File: //lib/python3/dist-packages/uaclient/__pycache__/security.cpython-310.pyc
o
nHJe#� � @ s� d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZ d dlmZmZmZmZmZmZ d dlmZ d dlmZmZ d dlm Z m Z d d l m Z m Z m!Z! d d
l"m#Z# d d l$m%Z% d d l&m'Z' d d
l(m)Z)m*Z* d dl+m,Z, d dl-m.Z. d dl/m0Z0 d dl1m2Z2 dZ3dZ4dZ5dZ6dZ7e dde8fde8fg�Z9e dde:fd e
e9 fd e
e8 fd e:fg�Z;e d d e8fd!e8fd"e8fg�Z<e d#d$e:fd%e e8 fg�Z=G d&d'� d'ej>�Z?e d(d$e?fd e e
e9 fg�Z@G d)d*� d*e0jA�ZBG d+d,� d,�ZCG d-d.� d.�ZDG d/d0� d0�ZEd1e e8e e8e8f f fd2d3�ZFd4e
eE d5e e8e:f d1e e8e e8e e8e8f f f fd6d7�ZGd8d9� ZHd:e8d1ee e? e e8 f fd;d<�ZId=eDd4e
eE d:e8d>e e8e e8e8f f d?e#d5e e8e:f d@e:d1e?fdAdB�ZJdCeEdDe
eE d:e8d>e e8e e8e8f f d?e#d5e e8e:f d@e:dEe:d1e?fdFdG�ZK H Hd�d?e#d:e8d@e:dEe:d1e?f
dIdJ�ZLdKdL� ZMdMdN� ZNdCeEd>e e8e e8e8f f d1e e8eCf fdOdP�ZOd=eDd>e e8e e8e8f f d1e e8eCf fdQdR�ZPd:e8dSe e8eCf fdTdU�ZQdVeCdWe e8e e8e8f f d1eCfdXdY�ZRdZd[� ZSd\e
ee8eCf d]eTd^eTd1e8fd_d`�ZUdae8d?e#fdbdc�ZVdae8d?e#d1e:fddde�ZW fd�d$e?d:e8dge8fdhdi�ZXd?e#dje e8e
ee8eCf f dke e8e
e< f d]eTd^eTd@e:d1e;fdldm�ZYd e
e9 d1e8fdndo�ZZd?e#d:e8dSe e8eCf d>e e8e e8e8f f dpe e8e e8e e8e8f f f d@e:d1e@fdqdr�Z[d�dsdt�Z\d?e#due8d1e:fdvdw�Z]d?e#fdxdy�Z^d?e#d1e:fdzd{�Z_d?e#d|e8d1e:fd}d~�Z`d?e#d@e:d1e:fdd��Zadae8d?e#d@e:d1e:fd�d��Zbd?e#d1e:fd�d��Zcd�e e8ef d?e#d@e:d1e:fd�d��Zdd?e#d�e
e8 dae8d@e:d1e=f
d�d��ZedS )�� N)� defaultdict)�datetime)�Any�Dict�List�
NamedTuple�Optional�Set�Tuple)�apt�
exceptions� livepatch�messages�system�util)� _initiate)�MagicAttachRevokeOptions�_revoke)�MagicAttachWaitOptions�_wait)�CLOUD_TYPE_TO_TITLE�PRO_CLOUD_URLS�get_cloud_type)�UAConfig)�PRINT_WRAP_WIDTH)�entitlement_factory)�ApplicabilityStatus�UserFacingStatus)�notices)�Notice)�
serviceclient)�colorize_commandsz=((CVE|cve)-\d{4}-\d{4,7}$|(USN|usn|LSN|lsn)-\d{1,5}-\d{1,2}$)z cves.jsonzcves/{cve}.jsonz notices.jsonznotices/{notice}.json�UnfixedPackage�pkg�unfixed_reason� ReleasedPackagesInstallResult�
fix_status� unfixed_pkgs�installed_pkgs�all_already_installed�BinaryPackageFix�
source_pkg�
binary_pkg�
fixed_version�
UpgradeResult�status�failure_reasonc @ sZ e Zd ZdZG dd� d�Zedd�Zedd�Zedd�Zed d
�Ze d d � �Z
d
d� Z dS )� FixStatuszD
An enum to represent the system status after fix operation
c @ s e Zd Zdedefdd�ZdS )zFixStatus._Value�value�msgc C s || _ || _d S �N�r2 r3 )�selfr2 r3 � r7 �3/usr/lib/python3/dist-packages/uaclient/security.py�__init__[ �
zFixStatus._Value.__init__N)�__name__�
__module__� __qualname__�int�strr9 r7 r7 r7 r8 �_ValueZ s r@ r �fixed� not-affected� zstill-affected� zaffected-until-rebootc C s | j j S r4 )r2 �r6 r7 r7 r8 � exit_coded s zFixStatus.exit_codec C s | j jS r4 r5 rE r7 r7 r8 �__str__h s zFixStatus.__str__N) r; r< r= �__doc__r@ �SYSTEM_NON_VULNERABLE�SYSTEM_NOT_AFFECTED�SYSTEM_STILL_VULNERABLE� SYSTEM_VULNERABLE_UNTIL_REBOOT�propertyrF rG r7 r7 r7 r8 r1 U s
r1 � FixResultc s0 e Zd ZdZdZdeeef deeef fdd�Ze j
e j g d�d� d#� fd
d � �Z
d$d ee d
ee dee dee dee dee dee deee ded fdd�Zdeddfdd�Z d%dee dee dee dee d ee ded f d d �Zd edd fd!d"�Z� ZS )&�UASecurityClient� � security_url� query_params�returnc C s. | j j �di ��di �}|r|�|� |S |S )zD
Update query params with data from feature config.
