAccessKey: access.SecretAccessKey, + Region: maps.GetValueAsString(options.ProviderDeployConfig, "region"), + ResourceType: pHuaweiCloudWAF.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), + CertificateId: maps.GetValueAsString(options.ProviderDeployConfig, "certificateId"), + Domain: maps.GetValueAsString(options.ProviderDeployConfig, "domain"), + }, logger) + return deployer, logger, err + default: break } @@ -441,7 +453,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger, SecretId: access.SecretId, SecretKey: access.SecretKey, Region: maps.GetValueAsString(options.ProviderDeployConfig, "region"), - ResourceType: pTencentCloudCLB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), + ResourceType: pTencentCloudCLB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), LoadbalancerId: maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"), ListenerId: maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"), Domain: maps.GetValueAsString(options.ProviderDeployConfig, "domain"), @@ -552,7 +564,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger, AccessKeyId: access.AccessKeyId, AccessKeySecret: access.SecretAccessKey, Region: maps.GetValueAsString(options.ProviderDeployConfig, "region"), - ResourceType: pVolcEngineCLB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), + ResourceType: pVolcEngineCLB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")), ListenerId: maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"), }, logger) return deployer, logger, err diff --git a/internal/domain/provider.go b/internal/domain/provider.go index c8425b06..015e4f28 100644 --- a/internal/domain/provider.go +++ b/internal/domain/provider.go @@ -114,6 +114,7 @@ const ( DeployProviderTypeEdgioApplications = DeployProviderType("edgio-applications") DeployProviderTypeHuaweiCloudCDN = DeployProviderType("huaweicloud-cdn") DeployProviderTypeHuaweiCloudELB = DeployProviderType("huaweicloud-elb") + DeployProviderTypeHuaweiCloudWAF = DeployProviderType("huaweicloud-waf") DeployProviderTypeKubernetesSecret = DeployProviderType("k8s-secret") DeployProviderTypeLocal = DeployProviderType("local") DeployProviderTypeQiniuCDN = DeployProviderType("qiniu-cdn") diff --git a/internal/pkg/core/deployer/providers/huaweicloud-waf/consts.go b/internal/pkg/core/deployer/providers/huaweicloud-waf/consts.go new file mode 100644 index 00000000..fc574c32 --- /dev/null +++ b/internal/pkg/core/deployer/providers/huaweicloud-waf/consts.go @@ -0,0 +1,12 @@ +package huaweicloudwaf + +type ResourceType string + +const ( + // 资源类型：替换指定证书。 + RESOURCE_TYPE_CERTIFICATE = ResourceType("certificate") + // 资源类型：部署到云模式防护网站。 + RESOURCE_TYPE_CLOUDSERVER = ResourceType("cloudserver") + // 资源类型：部署到独享模式防护网站。 + RESOURCE_TYPE_PREMIUMHOST = ResourceType("premiumhost") +) diff --git a/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf.go b/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf.go new file mode 100644 index 00000000..80ac4fe6 --- /dev/null +++ b/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf.go @@ -0,0 +1,358 @@ +package huaweicloudwaf + +import ( + "context" + "errors" + "fmt" + "strings" + + "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" + "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/global" + hcIam "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3" + hcIamModel "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3/model" + hcIamRegion "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3/region" + hcWaf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1" + hcWafModel "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model" + hcWafRegion "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region" + xerrors "github.com/pkg/errors" + + "github.com/usual2970/certimate/internal/pkg/core/deployer" + "github.com/usual2970/certimate/internal/pkg/core/logger" + "github.com/usual2970/certimate/internal/pkg/core/uploader" + uploaderp "github.com/usual2970/certimate/internal/pkg/core/uploader/providers/huaweicloud-waf" + hwsdk "github.com/usual2970/certimate/internal/pkg/vendors/huaweicloud-sdk" +) + +type HuaweiCloudWAFDeployerConfig struct { + // 华为云 AccessKeyId。 + AccessKeyId string `json:"accessKeyId"` + // 华为云 SecretAccessKey。 + SecretAccessKey string `json:"secretAccessKey"` + // 华为云区域。 + Region string `json:"region"` + // 部署资源类型。 + ResourceType ResourceType `json:"resourceType"` + // 证书 ID。 + // 部署资源类型为 [RESOURCE_TYPE_CERTIFICATE] 时必填。 + CertificateId string `json:"certificateId,omitempty"` + // 防护域名（支持泛域名）。 + // 部署资源类型为 [RESOURCE_TYPE_CLOUDSERVER]、[RESOURCE_TYPE_PREMIUMHOST] 时必填。 + Domain string `json:"domain,omitempty"` +} + +type HuaweiCloudWAFDeployer struct { + config *HuaweiCloudWAFDeployerConfig + logger logger.Logger + sdkClient *hcWaf.WafClient + sslUploader uploader.Uploader +} + +var _ deployer.Deployer = (*HuaweiCloudWAFDeployer)(nil) + +func New(config *HuaweiCloudWAFDeployerConfig) (*HuaweiCloudWAFDeployer, error) { + return NewWithLogger(config, logger.NewNilLogger()) +} + +func NewWithLogger(config *HuaweiCloudWAFDeployerConfig, logger logger.Logger) (*HuaweiCloudWAFDeployer, error) { + if config == nil { + return nil, errors.New("config is nil") + } + + if logger == nil { + return nil, errors.New("logger is nil") + } + + client, err := createSdkClient(config.AccessKeyId, config.SecretAccessKey, config.Region) + if err != nil { + return nil, xerrors.Wrap(err, "failed to create sdk client") + } + + uploader, err := uploaderp.New(&uploaderp.HuaweiCloudWAFUploaderConfig{ + AccessKeyId: config.AccessKeyId, + SecretAccessKey: config.SecretAccessKey, + Region: config.Region, + }) + if err != nil { + return nil, xerrors.Wrap(err, "failed to create ssl uploader") + } + + return &HuaweiCloudWAFDeployer{ + logger: logger, + config: config, + sdkClient: client, + sslUploader: uploader, + }, nil +} + +func (d *HuaweiCloudWAFDeployer) Deploy(ctx context.Context, certPem string, privkeyPem string) (*deployer.DeployResult, error) { + // 上传证书到 WAF + upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem) + if err != nil { + return nil, xerrors.Wrap(err, "failed to upload certificate file") + } + + d.logger.Logt("certificate file uploaded", upres) + + // 根据部署资源类型决定部署方式 + switch d.config.ResourceType { + case RESOURCE_TYPE_CERTIFICATE: + if err := d.deployToCertificate(ctx, certPem, privkeyPem); err != nil { + return nil, err + } + + case RESOURCE_TYPE_CLOUDSERVER: + if err := d.deployToCloudServer(ctx, certPem, privkeyPem); err != nil { + return nil, err + } + + case RESOURCE_TYPE_PREMIUMHOST: + if err := d.deployToPremiumHost(ctx, certPem, privkeyPem); err != nil { + return nil, err + } + + default: + return nil, fmt.Errorf("unsupported resource type: %s", d.config.ResourceType) + } + + return &deployer.DeployResult{}, nil +} + +func (d *HuaweiCloudWAFDeployer) deployToCertificate(ctx context.Context, certPem string, privkeyPem string) error { + if d.config.CertificateId == "" { + return errors.New("config `certificateId` is required") + } + + // 查询证书 + // REF: https://support.huaweicloud.com/api-waf/ShowCertificate.html + showCertificateReq := &hcWafModel.ShowCertificateRequest{ + CertificateId: d.config.CertificateId, + } + showCertificateResp, err := d.sdkClient.ShowCertificate(showCertificateReq) + if err != nil { + return xerrors.Wrap(err, "failed to execute sdk request 'waf.ShowCertificate'") + } else { + d.logger.Logt("已获取 WAF 证书", showCertificateResp) + } + + // 更新证书 + // REF: https://support.huaweicloud.com/api-waf/UpdateCertificate.html + updateCertificateReq := &hcWafModel.UpdateCertificateRequest{ + CertificateId: d.config.CertificateId, + Body: &hcWafModel.UpdateCertificateRequestBody{ + Name: *showCertificateResp.Name, + Content: hwsdk.StringPtr(certPem), + Key: hwsdk.StringPtr(privkeyPem), + }, + } + updateCertificateResp, err := d.sdkClient.UpdateCertificate(updateCertificateReq) + if err != nil { + return xerrors.Wrap(err, "failed to execute sdk request 'waf.UpdateCertificate'") + } else { + d.logger.Logt("已更新 WAF 证书", updateCertificateResp) + } + + return nil +} + +func (d *HuaweiCloudWAFDeployer) deployToCloudServer(ctx context.Context, certPem string, privkeyPem string) error { + if d.config.Domain == "" { + return errors.New("config `domain` is required") + } + + // 上传证书到 WAF + upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem) + if err != nil { + return xerrors.Wrap(err, "failed to upload certificate file") + } else { + d.logger.Logt("certificate file uploaded", upres) + } + + // 遍历查询云模式防护域名列表，获取防护域名 ID + // REF: https://support.huaweicloud.com/api-waf/ListHost.html + hostId := "" + listHostPage := int32(1) + listHostPageSize := int32(100) + for { + listHostReq := &hcWafModel.ListHostRequest{ + Hostname: hwsdk.StringPtr(strings.TrimPrefix(d.config.Domain, "*")), + Page: hwsdk.Int32Ptr(listHostPage), + Pagesize: hwsdk.Int32Ptr(listHostPageSize), + } + listHostResp, err := d.sdkClient.ListHost(listHostReq) + if err != nil { + return xerrors.Wrap(err, "failed to execute sdk request 'waf.ListHost'") + } + + if listHostResp.Items != nil { + for _, hostItem := range *listHostResp.Items { + if strings.TrimPrefix(d.config.Domain, "*") == *hostItem.Hostname { + hostId = *hostItem.Id + break + } + } + } + + if listHostResp.Items == nil || len(*listHostResp.Items) < int(listHostPageSize) { + break + } else { + listHostPage++ + } + } + if hostId == "" { + return errors.New("host not found") + } + + // 更新云模式防护域名的配置 + // REF: https://support.huaweicloud.com/api-waf/UpdateHost.html + updateHostReq := &hcWafModel.UpdateHostRequest{ + InstanceId: hostId, + Body: &hcWafModel.UpdateHostRequestBody{ + Certificateid: hwsdk.StringPtr(upres.CertId), + Certificatename: hwsdk.StringPtr(upres.CertName), + }, + } + updateHostResp, err := d.sdkClient.UpdateHost(updateHostReq) + if err != nil { + return xerrors.Wrap(err, "failed to execute sdk request 'waf.UpdateHost'") + } else { + d.logger.Logt("已更新云模式防护域名的配置", updateHostResp) + } + + return nil +} + +func (d *HuaweiCloudWAFDeployer) deployToPremiumHost(ctx context.Context, certPem string, privkeyPem string) error { + if d.config.Domain == "" { + return errors.New("config `domain` is required") + } + + // 上传证书到 WAF + upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem) + if err != nil { + return xerrors.Wrap(err, "failed to upload certificate file") + } else { + d.logger.Logt("certificate file uploaded", upres) + } + + // 遍历查询独享模式域名列表，获取防护域名 ID + // REF: https://support.huaweicloud.com/api-waf/ListPremiumHost.html + hostId := "" + listPremiumHostPage := int32(1) + listPremiumHostPageSize := int32(100) + for { + listPremiumHostReq := &hcWafModel.ListPremiumHostRequest{ + Hostname: hwsdk.StringPtr(strings.TrimPrefix(d.config.Domain, "*")), + Page: hwsdk.StringPtr(fmt.Sprintf("%d", listPremiumHostPage)), + Pagesize: hwsdk.StringPtr(fmt.Sprintf("%d", listPremiumHostPageSize)), + } + listPremiumHostResp, err := d.sdkClient.ListPremiumHost(listPremiumHostReq) + if err != nil { + return xerrors.Wrap(err, "failed to execute sdk request 'waf.ListPremiumHost'") + } + + if listPremiumHostResp.Items != nil { + for _, hostItem := range *listPremiumHostResp.Items { + if strings.TrimPrefix(d.config.Domain, "*") == *hostItem.Hostname { + hostId = *hostItem.Id + break + } + } + } + + if listPremiumHostResp.Items == nil || len(*listPremiumHostResp.Items) < int(listPremiumHostPageSize) { + break + } else { + listPremiumHostPage++ + } + } + if hostId == "" { + return