
    X_                        d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ	 ddlm
Z dZ G d	 d
e	j                        Z	 d:dZd:dZd;dZ	 	 	 d:dZd Zd Zd Zd Zd Zd Zd<dZd=dZd=dZd>dZd=dZd<dZd<dZd<dZ d<dZ!d<dZ"d<d Z#d?d!Z$d<d"Z%d<d#Z&d<d$Z'd% Z(d& Z)d' Z*d( Z+d) Z,d* Z-d+ Z.d<d,Z/d<d-Z0d<d.Z1d<d/Z2d0 Z3d1 Z4d2 Z5d<d3Z6d<d4Z7d5 Z8d<d6Z9d<d7Z:d;d8Z;d<d9Z<y)@zJFlags and helpers for the compute organization firewall policies commands.    )absolute_import)division)unicode_literals)arg_parsers)
completers)flagszJ    table(
      name:label=ID,
      displayName,
      description
    )c                        e Zd Z fdZ xZS )FirewallPoliciesCompleterc                 2    t        t        | 
  dddd| y )Ncompute.firewallPoliciesz(compute org-firewall-policies list --uri)
collectionlist_command )superr
   __init__)selfkwargs	__class__s     Alib/googlecloudsdk/command_lib/compute/firewall_policies/flags.pyr   z"FirewallPoliciesCompleter.__init__$   s(    	
#T3 -?     )__name__
__module____qualname__r   __classcell__)r   s   @r   r
   r
   "   s     r   r
   Nc                 b    t        j                  ddt        || ddj                  |      d      S )NFIREWALL_POLICYfirewall policyfirewall policiesz)Short name of the firewall policy to {0}.r   nameresource_name	completerpluralrequiredcustom_plural
short_helpglobal_collectioncompute_flagsResourceArgumentr
   formatr$   r#   	operations      r   FirewallPolicyRuleListArgumentr.   ,   s:     
	'	'%)'<CCIN2	
 	r   c                 b    t        j                  ddt        || ddj                  |      d      S )Nr   r   r   z/Short name or ID of the firewall policy to {0}.r   r   r(   r,   s      r   FirewallPolicyArgumentr0   ;   s=    		'	'%)'BII
 3
 r   c                 @    t        j                  ddt        || d      S )Nr    associationr   )r    r!   r"   r#   r$   r'   )r)   r*   r
   )r$   r#   s     r   "FirewallPolicyAssociationsArgumentr3   J   s'    		'	'!)2
 r   c                 `    t        j                  ddt        || ddj                  |            S )Npriorityzfirewall policy ruler   z+Priority of the firewall policy rule to {}.)r    r!   r"   r#   r$   r'   r&   r(   r,   s      r   FirewallPolicyRuleArgumentr6   U   s:    
 
	'	'*)2>EE


 
r   c                     | j                  ddd       | j                  dd      }|j                  dd       |j                  d	d
       | j                  dd       y)z.Adds the argument for firewall policy creaton.z--short-nameTzgA textual name of the firewall policy. The name must be 1-63 characters long, and comply with RFC 1035.r$   helpr$   mutex--organizationzHOrganization in which the organization firewall policy is to be created.r9   --folderzBFolder in which the organization firewall policy is to be created.--descriptionFAn optional, textual description for the organization security policy.N)add_argument	add_groupparsergroups     r   AddArgFirewallPolicyCreationrF   g   s    7	   

D

5%   O  
 	  r   c                 R    | j                  ddd       | j                  dd       y)	z2Adds the argument for firewall policy clone rules.z--source-firewall-policyTz=The URL of the source firewall policy to copy the rules from.r8   r<   zzOrganization in which the organization firewall policy to copy the rules to. Must be set if firewall-policy is short name.r=   NrA   rD   s    r   AddArgsCloneRulesrJ      s<     J   	E  r   c                 *    | j                  dd       y)zFAdds the argument for firewall policy force start progressive rollout.r<   zOrganization in which the organization firewall policy to start the rollout of resides. Must be set if firewall-policy is short name.r=   NrH   rI   s    r   #AddArgsForceStartProgressiveRolloutrL      s    O  r   c                 v    | j                  dd      }|j                  dd       |j                  dd       y)	z+Adds the argument for firewall policy list.Tr:   r<   z2Organization in which firewall policies are listedr=   r>   z,Folder in which firewall policies are listedNrB   rA   rC   s     r   AddArgsListFirewallPolicyrO      sK    


