
    fO                     &   d dl Z d dlZd dlmZ d dlmZmZmZ d dlm	Z	m
Z
mZmZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZmZ d dlm Z m!Z!m"Z"  e
jF                         Z$ e jJ                   ejL                  e'            Z(g dZ)ddgZ*g dZ+e)e*z   e)e*z   e)e)e+z   dZ,g dZ-g dZ.g dZ/g dZ0e)e*z   e-z   e)e*z   e.z   e)e/z   e)e+z   e0z   dZ1 G d dejd                        Z3 G d de3      Z4 G d de3      Z5 G d de4      Z6y)    N)groupby)ListOptionalTuple)aptevent_logger
exceptionsmessagessystemutil)NoCloudTypeReasonget_cloud_type)repo)IncompatibleService)ApplicationStatus)notices)Notice)ServicesOnceEnabledDataservices_once_enabled_file)MessagingOperationsMessagingOperationsDictStaticAffordance)
strongswanstrongswan-hmacopenssh-clientopenssh-servershim-signedopenssh-client-hmacopenssh-server-hmac)
libnettle8libhogweed6libgnutls30libgmp10)xenialbionicfocaljammy)openssllibssl1.0.0libssl1.0.0-hmac)r(   	libssl1.1libssl1.1-hmaclibgcrypt20libgcrypt20-hmac)gawkzupdate-notifier-commonr(   zopenssl-fips-module-3libssl3r-   r.   c            	       p    e Zd ZdZdZdZdZej                  j                  Z
g dZed        Z	 	 	 ddeee      d	ed
eddf fdZ	 ddededdfdZdededef fdZedeedf   fd       Zedee   f fd       Zdeeeej4                     f   f fdZddZddedef fdZddeddf fdZ xZS )FIPSCommonEntitlementi  zubuntu-pro-fips.gpgz/proc/sys/crypto/fips_enabledT)zfips-initramfsr+   r,   r)   r*   r)   r*   z
linux-fipsr   r   r   r   r(   r   r   r-   r.   zfips-initramfs-genericr   c                     t        j                         j                  }t        j                         rt        j                  |g       S t        j                  |g       S )a  
        Dictionary of conditional packages to be installed when
        enabling FIPS services. For example, if we are enabling
        FIPS services in a machine that has openssh-client installed,
        we will perform two actions:

        1. Upgrade the package to the FIPS version
        2. Install the corresponding hmac version of that package
           when available.
        )r   get_release_infoseriesis_container#FIPS_CONTAINER_CONDITIONAL_PACKAGESgetFIPS_CONDITIONAL_PACKAGES)selfr5   s     </usr/lib/python3/dist-packages/uaclient/entitlements/fips.pyconditional_packagesz*FIPSCommonEntitlement.conditional_packages   sJ     ((*11 6::62FF(,,VR88    Npackage_listcleanup_on_failureverbosereturnc                 8   |r=t         j                  t        j                  j	                  | j
                               | j                  }t        | !  |d       g }t        j                         }t        t        | j                        d       }|D ]  \  }}	||v s||	z  } |D ]  }
	 t        | !  |
gdd        y# t        j                  $ rA t         j                  t        j                   j	                  | j
                  |
             Y mw xY w)	a)  Install contract recommended packages for the entitlement.

        :param package_list: Optional package list to use instead of
            self.packages.
        :param cleanup_on_failure: Cleanup apt files if apt install fails.
        :param verbose: If true, print messages to stdout
        titleF)r>   r@   c                 &    | j                  dd      S )Nz-hmac )replace)pkg_names    r;   <lambda>z8FIPSCommonEntitlement.install_packages.<locals>.<lambda>   s    !1!1'2!> r=   )key)r>   r?   r@   )servicepkgN)eventinfor
   INSTALLING_SERVICE_PACKAGESformatrD   packagessuperinstall_packagesr   get_installed_packages_namesr   sortedr<   r	   UbuntuProErrorFIPS_PACKAGE_NOT_AVAILABLE)r:   r>   r?   r@   mandatory_packagesdesired_packagesinstalled_packages
pkg_groupsrH   pkg_listrL   	__class__s              r;   rS   z&FIPSCommonEntitlement.install_packages   s$    JJ44;;$**;M "]] +U 	! 	
  ==?4,,->


 #- 	-Hh-- H, 	- $ 
	C	("%5% ) 
	
 ,, 

77>> $

 ? s   /CADD	operationsilentc                 j   t        j                         }t        j                  |       |r|s3t        j	                  t
        j                  j                  |             |dk(  r$t        j                  t        j                         y|dk(  r$t        j                  t        j                         yyy)zCheck if user should be alerted that a reboot must be performed.

