[BUG] Why should I have to provide the entire appfwprofile attributes to update a single attribute?

[sumanth-lingappa]

Contact us

For any immediate issues or help , reach out to us at NetScaler-AutomationToolkit@cloud.com !

Bug Report

Describe the bug A clear and concise description of what the bug is.

To Reproduce Steps to reproduce the behaviour:

1. My terraform files are

   resource "citrixadc_appfwprofile" "tf_appfwprofile1" {
   name           = "tf_appfwprofile1"
   sqlinjectionaction = [
   "block",
   "log",
   "stats",
   ]
   type = [
   "HTML",
   "JSON",
   "XML",
   ]
   }

2. which terraform command I am getting the error

   Not applicable

3. Terraform output logs to the log file (./tf.log). Append TF_LOG=TRACE NS_LOG=TRACE TF_LOG_PATH=./tf.log to your terraform command

   
   root@cloud-client:~/apply-waf-configuration# terraform apply -var-file example.tfvars
   citrixadc_nsfeature.tf_nsfeature: Refreshing state... [id=tf-nsfeature-20230913053538261700000001]
   citrixadc_lbvserver.tf_lbvserver2: Refreshing state... [id=tf_lbvserver2]
   citrixadc_service.web-echoserver2: Refreshing state... [id=web-echoserver2]
   citrixadc_nsip.snip: Refreshing state... [id=192.168.3.10]
   citrixadc_lbvserver.tf_lbvserver1: Refreshing state... [id=tf_lbvserver1]
   citrixadc_csvserver.tf_csvserver: Refreshing state... [id=tf_csvserver]
   citrixadc_service.web-echoserver1: Refreshing state... [id=web-echoserver1]
   citrixadc_lbvserver_service_binding.lb_binding1: Refreshing state... [id=tf_lbvserver1,web-echoserver1]
   citrixadc_lbvserver_service_binding.lb_binding2: Refreshing state... [id=tf_lbvserver2,web-echoserver2]
   citrixadc_csaction.tf_csaction1: Refreshing state... [id=tf_csaction1]
   citrixadc_csaction.tf_csaction2: Refreshing state... [id=tf_csaction2]
   citrixadc_cspolicy.tf_policy_echoserver2: Refreshing state... [id=tf_policy_echoserver2]
   citrixadc_cspolicy.tf_policy_echoserver1: Refreshing state... [id=tf_policy_echoserver1]
   citrixadc_csvserver_cspolicy_binding.tf_csvscspolbind_echoserver1: Refreshing state... [id=tf_csvserver,tf_policy_echoserver1]
   citrixadc_csvserver_cspolicy_binding.tf_csvscspolbind_echoserver2: Refreshing state... [id=tf_csvserver,tf_policy_echoserver2]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:

• create

Terraform will perform the following actions:

