Your IP : 216.73.216.52
U
8�-d� � @ s� d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dlm Z m
Z
m Z m Z m
Z
mZmZ d dlmZmZmZmZmZmZ d dlmZ d dlmZmZ d dl m Z m Z d d l m Z m!Z!m"Z" d d
l#m$Z$ d d l%m&Z&m'Z' d d l(m)Z) d d
l*m+Z+m,Z, d dl-m.Z. d dl/m0Z0 d dl1m2Z2 dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:e dde;fdee< fd ee< fd e;fg�Z=e d d e<fd e<fd!e<fg�Z>ej?G d"d#� d#ej@��ZAG d$d%� d%ejB�ZCG d&d'� d'�ZDG d(d)� d)�ZEG d*d+� d+�ZFe
e<e
e<e<f f d,�d-d.�ZGe eF e
e<e;f e
e<e
e<e
e<e<f f f d/�d0d1�ZHd2d3� ZIdxe$e<e;eAd5�d6d7�ZJd8d9� ZKd:d;� ZLeFe
e<e
e<e<f f e
e<eDf d<�d=d>�ZMeEe
e<e
e<e<f f e
e<eDf d?�d@dA�ZNe<e
e<eDf dB�dCdD�ZOeDe
e<e
e<e<f f eDdE�dFdG�ZPdHdI� ZQe ee<eDf eReRe<dJ�dKdL�ZSe<e$dM�dNdO�ZTe<e$e;dP�dQdR�ZUe$e
e<e ee<eDf f e
e<e e> f eReRe;e=dS�dTdU�ZVe e< e<dV�dWdX�ZWe$e<e
e<eDf e
e<e
e<e<f f e
e<e
e<e
e<e<f f f e;eAdY�dZd[�ZXdd,�d\d]�ZYe$e<e;d^�d_d`�ZZe$da�dbdc�Z[e$e;dd�dedf�Z\e$e<e;dg�dhdi�Z]e$e;e;dj�dkdl�Z^e<e$e;e;dm�dndo�Z_e$e;dd�dpdq�Z`e
e<e f e$e;e;dr�dsdt�Zae$e e< e<e;e;du�dvdw�ZbdS )y� N)� defaultdict)�datetime)�Any�Dict�List�
NamedTuple�Optional�Set�Tuple)�apt�
exceptions�messages�
serviceclient�system�util)� _initiate)�MagicAttachRevokeOptions�_revoke)�MagicAttachWaitOptions�_wait)�CLOUD_TYPE_TO_TITLE�
PRO_CLOUDS�get_cloud_type)�UAConfig)� BASE_UA_URL�PRINT_WRAP_WIDTH)�entitlement_factory)�ApplicabilityStatus�UserFacingStatus)�notices)�Notice)�colorize_commandsz=((CVE|cve)-\d{4}-\d{4,7}$|(USN|usn|LSN|lsn)-\d{1,5}-\d{1,2}$)z cves.jsonzcves/{cve}.jsonz notices.jsonznotices/{notice}.jsonzUbuntu standard updateszUbuntu Pro: ESM InfrazUbuntu Pro: ESM Apps� ReleasedPackagesInstallResult�
fix_status� unfixed_pkgs�installed_pkgs�all_already_installed�BinaryPackageFix�
source_pkg�
binary_pkg�
fixed_versionc @ s e Zd ZdZdZdZdZdS )� FixStatuszD
An enum to represent the system status after fix operation
r � � N)�__name__�
__module__� __qualname__�__doc__�SYSTEM_NON_VULNERABLE�SYSTEM_STILL_VULNERABLE� SYSTEM_VULNERABLE_UNTIL_REBOOT� r5 r5 �3/usr/lib/python3/dist-packages/uaclient/security.pyr+ G s r+ c s� e Zd ZdZdZejZee e
f ee e
f d�dd�Z e j
ejdddgd �d� fd d � �Zd ee ee ee ee ee ee ee eee ed
d� dd�Ze d
d�dd�Zd ee ee ee ee ee ed d�dd�Ze dd�dd�Z� ZS ) �UASecurityClient� Z security_url)� query_params�returnc C s. | j j �di ��di �}|r*|�|� |S |S )zD
Update query params with data from feature config.
Zfeatures�extra_security_params)�cfg�get�update)�selfr9 r; r5 r5 r6 �_get_query_paramsX s �
z"UASecurityClient._get_query_paramsr, � � )Z retry_sleepsNc s" | � |�}t� j|||||dd�S )NF)�path�data�headers�methodr9 Zlog_response_body)r@ �super� request_url)r? rC rD rE rF r9 �� __class__r5 r6 rH h s
�z UASecurityClient.request_url�CVE) �query�priority�package�limit�offset� component�version�statusr: c s: ||||||||d�} � j t| d�\}
} � fdd�|
D �S )znQuery to match multiple-CVEs.