        @param operation: The operation being executed.
        @param silent: Boolean set True to silence print/log of messages
        )r^   installzdisable operationN)r   should_rebootrM   needs_rebootrN   r
   ENABLE_REBOOT_REQUIRED_TMPLrP   r   addr   FIPS_SYSTEM_REBOOT_REQUIREDFIPS_DISABLE_REBOOT_REQUIRED)r:   r^   r_   reboot_requireds       r;   _check_for_reboot_msgz+FIPSCommonEntitlement._check_for_reboot_msg   s     !..0?+

88??"+ @ 
 I%66 1177 2 r=   r5   cloud_idc                     |dk(  rFt        j                  | j                  j                  d      ry|dv ryt        dt        |   v       S y)aV  Return False when FIPS is allowed on this cloud and series.

        On Xenial GCP there will be no cloud-optimized kernel so
        block default ubuntu-fips enable. This can be overridden in
        config with features.allow_xenial_fips_on_cloud.

        GCP doesn't yet have a cloud-optimized kernel or metapackage so
        block enable of fips if the contract does not specify ubuntu-gcp-fips.
        This also can be overridden in config with
        features.allow_default_fips_metapackage_on_gcp.

        :return: False when this cloud, series or config override allows FIPS.
        gcez.features.allow_default_fips_metapackage_on_gcp)configpath_to_valueT)r%   r&   zubuntu-gcp-fips)r   is_config_value_truecfgboolrR   rQ   )r:   r5   rj   r]   s      r;   _allow_fips_on_cloud_instancez3FIPSCommonEntitlement._allow_fips_on_cloud_instance   sU      u((xx||N  ,,)UW-==>>r=   .c                     dddd}t               \  }dt        j                         j                  t        j
                  j                  j                         |j                              }| fddffS )	Nzan AWSzan Azureza GCP)awsazurerl   rF   )r5   cloudc                  (    j                         S N)rr   )rj   r:   r5   s   r;   rI   z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>  s    ::68L r=   T)	r   r   r4   r5   r
   FIPS_BLOCK_ON_CLOUDrP   rD   r8   )r:   cloud_titles_blocked_messagerj   r5   s   `   @@r;   static_affordancesz(FIPSCommonEntitlement.static_affordances	  s    '*WM$&!H((*11"66==<<>)9)9()C > 

  L
 	
r=   c                 D    t        j                         rg S t        |   S rx   )r   r6   rR   rQ   r:   r]   s    r;   rQ   zFIPSCommonEntitlement.packages  s     Iwr=   c                    t         |          \  }}t        j                         r;t        j                         s't        j                  t        j                         ||fS t        j                  j                  | j                        rt        j                  t        | j                              s#t        j                  t        j                         t        j                  | j                        j!                         dk(  r't        j                  t        j"                         ||fS t        j$                  t        j"                         t&        j(                  t*        j,                  j/                  | j                        fS |t&        j0                  k7  r||fS t&        j0                  t*        j2                  fS )N1)	file_name)rR   application_statusr   r6   rb   r   remover   rf   ospathexistsFIPS_PROC_FILEsetrQ   	load_filestripFIPS_MANUAL_DISABLE_URLre   r   DISABLEDr
   FIPS_PROC_FILE_ERRORrP   ENABLEDFIPS_REBOOT_REQUIRED)r:   super_status	super_msgr]   s      r;   r   z(FIPSCommonEntitlement.application_status"  s^    #('"<">i )=)=)?NN22  **77>>$--. ''DMM(:;66  3 34::<C22 $Y..22 &..1188"&"5"5 9   ,444**%%))
 	
r=   c                 b   t        t        j                               }t        | j                        j	                  t        | j
                              }|j                  |      }|rHt        j                  t        |      t        j                  j                  | j                               yy)zRemove fips meta package to disable the service.

        FIPS meta-package will unset grub config options which will deactivate
        FIPS on any related packages.
        rC   N)r   r   rT   rQ   
differencer<   intersectionremove_packageslistr
   DISABLE_FAILED_TMPLrP   rD   )r:   rZ   fips_metapackager   s       r;   r   z%FIPSCommonEntitlement.remove_packagesL  s     !!A!A!CDt}}-88))*
 +778JK%&,,33$**3E r=   c                     t         |   |      rjt        j                  t        j
                         t        j                  t        j                         t        j                  t        j                         yy)Nr_   TF)rR   _perform_enabler   r   r   WRONG_FIPS_METAPACKAGE_ON_CLOUDr   rg   )r:   r_   r]   s     r;   r   z%FIPSCommonEntitlement._perform_enable]  sT    7"&"1NN66 NN6667NN6>>?r=   c                    ddg}t        j                  |t        j                  j	                  dj                  |                  }g }|j                         D ]"  }|| j                  v s|j                  |       $ |rJddg|z   }t        j                  |t        j                  j	                  dj                  |                  }t        | )  |       y)zSetup apt config based on the resourceToken and directives.