D

5%?  
 E  r   c                 P    | j                  dd       | j                  dd       y)z+Adds the argument for firewall policy move.r<   ztOrganization in which the organization firewall policy is to be moved. Must be set if FIREWALL_POLICY is short name.r=   r>   z@Folder to which the organization firewall policy is to be moved.NrH   rI   s    r   AddArgsMoverQ      s9    B   	M  r   c                 P    | j                  dd       | j                  dd       y)z-Adds the argument for firewall policy update.r<   zvOrganization in which the organization firewall policy is to be updated. Must be set if FIREWALL_POLICY is short name.r=   r?   r@   NrH   rI   s    r   AddArgsUpdateFirewallPolicyrS      s;    D   	  r   c           
      v    | j                  d|rdndz   d|rdndt        dj                  |rdnd|             y)	z+Adds the priority argument to the argparse.r    s PRIORITY*NzPriority of the rule{0} to {1}. Rules are evaluated in order from highest priority to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.)metavarnargsr"   r9   )rA   r
   r+   )rD   r-   	is_plurals      r   AddPriorityr\      sF    yb)C$)<<BFcB	=  r   c                 6    | j                  dg dd |d       y))Adds the action argument to the argparse.--action)allowdeny	goto_nextapply_security_profile_groupc                 "    | j                         S Nlowerxs    r   <lambda>zAddAction.<locals>.<lambda>   
    QWWYr   :Action to take if the request matches the match condition.choicestyper$   r9   NrH   rD   r$   s     r   	AddActionrq      s$    LG  r   c                 6    | j                  dg dd |d       y)r^   r_   )mirrordo_not_mirrorrb   c                 "    | j                         S re   rf   rh   s    r   rj   z*AddPacketMirroringAction.<locals>.<lambda>   rk   r   rl   rm   NrH   rp   s     r   AddPacketMirroringActionrv      s$    6G  r   c                 J    | j                  d|dj                  |             y)z5Adds the firewall policy ID argument to the argparse.--firewall-policyzCShort name of the firewall policy into which the rule should be {}.r8   NrA   r+   )rD   r$   r-   s      r   AddFirewallPolicyIdrz      s*    6)$  r   c                 ,    | j                  d|d       y )Nr<   zmOrganization which the organization firewall policy belongs to. Must be set if FIREWALL_POLICY is short name.r8   rH   rp   s     r   AddOrganizationr|   	  s     :	  r   c                 T    | j                  dt        j                         |dd       y)zAdds the source IP ranges.z--src-ip-rangesSRC_IP_RANGEz(Source IP ranges to match for this rule.ro   r$   rY   r9   NrA   r   ArgListrp   s     r   AddSrcIpRangesr     s-     5  r   c                 T    | j                  dt        j                         |dd       y)zAdds the destination IP ranges.z--dest-ip-rangesDEST_IP_RANGEz-Destination IP ranges to match for this rule.r   Nr   rp   s     r   AddDestIpRangesr     s-     :  r   c                 T    | j                  dt        j                         |dd       y)zAdds the layer4 configs.z--layer4-configsLAYER4_CONFIGzPA list of destination protocols and ports to which the firewall rule will apply.r   Nr   rp   s     r   AddLayer4Configsr   *  s/       	r   c                 2    | j                  d|ddgd       y)z?Adds the direction of the traffic to which the rule is applied.z--directionINGRESSEGRESSzZDirection of the traffic the rule is applied. The default is to apply on incoming traffic.)r$   rn   r9   NrH   rp   s     r   AddDirectionr   8  s(    (#(  r   c                 J    | j                  d|t        j                  d       y)z"Adds the option to enable logging.z--enable-loggingzSUse this flag to enable logging of connections that allowed or denied by this rule.r$   actionr9   NrA   r   StoreTrueFalseActionrp   s     r   AddEnableLoggingr   E  s)    --!  r   c                 J    | j                  d|t        j                  d       y)z$Adds the option to disable the rule.z
