
                              S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK	J
r
  SrS	rS
rSr " S S\R                  5      rg)z,Troubleshoot VPC setting for ssh connection.    )absolute_import)division)unicode_literals)apis)ssh_troubleshooter)logcomputev1a:  There is an issue with your IAP configuration

Check the following items:
 - The IAP firewall rule is valid.
 - IAP tunneling is enabled.
 - You are connecting using an IAP token.
 - You have the IAM role of Project Owner, IAP-Secured Tunnel User, or iap.tunnelInstances.accessViaIAP (preferred)
 - Your organization hasn't blocked access to external IP addresses. IAP changes the source traffic to 35.235.240.0/20 and the tunnel to https://tunnel.cloudproxy.app.
 - If your organization blocks access to public IP addresses, try connecting through a bastion server.

Help for IAP port forwarding: https://cloud.google.com/iap/docs/using-tcp-forwarding
https://cloud.google.com/iap/docs/faq#what_domain_does_for_tcp_use
Help for bastion server: https://cloud.google.com/compute/docs/instances/connecting-advanced#bastion_host
a8  No ingress firewall rule allowing SSH found.

If the project uses the default ingress firewall rule for SSH, connections to all VMs are allowed on TCP port 22.
If the VPC network that the VM's network interface is in has a custom firewall rule, make sure that custom rule allows ingress traffic on the VM's SSH TCP port (usually, this is TCP port 22).
Help for default firewall rule: https://cloud.google.com/vpc/docs/vpc#default-network
Help for custom firewall rule: https://cloud.google.com/network-connectivity/docs/vpn/how-to/configuring-firewall-rules

If you need to investigate further, enable the VM's serial console. Then connect through the VM serial port, find the SSH server's listen port, and make sure the port number in the VM's firewall rules matches the SSH server's listen port.
Help for serial console: https://cloud.google.com/compute/docs/instances/interacting-with-serial-console
Help for serial port: https://cloud.google.com/compute/docs/instances/interacting-with-serial-console
Help for firewall rules: https://cloud.google.com/vpc/docs/using-firewalls
c                   ^    \ rS rSrSrSrSrSrSrS r	S r
S rS rS rS	 rS
 rS rS rSrg)VPCTroubleshooterI   zCheck VPC setting.Nc                     Xl         X l        X0l        X@l        [        R
                  " [        [        5      U l        [        R                  " [        [        5      U l
        0 U l        g N)projectzoneinstanceiap_tunnel_argsr   GetClientInstance_API_COMPUTE_CLIENT_NAME_API_CLIENT_VERSION_V1compute_clientGetMessagesModulecompute_messageissues)selfr   r   r   r   s        <lib/googlecloudsdk/command_lib/compute/vpc_troubleshooter.py__init__VPCTroubleshooter.__init__Q   sR    LIM*001I1GID112J2HJDDK    c                     g r    r   s    r   check_prerequisite$VPCTroubleshooter.check_prerequisite\       
r   c                     g r   r!   r"   s    r   cleanup_resources#VPCTroubleshooter.cleanup_resources_   r%   r   c                    [         R                  R                  S5        U R                  5         U R                  (       a  U R                  5         [         R                  R                  SR                  [        U R                  5      5      5        U R                  R                  5        H"  n[         R                  R                  U5        M$     g )Nz---- Checking VPC settings ----z"VPC settings: {0} issue(s) found.
)
r   statusPrint_CheckDefaultSSHPortr   _CheckIAPTunnelingformatlenr   values)r   messages     r   troubleshootVPCTroubleshooter.troubleshootb   s    JJ67
JJ:AADKK ;;%%'	jjw (
r   c                     U R                  5       nU H  nU R                  U5      (       d  M    g    [        U R                  S'   g )Niap)_ListInstanceEffectiveFirewall_HasValidateIAPTunnelingRuleIAP_MESSAGEr   r   firewall_listfirewalls      r   r-   $VPCTroubleshooter._CheckIAPTunnelingm   s>    779M!		*	*8	4	4 " %DKKr   c                     U R                  5       nU H  nU R                  U5      (       d  M    g    [        U R                  S'   g )Ndefault_ssh_port)r6   _HasSSHProtocalAndPortDEFAULT_SSH_PORT_MESSAGEr   r9   s      r   r,   &VPCTroubleshooter._CheckDefaultSSHPortt   s?    779M!		$	$X	.	. " '?DKK"#r   c                     U R                   R                  U R                  R                  SU R                  R                  U R
                  S9nU R                  R                  R                  U5      R                  $ )Nnic0)r   networkInterfacer   r   )
r   ,ComputeInstancesGetEffectiveFirewallsRequestr   namer   r   r   	instancesGetEffectiveFirewalls	firewalls)r   reqs     r   r6   0VPCTroubleshooter._ListInstanceEffectiveFirewall{   sg    



K
K##!!YY	 L C
 ((>>sCMMMr   c                     UR                   U R                  R                  R                  R                  :w  a  g[        S UR                   5       5      (       a  gU R                  U5      (       d  gg)NFc              3   *   #    U  H	  oS :g  v   M     g7f)z35.235.240.0/20Nr!   ).0ranges     r   	<genexpr>AVPCTroubleshooter._HasValidateIAPTunnelingRule.<locals>.<genexpr>   s     
I3H%%%3H   T)	directionr   FirewallDirectionValueValuesEnumINGRESSallsourceRangesr?   )r   r;   s     r   r7   .VPCTroubleshooter._HasValidateIAPTunnelingRule   s\    T11::SS[[[

I83H3H
III&&x00r   c                     UR                    H8  nUR                  S:X  d  M  [        S UR                   5       5      (       d  M8    g   g)Ntcpc              3   *   #    U  H	  oS :H  v   M     g7f)22Nr!   )rN   ports     r   rP   ;VPCTroubleshooter._HasSSHProtocalAndPort.<locals>.<genexpr>   s      05#34$,#3rR   TF)allowed
IPProtocolanyports)r   r;   
allow_rules      r   r?   (VPCTroubleshooter._HasSSHProtocalAndPort   sG    &&
			%	'C 05#-#3#305 -5 -5 ' r   )r   r   r   r   r   r   r   )__name__
__module____qualname____firstlineno____doc__r   r   r   r   r   r#   r'   r2   r-   r,   r6   r7   r?   __static_attributes__r!   r   r   r   r   I   sG    '	$(/		%?Nr   r   N)rj   
__future__r   r   r   googlecloudsdk.api_lib.utilr   "googlecloudsdk.command_lib.computer   googlecloudsdk.corer   r   r   r8   r@   SshTroubleshooterr   r!   r   r   <module>rq      sS    3 &  ' , A #$  Y 0S ,H*<< Hr   