HEX

File: //lib/python3/dist-packages/cloudinit/config/__pycache__/cc_wireguard.cpython-310.pyc
o

�Ad#%�@sVUdZddlZddlmZddlmZddlmZddlmZm	Z	ddl
mZddlm
Z
dd	lmZmZdd
lmZed�Zddd
edgedged�gd�Zeed<ee�Ze�e�Zegd��ZdZdZdZdefdd�Zdefdd�Z dedefdd�Z!de"fd d!�Z#de"fd"d#�Z$defd$d%�Z%d&d'�Z&d(e'd)e
ded*ed+e"d,dfd-d.�Z(dS)/�	Wireguard�N)�Logger)�dedent)�log)�subp�util)�Cloud)�Config)�
MetaSchema�get_meta_doc)�PER_INSTANCEaIWireguard module provides a dynamic interface for configuring
Wireguard (as a peer or server) in an easy way.

This module takes care of:
  - writing interface configuration files
  - enabling and starting interfaces
  - installing wireguard-tools package
  - loading wireguard kernel module
  - executing readiness probes

What's a readiness probe?

The idea behind readiness probes is to ensure Wireguard connectivity
before continuing the cloud-init process. This could be useful if you
need access to specific services like an internal APT Repository Server
(e.g Landscape) to install/update packages.

Example:

An edge device can't access the internet but uses cloud-init modules which
will install packages (e.g landscape, packages, ubuntu_advantage). Those
modules will fail due to missing internet connection. The "wireguard" module
fixes that problem as it waits until all readinessprobes (which can be
arbitrary commands - e.g. checking if a proxy server is reachable over
Wireguard network) are finished before continuing the cloud-init
"config" stage.

.. note::
    In order to use DNS with Wireguard you have to install ``resolvconf``
    package or symlink it to systemd's ``resolvectl``, otherwise ``wg-quick``
    commands will throw an error message that executable ``resolvconf`` is
    missing which leads wireguard module to fail.
�cc_wireguardz$Module to configure Wireguard tunnel�ubuntu�	wireguarda�    # Configure one or more WG interfaces and provide optional readinessprobes
    wireguard:
      interfaces:
        - name: wg0
          config_path: /etc/wireguard/wg0.conf
          content: |
            [Interface]
            PrivateKey = <private_key>
            Address = <address>
            [Peer]
            PublicKey = <public_key>
            Endpoint = <endpoint_ip>:<endpoint_ip_port>
            AllowedIPs = <allowedip1>, <allowedip2>, ...
        - name: wg1
          config_path: /etc/wireguard/wg1.conf
          content: |
            [Interface]
            PrivateKey = <private_key>
            Address = <address>
            [Peer]
            PublicKey = <public_key>
            Endpoint = <endpoint_ip>:<endpoint_ip_port>
            AllowedIPs = <allowedip1>
      readinessprobe:
        - 'systemctl restart service'
        - 'curl https://webhook.endpoint/example'
        - 'nc -zv some-service-fqdn 443'
    )�id�name�title�description�distros�	frequency�activate_by_schema_keys�examples�meta)r�config_path�contenti��
)���wg_intcCs�g}t�t|����}|rd�t|��}|�d|���t|���D] \}}|dks2|dks2|dkrBt|t	�sB|�d|�d|���q"|rQt
dt�t�|�����d	S)
aRValidate user-provided wg:interfaces option values.

    This function supplements flexible jsonschema validation with specific
    value checks to aid in triage of invalid user-provided configuration.

    @param wg_int: Dict of configuration value under 'wg:interfaces'.

    @raises: ValueError describing invalid values provided.
    z, z%Missing required wg:interfaces keys: rrrz$Expected a string for wg:interfaces:�. Found z*Invalid wireguard interface configuration:N)�REQUIRED_WG_INT_KEYS�
difference�set�keys�join�sorted�append�items�
isinstance�str�
ValueError�NL)r�errors�missingr#�key�value�r0�?/usr/lib/python3/dist-packages/cloudinit/config/cc_wireguard.py�supplemental_schema_validationis"

����r2c
Cszt�d|d�zt�d|d�tj|d|dtd�Wd	Sty<}ztd|d�dt�t|����|�d	}~ww)
z�Writing user-provided configuration into Wireguard
    interface configuration file.

