
    JhHf                        d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl	m
Z
mZmZmZmZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZm Z  d dl!m"Z"m#Z#m$Z$  ejJ                         Z& e jN                   ejP                  e)            Z*g dZ+ddgZ,e+e,z   e+e,z   e+dZ-g dZ.g dZ/g dZ0e+e,z   e.z   e+e,z   e/z   e+e0z   dZ1 G d dejd                        Z3 G d de3      Z4 G d de3      Z5 G d de4      Z6y)    N)groupby)ListOptionalTuple)apiaptevent_logger
exceptionsmessagessystemutil)NoCloudTypeReasonget_cloud_type)repo)EntitlementWithMessage)ApplicationStatus)notices)Notice)ServicesOnceEnabledDataservices_once_enabled_file)MessagingOperationsMessagingOperationsDictStaticAffordance)
strongswanstrongswan-hmacopenssh-clientopenssh-servershim-signedopenssh-client-hmacopenssh-server-hmac)xenialbionicfocal)openssllibssl1.0.0libssl1.0.0-hmac)r$   	libssl1.1libssl1.1-hmaclibgcrypt20libgcrypt20-hmacc            	       n    e Zd ZdZdZdZej                  ZdZ	dZ
ej                  j                  Zg dZedefd       Zed        Zd	edefd
Zdej,                  fdZdefdZdej,                  fdZ	 	 d#dej,                  deee      deddf fdZdefdZ	 d$dededdfdZdededef fdZ ede!e"df   fd       Z#edee   f fd       Z$de!e%eejL                     f   f fdZ'd%dZ(dej,                  def fdZ)dej,                  def fd Z*d! Z+dej,                  ddf fd"Z, xZ-S )&FIPSCommonEntitlementi  zubuntu-pro-fips.gpgz/proc/sys/crypto/fips_enabledT)zfips-initramfszfips-initramfs-genericr)   r*   libgmp10libgnutls30libhogweed6
libnettle8r%   r&   r%   r&   r'   r(   libssl3
linux-fipsr   r   r   r    r$   openssl-fips-module-3r   r   r   zubuntu-fipszubuntu-aws-fipszubuntu-azure-fipsubuntu-gcp-fipsreturnc                    d }d }| j                   st        j                         rLt        j                  j                  | j                        }| j                         st        j                  g}n| j                  }t        j                  d|ifg}d }| j                  sI| j                   s=t        j                  dt        j                  j                  | j                        ifg}| j                   s| j                  i fgnd }||||d}t        | j                         dk(  r| j                   d   }t#        j$                  d|      }|r|j'                  d      }	nd}	t        j(                         j*                  }
|	|
k7  rn|j-                  d      xs g }t        j.                  j                  |	| j0                  |	|
xs d	
      }|j3                  t        j                  d|if       ||d<   |S )Ntitlemsg)
pre_enablepre_installpost_enablepre_disable   r   zubuntu-([a-z]+)-fipsgenericr:   unknown)variantservicebase_flavorcurrent_flavor)access_onlyr   is_containerr    PROMPT_FIPS_CONTAINER_PRE_ENABLEformatr8   auto_upgrade_all_on_enableFIPS_RUN_APT_UPGRADEpre_enable_msgr   prompt_for_confirmationpurgePROMPT_FIPS_PRE_DISABLEprompt_if_kernel_downgradelenpackagesrematchgroupget_kernel_infoflavorget#KERNEL_FLAVOR_CHANGE_WARNING_PROMPTnameappend)selfr:   r<   pre_enable_promptr=   r;   	messagingubuntu_fips_package_name ubuntu_fips_package_flavor_matchubuntu_fips_package_flavorrD   r9   s               </usr/lib/python3/dist-packages/uaclient/entitlements/fips.pyr]   zFIPSCommonEntitlement.messaging   s   
""$==DD"jj E  "
 668#+#@#@"AK$($7$7! 00-.J zz$"2"2 00x??FF"&**  G  	K$ ##	 33  	 %&&&	
	 t}}"'+}}Q'7$/1xx&(@0, 04::1= + .7*#335<<N)^;&]]<8>B
BBII6 II :#1#>Y	 J  !!44 +5	,'    c                     t        j                         j                  }t        j                         rt        j                  |g       S t        j                  |g       S )a  
        Dictionary of conditional packages to be installed when
        enabling FIPS services. For example, if we are enabling
        FIPS services in a machine that has openssh-client installed,
        we will perform two actions:

        1. Upgrade the package to the FIPS version
        2. Install the corresponding hmac version of that package
           when available.
        )r   get_release_infoseriesrF   #FIPS_CONTAINER_CONDITIONAL_PACKAGESrW   FIPS_CONDITIONAL_PACKAGES)r[   re   s     ra   conditional_packagesz*FIPSCommonEntitlement.conditional_packages   sJ     ((*11 6::62FF(,,VR88rb   
assume_yesc                2   t        j                         j                  }|t        j	                  d       yt        j                  d|      }t        j                  d      }|||j                  d      }t        j                  d||       t        j                  ||      dk  rYt        j                  t        j                  j!                  ||             t#        j$                  t        j&                  |	      S yt        j	                  d
||       y)ztCheck if installing a FIPS kernel will downgrade the kernel
        and prompt for confirmation if it will.
        z Cannot gather kernel informationFz!(?P<kernel_version>\d+\.\d+\.\d+)r2   kernel_versionz*Kernel information: cur='%s' and fips='%s'r   )current_versionnew_version)r9   ri   z2Cannot gather kernel information for '%s' and '%s'T)r   rU   proc_version_signature_versionLOGwarningrR   searchr   get_pkg_candidate_versionrT   debugversion_compareeventinfor   KERNEL_DOWNGRADE_WARNINGrH   r   rL   PROMPT_YES_NO)r[   ri   our_full_kernel_strour_mfips_kernel_version_strour_kernel_version_strs         ra   rO   z0FIPSCommonEntitlement.prompt_if_kernel_downgrade   s    ""$CC 	 &KK:;		02E
 #&"?"?"M!8!D%*[[1A%B"II<#' ##+-C 
 

55<<(>$; =  33 ..:   KKD#'
 rb   progressc           	         g }t        j                         }t        t        | j                        d       }|D ]  \  }}||v s||z  } |D ]   }	 t        j
                  |gddig d       " y # t        j                  $ r> |j                  dt        j                  j                  | j                  |             Y tw xY w)	Nc                 &    | j                  dd      S )Nz-hmac )replace)pkg_names    ra   <lambda>zNFIPSCommonEntitlement.hardcoded_install_conditional_packages.<locals>.<lambda>#  s    !1!1'2!> rb   )keyDEBIAN_FRONTENDnoninteractivez--allow-downgradesz$-o Dpkg::Options::="--force-confdef"z$-o Dpkg::Options::="--force-confold"rQ   override_env_varsapt_optionsrv   )rB   pkg)r   get_installed_packages_namesr   sortedrh   run_apt_install_commandr
   UbuntuProErroremitr   FIPS_PACKAGE_NOT_AVAILABLErH   r8   )r[   r}   desired_packagesinstalled_packages
pkg_groupsr   pkg_listr   s           ra   &hardcoded_install_conditional_packagesz<FIPSCommonEntitlement.hardcoded_install_conditional_packages  s    
  ==?4,,->


 #- 	-Hh-- H, 	- $ 	C++!U'8:J&K!	 ,, 77>> $

 ? s   A22ACCc                     t        j                  | j                  j                  d      }t        j                         j
                  dv }|xs | S )Nzfeatures.fips_auto_upgrade_allconfigpath_to_value>   r#   r"   r!   )r   is_config_value_truecfgr   rd   re   )r[   install_all_updates_overridehardcoded_releases      ra   rI   z0FIPSCommonEntitlement.auto_upgrade_all_on_enable=  sT    '+'@'@88<</O(
$ #335<< A
 

