
    dF.                     ~    d dl mZ d dlmZ d dlmZ  G d de      Z G d d      Z G d d	e      Z	 G d
 de      Z
y)    )ustr)	shellutil)CommandErrorc                   J    e Zd ZdZd Zed        Zd Zd Zd Z	d Z
d Zd	 Zy
)
RouteEntryz
    Represents a single route. The destination, gateway, and mask members are hex representations of the IPv4 address in
    network byte order.
    c                 ~    || _         || _        || _        || _        t	        |d      | _        t	        |      | _        y )N   )	interfacedestinationgatewaymaskintflagsmetric)selfr
   r   r   r   r   r   s          J/usr/lib/python3/dist-packages/azurelinuxagent/common/utils/networkutil.py__init__zRouteEntry.__init__   s7    "&	^
&k    c                     t        |       dk7  rt        d      g }t        ddd      D ],  }|j                  t	        t        | ||dz    d                   . dj                  |      S )N   z5String to dotted quad conversion must be 8 characters      r	   .)len	Exceptionrangeappendstrr   join)valueoctetsidxs      r   _net_hex_to_dotted_quadz"RouteEntry._net_hex_to_dotted_quad&   sh    u:?STTB# 	<CMM#c%C!G"4b9:;	<xxr   c                 8    | j                  | j                        S N)r$   r   r   s    r   destination_quadzRouteEntry.destination_quad/   s    ++D,<,<==r   c                 8    | j                  | j                        S r&   )r$   r   r'   s    r   gateway_quadzRouteEntry.gateway_quad2   s    ++DLL99r   c                 8    | j                  | j                        S r&   )r$   r   r'   s    r   	mask_quadzRouteEntry.mask_quad5   s    ++DII66r   c                     d}|j                  | j                  | j                         | j                         | j	                         | j
                  | j                        S )Nzo{{"Iface": "{0}", "Destination": "{1}", "Gateway": "{2}", "Mask": "{3}", "Flags": "{4:#06x}", "Metric": "{5}"}}formatr
   r(   r*   r,   r   r   r   fs     r   to_jsonzRouteEntry.to_json8   sM    }xx(=(=(?ARARATVZVdVdVf

DKK1 	1r   c                     d}|j                  | j                  | j                         | j                         | j	                         | j
                  | j                        S )NzNIface: {0}	Destination: {1}	Gateway: {2}	Mask: {3}	Flags: {4:#06x}	Metric: {5}r.   r0   s     r   __str__zRouteEntry.__str__=   sM    axx(=(=(?ARARATVZVdVdVf

