
KeO              	   @   sx  d  d l  Z  d  d l Z d  d l m Z d  d l m Z m Z m Z d  d l m	 Z	 m
 Z
 m Z m Z m Z m Z d  d l m Z m Z d  d l m Z d  d l m Z d  d l m Z d  d	 l m Z d  d
 l m Z d  d l m Z m Z d  d l m  Z  m! Z! m" Z" e
 j#   Z$ e  j% e j& e'   Z( d d d d d g Z) d d g Z* d d d d g Z+ d e) e* d e) e* d e) d e) e+ i Z, d d d g Z- d d d  d! d" g Z. d d d  d! d" g Z/ d# d$ d d% d& d! d" g Z0 d e) e* e- d e) e* e. d e) e/ d e) e+ e0 i Z1 Gd' d(   d( e j2  Z3 Gd) d*   d* e3  Z4 Gd+ d,   d, e3  Z5 Gd- d.   d. e4  Z6 d S)/    N)groupby)ListOptionalTuple)aptevent_logger
exceptionsmessagessystemutil)NoCloudTypeReasonget_cloud_type)repo)IncompatibleService)ApplicationStatus)notices)Notice)ServicesOnceEnabledDataservices_once_enabled_file)MessagingOperationsMessagingOperationsDictStaticAffordance
strongswanzstrongswan-hmaczopenssh-clientzopenssh-serverzshim-signedzopenssh-client-hmaczopenssh-server-hmacZ
libnettle8Zlibhogweed6Zlibgnutls30Zlibgmp10ZxenialbionicfocalZjammyopensslzlibssl1.0.0zlibssl1.0.0-hmacz	libssl1.1zlibssl1.1-hmaclibgcrypt20zlibgcrypt20-hmacZgawkzupdate-notifier-commonzopenssl-fips-module-3Zlibssl3c                   s  e  Z d  Z d Z d Z d Z d Z e j j	 Z
 d d d d d	 d d	 d
 d d d d d d d d d d d g Z e d d    Z d d d e e e e e d d   f d d   Z d e e d d d d   Z e e e d    f d! d"    Z e e e d# f d$ d% d&     Z e e e d$   f d' d(     Z e e e e j f d$   f d) d*    Z d d$ d+ d,    Z d e e d-   f d. d/   Z d e d d-   f d0 d1   Z   S)2FIPSCommonEntitlementi  zubuntu-pro-fips.gpgz/proc/sys/crypto/fips_enabledTzfips-initramfsz	libssl1.1zlibssl1.1-hmaczlibssl1.0.0zlibssl1.0.0-hmacz
linux-fipszopenssh-clientzopenssh-client-hmaczopenssh-serverzopenssh-server-hmacr   r   zstrongswan-hmacr   zlibgcrypt20-hmaczfips-initramfs-genericzshim-signedc             C   s;   t  j   j } t  j   r+ t j | g   St j | g   S)a  
        Dictionary of conditional packages to be installed when
        enabling FIPS services. For example, if we are enabling
        FIPS services in a machine that has openssh-client installed,
        we will perform two actions:

        1. Upgrade the package to the FIPS version
        2. Install the corresponding hmac version of that package
           when available.
        )r
   get_release_infoseriesis_container#FIPS_CONTAINER_CONDITIONAL_PACKAGESgetFIPS_CONDITIONAL_PACKAGES)selfr    r%   </usr/lib/python3/dist-packages/uaclient/entitlements/fips.pyconditional_packages   s    z*FIPSCommonEntitlement.conditional_packagesN)package_listcleanup_on_failureverbosereturnc                s  | r% t  j t j j d |  j   |  j } t   j d | d d  g  } t	 j
   } t t |  j  d d d   } x* | D]" \ } }	 | | k r | |	 7} q Wxq | D]i }
 y& t   j d |
 g d d d d  Wq t j k
 rt  j t j j d	 |  j d
 |
   Yq Xq Wd S)a)  Install contract recommended packages for the entitlement.

