a -@=j @s ddlZddlZddlZddlZddlZddlmZddlmZm Z ddl m Z m Z m Z ddl mZddl mZmZddlmZddlmZmZdd lmZdd lmZdd lmZdd lmZdd lm Z e!e"Z#dZ$dZ%GdddZ&ddZ'e&j(gZ)dZ*Gddde j+Z,Gddde,Z-ddZ.ddZ/ddZ0dd Z1d!d"Z2d#d$Z3d%d&Z4d'd(Z5d)d*Z6d+d,Z7ej8fee9efee9e9feee9e:fd-d.d/Z;eddd3ej8fd4d5Z?d6d7Z@d8d9ZAe-e jBffe,e jBe jCffgZDd:d;ZEdS)<N)suppress)DictList)dminetsources) url_helper)utilwarnings)Distro) EventScope EventType)netplan)NoDHCPLeaseError)EphemeralIPNetwork)NicOrder)ec2)Z datasourceEc2Z strict_idwarnc@s(eZdZdZdZdZdZdZdZdZ dS) CloudNamesZawsZ brightboxZzstacke24cloudZoutscaleunknownzno-ec2-metadataN) __name__ __module__ __qualname__AWS BRIGHTBOXZSTACKE24CLOUDOUTSCALEUNKNOWNNO_EC2_METADATAr"r"C/usr/lib/python3.9/site-packages/cloudinit/sources/DataSourceEc2.pyr$srcCs|jdkod|jvS)Nzmeta-data/tags/)codeurl) exceptionr"r"r#skip_404_tag_errors3sr(zS ENV{ID_NET_DRIVER}=="vif|ena|ixgbevf", GOTO="cloudinit_hook" GOTO="cloudinit_end" cseZdZUdZgdZdZgdZeee d<dZ dZ dZ e jZd ZejejejejejhiZejejejhiZeZfd d Zedd fd d ZddZddZ ddZ!e"ddZ#e"ddZ$e"ddZ%e"ddZ&e"ddZ'e"dd Z(e"d!d"Z)d#d$Z*d%d&Z+d'd(Z,d)d*Z-d+d,Z.e"d-d.Z/e"d/d0Z0d1d2Z1e"d3d4Z2d5d6Z3dBd7d8Z4d9d:Z5d;d<Z6dCd=d>Z7dDd@dAZ8Z9S)E DataSourceEc2r)zhttp://169.254.169.254zhttp://[fd00:ec2::254]zhttp://instance-data.:8773z 2009-04-04)z 2021-03-23z 2018-09-24z 2016-09-02extended_metadata_versions2NFcs,tt||||d|_d|_tj|_dSN)superr)__init__metadata_addressidentityrMAC_fallback_nic_order)selfsys_cfgdistropaths __class__r"r#r/uszDataSourceEc2.__init__)ci_pkl_versionreturncst|t|_tj|_dSr-)r. _unpickle_EXTRA_HOTPLUG_UDEV_RULESextra_hotplug_udev_rulesrr2r3)r4r:r8r"r#r<{s zDataSourceEc2._unpicklecCstS)z5Return the cloud name as identified during _get_data.)identify_platformr4r"r"r#_get_cloud_nameszDataSourceEc2._get_cloud_namecCsFtt|jttd\}}td||j|j |dkrF|jt j krFdS|jt j krVdS|j rtrrtddSzbt|j|jjddd8}||_td|jrd |jnd Wdn1s0YWqtyYdS0n ||_|jsdS|jd d|_|jd d|_|jd ididi|_dS)N)rNz0strict_mode: %s, cloud_name=%s cloud_platform=%strueFz1FreeBSD doesn't support running dhclient with -sfT)ipv4ipv6zCrawled metadata service%s meta-data user-datadynamicinstance-identitydocument)read_strict_moder get_cfg_by_pathr5STRICT_ID_PATHSTRICT_ID_DEFAULTLOGdebug cloud_nameplatformrr r!perform_dhcp_setupZ is_FreeBSDrr6fallback_interfacecrawl_metadataZ_crawled_metadataZ state_msgrgetmetadataZ userdata_rawr1)r4Z strict_modeZ_sleepZnetwr"r"r# _get_datas^   &   zDataSourceEc2._get_datacCsL|js dS|jdidi}|diD]\}}d|vr0dSq0dS)z6Report if this instance type is Ec2 Classic (non-vpc).Fnetwork interfacesmacszvpc-idT)rXrWitems)r4Z ifaces_mdZ_macZmac_datar"r"r#is_classic_instancesz!DataSourceEc2.is_classic_instancecCs|js dS|jdS)Nzami-launch-index)rXrWr@r"r"r# launch_indexszDataSourceEc2.launch_indexcCs|jstj|_|jSr-)Z_platform_typer)dsnamelowerr@r"r"r#rSs