    @param wg_int: Dict of configuration value under 'wg:interfaces'.

    @raises: RuntimeError for issues writing of configuration file.
    z"Configuring Wireguard interface %srz#Writing wireguard config to file %srr)�modez-Failure writing Wireguard configuration file �:N)	�LOG�debugr�
write_file�WG_CONFIG_FILE_MODE�	Exception�RuntimeErrorr+r))r�er0r0r1�write_config�s(��������r<�cloudc
Cs�z+t�d|d�|j�dd|d���t�d|d�|j�dd|d���WdStjyD}ztdt�t|����|�d}~ww)	z�Enable and start Wireguard interface

    @param wg_int: Dict of configuration value under 'wg:interfaces'.

    @raises: RuntimeError for issues enabling WG interface.
    zEnabling wg-quick@%s at bootr�enablez	wg-quick@z!Bringing up interface wg-quick@%s�restartz0Failed enabling/starting Wireguard interface(s):N)	r5r6�distro�manage_servicer�ProcessExecutionErrorr:r+r))rr=r;r0r0r1�	enable_wg�s����rC�wg_readinessprobescCsZg}d}|D]}t|t�s|�d|�d|���|d7}q|r+tdt�t�|�����dS)z�Basic validation of user-provided probes

    @param wg_readinessprobes: List of readinessprobe probe(s).

    @raises: ValueError of wrong datatype provided for probes.
    rz(Expected a string for readinessprobe at r�z Invalid readinessProbe commands:N)r(r)r&r*r+r$)rDr,�pos�cr0r0r1�!readinessprobe_command_validation�s
����rHcCs�g}|D]1}zt�dt|��tj|ddd�Wqtjy5}z|�|�d|���WYd}~qd}~ww|rDtdt�t�|�����dS)z�Execute provided readiness probe(s)

    @param wg_readinessprobes: List of readinessprobe probe(s).

    @raises: ProcessExecutionError for issues during execution of probes.
    zRunning readinessprobe: '%s'T��capture�shellz: Nz&Failed running readinessprobe command:)	r5r6r)rrBr&r:r+r$)rDr,rGr;r0r0r1�readinessprobe�s ����rLcCs�dg}t�d�r
dSt��tkr|�d�z|j��Wnty*t�	t
d��wz	|j�|�WdStyBt�	t
d��w)z�Install wireguard packages and tools

    @param cloud: Cloud object

    @raises: Exception for issues during package
    installation.
    zwireguard-tools�wgNrzPackage update failedz!Failed to install wireguard-tools)r�whichr�kernel_version�MIN_KERNEL_VERSIONr&r@�update_package_sourcesr9�logexcr5�install_packages)r=�packagesr0r0r1� maybe_install_wireguard_packages�s"	

��rUc
Cs�z$tjdddd�}t�d|j���s"t�d�tjdddd�WdSWdStjy?}zt�	tdt
�t|�����d}~ww)	zYLoad wireguard kernel module

    @raises: ProcessExecutionError for issues modprobe
    �lsmodTrIrzLoading wireguard kernel modulezmodprobe wireguardz Could not load wireguard module:N)r�re�search�stdout�stripr5r6rBrrRr+r))�outr;r0r0r1�load_wireguard_kernel_module�s
���r\r�cfgr�args�returncCs�d}d|vrt�d�|d}nt�d|�dSt|�t�|dD]}t|�t|�t||�q#d|vrK|ddurK|d}t|�t|�dSt�d�dS)Nrz!Found Wireguard section in configz<Skipping module named %s, no 'wireguard' configuration found�
interfacesrLz+Skipping readinessprobe - no checks defined)	r5r6rUr\r2r<rCrHrL)rr]r=rr^�
wg_sectionrrDr0r0r1�handles.

��
�rb))�__doc__rW�loggingr�textwrapr�	cloudinitrrr�cloudinit.cloudr�cloudinit.configr	�cloudinit.config.schemar
r�cloudinit.settingsr�MODULE_DESCRIPTIONr�__annotations__�	getLogger�__name__r5�	frozensetr r8r+rP�dictr2r<rC�listrHrLrUr\r)rbr0r0r0r1�<module>sf�$���+
������