�features�extra_security_params)�cfg�get�update)r6 rR rU r7 r7 r8 �_get_query_paramsz s �
z"UASecurityClient._get_query_params)rC � � )� retry_sleepsNc s" | � |�}t� j|||||dd�S )NF)�path�data�headers�methodrR �log_response_body)rY �super� request_url)r6 r] r^ r_ r` rR �� __class__r7 r8 rc � s
�z UASecurityClient.request_url�query�priority�package�limit�offset� component�versionr/ �CVEc sV ||||||||d�} � j t| d�}
|
jdkr!tjt|
j|
jd��� fdd�|
jD �S )znQuery to match multiple-CVEs.
@return: List of CVE instances based on the the JSON response.
)�qrg rh ri rj rk rl r/ �rR �� ��url�code�bodyc s g | ]}t � |d ��qS )��client�response)rm )�.0�cve_mdrE r7 r8 �
<listcomp>� s �z-UASecurityClient.get_cves.<locals>.<listcomp>)rc � API_V1_CVESrs r �SecurityAPIErrorrt � json_list) r6 rf rg rh ri rj rk rl r/ rR rw r7 rE r8 �get_cves� s" �
�
�zUASecurityClient.get_cves�cve_idc C �B t j|d�}| �|�}|jdkrtj||j|jd��t| |jd�S )zkQuery to match single-CVE.
@return: CVE instance for JSON response from the Security API.
��cverp rq ru ) �API_V1_CVE_TMPL�formatrc rs r r| rt rm � json_dict)r6 r rr rw r7 r7 r8 �get_cve� �
�zUASecurityClient.get_cve�details�release�order�USNc sf � ||||d�}�j t|d�}|jdkr tjt|j|jd��t� �fdd�|j�dg �D �dd � d
�S ) zuQuery to match multiple-USNs.
@return: Sorted list of USN instances based on the the JSON response.
)r� r� ri rj r� ro rp rq c s0 g | ]}� d u s� |� dg �v rt�|d��qS )N�cves_idsru )rW r� )rx �usn_md�r� r6 r7 r8 rz � s
�z0UASecurityClient.get_notices.<locals>.<listcomp>r c S � | j S r4 ��id��xr7 r7 r8 �<lambda>� � z.UASecurityClient.get_notices.<locals>.<lambda>��key) rc �API_V1_NOTICESrs r r| rt �sortedr� rW )r6 r� r� ri rj r� rR rw r7 r� r8 � get_notices� s"
�
� ��z UASecurityClient.get_notices� notice_idc C r� )zbQuery to match single-USN.
@return: USN instance representing the JSON response.
)�noticerp rq ru ) �API_V1_NOTICE_TMPLr� rc rs r r| rt r� r� )r6 r� rr rw r7 r7 r8 �
get_notice� r� zUASecurityClient.get_notice)NNNN)NNNNNNNN)NNNNN)r; r< r= � url_timeout�cfg_url_base_attrr r? r rY r �retry�socket�timeoutrc r r> r r~ r� r� r� �
__classcell__r7 r7 rd r8 rO u st
�
����������
�
�"������
�!rO c @ s� e Zd ZdZdeeef fdd�Zedd� �Z edd� �Z
ed d
� �Z ed d � �Z ed
d� �Z
edd� �Zedefdd��Zedd� �ZdS )�CVEPackageStatuszAClass representing specific CVE PackageStatus on an Ubuntu series� cve_responsec C s
|| _ d S r4 �rw )r6 r� r7 r7 r8 r9 � s
zCVEPackageStatus.__init__c C �
| j d S �N� descriptionr� rE r7 r7 r8 r� � �
z CVEPackageStatus.descriptionc C r� r4 )r� rE r7 r7 r8 r- s z CVEPackageStatus.fixed_versionc C r� )N�pocketr� rE r7 r7 r8 r� r� zCVEPackageStatus.pocketc C r� )N�release_codenamer� rE r7 r7 r8 r� r� z!CVEPackageStatus.release_codenamec C r� )Nr/ r� rE r7 r7 r8 r/
r� zCVEPackageStatus.statusc C s� | j dkrtjS | j dkrtjS | j dkrtjS | j dv r tjS | j dkr(tjS | j dkr0tjS | j dkr=tjj | j
d�S tj j | j d �S )
N�neededz needs-triage�pending)�ignored�deferred�DNErB �released)�
fix_stream)r/ ) r/ r �SECURITY_CVE_STATUS_NEEDED�SECURITY_CVE_STATUS_TRIAGE�SECURITY_CVE_STATUS_PENDING�SECURITY_CVE_STATUS_IGNORED�SECURITY_CVE_STATUS_DNE� SECURITY_CVE_STATUS_NOT_AFFECTED�SECURITY_FIX_RELEASE_STREAMr� �
pocket_source�SECURITY_CVE_STATUS_UNKNOWNrE r7 r7 r8 �status_message s"
�z CVEPackageStatus.status_messagerS c C s t | jtjk�S )z?Return True if the package requires an active Pro subscription.)�boolr� r �'SECURITY_UBUNTU_STANDARD_UPDATES_POCKETrE r7 r7 r8 � requires_ua% s
��z CVEPackageStatus.requires_uac C sZ | j dkr
tj}|S | j dkrtj}|S | j dv r tj}|S d| jv r(tj}|S tj}|S )z>Human-readable string representing where the fix is published.� esm-infra�esm-apps)�updates�security�esm)r� r �SECURITY_UA_INFRA_POCKET�SECURITY_UA_APPS_POCKETr� r- )r6 �
fix_sourcer7 r7 r8 r� - s
�
�
��z CVEPackageStatus.pocket_sourceN)r; r< r= rH r r? r r9 rM r� r- r� r� r/ r� r� r� r� r7 r7 r7 r8 r� � s&
r� c @ s� e Zd ZdZdedeeef fdd�Zde fdd�Z
e d d
� �Z d d � Z
e dee fd
d��Ze ded fdd��Ze dd� �Ze deeef fdd��ZdS )rm z7Class representing CVE response from the SecurityClientrv rw c C � || _ || _d S r4 �rw rv �r6 rv rw r7 r7 r8 r9 B r: z CVE.__init__rS c C � t |t�sdS | j|jkS �NF)�
isinstancerm rw �r6 �otherr7 r7 r8 �__eq__F �
z
CVE.__eq__c C � | j �dd��� S )Nr� �UNKNOWN_CVE_ID�rw rW �upperrE r7 r7 r8 r� K � zCVE.idc C sJ | j }| jD ]}|j} dj| j|d�d�tjjj| jd��g}d�|�S )z2Return a string representing the URL for this cve.�{issue}: {title}��issue�title� - {}r� �
) r� r r� r� r� r �urls�SECURITY_CVE_PAGE�join)r6 r� r� �linesr7 r7 r8 �get_url_headerO s
��
zCVE.get_url_headerc C � | j �dg �S )N� notices_ids�rw rW rE r7 r7 r8 r� ^ s zCVE.notices_idsr� c �< t � d�st� fdd�� j�dg �D �dd� dd�� _� jS ) z�Return a list of USN instances from API response 'notices'.
Cache the value to avoid extra work on multiple calls.
�_noticesc � g | ]}t � j|��qS r7 )r� rv )rx r� rE r7 r8 rz j �
��z CVE.notices.<locals>.<listcomp>r c S r� r4 r� ��nr7 r7 r8 r� n r� z CVE.notices.<locals>.<lambda>T�r� �reverse)�hasattrr� rw rW r� rE r7 rE r8 r b �
��z CVE.noticesc C � | j �d�S r� r� rE r7 r7 r8 r� s � zCVE.descriptionc C sb t | d�r| jS i | _t�� j}| jd D ]}|d D ]}|d |kr,t|�| j|d < qq| jS )z�Dict of package status dicts for the current Ubuntu series.
Top-level keys are source packages names and each value is a
CVEPackageStatus object
�_packages_status�packages�statusesr� �name)r� r� r �get_release_info�seriesrw r� )r6 r� rh �
pkg_statusr7 r7 r8 �packages_statusw s
���zCVE.packages_statusN)r; r< r= rH rO r r? r r9 r� r� rM r� r� r r� r r� r� r� r7 r7 r7 r8 rm ? s
rm c @ s� e Zd ZdZdedeeef fdd�Zde fdd�Z
e defd d
��Z e de
e fd d ��Ze de
e fd
d��Ze dd� �Ze dd� �Zdd� Ze deeeeeeef f f fdd��ZdS )r� z7Class representing USN response from the SecurityClientrv rw c C r� r4 r� r� r7 r7 r8 r9 � r: z USN.__init__rS c C r� r� )r� r� rw r� r7 r7 r8 r� � r� z
USN.__eq__c C r� )Nr� �UNKNOWN_USN_IDr� rE r7 r7 r8 r� � r� zUSN.idc C r� )z$List of CVE IDs related to this USN.r� r� rE r7 r7 r8 r� � s z USN.cves_idsc r� ) z�List of CVE instances based on API response 'cves' key.
Cache the values to avoid extra work for multiple call-sites.