zDataSourceEc2.platformcCsdS)Nzlatest/api/tokenr"r@r"r"r#api_token_routeszDataSourceEc2.api_token_routecCsdS)NZ21600r"r@r"r"r#imdsv2_token_ttl_secondssz&DataSourceEc2.imdsv2_token_ttl_secondscCsdS)NzX-aws-ec2-metadata-tokenr"r@r"r"r#imdsv2_token_put_headersz%DataSourceEc2.imdsv2_token_put_headercCs |jdS)Nz -ttl-seconds)rdr@r"r"r#imdsv2_token_req_headersz%DataSourceEc2.imdsv2_token_req_headercCs |j|jgSr-)rdrer@r"r"r#imdsv2_token_redactsz!DataSourceEc2.imdsv2_token_redactc Csd}|}|jD]}||j|}ztj|||jd}Wn4tjyn}zt d||WYd}~qd}~00|j dkrt d||S|j dkrd}t |||j q|j S) aEGet the best supported api version from the metadata service. Loop through all extended support metadata versions in order and return the most-fully featured metadata api version discovered. If extended_metadata_versions aren't present, return the datasource's min_metadata_version. z{0}/{1}/meta-data/instance-id)r&headersheaders_redactzurl %s raised exception %sNz#Found preferred metadata version %sr$z0Metadata api version %s not present. Headers: %s) _get_headersr*formatr0uhelpreadurlrfUrlErrorrPrQr%rgmin_metadata_version)r4Zurl_tmplrgZapi_verr&Zrespemsgr"r"r#get_metadata_api_versions&   $   z&DataSourceEc2.get_metadata_api_versioncCsh|jtjkrZt|ddsF|}tj||j|j|j |j d di|_ |j d|j dS|j dSdS)Nr1 headers_cbrh exception_cbrKZ instanceIdz instance-id)rRrrgetattrrrrget_instance_identityr0rjrf_refresh_stale_aws_token_cbrWr1rX)r4 api_versionr"r"r#get_instance_ids    zDataSourceEc2.get_instance_idc Cs|jtvrdSg}i}|j}d}|D]"}d||}|||||<q$tdd}d}|} z0tj || j | j tj |j |j||jdd \}}WntjyYn0|r|r||_||SdS)aGet an API token for EC2 Instance Metadata Service. On EC2. IMDS will always answer an API token, unless the instance owner has disabled the IMDS HTTP endpoint or the network topology conflicts with the configured hop-limit. NPUT{0}/{1}zFetching Ec2 IMDSv2 API TokenF) urlsmax_waittimeout status_cbrtrurequest_methodrhZconnect_synchronously)rR IDMSV2_SUPPORTED_CLOUD_PLATFORMSrbrkappendrPrQget_url_paramsrl wait_for_urlmax_wait_secondstimeout_secondswarningrj_imds_exception_cbrfrn _api_token) r4mdurlsr}url2baseurl_pathrr&curresponse url_paramsr"r"r#_maybe_fetch_api_tokens@      z$DataSourceEc2._maybe_fetch_api_tokenc Csvg}d}|j}|}|jdkr$dS|d|j}dd|D}t|t|krltdtt|t|t |rz|}nt d|j}| |}|s |j t vr i}dj|jd } d } |D]"} d | | } || | || <qt}tj||j|jtj |j|j| d \} } | r || }|r<||_td |jn2|j t vrTt dntd|tt|t|S)NrF metadata_urlscSsg|]}t|r|qSr")r Zis_resolvable_url).0xr"r"r# Uz;DataSourceEc2.wait_for_metadata_service..z,Removed the following from metadata urls: %sz+Empty metadata url list! using default listz{ver}/meta-data/instance-id)ZverZGETr|)r}r~rrrhrtrzUsing metadata source: '%s'z)IMDS's HTTP endpoint is probably disabledz(Giving up on md from %s after %s seconds)ds_cfgrrrWrsetrPrQlistlenrrrRrrkrortime