Application Gateway WAF Rate Limit feature swagger changes #23021
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hi, @sraghavan-msft Thanks for your PR. I am workflow bot for review process. Here are some small tips. Any feedback about review process or workflow bot, pls contact swagger and tools team. [email protected] |
Swagger Validation Report
|
| compared swaggers (via Oad v0.10.4)] | new version | base version |
|---|---|---|
| webapplicationfirewall.json | 2022-11-01(699e41d) | 2022-09-01(main) |
The following breaking changes are detected by comparison with the latest stable version:
| Rule | Message |
|---|---|
|
The 'required' status changed from the old version('True') to the new version('False'). New: Microsoft.Network/stable/2022-11-01/networkSecurityGroup.json#L720:7 Old: Microsoft.Network/stable/2022-09-01/networkSecurityGroup.json#L720:7 |
|
The new version is missing a property found in the old version. Was 'applicationGatewayIPConfigurations' renamed or removed? New: Microsoft.Network/stable/2022-11-01/virtualNetwork.json#L1500:7 Old: Microsoft.Network/stable/2022-09-01/virtualNetwork.json#L1500:7 |
️⚠️LintDiff: 0 Warnings warning [Detail]
| compared tags (via openapi-validator v2.0.0) | new version | base version |
|---|---|---|
| package-2022-11 | package-2022-11(699e41d) | package-2022-11(release-Microsoft.Network-2022-11-01) |
The following errors/warnings exist before current PR submission:
Only 30 items are listed, please refer to log for more details.
| Rule | Message |
|---|---|
|
Resource type naming must follow camel case. Path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies' Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L37 |
|
Resource type naming must follow camel case. Path: '/subscriptions/{subscriptionId}/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies' Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L83 |
|
Resource type naming must follow camel case. Path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/{policyName}' Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L122 |
|
The resource name parameter 'policyName' should be defined with a 'pattern' restriction. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L122 |
|
Tracked resource 'WebApplicationFirewallPolicy' must have patch operation that at least supports the update of tags. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L122 |
|
A 202 response should include an Location response header. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L271 |
|
The schema 'WebApplicationFirewallPolicy' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L295 |
|
Model definition 'WebApplicationFirewallPolicy' must have the properties 'name', 'id' and 'type' in its hierarchy and these properties must be marked as readonly. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L295 |
|
The schema 'WebApplicationFirewallPolicyPropertiesFormat' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L315 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L325 |
|
The schema 'WebApplicationFirewallPolicyListResult' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L385 |
|
The schema 'ManagedRulesDefinition' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L403 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L409 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L416 |
|
The schema 'PolicySettings' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L425 |
|
The schema 'WebApplicationFirewallCustomRule' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L484 |
|
The integer type does not have a format, please add it. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L503 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L550 |
|
The schema 'MatchVariable' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L597 |
|
The schema 'MatchCondition' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L627 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L635 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L739 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L759 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L813 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L833 |
|
The schema 'OwaspCrsExclusionEntry' is considered an object but without a 'type:object', please add the missing 'type:object'. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L855 |
|
Missing identifier id in array item property Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L901 |
| Parameter 'api-version' is referenced but not defined in the global parameters section of Service Definition Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L49 |
|
| Parameter 'api-version' is referenced but not defined in the global parameters section of Service Definition Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L95 |
|
| The response of operation:'WebApplicationFirewallPolicies_Get' is defined without 'systemData'. Consider adding the systemData to the response. Location: Microsoft.Network/stable/2022-11-01/webapplicationfirewall.json#L123 |
️️✔️Avocado succeeded [Detail] [Expand]
Validation passes for Avocado.
️❌SwaggerAPIView: 0 Errors, 0 Warnings failed [Detail]
️️✔️CadlAPIView succeeded [Detail] [Expand]
️️✔️ModelValidation succeeded [Detail] [Expand]
Validation passes for ModelValidation.
️️✔️SemanticValidation succeeded [Detail] [Expand]
Validation passes for SemanticValidation.
