OS : Linux
PHP Version : 7.4.33
Software : Apache/2.4.6 (CentOS) PHP/7.4.33
Information System : # This file is part of cloud-init. See LICENSE file for license information.
import json
import logging
import os
import re
import socket
import struct
import time
import textwrap
from cloudinit.net import dhcp
from cloudinit import stages
from cloudinit import temp_utils
from contextlib import contextmanager
from xml.etree import ElementTree
from cloudinit import url_helper
from cloudinit import util
from cloudinit import version
from cloudinit import distros
from cloudinit.reporting import events
from cloudinit.net.dhcp import EphemeralDHCPv4
from datetime import datetime
LOG = logging.getLogger(__name__)
# This endpoint matches the format as found in dhcp lease files, since this
# value is applied if the endpoint can't be found within a lease file
DEFAULT_WIRESERVER_ENDPOINT = "a8:3f:81:10"
BOOT_EVENT_TYPE = 'boot-telemetry'
SYSTEMINFO_EVENT_TYPE = 'system-info'
DIAGNOSTIC_EVENT_TYPE = 'diagnostic'
azure_ds_reporter = events.ReportEventStack(
name="azure-ds",
description="initialize reporter for azure ds",
reporting_enabled=True)
def azure_ds_telemetry_reporter(func):
def impl(*args, **kwargs):
with events.ReportEventStack(
name=func.__name__,
description=func.__name__,
parent=azure_ds_reporter):
return func(*args, **kwargs)
return impl
def is_byte_swapped(previous_id, current_id):
"""
Azure stores the instance ID with an incorrect byte ordering for the
first parts. This corrects the byte order such that it is consistent with
that returned by the metadata service.
"""
if previous_id == current_id:
return False
def swap_bytestring(s, width=2):
dd = [byte for byte in textwrap.wrap(s, 2)]
dd.reverse()
return ''.join(dd)
parts = current_id.split('-')
swapped_id = '-'.join([
swap_bytestring(parts[0]),
swap_bytestring(parts[1]),
swap_bytestring(parts[2]),
parts[3],
parts[4]
])
return previous_id == swapped_id
@azure_ds_telemetry_reporter
def get_boot_telemetry():
"""Report timestamps related to kernel initialization and systemd
activation of cloud-init"""
if not distros.uses_systemd():
raise RuntimeError(
"distro not using systemd, skipping boot telemetry")
LOG.debug("Collecting boot telemetry")
try:
kernel_start = float(time.time()) - float(util.uptime())
except ValueError:
raise RuntimeError("Failed to determine kernel start timestamp")
try:
out, _ = util.subp(['/bin/systemctl',
'show', '-p',
'UserspaceTimestampMonotonic'],
capture=True)
tsm = None
if out and '=' in out:
tsm = out.split("=")[1]
if not tsm:
raise RuntimeError("Failed to parse "
"UserspaceTimestampMonotonic from systemd")
user_start = kernel_start + (float(tsm) / 1000000)
except util.ProcessExecutionError as e:
raise RuntimeError("Failed to get UserspaceTimestampMonotonic: %s"
% e)
except ValueError as e:
raise RuntimeError("Failed to parse "
"UserspaceTimestampMonotonic from systemd: %s"
% e)
try:
out, _ = util.subp(['/bin/systemctl', 'show',
'cloud-init-local', '-p',
'InactiveExitTimestampMonotonic'],
capture=True)
tsm = None
if out and '=' in out:
tsm = out.split("=")[1]
if not tsm:
raise RuntimeError("Failed to parse "
"InactiveExitTimestampMonotonic from systemd")
cloudinit_activation = kernel_start + (float(tsm) / 1000000)
except util.ProcessExecutionError as e:
raise RuntimeError("Failed to get InactiveExitTimestampMonotonic: %s"
% e)
except ValueError as e:
raise RuntimeError("Failed to parse "
"InactiveExitTimestampMonotonic from systemd: %s"
% e)
evt = events.ReportingEvent(
BOOT_EVENT_TYPE, 'boot-telemetry',
"kernel_start=%s user_start=%s cloudinit_activation=%s" %
(datetime.utcfromtimestamp(kernel_start).isoformat() + 'Z',
datetime.utcfromtimestamp(user_start).isoformat() + 'Z',
datetime.utcfromtimestamp(cloudinit_activation).isoformat() + 'Z'),
events.DEFAULT_EVENT_ORIGIN)
events.report_event(evt)
# return the event for unit testing purpose
return evt
@azure_ds_telemetry_reporter
def get_system_info():
"""Collect and report system information"""
info = util.system_info()
evt = events.ReportingEvent(
SYSTEMINFO_EVENT_TYPE, 'system information',
"cloudinit_version=%s, kernel_version=%s, variant=%s, "
"distro_name=%s, distro_version=%s, flavor=%s, "
"python_version=%s" %
(version.version_string(), info['release'], info['variant'],
info['dist'][0], info['dist'][1], info['dist'][2],
info['python']), events.DEFAULT_EVENT_ORIGIN)
events.report_event(evt)
# return the event for unit testing purpose
return evt
def report_diagnostic_event(str):
"""Report a diagnostic event"""
evt = events.ReportingEvent(
DIAGNOSTIC_EVENT_TYPE, 'diagnostic message',
str, events.DEFAULT_EVENT_ORIGIN)
events.report_event(evt)
# return the event for unit testing purpose
return evt
@contextmanager
def cd(newdir):
prevdir = os.getcwd()
os.chdir(os.path.expanduser(newdir))
try:
yield
finally:
os.chdir(prevdir)
def _get_dhcp_endpoint_option_name():
if util.is_FreeBSD():
azure_endpoint = "option-245"
else:
azure_endpoint = "unknown-245"
return azure_endpoint