DKK1 	1r   c                     dj                  | j                  | j                  | j                  | j                  | j
                  | j                        S )Nz9RouteEntry("{0}", "{1}", "{2}", "{3}", "{4:#04x}", "{5}"))r/   r
   r   r   r   r   r   r'   s    r   __repr__zRouteEntry.__repr__B   s<    JVDNND$4$4dllDIItzz[_[f[fg	hr   N)__name__
__module____qualname____doc__r   staticmethodr$   r(   r*   r,   r2   r4   r6    r   r   r   r      s?    
"    >:71
1
hr   r   c                   :    e Zd Zd Zd Zd Zd Zed        Zd Z	y)NetworkInterfaceCardc                 \    || _         t               | _        t               | _        || _        y r&   )namesetipv4ipv6link)r   r@   	link_infos      r   r   zNetworkInterfaceCard.__init__H   s"    	E	E		r   c                 :    | j                   j                  |       y r&   )rB   addr   infos     r   add_ipv4zNetworkInterfaceCard.add_ipv4N       		dr   c                 :    | j                   j                  |       y r&   )rC   rG   rH   s     r   add_ipv6zNetworkInterfaceCard.add_ipv6Q   rK   r   c                     | j                   |j                   k(  xr4 | j                  |j                  k(  xr | j                  |j                  k(  S r&   )rD   rB   rC   )r   others     r   __eq__zNetworkInterfaceCard.__eq__T   sA    yyEJJ& 'yyEJJ&'yyEJJ&	'r   c           
          dj                  dj                  t        |       D cg c]  }dj                  |       c}            S c c}w )Nz[{0}],z"{0}")r/   r    sorted)itemsxs     r   _json_arrayz NetworkInterfaceCard._json_arrayY   s5    ~~chh6%='Qaq(9'QRSS'Qs   Ac                    dj                  | j                        dj                  | j                        g}t        | j                        dkD  r9|j                  dj                  | j                  | j                                     t        | j                        dkD  r9|j                  dj                  | j                  | j                                     dj                  dj                  |            S )Nz"name": "{0}"z"link": "{0}"r   z"ipv4": {0}z"ipv6": {0}z	{{ {0} }}z, )	r/   r@   rD   r   rB   r   rV   rC   r    )r   entriess     r   r4   zNetworkInterfaceCard.__str__]   s    "))$))4"))$))46tyy>ANN=//0@0@0KLMtyy>ANN=//0@0@0KLM!!$))G"455r   N)
r7   r8   r9   r   rJ   rM   rP   r;   rV   r4   r<   r   r   r>   r>   G   s1    '
 T T6r   r>   c                       e Zd ZdZdZdZy)FirewallCmdDirectCommandsz--passthroughz--query-passthroughz--remove-passthroughN)r7   r8   r9   PassThroughQueryPassThroughRemovePassThroughr<   r   r   rZ   rZ   g   s     "K -
 /r   rZ   c                   2   e Zd ZdZdZdZdZdZedd       Z	ed        Z
ed	        Zedd
       Zedd       Zedd       Zedd       Zed        Zed        Zed        Zed        Zeeddfd       Zed        Zed        Zed        Zed        Zy)AddFirewallRulesa  
    This class is a utility class which is only meant to orchestrate adding Firewall rules (both iptables and firewalld).
    This would also be called from a separate utility binary which would be very early up in the boot order of the VM,
    due to which it would not have access to basic mounts like file-system.
    Please make sure to not log anything in any function this class.
    z-Az-Iz-Dz-C c                     | dk7  rddgS dgS )za
        If 'wait' is True, adds the wait option (-w) to the given iptables command line
        r`   iptablesz-wr<   waits    r   __get_iptables_base_commandz,AddFirewallRules.__get_iptables_base_command   s    
 2:%%|r   c                     ddd| dgS )Nzfirewall-cmdz--permanentz--directrB   r<   )commands    r   __get_firewalld_base_commandz-AddFirewallRules.__get_firewalld_base_command   s     z7FKKr   c                     dd| dd|ddgS )Nz-tsecurityOUTPUTz-dz-ptcpr<   )rg   r   s     r   __get_common_command_paramsz,AddFirewallRules.__get_common_command_params   s    j'8T;eTTr   c                     |dk7  rt         j                  |      }nt         j                  |      }|j                  t         j	                  | |             |S )Nr`   )r_   -_AddFirewallRules__get_firewalld_base_command,_AddFirewallRules__get_iptables_base_commandextend,_AddFirewallRules__get_common_command_paramsrg   r   firewalld_commandrd   cmds        r   __get_firewall_base_commandz,AddFirewallRules.__get_firewall_base_command   sL     ""??@QRC">>tDC

#??UV
r   c                 \    t         j                  | |||      }|j                  g d       |S )N)z--destination-port53-jACCEPTr_   ,_AddFirewallRules__get_firewall_base_commandrq   rs   s        r   get_accept_tcp_rulez$AddFirewallRules.get_accept_tcp_rule   s.     ::7KQbdhi

?@
r   c                 v    t         j                  | |||      }|j                  dddt        |      ddg       |S )N-mownerz--uid-ownerry   rz   )r_   r|   rq   r   )rg   r   	owner_uidrt   rd   ru   s         r   get_wire_root_accept_rulez*AddFirewallRules.get_wire_root_accept_rule   s<    ::7KQbdhi

D'=#i.$QR
r   c                 \    t         j                  | |||      }|j                  g d       |S )N)r   	conntrackz	--ctstatezINVALID,NEWry   DROPr{   rs   s        r   get_wire_non_root_drop_rulez,AddFirewallRules.get_wire_non_root_drop_rule   s,    ::7KQbdhi