�_cvesc r� r7 )rm rv )rx r� rE r7 r8 rz � r� z USN.cves.<locals>.<listcomp>�cvesc S r� r4 r� r� r7 r7 r8 r� � r� zUSN.cves.<locals>.<lambda>Tr� )r� r� rw rW r� rE r7 rE r8 r� � r� zUSN.cvesc C r� )Nr� r� rE r7 r7 r8 r� � r� z USN.titlec C r� )N�
referencesr� rE r7 r7 r8 r� � r� zUSN.referencesc C s� dj | j| jd�g}| jr'|�d� | jD ]}|�d� tjjj |d��� qn| jr<|�d� | jD ] }|�d| � q2d� |�S ) z5Return a string representing the URL for this notice.r� r� z Found CVEs:r� r� zFound Launchpad bugs:z - r� )
r� r� r� r� �appendr r� r� r� r� )r6 r� r� � referencer7 r7 r8 r� � s
���
zUSN.get_url_headerc C sN t | d�r| jS t�� j}i | _| j�di ��|g �D ]�}|�d�rW|d | jv rMd| j|d v rCtjdj | j
|d d�| j
dd ��|| j|d d< qd|i| j|d < q|�d
�smtjd j | j
|d d �| j
dd ��d
|d
vr�tjdj | j
|d |d
d�| j
dd ��|d
� d
�d }|| jvr�i | j|< || j| |d < q| jS )aW Binary package information available for this release.
Reformat the USN.release_packages response to key it based on source
package name and related binary package names.
:return: Dict keyed by source package name. The second-level key will
be binary package names generated from that source package and the
values will be the dict response from USN.release_packages for
that binary package. The binary metadata contains the following
keys: name, version.
Optional additional keys: pocket and component.
�_release_packages�release_packages� is_sourcer� �sourcez6{usn} metadata defines duplicate source packages {pkg})�usnr# � �� error_msgr� �
extra_info� source_linkzL{issue} metadata does not define release_packages source_link for {bin_pkg}.)r� �bin_pkg�/zX{issue} metadata has unexpected release_packages source_link value for {bin_pkg}: {link})r� r �link���) r� r r r� r� rw rW r �SecurityAPIMetadataErrorr� r� �split)r6 r� r# �source_pkg_namer7 r7 r8 r � sR
��
�� ��
zUSN.release_packagesN)r; r< r= rH rO r r? r r9 r� r� rM r� r r� rm r� r� r� r� r r7 r7 r7 r8 r� � s"
,r� rS c C s| d} t �dd| d dg�\}}i }|�� D ]%}|�d�\}}}}|s%|}d|vr*q||v r5||| |< q||i||< q|S )z�Return a dict of all source packages installed on the system.
The dict keys will be source package name: "krb5". The value will be a dict
with keys binary_pkg and version.
z${db:Status-Status}z
dpkg-queryz#-f=${Package},${Source},${Version},r� z-W�,� installed)r �subp�
splitlinesr ) � status_field�out�_err�installed_packages�pkg_line�pkg_namer � pkg_versionr/ r7 r7 r8 �#query_installed_source_pkg_versions s$
�� r �usns� beta_pocketsc s� i }| D ]R}|j �� D ]J\}}� fdd�|�� D �}||vr%|r%|||< q ||v rU|| }|�� D ]#\}} ||vr>| ||< q1|| d }
| d } t�| |
�dkrT| ||< q1q q|S )a Walk related USNs, merging the released binary package versions.
For each USN, iterate over release_packages to collect released binary
package names and required fix version. If multiple related USNs
require different version fixes to the same binary package, track the
maximum version required across all USNs.
:param usns: List of USN response instances from which to calculate merge.
:param beta_pockets: Dict keyed on service name: esm-infra, esm-apps
the values of which will be true of USN response instances
from which to calculate merge.
:return: Dict keyed by source package name. Under each source package will
be a dict with binary package name as keys and binary package metadata
as the value.
c s. i | ]\}}d � � |� dd�d �u r||�qS )Fr� �None�rW )rx � bin_pkg_name�
bin_pkg_md�r r7 r8 �
<dictcomp>F s ��z>merge_usn_released_binary_package_versions.<locals>.<dictcomp>rl r )r �itemsr �version_compare) r r �usn_pkg_versionsr �src_pkg�binary_pkg_versions�public_bin_pkg_versions� usn_src_pkgr �
binary_pkg_md� prev_version�current_versionr7 r$ r8 �*merge_usn_released_binary_package_versions/ s,
�
���r0 c C sn | j sg S i }| j D ] }|jD ]}|�d�sq|| jkr q||vr)|j|d�||< qq
tt|�� dd� d��S )z�For a give usn, get the related USNs for it.
For each CVE associated with the given USN, we capture
other USNs that are related to the CVE. We consider those
USNs related to the original USN.