        :param package_list: Optional package list to use instead of
            self.packages.
        :param cleanup_on_failure: Cleanup apt files if apt install fails.
        :param verbose: If true, print messages to stdout
        titler(   r*   Fkeyc             S   s   |  j  d d  S)Nz-hmac )replace)pkg_namer%   r%   r&   <lambda>   s    z8FIPSCommonEntitlement.install_packages.<locals>.<lambda>r)   servicepkgN)eventinfor	   ZINSTALLING_SERVICE_PACKAGESformatr,   packagessuperinstall_packagesr   get_installed_packages_namesr   sortedr'   r   ZUbuntuProErrorZFIPS_PACKAGE_NOT_AVAILABLE)r$   r(   r)   r*   Zmandatory_packagesZdesired_packagesinstalled_packagesZ
pkg_groupsr0   Zpkg_listr3   )	__class__r%   r&   r9      s,    	z&FIPSCommonEntitlement.install_packagesF)	operationsilentr+   c             C   s   t  j   } t j |  | r| | sA t j t j j d |   | d k r` t j	 t
 j  n | d k r| t j	 t
 j  d S)zCheck if user should be alerted that a reboot must be performed.

        @param operation: The operation being executed.
        @param silent: Boolean set True to silence print/log of messages
        r>   installzdisable operationN)r
   should_rebootr4   Zneeds_rebootr5   r	   ZENABLE_REBOOT_REQUIRED_TMPLr6   r   addr   FIPS_SYSTEM_REBOOT_REQUIREDFIPS_DISABLE_REBOOT_REQUIRED)r$   r>   r?   Zreboot_requiredr%   r%   r&   _check_for_reboot_msg   s    
z+FIPSCommonEntitlement._check_for_reboot_msg)r   cloud_idr+   c                sX   | d k rT t  j d |  j j d d  r. d S| d	 k r> d St d t   j k  Sd S)
aV  Return False when FIPS is allowed on this cloud and series.

        On Xenial GCP there will be no cloud-optimized kernel so
        block default ubuntu-fips enable. This can be overridden in
        config with features.allow_xenial_fips_on_cloud.

        GCP doesn't yet have a cloud-optimized kernel or metapackage so
        block enable of fips if the contract does not specify ubuntu-gcp-fips.
        This also can be overridden in config with
        features.allow_default_fips_metapackage_on_gcp.

        :return: False when this cloud, series or config override allows FIPS.
        gceconfigZpath_to_valuez.features.allow_default_fips_metapackage_on_gcpTr   r   zubuntu-gcp-fips)r   r   )r   Zis_config_value_truecfgboolr8   r7   )r$   r   rF   )r=   r%   r&   _allow_fips_on_cloud_instance   s    		z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.)r+   c                s   d d d d d d i } t    \   }   d  k r9 d   t j   j  t j j d  j   d	 | j     } |     f d
 d   d f f S)NZawszan AWSZazurezan AzurerG   za GCPr.   r   Zcloudc                  s    j      S)N)rK   r%   )rF   r$   r   r%   r&   r1     s    z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T)	r   r
   r   r   r	   ZFIPS_BLOCK_ON_CLOUDr6   r,   r"   )r$   Zcloud_titles_Zblocked_messager%   )rF   r$   r   r&   static_affordances	  s    z(FIPSCommonEntitlement.static_affordancesc                s   t  j   r g  St   j S)N)r
   r    r8   r7   )r$   )r=   r%   r&   r7     s    zFIPSCommonEntitlement.packagesc                s  t    j   \ } } t j   rH t j   rH t j t j  | | f St	 j
 j |  j  r t j t |  j   s t j t j  t j |  j  j   d k r t j t j  | | f St j t j  t j t j j d |  j  f S| t j k r| | f St j t j f S)N1	file_name)r8   application_statusr
   r    rA   r   remover   rC   ospathexistsFIPS_PROC_FILEsetr7   Z	load_filestripZFIPS_MANUAL_DISABLE_URLrB   r   ZDISABLEDr	   ZFIPS_PROC_FILE_ERRORr6   ENABLEDFIPS_REBOOT_REQUIRED)r$   Zsuper_statusZ	super_msg)r=   r%   r&   rP   "  s,    






z(FIPSCommonEntitlement.application_statusc             C   st   t  t j    } t  |  j  j t  |  j   } | j |  } | rp t j t |  t	 j
 j d |  j   d S)zRemove fips meta package to disable the service.

