3
\me @ s d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
d dl m Z d dl m
Z
d dlmZmZ d dlmZmZmZmZmZmZ d dlmZ d dlmZ d d lm Z m Z m Z m Z m Z m!Z! d d
l"m#Z# d d l$m%Z% erd d l&m'Z' ej(e)Z*d
Z+dZ,dZ-dZ.dZ/dZ0dZ1e#j2ddddZ3edZ4ede4f ede4f ddd Z5e5d d Z6e5d d Z7dd!e8e#j9d"d#d$Z:d%d& Z;e5e%d' fd(d)Zd.d/ Z?e5dd0d1d2e8e@eeA eBeBe jCd3d4d5ZDe8e8e8eAd6d7d8ZEG d9d: d:ZFG d;d< d d>ZIG d?d@ d@ZJG dAdB dBZKG dCdD dDZLe5dTe8eee8 ee8 dEdFdGZMe5e8dHdIdJdKZNdLdM ZOG dNdO dOeGZPG dPdQ dQeGZQG dRdS dSZRdS )U N)contextmanager)datetime)ENOENT)sleeptime)
TYPE_CHECKINGCallableListOptionalTypeVarUnion) ElementTree)escape)distrossubp
temp_utils
url_helperutilversion)events) CFG_BUILTIN)errorsz
168.63.129.16zboot-telemetryz system-infoZ
diagnosticZ
compressedi z'/run/cloud-init/log_pushed_to_kvp_indexzazure-dsz initialize reporter for azure dsT)name descriptionZreporting_enabledT.)funcreturnc s fdd}|S )Nc
s* t j j jtd | |S Q R X d S )N)r r parent)r ReportEventStack__name__azure_ds_reporter)argskwargs)r /usr/lib/python3.6/azure.pyimpl5 s
z)azure_ds_telemetry_reporter..implr# )r r% r# )r r$ azure_ds_telemetry_reporter4 s r& c 2 C s8 t j stdtjd ytt ttj } W n, t k
r` } ztd|W Y dd}~X nX yXt
j
ddddgd d
\}}d}|rd |kr|j d d }|std
| t|d }W nb t
j k
r } ztd| |W Y dd}~X n2 t k
r } ztd| |W Y dd}~X nX y`t
j
dddddgd d
\}}d}|r^d |kr^|j d d }|sltd| t|d }W nd t
j k
r } ztd| |W Y dd}~X n2 t k
r } ztd| |W Y dd}~X nX t
jtddtj| j d tj|j d tj|j d f t
j}t
j| |S )z[Report timestamps related to kernel initialization and systemd
activation of cloud-initz1distro not using systemd, skipping boot telemetryzCollecting boot telemetryz*Failed to determine kernel start timestampNZ systemctlZshowz-pZUserspaceTimestampMonotonicT)capture= z8Failed to parse UserspaceTimestampMonotonic from systemdi@B z-Failed to get UserspaceTimestampMonotonic: %szL zutf-8) replacelenr0 structpackrh encodesocketZ inet_ntoa)Zfallback_lease_valueZunescaped_valueZ
hex_stringZhex_pairZ packed_bytesr# r# r$ get_ip_from_lease_value! s
r| )rI retry_sleeptimeout_minutes)urlheadersrI r r r c C s |d t }d}d}x|s|d7 }ytj| ||d d}P W n` tjk
r } zBtd| |||j|jf tjd t | |ksd t |kr W Y dd}~X nX t
| qW td
| |f tjd |S ) zReadurl wrapper for querying wireserver.
:param retry_sleep: Time to sleep before retrying.
:param timeout_minutes: Retry up to specified number of minutes.
:raises UrlError: on error fetching data.
< r Nr) r} )r rI timeoutzdFailed HTTP request with Azure endpoint %s during attempt %d with exception: %s (code=%r headers=%r))r@ zNetwork is unreachablez@Successful HTTP request with Azure endpoint %s after %d attempts)r} r ) r r ZreadurlZUrlErrorrF coder r, r- r` r ) r r rI r r r Zattemptresponser5 r# r# r$ http_with_retries/ s.
r )usernamehostname
disableSshPwdr c C s$ t jd}|j| ||d}|jdS )Na.