️️✔️PrettierCheck succeeded [Detail] [Expand]
Validation passes for PrettierCheck.
️️✔️SpellCheck succeeded [Detail] [Expand]
Validation passes for SpellCheck.
️️✔️CadlValidation succeeded [Detail] [Expand]
Validation passes for CadlValidation.
️️✔️PR Summary succeeded [Detail] [Expand]
Validation passes for Summary.
Swagger Generation Artifacts
|
Generated ApiView
|
ghost
added
the
tejasshah7
reviewed
Mar 10, 2023
...etwork/resource-manager/Microsoft.Network/stable/2022-11-01/examples/WafListAllPolicies.json
Show resolved
Hide resolved
|
Hi @sraghavan-msft, Your PR has some issues. Please fix the CI sequentially by following the order of
|
This was referenced Mar 10, 2023
|
@sraghavan-msft , please fix |
raych1
added
the
Reviewed-ChangesRequested
AzureRestAPISpecReview
added
the
BreakingChangeReviewRequired
|
Hi @sraghavan-msft, one or multiple breaking change(s) is detected in your PR. Please check out the breaking change(s), and provide business justification in the PR comment and @ PR assignee why you must have these change(s), and how external customer impact can be mitigated. Please ensure to follow breaking change policy to request breaking change review and approval before proceeding swagger PR review. |
|
Pasting this comment from #23022 as it applies to this PR as well @raych1 The Breaking Change failure in this PR is due to a change that was merged directly in the main branch by Appgw team. It is not related to the changes in this PR. Below is a PR that was approved and merged with the same failure for your reference. |
raych1
approved these changes
Mar 23, 2023
raych1
added
Approved-BreakingChange
| "description": "Rate Limit threshold to apply in case ruleType is RateLimitRule. Must be greater than or equal to 1", | ||
| "type": "integer", | ||
| "format": "int32", | ||
| "minimum": 1 |
There was a problem hiding this comment.
This line is reverted
raych1
pushed a commit
that referenced
this pull request
Apr 25, 2023
* Adds base for updating Microsoft.Network from version stable/2022-09-01 to version 2022-11-01 * Updates readme * Updates API version in new specs and examples * remove loadDistributionPolicy from appgw PUT request body example (#23144) * remove loadDistributionPolicy from appgw PUT request body example * remove loadDistributionPolicy from appgw PUT request body example2 * remove loadDistributionPolicy from appgw PUT request body example * remove duplicates * add private link configuration to see if it will fix validation error * remove privateLinkConfig related * revert changes to see if still get validation error * update back to original changes * add response resource id to fix modelValidation error * add connection resource * Selector in Exclusions should not be required as Operator EqualsAny does not need a Selector (#23184) * Application Gateway WAF Rate Limit feature swagger changes (#23021) * Application Gateway WAF Rate Limit feature swagger changes * Fixing lint errors * Updated rate limit feature examples * Fix for applicationGatewayIpConfigurations property and make the priority parameter as required for NSG (#23210) * Fix for applicationGatewayIpConfigurations property This swagger definition is defining property applicationGatewayIpConfigurations, ``` "applicationGatewayIpConfigurations": { "type": "array", "items": { "$ref": "./applicationGateway.json#/definitions/ApplicationGatewayIPConfiguration" }, "description": "Application gateway IP configurations of virtual network resource." } ``` but actual rest api returned applicationGatewayIPConfigurations, the P is upper case while in swagger it is lower case. ``` { "name": "subnet-agw", "id": "/subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/subnet-agw", "properties": { "applicationGatewayIPConfigurations": [ { "id": "/subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.Network/applicationGateways/<agw-name>/gatewayIPConfigurations/appGatewayIpConfig" } ] }, "type": "Microsoft.Network/virtualNetworks/subnets" } ``` * Making priority property required [This is the API invoked](https://learn.microsoft.com/en-us/rest/api/virtualnetwork/network-security-groups/create-or-update?tabs=HTTP#code-try-0). For the NSG security rules without priorities, seems like the priority