o Kig@sddlZddlZddlZddlmZddlmZmZmZddl m Z m Z m Z m Z mZmZmZddlmZmZddlmZddlmZddlmZdd lmZdd lmZdd lmZm Z dd l!m"Z"m#Z#m$Z$e %Z&e'e(e)Z*gd Z+ddgZ,e+e,e+e,e+dZ-gdZ.gdZ/gdZ0e+e,e.e+e,e/e+e0dZ1Gdddej2Z3Gddde3Z4Gddde3Z5Gddde4Z6dS)N)groupby)ListOptionalTuple)apiapt event_logger exceptionsmessagessystemutil)NoCloudTypeReasonget_cloud_type)repo)EntitlementWithMessage)ApplicationStatus)notices)Notice)ServicesOnceEnabledDataservices_once_enabled_file)MessagingOperationsMessagingOperationsDictStaticAffordance) strongswanstrongswan-hmacopenssh-clientopenssh-server shim-signedopenssh-client-hmacopenssh-server-hmac)xenialbionicfocal)openssl libssl1.0.0libssl1.0.0-hmac)r# libssl1.1libssl1.1-hmac libgcrypt20libgcrypt20-hmacc seZdZdZdZdZejZdZ dZ ej j Z gdZedefddZed d Zd edefd d ZdejfddZdefddZdejfddZ  d6dejdeeededdffdd ZdefddZ d7dededdfdd Zd!ed"edeffd#d$ Z ede!e"d%ffd&d'Z#edeeffd(d) Z$de!e%eej&fffd*d+ Z'd8d,d-Z(dejdeffd.d/ Z)dejdeffd0d1 Z*d2d3Z+dejddffd4d5 Z,Z-S)9FIPSCommonEntitlementizubuntu-pro-fips.gpgz/proc/sys/crypto/fips_enabledT)zfips-initramfszfips-initramfs-genericr(r)libgmp10 libgnutls30 libhogweed6 libnettle8r$r%r$r%r&r'libssl3z linux-fipsrrrrr#openssl-fips-module-3rrr ubuntu-fipszubuntu-aws-fipszubuntu-azure-fipsubuntu-gcp-fipsreturnc Cs0d}d}|js'trtjj|jd}|stjg}n|j }t j d|ifg}d}|j s=|js=t j dtj j|jdifg}|jsF|jifgnd}||||d}t|jdkr|jd}td|}|ri|d} nd} tj} | | kr|dpzg}tjj| |j| | pd d } |t j d| if||d<|S) Ntitlemsg) pre_enable pre_install post_enable pre_disablerzubuntu-([a-z]+)-fipsgenericr7unknown)variantservice base_flavorcurrent_flavor) access_onlyr is_containerr PROMPT_FIPS_CONTAINER_PRE_ENABLEformatr5auto_upgrade_all_on_enableFIPS_RUN_APT_UPGRADEpre_enable_msgr prompt_for_confirmationpurgePROMPT_FIPS_PRE_DISABLEprompt_if_kernel_downgradelenpackagesrematchgroupget_kernel_infoflavorget#KERNEL_FLAVOR_CHANGE_WARNING_PROMPTnameappend) selfr7r9pre_enable_promptr:r8 messagingubuntu_fips_package_name ubuntu_fips_package_flavor_matchubuntu_fips_package_flavorrAr6r^\d+\.\d+\.\d+)r1r;rubuntulinuxkernel_versionz*Kernel information: cur='%s' and fips='%s')current_version new_version)r6rez2Cannot gather kernel information for '%s' and '%s'T)r rRproc_version_signature_versionLOGwarningrOsearchrMrNrget_pkg_candidate_versionreplacerQdebugversion_compareeventinfor KERNEL_DOWNGRADE_WARNINGrEr rI PROMPT_YES_NO)rXreour_full_kernel_strour_m fips_packagefips_kernel_version_strour_kernel_version_strr^r^r_rLsT     z0FIPSCommonEntitlement.prompt_if_kernel_downgradeprogressc Csg}t}tt|jddd}|D] \}}||vr||7}q|D](}ztj|gddigddWq"tjyJ|dt j j |j |d Yq"wdS) NcSs |ddS)Nz-hmac)rp)pkg_namer^r^r_- zNFIPSCommonEntitlement.hardcoded_install_conditional_packages..)keyDEBIAN_FRONTENDnoninteractivez--allow-downgradesz$-o Dpkg::Options::="--force-confdef"z$-o Dpkg::Options::="--force-confold"rNoverride_env_vars apt_optionsrt)r?pkg) rget_installed_packages_namesrsortedrdrun_apt_install_commandr UbuntuProErroremitr FIPS_PACKAGE_NOT_AVAILABLErEr5)rXr|desired_packagesinstalled_packages