OwlCyberSecurity - MANAGER
Edit File: contract.cpython-38.pyc
U ���h�� � @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z m Z d dl m m Z d dlmZmZmZmZmZmZmZmZmZ d dlmZ d dlm Z d dl m Z d dl m Z d d l!m"Z"m#Z# d d l$m%Z% d d l&m'Z' d Z(d Z)d Z*dZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2dZ3ddddd�Z4e�5� Z6e�7e�8e9��Z:eddd g�Z;G d d � d ej<�Z=G d d � d e%j>�Z?e@d!�d"d#�ZAdDe eeBef eeBef eCeCeCdd%�d&d'�ZDdEe eeBef eeBef eCeCeCe eeCf d)�d*d+�ZEejFejGd,�d-d.�ZHdFe d/�d0d1�ZIe ee d2�d3d4�ZJe eBeeBef d5�d6d7�ZKeeBeBf eeBeBf eLd8�d9d:�ZMdGeeBef eBeBe eB eeLeeBef f d;�d<d=�ZNdHeeBef e eB e eB dd>�d?d@�ZOe eeBef ee; dA�dBdC�ZPdS )I� N)� namedtuple)�Any�Dict�List�Optional�Tuple) � data_types� event_logger� exceptions�http�messages�secret_manager�system�util�version)�_enabled_services)� _is_attached)�UAConfig)�ATTACH_FAIL_DATE_FORMAT)�attachment_data_file�machine_id_file)� serviceclient)� get_user_or_root_log_file_pathz/v1/context/machines/tokenz3/v1/contracts/{contract}/context/machines/{machine}z /v1/resourcesz3/v1/resources/{resource}/context/machines/{machine}z /v1/clouds/{cloud_type}/tokenz3/v1/contracts/{contract}/machine-activity/{machine}z /v1/contractz/v1/magic-attachz?/v1/contracts/{contract}/context/machines/{machine}/guest-token� � � � )�series_overrides�series�cloud�variant�EnableByDefaultService�namer c @ sR e Zd Zejdejdd�ejdejdd�ejdejdd�ejdejdd�ejdejdd�ejdejdd�ejd ejdd�ejd ejdd�ejd ejdd�ejd ejdd�ejd ejdd�ejdejdd�ejdejdd�ejdejdd�gZdee ee ee ee ee ee ee ee ee ee ee ee ee ee d�dd�Z dS )� CPUTypeData� cpuinfo_cpuF)Zrequired�cpuinfo_cpu_architecture�cpuinfo_cpu_family�cpuinfo_cpu_implementer�cpuinfo_cpu_part�cpuinfo_cpu_revision�cpuinfo_cpu_variant� cpuinfo_model�cpuinfo_model_name�cpuinfo_stepping�cpuinfo_vendor_id�"sys_firmware_devicetree_base_model� sysinfo_model� sysinfo_typeN�r$ r% r& r' r( r) r* r+ r, r- r. r/ r0 r1 c C sX || _ || _|| _|| _|| _|| _|| _|| _| | _| | _ | | _ | | _ | | _ || _ d S )Nr2 )�selfr$ r% r& r' r( r) r* r+ r, r- r. r/ r0 r1 � r4 �3/usr/lib/python3/dist-packages/uaclient/contract.py�__init__z s �zCPUTypeData.__init__)NNNNNNNNNNNNNN) �__name__� __module__� __qualname__r ZFieldZStringDataValueZfieldsr �strr6 r4 r4 r4 r5 r# F s� �� �� � � � � � � �� � ��5 ��r# c sh e Zd ZdZd*ee dd�� fdd� Zeje j dddgd�d+d d ��Z e e ef d �d d �Ze e e ef d�dd�Zeje j dddgd�e e e ef d�dd��Zd,e e ee e e ef d�dd�Zdd� Ze e e ef d�dd�Ze e ef d �d d �Ze d �d d �Zd-e e ee e e ef d!�d"d#�Zd.e e ee e d!�d$d%�Ze e e e d!�d&d'�Zd(d)� Z� ZS )/�UAContractClientZ contract_urlN��cfg�returnc s t � j|d� t�� | _d S )N�r= )�superr6 �mtf�get_machine_token_file�machine_token_file)r3 r= �� __class__r4 r5 r6 � s zUAContractClient.__init__r r )Z retry_sleepsc C s� |st �| j�}| �� }|�dd�|�i� | �� }|�� |d< ||d�}t|�}| j t ||d�}|j dkrvt � � �n|j dkr�t|� |j dkr�t jt |j |jd ��|j} tj�| �d d �� | �d g �D ]} tj�| �d d �� q�| S )a} Requests machine attach to the provided machine_id. @param contract_token: Token string providing authentication to ContractBearer service endpoint. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing the machine-token. � Authorization� Bearer {}�lastAttachment�� machineId� activityInfo)�data�headers� i� �� ��url�code�body� machineToken� �resourceTokens�token)r �get_machine_idr= rM �update�format�_get_activity_info� isoformat�_support_old_machine_info� request_url�API_V1_ADD_CONTRACT_MACHINErR r ZAttachInvalidTokenError� _raise_attach_forbidden_message�ContractAPIErrorrS � json_dictr �secrets� add_secret�get) r3 �contract_tokenZ attachment_dt� machine_idrM � activity_inforL �backcompat_data�response� response_jsonrW r4 r4 r5 �add_contract_machine� s< � � �z%UAContractClient.add_contract_machine)r> c C sT | � � }| jt|d |d |d |d d�d�}|jdkrNtjt|j|jd��|jS ) z=Requests list of entitlements available to this machine type.� architecturer �kernel�virt�rm r rn ro )� query_paramsrO rP )r[ r^ �API_V1_AVAILABLE_RESOURCESrR r ra rS rb )r3 rh rj r4 r4 r5 �available_resources� s �� �z$UAContractClient.available_resources)rf r> c C sN | � � }|�dd�|�i� | jt|d�}|jdkrHtjt|j|jd��|j S )NrF rG �rM rO rP ) rM rY rZ r^ � API_V1_GET_CONTRACT_USING_TOKENrR r ra rS rb )r3 rf rM rj r4 r4 r5 �get_contract_using_token� s � �z)UAContractClient.get_contract_using_token)� cloud_typerL c C sz | j tj|d�|d�}|jdkr\|j�dd�}|rHt�|� tj |d��tj t|j|j d��|j}t j �|�dd�� |S ) z�Requests contract token for auto-attach images for Pro clouds. @param instance: AutoAttachCloudInstance for the cloud. @return: Dict of the JSON response containing the contract-token. )rw )rL rO �messagerU )� error_msgrP � contractToken)r^ �,API_V1_GET_CONTRACT_TOKEN_FOR_CLOUD_INSTANCErZ rR rb re �LOG�debugr ZInvalidProImagera rS r rc rd )r3 rw rL rj �msgrk r4 r4 r5 �%get_contract_token_for_cloud_instance� s* �� � �z6UAContractClient.get_contract_token_for_cloud_instance)� machine_token�resourcerg r> c C s� |st �| j�}| �� }|�dd�|�i� tj||d�}| j||d�}|jdkrft j t|j|j d��|j� d�r�|jd |j d< |j }|� dg �D ]}tj�|� d d �� q�|S ) a� Requests machine access context for a given resource @param machine_token: The authentication token needed to talk to this contract service endpoint. @param resource: Entitlement name. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing entitlement accessInfo. rF rG )r� �machinert rO rP �expiresrV rW rU )r rX r= rM rY rZ �"API_V1_GET_RESOURCE_MACHINE_ACCESSr^ rR r ra rS re rb r rc rd ) r3 r� r� rg rM rQ rj rk rW r4 r4 r5 �get_resource_machine_access s* � � z,UAContractClient.get_resource_machine_accessc C s� | j j}| j j�d�}t�| j�}| �� }tj ||d�}| � � }|� dd� |�i� | j |||d�}|j dkr�tj||j |jd��|jr�| j j}|j|d< | j �|� d S ) z�Report current activity token and enabled services. This will report to the contracts backend all the current enabled services in the system. rT �Zcontractr� rF rG )rM rL rO rP rK N)rC � contract_idr� re r rX r= r[ � API_V1_UPDATE_ACTIVITY_TOKENrZ rM rY r^ rR r ra rS rb �write)r3 r� r� rg Z request_datarQ rM rj r4 r4 r5 �update_activity_token; s. � � � z&UAContractClient.update_activity_token)� magic_tokenr> c C s� | � � }|�dd�|�i� | jt|d�}|jdkr<t�� �|jdkrNt�� �|jdkrltj t|j|j d��|j }dd d g}|D ]}t j �|�|d �� q�|S ) z�Request magic attach token info. When the magic token is registered, it will contain new fields that will allow us to know that the attach process can proceed rF rG rt rN � rO rP rW �userCoderz rU )rM rY rZ r^ �"API_V1_GET_MAGIC_ATTACH_TOKEN_INFOrR r �MagicAttachTokenError�MagicAttachUnavailablera rS rb r rc rd re )r3 r� rM rj rk � secret_fields�fieldr4 r4 r5 �get_magic_attach_token_infoc s* � � z,UAContractClient.get_magic_attach_token_infoc C sz | � � }| jt|dd�}|jdkr*t�� �|jdkrHtjt|j|jd��|j}dddg}|D ]}t j � |� |d �� q\|S ) z)Create a magic attach token for the user.