citrixadc_appfwprofile.tf_appfwprofile1 will be created

• resource "citrixadc_appfwprofile" "tf_appfwprofile1" {
  • addcookieflags = (known after apply)
  • archivename = (known after apply)
  • bufferoverflowmaxcookielength = (known after apply)
  • bufferoverflowmaxheaderlength = (known after apply)
  • bufferoverflowmaxquerylength = (known after apply)
  • bufferoverflowmaxurllength = (known after apply)
  • canonicalizehtmlresponse = (known after apply)
  • checkrequestheaders = (known after apply)
  • cmdinjectionaction = (known after apply)
  • comment = (known after apply)
  • cookieencryption = (known after apply)
  • cookiehijackingaction = (known after apply)
  • cookieproxying = (known after apply)
  • cookietransforms = (known after apply)
  • creditcardmaxallowed = (known after apply)
  • creditcardxout = (known after apply)
  • crosssitescriptingcheckcompleteurls = (known after apply)
  • crosssitescriptingtransformunsafehtml = (known after apply)
  • customsettings = (known after apply)
  • defaultcharset = (known after apply)
  • defaultfieldformatmaxlength = (known after apply)
  • defaultfieldformatminlength = (known after apply)
  • defaultfieldformattype = (known after apply)
  • defaults = (known after apply)
  • dosecurecreditcardlogging = (known after apply)
  • enableformtagging = (known after apply)
  • errorurl = (known after apply)
  • excludefileuploadfromchecks = (known after apply)
  • exemptclosureurlsfromsecuritychecks = (known after apply)
  • fileuploadmaxnum = (known after apply)
  • htmlerrorobject = (known after apply)
  • id = (known after apply)
  • infercontenttypexmlpayloadaction = (known after apply)
  • invalidpercenthandling = (known after apply)
  • jsonerrorobject = (known after apply)
  • jsonsqlinjectiontype = (known after apply)
  • logeverypolicyhit = (known after apply)
  • name = "tf_appfwprofile1"
  • optimizepartialreqs = (known after apply)
  • percentdecoderecursively = (known after apply)
  • postbodylimit = (known after apply)
  • postbodylimitaction = (known after apply)
  • postbodylimitsignature = (known after apply)
  • refererheadercheck = (known after apply)
  • requestcontenttype = (known after apply)
  • responsecontenttype = (known after apply)
  • rfcprofile = (known after apply)
  • semicolonfieldseparator = (known after apply)
  • sessionlessfieldconsistency = (known after apply)
  • sessionlessurlclosure = (known after apply)
  • signatures = (known after apply)
  • sqlinjectionaction = [
    • "block",
    • "log",
    • "stats", ]
  • sqlinjectionchecksqlwildchars = (known after apply)
  • sqlinjectiononlycheckfieldswithsqlchars = (known after apply)
  • sqlinjectionparsecomments = (known after apply)
  • sqlinjectiontransformspecialchars = (known after apply)
  • sqlinjectiontype = (known after apply)
  • starturlclosure = (known after apply)
  • streaming = (known after apply)
  • stripcomments = (known after apply)
  • striphtmlcomments = (known after apply)
  • stripxmlcomments = (known after apply)
  • trace = (known after apply)
  • type = [
    • "HTML",
    • "JSON",
    • "XML", ]
  • urldecoderequestcookies = (known after apply)
  • usehtmlerrorobject = (known after apply)
  • verboseloglevel = (known after apply)
  • xmlerrorobject = (known after apply)
  • xmlsqlinjectionchecksqlwildchars = (known after apply)
  • xmlsqlinjectiononlycheckfieldswithsqlchars = (known after apply)
  • xmlsqlinjectionparsecomments = (known after apply)
  • xmlsqlinjectiontype = (known after apply) }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve.

Enter a value: yes

citrixadc_appfwprofile.tf_appfwprofile1: Creating... citrixadc_appfwprofile.tf_appfwprofile1: Creation complete after 0s [id=tf_appfwprofile1]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

root@cloud-client:~/apply-waf-configuration# terraform plan -var-file example.tfvars citrixadc_nsfeature.tf_nsfeature: Refreshing state... [id=tf-nsfeature-20230913053538261700000001] citrixadc_lbvserver.tf_lbvserver2: Refreshing state... [id=tf_lbvserver2] citrixadc_nsip.snip: Refreshing state... [id=192.168.3.10] citrixadc_service.web-echoserver1: Refreshing state... [id=web-echoserver1] citrixadc_lbvserver.tf_lbvserver1: Refreshing state... [id=tf_lbvserver1] citrixadc_appfwprofile.tf_appfwprofile1: Refreshing state... [id=tf_appfwprofile1] citrixadc_csvserver.tf_csvserver: Refreshing state... [id=tf_csvserver] citrixadc_service.web-echoserver2: Refreshing state... [id=web-echoserver2] citrixadc_lbvserver_service_binding.lb_binding1: Refreshing state... [id=tf_lbvserver1,web-echoserver1] citrixadc_csaction.tf_csaction1: Refreshing state... [id=tf_csaction1] citrixadc_lbvserver_service_binding.lb_binding2: Refreshing state... [id=tf_lbvserver2,web-echoserver2] citrixadc_csaction.tf_csaction2: Refreshing state... [id=tf_csaction2] citrixadc_cspolicy.tf_policy_echoserver1: Refreshing state... [id=tf_policy_echoserver1] citrixadc_cspolicy.tf_policy_echoserver2: Refreshing state... [id=tf_policy_echoserver2] citrixadc_csvserver_cspolicy_binding.tf_csvscspolbind_echoserver1: Refreshing state... [id=tf_csvserver,tf_policy_echoserver1] citrixadc_csvserver_cspolicy_binding.tf_csvscspolbind_echoserver2: Refreshing state... [id=tf_csvserver,tf_policy_echoserver2]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place