pkg_groupsr~pkg_listrr^r^r_&hardcoded_install_conditional_packages$s4   zr"r!r )r is_config_value_truecfgr r`ra)rXinstall_all_updates_overridehardcoded_releaser^r^r_rFGs  z0FIPSCommonEntitlement.auto_upgrade_all_on_enablecCsddt|jD}tjdkr|d|t|dkrVz"| dt j j d |d||tj|d d igd d WdStjyU| dt jYdSwdS) NcSsg|]}|jqSr^)rV).0packager^r^r_ VszMFIPSCommonEntitlement.install_all_available_fips_upgrades..jammyr0rrt )rNrrrr)r;get_installed_packages_with_uninstalled_candidate_in_originoriginr r`rarWsortrMrr INSTALLING_PACKAGESrEjoinunhold_packagesrr rFIPS_PACKAGES_UPGRADE_FAILURE)rXr| to_upgrader^r^r_#install_all_available_fips_upgradesSs4     z9FIPSCommonEntitlement.install_all_available_fips_upgradesN package_listcleanup_on_failurecsl|j}|rtj||dn |tjj|jd|r#| |n| || r4t tjdSdS)zInstall contract recommended packages for the entitlement. :param package_list: Optional package list to use instead of self.packages. :param cleanup_on_failure: Cleanup apt files if apt install fails. )rr4N)rNsuperinstall_packagesr|r INSTALLING_SERVICE_PACKAGESrEr5rFrr_check_for_rebootraddrFIPS_SYSTEM_REBOOT_REQUIRED)rXr|rrmandatory_packages __class__r^r_rws"  z&FIPSCommonEntitlement.install_packagescCstS)z=Check if system needs to be rebooted because of this service.)r should_rebootrXr^r^r_rsz'FIPSCommonEntitlement._check_for_rebootF operationsilentcCsN|}t||r#|sttjj|d|dkr%tt j dSdSdS)zCheck if user should be alerted that a reboot must be performed. @param operation: The operation being executed. @param silent: Boolean set True to silence print/log of messages )rzdisable operationN) rrs needs_rebootrtr ENABLE_REBOOT_REQUIRED_TMPLrErrrFIPS_DISABLE_REBOOT_REQUIRED)rXrrreboot_requiredr^r^r__check_for_reboot_msgs z+FIPSCommonEntitlement._check_for_reboot_msgracloud_idcs>|dkrtj|jjddrdS|dvrdStdtjvSdS)aVReturn False when FIPS is allowed on this cloud and series. On Xenial GCP there will be no cloud-optimized kernel so block default ubuntu-fips enable. This can be overridden in config with features.allow_xenial_fips_on_cloud. GCP doesn't yet have a cloud-optimized kernel or metapackage so block enable of fips if the contract does not specify ubuntu-gcp-fips. This also can be overridden in config with features.allow_default_fips_metapackage_on_gcp. :return: False when this cloud, series or config override allows FIPS. gcez.features.allow_default_fips_metapackage_on_gcprT)r!r"r2)r rrboolrrNrXrarrr^r__allow_fips_on_cloud_instancesz3FIPSCommonEntitlement._allow_fips_on_cloud_instance.cs^dddd}t\}durdtjtjj|d}|fddd ffS) Nzan AWSzan Azureza GCP)awsazurerr})racloudcs SN)rr^rrXrar^r_rrz:FIPSCommonEntitlement.static_affordances..T) rr r`rar FIPS_BLOCK_ON_CLOUDrEr5rT)rX cloud_titles_blocked_messager^rr_static_affordancess   z(FIPSCommonEntitlement.static_affordancescstrgStjSr)r rCrrNrrr^r_rNszFIPSCommonEntitlement.packagescst\}}trtsttj||fSt j |j rStt |js.ttjt|j dkrBttj||fSttjtjtjj|j dfS|tjkr\||fSt}g}|jD] }||vrp||qe|rtjtjjd||jdfStjtj fS)N1) file_namer)rNr?)