--disabledzJUse this flag to disable the rule. Disabled rules will not affect traffic.r   Nr   rp   s     r   AddDisabledr   R  s)    --  r   c                 H    | j                  ddj                  |             y)z;Adds the new firewall policy rule priority to the argparse.z--new-priorityz6New priority for the rule to {}. Valid in [0, 65535]. r=   Nry   )rD   r-   s     r   AddNewPriorityr   _  s)    
B
I
I  r   c                 T    | j                  dt        j                         d|d       y)z1Adds the target resources the rule is applied to.z--target-resourcesTARGET_RESOURCESz>List of URLs of target resources to which the rule is applied.ro   rY   r$   r9   Nr   rp   s     r   AddTargetResourcesr   k  s-      K  r   c                 T    | j                  dt        j                         d|d       y)z.Adds the target service accounts for the rule.z--target-service-accountsTARGET_SERVICE_ACCOUNTSz-List of target service accounts for the rule.r   Nr   rp   s     r   AddTargetServiceAccountsr   v  s-    ! ':  r   c                 ,    | j                  d|d       y)z"Adds the description of this rule.r?   z.An optional, textual description for the rule.r8   NrH   rp   s     r   AddDescriptionr     s    ;  r   c                     | j                  ddd       | j                  dd       | j                  dd	       | j                  d
dddd       | j                  dd       y)z+Adds the arguments of association creation.rx   Tz&Security policy ID of the association.r8   r<   zvID of the organization in which the firewall policy is to be associated. Must be set if FIREWALL_POLICY is short name.r=   r>   z7ID of the folder with which the association is created.z--replace-association-on-target
store_trueFa  By default, if you attempt to insert an association to an organization or folder resource that is already associated with a firewall policy the method will fail. If this is set, the existing  association will be deleted at the same time that the new association is created.)r   defaultr$   r9   z--namezName to identify this association. If unspecified, the name will be set to "organization-{ORGANIZATION_ID}" or "folder-{FOLDER_ID}".NrH   rI   s    r   AddArgsCreateAssociationr     s    3  
 	G   	P   	'$   	%  r   c                 R    | j                  ddd       | j                  dd       y)	z+Adds the arguments of association deletion.rx   Tz>Short name or ID of the firewall policy ID of the association.r8   r<   ztID of the organization in which the firewall policy is to be detached. Must be set if FIREWALL_POLICY is short name.r=   NrH   rI   s    r   AddArgsDeleteAssociationr     s<    K   	E  r   c                 v    | j                  dd      }|j                  dd       |j                  dd       y)	z'Adds the arguments of association list.Tr:   r<   z<ID of the organization with which the association is listed.r=   r>   z6ID of the folder with which the association is listed.NrN   rC   s     r   AddArgsListAssociationr     sK    