 ,D3D/DDrb   c                 h   t        j                  | j                        D cg c]  }|j                   }}t	        j
                         j                  dk(  r|j                  d       |j                          t        |      dkD  rn	 |j                  dt        j                  j                  dj                  |                   | j                  |       t        j                   |ddig d	
       y y c c}w # t"        j$                  $ r# |j                  dt        j&                         Y y w xY w)Njammyr3   r   rv    )rQ   r   r   r   r   )r   ;get_installed_packages_with_uninstalled_candidate_in_originoriginrY   r   rd   re   rZ   sortrP   r   r   INSTALLING_PACKAGESrH   joinunhold_packagesr   r
   r   FIPS_PACKAGES_UPGRADE_FAILURE)r[   r}   package
to_upgrades       ra   #install_all_available_fips_upgradesz9FIPSCommonEntitlement.install_all_available_fips_upgradesI  s   
 ZZ
 LL

 
 ""$++w656z?QN0077!$*!5 8  $$Z0++''8:J&K! 
< ,, Nfh&L&LMNs   C6A,C; ;3D10D1Npackage_listcleanup_on_failurec                    | j                   }|rt        | 	  ||       n9|j                  t        j
                  j                  | j                               | j                         r| j                  |       n| j                  |       | j                         r$t        j                  t        j                         yy)zInstall contract recommended packages for the entitlement.

        :param package_list: Optional package list to use instead of
            self.packages.
        :param cleanup_on_failure: Cleanup apt files if apt install fails.
        )r   r7   N)rQ   superinstall_packagesr}   r   INSTALLING_SERVICE_PACKAGESrH   r8   rI   r   r   _check_for_rebootr   addr   FIPS_SYSTEM_REBOOT_REQUIRED)r[   r}   r   r   mandatory_packages	__class__s        ra   r   z&FIPSCommonEntitlement.install_packagesm  s     "]]G$/ %  44;;$**;M **,44X>77A!!#KK22 $rb   c                 *    t        j                         S )z=Check if system needs to be rebooted because of this service.)r   should_reboot)r[   s    ra   r   z'FIPSCommonEntitlement._check_for_reboot  s    ##%%rb   	operationsilentc                    | j                         }t        j                  |       |r_|s3t        j                  t        j
                  j                  |             |dk(  r$t        j                  t        j                         yyy)zCheck if user should be alerted that a reboot must be performed.

        @param operation: The operation being executed.
        @param silent: Boolean set True to silence print/log of messages
        )r   zdisable operationN)r   ru   needs_rebootrv   r   ENABLE_REBOOT_REQUIRED_TMPLrH   r   r   r   FIPS_DISABLE_REBOOT_REQUIRED)r[   r   r   reboot_requireds       ra   _check_for_reboot_msgz+FIPSCommonEntitlement._check_for_reboot_msg  sy     002?+

88??"+ @ 
 //77 0 rb   re   cloud_idc                     |dk(  rFt        j                  | j                  j                  d      ry|dv ryt        dt        |   v       S y)aV  Return False when FIPS is allowed on this cloud and series.

        On Xenial GCP there will be no cloud-optimized kernel so
        block default ubuntu-fips enable. This can be overridden in
        config with features.allow_xenial_fips_on_cloud.

        GCP doesn't yet have a cloud-optimized kernel or metapackage so
        block enable of fips if the contract does not specify ubuntu-gcp-fips.
        This also can be overridden in config with
        features.allow_default_fips_metapackage_on_gcp.