class AzureEndpointHttpClient(object):
headers = {
'x-ms-agent-name': 'WALinuxAgent',
'x-ms-version': '2012-11-30',
}
def __init__(self, certificate):
self.extra_secure_headers = {
"x-ms-cipher-name": "DES_EDE3_CBC",
"x-ms-guest-agent-public-x509-cert": certificate,
}
def get(self, url, secure=False):
headers = self.headers
if secure:
headers = self.headers.copy()
headers.update(self.extra_secure_headers)
return url_helper.read_file_or_url(url, headers=headers, timeout=5,
retries=10)
def post(self, url, data=None, extra_headers=None):
headers = self.headers
if extra_headers is not None:
headers = self.headers.copy()
headers.update(extra_headers)
return url_helper.read_file_or_url(url, data=data, headers=headers,
timeout=5, retries=10)
class GoalState(object):
def __init__(self, xml, http_client):
self.http_client = http_client
self.root = ElementTree.fromstring(xml)
self._certificates_xml = None
def _text_from_xpath(self, xpath):
element = self.root.find(xpath)
if element is not None:
return element.text
return None
@property
def container_id(self):
return self._text_from_xpath('./Container/ContainerId')
@property
def incarnation(self):
return self._text_from_xpath('./Incarnation')
@property
def instance_id(self):
return self._text_from_xpath(
'./Container/RoleInstanceList/RoleInstance/InstanceId')
@property
def certificates_xml(self):
if self._certificates_xml is None:
url = self._text_from_xpath(
'./Container/RoleInstanceList/RoleInstance'
'/Configuration/Certificates')
if url is not None:
self._certificates_xml = self.http_client.get(
url, secure=True).contents
return self._certificates_xml
class OpenSSLManager(object):
certificate_names = {
'private_key': 'TransportPrivate.pem',
'certificate': 'TransportCert.pem',
}
def __init__(self):
self.tmpdir = temp_utils.mkdtemp()
self.certificate = None
self.generate_certificate()
def clean_up(self):
util.del_dir(self.tmpdir)
@azure_ds_telemetry_reporter
def generate_certificate(self):
LOG.debug('Generating certificate for communication with fabric...')
if self.certificate is not None:
LOG.debug('Certificate already generated.')
return
with cd(self.tmpdir):
util.subp([
'openssl', 'req', '-x509', '-nodes', '-subj',
'/CN=LinuxTransport', '-days', '32768', '-newkey', 'rsa:2048',
'-keyout', self.certificate_names['private_key'],
'-out', self.certificate_names['certificate'],
])
certificate = ''
for line in open(self.certificate_names['certificate']):
if "CERTIFICATE" not in line:
certificate += line.rstrip()
self.certificate = certificate
LOG.debug('New certificate generated.')
@staticmethod
@azure_ds_telemetry_reporter
def _run_x509_action(action, cert):
cmd = ['openssl', 'x509', '-noout', action]
result, _ = util.subp(cmd, data=cert)
return result
@azure_ds_telemetry_reporter
def _get_ssh_key_from_cert(self, certificate):
pub_key = self._run_x509_action('-pubkey', certificate)
keygen_cmd = ['ssh-keygen', '-i', '-m', 'PKCS8', '-f', '/dev/stdin']
ssh_key, _ = util.subp(keygen_cmd, data=pub_key)
return ssh_key
@azure_ds_telemetry_reporter
def _get_fingerprint_from_cert(self, certificate):
"""openssl x509 formats fingerprints as so:
'SHA1 Fingerprint=07:3E:19:D1:4D:1C:79:92:24:C6:A0:FD:8D:DA:\
B6:A8:BF:27:D4:73\n'
Azure control plane passes that fingerprint as so:
'073E19D14D1C799224C6A0FD8DDAB6A8BF27D473'
"""
raw_fp = self._run_x509_action('-fingerprint', certificate)
eq = raw_fp.find('=')
octets = raw_fp[eq+1:-1].split(':')
return ''.join(octets)
@azure_ds_telemetry_reporter
def _decrypt_certs_from_xml(self, certificates_xml):
"""Decrypt the certificates XML document using the our private key;
return the list of certs and private keys contained in the doc.
"""
tag = ElementTree.fromstring(certificates_xml).find('.//Data')
certificates_content = tag.text
lines = [
b'MIME-Version: 1.0',
b'Content-Disposition: attachment; filename="Certificates.p7m"',
b'Content-Type: application/x-pkcs7-mime; name="Certificates.p7m"',
b'Content-Transfer-Encoding: base64',
b'',
certificates_content.encode('utf-8'),
]
with cd(self.tmpdir):
out, _ = util.subp(
'openssl cms -decrypt -in /dev/stdin -inkey'
' {private_key} -recip {certificate} | openssl pkcs12 -nodes'
' -password pass:'.format(**self.certificate_names),
shell=True, data=b'\n'.join(lines))
return out
@azure_ds_telemetry_reporter
def parse_certificates(self, certificates_xml):
"""Given the Certificates XML document, return a dictionary of
fingerprints and associated SSH keys derived from the certs."""
out = self._decrypt_certs_from_xml(certificates_xml)
current = []
keys = {}
for line in out.splitlines():
current.append(line)
if re.match(r'[-]+END .*?KEY[-]+$', line):
# ignore private_keys
current = []
elif re.match(r'[-]+END .*?CERTIFICATE[-]+$', line):
certificate = '\n'.join(current)
ssh_key = self._get_ssh_key_from_cert(certificate)
fingerprint = self._get_fingerprint_from_cert(certificate)
keys[fingerprint] = ssh_key
current = []
return keys
class WALinuxAgentShim(object):
REPORT_READY_XML_TEMPLATE = '\n'.join([
'',
'