�
d�bc@s�dd
lZdd
l
Z
dd
ljjZddlmZ
ddlmZm	Z	
ddl
mZ
ddlm
Z
mZ
ddlmZmZmZ
ddlmZ
ddlmZ
d	ef
d
��YZd
S(i����N(
tlogger(t	add_eventtWALAEventOperation(
tustr(t
get_osutiltsystemd(t	shellutiltfileutilttextutil(
tAddFirewallRules(
tCommandErrortPersistFirewallRulesHandlercBs�eZ
dZd
ZdZdZddgZdZed��
Z	d�Z
ed	��
Zd
�Zd�Z
d�Zd
�Zd�Zd�Zd�Zed��
Zd�Zd�Zd�Zd�Zd�ZRS(sp

# This unit file (Version={version}) was created by the Azure VM Agent.
# Do not edit.
[Unit]
Description=Setup network rules for WALinuxAgent 
Before=network-pre.target
Wants=network-pre.target
DefaultDependencies=no
ConditionPathExists={binary_path}

[Service]
Type=oneshot
ExecStart={py_path} {binary_path}
RemainAfterExit=false

[Install]
WantedBy=network.target
sq

# This python file was created by the Azure VM Agent. Please do not edit.

import os 


if __name__ == '__main__':
    if os.path.exists("{egg_path}"):
        os.system("{py_path} {egg_path} --setup-firewall --dst_ip={wire_ip} --uid={user_id} {wait}")
    else:
        print("{egg_path} file not found, skipping execution of firewall execution setup for this boot")
s{0}-network-setup.serviceswaagent-network-setup.pysfirewall-cmds--states1.2cCs:t�}t
jj|j��
}
tjj|j�|
�S(
N(	RRt _AGENT_NETWORK_SETUP_NAME_FORMATtformattget_service_nametostpathtjoint"get_systemd_unit_file_install_path(tosutiltservice_name((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pytget_service_file_pathJs	

cCs�t�}|j
j|j��
|_tj�|_|j�|_	|
|_
||_|j�|_
tjjtj�tjd
�|_dS(s�

        This class deals with ensuring that Firewall rules are persisted over system reboots.
        It tries to employ using Firewalld.service if present first as it already has provisions for persistent rules.
        If not, it then creates a new agent-network-setup.service file and copy it over to the osutil.get_systemd_unit_file_install_path() dynamically
        On top of it, on every service restart it ensures that the WireIP is overwritten and the new IP is blocked as well.
        iN(RRR
Rt_network_setup_service_nameRt
is_systemdt_is_systemdRt_systemd_file_patht_dst_ipt_uidtget_firewall_will_waitt_waitRRRtgetcwdtsystargvt_current_agent_executable_path(tselftdst_iptuidR((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt__init__Ps	



	
	
cCshtj
}ytj|�
j�d
kSWn;tk
rc
}

tjdjdj	|�
t
|
�
��

n
XtS(Ntrunnings{0} command failed: {1}t
 (Rt_FIREWALLD_RUNNING_CMDRtrun_commandtrstript	ExceptionRtverboseR
RRtFalse(tfirewalld_stateterror((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt_is_firewall_service_runningas	



,
c
Cs�tj
�s)tjd
j|j�
�

dS|j�r�tjd�

|j�
y5t	j
|j�tj
jtj�|j�g�
Wn5tk
r�
}

tjdj|jt|
�
��

n
XdStjdj|j�
�

|j�
dS(Ns)Did not detect Systemd, unable to set {0}sIFirewalld.service present on the VM, setting up permanent rules on the VMs*Unable to delete existing service {0}: {1}s?Firewalld service not running/unavailable, trying to set up {0}(RRRtwarnR
RR0tinfot _setup_permanent_firewalld_rulesRtrm_filesRRRRtconftget_lib_dirtBINARY_FILE_NAMER+Rt_setup_network_setup_service(R"R/((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pytsetupns