        :return: False when this cloud, series or config override allows FIPS.
        gcez.features.allow_default_fips_metapackage_on_gcpr   T)r"   r#   r4   )r   r   r   boolr   rQ   )r[   re   r   r   s      ra   _allow_fips_on_cloud_instancez3FIPSCommonEntitlement._allow_fips_on_cloud_instance  sU      u((xx||N  ,,)UW-==>>rb   .c                     dddd}t               \  }dt        j                         j                  t        j
                  j                  j                         |j                              }| fddffS )	Nzan AWSzan Azureza GCP)awsazurer   r   )re   cloudc                  (    j                         S N)r   )r   r[   re   s   ra   r   z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>  s    ::68L rb   T)	r   r   rd   re   r   FIPS_BLOCK_ON_CLOUDrH   r8   rW   )r[   cloud_titles_blocked_messager   re   s   `   @@ra   static_affordancesz(FIPSCommonEntitlement.static_affordances  s    '*WM$&!H((*11"66==<<>)9)9()C > 

  L
 	
rb   c                 D    t        j                         rg S t        |   S r   )r   rF   r   rQ   r[   r   s    ra   rQ   zFIPSCommonEntitlement.packages  s     Iwrb   c                    t         |          \  }}t        j                         r;t        j                         s't        j                  t        j                         ||fS t        j                  j                  | j                        rt        j                  t        | j                              s#t        j                  t        j                         t        j                  | j                        j!                         dk(  r't        j                  t        j"                         ||fS t        j$                  t        j"                         t&        j(                  t*        j,                  j/                  | j                        fS |t&        j0                  k7  r||fS t3        j4                         }g }| j                  D ]  }||vs|j7                  |        |rJt&        j8                  t*        j:                  j/                  dj=                  |      | j>                        fS t&        j0                  t*        j@                  fS )N1)	file_namer   )rQ   rB   )!r   application_statusr   rF   r   r   remover   r   ospathexistsFIPS_PROC_FILEsetrQ   	load_filestripFIPS_MANUAL_DISABLE_URLr   r   DISABLEDr   FIPS_PROC_FILE_ERRORrH   ENABLEDr   r   rZ   WARNINGFIPS_PACKAGES_NOT_INSTALLEDr   rY   FIPS_REBOOT_REQUIRED)r[   super_status	super_msgr   missingr   r   s         ra   r   z(FIPSCommonEntitlement.application_status  s    #('"<">i )=)=)?NN22  **77>>$--. ''DMM(:;66  3 34::<C22 $Y..22 &..1188"&"5"5 9   ,444** ==? }} 	(G00w'	( !))44;; XXg.		 <   %%))
 	
rb   c                 b   t        t        j                               }t        | j                        j	                  t        | j
                              }|j                  |      }|rHt        j                  t        |      t        j                  j                  | j                               yy)zRemove fips meta package to disable the service.

        FIPS meta-package will unset grub config options which will deactivate
        FIPS on any related packages.
        r7   N)r   r   r   rQ   
differencerh   intersectionremove_packageslistr   DISABLE_FAILED_TMPLrH   r8   )r[   r   fips_metapackager   s       ra   r   z%FIPSCommonEntitlement.remove_packages   s     !!A!A!CDt}}-88))*
 +778JK%&,,33$**3E rb   c                     t         |   |      rjt        j                  t        j
                         t        j                  t        j                         t        j                  t        j                         yyNTF)r   _perform_enabler   r   r   WRONG_FIPS_METAPACKAGE_ON_CLOUDr   r   r[   r}   r   s     ra   r   z%FIPSCommonEntitlement._perform_enable1  sQ    7"8,NN66 NN6667NN6>>?rb   c                     t         |   |      r4| j                         r#t        j                  t
        j                         yyr   )r   _perform_disabler   r   r   r   r   r   s     ra   r   z&FIPSCommonEntitlement._perform_disable<  s9    7#H-%%'77 rb   c                    ddg}t        j                  |t        j                  j	                  dj                  |                  }g }|j                         D ]  }||v s|j                  |        |rKddg|z   }t        j                  |t        j                  j	                  dj                  |                  }y y )Nzapt-mark	showholdsr   )commandunhold)r   run_apt_commandr   EXECUTING_COMMAND_FAILEDrH   r   
splitlinesrZ   )r[   package_namescmdholdsunholdshold
unhold_cmds          ra   r   z%FIPSCommonEntitlement.unhold_packagesF  s    ;'##--44SXXc]4K
 $$& 	%D}$t$	% $h/'9J''1188HHZ0 9 E rb   c                 Z    | j                  | j                         t        |   |       y)zSetup apt config based on the resourceToken and directives.