errors.New("host not found") + } + + // 修改独享模式域名配置 + // REF: https://support.huaweicloud.com/api-waf/UpdatePremiumHost.html + updatePremiumHostReq := &hcWafModel.UpdatePremiumHostRequest{ + HostId: hostId, + Body: &hcWafModel.UpdatePremiumHostRequestBody{ + Certificateid: hwsdk.StringPtr(upres.CertId), + Certificatename: hwsdk.StringPtr(upres.CertName), + }, + } + updatePremiumHostResp, err := d.sdkClient.UpdatePremiumHost(updatePremiumHostReq) + if err != nil { + return xerrors.Wrap(err, "failed to execute sdk request 'waf.UpdatePremiumHost'") + } else { + d.logger.Logt("已修改独享模式域名配置", updatePremiumHostResp) + } + + return nil +} + +func createSdkClient(accessKeyId, secretAccessKey, region string) (*hcWaf.WafClient, error) { + projectId, err := getSdkProjectId(accessKeyId, secretAccessKey, region) + if err != nil { + return nil, err + } + + auth, err := basic.NewCredentialsBuilder(). + WithAk(accessKeyId). + WithSk(secretAccessKey). + WithProjectId(projectId). + SafeBuild() + if err != nil { + return nil, err + } + + hcRegion, err := hcWafRegion.SafeValueOf(region) + if err != nil { + return nil, err + } + + hcClient, err := hcWaf.WafClientBuilder(). + WithRegion(hcRegion). + WithCredential(auth). + SafeBuild() + if err != nil { + return nil, err + } + + client := hcWaf.NewWafClient(hcClient) + return client, nil +} + +func getSdkProjectId(accessKeyId, secretAccessKey, region string) (string, error) { + auth, err := global.NewCredentialsBuilder(). + WithAk(accessKeyId). + WithSk(secretAccessKey). + SafeBuild() + if err != nil { + return "", err + } + + hcRegion, err := hcIamRegion.SafeValueOf(region) + if err != nil { + return "", err + } + + hcClient, err := hcIam.IamClientBuilder(). + WithRegion(hcRegion). + WithCredential(auth). + SafeBuild() + if err != nil { + return "", err + } + + client := hcIam.NewIamClient(hcClient) + + request := &hcIamModel.KeystoneListProjectsRequest{ + Name: ®ion, + } + response, err := client.KeystoneListProjects(request) + if err != nil { + return "", err + } else if response.Projects == nil || len(*response.Projects) == 0 { + return "", errors.New("no project found") + } + + return (*response.Projects)[0].Id, nil +} diff --git a/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf_test.go b/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf_test.go new file mode 100644 index 00000000..0ec57013 --- /dev/null +++ b/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf_test.go @@ -0,0 +1,84 @@ +package huaweicloudwaf_test + +import ( + "context" + "flag" + "fmt" + "os" + "strings" + "testing" + + provider "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/huaweicloud-waf" +) + +var ( + fInputCertPath string + fInputKeyPath string + fAccessKeyId string + fSecretAccessKey string + fRegion string + fResourceType string + fDomain string +) + +func init() { + argsPrefix := "CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_" + + flag.StringVar(&fInputCertPath, argsPrefix+"INPUTCERTPATH", "", "") + flag.StringVar(&fInputKeyPath, argsPrefix+"INPUTKEYPATH", "", "") + flag.StringVar(&fAccessKeyId, argsPrefix+"ACCESSKEYID", "", "") + flag.StringVar(&fSecretAccessKey, argsPrefix+"SECRETACCESSKEY", "", "") + flag.StringVar(&fRegion, argsPrefix+"REGION", "", "") + flag.StringVar(&fResourceType, argsPrefix+"RESOURCETYPE", "", "") + flag.StringVar(&fDomain, argsPrefix+"DOMAIN", "", "") +} + +/* +Shell command to run this test: + + go test -v ./huaweicloud_waf_test.go -args \ + --CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_INPUTCERTPATH="/path/to/your-input-cert.pem" \ + --CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_INPUTKEYPATH="/path/to/your-input-key.pem" \ + --CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_ACCESSKEYID="your-access-key-id" \ + --CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_SECRETACCESSKEY="your-secret-access-key" \ + --CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_REGION="cn-north-1" \ + --CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_RESOURCETYPE="premium" \ + --CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_DOMAIN="example.com" +*/ +func TestDeploy(t *testing.T) { + flag.Parse() + + t.Run("Deploy", func(t *testing.T) { + t.Log(strings.Join([]string{ + "args:", + fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath), + fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath), + fmt.Sprintf("ACCESSKEYID: %v", fAccessKeyId), + fmt.Sprintf("SECRETACCESSKEY: %v", fSecretAccessKey), + fmt.Sprintf("REGION: %v", fRegion), + fmt.Sprintf("RESOURCETYPE: %v", fResourceType), + }, "\n")) + + deployer, err := provider.New(&provider.HuaweiCloudWAFDeployerConfig{ + AccessKeyId: fAccessKeyId, + SecretAccessKey: fSecretAccessKey, + Region: fRegion, + ResourceType: provider.ResourceType(fResourceType), + Domain: fDomain, + }) + if err != nil { + t.Errorf("err: %+v", err) + return + } + + fInputCertData, _ := os.ReadFile(fInputCertPath) + fInputKeyData, _ := os.ReadFile(fInputKeyPath) + res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData)) + if err != nil { + t.Errorf("err: %+v", err) + return + } + + t.Logf("ok: %v", res) + }) +} diff --git a/internal/pkg/core/deployer/providers/volcengine-imagex/volcengine_imagex.go b/internal/pkg/core/deployer/providers/volcengine-imagex/volcengine_imagex.go index 00102896..dea81300 100644 --- a/internal/pkg/core/deployer/providers/volcengine-imagex/volcengine_imagex.go +++ b/internal/pkg/core/deployer/providers/volcengine-imagex/volcengine_imagex.go @@ -83,10 +83,10 @@ func (d *VolcEngineImageXDeployer) Deploy(ctx context.Context, certPem string, p upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem) if err != nil { return nil, xerrors.Wrap(err, "failed to upload certificate file") + } else { + d.logger.Logt("certificate file uploaded", upres) } - d.logger.Logt("certificate file uploaded", upres) - // 获取域名配置 // REF: https://www.volcengine.com/docs/508/9366 getDomainConfigReq := &veImageX.GetDomainConfigQuery{ diff --git a/internal/pkg/core/uploader/providers/huaweicloud-waf/huaweicloud_waf.go b/internal/pkg/core/uploader/providers/huaweicloud-waf/huaweicloud_waf.go index b4be3315..eb2eb7f2 100644 --- a/internal/pkg/core/uploader/providers/huaweicloud-waf/huaweicloud_waf.go +++ b/internal/pkg/core/uploader/providers/huaweicloud-waf/huaweicloud_waf.go @@ -7,6 +7,10 @@ import ( "time" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" + "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/global" + hcIam "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3" + hcIamModel "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3/model" + hcIamRegion "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3/region" hcWaf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1" hcWafModel "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model" hcWafRegion "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region" @@ -64,11 +68,11 @@ func (u *HuaweiCloudWAFUploader) Upload(ctx context.Context, certPem string, pri // REF: https://support.huaweicloud.com/api-waf/ListCertificates.html // REF: https://support.huaweicloud.com/api-waf/ShowCertificate.html listCertificatesPage := int32(1) - listCertificatesLimit := int32(100) + listCertificatesPageSize := int32(100) for { listCertificatesReq := &hcWafModel.ListCertificatesRequest{ Page: hwsdk.Int32Ptr(listCertificatesPage), - Pagesize: hwsdk.Int32Ptr(listCertificatesLimit), + Pagesize: hwsdk.Int32Ptr(listCertificatesPageSize), } listCertificatesResp, err := u.sdkClient.ListCertificates(listCertificatesReq) if err != nil { @@ -107,7 +111,7 @@ func (u *HuaweiCloudWAFUploader) Upload(ctx