�POST�rM �methodr� rO rP rW r� rz rU ) rM r^ �API_V1_NEW_MAGIC_ATTACHrR r r� ra rS rb r rc rd re )r3 rM rj rk r� r� r4 r4 r5 �new_magic_attach_token s& � � z'UAContractClient.new_magic_attach_token)r� c C s� | � � }|�dd�|�i� | jt|dd�}|jdkr>t�� �|jdkrPt�� �|jdkrbt� � �|jdkr�tj t|j|j d ��d S ) z)Revoke a magic attach token for the user.rF rG ZDELETEr� � rN r� rO rP N) rM rY rZ r^ �API_V1_REVOKE_MAGIC_ATTACHrR r Z MagicAttachTokenAlreadyActivatedr� r� ra rS )r3 r� rM rj r4 r4 r5 �revoke_magic_attach_token� s& � �z*UAContractClient.revoke_magic_attach_token)r� r� rg r> c C s� |st �| j�}| �� }|�dd�|�i� tj||d�}| �� }| j|d||d |d |d |d d �d �}|j d kr�t j ||j |j d ��|j� d �r�|jd |jd < |jS )a| Get the updated machine token from the contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. rF rG r� �GETrm r rn ro rp )r� rM rq rO rP r� )r rX r= rM rY rZ �API_V1_GET_CONTRACT_MACHINEr[ r^ rR r ra rS re rb )r3 r� r� rg rM rQ rh rj r4 r4 r5 �get_contract_machine� s8 ��� � z%UAContractClient.get_contract_machinec C s� |st �| j�}| �� }|�dd�|�i� || �� d�}t|�}tj||d�}| j ||d|d�}|j dkr�t j ||j |j d��|j�d �r�|jd |jd < |jS ) a� Request machine token refresh from contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing refreshed machine-token rF rG rI r� r� )rM r� rL rO rP r� )r rX r= rM rY rZ r[ r] � API_V1_UPDATE_CONTRACT_MACHINEr^ rR r ra rS re rb ) r3 r� r� rg rM rL ri rQ rj r4 r4 r5 �update_contract_machine� s6 � � � � z(UAContractClient.update_contract_machinec C sv | � � }|�dd�|�i� tj||d�}| j||dd�}|jdkrRtjdd��n |jd krptj||j|j d ��|j S ) a� Request guest token associated with this machine's contract @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service @param machine_id: Unique machine id that was registered with the pro backend on attach. @return: Dict of the JSON response containing the guest token rF rG r� r� r� r� �get_guest_token)Z feature_namerO rP ) rM rY rZ �API_V1_GET_GUEST_TOKENr^ rR r Z FeatureNotSupportedOldTokenErrorra rS rb )r3 r� r� rg rM rQ rj r4 r4 r5 r� s$ � � �z UAContractClient.get_guest_tokenc C s� t �� }t �� jt �� jt �� jt �� t �� t � � t � � t |j |j|j|j|j|j|j|j|j|j|j|j|j|jd�jdd�d�}t | j �j r�t | j �j }t!�"� }| j#j$p�t �%| j �| j#j&dd� |D �dd� |D �|r�|j'�(� nd d �}ni }||�S ) z9Return a dict of activity info data for contract requestsr2 F)Z keep_none)� distributionrn r rm Zdesktopro Z clientVersionZcpu_typec S s g | ] }|j �qS r4 )r" ��.0Zservicer4 r4 r5 � <listcomp>H s z7UAContractClient._get_activity_info.<locals>.<listcomp>c S s i | ]}|j r|j|j�qS r4 )Zvariant_enabledr" Z variant_namer� r4 r4 r5 � <dictcomp>I s � z7UAContractClient._get_activity_info.<locals>.<dictcomp>N)Z activityIDZ activityToken� resourcesZresourceVariantsrH ))r Z get_cpu_info�get_release_infor� Zget_kernel_infoZ uname_releaser Z get_dpkg_archZ is_desktopZ get_virt_typer Z get_versionr# r$ r% r& r' r( r) r* r+ r, r- r. r/ r0 r1 Zto_dictr r= Z is_attachedr �enabled_servicesr �readrC Z activity_idrX Zactivity_tokenZ attached_atr\ )r3 ZcpuinfoZ machine_infor� Zattachment_datarh r4 r4 r5 r[ # sZ ��� �� ��z#UAContractClient._get_activity_info)N)N)N)N)N) r7 r8 r9 Zcfg_url_base_attrr r r6 r Zretry�socketZtimeoutrl r r: r rs rv r r� r� r� r� r� r� r� r� r[ � __classcell__r4 r4 rD r5 r; � s\ �� � * �$ � � &( � � / �� *� #r; )� request_bodyc C sJ | � di �}| � d�||� d�|� d�|� d�|� d�dt�� jd�d �S ) a? Transforms a request_body that has the new activity_info into a body that includes both old and new forms of machineInfo/activityInfo