zUSN-�r� c S r� r4 r� r� r7 r7 r8 r� | r� z"get_related_usns.<locals>.<lambda>r� )r� r� �
startswithr� r� �listr� �values)r rv � related_usnsr� �related_usn_idr7 r7 r8 �get_related_usnsa s
��� r7 �issue_idc C sf t �� }|d ur1|j d ur1|j jd ur1|j jD ]}|j| �� kr0|jr0|j jp(d}tj|f S qdS )NzN/A)NN) r
r/ �fixesr� �lower�patchedrl r1 rI )r8 � lp_status�fixrl r7 r7 r8 � _check_cve_fixed_by_livepatch s
�r> r� r rV �dry_runc C s2 t | |d�}t||�}t� t||||||d�jS )N)r� r �rV r8 �affected_pkg_statusr �usn_released_pkgsr? )�'get_cve_affected_source_packages_statusr0 �print� prompt_for_affected_packagesr/ ) r� r r8 r rV r r? rA rB r7 r7 r8 �_fix_cve� s" ����rF r r5 �
no_relatedc C s� t dtjj|d� � t| |d�}t| g|�} t||||| |d�\}
} |
tjtj fvr-|
S |r1|r3|
S t dtj
jd� dd� |D ��d� � t dtj � i } |D ])}
t d �|
j
�� t|
|d�}t|
g|�} t||
j
||| |d�}|| |
j
< t � qQt tj� t|
|tjd
� d }|D ]D}
| |
j
j}t||
j
tjd
� |tjkr�t d tjjd
d� � d}|tjkr�| |
j
jp�g }|D ]}|jr�t d�|j|j�� q�d}q�|r�t dtjj|d� � |
S )Nr� �r8 �r r r@ z
- c s � � | ]}|j V qd S r4 r� )rx r r7 r7 r8 � <genexpr>� s � z_fix_usn.<locals>.<genexpr>)r5 z- {})�contextF�- �
fix operation�� operationTz
- {}: {})rD r � SECURITY_FIXING_REQUESTED_USNr� � get_affected_packages_from_usnr0 rE r1 rI rJ �SECURITY_RELATED_USNSr� � SECURITY_FIXING_RELATED_USNSr� �SECURITY_USN_SUMMARY�_handle_fix_status_message�FIX_ISSUE_CONTEXT_REQUESTEDr/ �FIX_ISSUE_CONTEXT_RELATEDrL �ENABLE_REBOOT_REQUIRED_TMPLrK r' r$ r# �SECURITY_RELATED_USN_ERROR)r r5 r8 r rV r r? rG rA rB �target_fix_status�_�related_usn_status� related_usn�related_fix_status�failure_on_related_usnr/ r' � unfixed_pkgr7 r7 r8 �_fix_usn� s� ���
� �������
�
�
���
����� ��rb Fc
C sx |rt tj� |�� }t| d�}t� }ttj| �ttj| �d�}d|v rrt |�\}}|r8t tj
j ||d�� |S z|j |d�} |j
|d�}
W n tjy` } z
| jdkrZtj|d��| �d } ~ ww t | �� � t| |
||| ||d �S z
|j|d
�} t| |�}
W n tjy� } z
| jdkr�tj|d��| �d } ~ ww t | �� � | jd s�tjd � |�|d
d��t| |
||| |||d�S )N�rV )r� r� rm )r� rl )r )r� i� rH )r� r r8 r rV r r? r1 r z.{} metadata defines no fixed package versions.r r )r r5 r8 r rV r r? rG )rD r �SECURITY_DRY_RUN_WARNINGr� rO r � _is_pocket_used_by_beta_servicer� r� r> �CVE_FIXED_BY_LIVEPATCHr� r� r� r r| rs �SecurityIssueNotFoundr� rF r� r7 rw r rb )
rV r8 r? rG rv r r �livepatch_cve_status�
patch_versionr� r �er r7 r7 r8 �fix_security_issue_id s�
��� ���
�� �
��
��rk c C s` i }| D ])}t ||��� D ] \}}||vr|||< q
|| j}t�||j�dkr,|||< q
q|S )Nr )rC r& r- r r' )r� r �
affected_pkgsr� r r� � current_verr7 r7 r8 � get_affected_packages_from_cvesv s" �
�
���
rn c C s� i }| j �� D ]6\}}||vrqtt�}d|d< dd� |�� D �}|s0tjd�| j�| jdd��|�� |d< t |d �||< q|S )
Nr� r/ c S s" h | ]
\}}|� d �r|d �qS )r� r! )rx r\ � pkg_bin_infor7 r7 r8 � <setcomp>� s ��z1get_affected_packages_from_usn.<locals>.<setcomp>zC{} metadata defines no pocket information for any release packages.r r r� )r� )
r r& r r? r r r� r� �popr� )r r rl r �pkg_infor� � all_pocketsr7 r7 r8 rR � s& �� rR c C s | j r t| j |�S t| |�S )z�Walk CVEs related to a USN and return a dict of all affected packages.
:return: Dict keyed on source package name, with active CVEPackageStatus
for the current Ubuntu release.
)r� rn rR rI r7 r7 r8 � get_usn_affected_packages_status� s
rt c C s8 i }| j �� D ]\}}|jdkrq||v r|||< q|S )z�Get a dict of any CVEPackageStatuses affecting this Ubuntu release.
:return: Dict of active CVEPackageStatus keyed by source package names.
rB )r� r& r/ )r� r �affected_pkg_versionsr+ �package_statusr7 r7 r8 rC � s
�rC rA c C st t |�}|dkrttj� tdtjj| dd� � dS tj�|�j|d�t |�
� ��d�}tt j |t
dd d
�� dS ) a Print header strings describing affected packages related to a CVE/USN.
:param issue_id: String of USN or CVE issue id.