        FIPS-specifically handle apt-mark unhold

        :raise UbuntuProError: on failure to setup any aspect of this apt
           configuration
        zapt-mark	showholds )commandunholdr   N)r   run_apt_commandr
   EXECUTING_COMMAND_FAILEDrP   join
splitlinesfips_pro_package_holdsappendrR   setup_apt_config)r:   r_   cmdholdsunholdshold
unhold_cmdr]   s          r;   r   z&FIPSCommonEntitlement.setup_apt_configh  s     ;'##--44SXXc]4K
 $$& 	%Dt222t$	% $h/'9J''1188HHZ0 9 E 	  /r=   )NTTF)rA   N) __name__
__module____qualname__repo_pin_priorityrepo_key_filer   apt_noninteractiver
   urlsFIPS_HOME_PAGEhelp_doc_urlr   propertyr<   r   r   strrq   rS   ri   rr   r   r   r}   rQ   r   NamedMessager   r   r   r   __classcell__r]   s   @r;   r2   r2   h   s^   )M4N
 ==//L, 9 9( -1#'	1tCy)1 !1 	1
 
1h .3&*	4%(	> 
E*:C*?$@ 
 
$  $s)    
(
	 (8+@+@"AA	B(
T"	d 	t 	0t 0 0 0r=   r2   c                        e Zd ZdZej
                  Zej                  Zej                  Z
dZej                  Zedeedf   fd       Zedeedf   f fd       Zedefd       Zd
dedef fd	Z xZS )FIPSEntitlementfips
UbuntuFIPSrA   .c                     ddl m} ddlm} t	        |t
        j                        t	        t        t
        j                        t	        |t
        j                        fS )Nr   )LivepatchEntitlementRealtimeKernelEntitlement)
uaclient.entitlements.livepatchr   uaclient.entitlements.realtimer   r   r
   LIVEPATCH_INVALIDATES_FIPSFIPSUpdatesEntitlementFIPS_UPDATES_INVALIDATES_FIPSREALTIME_FIPS_INCOMPATIBLE)r:   r   r   s      r;   incompatible_servicesz%FIPSEntitlement.incompatible_services  sQ    HL  $h&I&I  &(N(N  )8+N+N

 
	
r=   c                    t         |   }t        | j                        }t        j
                  }t        |j                         d   |k(        t        j                         }|r|j                  nd|t        j                  j                  | j                  |j                        fddft        j                  j                  | j                  |j                        fddffz   S )Nr   F)r   fips_updatesc                       S rx    )is_fips_updates_enableds   r;   rI   z4FIPSEntitlement.static_affordances.<locals>.<lambda>  s    / r=   c                       S rx   r   )fips_updates_once_enableds   r;   rI   z4FIPSEntitlement.static_affordances.<locals>.<lambda>  s    1 r=   )rR   r}   r   rp   r   r   rq   r   r   readr   r
   $FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrP   rD   )FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r:   r}   r   enabled_statusservices_once_enabled_objr   r   r]   s        @@r;   r}   z"FIPSEntitlement.static_affordances  s    "W7-dhh7*22"&++-a0NB#
 %?$C$C$E! ) &22 	" "==DD,2D2D E  0 BBII,2D2D J  2%
 
 	
r=   c                    d }t        j                         r<t        j                  j	                  | j
                        }t        j                  g}n| j                  }d }| j                  sHt        j                  t        j                  j	                  | j
                        | j                  dfg}t        j                  || j                  dfg||dS NrC   )msg
assume_yes)
pre_enablepost_enablepre_disable)r   r6   r
    PROMPT_FIPS_CONTAINER_PRE_ENABLErP   rD   FIPS_RUN_APT_UPGRADEpre_enable_msgpurger   prompt_for_confirmationPROMPT_FIPS_PRE_DISABLEr   r:   r   pre_enable_promptr   s       r;   	messagingzFIPSEntitlement.messaging  s     99@@** A  
 $889K $ 3 3zz 00'??FF"&**  G   '+oo	
K 00-T__M '&	
 		
r=   r_   c                 "   t               \  }}|K|t        j                  k(  r8t        j	                  d       t
        j                  t        j                         t        | )  |      r$t        j                  t        j                         yy)Nz>Could not determine cloud, defaulting to generic FIPS package.r   TF)r   r   CLOUD_ID_ERRORLOGwarningrM   rN   r
   .FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGErR   r   r   r   r   FIPS_INSTALL_OUT_OF_DATE)r:   r_   
cloud_typeerrorr]   s       r;   r   zFIPSEntitlement._perform_enable  sv    *,
E%+<+K+K"KKK6 JJxNNO7"&"1NN// r=   r   )r   r   r   namer
   