1.0
LinuxProvisioningConfiguration
{username}
{disableSshPwd}
{hostname}
1.0
true
)r r r zutf-8)textwrapdedentr\ rz )r r r ZOVF_ENV_TEMPLATEretr# r# r$ build_minimal_ovff s
r c @ sH e Zd ZdddZdd Zdejddd Zdee ejd d d
Z
d
S )AzureEndpointHttpClientZ WALinuxAgentz
2012-11-30)zx-ms-agent-namez x-ms-versionc C s d|d| _ d S )NZ DES_EDE3_CBC)zx-ms-cipher-namez!x-ms-guest-agent-public-x509-cert)extra_secure_headers)self certificater# r# r$ __init__ s z AzureEndpointHttpClient.__init__F)r c C s, | j }|r | j j }|j| j t||dS )N)r )r copyupdater r )r r securer r# r# r$ get s
zAzureEndpointHttpClient.getN)rI r c C s0 | j }|d k r"| j j }|j| t|||dS )N)rI r )r r r r )r r rI
extra_headersr r# r# r$ post s
z AzureEndpointHttpClient.post)F)NN) r
__module__ __qualname__r r r UrlResponser r
bytesr r# r# r# r$ r s r c @ s e Zd ZdZdS ) InvalidGoalStateXMLExceptionz9Raised when GoalState XML is invalid or has missing data.N)r r r __doc__r# r# r# r$ r s r c @ s2 e Zd Zdeeef eeddddZdd Z dS ) GoalStateTN) unparsed_xmlazure_endpoint_clientneed_certificater c C s || _ ytj|| _W n8 tjk
rN } ztd| tjd W Y dd}~X nX | jd| _ | jd| _
| jd| _ x8dD ]0}t | |dkrzd
| }t|tjd t
|qzW d| _| jd }|dk o|rtjd d
td. | j j|ddj| _| jdkrt
dW dQ R X dS )ah Parses a GoalState XML string and returns a GoalState object.
@param unparsed_xml: string representing a GoalState XML.
@param azure_endpoint_client: instance of AzureEndpointHttpClient.
@param need_certificate: switch to know if certificates is needed.
@return: GoalState object representing the GoalState XML string.
z!Failed to parse GoalState XML: %s)r@ Nz./Container/ContainerIdz4./Container/RoleInstanceList/RoleInstance/InstanceIdz
./Incarnation container_id instance_id incarnationzMissing %s in GoalState XMLzD./Container/RoleInstanceList/RoleInstance/Configuration/Certificateszget-certificates-xmlzget certificates xml)r r r T)r z/Azure endpoint returned empty certificates xml.)r r r )r r
fromstringroot
ParseErrorrF r, rc _text_from_xpathr r r getattrr certificates_xmlr r r r contents)r r r r r5 attrrA r r# r# r$ r s<
zGoalState.__init__c C s | j j|}|d k r|jS d S )N)r findtext)r Zxpathelementr# r# r$ r s zGoalState._text_from_xpath)T)
r r r r r` r r boolr r r# r# r# r$ r s 2r c @ s e Zd ZdddZdd Zdd Zedd Zejd
d Ze d d Z
e e d
d Z e dd Z
e dd Ze dd Ze dd ZdS )OpenSSLManagerzTransportPrivate.pemzTransportCert.pem) private_keyr c C s t j | _d | _| j d S )N)r Zmkdtemptmpdir _certificategenerate_certificate)r r# r# r$ r s
zOpenSSLManager.__init__c C s t j| j d S )N)r Zdel_dirr )r r# r# r$ clean_up s zOpenSSLManager.clean_upc C s | j S )N)r )r r# r# r$ r s zOpenSSLManager.certificatec C s
|| _ d S )N)r )r valuer# r# r$ r s c C s t jd | jd k r"t jd d S t| jn tjddddddd d
d d d