parameter is required. Azure portal works as expected. I don't think that's allowed but according to the schema it is because the priority property is not marked as required. I tried to create a NSG security rule without the priorities and it failed with below. Request Body: ``` { "properties": { "securityRules": [ { "name": "rule1", "properties": { "protocol": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "destinationPortRange": "80", "sourcePortRange": "*", "direction": "Inbound" } } ] }, "location": "eastus" } ``` Response received: ``` { "error": { "code": "SecurityRuleInvalidPriority", "message": "Security rule has invalid Priority. Value provided: 0 Allowed range 100-4096.", "details": [] } } ``` This PR will make the priority parameter as required. * Update NetworkSecurityGroupDelete.json * Update NetworkSecurityGroupRuleDelete.json * Update NetworkSecurityGroupDelete.json * Undo previous change of making fields optional within Exclusion (#23325) * Nivishenker/http headers to insert (#23295) * new app rule property - http header to insert * prettier * add to 22-11-01 * removed changes from 22-09-01 * fixed example * delete RCG example * fix delete examples * added a Location header * prettier fix * Application Gateway WAF Log scrubbing swagger changes (#23022) * Log scrubbing API changes * Update examples * Addressing comments * Fix * Update property in load balancer for Connection Draining Phase 1 (#23082) * Update property in load balancer for Coneection Draining Phase 1 * Fix model validation * Azure Firewall Packet Capture API. Cancelled PR from 2022-09-01 and created for 2022-11-01 (#23114) * moving packet-capture api to 2022-11-01 release from 2022-09-01 * fixing the LRO response header error for model validation * Changes for Additional nic and corrections (#23522) * Changes for Additional nic and corrections * Fixes for tool reported issues * Fix for SpellCheck, ModelValidation * Defining Location in NetworkVirtualApplianceDelete for async * Minor fix * Minor fix * Minor fix * PrettierCheck fixed * Fixing VirtualApplianceAdditionalNicProperties * ModelValidation fixed * Correcting the location header string * Correcting location header * Prettied Check Fix * Fix * Fix * Add inspection limit changes (#23536) * Fixed headers for examples (#23554) * Fix response of API: List of advertised/learned BGP routes (#23555) * fix response type * fix format * fix example, add x-ms-identifiers * AuxiliarySku on Nic (#23552) * Adding auxiliary sku property on nic * Adding AcceleratedConnections to AuxMode * modifying the auxSku values * Removing accidental change --------- Co-authored-by: Prachi Pravin Bhavsar <[email protected]> * migrated latest pr from incorrect branch (#23589) * Changes for NVA connection (#23173) * Changes for NVA connection * Changes to address validation failures * Fix some ModelValidation errors * Fix some ModelValidation errors * Fix some ModelValidation errors * Fix some ModelValidation errors * Fix some ModelValidation errors * Addressing some review comments * Addressing some review comments * Addressing some review comments * Addressing some review comments * Addressing some review comments * Fix camel case for property name * Fixing resourceUri to Camel case in example files * Fix SDK duplication error * Fix one LintDiff error * try fix lintdiff errors * fix lro erro in lintdiff * fix model validation error * Bastion S360 for 2022-11 version (#23595) * Release microsoft.network 2022 11 01 (#23564) * Application Gateway WAF Rate Limit feature swagger changes * Fixing lint errors * Updated rate limit feature examples * rateLimitDuration and rateLimitThreshold are not mandatory. There are only mandatory if ruleType is RateLimitRule. This validation will be done in NRP. * Fix attempt 2. Removed minimum constraint from rateLimitThreshold. Validation will be done in NRP * Remove the minimum number for the option field requestBodyInspectLimitInKB (#23663) * Remove minimum value for optional field requestBodyInspectLimitInKB * Remove exlcusiveMinimum --------- Co-authored-by: htippanaboya <[email protected]> Co-authored-by: tracyMicro <[email protected]> Co-authored-by: tejasshah7 <[email protected]> Co-authored-by: sraghavan-msft <[email protected]> Co-authored-by: navba-MSFT <[email protected]> Co-authored-by: NiviShenker <[email protected]> Co-authored-by: Sindhu Aluguvelli <[email protected]> Co-authored-by: phrazfipho <[email protected]> Co-authored-by: nikhilpadhye1 <[email protected]> Co-authored-by: JainRah <[email protected]> Co-authored-by: karanbazaz <[email protected]> Co-authored-by: yeliMSFT <[email protected]> Co-authored-by: pracsb <[email protected]> Co-authored-by: Prachi Pravin Bhavsar <[email protected]> Co-authored-by: nanditaashok-ms <[email protected]> Co-authored-by: anvrao1 <[email protected]> Co-authored-by: baoqihuang0326 <[email protected]>