monotonicrlrrrfrjr0Zcriticalintbool)r4r}Z start_timeZmcfgrrZfilteredr0rrrr&r_r"r"r#wait_for_metadata_serviceJsl         z'DataSourceEc2.wait_for_metadata_servicecCsd|jvrdSd}|jd}t|ts6td|dS|D],\}}||krV|}ql|dkr>|dkr>|}q>|durtd|dS|}|dsd|}tj |r|S| tj |}|rtd|||S|dkrdS|S) Nzblock-device-mappingz+block-device-mapping not a dictionary: '%s'Z ephemeralZ ephemeral0z Unable to convert %s to a device/z/dev/%szRemapped device name %s => %s) rX isinstancedictrPrQr] startswithospathexistsZ _remap_devicebasename)r4namefoundZbdmZentnameZdeviceZofoundZremappedr"r"r#device_name_to_devices8       z#DataSourceEc2.device_name_to_devicecCsTz:|jtjkr(|jd|jddWS|jddWSWntyNYdS0dS)NZavailabilityZoneZ placementzavailability-zone)rRrrr1rWrXKeyErrorr@r"r"r#availability_zones   zDataSourceEc2.availability_zonecCsR|jtjkr4|jd}|jr0|s0|jdd}|S|j}|durN|ddSdS)Nregion)rRrrr1rWr)r4razr"r"r#rs    zDataSourceEc2.regioncCs,|sdS|jtjkr(tt|tt|dSr-)rRrr warn_if_necessaryr rMrNrO)r4cfgZis_new_instancer"r"r#activates  zDataSourceEc2.activatec Cs|jtjkr|jS|jdur*tddSd}|jj}|jd}t |t rt ||j|t |jdd|jd}|rt|j|_|jtjtj|jtjtjn td|||_|jS)z@Return a network config dict for rendering ENI or netplan files.Nz8Unexpected call to network_config when metadata is None.rZZapply_full_imds_network_configT) fallback_nicfull_network_configfallback_nic_orderz%Metadata 'network' key not valid: %s.)_network_configrUNSETrXrPrr6rUrWrr#convert_ec2_metadata_network_configr Zget_cfg_option_boolrr3r^copydeepcopydefault_update_eventsr NETWORKaddr BOOT BOOT_LEGACY)r4resultZifaceZnet_mdr"r"r#network_configsB        zDataSourceEc2.network_configc Cs|s iS|}|j}i}|jtvr:|j}|j}d}n&|jtjkrTd}}t }n d}}}zxt j ||j |j ||d}t||d<t j||j |j |||d|d<|jtjkrt j||j |j ||d}d|i|d<Wn(tyttd|j iYS0||d <|S) zCrawl metadata service when available. @returns: Dictionary of crawled metadata content containing the keys: meta-data, user-data and dynamic. NrsrH)rtrhruZretrieval_exception_ignore_cbrGrJrIz'Failed reading from metadata address %sZ_metadata_api_version)rrrrfrRrrx#_skip_or_refresh_stale_aws_token_cbrrr(rZget_instance_userdatar0rjr Zmaybe_b64decodeZget_instance_metadatarrw ExceptionZlogexcrP) r4ryZredactZcrawled_metadataZexc_cbZ exc_cb_udZskip_cbZ raw_userdatar1r"r"r#rVs`      zDataSourceEc2.crawl_metadatac Cs|jtvrdS|dur|j}td|j|i}d|j|j}zt j |||j dd}Wn6t j y}zt d||WYd}~dSd}~00|jS)zRequest new metadata API token. @param seconds: The lifetime of the token in seconds @return: The API token or None if unavailable. Nz!Refreshing Ec2 metadata API tokenz{}/{}r{)rgrhrz/Unable to get API token: %s raised exception %s)rRrrcrPrQrerkr0rbrlrmrfrnrcontents)r4ZsecondsZrequest_headerZ token_urlrrpr"r"r#_refresh_api_tokenSs(    z DataSourceEc2._refresh_api_tokencCs$ttj||}|sdS|||S)zSCallback will not retry on SKIP_USERDATA_CODES or