D

5%I  
 O  r   c                 T    | j                  dt        j                         ddd       y)z)Adds a source address group to this rule.z--src-address-groupsSOURCE_ADDRESS_GROUPSFz\Source address groups to match for this rule. Can only be specified if DIRECTION is ingress.r   Nr   rI   s    r   AddSrcAddressGroupsr     s/     %;  	r   c                 T    | j                  dt        j                         ddd       y)z.Adds a destination address group to this rule.z--dest-address-groupsDEST_ADDRESS_GROUPSFz`Destination address groups to match for this rule. Can only be specified if DIRECTION is egress.r   Nr   rI   s    r   AddDestAddressGroupsr     s/     #:  	r   c                 T    | j                  dt        j                         ddd       y)zAdds source fqdns to this rule.z--src-fqdnsSOURCE_FQDNSFzUSource FQDNs to match for this rule. Can only be specified if DIRECTION is `ingress`.r   Nr   rI   s    r   AddSrcFqdnsr     s/     =  	r   c                 T    | j                  dt        j                         ddd       y)z$Adds destination fqdns to this rule.z--dest-fqdns
DEST_FQDNSFzYDestination FQDNs to match for this rule. Can only be specified if DIRECTION is `egress`.r   Nr   rI   s    r   AddDestFqdnsr     s/     <  	r   c                 f    d}|r|dz  }| j                  dt        j                         dd|       y)z'Adds a source region code to this rule.z\Source Region Code to match for this rule. Can only be specified if DIRECTION is `ingress`. z\Cannot be specified when the source network type is NON_INTERNET, VPC_NETWORK or INTRA_VPC. z--src-region-codesSOURCE_REGION_CODESFr   Nr   rD   support_network_scopes	help_texts      r   AddSrcRegionCodesr     sM    "  	<I 	 #  r   c                 f    d}|r|dz  }| j                  dt        j                         dd|       y)z,Adds a destination region code to this rule.z`Destination Region Code to match for this rule. Can only be specified if DIRECTION is `egress`. zBCannot be specified when the source network type is NON_INTERNET. z--dest-region-codesDEST_REGION_CODESFr   Nr   r   s      r   AddDestRegionCodesr      sK    !  LI 	 !  r   c                 `    d}|rd}| j                  dt        j                         dd|       y)z8Adds source threat intelligence list names to this rule.zSource Threat Intelligence lists to match for this rule. Can only be specified if DIRECTION is `ingress`. The available lists can be found here: https://cloud.google.com/vpc/docs/firewall-policies-rule-details#threat-intelligence-fw-policy.aL  Source Threat Intelligence lists to match for this rule. Can only be specified if DIRECTION is `ingress`. Cannot be specified when the source network type is NON_INTERNET, VPC_NETWORK or INTRA_VPC. The available lists can be found here: https://cloud.google.com/vpc/docs/firewall-policies-rule-details#threat-intelligence-fw-policy.z--src-threat-intelligence SOURCE_THREAT_INTELLIGENCE_LISTSFr   Nr   rD   r   	text_helps      r   AddSrcThreatIntelligencer   3  sJ    h  	j  	! 0  r   c                 `    d}|rd}| j                  dt        j                         dd|       y)z=Adds destination threat intelligence list names to this rule.zDestination Threat Intelligence lists to match for this rule. Can only be specified if DIRECTION is `egress`. The available lists can be found here: https://cloud.google.com/vpc/docs/firewall-policies-rule-details#threat-intelligence-fw-policy.a2  Destination Threat Intelligence lists to match for this rule. Can only be specified if DIRECTION is `egress`. Cannot be specified when source network type is NON_INTERNET. The available lists can be found here: https://cloud.google.com/vpc/docs/firewall-policies-rule-details#threat-intelligence-fw-policy.z--dest-threat-intelligenceDEST_THREAT_INTELLIGENCE_LISTSFr   Nr   r   s      r   AddDestThreatIntelligencer   M  sJ    h  	j  	" .  r   c                 .    | j                  dddd       y))Adds security profile group to this rule.--security-profile-groupSECURITY_PROFILE_GROUPFad  An org-based security profile group to be used with apply_security_profile_group action. Allowed formats are: a) http(s)://<namespace>/<api>/organizations/<org_id>/locations/global/securityProfileGroups/<profile> b) (//)<namespace>/organizations/<org_id>/locations/global/securityProfileGroups/<profile> c) <profile>. In case "c" `gcloud` CLI will create a reference matching format "a", but to make it work CLOUDSDK_API_ENDPOINT_OVERRIDES_NETWORKSECURITY property must be set. In order to set this property, please run the command `gcloud config set api_endpoint_overrides/networksecurity https://<namespace>/`.rY   r$   r9   NrH   rI   s    r   AddSecurityProfileGroupr   f  #     &	$  r   c                 .    | j                  dddd       y)r   r   r   FaN  An org-based security profile group to be used with mirror action. Allowed formats are: a) http(s)://<namespace>/<api>/organizations/<org_id>/locations/global/securityProfileGroups/<profile> b) (//)<namespace>/organizations/<org_id>/locations/global/securityProfileGroups/<profile> c) <profile>. In case "c" `gcloud` CLI will create a reference matching format "a", but to make it work CLOUDSDK_API_ENDPOINT_OVERRIDES_NETWORKSECURITY property must be set. In order to set this property, please run the command `gcloud config set api_endpoint_overrides/networksecurity https://<namespace>/`.r   NrH   rI   s    r    AddMirroringSecurityProfileGroupr   {  r   r   c                 J    | j                  ddt        j                  d       y)z6Adds the option to turn on TLS decryption on the rule.z--tls-inspectFzUse this flag to indicate whether TLS traffic should be inspected using the TLS inspection policy when the security profile group is applied. Default: no TLS inspection.r   Nr   rI   s    r   AddTlsInspectr     s)    --4  	r   c                 .    | j                  d|dd       y)z'Adds source network scope to this rule.z--src-network-scopeTaE  Deprecated. Use --src-network-type instead. Use this flag to indicate that the rule should match internet, non-internet traffic or traffic coming from the network specified by --src-network. It applies to ingress rules. Valid values are INTERNET, NON_INTERNET, VPC_NETWORKS and INTRA_VPC. Use empty string to clear the field.r$   hiddenr9   NrH   rp   s     r   AddSrcNetworkScoper     s#    (  r   c                 ,    | j                  d|d       y)z&Adds source network type to this rule.z--src-network-typea  Use this flag to indicate that the rule should match internet, non-internet traffic or traffic coming from the network specified by --src-network. It applies to ingress rules. Valid values are INTERNET, NON_INTERNET, VPC_NETWORKS and INTRA_VPC. Use empty string to clear the field.r8   NrH   rp   s     r   AddSrcNetworkTyper     s     (	  
r   c                 T    | j                  dt        j                         ddd       y)z+Adds source network urls list to this rule.z--src-networksSRC_NETWORKSFzThe source VPC networks to  match for this rule.  It can only be specified when --src-network-type is VPC_NETWORKS. It applies to  ingress rules. It accepts full or partial URLs.r   Nr   rI   s    r   AddSrcNetworksr     s/     =  
r   c                 .    | j                  d|dd       y)z,Adds destination network scope to this rule.z--dest-network-scopeTa  Deprecated. Use --dest-network-type instead. Use this flag to indicate that the rule should match internet or non-internet traffic. It applies to destination traffic for egress rules. Valid values are INTERNET and NON_INTERNET. Use empty string to clear the field.r   NrH   rp   s     r   AddDestNetworkScoper     s#    .  r   c                 ,    | j                  d|d       y)z+Adds destination network type to this rule.z--dest-network-typezUse this flag to indicate that the rule should match internet or non-internet traffic. It applies to destination traffic for egress rules. Valid values are INTERNET and NON_INTERNET. Use empty string to clear the field.r8   NrH   rp   s     r   AddDestNetworkTyper     s     .	  	r   c                 f    d}|r|dz  }| j                  dt        j                         d||       y)z'Adds a  source secure tag to this rule.a  A list of instance secure tags indicating the set of instances on the network to which the rule applies if all other fields match. Either --src-ip-ranges or --src-secure-tags must be specified for ingress traffic. If both --src-ip-ranges and --src-secure-tags are specified, an inbound connection is allowed if either the range of the source matches --src-ip-ranges or the tag of the source matches --src-secure-tags. Secure Tags can be assigned to instances during instance creation.zD Secure tags cannot be specified if source network type is INTERNET.z--src-secure-tagsSOURCE_SECURE_TAGSr   Nr   )rD   r$   r   r   s       r   AddSrcSecureTagsr     sK      NI 	 "  r   c                 T    | j                  dt        j                         d|d       y)z&Adds a target secure tag to this rule.z--target-secure-tagsTARGET_SECURE_TAGSzdAn optional, list of target secure tags with a name of the format tagValues/ or full namespaced namer   Nr   rp   s     r   AddTargetSecureTagsr     s/     "6  	r   )FFN)FF)F)T)TNre   )=__doc__
__future__r   r   r   googlecloudsdk.callioper   "googlecloudsdk.command_lib.computer   compute_completersr   r)   DEFAULT_LIST_FORMATListCommandCompleterr
   r.   r0   r3   r6   rF   rJ   rL   rO   rQ   rS   r\   rq   rv   rz   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   <module>r      s0   Q &  ' / O E	  2 G G  -1 $ F" $"	


	(V"(&42**" 4r   