We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
azure - event hub resources
Add event hub resource & implement firewall filter

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `tools/c7n_azure/c7n_azure/resources/event_hub.py`
Content:
```
1 # Copyright 2019 Microsoft Corporation
2 #
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
6 #
7 # http://www.apache.org/licenses/LICENSE-2.0
8 #
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
14 
15 from c7n_azure.provider import resources
16 from c7n_azure.resources.arm import ArmResourceManager
17 
18 
19 @resources.register('eventhub')
20 class EventHub(ArmResourceManager):
21     """Event Hub Resource
22 
23     :example:
24 
25     Finds all Event Hub resources in the subscription.
26 
27     .. code-block:: yaml
28 
29         policies:
30             - name: find-all-eventhubs
31               resource: azure.eventhub
32 
33     """
34 
35     class resource_type(ArmResourceManager.resource_type):
36         doc_groups = ['Events']
37 
38         service = 'azure.mgmt.eventhub'
39         client = 'EventHubManagementClient'
40         enum_spec = ('namespaces', 'list', None)
41         default_report_fields = (
42             'name',
43             'location',
44             'resourceGroup',
45             'sku.name',
46             'properties.isAutoInflateEnabled'
47         )
48         resource_type = 'Microsoft.EventHub/namespaces'
49
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/tools/c7n_azure/c7n_azure/resources/event_hub.py b/tools/c7n_azure/c7n_azure/resources/event_hub.py
--- a/tools/c7n_azure/c7n_azure/resources/event_hub.py
+++ b/tools/c7n_azure/c7n_azure/resources/event_hub.py
@@ -12,8 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import logging
+
+from c7n_azure.filters import FirewallRulesFilter
 from c7n_azure.provider import resources
 from c7n_azure.resources.arm import ArmResourceManager
+from netaddr import IPSet
 
 
 @resources.register('eventhub')
@@ -22,13 +26,17 @@
 
     :example:
 
-    Finds all Event Hub resources in the subscription.
+    This policy will find all Event Hubs allowing traffic from 1.2.2.128/25 CIDR.
 
     .. code-block:: yaml
 
         policies:
-            - name: find-all-eventhubs
-              resource: azure.eventhub
+          - name: find-event-hub-allowing-subnet
+            resource: azure.eventhub
+            filters:
+              - type: firewall-rules
+                include:
+                    - '1.2.2.128/25'
 
     """
 
@@ -46,3 +54,29 @@
             'properties.isAutoInflateEnabled'
         )
         resource_type = 'Microsoft.EventHub/namespaces'
+
+
+@EventHub.filter_registry.register('firewall-rules')
+class EventHubFirewallRulesFilter(FirewallRulesFilter):
+
+    def __init__(self, data, manager=None):
+        super(EventHubFirewallRulesFilter, self).__init__(data, manager)
+        self._log = logging.getLogger('custodian.azure.eventhub')
+        self.client = None
+
+    @property
+    def log(self):
+        return self._log
+
+    def process(self, resources, event=None):
+        self.client = self.manager.get_client()
+        return super(EventHubFirewallRulesFilter, self).process(resources, event)
+
+    def _query_rules(self, resource):
+        query = self.client.namespaces.get_network_rule_set(
+            resource['resourceGroup'],
+            resource['name'])
+
+        resource_rules = IPSet([r.ip_mask for r in query.ip_rules])
+
+        return resource_rules

{"golden_diff": "diff --git a/tools/c7n_azure/c7n_azure/resources/event_hub.py b/tools/c7n_azure/c7n_azure/resources/event_hub.py\n--- a/tools/c7n_azure/c7n_azure/resources/event_hub.py\n+++ b/tools/c7n_azure/c7n_azure/resources/event_hub.py\n@@ -12,8 +12,12 @@\n # See the License for the specific language governing permissions and\n # limitations under the License.\n \n+import logging\n+\n+from c7n_azure.filters import FirewallRulesFilter\n from c7n_azure.provider import resources\n from c7n_azure.resources.arm import ArmResourceManager\n+from netaddr import IPSet\n \n \n @resources.register('eventhub')\n@@ -22,13 +26,17 @@\n \n     :example:\n \n-    Finds all Event Hub resources in the subscription.\n+    This policy will find all Event Hubs allowing traffic from 1.2.2.128/25 CIDR.