if no token is available.F)rZskip_retry_on_codesZSKIP_USERDATA_CODESrx)r4rqr'Zretryr"r"r#rps z1DataSourceEc2._skip_or_refresh_stale_aws_token_cbcCs*t|tjr&|jdkr&tdd|_dS)z=Exception handler for Ec2 to refresh token if token is stale.iz+Clearing cached Ec2 API token due to expiryNT)rrlrnr%rPrQrr4rqr'r"r"r#rxzs z)DataSourceEc2._refresh_stale_aws_token_cbcCsDt|tjr@|jr@|jdkr@|jdkr2tdn td|dS)a2Fail quickly on proper AWS if IMDSv2 rejects API token request Guidance from Amazon is that if IMDSv2 had disabled token requests by returning a 403, or cloud-init malformed requests resulting in other 40X errors, we want the datasource detection to fail quickly without retries as those symptoms will likely not be resolved by retries. Exceptions such as requests.ConnectionError due to IMDS being temporarily unroutable or unavailable will still retry due to the callsite wait_for_url. iizLEc2 IMDS endpoint returned a 403 error. HTTP endpoint is disabled. Aborting.z2Fatal error while requesting Ec2 IMDSv2 API tokensN)rrlrnr%rPrrr"r"r#rs  z DataSourceEc2._imds_exception_cbrFcCsN|jtvriS|j|ji}|j|vr(|S|jsB||_|jsBiS|j|jiS)zReturn a dict of headers for accessing a url. If _api_token is unset on AWS, attempt to refresh the token via a PUT and then return the updated token header. )rRrrercrbrrrd)r4r&Zrequest_token_headerr"r"r#rjs   zDataSourceEc2._get_headers)N)N)rF):rrrr`rror*rstr__annotations__Z url_max_waitZ url_timeoutrrrrrTr rr ZBOOT_NEW_INSTANCErrZHOTPLUGZsupported_update_eventsrr=r>r/rr<rArYr^propertyr_rSrbrcrdrerfrrrzrrrrrrrrVrrrxrrj __classcell__r"r"r8r#r)Bsv   3        2J3    /8   r)cs$eZdZdZdZfddZZS)DataSourceEc2LocalayDatasource run at init-local which sets up network to query metadata. In init-local, no network is available. This subclass sets up minimal networking with dhclient on a viable nic so that it can talk to the metadata service. If the metadata service provides network configuration then render the network configuration for that instance based on metadata. Tcs8tjtjf}|j|vr*td||jdStt|S)Nz+Local Ec2 mode only supported on %s, not %sF) rrrrRrPrQr.rget_data)r4Zsupported_platformsr8r"r#rs  zDataSourceEc2Local.get_data)rrr__doc__rTrrr"r"r8r#rsrc CsBz t|WSty<}zt||WYd}~Sd}~00dSr-)parse_strict_mode ValueErrorrPr)cfgvaldefaultrpr"r"r#rLs   rLc Cs|dur dS|durdS|s dS|d\}}}|dvrHtd||f|rz t|}Wqty}ztd ||f|WYd}~qd}~00nd}||fS) NT)rBNF)falseN)rr,)rBrrzUInvalid mode '%s' in strict_id setting '%s': Expected one of 'true', 'false', 'warn'.z2rz#identify_platform..z'calling %s with %s raised exception: %s) _collect_platform_datarrrrrrrPr)rZchecksZcheckerrrpr"r"r#r?)s"r?cCsd}ttttd}Wdn1s20Y|pLtdpLd}tdpZd}tdphd}tdpvd}tdpd}|||||d S) aFReturns a dictionary of platform info from dmi or /sys/hypervisor. Keys in the dictionary are as follows: uuid: system-uuid from dmi or /sys/hypervisor serial: dmi 'system-serial-number' (/sys/.../product_serial) asset_tag: 'dmidecode -s chassis-asset-tag' vendor: dmi 'system-manufacturer' (/sys/.../sys_vendor) product_name: dmi 'system-product-name' (/sys/.../system-manufacturer) On Ec2 instances experimentation is that product_serial is upper case, and product_uuid is lower case. This returns lower case values for both. Nz/sys/hypervisor/uuidz system-uuidrFzsystem-serial-numberzchassis-asset-tagzsystem-manufacturerzsystem-product-namerrrrr) rOSErrorUnicodeDecodeErrorr Zload_text_filestriprZ read_dmi_datararr"r"r#r?s  ,r) macs_metadata macs_to_nicsrr;csni}tdkstdkr |Stddtfdd}ddddtt|fd dd DS) aI Builds a dictionary containing macs as keys and nic orders as values, taking into account `network-card` and `device-number` if present. Note that the first NIC will be the primary NIC as it will be the one with [network-card] == 0 and device-number == 0 if present. @param macs_metadata: dictionary with mac address as key and contents like: {"device-number": "0", "interface-id": "...", "local-ipv4s": ...} @macs_to_nics: dictionary with mac address as key and nic name as value @return: Dictionary with macs as keys and nic orders as values. rcSs |dduS)Nr"Zmmdr"r"r#rwrz"_build_nic_order..cs|||fSr-)rW)mac)rrr"r#rzrcSs ||d}|durt|S|Sr-)rWr)ZdiktkeyZ alt_valuevaluer"r"r#_get_key_as_int_ors z,_build_nic_order.._get_key_as_int_orcSsi|]\}\}}}||qSr"r")rirZ _mac_metadataZ _nic_namer"r"r# s z$_build_nic_order..cs@|ddtd|ddtdtjkr6|dn|dfS)Nrz network-cardZinfinity device-numberr)floatrZNIC_NAMEr)rrr"r#rs )r)rfiltermapkeys enumeratesorted)rrr nic_orderZvalid_macs_metadatar")rrrrr#_build_nic_order_s&    r) dev_confignic_name nic_metadatar6is_ipv4tabler;c CsJ|r|d}|d}n|d}|d}|r6|sNtd|rDdnddS|d s`g|d <|rz|jj||d }|d } Wn2ty} ztd || WYd} ~ n d} ~ 00|d d | |dt|t r|gn|}|D]} |d | |dq|dsg|d<t|t r"|gn|}|D]} |d| |dq*dS)a Configure policy-based routing on secondary NICs / secondary IPs to ensure outgoing packets are routed via the correct interface. @param: dev_config: network cfg v2 to be updated inplace. @param: nic_name: nic name. Only used if ipv4. @param: nic_metadata: nic metadata from IMDS. @param: distro: Instance of Distro. Only used if ipv4. @param: is_ipv4: Boolean indicating if we are acting over ipv4 or not. @param: table: Routing table id. subnet-ipv4-cidr-block local-ipv4szsubnet-ipv6-cidr-blocksipv6szANot enough IMDS information to configure policy routing for IPv%s46Nroutes)r6ZrouterszoCould not perform dhcp discovery on %s to find its gateway. Not adding default route via the gateway. Error: %sz 0.0.0.0/0)toZviar)r rrouting-policy)fromr) rWrPrQZ dhcp_clientZdhcp_discoveryrrrrr) rrrr6rrZsubnet_prefix_routesipsZleaseZgatewayrpZ prefix_routeipr"r"r#_configure_policy_routings`          rTc Cs2did}|st}|dd}|s|D]\}} | |kr.qDq.ddd|i| d} ||} | d rvd| d <| |d | <|St|jtj} t |||} t | }|D]}||} ||} | sq| |}|d k}d |ddi}d|dd|i| d} d|}| rB| drB|sBd|d<t | || | d|d| d rd| d <|| d<| r| dr|st | || | d|dt | || d<| ds| d| |d | <qt|d dkr.