Terraform will perform the following actions:

citrixadc_appfwprofile.tf_appfwprofile1 will be updated in-place

~ resource "citrixadc_appfwprofile" "tf_appfwprofile1" { ~ bufferoverflowaction = [

• "block",
• "log",
• "stats", ] ~ contenttypeaction = [
• "none", ] ~ cookieconsistencyaction = [
• "none", ] ~ creditcard = [
• "none", ] ~ creditcardaction = [
• "none", ] ~ crosssitescriptingaction = [
• "block",
• "log",
• "stats", ] ~ csrftagaction = [
• "none", ] ~ denyurlaction = [
• "block",
• "log",
• "stats", ] ~ dynamiclearning = [
• "none", ] ~ fieldconsistencyaction = [
• "none", ] ~ fieldformataction = [
• "block",
• "log",
• "stats", ] ~ fileuploadtypesaction = [
• "block",
• "log",
• "stats", ] id = "tf_appfwprofile1" ~ inspectcontenttypes = [
• "application/grpc",
• "application/x-www-form-urlencoded",
• "multipart/form-data",
• "text/x-gwt-rpc", ] ~ jsondosaction = [
• "block",
• "log",
• "stats", ] ~ jsonsqlinjectionaction = [
• "block",
• "log",
• "stats", ] ~ jsonxssaction = [
• "block",
• "log",
• "stats", ] ~ multipleheaderaction = [
• "block",
• "log", ] name = "tf_appfwprofile1" ~ starturlaction = [
• "block",
• "log",
• "stats", ] ~ xmlattachmentaction = [
• "block",
• "log",
• "stats", ] ~ xmldosaction = [
• "block",
• "log",
• "stats", ] ~ xmlformataction = [
• "block",
• "log",
• "stats", ] ~ xmlsoapfaultaction = [
• "block",
• "log",
• "stats", ] ~ xmlsqlinjectionaction = [
• "block",
• "log",
• "stats", ] ~ xmlvalidationaction = [
• "block",
• "log",
• "stats", ] ~ xmlwsiaction = [
• "block",
• "log",
• "stats", ] ~ xmlxssaction = [
• "block",
• "log",
• "stats", ]

  (51 unchanged attributes hidden)

  }

Plan: 0 to add, 1 to change, 0 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

4. Error I am facing on the console
```bash
Not applicable

Expected behaviour The terraform plan immediately after the terraform apply should not have any changes to be shown

Screenshots If applicable, add screenshots to help explain your problem.

Environment (please fill the following information):

• OS: Linux
• terraform version output

 root@cloud-client:~/apply-waf-configuration# terraform version
Terraform v1.1.4
on linux_amd64
+ provider registry.terraform.io/citrix/citrixadc v1.31.0

Your version of Terraform is out of date! The latest version
is 1.5.7. You can update by downloading from https://www.terraform.io/downloads.html

• terraform-provider-citrixadc version

  root@cloud-client:~/apply-waf-configuration# grep -e '"version"' -e '"terraform_version"' terraform.tfstate
  "version": 4,
  "terraform_version": "1.1.4",
  root@cloud-client:~/apply-waf-configuration# 

• go version output

root@cloud-client:~/apply-waf-configuration# go version
bash: go: command not found
root@cloud-client:~/apply-waf-configuration# 

Additional context I am executing NetScaler Community labs - netscaler-adc-basic-application-protection-configuration-waf-using-terraform

[jeffriechers]

I had something similar happen with ecc curve settings. I had to modify my code to manually define every single entry as it shows up after deployment. Even the optional items that are defaults. Once I did that then I no longer had it re-applying settings that existed.

[kaiAsmOne]

It´s not that strange when you look at how the REST API is implemented at the Netscaler. Netscaler gui talks with itself using REST API.

If you sniff the traffic in sslplain you will notice that the attributes of the appfw profile are not optional, all settings are set everytime you do one small change to the appfw / waf profile in gui :)

[gusmb]

What does the state file look like after first apply, shouldn't all those default attributes be there? If that's the case, I'd assume that there would be no issue as TF would know the current state, is the NITRO call. It returning the complete picture in this case?

[rohit-myali]

Hello @sumanth-lingappa @kaiAsmOne @gusmb @jeffriechers Thanks for your patience. We have worked on this and and it is now available in the terraform registry. Please download the latest terraform-provider-citrixadc version v1.38.0. Now you don't need to provide the entire appfwprofile attributes to update a single attribute.

Thank you