context.Context, certPem string, pri } } - if listCertificatesResp.Items == nil || len(*listCertificatesResp.Items) < int(listCertificatesLimit) { + if listCertificatesResp.Items == nil || len(*listCertificatesResp.Items) < int(listCertificatesPageSize) { break } else { listCertificatesPage++ @@ -141,9 +145,15 @@ func (u *HuaweiCloudWAFUploader) Upload(ctx context.Context, certPem string, pri } func createSdkClient(accessKeyId, secretAccessKey, region string) (*hcWaf.WafClient, error) { + projectId, err := getSdkProjectId(accessKeyId, secretAccessKey, region) + if err != nil { + return nil, err + } + auth, err := basic.NewCredentialsBuilder(). WithAk(accessKeyId). WithSk(secretAccessKey). + WithProjectId(projectId). SafeBuild() if err != nil { return nil, err @@ -165,3 +175,40 @@ func createSdkClient(accessKeyId, secretAccessKey, region string) (*hcWaf.WafCli client := hcWaf.NewWafClient(hcClient) return client, nil } + +func getSdkProjectId(accessKeyId, secretAccessKey, region string) (string, error) { + auth, err := global.NewCredentialsBuilder(). + WithAk(accessKeyId). + WithSk(secretAccessKey). + SafeBuild() + if err != nil { + return "", err + } + + hcRegion, err := hcIamRegion.SafeValueOf(region) + if err != nil { + return "", err + } + + hcClient, err := hcIam.IamClientBuilder(). + WithRegion(hcRegion). + WithCredential(auth). + SafeBuild() + if err != nil { + return "", err + } + + client := hcIam.NewIamClient(hcClient) + + request := &hcIamModel.KeystoneListProjectsRequest{ + Name: ®ion, + } + response, err := client.KeystoneListProjects(request) + if err != nil { + return "", err + } else if response.Projects == nil || len(*response.Projects) == 0 { + return "", errors.New("no project found") + } + + return (*response.Projects)[0].Id, nil +} diff --git a/ui/src/components/workflow/node/DeployNodeConfigForm.tsx b/ui/src/components/workflow/node/DeployNodeConfigForm.tsx index e7a1f5d9..93cf857e 100644 --- a/ui/src/components/workflow/node/DeployNodeConfigForm.tsx +++ b/ui/src/components/workflow/node/DeployNodeConfigForm.tsx @@ -34,6 +34,7 @@ import DeployNodeConfigFormDogeCloudCDNConfig from "./DeployNodeConfigFormDogeCl import DeployNodeConfigFormEdgioApplicationsConfig from "./DeployNodeConfigFormEdgioApplicationsConfig"; import DeployNodeConfigFormHuaweiCloudCDNConfig from "./DeployNodeConfigFormHuaweiCloudCDNConfig"; import DeployNodeConfigFormHuaweiCloudELBConfig from "./DeployNodeConfigFormHuaweiCloudELBConfig"; +import DeployNodeConfigFormHuaweiCloudWAFConfig from "./DeployNodeConfigFormHuaweiCloudWAFConfig"; import DeployNodeConfigFormKubernetesSecretConfig from "./DeployNodeConfigFormKubernetesSecretConfig"; import DeployNodeConfigFormLocalConfig from "./DeployNodeConfigFormLocalConfig"; import DeployNodeConfigFormQiniuCDNConfig from "./DeployNodeConfigFormQiniuCDNConfig"; @@ -165,6 +166,8 @@ const DeployNodeConfigForm = forwardRef; case DEPLOY_PROVIDERS.HUAWEICLOUD_ELB: return ; + case DEPLOY_PROVIDERS.HUAWEICLOUD_WAF: + return ; case DEPLOY_PROVIDERS.KUBERNETES_SECRET: return ; case DEPLOY_PROVIDERS.LOCAL: diff --git a/ui/src/components/workflow/node/DeployNodeConfigFormHuaweiCloudWAFConfig.tsx b/ui/src/components/workflow/node/DeployNodeConfigFormHuaweiCloudWAFConfig.tsx new file mode 100644 index 00000000..cdcabef5 --- /dev/null +++ b/ui/src/components/workflow/node/DeployNodeConfigFormHuaweiCloudWAFConfig.tsx @@ -0,0 +1,132 @@ +import { useTranslation } from "react-i18next"; +import { Form, type FormInstance, Input, Select } from "antd"; +import { createSchemaFieldRule } from "antd-zod"; +import { z } from "zod"; + +import Show from "@/components/Show"; +import { validDomainName } from "@/utils/validators"; + +type DeployNodeConfigFormHuaweiCloudWAFConfigFieldValues = Nullish<{ + resourceType: string; + region: string; + certificateId?: string; + domain?: string; + listenerId?: string; +}>; + +export type DeployNodeConfigFormHuaweiCloudWAFConfigProps = { + form: FormInstance; + formName: string; + disabled?: boolean; + initialValues?: DeployNodeConfigFormHuaweiCloudWAFConfigFieldValues; + onValuesChange?: (values: DeployNodeConfigFormHuaweiCloudWAFConfigFieldValues) => void; +}; + +const RESOURCE_TYPE_CERTIFICATE = "certificate" as const; +const RESOURCE_TYPE_CLOUDSERVER = "cloudserver" as const; +const RESOURCE_TYPE_PREMIUMHOST = "premiumhost" as const; + +const initFormModel = (): DeployNodeConfigFormHuaweiCloudWAFConfigFieldValues => { + return {}; +}; + +const DeployNodeConfigFormHuaweiCloudWAFConfig = ({ + form: formInst, + formName, + disabled, + initialValues, + onValuesChange, +}: DeployNodeConfigFormHuaweiCloudWAFConfigProps) => { + const { t } = useTranslation(); + + const formSchema = z.object({ + resourceType: z.union([z.literal(RESOURCE_TYPE_CERTIFICATE), z.literal(RESOURCE_TYPE_CLOUDSERVER), z.literal(RESOURCE_TYPE_PREMIUMHOST)], { + message: t("workflow_node.deploy.form.huaweicloud_waf_resource_type.placeholder"), + }), + region: z + .string({ message: t("workflow_node.deploy.form.huaweicloud_waf_region.placeholder") }) + .nonempty(t("workflow_node.deploy.form.huaweicloud_waf_region.placeholder")) + .trim(), + certificateId: z + .string() + .max(64, t("common.errmsg.string_max", { max: 64 })) + .trim() + .nullish() + .refine((v) => { + if (fieldResourceType !== RESOURCE_TYPE_CERTIFICATE) return true; + return !!v?.trim(); + }, t("workflow_node.deploy.form.huaweicloud_waf_certificate_id.placeholder")), + domain: z + .string() + .nullish() + .refine((v) => { + if (fieldResourceType !== RESOURCE_TYPE_CLOUDSERVER && fieldResourceType !== RESOURCE_TYPE_PREMIUMHOST) return true; + return validDomainName(v!, { allowWildcard: true }); + }, t("workflow_node.deploy.form.huaweicloud_waf_domain.placeholder")), + }); + const formRule = createSchemaFieldRule(formSchema); + + const fieldResourceType = Form.useWatch("resourceType", formInst); + + const handleFormChange = (_: unknown, values: z.infer) => { + onValuesChange?.(values); + }; + + return ( +
+ + + + + } + > + + + + + } + > + + + + + + } + > + + + +
+ ); +}; + +export default DeployNodeConfigFormHuaweiCloudWAFConfig; diff --git a/ui/src/domain/provider.ts b/ui/src/domain/provider.ts index 6235e4c2..96c0230b 100644 --- a/ui/src/domain/provider.ts +++ b/ui/src/domain/provider.ts @@ -195,6 +195,7 @@ export const DEPLOY_PROVIDERS = Object.freeze({ EDGIO_APPLICATIONS: `${ACCESS_PROVIDERS.EDGIO}-applications`, HUAWEICLOUD_CDN: `${ACCESS_PROVIDERS.HUAWEICLOUD}-cdn`, HUAWEICLOUD_ELB: `${ACCESS_PROVIDERS.HUAWEICLOUD}-elb`, + HUAWEICLOUD_WAF: `${ACCESS_PROVIDERS.HUAWEICLOUD}-waf`, KUBERNETES_SECRET: `${ACCESS_PROVIDERS.KUBERNETES}-secret`, LOCAL: `${ACCESS_PROVIDERS.LOCAL}`, QINIU_CDN: `${ACCESS_PROVIDERS.QINIU}-cdn`, @@ -270,6 +271,7 @@ export const deployProvidersMap: Maphttps://console-intl.huaweicloud.com/vpc/#/elb/list/grid", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.label": "Resource type", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.placeholder": "Please select resource type", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.certificate.label": "WAF certificate", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.cloudserver.label": "WAF cloud server", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.premiumhost.label": "WAF premium host", + "workflow_node.deploy.form.huaweicloud_waf_region.label": "Huawei Cloud WAF region", + "workflow_node.deploy.form.huaweicloud_waf_region.placeholder": "Please enter Huawei Cloud WAF region (e.g. cn-north-1)", + "workflow_node.deploy.form.huaweicloud_waf_region.tooltip": "For more information, see