@return: List of CVE instances based on the the JSON response.
)�qrM rN rO rP rQ rR rS �r9 c s g | ]}t � |d ��qS )��client�response)rK )�.0Zcve_md�r? r5 r6 �
<listcomp>� s z-UASecurityClient.get_cves.<locals>.<listcomp>)rH � API_V1_CVES) r? rL rM rN rO rP rQ rR rS r9 Z
cves_response�_headersr5 rZ r6 �get_cvesv s �
�
zUASecurityClient.get_cves)�cve_idr: c C s" | � tj|d��\}}t| |d�S )zkQuery to match single-CVE.
@return: CVE instance for JSON response from the Security API.
)�cverV )rH �API_V1_CVE_TMPL�formatrK )r? r_ � cve_responser] r5 r5 r6 �get_cve� s
�zUASecurityClient.get_cve�USN)�details�releaserO rP �orderr: c sJ � ||||d�}�j t|d�\}}t� �fdd�|�dg �D �dd� d�S ) zuQuery to match multiple-USNs.
@return: Sorted list of USN instances based on the the JSON response.
)rf rg rO rP rh rU c s0 g | ](}� d ks � |� dg �krt�|d��qS )N�cves_idsrV )r= re )rY Zusn_md�rf r? r5 r6 r[ � s �z0UASecurityClient.get_notices.<locals>.<listcomp>r c S s | j S �N��id��xr5 r5 r6 �<lambda>� � z.UASecurityClient.get_notices.<locals>.<lambda>��key)rH �API_V1_NOTICES�sortedr= ) r? rf rg rO rP rh r9 Z
usns_responser] r5 rj r6 � get_notices� s
� �
��z UASecurityClient.get_notices)� notice_idr: c C s" | � tj|d��\}}t| |d�S )zbQuery to match single-USN.
@return: USN instance representing the JSON response.
)�noticerV )rH �API_V1_NOTICE_TMPLrb re )r? rw Znotice_responser] r5 r5 r6 �
get_notice� s
�zUASecurityClient.get_notice)NNNN)NNNNNNNN)NNNNN)r. r/ r0 Z url_timeoutZcfg_url_base_attrr �SecurityAPIErrorZ
api_error_clsr �strr r@ r Zretry�socketZtimeoutrH r �intr r^ rd rv rz �
__classcell__r5 r5 rI r6 r7 R s\
� � �
� �� r7 c @ s� e Zd ZdZeeef d�dd�Zedd� �Z edd� �Z
ed d
� �Z ed d � �Z ed
d� �Z
edd� �Zeed�dd��Zedd� �ZdS )�CVEPackageStatuszAClass representing specific CVE PackageStatus on an Ubuntu series�rc c C s
|| _ d S rk �rX )r? rc r5 r5 r6 �__init__� s zCVEPackageStatus.__init__c C s
| j d S �N� descriptionr� rZ r5 r5 r6 r� � s z CVEPackageStatus.descriptionc C s | j S rk )r� rZ r5 r5 r6 r* � s z CVEPackageStatus.fixed_versionc C s
| j d S )N�pocketr� rZ r5 r5 r6 r� � s zCVEPackageStatus.pocketc C s
| j d S )N�release_codenamer� rZ r5 r5 r6 r� � s z!CVEPackageStatus.release_codenamec C s
| j d S )NrS r� rZ r5 r5 r6 rS � s zCVEPackageStatus.statusc C sz | j dkrdS | j dkr dS | j dkr*dS | j dkr8dS | j d krFd
S | j d krTd S | j d
krntjj| jd�S d�| j �S )NZneededz Sorry, no fix is available yet.z needs-triagez7Ubuntu security engineers are investigating this issue.�pendingz)A fix is coming soon. Try again tomorrow.)�ignored�deferredzSorry, no fix is available.ZDNEz.Source package does not exist on this release.� not-affectedz/Source package is not affected on this release.�released)Z
fix_streamz UNKNOWN: {})rS r
ZSECURITY_FIX_RELEASE_STREAMrb �
pocket_sourcerZ r5 r5 r6 �status_message� s"
�z CVEPackageStatus.status_message�r: c C s t | jtk�S )z?Return True if the package requires an active Pro subscription.)�boolr� � UBUNTU_STANDARD_UPDATES_POCKETrZ r5 r5 r6 � requires_ua� s z CVEPackageStatus.requires_uac C sH | j dkrt}n4| j dkr t}n$| j dkr0t}nd| jkr@t}nt}|S )z>Human-readable string representing where the fix is published.� esm-infra�esm-apps)ZupdatesZsecurityZesm)r� �UA_INFRA_POCKET�UA_APPS_POCKETr� r* )r? Z
fix_sourcer5 r5 r6 r� � s