5


 

c
CsQytj
|j|j�
Wn0tk
rL
}

tjd
jt|
�
�
�

t	SXt
S(NsKCheck if Firewall rules already applied using firewalld.service failed: {0}(R	tcheck_firewalld_rule_appliedRRR+RR,R
RR-tTrue(R"R/((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt__verify_firewall_rules_enabled�s




c

CsQ|j�rt
jd
�

dSt
jd�

tj|j|j�
t
jd�

dS(Ns-Firewall rules already set. No change needed.sEFirewall rules not added yet, adding them now using firewalld.services@Successfully added the firewall commands using firewalld.service(t;_PersistFirewallRulesHandler__verify_firewall_rules_enabledRR2R	tadd_firewalld_rulesRR(
R"((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyR3�s





c
Cs�d
d|jg}
yt
j|
�
j�dkSWnptk
rt
}
dj|jdj|
�
|j|j|j	�}n.t
k
r�
}
dj|jt|�
�}n
Xtj
|�

tS(Nt	systemctls
is-enabledtenabledsD{0} not enabled. Command: {1}, ExitCode: {2}
Stdout: {3}
Stderr: {4}R's+Ran into error, {0} not enabled. Error: {1}(RRR)R*R
R
Rt
returncodetstdouttstderrR+RRR,R-(R"tcmdR/tmsg((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt&__verify_network_setup_service_enabled�s




-



c
Cs�|j�
|j
�}
|
rO|j�rOtjd
j|j�
�

|j�
nq|
sqtjdj|j�
�

n"tjdj|j�|j	��

|j
�
|j�
tjdj|j�
�

dS(Ns/Service: {0} already enabled. No change needed.s'Service: {0} not enabled. Adding it nows:Unit file {0} version modified to {1}, setting it up agains&Successfully added and enabled the {0}(t/_PersistFirewallRulesHandler__setup_binary_filetB_PersistFirewallRulesHandler__verify_network_setup_service_enabledt8_PersistFirewallRulesHandler__unit_file_version_modifiedRR2R
Rt<_PersistFirewallRulesHandler__log_network_setup_service_logsRt
_UNIT_VERSIONt3_PersistFirewallRulesHandler__set_service_unit_filet1_PersistFirewallRulesHandler__reload_systemd_conf(R"tnetwork_service_enabled((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyR8�s











c

Cs�tj
jtj�|j�}
y`tj|
|jj	d
|j
d|jd|jd|j
dtj��
tjdj	|
�
�

WnPtk
r�


tjdj	|j��
�

|j|
�

|j|j��

�n
XdS(Ntegg_pathtwire_iptuser_idtwaittpy_paths;Successfully updated the Binary file {0} for firewall setupsfUnable to setup binary file, removing the service unit file {0} to ensure its not run on system reboot(RRRR5R6R7Rt
write_filet-_PersistFirewallRulesHandler__BINARY_CONTENTSR
R!RRRRt
executableRR2R+R1Rt9_PersistFirewallRulesHandler__remove_file_without_raising(R"tbinary_file_path((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt__setup_binary_file�s 


	

	
	
	











c
	Cs
|j�}
t
jjtj�|j�}y�tj|
|j	j
d
|dtjd|j
��
tj|
d�
dd|jg}ytj|�

WnXtk
r�
}
td�
j
|j|
dj|�
|j|j|j�}t|�
�
n
XWn!tk
r



|j|
�

�n
XdS(	Ntbinary_pathRStversioni�
R?tenablespUnable to enable service: {0}; deleting service file: {1}. Command: {2}, Exit-code: {3}.
stdout: {4}
stderr: {5}R'(RRRRR5R6R7RRTt2_PersistFirewallRulesHandler__SERVICE_FILE_CONTENTR
RRVRKtchmodRRR)R
RRARBRCR+RW(R"tservice_unit_fileRZRDR/RE((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt__set_service_unit_file�s(



	

	







	
!