| jd d| jd g d}x*t| jd D ]}d|krt||j 7 }qtW || _W d Q R X t jd d S )Nz7Generating certificate for communication with fabric...z Certificate already generated.opensslZreqz-x509z-nodesz-subjz/CN=LinuxTransportz-daysZ32768z-newkeyzrsa:2048z-keyoutr z-outr rq Z CERTIFICATEzNew certificate generated.) r, r- r ro r r certificate_namesrU rstrip)r r liner# r# r$ r s4
z#OpenSSLManager.generate_certificatec C s" ddd| g}t j ||d\}}|S )Nr Zx509z-noout)rI )r )actionZcertcmdresultr7 r# r# r$ _run_x509_action s z OpenSSLManager._run_x509_actionc C s2 | j d|}ddddddg}tj||d\}}|S ) Nz-pubkeyz
ssh-keygenz-iz-mZPKCS8z-fz
/dev/stdin)rI )r r )r r Zpub_keyZ
keygen_cmdssh_keyr7 r# r# r$ _get_ssh_key_from_cert' s z%OpenSSLManager._get_ssh_key_from_certc C s6 | j d|}|jd}||d d jd}dj|S )a openssl x509 formats fingerprints as so:
'SHA1 Fingerprint=07:3E:19:D1:4D:1C:79:92:24:C6:A0:FD:8D:DA: B6:A8:BF:27:D4:73
'
Azure control plane passes that fingerprint as so:
'073E19D14D1C799224C6A0FD8DDAB6A8BF27D473'
z -fingerprintr( r) rs rq )r r r0 join)r r Zraw_fpeqZoctetsr# r# r$ _get_fingerprint_from_cert. s
z)OpenSSLManager._get_fingerprint_from_certc C sj t j|jd}|j}ddddd|jdg}t| j* tjdjf | j d d
j
|d \}}W d Q R X |S )
zDecrypt the certificates XML document using the our private key;
return the list of certs and private keys contained in the doc.
z.//Datas MIME-Version: 1.0s< Content-Disposition: attachment; filename="Certificates.p7m"s? Content-Type: application/x-pkcs7-mime; name="Certificates.p7m"s! Content-Transfer-Encoding: base64 zutf-8zuopenssl cms -decrypt -in /dev/stdin -inkey {private_key} -recip {certificate} | openssl pkcs12 -nodes -password pass:T
)shellrI N) r
r r r rz ro r r r\ r r )r r tagZcertificates_contentlinesr6 r7 r# r# r$ _decrypt_certs_from_xml< s z&OpenSSLManager._decrypt_certs_from_xmlc C sz | j |}g }i }xb|j D ]V}|j| tjd|r
{incarnation}
{container_id}
{instance_id}
{health_status}
{health_detail_subsection}
z
{health_substatus}
{health_description}
ZReadyZNotReadyZProvisioningFailedi N)
goal_stater endpointr c C s || _ || _|| _dS )a? Creates instance that will report provisioning status to an endpoint
@param goal_state: An instance of class GoalState that contains
goal state info such as incarnation, container id, and instance id.
These 3 values are needed when reporting the provisioning status
to Azure
@param azure_endpoint_client: Instance of class AzureEndpointHttpClient
@param endpoint: Endpoint (string) where the provisioning status report
will be sent to
@return: Instance of class GoalStateHealthReporter
N) _goal_state_azure_endpoint_client _endpoint)r r r r r# r# r$ r s z GoalStateHealthReporter.__init__)r c C s | j | jj| jj| jj| jd}tjd y| j|d W n6 t k
rp } zt
d| tj d W Y d d }~X nX tj d d S )N)r r r statusz Reporting ready to Azure fabric.)documentz#exception while reporting ready: %s)r@ z Reported ready to Azure fabric.)