z CVEPackageStatus.pocket_sourceN)r. r/ r0 r1 r r| r r� �propertyr� r* r� r� rS r� r� r� r� r5 r5 r5 r6 r� � s$
r� c @ s� e Zd ZdZeeeef d�dd�Ze d�dd�Z
e dd � �Z d
d � Z
e ee d�d d
��Ze ed d�dd��Ze dd� �Ze eeef d�dd��ZdS )rK z7Class representing CVE response from the SecurityClientrV c C s || _ || _d S rk �rX rW �r? rW rX r5 r5 r6 r� s z CVE.__init__r� c C s t |t�sdS | j|jkS �NF)�
isinstancerK rX �r? �otherr5 r5 r6 �__eq__ s
z
CVE.__eq__c C s | j �dd��� S )Nrm ZUNKNOWN_CVE_ID�rX r= �upperrZ r5 r5 r6 rm s zCVE.idc C sB | j }| jD ]}|j} q q dj| j|d�d�| j�g}d�|�S )z2Return a string representing the URL for this cve.�{issue}: {title}��issue�title�! - https://ubuntu.com/security/{}�
)r� r r� rb rm �join)r? r� rx �linesr5 r5 r6 �get_url_header s
�zCVE.get_url_headerc C s | j �dg �S )N� notices_ids�rX r= rZ r5 r5 r6 r� + s zCVE.notices_idsre c s< t � d�s6t� fdd�� j�dg �D �dd� dd�� _� jS ) z�Return a list of USN instances from API response 'notices'.
Cache the value to avoid extra work on multiple calls.
�_noticesc s g | ]}t � j|��qS r5 )re rW )rY rx rZ r5 r6 r[ 7 s �z CVE.notices.<locals>.<listcomp>r c S s | j S rk rl ��nr5 r5 r6 rp ; rq z CVE.notices.<locals>.<lambda>T�rs �reverse)�hasattrru rX r= r� rZ r5 rZ r6 r / s
��z CVE.noticesc C s | j �d�S r� r� rZ r5 r5 r6 r� @ s zCVE.descriptionc C sd t | d�r| jS i | _t�� d }| jd D ]0}|d D ]"}|d |kr8t|�| j|d < q8q,| jS )z�Dict of package status dicts for the current Ubuntu series.
Top-level keys are source packages names and each value is a
CVEPackageStatus object
�_packages_status�seriesZpackagesZstatusesr� �name)r� r� r �get_platform_inforX r� )r? r� rN �
pkg_statusr5 r5 r6 �packages_statusD s
�zCVE.packages_statusN)r. r/ r0 r1 r7 r r| r r� r� r� r� rm r� r r� r r� r� r� r5 r5 r5 r6 rK s
rK c @ s� e Zd ZdZeeeef d�dd�Ze d�dd�Z
e ed�dd ��Z e e
e d�d
d ��Ze e
e d�d d
��Ze dd� �Ze dd� �Zdd� Ze eeeeeeef f f d�dd��ZdS )re z7Class representing USN response from the SecurityClientrV c C s || _ || _d S rk r� r� r5 r5 r6 r� [ s z USN.__init__r� c C s t |t�sdS | j|jkS r� )r� re rX r� r5 r5 r6 r� _ s
z
USN.__eq__c C s | j �dd��� S )Nrm ZUNKNOWN_USN_IDr� rZ r5 r5 r6 rm d s zUSN.idc C s | j �dg �S )z$List of CVE IDs related to this USN.ri r� rZ r5 r5 r6 ri h s z USN.cves_idsc s< t � d�s6t� fdd�� j�dg �D �dd� dd�� _� jS ) z�List of CVE instances based on API response 'cves' key.
Cache the values to avoid extra work for multiple call-sites.
�_cvesc s g | ]}t � j|��qS r5 )rK rW )rY r` rZ r5 r6 r[ u s �z USN.cves.<locals>.<listcomp>�cvesc S s | j S rk rl r� r5 r5 r6 rp y rq zUSN.cves.<locals>.<lambda>Tr� )r� ru rX r= r� rZ r5 rZ r6 r� m s
��zUSN.cvesc C s | j �d�S )Nr� r� rZ r5 r5 r6 r� ~ s z USN.titlec C s | j �d�S )N�
referencesr� rZ r5 r5 r6 r� � s zUSN.referencesc C sv dj | j| jd�g}| jrB|�d� | jD ]}|�d� |�� q*n*| jrl|�d� | jD ]}|�d| � qXd�|�S )z5Return a string representing the URL for this notice.r� r� z Found CVEs:r� zFound Launchpad bugs:z - r� )rb rm r� ri �appendr� r� )r? r� r` Z referencer5 r5 r6 r� � s
zUSN.get_url_headerc C sR t | d�r| jS t�� d }i | _| j�di ��|g �D �]}|�d�r�|d | jkr�d| j|d kr�tjdj| j |d d�| j d ��|| j|d d< nd|i| j|d < q8|�d
�s�tjd j| j |d d �| j d ��n4d
|d
k�rtjdj| j |d |d
d�| j d ��|d
�
d
�d }|| jk�r8i | j|< || j| |d < q8| jS )aW Binary package information available for this release.