        FIPS meta-package will unset grub config options which will deactivate
        FIPS on any related packages.
        r,   N)rV   r   r:   r7   
differencer'   intersectionremove_packageslistr	   ZDISABLE_FAILED_TMPLr6   r,   )r$   r<   Zfips_metapackager\   r%   r%   r&   r\   L  s    	z%FIPSCommonEntitlement.remove_packages)r?   r+   c                sM   t    j d |  rI t j t j  t j t j  t j t j  d Sd S)Nr?   TF)r8   _perform_enabler   rQ   r   ZWRONG_FIPS_METAPACKAGE_ON_CLOUDrY   rD   )r$   r?   )r=   r%   r&   r^   ]  s    
z%FIPSCommonEntitlement._perform_enablec                s   d d g } t  j | t j j d d j |    } g  } x0 | j   D]" } | |  j k rI | j |  qI W| r d d g | } t  j | t j j d d j |    } t	   j
 d |  d S)zSetup apt config based on the resourceToken and directives.

        FIPS-specifically handle apt-mark unhold

        :raise UbuntuProError: on failure to setup any aspect of this apt
           configuration
        zapt-markZ	showholdsZcommand Zunholdr?   N)r   Zrun_apt_commandr	   ZEXECUTING_COMMAND_FAILEDr6   join
splitlinesfips_pro_package_holdsappendr8   setup_apt_config)r$   r?   cmdZholdsZunholdsZholdZ
unhold_cmd)r=   r%   r&   rd   h  s    !z&FIPSCommonEntitlement.setup_apt_config)__name__
__module____qualname__Zrepo_pin_priorityrepo_key_filerU   Zapt_noninteractiver	   ZurlsZFIPS_HOME_PAGEZhelp_doc_urlrb   propertyr'   r   r   strrJ   r9   rE   rK   r   r   rM   r7   r   ZNamedMessagerP   r\   r^   rd   r%   r%   )r=   r&   r   h   sR   	/	"",(!r   c                   s   e  Z d  Z d Z e j Z e j Z e j	 Z
 d Z e j Z e e e d f d d d     Z e e e d f d   f d d     Z e e d d	 d
     Z d e e d   f d d   Z   S)FIPSEntitlementfipsZ
UbuntuFIPS.)r+   c             C   sQ   d d l  m } d d l m } t | t j  t t t j  t | t j	  f S)Nr   )LivepatchEntitlement)RealtimeKernelEntitlement)
Zuaclient.entitlements.livepatchrn   uaclient.entitlements.realtimero   r   r	   ZLIVEPATCH_INVALIDATES_FIPSFIPSUpdatesEntitlementZFIPS_UPDATES_INVALIDATES_FIPSZREALTIME_FIPS_INCOMPATIBLE)r$   rn   ro   r%   r%   r&   incompatible_services  s    z%FIPSEntitlement.incompatible_servicesc                s   t    j } t |  j  } t j } t | j   d | k   t j	   } | r[ | j
 n d   | t j j d |  j d | j   f d d   d f t j j d |  j d | j    f d d   d f f S)Nr   Frm   fips_updatesc                  s     S)Nr%   r%   )is_fips_updates_enabledr%   r&   r1     s    z4FIPSEntitlement.static_affordances.<locals>.<lambda>c                  s     S)Nr%   r%   )fips_updates_once_enabledr%   r&   r1     s    )r8   rM   rq   rI   r   rX   rJ   rP   r   readrs   r	   Z$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDr6   r,   Z)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r$   rM   rs   Zenabled_statusZservices_once_enabled_obj)r=   )ru   rt   r&   rM     s"    	z"FIPSEntitlement.static_affordancesc             C   s   d  } t  j   r9 t j j d |  j  } t j g } n	 |  j } d  } |  j s t	 j
 d t j j d |  j  d |  j i f g } d t	 j
 d | d |  j i f g d | d | i S)Nr,   msg
assume_yes
pre_enablepost_enablepre_disable)r
   r    r	    PROMPT_FIPS_CONTAINER_PRE_ENABLEr6   r,   FIPS_RUN_APT_UPGRADEpre_enable_msgpurger   prompt_for_confirmationPROMPT_FIPS_PRE_DISABLErx   )r$   rz   pre_enable_promptr{   r%   r%   r&   	messaging  s"    			zFIPSEntitlement.messagingF)r?   r+   c                st   t    \ } } | d  k rG | t j k rG t j d  t j t j  t	   j