build_reportr r r r PROVISIONING_SUCCESS_STATUSr, r- _post_health_reportra rF errorr> )r r r5 r# r# r$ send_ready_signal s
z)GoalStateHealthReporter.send_ready_signal)r r c C s | j | jj| jj| jj| j| j|d}y| j|d W n: tk
rp } z d| }t |t
j d W Y d d }~X nX t
j d d S )N)r r r r substatusr )r z%exception while reporting failure: %s)r@ z!Reported failure to Azure fabric.)
r r r r r PROVISIONING_NOT_READY_STATUS PROVISIONING_FAILURE_SUBSTATUSr ra rF r, r rc )r r r r5 rA r# r# r$ send_failure_signal s z+GoalStateHealthReporter.send_failure_signal)r r r r r c C sb d}|d k r.| j jt|t|d | j d}| jjtt|t|t|t||d}|jdS )Nrq )Zhealth_substatusZhealth_description)r r r Z
health_statusZhealth_detail_subsectionzutf-8)%HEALTH_DETAIL_SUBSECTION_XML_TEMPLATEr\ r "HEALTH_REPORT_DESCRIPTION_TRIM_LENHEALTH_REPORT_XML_TEMPLATEr` rz ) r r r r r r r Z
health_detailZ
health_reportr# r# r$ r s
z$GoalStateHealthReporter.build_report)r r c C sH t td tjd dj| j}| jj||ddid tjd d S )Nr z&Sending health report to Azure fabric.z http://{}/machine?comp=healthz Content-Typeztext/xml; charset=utf-8)rI r z/Successfully sent health report to Azure fabric)rf r r, r- r\ r r r )r r r r# r# r$ r s
z+GoalStateHealthReporter._post_health_report)NN)r r r r r r r r r r r r r r` r r& r r r r r r# r# r# r$ r j s*
r c @ s e Zd ZedddZdd Zedddd Zed ee e dd
d Z
eedd d
dZ ee e
dddZeedddZeeeef e e
dddZee
eedddZeeeeddd ZdS ) WALinuxAgentShim)r c C s || _ d | _d | _d S )N)r openssl_managerr )r r r# r# r$ r s zWALinuxAgentShim.__init__c C s | j d k r| j j d S )N)r r )r r# r# r$ r s
zWALinuxAgentShim.clean_upN)r c C sV y t jd tjd|g W n4 tk
rP } ztd| t jd W Y d d }~X nX d S )Nz Ejecting the provisioning isoZejectz(Failed ejecting the provisioning iso: %s)r@ )r, r- r ra rF r )r iso_devr5 r# r# r$ eject_iso s
zWALinuxAgentShim.eject_isoc C s d}| j dkr&|dk r&t | _ | j j}| jdkr:t|| _| j|dk d}d}|dk rb| j||}t|| j| j}|dk r| j | |j
|S )a Gets the VM's GoalState from Azure, uses the GoalState information
to report ready/send the ready signal/provisioning complete signal to
Azure, and then uses pubkey_info to filter and obtain the user's
pubkeys from the GoalState.
@param pubkey_info: List of pubkey values and fingerprints which are
used to filter and obtain the user's pubkey values from the
GoalState.
@return: The list of user's authorized pubkey values.
N)r ) r r r r r _fetch_goal_state_from_azure_get_user_pubkeysr r r r )r pubkey_infor Zhttp_client_certificater ssh_keyshealth_reporterr# r# r$ "register_with_azure_and_fetch_data s$
z3WALinuxAgentShim.register_with_azure_and_fetch_data)r r c C s@ | j dkrtd| _ | jdd}t|| j | j}|j|d dS )zGets the VM's GoalState from Azure, uses the GoalState information
to report failure/send provisioning failure signal to Azure.
@param: user visible error description of provisioning failure.
NF)r )r )r r r r r r )r r r r r# r# r$ ®ister_with_azure_and_report_failureF s
z7WALinuxAgentShim.register_with_azure_and_report_failure)r r c C s | j }| j||S )a Fetches the GoalState XML from the Azure endpoint, parses the XML,
and returns a GoalState object.
@param need_certificate: switch to know if certificates is needed.