Reformat the USN.release_packages response to key it based on source
package name and related binary package names.
:return: Dict keyed by source package name. The second-level key will
be binary package names generated from that source package and the
values will be the dict response from USN.release_packages for
that binary package. The binary metadata contains the following
keys: name, version.
Optional additional keys: pocket and component.
�_release_packagesr� �release_packagesZ is_sourcer� �sourcez6{usn} metadata defines duplicate source packages {pkg})�usn�pkg��issue_idZ source_linkzL{issue} metadata does not define release_packages source_link for {bin_pkg}.)r� �bin_pkg�/zX{issue} metadata has unexpected release_packages source_link value for {bin_pkg}: {link})r� r� �link���) r� r� r r� rX r= r �SecurityAPIMetadataErrorrb rm �split)r? r� r� �source_pkg_namer5 r5 r6 r� � sN
��
����
zUSN.release_packagesN)r. r/ r0 r1 r7 r r| r r� r� r� r� rm r ri rK r� r� r� r� r� r5 r5 r5 r6 re X s
re r� c C s| d} t �dd| d dg�\}}i }|�� D ]J}|�d�\}}}}|sJ|}d|krTq,||krj||| |< q,||i||< q,|S )z�Return a dict of all source packages installed on the system.
The dict keys will be source package name: "krb5". The value will be a dict
with keys binary_pkg and version.
z${db:Status-Status}z
dpkg-queryz#-f=${Package},${Source},${Version},r� z-W�,Z installed)r �subp�
splitlinesr� ) Z status_field�outZ_err�installed_packagesZpkg_line�pkg_namer� Z pkg_versionrS r5 r5 r6 �#query_installed_source_pkg_versions� s$
�� r� )�usns� beta_pocketsr: c s� i }| D ]�}|j �� D ]�\}}� fdd�|�� D �}||krJ|rJ|||< q||kr|| }|�� D ]D\}} ||kr|| ||< qb|| d }
| d } t�| |
d�sb| ||< qbqq|S )a Walk related USNs, merging the released binary package versions.
For each USN, iterate over release_packages to collect released binary
package names and required fix version. If multiple related USNs
require different version fixes to the same binary package, track the
maximum version required across all USNs.
:param usns: List of USN response instances from which to calculate merge.
:param beta_pockets: Dict keyed on service name: esm-infra, esm-apps
the values of which will be true of USN response instances
from which to calculate merge.
:return: Dict keyed by source package name. Under each source package will
be a dict with binary package name as keys and binary package metadata
as the value.
c s. i | ]&\}}d � � |� dd�d �kr||�qS )Fr� �None�r= )rY Z bin_pkg_nameZ
bin_pkg_md�r� r5 r6 �
<dictcomp> s �� z>merge_usn_released_binary_package_versions.<locals>.<dictcomp>rR �le)r� �itemsr �compare_versions) r� r� Zusn_pkg_versionsr� �src_pkgZbinary_pkg_versionsZpublic_bin_pkg_versionsZ usn_src_pkgr� Z
binary_pkg_mdZ prev_versionZcurrent_versionr5 r� r6 �*merge_usn_released_binary_package_versions� s,
�
�r� c C sX | j s | gS i }| j D ](}|jD ] }||kr |j|d�||< q qtt|�� dd� d��S )z�For a give usn, get the related USNs for it.
For each CVE associated with the given USN, we capture
other USNs that are related to the CVE. We consider those
USNs related to the original USN.