        FIPS-specifically handle apt-mark unhold

        :raise UbuntuProError: on failure to setup any aspect of this apt
           configuration
        N)r   fips_pro_package_holdsr   setup_apt_configr   s     ra   r  z&FIPSCommonEntitlement.setup_apt_configY  s&     	T889 *rb   NT)F)r5   N).__name__
__module____qualname__repo_pin_priorityrepo_key_filer   r   PROMPT_FIPS_PRE_ENABLErK   supports_access_onlyapt_noninteractiveurlsFIPS_HOME_PAGEhelp_doc_urlr  propertyr   r]   rh   r   rO   r   ProgressWrapperr   rI   r   r   r   strr   r   r   r   r   r   r   rQ   r   NamedMessager   r   r   r   r   r  __classcell__r   s   @ra   r,   r,   V   s   )M4N44N
 ==//L@ R2 R Rh 9 9$, , ,\!++!F
ED 
E"N++"NN -1#'	$%%$ tCy)$ !	$
 
$L&4 &
 .3&*	,%(	> 
E*:C*?$@ 
 
$  $s)    
9
	 (8+@+@"AA	B9
v"	(;(; 	 	)<)<  &	+)<)< 	+ 	+ 	+rb   r,   c                        e Zd ZdZej
                  Zej                  Zej                  Z
dZej                  Zedeedf   fd       Zedeedf   f fd       Zdej*                  def fdZ xZS )	FIPSEntitlementfips
UbuntuFIPSr5   .c                     ddl m} ddlm} t	        |t
        j                        t	        t        t
        j                        t	        |t
        j                        fS )Nr   )LivepatchEntitlementRealtimeKernelEntitlement)
uaclient.entitlements.livepatchr  uaclient.entitlements.realtimer   r   r   LIVEPATCH_INVALIDATES_FIPSFIPSUpdatesEntitlementFIPS_UPDATES_INVALIDATES_FIPSREALTIME_FIPS_INCOMPATIBLE)r[   r  r   s      ra   incompatible_servicesz%FIPSEntitlement.incompatible_servicesm  sQ    HL #$h&I&I #&(N(N #)8+N+N

 
	
rb   c                    t         |   }t        | j                        }t        j
                  }t        |j                         d   |k7        t        j                         }|r|j                  nd|t        j                  j                  | j                  |j                        fddft        j                  j                  | j                  |j                        fddffz   S )N)r   r   F)r  fips_updatesc                       S r    )is_fips_updates_enableds   ra   r   z4FIPSEntitlement.static_affordances.<locals>.<lambda>  s    / rb   c                       S r   r+  )fips_updates_once_enableds   ra   r   z4FIPSEntitlement.static_affordances.<locals>.<lambda>  s    1 rb   )r   r   r$  r   r   r   r   r   r   readr)  r   $FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrH   r8   )FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r[   r   r)  disabled_statusservices_once_enabled_objr.  r,  r   s        @@ra   r   z"FIPSEntitlement.static_affordances~  s    "W7-$((;+44"&++-a0OC#
 %?$C$C$E! ) &22 	" "==DD,2D2D E  0 BBII,2D2D J  2%
 
