�
d�bc@s�dd
lm
Z

ddlmZ
ddlmZ
def
d��YZdd
d��YZdef
d	��YZ	d
ef
d��YZ
dS(i����(
tustr(
t	shellutil(
tCommandErrort
RouteEntrycBs\eZ
dZd
�Zed��
Zd�Zd�Zd�Zd�Z	d�Z
d�ZRS(	s�
    Represents a single route. The destination, gateway, and mask members are hex representations of the IPv4 address in
    network byte order.
    cCsI|
|_||_
||_||_t|d
�|_t|�
|_dS(Ni(t	interfacetdestinationtgatewaytmasktinttflagstmetric(tselfRRRRR	R
((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__init__s
	
	
	
	

c
Csxt|�
d
kr!t
d�
�
ng}
xAtddd�D]-}|
jtt|||d!d��
�

q:Wdj|
�
S(Nis5String to dotted quad conversion must be 8 charactersii����iit
.(tlent	ExceptiontrangetappendtstrRtjoin(tvaluetoctetstidx((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt_net_hex_to_dotted_quad%s



+
c

Cs|j|j
�
S(
N(RR(
R((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytdestination_quad.s
c

Cs|j|j
�
S(
N(RR(
R((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytgateway_quad1s
c

Cs|j|j
�
S(
N(RR(
R((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt	mask_quad4s
c
Cs=d
}
|
j|j
|j�|j�|j�|j|j�S(Nso{{"Iface": "{0}", "Destination": "{1}", "Gateway": "{2}", "Mask": "{3}", "Flags": "{4:#06x}", "Metric": "{5}"}}(tformatRRRRR	R
(Rt
f((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytto_json7s

'
c
Cs=d
}
|
j|j
|j�|j�|j�|j|j�S(NsNIface: {0}	Destination: {1}	Gateway: {2}	Mask: {3}	Flags: {4:#06x}	Metric: {5}(RRRRRR	R
(RR((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__str__<s

'
c

Cs.d
j|j
|j|j|j|j|j�S(Ns9RouteEntry("{0}", "{1}", "{2}", "{3}", "{4:#04x}", "{5}")(RRRRRR	R
(
R((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__repr__As

(t__name__t
__module__t__doc__RtstaticmethodRRRRRRR(((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyRs
							tNetworkInterfaceCardcBsDeZ
d�Zd
�Zd�Zd�Zed��
Zd�ZRS(cCs.|
|_t
�|_t
�|_||_dS(
N(tnametsettipv4tipv6tlink(RR%t	link_info((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyRGs
	


cCs|jj
|
�

dS(
N(R'tadd(Rtinfo((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytadd_ipv4Ms
cCs|jj
|
�

dS(
N(R(R+(RR,((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytadd_ipv6Ps
cCs4|j|
jko3|j
|
j
ko3|j|
jkS(
N(R)R'R((Rtother((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__eq__Ss


c
Cs8d
jdj
gt|�
D]}
dj|
�
^q�
�
S(Ns[{0}]t
,s"{0}"(RRtsorted(titemst
x((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt_json_arrayXsc
Cs�d
j|j
�
dj|j�
g}
t|j�
dkr^|
jdj|j|j�
�
�

nt|j�
dkr�|
jdj|j|j�
�
�

ndjdj|
�
�
S(Ns
"name": "{0}"s
"link": "{0}"is"ipv4": {0}s"ipv6": {0}s	{{ {0} }}s, (	RR%R)RR'RR5R(R(Rtentries((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyR\s



%

%
(	R R!RR-R.R0R#R5R(((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyR$Fs
				tFirewallCmdDirectCommandsc
BseZ
dZd
ZRS(s
--passthroughs--query-passthrough(R R!tPassThroughtQueryPassThrough(((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyR7fstAddFirewallRulescBs4
eZ
dZd
ZdZdZdZed��
Zedd�
�
Z	ed��
Z
ed	��
Zed
��
Zed��
Z
eddd��
Zed
��
Zed��
Zedd�
�
Zedd�
�
Zed��
Zed��
Zed��
Zed��
Zed��
Zed��
ZRS(s�

    This class is a utility class which is only meant to orchestrate adding Firewall rules (both iptables and firewalld).
    This would also be called from a separate utility binary which would be very early up in the boot order of the VM,
    due to which it would not have access to basic mounts like file-system.
    Please make sure to not log anything in any function this class.
    s-As-Is-Ds-CcCs|r|
jd
�

n|
S(sa
        If 'wait' is True, adds the wait option (-w) to the given iptables command line
        s-w(
R(twaittcommand((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt	_add_wait�s

tc

Cs|d
krddgSdg
S(NR>tiptabless-w((
R;((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__get_iptables_base_command�s


c

Csd
dd|dgS(Nsfirewall-cmds--permanents--directR'((
R<((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__get_firewalld_base_command�sc	Csd
d|dd|
dddg	S(Ns-ttsecuritytOUTPUTs-ds-pttcps-m((R<R((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__get_common_command_params�scCsDtj
|
|�}|jd
dt|�
ddg�

tj||�S(Ntowners--uid-owners-jtACCEPT(R:t,_AddFirewallRules__get_common_command_paramstextendRR=(R;R<Rtuidtcmd((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt"__get_common_accept_command_params�s
"
cCs>tj
|
|�}|jd
ddddg�

tj||�S(Nt	conntracks	--ctstatesINVALID,NEWs-jtDROP(R:RHRIR=(R;R<RRK((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt __get_common_drop_command_params�s

c
Cs_|d
krtj
|�
}ntj|�
}|dd|dd|
dddd	d
dg}|S(NR>s-tRBRCs-ds-pRDs--destination-portt53s-jRG(R:t-_AddFirewallRules__get_firewalld_base_commandt,_AddFirewallRules__get_iptables_base_command(R<Rtfirewalld_commandR;RK((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytget_accept_tcp_rule�s


.
cCs/tj
�}|jtj||
||��

|S(
N(R:RRRIt3_AddFirewallRules__get_common_accept_command_params(R;R<Rt	owner_uidRK((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytget_iptables_accept_command�s

cCs,tj
�}|jtj||
|��

|S(
N(R:RRRIt1_AddFirewallRules__get_common_drop_command_params(R;R<RRK((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytget_iptables_drop_command�s

cCs5tj
|�
}|jtj|tj|
|��

|S(
N(R:RQRIRUtAPPEND_COMMAND(R<RRJR;RK((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytget_firewalld_accept_command�s





cCs2tj
|�
}|jtj|tj|
��

|S(
N(R:RQRIRXRZ(R<RR;RK((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytget_firewalld_drop_command�s


cCs(|d
kr$tdj
|
�
�
�
ndS(NR>s{0} should not be empty(RR(tvalR%((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__raise_if_empty�s
c
Csmytj
|�

WnUtk
rh
}

d
jdj|�
|
jt|
j�
t|
j�
�}t	|�
�
n
XdS(Ns>Command {0} failed with exit-code: {1}
Stdout: {2}
Stderr: {3}t
 (
R
trun_commandRRRt
returncodeRtstdouttstderrR(RKterrortmsg((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt
__execute_cmd�s






cCs�tj
|
d
�
tj
|d�
tjtj|
d|�
}tj|�

tj|tj|
|�}tj|�

tj|tj|
�}tj|�

dS(NsDestination IPsUser IDR;(R:t!_AddFirewallRules__raise_if_emptyRTRZt_AddFirewallRules__execute_cmdRWRY(R;tdst_ipRJtaccept_tcp_ruletaccept_rulet	drop_rule((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytadd_iptables_rules�s





cCs�tj
|
d
�
tj
|d�
tjtj|
d|�
}tj|�

tj||
|�}tj|�

tj||
�}tj|�

dS(NsDestination IPsUser IDRS(R:RgRTtINSERT_COMMANDRhR[R\(R<RiRJRjt
accept_cmdtdrop_cmd((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt__execute_firewalld_commands�s





cCstj
tj||
�
dS(
N(R:t-_AddFirewallRules__execute_firewalld_commandsR7R8(RiRJ((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytadd_firewalld_rules
scCstj
tj||
�
dS(
N(R:RrR7R9(RiRJ((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pytcheck_firewalld_rule_applied

s(R R!R"RZRntDELETE_COMMANDt
CHECK_COMMANDR#R=RRRQRHRURXRTRWRYR[R\RgRhRmRrRsRt(((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyR:ts4	




N((tazurelinuxagent.common.futureRtazurelinuxagent.common.utilsR
t&azurelinuxagent.common.utils.shellutilRtobjectRR$R7R:(((sL/usr/lib/python2.7/site-packages/azurelinuxagent/common/utils/networkutil.pyt<module>s

.