�rw c S s | j S rk rl rn r5 r5 r6 rp 8 rq z"get_related_usns.<locals>.<lambda>rr )r� r� rz �listru �values)r� rW Z related_usnsr` Zrelated_usn_idr5 r5 r6 �get_related_usns" s
�r� F)r< r� �dry_runr: c
s` |rt tj� � �� � t| d�}t� }tt| �tt| �d�}d� k�r�d }zt �
ddddg�\}}W n t j k
rz Y nX |�rzdt
�|�d d d
}|r�|�d g �} t� fd d
�| D ��r�t tjj� |�dd�d�� tjW S W n tttfk
�r Y nX z |j� d�}
|j� d�} W nT t jk
�rt } z2t| �}
d|
� � k�rZtj j� d�}
t � |
��W 5 d } ~ X Y nX t |
|d�}t |
� � � t!| |�}n�z|j"� d�}t#||�} W nT t jk
�r } z2t| �}
d|
� � k�r�tj j� d�}
t � |
��W 5 d } ~ X Y nX t$||d�}t!| |�}t |� � � |j%d �sLt j&d�� �� d��t'| � ||||d�S )N�r< )r� r� rK zcanonical-livepatchrS z --verbosez
--format=jsonZStatusr Z LivepatchZFixesc 3 s& | ] }|d � � � ko |d V qdS )�NameZPatchedN)�lower)rY Zfixr� r5 r6 � <genexpr>a s �z(fix_security_issue_id.<locals>.<genexpr>ZVersionzN/A)r� rR )r_ )rf z not foundr� )r` r� r� �r� r� r� z.{} metadata defines no fixed package versions.)r< r� �affected_pkg_statusr� �usn_released_pkgsr� )(�printr
ZSECURITY_DRY_RUN_WARNINGr� r7 r� � _is_pocket_used_by_beta_servicer� r� r r� r ZProcessExecutionError�json�loadsr= �anyZCVE_FIXED_BY_LIVEPATCHrb r+ r2 �
ValueError�KeyError�
IndexErrorrd rv r{ r| r� Z SECURITY_FIX_NOT_FOUND_ISSUE�UserFacingError�'get_cve_affected_source_packages_statusr� r� rz r� � get_usn_affected_packages_statusrX r� � prompt_for_affected_packages)r< r� r� rW r� r� Z
status_stdout�_Z parsed_patch�fixesr` r� �e�msgr� r� r� r5 r� r6 �fix_security_issue_id; s�
�
�� � �
�� � � � � � � ���r� c C s^ i }| D ]P}t ||��� D ]<\}}||kr4|||< q|| j}t�||jd�s|||< qq|S )Nr� )r� r� r* r r� )r� r� �
affected_pkgsr` r� r� Z current_verr5 r5 r6 � get_affected_packages_from_cves� s �
� r� c C s� i }| j �� D ]n\}}||kr qtt�}d|d< dd� |�� D �}|sbd}tj|�| j�| jd��|�� |d< t |d�||< q|S ) Nr� rS c S s" h | ]\}}|� d �r|d �qS )r� r� )rY r� Z pkg_bin_infor5 r5 r6 � <setcomp>� s
�z1get_affected_packages_from_usn.<locals>.<setcomp>zC{} metadata defines no pocket information for any release packages.r� r� r� )
r� r� r r| r r� rb rm �popr� )r� r� r� r� Zpkg_inforc Z all_pocketsr� r5 r5 r6 � get_affected_packages_from_usn� s& ��
� r� )r� r� r: c C s | j rt| j |�S t| |�S dS )z�Walk CVEs related to a USN and return a dict of all affected packages.
:return: Dict keyed on source package name, with active CVEPackageStatus
for the current Ubuntu release.
N)r� r� r� r� r5 r5 r6 r� � s r� )r` r� r: c C s8 i }| j �� D ]$\}}|jdkr"q||kr|||< q|S )z�Get a dict of any CVEPackageStatuses affecting this Ubuntu release.
:return: Dict of active CVEPackageStatus keyed by source package names.
r� )r� r� rS )r` r� Zaffected_pkg_versionsr( Zpackage_statusr5 r5 r6 r� � s
r� )r� r� c C s� t |�}|dkrFtdtjjddd� d � tdtjj| d� � dS |d krTd
}nd}dtjj||d� d d �t|�� �� }tt j
|t d
dd�� dS )a Print header strings describing affected packages related to a CVE/USN.
:param issue_id: String of USN or CVE issue id.
:param affected_pkg_status: Dict keyed on source package name, with active
CVEPackageStatus for the current Ubuntu release.
r r� ZNozs are)�count�
plural_str�.�r� Nr, z isz: �, � F)�width�subsequent_indentZreplace_whitespace) �lenr� r
ZSECURITY_AFFECTED_PKGSrb ZSECURITY_ISSUE_UNAFFECTEDr� ru �keys�textwrap�fillr )r� r� r� r� r� r5 r5 r6 � print_affected_packages_header� sH ���� �������r
)r� �usn_src_released_pkgsr: c C sf t �| �}|rb|�d�rbd|jd< |d d |jd< |�� D ]$\}}|�d�}|r<||jd< qbq<|S )a� Parse release status based on both pkg_status and USN.release_packages.