:param affected_pkg_status: Dict keyed on source package name, with active
CVEPackageStatus for the current Ubuntu release.
r r� r )r� r N�, )�count�pkgs� F)�width�subsequent_indent�replace_whitespace)�lenrD r �SECURITY_NO_AFFECTED_PKGS�SECURITY_ISSUE_UNAFFECTEDr� �SECURITY_AFFECTED_PKGS� pluralizer� r� �keys�textwrap�fillr )r8 rA rx r3 r7 r7 r8 � print_affected_packages_header� s,
��� ���r� r� �usn_src_released_pkgsc C sh t �| �}|r2|�d�r2d|jd< |d d |jd< |�� D ]\}}|�d�}|r1||jd< |S q |S )a� Parse release status based on both pkg_status and USN.release_packages.
Since some source packages in universe are not represented in
CVEPackageStatus, rely on presence of such source packages in
usn_src_released_pkgs to represent package as a "released" status.
:param pkg_status: the CVEPackageStatus for this source package.
:param usn_src_released_pkgs: The USN.release_packages representing only
this source package. Normally, release_packages would have data on
multiple source packages.
:return: Tuple of:
human-readable status message, boolean whether released,
boolean whether the fix requires access to UA
r r� r/ rl r� r� )�copy�deepcopyrW rw r& )r� r� �usn_pkg_statusr �usn_released_pkgr� r7 r7 r8 �#override_usn_release_package_status� s
�
�
�r� c C sd i }t | �� �D ]'\}}|�|i �}t||�}|j�dd�}||vr&g ||< || �||f� q|S )Nr� r� )r� r& rW r� r/ �replacer� )rA rB �
status_groupsr) r� �usn_released_srcr� � status_groupr7 r7 r8 �group_by_usn_package_status s �r� �pkg_status_list� pkg_index�num_pkgsc C s� | sdS g }g }| D ]\}}|d7 }|� d�||�� |� |� q
tjd�dd�|� d d�t|���tdd �}d
�||j�S ) z;Format the packages and status to an user friendly message.r rC z{}/{}z{} {}:�(rw �)rz �r{ r| z{}
{})r� r� r� r� r� r� r r� )r� r� r� � msg_index�src_pkgsr) r� �
msg_headerr7 r7 r8 �_format_packages_message s ��r� r� c C s> d}| t jkr
d}n| t jkrd}t||d�}|r ||�S d S )Nzno-service-neededr� r� )rV r� )r r� r� r )r� rV �service_to_check�ent_clsr7 r7 r8 �_get_service_for_pocket3 s
r� c C s4 t | |�}|r|�� \}}|tjkrdS |j S dS )zBCheck if the pocket where the fix is at belongs to a beta service.F)r� �user_facing_statusr �ACTIVE�
valid_service)r� rV �ent�
ent_statusr\ r7 r7 r8 re > s
re r rL c C s� | t jkr |rtjj||d�}ntjj|d�}tt�|�� d S | t j kr@|r0tj
j||d�}ntj j|d�}tt�|�� d S | t j kr`|rPtj
j||d�}ntjj|d�}tt�|�� d S |rktj
j||d�}ntjj|d�}tt�|�� d S )N)r� rL )r� )r1 rI r �%SECURITY_ISSUE_RESOLVED_ISSUE_CONTEXTr� �SECURITY_ISSUE_RESOLVEDrD r �handle_unicode_charactersrJ �'SECURITY_ISSUE_UNAFFECTED_ISSUE_CONTEXTr� rL �)SECURITY_ISSUE_NOT_RESOLVED_ISSUE_CONTEXT�SECURITY_ISSUE_NOT_RESOLVED)r/ r8 rL r3 r7 r7 r8 rV N s6
�
�
��rV �src_pocket_pkgs�binary_pocket_pkgsc sr d}d}g }t � } |r�tjtjtjfD ]�}
||
} ||
} tjj|
d�� |r�t| ||d�}
|
r=t|
� | s;ttj � qd}g }t
| �D ];}|
tjk}t j |j
|d�}|rdt �|j|�dkrd|�|j
� qCtjj|j
|jd�}td| � |�t|j|d �� qC|t| �7 }t| ||
|d
�}||jM }|jp�d � |s�|�� fd d
�| D �� q| �dd� | D �� qt||| |d�S )a% Handle the packages that could be fixed and have a released status.
:returns: Tuple of
boolean whether all packages were successfully upgraded,
list of strings containing the packages that were not upgraded,
boolean whether all packages were already installed
T��service�r� r� r� F)�check_esm_cacher )rh rl rM �r# r$ )rV � upgrade_pkgsr� r? r c � g | ]
\}}t |� d ��qS �r� �r" �rx r) r\ �� failure_msgr7 r8 rz � s ���z2_handle_released_package_fixes.<locals>.<listcomp>c s rJ r4 )r, )rx r, r7 r7 r8 rK � s �
�z1_handle_released_package_fixes.<locals>.<genexpr>)r& r' r( r) )�setr r� r� r� � SECURITY_UA_SERVICE_REQUIREDr� r� rD �SECURITY_UPDATE_INSTALLEDr� r �get_pkg_candidate_versionr, r' r- r� �FIX_CANNOT_INSTALL_PACKAGEr" r+ r~ �upgrade_packages_and_attachr/ r0 �extendrX r% )rV r� r� r� r� r? r) �upgrade_statusr' r( r� �
pkg_src_group� binary_pkgsr3 r� r, r� �candidate_versionr$ �upgrade_resultr7 r� r8 � _handle_released_package_fixess s� ���
�������� �� �
��
��r� c C sB t dd� | D ��}t|�}tjtj�|�j|d�|�d�t dd�S )z�Format the list of unfixed packages into an message.