 	
rb   r}   c                     t               \  }}|K|t        j                  k(  r8t        j	                  d       t
        j                  t        j                         t        | )  |      r$t        j                  t        j                         yy)Nz>Could not determine cloud, defaulting to generic FIPS package.TF)r   r   CLOUD_ID_ERRORro   rp   ru   rv   r   .FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGEr   r   r   r   r   FIPS_INSTALL_OUT_OF_DATE)r[   r}   
cloud_typeerrorr   s       ra   r   zFIPSEntitlement._perform_enable  ss    *,
E%+<+K+K"KKK6 JJxNNO7"8,NN// rb   )r  r	  r
  rY   r   
FIPS_TITLEr8   FIPS_DESCRIPTIONdescriptionFIPS_HELP_TEXT	help_textr   r  rK   r  r   r   r'  r   r   r   r  r   r   r  r  s   @ra   r  r  e  s    DE++K''IF44N
u-CS-H'I 
 
  
E*:C*?$@ 
 
B(;(;   rb   r  c                        e Zd ZdZej
                  ZdZej                  Z	ej                  Zej                  Zedeedf   fd       Zdej&                  def fdZ xZS )r$  zfips-updatesUbuntuFIPSUpdatesr5   .c                 ~    ddl m} t        t        t        j
                        t        |t        j                        fS )Nr   r  )r"  r   r   r  r   FIPS_INVALIDATES_FIPS_UPDATES"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r[   r   s     ra   r'  z,FIPSUpdatesEntitlement.incompatible_services  s:    L #!G!G #);;	
 	
rb   r}   c                 f    t         |   |      r t        j                  t	        d             yy)N)r}   T)r)  F)r   r   r   writer   r   s     ra   r   z&FIPSUpdatesEntitlement._perform_enable  s1    7"H"5&,,'T: rb   )r  r	  r
  rY   r   FIPS_UPDATES_TITLEr8   r   FIPS_UPDATES_DESCRIPTIONr<  FIPS_UPDATES_HELP_TEXTr>  PROMPT_FIPS_UPDATES_PRE_ENABLErK   r  r   r   r'  r   r  r   r   r  r  s   @ra   r$  r$    s{    D''E F33K//I<<N
u-CS-H'I 
 
(;(;   rb   r$  c                        e Zd ZdZej
                  Zej                  Zej                  Z
dZej                  ZdZedeedf   f fd       Zdededefd	Z xZS )
FIPSPreviewEntitlementzfips-previewUbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgr5   .c                 X    t         |   t        t        t        j
                        fz   S r   )r   r'  r   r  r   rB  r   s    ra   r'  z,FIPSPreviewEntitlement.incompatible_services  s-    w,"!G!G0
 
 	
rb   re   r   c                      yr  r+  )r[   re   r   s      ra   r   z4FIPSPreviewEntitlement._allow_fips_on_cloud_instance  s     rb   )r  r	  r
  rY   r   FIPS_PREVIEW_TITLEr8   FIPS_PREVIEW_DESCRIPTIONr<  FIPS_PREVIEW_HELP_TEXTr>  r   PROMPT_FIPS_PREVIEW_PRE_ENABLErK   r  r  r   r   r'  r  r   r   r  r  s   @ra   rK  rK    s    D''E33K//I F<<N1M
u-CS-H'I 
 
%(	rb   rK  )7loggingr   rR   	itertoolsr   typingr   r   r   uaclientr   r   r	   r
   r   r   r   uaclient.clouds.identityr   r   uaclient.entitlementsr   uaclient.entitlements.baser   (uaclient.entitlements.entitlement_statusr   uaclient.filesr   uaclient.files.noticesr   uaclient.files.state_filesr   r   uaclient.typesr   r   r   get_event_loggerru   	getLoggerreplace_top_level_logger_namer  ro   CONDITIONAL_PACKAGES_EVERYWHERE!CONDITIONAL_PACKAGES_OPENSSH_HMACrg   &UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALrf   RepoEntitlementr,   r  r$  rK  r+  rb   ra   <module>rh     sD    	 	  ( ( O O O F & = F " )  	&%%'g:::8DE#  % !
 .'(-'(, "* &
* &) % .'(,- .'(,- -+,	' #L+D00 L+^I+ IX2 @_ rb   