!rapplication_statusr rCrrremoverrospathexistsFIPS_PROC_FILEsetrN load_filestripFIPS_MANUAL_DISABLE_URLrrDISABLEDr FIPS_PROC_FILE_ERRORrEENABLEDrrrWWARNINGFIPS_PACKAGES_NOT_INSTALLEDrrVFIPS_REBOOT_REQUIRED)rX super_status super_msgrmissingrrr^r_rsR    z(FIPSCommonEntitlement.application_statuscCsTtt}t|jt|j}||}|r(tt|t j j |j ddSdS)zRemove fips meta package to disable the service. FIPS meta-package will unset grub config options which will deactivate FIPS on any related packages. r4N) rrrrN differencerd intersectionremove_packageslistr DISABLE_FAILED_TMPLrEr5)rXrfips_metapackagerr^r^r_r*s   z%FIPSCommonEntitlement.remove_packagescs8t|rttjttjttjdSdSNTF)r_perform_enablerrrWRONG_FIPS_METAPACKAGE_ON_CLOUDrrrXr|rr^r_r;s   z%FIPSCommonEntitlement._perform_enablecs(t|r|rttjdSdSr)r_perform_disablerrrrrrrr^r_rFs z&FIPSCommonEntitlement._perform_disablecCs|ddg}t|tjjd|d}g}|D] }||vr#||q|r.crrr^r^)fips_updates_once_enabledr^r_rr)rrrrrrrrrreadrr $FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrEr5)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)rXrrdisabled_statusservices_once_enabled_objr)rrr_rs2   z"FIPSEntitlement.static_affordancesr|csRt\}}|dur|tjkrtdttjt |r't t jdSdS)Nz>Could not determine cloud, defaulting to generic FIPS package.TF)rr CLOUD_ID_ERRORrlrmrsrtr .FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGErrrrrFIPS_INSTALL_OUT_OF_DATE)rXr| cloud_typeerrorrr^r_rs   zFIPSEntitlement._perform_enable)rrrrVr FIPS_TITLEr5FIPS_DESCRIPTION descriptionFIPS_HELP_TEXT help_textrrrHrrrrrrrrrrr r^r^rr_r os !r csbeZdZdZejZdZejZ ej Z ej Z edeedffddZdejdeffdd ZZS) rz fips-updatesUbuntuFIPSUpdatesr3.cCs$ddlm}tttjt|tjfS)Nrr)rrrr r FIPS_INVALIDATES_FIPS_UPDATES"REALTIME_FIPS_UPDATES_INCOMPATIBLE)rXrr^r^r_rs z,FIPSUpdatesEntitlement.incompatible_servicesr|cs&tj|drttdddSdS)N)r|T)rF)rrrwriterrrr^r_rs z&FIPSUpdatesEntitlement._perform_enable)rrrrVr FIPS_UPDATES_TITLEr5rFIPS_UPDATES_DESCRIPTIONr)FIPS_UPDATES_HELP_TEXTr+PROMPT_FIPS_UPDATES_PRE_ENABLErHrrrrrrrrr r^r^rr_rs rcsheZdZdZejZejZej Z dZ ej Z dZedeedfffdd Zded edefd d ZZS) FIPSPreviewEntitlementz fips-previewUbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgr3.cstjtttjfSr)rrrr r r-rrr^r_rs z,FIPSPreviewEntitlement.incompatible_servicesrarcCsdSrr^rr^r^r_rsz4FIPSPreviewEntitlement._allow_fips_on_cloud_instance)rrrrVr FIPS_PREVIEW_TITLEr5FIPS_PREVIEW_DESCRIPTIONr)FIPS_PREVIEW_HELP_TEXTr+rPROMPT_FIPS_PREVIEW_PRE_ENABLErHrrrrrrrrr r^r^rr_r4s"r4)7loggingrrO itertoolsrtypingrrruaclientrrrr r r r uaclient.clouds.identityr ruaclient.entitlementsruaclient.entitlements.baser(uaclient.entitlements.entitlement_statusruaclient.filesruaclient.files.noticesruaclient.files.state_filesrruaclient.typesrrrget_event_loggerrs getLoggerreplace_top_level_logger_namerrlCONDITIONAL_PACKAGES_EVERYWHERE!CONDITIONAL_PACKAGES_OPENSSH_HMACrc&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALrbRepoEntitlementr*r rr4r^r^r^r_sj $      L