:returns: A string containing the message output for the unfixed
packages.
c S s h | ]}|j �qS r7 )r# )rx r# r7 r7 r8 rp � s z/_format_unfixed_packages_msg.<locals>.<setcomp>rw )r� ry rz r� )
r� r~ r� r� r �SECURITY_PKG_STILL_AFFECTEDr� r� r� r )r' � sorted_pkgs�num_pkgs_unfixedr7 r7 r8 � _format_unfixed_packages_msg� s ���r� rB c
s t |�}t||� |dkrttjdd�S tt�}tt�}d} t||�}
g } t|
� � �D ]s\} }
| dkrXtj
}t t |
| |d�� | t |
�7 } |
d d j
� | � fdd�|
D �7 } q+|
D ]C\}}||j �||f� || � � D ].\}}|�|i �}||vr}qn|�|i ��d d
�}t�||�dkr�||j �t|||d �� qnqZq+t| ||| ||d �}| |j7 } t � | r�t t| �� |jr�|jr�| r�tjntj
}n/tj|j d
�r�t j j dd�}t |� t j!t"j#dd� | r�tjntj$}n | r�tjntj
}ntj}t%||� t|| d�S )a Process security CVE dict returning a CVEStatus object.
Since CVEs point to a USN if active, get_notice may be called to fill in
CVE title details.
:returns: An FixStatus enum value corresponding to the system state
after processing the affected packages
r N)r/ r' r� r� rC c r� r� r� r� ��
status_msgr7 r8 rz % s
��z0prompt_for_affected_packages.<locals>.<listcomp>rl r )r+ r, r- )rV r� r� r� r� r? )r( rN rO )&r~ r� rN r1 rJ r r3 r� r� r& rI rD r� r� r� r� rW r r' r* r� r' r� r& r) rK r �
should_rebootr( r rY r� r �addr �ENABLE_REBOOT_REQUIREDrL rV )rV r8 rA r rB r? rx r� r� r� �pkg_status_groupsr' � status_value�pkg_status_group�
fix_resultr) r� r, rl r� r- � released_pkgs_install_result�
reboot_msgr7 r� r8 rE � s�
����
�
� �
������
�������
��
�rE c C s: t � \} }| tv rttjjt�| �t�| �d�� dS dS )z:Alert the user when running Pro on cloud with PRO support.)r� �cloud_specific_urlN)r r rD r �SECURITY_USE_PRO_TMPLr� r rW )�
cloud_typer\ r7 r7 r8 �*_inform_ubuntu_pro_existence_if_applicable s
���r� �tokenc
C s� ddl }ddlm} ttdd|gg�� z|�|j|dddd�| �}|dkW S tjy? } z t|j � W Y d}~d S d}~ww )
ztAttach to an Ubuntu Pro subscription with a given token.
:return: True if attach performed without errors.
r N��cli�pro�attachTr� )r� � auto_enabler� �
attach_configF)
�argparse�uaclientr� rD r! �
action_attach� Namespacer �UbuntuProErrorr3 )rV r� r� r� �ret_code�errr7 r7 r8 �_run_ua_attach� s ��
��r� c
C s� t tj� t| d�}t dtjj|jd� � t|jd�}zt || d�}W n t
j yD } zt tj � t
|jd�}t|| d� |�d }~ww t dtj � t| |j�S )Nrc r� )� user_code)� magic_token)�optionsrV )rD r �CLI_MAGIC_ATTACH_INITr �CLI_MAGIC_ATTACH_SIGN_INr� r� r r� r r �MagicAttachTokenError�CLI_MAGIC_ATTACH_FAILEDr r �CLI_MAGIC_ATTACH_PROCESSINGr� �contract_token)rV �
initiate_resp� wait_options� wait_resprj �revoke_optionsr7 r7 r8 �_perform_magic_attach� s.
���
� �� r� c C sh t � ttj� tjtjg d�d�}|dkrdS |dkr t| �S |dkr2ttj� t d�}t
| |�S dS ) zZPrompt for attach to a subscription or token.
:return: True if attach performed.
)�s�a�c��
valid_choicesr� Fr� r� �> T) r� rD r �*SECURITY_UPDATE_NOT_INSTALLED_SUBSCRIPTIONr �prompt_choices�SECURITY_FIX_ATTACH_PROMPTr� �PROMPT_ENTER_TOKEN�inputr� )rV �choicer� r7 r7 r8 �_prompt_for_attach� s
�
r r� c C s� ddl }ddlm} ttjj|d�� tjtj j|d�ddgd�}|dkrBtt
dd |gg�� t d|� |j
|gd
d d d d
�| �k�S d S )zMPrompt for enable a pro service.