 d |  rp t j t j  d Sd S)Nz>Could not determine cloud, defaulting to generic FIPS package.r?   TF)r   r   ZCLOUD_ID_ERRORLOGZwarningr4   r5   r	   Z.FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGEr8   r^   r   rQ   r   ZFIPS_INSTALL_OUT_OF_DATE)r$   r?   Z
cloud_typeerror)r=   r%   r&   r^     s    
zFIPSEntitlement._perform_enable)rf   rg   rh   namer	   Z
FIPS_TITLEr,   ZFIPS_DESCRIPTIONdescriptionZFIPS_HELP_TEXT	help_textoriginZPROMPT_FIPS_PRE_ENABLEr~   rj   r   r   rr   r   rM   r   r   rJ   r^   r%   r%   )r=   r&   rl     s   				"(!%rl   c                   s   e  Z d  Z d Z e j Z d Z e j Z	 e j
 Z e e e d f d d d     Z e e d d d     Z d	 e e d
   f d d   Z   S)rq   zfips-updatesZUbuntuFIPSUpdates.)r+   c             C   s2   d d l  m } t t t j  t | t j  f S)Nr   )ro   )rp   ro   r   rl   r	   FIPS_INVALIDATES_FIPS_UPDATESZ"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r$   ro   r%   r%   r&   rr     s    z,FIPSUpdatesEntitlement.incompatible_servicesc             C   s   d  } t  j   r9 t j j d |  j  } t j g } n	 t j } d  } |  j s t	 j
 d t j j d |  j  d |  j i f g } d t	 j
 d | d |  j i f g d | d | i S)Nr,   rw   rx   ry   rz   r{   )r
   r    r	   r|   r6   r,   r}   ZPROMPT_FIPS_UPDATES_PRE_ENABLEr   r   r   r   rx   )r$   rz   r   r{   r%   r%   r&   r     s"    			z FIPSUpdatesEntitlement.messagingF)r?   r+   c                sz   t    j d |  rv |  j j d  p* i  } | j |  j d i  |  j j d d d |  t j t	 d d   d Sd S)Nr?   zservices-once-enabledTr-   Zcontentrs   F)
r8   r^   rI   Z
read_cacheupdater   Zwrite_cacher   writer   )r$   r?   Zservices_once_enabled)r=   r%   r&   r^   1  s    z&FIPSUpdatesEntitlement._perform_enable)rf   rg   rh   r   r	   ZFIPS_UPDATES_TITLEr,   r   ZFIPS_UPDATES_DESCRIPTIONr   ZFIPS_UPDATES_HELP_TEXTr   rj   r   r   rr   r   r   rJ   r^   r%   r%   )r=   r&   rq     s   			"%rq   c                   s   e  Z d  Z d Z e j Z e j Z e j	 Z
 d Z e j Z d Z e e e d f d   f d d     Z e e e d d	 d
    Z   S)FIPSPreviewEntitlementzfips-previewZUbuntuFIPSPreviewzubuntu-pro-fips-preview.gpg.)r+   c                s   t    j t t t j  f S)N)r8   rr   r   rl   r	   r   )r$   )r=   r%   r&   rr   L  s    	z,FIPSPreviewEntitlement.incompatible_services)r   rF   r+   c             C   s   d S)NTr%   )r$   r   rF   r%   r%   r&   rK   T  s    z4FIPSPreviewEntitlement._allow_fips_on_cloud_instance)rf   rg   rh   r   r	   ZFIPS_PREVIEW_TITLEr,   ZFIPS_PREVIEW_DESCRIPTIONr   ZFIPS_PREVIEW_HELP_TEXTr   r   ZPROMPT_FIPS_PREVIEW_PRE_ENABLEr~   ri   rj   r   r   rr   rk   rJ   rK   r%   r%   )r=   r&   r   C  s   				(r   )7ZloggingrR   	itertoolsr   Ztypingr   r   r   Zuaclientr   r   r   r	   r
   r   Zuaclient.clouds.identityr   r   Zuaclient.entitlementsr   Zuaclient.entitlements.baser   Z(uaclient.entitlements.entitlement_statusr   Zuaclient.filesr   Zuaclient.files.noticesr   Zuaclient.files.state_filesr   r   Zuaclient.typesr   r   r   Zget_event_loggerr4   Z	getLoggerZreplace_top_level_logger_namerf   r   ZCONDITIONAL_PACKAGES_EVERYWHEREZ!CONDITIONAL_PACKAGES_OPENSSH_HMACZCONDITIONAL_PACKAGES_JAMMYr#   Z&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIALZ&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONICZ%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALZ%UBUNTU_FIPS_METAPACKAGE_DEPENDS_JAMMYr!   ZRepoEntitlementr   rl   rq   r   r%   r%   r%   r&   <module>   s   .							 rM