JoshLove-msft
pushed a commit
to JoshLove-msft/azure-rest-api-specs
that referenced
this pull request
Apr 25, 2023
* Adds base for updating Microsoft.Network from version stable/2022-09-01 to version 2022-11-01 * Updates readme * Updates API version in new specs and examples * remove loadDistributionPolicy from appgw PUT request body example (Azure#23144) * remove loadDistributionPolicy from appgw PUT request body example * remove loadDistributionPolicy from appgw PUT request body example2 * remove loadDistributionPolicy from appgw PUT request body example * remove duplicates * add private link configuration to see if it will fix validation error * remove privateLinkConfig related * revert changes to see if still get validation error * update back to original changes * add response resource id to fix modelValidation error * add connection resource * Selector in Exclusions should not be required as Operator EqualsAny does not need a Selector (Azure#23184) * Application Gateway WAF Rate Limit feature swagger changes (Azure#23021) * Application Gateway WAF Rate Limit feature swagger changes * Fixing lint errors * Updated rate limit feature examples * Fix for applicationGatewayIpConfigurations property and make the priority parameter as required for NSG (Azure#23210) * Fix for applicationGatewayIpConfigurations property This swagger definition is defining property applicationGatewayIpConfigurations, ``` "applicationGatewayIpConfigurations": { "type": "array", "items": { "$ref": "./applicationGateway.json#/definitions/ApplicationGatewayIPConfiguration" }, "description": "Application gateway IP configurations of virtual network resource." } ``` but actual rest api returned applicationGatewayIPConfigurations, the P is upper case while in swagger it is lower case. ``` { "name": "subnet-agw", "id": "/subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/subnet-agw", "properties": { "applicationGatewayIPConfigurations": [ { "id": "/subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.Network/applicationGateways/<agw-name>/gatewayIPConfigurations/appGatewayIpConfig" } ] }, "type": "Microsoft.Network/virtualNetworks/subnets" } ``` * Making priority property required [This is the API invoked](https://learn.microsoft.com/en-us/rest/api/virtualnetwork/network-security-groups/create-or-update?tabs=HTTP#code-try-0). For the NSG security rules without priorities, seems like the priority parameter is required. Azure portal works as expected. I don't think that's allowed but according to the schema it is because the priority property is not marked as required. I tried to create a NSG security rule without the priorities and it failed with below. Request Body: ``` { "properties": { "securityRules": [ { "name": "rule1", "properties": { "protocol": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "destinationPortRange": "80", "sourcePortRange": "*", "direction": "Inbound" } } ] }, "location": "eastus" } ``` Response received: ``` { "error": { "code": "SecurityRuleInvalidPriority", "message": "Security rule has invalid Priority. Value provided: 0 Allowed range 100-4096.", "details": [] } } ``` This PR will make the priority parameter as required. * Update NetworkSecurityGroupDelete.json * Update NetworkSecurityGroupRuleDelete.json * Update NetworkSecurityGroupDelete.json * Undo previous change of making fields optional within Exclusion (Azure#23325) * Nivishenker/http headers to insert (Azure#23295) * new app rule property - http header to insert * prettier * add to 22-11-01 * removed changes from 22-09-01 * fixed example * delete RCG example * fix delete examples * added a Location header * prettier fix * Application Gateway WAF Log scrubbing swagger changes (Azure#23022) * Log scrubbing API changes * Update examples * Addressing comments * Fix * Update property in load balancer for Connection Draining Phase 1 (Azure#23082) * Update property in load balancer for Coneection Draining Phase 1 * Fix model validation * Azure Firewall Packet Capture API. Cancelled PR from 2022-09-01 and created for 2022-11-01 (Azure#23114) * moving packet-capture api to 2022-11-01 release from 2022-09-01 * fixing the LRO response header error for model validation * Changes for Additional nic and corrections (Azure#23522) * Changes for Additional nic and corrections * Fixes for tool reported issues * Fix for SpellCheck, ModelValidation * Defining Location in NetworkVirtualApplianceDelete for async * Minor fix * Minor fix * Minor fix * PrettierCheck fixed * Fixing VirtualApplianceAdditionalNicProperties * ModelValidation fixed * Correcting the location header string * Correcting location header * Prettied Check Fix * Fix * Fix * Add inspection limit changes (Azure#23536) * Fixed headers for examples (Azure#23554) * Fix response of API: List of advertised/learned BGP routes (Azure#23555) * fix response type * fix format * fix example, add x-ms-identifiers * AuxiliarySku on Nic (Azure#23552) * Adding auxiliary sku property on nic * Adding AcceleratedConnections to AuxMode * modifying the auxSku values * Removing accidental change --------- Co-authored-by: Prachi Pravin Bhavsar <[email protected]> * migrated latest pr from incorrect branch (Azure#23589) * Changes for NVA connection (Azure#23173) * Changes for NVA connection * Changes to address validation failures * Fix some ModelValidation errors * Fix some ModelValidation errors * Fix some ModelValidation errors * Fix some ModelValidation errors * Fix some ModelValidation errors * Addressing some review comments * Addressing some review comments * Addressing some review comments * Addressing some review comments * Addressing some review comments * Fix camel case for property name * Fixing resourceUri to Camel case in example files * Fix SDK duplication error * Fix one LintDiff error * try fix lintdiff errors * fix lro erro in lintdiff * fix model validation error * Bastion S360 for 2022-11 version (Azure#23595) * Release microsoft.network 2022 11 01 (Azure#23564) * Application Gateway WAF Rate Limit feature swagger changes * Fixing lint errors * Updated rate limit feature examples * rateLimitDuration and rateLimitThreshold are not mandatory. There are only mandatory if ruleType is RateLimitRule. This validation will be done in NRP. * Fix attempt 2. Removed minimum constraint from rateLimitThreshold. Validation will be done in NRP * Remove the minimum number for the option field requestBodyInspectLimitInKB (Azure#23663) * Remove minimum value for optional field requestBodyInspectLimitInKB * Remove exlcusiveMinimum --------- Co-authored-by: htippanaboya <[email protected]> Co-authored-by: tracyMicro <[email protected]> Co-authored-by: tejasshah7 <[email protected]> Co-authored-by: sraghavan-msft <[email protected]> Co-authored-by: navba-MSFT <[email protected]> Co-authored-by: NiviShenker <[email protected]> Co-authored-by: Sindhu Aluguvelli <[email protected]> Co-authored-by: phrazfipho <[email protected]> Co-authored-by: nikhilpadhye1 <[email protected]> Co-authored-by: JainRah <[email protected]> Co-authored-by: karanbazaz <[email protected]> Co-authored-by: yeliMSFT <[email protected]> Co-authored-by: pracsb <[email protected]> Co-authored-by: Prachi Pravin Bhavsar <[email protected]> Co-authored-by: nanditaashok-ms <[email protected]> Co-authored-by: anvrao1 <[email protected]> Co-authored-by: baoqihuang0326 <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Application Gateway WAF Rate Limit feature changes
PR captures configuration model changes to support Application Gateway WAF Rate Limit feature. This feature is built on the existing Custom Rule framework. A new Custom Rule type "RateLimitRule" has been added. Along with this, a new field GroupByUserSession has been added to allow users to configure how to identify unique user sessions or to rate limit requests to an url endpoint by choosing "None"