PQ
r   c                 B    | dk(  rt        dj                  |            y )Nr`   z{0} should not be empty)r   r/   )valr@   s     r   __raise_if_emptyz!AddFirewallRules.__raise_if_empty   s%    "95<<TBCC r   c           	         	 t        j                  |        y # t        $ rc}dj                  dj	                  |       |j
                  t        |j                        t        |j                              }t        |      d }~ww xY w)Nz>Command {0} failed with exit-code: {1}
Stdout: {2}
Stderr: {3} )
r   run_commandr   r/   r    
returncoder   stdoutstderrr   )ru   errormsgs      r   __execute_cmdzAddFirewallRules.__execute_cmd   sx    	!!!#& 	!T[[\_\d\deh\i\a\l\l\`afamam\n\`afamam\npC C. 	!s    	BAA??Bc                 |    	 t        j                  |        y# t        $ r}|j                  dk7  r Y d }~yd }~ww xY w)NT   F)r   r   r   r   )ru   errs     r   __execute_check_commandz(AddFirewallRules.__execute_check_command   s?    	!!#& 	~~" #		s    	;6;c                 n   t         j                  t         j                  ||       }t         j                  t         j                  |||       }t         j	                  t         j                  ||       }t         j                  |      xr, t         j                  |      xr t         j                  |      S )Nrc   )r_   r}   CHECK_COMMANDr   r   (_AddFirewallRules__execute_check_command)rd   dst_ipuidcheck_cmd_tcp_rulecheck_cmd_accept_rulecheck_cmd_drop_rules         r   verify_iptables_rules_existz,AddFirewallRules.verify_iptables_rules_exist   s    -AABRB`B`bhosAt 0 J JK[KiKikqsvPT !K !V.JJK[KiKikqx|J}778JK QP`PxPx  zO  QP Q#;;<OP	Qr   c                 r   t         j                  | d       t         j                  |d       t         j                  || ||      }t         j                  |       t         j	                  || |||      }t         j                  |       t         j                  || ||      }t         j                  |       y )NzDestination IPzUser ID)rt   rd   )r_   !_AddFirewallRules__raise_if_emptyr}   _AddFirewallRules__execute_cmdr   r   )r   r   rg   rt   rd   accept_tcp_rule
accept_cmddrop_cmds           r   __execute_firewall_commandsz,AddFirewallRules.__execute_firewall_commands   s     	))&2BC))#y9*>>wQbim ? o&&7%??QTRcjn @ p
&&z2#??ct{?  A&&x0r   c                 R    t         j                  ||t         j                  |        y )N)rg   rd   )r_   ,_AddFirewallRules__execute_firewall_commandsAPPEND_COMMAND)rd   r   r   s      r   add_iptables_rulesz#AddFirewallRules.add_iptables_rules   s!    44VSJZJiJipt4ur   c                 P    t         j                  | |t        j                         y N)rt   )r_   r   rZ   r[   r   r   s     r   add_firewalld_rulesz$AddFirewallRules.add_firewalld_rules   s     
 	44VSTmTyTy4zr   c                 P    t         j                  | |t        j                         y r   )r_   r   rZ   r\   r   s     r   check_firewalld_rule_appliedz-AddFirewallRules.check_firewalld_rule_applied  s    44VSTmT~T~4r   c                 P    t         j                  | |t        j                         y r   )r_   r   rZ   r]   r   s     r   remove_firewalld_rulesz'AddFirewallRules.remove_firewalld_rules  s!    44VSTmTT4  	Ar   N)r`   )r`   r`   )r7   r8   r9   r:   r   INSERT_COMMANDDELETE_COMMANDr   r;   rp   ro   rr   r|   r}   r   r   r   r   r   r   r   r   r   r   r   r<   r   r   r_   r_   z   sz    N
 N N M  L L U U      
  
 D D ! ! 	 	 Q Q 9G[]df 1 1" v v { { @ @ A Ar   r_   N)azurelinuxagent.common.futurer   azurelinuxagent.common.utilsr   &azurelinuxagent.common.utils.shellutilr   objectr   r>   rZ   r_   r<   r   r   <module>r      sF   & / 2 ?,h ,h^6 6@/ /&NAv NAr   