This is necessary because there may be old ua-airgapped contract servers deployed that we need to support. This function is used for attach and refresh calls. rK rJ rm r� rn r ZLinux)r� rn r �type�release)rJ rK rm �os)re r r� r� )r� rh r4 r4 r5 r] ] s ��r] T)r= �past_entitlements�new_entitlements� allow_enabler �verboser> c C sx ddl m} d}g }g } || �D � ]�} z || } W n tk rJ Y q Y nX g } z$t| |�| i �| |||d�\} } W n� tjk r� } z*t�|� d}| � | � t� d| | � W 5 d}~X Y q t k �r } z0t�|� |� |� | � | � t�d| | � W 5 d}~X Y q X | r | r t � | � q t �| � t|�dk�rXtjd d � t| |�D �d ��n |�rttjd d � | D �d ��dS ) a� Iterate over all entitlements in new_entitlement and apply any delta found according to past_entitlements. :param cfg: UAConfig instance :param past_entitlements: dict containing the last valid information regarding service entitlements. :param new_entitlements: dict containing the current information regarding service entitlements. :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. :param verbose: If True, display output to stdout r )�entitlements_enable_orderF)r= � orig_access� new_accessr� r r� Tz+Failed to process contract delta for %s: %rNz5Unexpected error processing contract delta for %s: %rc S s* g | ]"\}}|t jjt|�t� d �f�qS ))ry Zlog_path)r ZUNEXPECTED_ERRORrZ r: r )r� r" � exceptionr4 r4 r5 r� � s ���z.process_entitlements_delta.<locals>.<listcomp>)�failed_servicesc S s g | ]}|t jf�qS r4 )r Z!E_ATTACH_FAILURE_DEFAULT_SERVICES)r� r" r4 r4 r5 r� � s �)�uaclient.entitlementsr� �KeyError�process_entitlement_deltare r ZUbuntuProErrorr| r� �append�error� Exception�eventZservice_processedZservices_failed�lenZAttachFailureUnknownError�zipZ AttachFailureDefaultServices)r= r� r� r� r r� r� Z delta_errorZunexpected_errorsr� r" Znew_entitlement�deltasZservice_enabled�er4 r4 r5 �process_entitlements_deltax sh � � � �� ��r� F)r= r� r� r� r r� r> c C s� ddl m} |rt|� t�||�}d}|r�|�di ��d�} | sT|�di ��d�} | sftj||d��|�di ��di ��d d �} z|| | | d �} W n4 tjk r� } zt � d | � | �W 5 d } ~ X Y nX | j ||||d�}||fS )ab Process a entitlement access dictionary deltas if they exist. :param cfg: UAConfig instance :param orig_access: Dict with original entitlement access details before contract refresh deltas :param new_access: Dict with updated entitlement access details after contract refresh :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. :param verbose: If True, display output to stdout :raise UbuntuProError: on failure to process deltas. :return: A tuple containing a dict of processed deltas and a boolean indicating if the service was fully processed r ��entitlement_factoryF� entitlementr� )Zorig�new� entitlements� obligations� use_selectorrU �r= r" r z3Skipping entitlement deltas for "%s". No such classN�r� r� ) r� r� �apply_contract_overridesr Zget_dict_deltasre r Z InvalidContractDeltasServiceType�EntitlementNotFoundErrorr| r} Zprocess_contract_deltas) r= r� r� r� r r� r� r� Zretr" r r� �excr4 r4 r5 r� � sR � � ��� � �r� )rj r> c C s� | j �d�}|r�|d }|d }|dkrR|d �t�}tj|||d �d�d��nF|dkr�|d �t�}tj|||d �d�d ��n|d kr�tj|d ��t�� �d S ) N�infoZ contractId�reasonzno-longer-effective�timez%m-%d-%Y)r� �dateZcontract_expiry_dateznot-effective-yet)r� r� Zcontract_effective_dateznever-effective)r� ) rb re �strftimer r ZAttachForbiddenExpiredZAttachForbiddenNotYetZAttachForbiddenNeverZAttachExpiredToken)rj r� r� r� r� r4 r4 r5 