:return: True if enable performed.
r Nr� r� rj r� r� r� �enableTFr� )r� �
assume_yes�betar� � access_only)r� r� r� rD r �SECURITY_SERVICE_DISABLEDr� r r� �SECURITY_FIX_ENABLE_PROMPTr! r� �
action_enabler� )rV r� r� r� r r7 r7 r8 �_prompt_for_enable� s0 �����r c C s |r t dtj � dS t| �S )z<Verify if machine is attached to an Ubuntu Pro subscription.r� T)rD r � SECURITY_DRY_RUN_UA_NOT_ATTACHEDr )rV r? r7 r7 r8 �_check_attached� s r c C s� t | |�}|rM|�� \}}|tjkrdS |�� \}}|tjkrC|r/tdtj j
|j d� � dS t ||j �r7dS ttj
j
|j d�� dS ttjj
|j d�� dS )zQ
Verify if the Ubuntu Pro subscription has the required service enabled.
Tr� r� F)r� r� r r� �applicability_statusr �
APPLICABLErD r �'SECURITY_DRY_RUN_UA_SERVICE_NOT_ENABLEDr� r� r � SECURITY_UA_SERVICE_NOT_ENABLED� SECURITY_UA_SERVICE_NOT_ENTITLED)r� rV r? r� r� r\ r r7 r7 r8 �(_check_subscription_for_required_service� s<
��� �� ���r c C s� ddl }ddlm} t� ttj� tjtj ddgd�}|dkrBttj
� t d�}tt dd gg�� |�
|jd
d d �| � t| |�S d
S )zdPrompt for attach a new subscription token to the user.
:return: True if attach performed.
r Nr� �rr� r� r� r� �detachTr� )r r� F)r� r� r� r� rD r �%SECURITY_UPDATE_NOT_INSTALLED_EXPIREDr r� �SECURITY_FIX_RENEW_PROMPT�PROMPT_EXPIRED_ENTER_TOKENr� r! �
action_detachr� r� )rV r� r� r r� r7 r7 r8 �_prompt_for_new_token) s"
�
�
r � status_cachec C sV | � dd�}|s
dS | � d�}|du s|t�|j�k r)|r$ttj� dS t|� S dS )zuCheck if the Ubuntu Pro subscription is expired.
:returns: True if subscription is expired and not renewed.
�attachedF�expiresN)rW r �now�tzinforD r �(SECURITY_DRY_RUN_UA_EXPIRED_SUBSCRIPTIONr )r rV r? r �contract_expiry_datetimer7 r7 r8 � _check_subscription_is_expiredD s
�
r r� c
C sj |st ddd�S t�� s|stj}t|� t d|d�S |tjkra| �d�p&i }|�dd�s>t | |�s=t dtj
j |d�d�S nt || |d�rPt dtj
j |d�d�S t|| |�sat dtjj |d�d�S ttg d �g d
� t|� g�� |s�zt�� tjg d �| d d
id� W n' ty� } zt|dt|��}t|�� � t dtjd�W Y d}~S d}~ww t ddd�S )a Upgrade available packages to fix a CVE.
Upgrade all packages in upgrades_packages and, if necessary,
prompt regarding system attach prior to upgrading Ubuntu Pro packages.
:return: True if package upgrade completed or unneeded, False otherwise.
TN)r/ r0 Fz status-cacher r� )r rV r? )r rX z&&)r �install�--only-upgrade�-y)zapt-getr! r" r# �DEBIAN_FRONTEND�noninteractive)�cmd�override_env_varsr3 )r. r �we_are_currently_rootr �SECURITY_APT_NON_ROOTrD r� �
read_cacherW r r� r� r �$SECURITY_UA_SERVICE_WITH_EXPIRED_SUBr �%SECURITY_UA_SERVICE_NOT_ENABLED_SHORTr! r� r �run_apt_update_command�run_apt_command� Exception�getattrr? �strip�SECURITY_UA_APT_FAILURE)rV r� r� r? r3 r rj r7 r7 r8 r� ^ sz
������ �������
�
� ��� r� )FF)r )rS N)fr� �enumr� r� � collectionsr r �typingr r r r r r r
r� r r r
r r r �+uaclient.api.u.pro.attach.magic.initiate.v1r �)uaclient.api.u.pro.attach.magic.revoke.v1r r �'uaclient.api.u.pro.attach.magic.wait.v1r r �uaclient.clouds.identityr r r �uaclient.configr �uaclient.defaultsr �uaclient.entitlementsr �(uaclient.entitlements.entitlement_statusr r �uaclient.filesr �uaclient.files.noticesr �
uaclient.httpr �uaclient.statusr! �CVE_OR_USN_REGEXr{ r� r� r� r? r" r� r% r* r. �Enumr1 rN �UAServiceClientrO r� rm r� r r0 r7 r> rF rb rk rn rR rt rC r� r� r� r> r� r� re rV r� r� rE r� r� r� r r r r r r r� r7 r7 r7 r8 �<module> s� $ ���
�� ��
�� �� HL �
�
�2 �
������
��
������
���
�t�����
�Y ��
���
��
�!��
�#���
� ���
�%������
�s��
����
�
"���
�+
���
������