Since some source packages in universe are not represented in
CVEPackageStatus, rely on presence of such source packages in
usn_src_released_pkgs to represent package as a "released" status.
:param pkg_status: the CVEPackageStatus for this source package.
:param usn_src_released_pkgs: The USN.release_packages representing only
this source package. Normally, release_packages would have data on
multiple source packages.
:return: Tuple of:
human-readable status message, boolean whether released,
boolean whether the fix requires access to UA
r� r� rS rR r� r� )�copy�deepcopyr= rX r� )r� r �usn_pkg_statusr� Zusn_released_pkgr� r5 r5 r6 �#override_usn_release_package_status s
��
r c C sd i }t | �� �D ]N\}}|�|i �}t||�}|j�dd�}||krLg ||< || �||f� q|S )Nr� r� )ru r� r= r rS �replacer� )r� r� Z
status_groupsr� r� �usn_released_srcr Z status_groupr5 r5 r6 �group_by_usn_package_statusC s �r )�pkg_status_list� pkg_index�num_pkgsr: c C s� | sdS g }g }| D ],\}}|d7 }|� d�||�� |� |� qtjd�dd�|� d d�t|���tdd �}d
�||j�S ) z;Format the packages and status to an user friendly message.� r, z{}/{}z{} {}:�(r �)r �r r z{}
{})r� rb r r r� ru r r� )r r r Z msg_indexZsrc_pkgsr� r� Z
msg_headerr5 r5 r6 �_format_packages_messageQ s" ��r )r� r< c C s: d}| t krd}n | tkr d}t||d�}|r6||�S d S )Nzno-service-neededr� r� )r< r� )r� r� r )r� r< Zservice_to_checkZent_clsr5 r5 r6 �_get_service_for_pocketk s r )r� r< r: c C s4 t | |�}|r0|�� \}}|tjkr(dS |j S dS )zBCheck if the pocket where the fix is at belongs to a beta service.F)r �user_facing_statusr �ACTIVEZ
valid_service)r� r< �ent�
ent_statusr� r5 r5 r6 r� v s
r� )r< �src_pocket_pkgs�binary_pocket_pkgsr r r� r: c C s4 d}d}t � }t � } |�r$tttfD ]�}
||
} ||
} |r�t| ||d�}
|
rlt|
� | shttj� q$nd}g }| D ]\}t� |j
�}|r�t� |j |d�r�|�
|j
� qttdtjj|j
|j d�j � |�|j� qt|t| �7 }|t| ||
|d�M }|�s|�dd � | D �� q$| �d
d � | D �� q$t||| |d �S )
a% Handle the packages that could be fixed and have a released status.
:returns: Tuple of
boolean whether all packages were successfully upgraded,
list of strings containing the packages that were not upgraded,
boolean whether all packages were already installed
T�r r r Fr� z- )rN rR )r< � upgrade_pkgsr� r� c S s g | ] \}}|�qS r5 r5 �rY r� r� r5 r5 r6 r[ � s z2_handle_released_package_fixes.<locals>.<listcomp>c s s | ] }|j V qd S rk )r) )rY r) r5 r5 r6 r� � s z1_handle_released_package_fixes.<locals>.<genexpr>)r# r$ r% r& )�setr� r� r� r r� r
ZSECURITY_UPDATE_INSTALLEDr Zget_pkg_candidate_versionr) r� r* r� ZFIX_CANNOT_INSTALL_PACKAGErb r� �addr( r �upgrade_packages_and_attachr> r" )r< r r! r r r� r& Zupgrade_statusr$ r% r� Z
pkg_src_groupZ binary_pkgsr� r# r) Zcandidate_versionr5 r5 r6 � _handle_released_package_fixes� sz ��
� ���� �
�
�r( )r$ r: c
C sF t | �}tjd�||dkr dnd|dkr,dndd�t| ���tdd �S )
z�Format the list of unfixed packages into an message.
:returns: A string containing the message output for the unfixed
packages.
z"{} package{} {} still affected: {}r, �sr Zare�isr r r )r r r rb r� ru r )r$ Znum_pkgs_unfixedr5 r5 r6 � _format_unfixed_packages_msg� s ��r+ )r< r� r� r� r� r� r: c
C s� t |�}t||� |dkr tjS tjj|d�}tt�}tt�} d}
t ||�} g } t
| � � �D �]\}
}|
dkr�tj j|d�}t
t||
|d�� |
t |�7 }
| dd� |D �7 } q\|D ]�\}}||j �||f� || � � D ]�\}}|�|i �}||k�r0| dd� |D �7 } dj||d �}|t| �7 }t�||��|�|i ��d
d �}t�||d �s�| |j �t|||d
�� q�q�q\t| || |
||d�}| |j7 } t
� | �r�t
t| �� tj j|d�}|j�rh|j�r�t
t � |�� | �r�tj S tjS t j |j!d��rFtj"jdd�}t
|� t#j$t%j&dd� t
t � tj j|d��� | �r@tj S tj'S t
t � |�� | �r`tj S tjS n t
t � tj j|d��� tj S dS )a Process security CVE dict returning a CVEStatus object.