|d  D]T} |d | d|d | dd|d | dd|d | ddq|S)a8Convert ec2 metadata to network config version 2 data dict. @param: network_md: 'network' portion of EC2 metadata. generally formed as {"interfaces": {"macs": {}} where 'macs' is a dictionary with mac address as key and contents like: {"device-number": "0", "interface-id": "...", "local-ipv4s": ...} @param: distro: instance of Distro. @param: macs_to_nics: Optional dict of mac addresses and nic names. If not provided, get_interfaces_by_mac is called to get it from the OS. @param: fallback_nic: Optionally provide the primary nic interface name. This nic will be guaranteed to minimally have a dhcp4 configuration. @param: full_network_config: Boolean set True to configure all networking presented by IMDS. This includes rendering secondary IPv4 and IPv6 addresses on all NICs and rendering network config on secondary NICs. If False, only the primary nic will be configured and only with dhcp (IPv4/IPv6). @return A dict of network config version 2 based on the metadata and macs. r)version ethernetsr[r\TFZ macaddress)dhcp4dhcp6matchset-namerrrrz route-metricrd)rdhcp4-overridesrrrrz use-routes)r6rrrrzdhcp6-overrides addressesrNr r )rZget_interfaces_by_macr]rarWrZnetwork_rendererrZRendererrrrrget_secondary_addressespopr)Z network_mdr6rrrrZnetcfgrrrrrZ is_netplanrr\Znic_idxZis_primary_nicZ dhcp_overriderr"r"r#rs             rcCs|d}|d}g}tt|to.t|dkrH|t|d||dtt|to^t|dkrx|t|d||dt|S)zParse interface-specific nic metadata and return any secondary IPs :return: List of secondary IPv4 or IPv6 addresses to configure on the interface rrrrZ24zsubnet-ipv6-cidr-blockZ128)rWrrrrextend_get_secondary_addressesr)rrZipv4srrr"r"r#rss     rc Csg}||}|}|r(t|ddkrNd|vr4dnd}td|||||n|dd}|ddD]} |dj| |d qh|S) zReturn list of IP addresses as CIDRs for secondary IPs The CIDR prefix will be default_prefix if cidr_key is absent or not parseable in nic_metadata. rrrCrDzJCould not parse %s %s for mac %s. %s network config prefix defaults to /%srNz {ip}/{prefix})rprefix)rWrsplitrPrrrk) rZcidr_keyrrdefault_prefixrZcidrrZip_typerr"r"r#rs"  rcCs t|tSr-)rZlist_from_depends datasources)Zdependsr"r"r#get_datasource_listsr")FrZloggingrrr contextlibrtypingrrZ cloudinitrrrrrlr r Zcloudinit.distrosr Zcloudinit.eventr r Z cloudinit.netrZcloudinit.net.dhcprZcloudinit.net.ephemeralrZcloudinit.sourcesrZcloudinit.sources.helpersrZ getLoggerrrPrNrOrr(rrr=Z DataSourcer)rrLrrrrrrrr?rr2rrrrrrrrrZDEP_FILESYSTEMZ DEP_NETWORKr!r"r"r"r"r# s         w! #   D X |