https://console-intl.huaweicloud.com/apiexplorer/#/endpoint", + "workflow_node.deploy.form.huaweicloud_waf_certificate_id.label": "Huawei Cloud WAF certificate ID", + "workflow_node.deploy.form.huaweicloud_waf_certificate_id.placeholder": "Please enter Huawei Cloud WAF certificate ID", + "workflow_node.deploy.form.huaweicloud_waf_certificate_id.tooltip": "For more information, see https://console-intl.huaweicloud.com/console/#/waf/certificateManagement", + "workflow_node.deploy.form.huaweicloud_waf_domain.label": "Huawei Cloud WAF domain", + "workflow_node.deploy.form.huaweicloud_waf_domain.placeholder": "Please enter Huawei Cloud WAF domain name", + "workflow_node.deploy.form.huaweicloud_waf_domain.tooltip": "For more information, see https://console-intl.huaweicloud.com/console/#/waf/domain/list", "workflow_node.deploy.form.k8s_namespace.label": "Kubernetes Namespace", "workflow_node.deploy.form.k8s_namespace.placeholder": "Please enter Kubernetes Namespace", "workflow_node.deploy.form.k8s_namespace.tooltip": "For more information, see https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/", diff --git a/ui/src/i18n/locales/zh/nls.provider.json b/ui/src/i18n/locales/zh/nls.provider.json index 2cbc066f..4efd7cd8 100644 --- a/ui/src/i18n/locales/zh/nls.provider.json +++ b/ui/src/i18n/locales/zh/nls.provider.json @@ -50,6 +50,7 @@ "provider.huaweicloud.cdn": "华为云 - 内容分发网络 CDN", "provider.huaweicloud.dns": "华为云 - 云解析 DNS", "provider.huaweicloud.elb": "华为云 - 弹性负载均衡 ELB", + "provider.huaweicloud.waf": "华为云 - Web 应用防火墙 WAF", "provider.kubernetes": "Kubernetes", "provider.kubernetes.secret": "Kubernetes - Secret", "provider.local": "本地部署", diff --git a/ui/src/i18n/locales/zh/nls.workflow.nodes.json b/ui/src/i18n/locales/zh/nls.workflow.nodes.json index dd33be3b..594b7421 100644 --- a/ui/src/i18n/locales/zh/nls.workflow.nodes.json +++ b/ui/src/i18n/locales/zh/nls.workflow.nodes.json @@ -226,6 +226,20 @@ "workflow_node.deploy.form.huaweicloud_elb_listener_id.label": "华为云 ELB 监听器 ID", "workflow_node.deploy.form.huaweicloud_elb_listener_id.placeholder": "请输入华为云 ELB 监听器 ID", "workflow_node.deploy.form.huaweicloud_elb_listener_id.tooltip": "这是什么？请参阅 https://console.huaweicloud.com/vpc/#/elb/list/grid", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.label": "证书替换方式", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.placeholder": "请选择证书替换方式", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.certificate.label": "替换指定证书", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.cloudserver.label": "替换指定云模式防护网站的证书", + "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.premiumhost.label": "替换指定独享模式防护网站的证书", + "workflow_node.deploy.form.huaweicloud_waf_region.label": "华为云 WAF 服务区域", + "workflow_node.deploy.form.huaweicloud_waf_region.placeholder": "请输入华为云 WAF 服务区域（例如：cn-north-1）", + "workflow_node.deploy.form.huaweicloud_waf_region.tooltip": "这是什么？请参阅 https://console.huaweicloud.com/apiexplorer/#/endpoint", + "workflow_node.deploy.form.huaweicloud_waf_certificate_id.label": "华为云 WAF 证书 ID", + "workflow_node.deploy.form.huaweicloud_waf_certificate_id.placeholder": "请输入华为云 WAF 证书 ID", + "workflow_node.deploy.form.huaweicloud_waf_certificate_id.tooltip": "这是什么？请参阅 https://console.huaweicloud.com/console/#/waf/certificateManagement", + "workflow_node.deploy.form.huaweicloud_waf_domain.label": "华为云 WAF 防护域名（支持泛域名）", + "workflow_node.deploy.form.huaweicloud_waf_domain.placeholder": "请输入华为云 WAF 防护域名", + "workflow_node.deploy.form.huaweicloud_waf_domain.tooltip": "这是什么？请参阅 https://console.huaweicloud.com/console/#/waf/domain/list", "workflow_node.deploy.form.k8s_namespace.label": "Kubernetes 命名空间", "workflow_node.deploy.form.k8s_namespace.placeholder": "请输入 Kubernetes 命名空间", "workflow_node.deploy.form.k8s_namespace.tooltip": "这是什么？请参阅 https://kubernetes.io/zh-cn/docs/concepts/overview/working-with-objects/namespaces/",