r` s* � � r` r? c C s� t �| �}|�� }|j}|d }|d d d }t| d�}|j||d�}|�|� tj� � |� di �� dt�| ��} t �| � t | ||�� d|d � d S ) a Request contract refresh from ua-contracts service. :param verbose: If True, display output to stdout :raise UbuntuProError: on failure to update contract or error processing contract deltas :raise ConnectivityError: On failure during a connection rT ZmachineTokenInfoZ contractInfo�idr? )r� r� rJ Fr� N) rA rB r� r� r; r� r� r rX � cache_clearre r r� ) r= r� rC Zorig_entitlementsZ orig_tokenr� r� Zcontract_clientZresprg r4 r4 r5 �refresh3 s0 � � �r� r< c C s t | �}|�� }|�dg �S )zDQuery available resources from the contract server for this machine.r� )r; rs re )r= �clientr� r4 r4 r5 �get_available_resourcesW s r� )r= rW r> c C s t | �}|�|�S )z/Query contract information for a specific token)r; rv )r= rW r� r4 r4 r5 �get_contract_information^ s r� )�override_selector�selector_valuesr> c C s< d}| � � D ]*\}}||f|� � kr* dS |t| 7 }q |S )Nr )�items�OVERRIDE_SELECTOR_WEIGHTS)r� r� Zoverride_weight�selector�valuer4 r4 r5 �_get_override_weightd s r� )r� � series_namerw r r> c C sz i }||d�}|r||d< | � di �� |i �}|r>||td < t�| �dg ��}|D ] }t|� d�|�} | rT||| < qT|S )N)r r r r r � overridesr� )�popr� �copy�deepcopyre r� ) r� r� rw r r� r� r Zgeneral_overrides�overrideZweightr4 r4 r5 �_select_overridesp s" � � r� )r� r r r> c C s� ddl m} tt| t�d| kg�s0td�| ���|dkrBt�� j n|}|� \}}| � di �}t ||||�}t |� � �D ]J\} } | � � D ]8\} } | d � | �} t| t�r�| �| � q�| | d | < q�qvdS )a� Apply series-specific overrides to an entitlement dict. This function mutates orig_access dict by applying any series-overrides to the top-level keys under 'entitlement'. The series-overrides are sparse and intended to supplement existing top-level dict values. So, sub-keys under the top-level directives, obligations and affordance sub-key values will be preserved if unspecified in series-overrides. To more clearly indicate that orig_access in memory has already had the overrides applied, the 'series' key is also removed from the orig_access dict. :param orig_access: Dict with original entitlement access details r )�get_cloud_typer� z?Expected entitlement access dict. Missing "entitlement" key: {}N)Zuaclient.clouds.identityr� �all� isinstance�dict� RuntimeErrorrZ r r� r re r� �sortedr� rY )r� r r r� r� rw �_Zorig_entitlementr� Z_weightZoverrides_to_apply�keyr� Zcurrentr4 r4 r5 r� � s. ��� � r� )r= r� r> c C s� ddl m} g }|�� D ]�\}}|�di ��dd�}z|| ||d�}W n tjk r` Y qY nX |�di ��di �}|�d�} |�|| �r|�� \} } | r|�t ||d �� q|S ) Nr r� r� r� rU r� r� � resourceToken)r" r ) r� r� r� re r r� Z_should_enable_by_default� can_enabler� r! ) r= r� r� Zenable_by_default_servicesZent_nameZ ent_valuer Zentr� r� r� r� r4 r4 r5 � get_enabled_by_default_services� s( ��r� )TT)FTT)T)N)NN)Qr� Zloggingr� � collectionsr �typingr r r r r Z uaclient.files.machine_token�filesr� rA Zuaclientr r r r r r r r r Z-uaclient.api.u.pro.status.enabled_services.v1r Z(uaclient.api.u.pro.status.is_attached.v1r Zuaclient.configr Zuaclient.defaultsr Zuaclient.files.state_filesr r Z uaclient.httpr Z uaclient.logr r_ r� r� rr r� r{ r� ru r� r� r� r� r� Zget_event_loggerr� Z getLoggerZ replace_top_level_logger_namer7 r| r! Z DataObjectr# ZUAServiceClientr; r� r] r: �boolr� r� Z HTTPResponseZ NamedMessager` r� r� r� �intr� r� r� r� r4 r4 r4 r5 �<module> s� , ������ �W C � � a � � B� $ � � � � � 2 