@return: GoalState object representing the GoalState XML
)"_get_raw_goal_state_xml_from_azure_parse_raw_goal_state_xml)r r unparsed_goal_state_xmlr# r# r$ r U s
z-WALinuxAgentShim._fetch_goal_state_from_azurec C s t jd dj| j}y,tjddtd | jj|}W dQ R X W n6 t k
rx } zt
d| t j d W Y dd}~X nX t j d |j
S )
zFetches the GoalState XML from the Azure endpoint and returns
the XML as a string.
@return: GoalState XML string
zRegistering with Azure...z!http://{}/machine/?comp=goalstatezgoalstate-retrievalzretrieve goalstate)r r r Nz9failed to register with Azure and fetch GoalState XML: %s)r@ z#Successfully fetched GoalState XML.)r, r> r\ r r r r r r ra rF rc r- r )r r r r5 r# r# r$ r d s
z3WALinuxAgentShim._get_raw_goal_state_xml_from_azure)r r r c C s~ yt || j|}W n6 tk
rH } ztd| tjd W Y dd}~X nX djd|j d|j d|j g}t|tj
d |S )a Parses a GoalState XML string and returns a GoalState object.
@param unparsed_goal_state_xml: GoalState XML string
@param need_certificate: switch to know if certificates is needed.
@return: GoalState object representing the GoalState XML
z"Error processing GoalState XML: %s)r@ Nz, z GoalState XML container id: %sz GoalState XML instance id: %sz GoalState XML incarnation: %s) r r ra rF r, rc r r r r r- )r r r r r5 rA r# r# r$ r s
z*WALinuxAgentShim._parse_raw_goal_state_xml)r r r c C sH g }|j dk rD|dk rD| jdk rDtjd | jj|j }| j||}|S )a Gets and filters the VM admin user's authorized pubkeys.
The admin user in this case is the username specified as "admin"
when deploying VMs on Azure.
See https://docs.microsoft.com/en-us/cli/azure/vm#az-vm-create.
cloud-init expects a straightforward array of keys to be dropped
into the admin user's authorized_keys file. Azure control plane exposes
multiple public keys to the VM via wireserver. Select just the
admin user's key(s) and return them, ignoring any other certs.
@param goal_state: GoalState object. The GoalState object contains
a certificate XML, which contains both the VM user's authorized
pubkeys and other non-user pubkeys, which are used for
MSI and protected extension handling.
@param pubkey_info: List of VM user pubkey dicts that were previously
obtained from provisioning data.
Each pubkey dict in this list can either have the format
pubkey['value'] or pubkey['fingerprint'].
Each pubkey['fingerprint'] in the list is used to filter
and obtain the actual pubkey value from the GoalState
certificates XML.
Each pubkey['value'] requires no further processing and is
immediately added to the return list.
@return: A list of the VM user's authorized pubkey values.
Nz/Certificate XML found; parsing out public keys.)r r r, r- r _filter_pubkeys)r r r r keys_by_fingerprintr# r# r$ r s
z"WALinuxAgentShim._get_user_pubkeys)r r r c C s g }xv|D ]n}d|kr.|d r.|j |d q
d|krl|d rl|d }|| kr^|j | | qxtjd| q
tjd| q
W |S )a8 Filter and return only the user's actual pubkeys.
@param keys_by_fingerprint: pubkey fingerprint -> pubkey value dict
that was obtained from GoalState Certificates XML. May contain
non-user pubkeys.
@param pubkey_info: List of VM user pubkeys. Pubkey values are added
to the return list without further processing. Pubkey fingerprints
are used to filter and obtain the actual pubkey values from
keys_by_fingerprint.
@return: A list of the VM user's authorized pubkey values.
r r zIovf-env.xml specified PublicKey fingerprint %s not found in goalstate XMLzFovf-env.xml specified PublicKey with neither value nor fingerprint: %s)r r, rc )r r r Zpubkeyr r# r# r$ r s
z WALinuxAgentShim._filter_pubkeys)NN)r r r r` r r r& r r
r r r r r r r r r r listr r dictr r# r# r# r$ r s.