Since CVEs point to a USN if active, get_notice may be called to fill in
CVE title details.
:returns: An FixStatus enum value corresponding to the system state
after processing the affected packages
r r r� r" c S s g | ] \}}|�qS r5 r5 r$ r5 r5 r6 r[ s z0prompt_for_affected_packages.<locals>.<listcomp>c S s g | ] \}}|�qS r5 r5 r$ r5 r5 r6 r[ & s z5{issue} metadata defines no fixed version for {pkg}.
)r� r� rR r r� )r( r) r* )r< r r! r r r� )r% z
fix operation)Z operationN)(r r
r+ r2 r
ZSECURITY_ISSUE_RESOLVEDrb r r� r ru r� ZSECURITY_ISSUE_NOT_RESOLVEDr� r r� r� r= r+ r r� r r� r' r( r$ r# r& r Zhandle_unicode_charactersr3 r Z
should_rebootr% ZENABLE_REBOOT_REQUIRED_TMPLr r& r ZENABLE_REBOOT_REQUIREDr4 )r< r� r� r� r� r� r� Z fix_messager r! r Zpkg_status_groupsr$ Z status_valueZpkg_status_groupr� r� r) rR r r� r* Z released_pkgs_install_resultZ
reboot_msgr5 r5 r6 r� � s�
����
�
� �� � �
��
�
��
���� ���
��
� ��r� c C s0 t � \} }| tkr,ttjjt�| �| d�� dS )z:Alert the user when running Pro on cloud with PRO support.)r� ZcloudN)r r r� r
ZSECURITY_USE_PRO_TMPLrb r r= )Z
cloud_typer� r5 r5 r6 �*_inform_ubuntu_pro_existence_if_applicable� s
��r, )r< �tokenr: c
C s� ddl }ddlm} ttdd|gg�� z$|�|j|dddd�| �}|dkW S tjk
r� } zt|j � W Y �d S d}~X Y nX dS )
ztAttach to an Ubuntu Pro subscription with a given token.
:return: True if attach performed without errors.
r N��cli�proZattachTr/ )r- Z auto_enablerb Z
attach_configF)
�argparse�uaclientr/ r� r! Z
action_attach� Namespacer r� r� )r< r- r1 r/ Zret_code�errr5 r5 r6 �_run_ua_attach� s" ��
r5 r� c
C s� t tj� t| d�}t dtjj|jd� � t|jd�}zt || d�}W nJ t
j k
r� } z*t tj � t
|jd�}t|| d� |�W 5 d }~X Y nX t dtj � t| |j�S )Nr� r� )� user_code)Z magic_token)Zoptionsr< )r� r
ZCLI_MAGIC_ATTACH_INITr ZCLI_MAGIC_ATTACH_SIGN_INrb r6 r r- r r ZMagicAttachTokenErrorZCLI_MAGIC_ATTACH_FAILEDr r ZCLI_MAGIC_ATTACH_PROCESSINGr5 Zcontract_token)r< Z
initiate_respZ wait_optionsZ wait_respr� Zrevoke_optionsr5 r5 r6 �_perform_magic_attach� s*
���
� r7 )r< r: c C sj t � ttj� tjtjdddgd�}|dkr2dS |dkrBt| �S |dkrfttj� t d�}t
| |�S dS )zZPrompt for attach to a subscription or token.
:return: True if attach performed.
r) �a�c�Z
valid_choicesF�> T) r, r� r
Z*SECURITY_UPDATE_NOT_INSTALLED_SUBSCRIPTIONr �prompt_choicesZSECURITY_FIX_ATTACH_PROMPTr7 ZPROMPT_ENTER_TOKEN�inputr5 )r< �choicer- r5 r5 r6 �_prompt_for_attach� s
�
r? )r< �servicer: c C s� ddl }ddlm} ttjj|d�� tjd�|�ddgd�}|dkr�tt d d
|gg�� t
d|� |j |gd d d
d d�| �k�S d S )zMPrompt for enable a pro service.