c
Cs_tj
j|�
r[ytj|�

Wq[tk
rW
}

tjd
j|t|
�
��

q[XndS(Ns&Unable to delete file: {0}; Error: {1}(	RRtexiststremoveR+RR1R
R(t	file_pathR/((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt__remove_file_without_raising�s




c
Cs�d
d|jg}
yt
j|
�
j�dkSWnptk
rt
}
dj|jdj|
�
|j|j|j	�}n.t
k
r�
}
dj|jt|�
�}n
Xtj
|�

tS(NR?s	is-failedtfailedsN{0} not in a failed state. Command: {1}, ExitCode: {2}
Stdout: {3}
Stderr: {4}R's*Ran into error, {0} not failed. Error: {1}(RRR)R*R
R
RRARBRCR+RRR,R-(R"RDR/RE((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt%__verify_network_setup_service_failed�s




-



c
	Cs
d
d|jddg}
|j
�}y;tj|
�
}td�
j|j|�}tj|�

Wn�tk
r�
}
djdj	|
�
|j
|j|j�}tj
|�

n>tk
r�
}
dj|jtj|�
�}tj
|�

n
Xtd	tjd
|d|dt�
dS(
Nt
journalctls-us-bs--utcs)Logs from the {0} since system boot:
 {1}s\Unable to fetch service logs, Command: {0} failed with ExitCode: {1}
Stdout: {2}
Stderr: {3}R'sGRan into unexpected error when getting logs for {0} service. Error: {1}topt
is_successtmessaget	log_event(RtA_PersistFirewallRulesHandler__verify_network_setup_service_failedRR)RR
RR2R
RRARBRCR1R+Rtformat_exceptionR
RtPersistFirewallRulesR-(R"RDtservice_failedRBRER/t
e((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt __log_network_setup_service_logs	
s&







$





	


c
Csfy0tj
d
j|j�
�

tjddg�

Wn/tk
ra
}

tjdjt|
�
�
�

n
XdS(Ns4Executing systemctl daemon-reload for setting up {0}R?s
daemon-reloads.Unable to reload systemctl configurations: {0}(	RR2R
RRR)R+R1R(R"t	exception((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt__reload_systemd_conf"
s





c
Cstj
j|j��
s6td
j|j��
�
�
ntj|j�dd�

}
|
dkrlt	d�
�
n|
j
d�
j�S(Ns
{0} not foundtline_resFThis unit file \(Version=([\d.]+)\) was created by the Azure VM Agent.s&Version tag not found in the unit filei
(RRRaRtOSErrorR
Rtfindre_in_filetNonet
ValueErrortgrouptstrip(R"tmatch((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt__get_unit_file_version)
s


	

c
Cs�y|j�}
Wn0t
k
rB
}
tjd
jt|�
�
�

tSX|
|jkrrtjdj|
|j��

tStjdj|
�
�

tS(s�
        Check if the unit file version changed from the expected version
        :return: True if unit file version changed else False
        sDUnable to determine version of unit file: {0}, overwriting unit filesWUnit file version: {0} does not match with expected version: {1}, overwriting unit filesOUnit file version matches with expected version: {0}, not overwriting unit file(	t3_PersistFirewallRulesHandler__get_unit_file_versionR+RR2R
RR;RKR-(R"tunit_file_versionR/((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt__unit_file_version_modified4
s








(t__name__t
__module__R]RURR7R(RKtstaticmethodRR%R0R9R=R3RHR8RGRLRWRlRJRMR}RI(((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyRs,

	
			
								(RRtazurelinuxagent.common.conftcommonR5tazurelinuxagent.commonRtazurelinuxagent.common.eventR
Rtazurelinuxagent.common.futureRtazurelinuxagent.common.osutilRRtazurelinuxagent.common.utilsRRRt(azurelinuxagent.common.utils.networkutilR	t&azurelinuxagent.common.utils.shellutilR
tobjectR(((sQ/usr/lib/python2.7/site-packages/azurelinuxagent/common/persist_firewall_rules.pyt<module>s