#
'r )r r r c
C s( t | d}z|j||dS |j X d S )N)r )r r )r r r )r r r shimr# r# r$ get_metadata_from_fabric s
r zerrors.ReportableError)r r c
C s2 t | d}|j }z|j|d W d |j X d S )N)r )r )r Zas_encoded_reportr r )r r r r r# r# r$ report_failure_to_fabric s
r c C s( t d| tjd t d| tjd d S )Nzdhclient output stream: %s)r@ zdhclient error stream: %s)rF r, r- )r6 errr# r# r$ dhcp_log_cb s r c @ s e Zd ZdS )BrokenAzureDataSourceN)r r r r# r# r# r$ r s r c @ s e Zd ZdS )NonAzureDataSourceN)r r r r# r# r# r$ r s r c @ s e Zd ZdddZdddddddddee ee ee ee ee eee eee dd dd Z
ed
d d Z e ed d
ddZ
d eeedddZd eeeedddZdd Zdd Zdd ZdS ) OvfEnvXmlz)http://schemas.dmtf.org/ovf/environment/1z)http://schemas.microsoft.com/windowsazure)ZovfwaNF)r passwordr custom_datadisable_ssh_password_auth public_keyspreprovisioned_vmpreprovisioned_vm_type) r r r r r
r r r
r c C s8 || _ || _|| _|| _|| _|p$g | _|| _|| _d S )N)r r r r r
r r r
) r r r r r r
r r r
r# r# r$ r s
zOvfEnvXml.__init__)r c C s | j |j kS )N)__dict__)r otherr# r# r$ __eq__5 s zOvfEnvXml.__eq__) ovf_env_xmlr c C sz yt j|}W n6 t jk
rD } zd| }t||W Y dd}~X nX |jd| js\tdt }|j| |j | |S )zParser for ovf-env.xml data.
:raises NonAzureDataSource: if XML is not in Azure's format.
:raises BrokenAzureDataSource: if XML is unparseable or invalid.
zInvalid ovf-env.xml: %sNz./wa:ProvisioningSectionz=Ignoring non-Azure ovf-env.xml: ProvisioningSection not found)
r
r r r r
NAMESPACESr r &_parse_linux_configuration_set_section _parse_platform_settings_section)clsr r r5 Z error_strinstancer# r# r$
parse_text8 s
zOvfEnvXml.parse_textr )r required namespacec C sl |j d||f tj}t|dkrDd| }tj| |r@t|d S t|dkrdtd|t|f |d S )Nz./%s:%sr z#No ovf-env.xml configuration for %rr) z:Multiple configuration matches in ovf-exml.xml for %r (%d))findallr r rw r, r- r )r noder r r matchesrA r# r# r$ _findQ s
zOvfEnvXml._find)r r
decode_base64
parse_boolc
C s |j d| tj}t|dkr@d| }tj| |rd S x`|jdtjD ]N}| j|ddd}| j|ddd}| j|dd dd
}|||d }| j j| qNW d S ) NZSSHF)r Z
PublicKeysz./wa:PublicKeyZ FingerprintZPathZValuerq )r r )r rm r )r r r r r r! r ) r r# Z ssh_sectionZpublic_keys_sectionZ
public_keyr rm r r r# r# r$ r" s& z OvfEnvXml._parse_ssh_section)r )FFN)r r r r r
r` r r r r r r classmethodr r r! r r r" r# r# r# r$ r s* 6
"r )NN)SrK rP ZloggingrW r r{ rx r rL
contextlibr r rj r r r Ztypingr r r r
r r Z xml.etreer
Zxml.sax.saxutilsr Z cloudinitr r r r r r Zcloudinit.reportingr Zcloudinit.settingsr Zcloudinit.sources.azurer Z getLoggerr r, ZDEFAULT_WIRESERVER_ENDPOINTr2 r= rE rO r[ r_ r r r r& r9 r? r` r1 rF rR rf rT ro r| r r rh r r r r ra r r r r r r r r r r r r# r# r# r$ s
T (
0 ? " f "