:return: True if enable performed.
r Nr. �r@ z Choose: [E]nable {} [C]ancelr� r9 r: r0 �enableTFr/ )r@ �
assume_yesZbetarb Z access_only)
r1 r2 r/ r� r
ZSECURITY_SERVICE_DISABLEDrb r r< r! r� Z
action_enabler3 )r< r@ r1 r/ r> r5 r5 r6 �_prompt_for_enable� s0 �����rD )r< r� r: c C s |rt dtj � dS t| �S )z<Verify if machine is attached to an Ubuntu Pro subscription.r� T)r� r
Z SECURITY_DRY_RUN_UA_NOT_ATTACHEDr? )r< r� r5 r5 r6 �_check_attached� s rE )r� r< r� r: c C s� t | |�}|r�|�� \}}|tjkr(dS |�� \}}|tjkr�|r^tdtj j
|j d� � dS t ||j �rndS ttj
j
|j d�� nttjj
|j d�� dS )zQ
Verify if the Ubuntu Pro subscription has the required service enabled.
Tr� rA F)r r r r �applicability_statusr Z
APPLICABLEr� r
Z'SECURITY_DRY_RUN_UA_SERVICE_NOT_ENABLEDrb r� rD Z SECURITY_UA_SERVICE_NOT_ENABLEDZ SECURITY_UA_SERVICE_NOT_ENTITLED)r� r< r� r r r� rF r5 r5 r6 �(_check_subscription_for_required_service s:
��� ����rG c C s� ddl }ddlm} t� ttj� tjd� t
�ddgd�}|dkr�ttj � t d�}tt
d d
gg�� |�|jd d d
�| � t| |�S dS )zdPrompt for attach a new subscription token to the user.
:return: True if attach performed.
r Nr. z2Choose: [R]enew your subscription (at {}) [C]ancel�rr9 r: r; r0 �detachTr/ )rC rb F)r1 r2 r/ r, r� r
Z%SECURITY_UPDATE_NOT_INSTALLED_EXPIREDr r< rb r ZPROMPT_EXPIRED_ENTER_TOKENr= r! Z
action_detachr3 r5 )r< r1 r/ r> r- r5 r5 r6 �_prompt_for_new_token0 s(
��
�
rJ )� status_cacher< r� r: c C sV | � dd�}|sdS | � d�}|dks6|t�|j�k rR|rHttj� dS t|� S dS )zuCheck if the Ubuntu Pro subscription is expired.
:returns: True if subscription is expired and not renewed.
�attachedFZexpiresN)r= r ZnowZtzinfor� r
Z(SECURITY_DRY_RUN_UA_EXPIRED_SUBSCRIPTIONrJ )rK r< r� rL Zcontract_expiry_datetimer5 r5 r6 � _check_subscription_is_expiredM s
��
rM )r< r# r� r� r: c
C s |sdS t �� s"|s"ttj� dS |tkrv| �d�p6i }|�dd�sTt| |�sfdS nt || |d�rfdS t
|| |�svdS tt dddgdd d
d g t |� g�� |�sz*t
�� t
jd d d
d g| d
did� W nF tk
�r } z&t|dt|��}t|�� � W Y �dS d}~X Y nX dS )a Upgrade available packages to fix a CVE.
Upgrade all packages in upgrades_packages and, if necessary,
prompt regarding system attach prior to upgrading Ubuntu Pro packages.
:return: True if package upgrade completed or unneeded, False otherwise.
TFz status-cacherL )rK r< r� r r> z&&�installz--only-upgradez-yzapt-getZDEBIAN_FRONTENDZnoninteractive)�cmd�envr� N)r Zwe_are_currently_rootr� r
ZSECURITY_APT_NON_ROOTr� Z
read_cacher= rE rM rG r! ru r Zrun_apt_update_commandZrun_apt_command� Exception�getattrr| �strip)r< r# r� r� rK r� r� r5 r5 r6 r' g sT
�
�����
��
r' )F)cr �enumr� r} r � collectionsr r �typingr r r r r r r
r2 r r r
r r r Z+uaclient.api.u.pro.attach.magic.initiate.v1r Z)uaclient.api.u.pro.attach.magic.revoke.v1r r Z'uaclient.api.u.pro.attach.magic.wait.v1r r Zuaclient.clouds.identityr r r Zuaclient.configr Zuaclient.defaultsr r Zuaclient.entitlementsr Z(uaclient.entitlements.entitlement_statusr r Zuaclient.filesr Zuaclient.files.noticesr Zuaclient.statusr! ZCVE_OR_USN_REGEXr\ ra rt ry r� r� r� r� r| r" r' �unique�Enumr+ ZUAServiceClientr7 r� rK re r� r� r� r� r� r� r� r� r
r r r~ r r r� r( r+ r� r, r5 r7 r? rD rE rG rJ rM r' r5 r5 r5 r6 �<module> s $ �
�� ��
wEJ|
� 1 � � k
�
�
� ,� #� � Y
� " � +
� �