FIPS_TITLErD   FIPS_DESCRIPTIONdescriptionFIPS_HELP_TEXT	help_textoriginPROMPT_FIPS_PRE_ENABLEr   r   r   r   r   r   r}   r   r   rq   r   r   r   s   @r;   r   r     s    DE++K''IF44N
u-@#-E'F 
 
  
E*:C*?$@ 
 
B #
2 #
 #
Jd t  r=   r   c                        e Zd ZdZej
                  ZdZej                  Z	ej                  Zedeedf   fd       Zedefd       Zd	dedef fdZ xZS )
r   zfips-updatesUbuntuFIPSUpdatesrA   .c                 ~    ddl m} t        t        t        j
                        t        |t        j                        fS )Nr   r   )r   r   r   r   r
   FIPS_INVALIDATES_FIPS_UPDATES"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r:   r   s     r;   r   z,FIPSUpdatesEntitlement.incompatible_services  s:    L  !G!G  );;	
 	
r=   c                    d }t        j                         r<t        j                  j	                  | j
                        }t        j                  g}nt        j                  }d }| j                  sHt        j                  t        j                  j	                  | j
                        | j                  dfg}t        j                  || j                  dfg||dS r   )r   r6   r
   r   rP   rD   r   PROMPT_FIPS_UPDATES_PRE_ENABLEr   r   r   r   r   r   s       r;   r   z FIPSUpdatesEntitlement.messaging  s     99@@** A  
 $889K ( G Gzz 00'??FF"&**  G   '+oo	
K 00-T__M '&	
 		
r=   r_   c                    t         |   |      ry| j                  j                  d      xs i }|j	                  | j
                  di       | j                  j                  d|       t        j                  t        d             yy)Nr   zservices-once-enabledT)rJ   content)r   F)
rR   r   rp   
read_cacheupdater   write_cacher   writer   )r:   r_   services_once_enabledr]   s      r;   r   z&FIPSUpdatesEntitlement._perform_enable1  s    7"&"1##$;<B " "(($))T):;HH  +5J !  ',,'T: r=   r   )r   r   r   r   r
   FIPS_UPDATES_TITLErD   r   FIPS_UPDATES_DESCRIPTIONr   FIPS_UPDATES_HELP_TEXTr   r   r   r   r   r   r   rq   r   r   r   s   @r;   r   r     s    D''E F33K//I
u-@#-E'F 
 
 #
2 #
 #
Jd t  r=   r   c                        e Zd ZdZej
                  Zej                  Zej                  Z
dZej                  ZdZedeedf   f fd       Zdededefd	Z xZS )
FIPSPreviewEntitlementzfips-previewUbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgrA   .c                 X    t         |   t        t        t        j
                        fz   S rx   )rR   r   r   r   r
   r   r   s    r;   r   z,FIPSPreviewEntitlement.incompatible_servicesL  s-    w,!G!G0
 
 	
r=   r5   rj   c                      y)NTr   )r:   r5   rj   s      r;   rr   z4FIPSPreviewEntitlement._allow_fips_on_cloud_instanceT  s     r=   )r   r   r   r   r
   FIPS_PREVIEW_TITLErD   FIPS_PREVIEW_DESCRIPTIONr   FIPS_PREVIEW_HELP_TEXTr   r   PROMPT_FIPS_PREVIEW_PRE_ENABLEr   r   r   r   r   r   r   rq   rr   r   r   s   @r;   r  r  C  s    D''E33K//I F<<N1M
u-@#-E'F 
 
%(	r=   r  )7loggingr   	itertoolsr   typingr   r   r   uaclientr   r   r	   r
   r   r   uaclient.clouds.identityr   r   uaclient.entitlementsr   uaclient.entitlements.baser   (uaclient.entitlements.entitlement_statusr   uaclient.filesr   uaclient.files.noticesr   uaclient.files.state_filesr   r   uaclient.typesr   r   r   get_event_loggerrM   	getLoggerreplace_top_level_logger_namer   r   CONDITIONAL_PACKAGES_EVERYWHERE!CONDITIONAL_PACKAGES_OPENSSH_HMACCONDITIONAL_PACKAGES_JAMMYr9   &UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCAL%UBUNTU_FIPS_METAPACKAGE_DEPENDS_JAMMYr7   RepoEntitlementr2   r   r   r  r   r=   r;   <module>r*     sl    	  ( ( J J F & : F " )  	&%%'g:::8DE#  % !  .'(-'(,,/II $* &
* &) %) % .'(,- .'(,- -+,, !+,' #Y0D00 Y0xo+ odJ2 JZ_ r=   