\n \n     .. code-block:: yaml\n \n         policies:\n-            - name: find-all-eventhubs\n-              resource: azure.eventhub\n+          - name: find-event-hub-allowing-subnet\n+            resource: azure.eventhub\n+            filters:\n+              - type: firewall-rules\n+                include:\n+                    - '1.2.2.128/25'\n \n     \"\"\"\n \n@@ -46,3 +54,29 @@\n             'properties.isAutoInflateEnabled'\n         )\n         resource_type = 'Microsoft.EventHub/namespaces'\n+\n+\n+@EventHub.filter_registry.register('firewall-rules')\n+class EventHubFirewallRulesFilter(FirewallRulesFilter):\n+\n+    def __init__(self, data, manager=None):\n+        super(EventHubFirewallRulesFilter, self).__init__(data, manager)\n+        self._log = logging.getLogger('custodian.azure.eventhub')\n+        self.client = None\n+\n+    @property\n+    def log(self):\n+        return self._log\n+\n+    def process(self, resources, event=None):\n+        self.client = self.manager.get_client()\n+        return super(EventHubFirewallRulesFilter, self).process(resources, event)\n+\n+    def _query_rules(self, resource):\n+        query = self.client.namespaces.get_network_rule_set(\n+            resource['resourceGroup'],\n+            resource['name'])\n+\n+        resource_rules = IPSet([r.ip_mask for r in query.ip_rules])\n+\n+        return resource_rules\n", "issue": "azure - event hub resources\nAdd event hub resource & implement firewall filter\n", "before_files": [{"content": "# Copyright 2019 Microsoft Corporation\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\nfrom c7n_azure.provider import resources\nfrom c7n_azure.resources.arm import ArmResourceManager\n\n\n@resources.register('eventhub')\nclass EventHub(ArmResourceManager):\n    \"\"\"Event Hub Resource\n\n    :example:\n\n    Finds all Event Hub resources in the subscription.\n\n    .. code-block:: yaml\n\n        policies:\n            - name: find-all-eventhubs\n              resource: azure.eventhub\n\n    \"\"\"\n\n    class resource_type(ArmResourceManager.resource_type):\n        doc_groups = ['Events']\n\n        service = 'azure.mgmt.eventhub'\n        client = 'EventHubManagementClient'\n        enum_spec = ('namespaces', 'list', None)\n        default_report_fields = (\n            'name',\n            'location',\n            'resourceGroup',\n            'sku.name',\n            'properties.isAutoInflateEnabled'\n        )\n        resource_type = 'Microsoft.EventHub/namespaces'\n", "path": "tools/c7n_azure/c7n_azure/resources/event_hub.py"}], "after_files": [{"content": "# Copyright 2019 Microsoft Corporation\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\nimport logging\n\nfrom c7n_azure.filters import FirewallRulesFilter\nfrom c7n_azure.provider import resources\nfrom c7n_azure.resources.arm import ArmResourceManager\nfrom netaddr import IPSet\n\n\n@resources.register('eventhub')\nclass EventHub(ArmResourceManager):\n    \"\"\"Event Hub Resource\n\n    :example:\n\n    This policy will find all Event Hubs allowing traffic from 1.2.2.128/25 CIDR.\n\n    .. code-block:: yaml\n\n        policies:\n          - name: find-event-hub-allowing-subnet\n            resource: azure.eventhub\n            filters:\n              - type: firewall-rules\n                include:\n                    - '1.2.2.128/25'\n\n    \"\"\"\n\n    class resource_type(ArmResourceManager.resource_type):\n        doc_groups = ['Events']\n\n        service = 'azure.mgmt.eventhub'\n        client = 'EventHubManagementClient'\n        enum_spec = ('namespaces', 'list', None)\n        default_report_fields = (\n            'name',\n            'location',\n            'resourceGroup',\n            'sku.name',\n            'properties.isAutoInflateEnabled'\n        )\n        resource_type = 'Microsoft.EventHub/namespaces'\n\n\n@EventHub.filter_registry.register('firewall-rules')\nclass EventHubFirewallRulesFilter(FirewallRulesFilter):\n\n    def __init__(self, data, manager=None):\n        super(EventHubFirewallRulesFilter, self).__init__(data, manager)\n        self._log = logging.getLogger('custodian.azure.eventhub')\n        self.client = None\n\n    @property\n    def log(self):\n        return self._log\n\n    def process(self, resources, event=None):\n        self.client = self.manager.get_client()\n        return super(EventHubFirewallRulesFilter, self).process(resources, event)\n\n    def _query_rules(self, resource):\n        query = self.client.namespaces.get_network_rule_set(\n            resource['resourceGroup'],\n            resource['name'])\n\n        resource_rules = IPSet([r.ip_mask for r in query.ip_rules])\n\n        return resource_rules\n", "path": "tools/c7n_azure/c7n_azure/resources/event_hub.py"}]}