| Server IP : 172.67.131.151 / Your IP : 104.23.197.244 Web Server : Apache System : Linux keen-cori.18-142-40-148.plesk.page 5.15.0-1084-aws #91~20.04.1-Ubuntu SMP Fri May 2 06:59:36 UTC 2025 x86_64 User : simottodesign.com_2tntp341vs7 ( 10011) PHP Version : 8.3.31 Disable Function : opcache_get_status MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/lib/python3/dist-packages/uaclient/__pycache__/ |
Upload File : |
U
2�d�� � @ s� d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZ d dlmZmZmZmZmZmZ d dlmZ d dlmZmZ d dlm Z m Z d d l m Z m Z m!Z! d d
l"m#Z# d d l$m%Z%m&Z& d d l'm(Z( d d
l)m*Z*m+Z+ d dl,m-Z- d dl.m/Z/ d dl0m1Z1 d dl2m3Z3 dZ4dZ5dZ6dZ7dZ8dZ9dZ:dZ;e dde<fd e<fg�Z=e d d e>fd e
e= fd e
e< fd!e>fg�Z?e d"d#e<fd$e<fd%e<fg�Z@e d&d'e>fd(e e< fg�ZAG d)d*� d*ejB�ZCe d+d'eCfd e e
e= fg�ZDG d,d-� d-e1jE�ZFG d.d/� d/�ZGG d0d1� d1�ZHG d2d3� d3�ZIe e<e e<e<f f d4�d5d6�ZJe
eI e e<e>f e e<e e<e e<e<f f f d7�d8d9�ZKd:d;� ZLe<ee eC e e< f d<�d=d>�ZMeHe
eI e<e e<e e<e<f f e#e e<e>f e>eCd?�d@dA�ZNeIe
eI e<e e<e e<e<f f e#e e<e>f e>e>eCdB� dCdD�ZOd�e#e<e>e>eCdF�dGdH�ZPdIdJ� ZQdKdL� ZReIe e<e e<e<f f e e<eGf dM�dNdO�ZSeHe e<e e<e<f f e e<eGf dP�dQdR�ZTe<e e<eGf dS�dTdU�ZUeGe e<e e<e<f f eGdV�dWdX�ZVdYdZ� ZWe
ee<eGf eXeXe<d[�d\d]�ZYe<e#d^�d_d`�ZZe<e#e>da�dbdc�Z[d�eCe<e<de�dfdg�Z\e#e e<e
ee<eGf f e e<e
e@ f eXeXe>e?dh�didj�Z]e
e= e<dk�dldm�Z^e#e<e e<eGf e e<e e<e<f f e e<e e<e e<e<f f f e>eDdn�dodp�Z_dd4�dqdr�Z`e#e<e>ds�dtdu�Zae#dv�dwdx�Zbe#e>dy�dzd{�Zce#e<e>d|�d}d~�Zde#e>e>d�d�d��Zee<e#e>e>d��d�d��Zfe#e>dy�d�d��Zge e<ef e#e>e>d��d�d��Zhe#e
e< e<e>eAd��d�d��ZidS )�� N)� defaultdict)�datetime)�Any�Dict�List�
NamedTuple�Optional�Set�Tuple)�apt�
exceptions� livepatch�messages�system�util)� _initiate)�MagicAttachRevokeOptions�_revoke)�MagicAttachWaitOptions�_wait)�CLOUD_TYPE_TO_TITLE�
PRO_CLOUDS�get_cloud_type)�UAConfig)� BASE_UA_URL�PRINT_WRAP_WIDTH)�entitlement_factory)�ApplicabilityStatus�UserFacingStatus)�notices)�Notice)�
serviceclient)�colorize_commandsz=((CVE|cve)-\d{4}-\d{4,7}$|(USN|usn|LSN|lsn)-\d{1,5}-\d{1,2}$)z cves.jsonzcves/{cve}.jsonz notices.jsonznotices/{notice}.jsonzUbuntu standard updateszUbuntu Pro: ESM InfrazUbuntu Pro: ESM Apps�UnfixedPackage�pkg�unfixed_reason� ReleasedPackagesInstallResult�
fix_status� unfixed_pkgs�installed_pkgs�all_already_installed�BinaryPackageFix�
source_pkg�
binary_pkg�
fixed_version�
UpgradeResult�status�failure_reasonc @ sZ e Zd ZdZG dd� d�Zedd�Zedd�Zedd�Zed d
�Ze d d � �Z
d
d� Z dS )� FixStatuszD
An enum to represent the system status after fix operation
c @ s e Zd Zeed�dd�ZdS )zFixStatus._Value��value�msgc C s || _ || _d S �Nr3 )�selfr4 r5 � r8 �3/usr/lib/python3/dist-packages/uaclient/security.py�__init___ s zFixStatus._Value.__init__N)�__name__�
__module__� __qualname__�int�strr: r8 r8 r8 r9 �_Value^ s r@ r Zfixed� not-affected� zstill-affected� zaffected-until-rebootc C s | j j S r6 )r4 �r7 r8 r8 r9 � exit_codeh s zFixStatus.exit_codec C s | j jS r6 r3 rD r8 r8 r9 �__str__l s zFixStatus.__str__N) r; r< r= �__doc__r@ �SYSTEM_NON_VULNERABLE�SYSTEM_NOT_AFFECTED�SYSTEM_STILL_VULNERABLE� SYSTEM_VULNERABLE_UNTIL_REBOOT�propertyrE rF r8 r8 r8 r9 r2 Y s
r2 � FixResultc s� e Zd ZdZdZeeef eeef d�dd�Ze j
e j dddgd �d� fd d � �Z
d ee ee ee ee ee ee ee eee ed
d� dd�Zed
d�dd�Zd ee ee ee ee ee ed d�dd�Zedd�dd�Z� ZS ) �UASecurityClient� Z security_url)� query_params�returnc C s. | j j �di ��di �}|r*|�|� |S |S )zD
Update query params with data from feature config.
Zfeatures�extra_security_params)�cfg�get�update)r7 rP rR r8 r8 r9 �_get_query_params~ s �
z"UASecurityClient._get_query_paramsrB � � )Z retry_sleepsNc s" | � |�}t� j|||||dd�S )NF)�path�data�headers�methodrP Zlog_response_body)rV �super� request_url)r7 rY rZ r[ r\ rP �� __class__r8 r9 r^ � s
�z UASecurityClient.request_url�CVE) �query�priority�package�limit�offset� component�versionr0 rQ c sT ||||||||d�} � j t| d�}
|
jdkr@t�t|
j|
j��� fdd�|
jD �S )znQuery to match multiple-CVEs.
@return: List of CVE instances based on the the JSON response.
)�qrc rd re rf rg rh r0 �rP �� c s g | ]}t � |d ��qS )��client�response)ra )�.0Zcve_mdrD r8 r9 �
<listcomp>� s z-UASecurityClient.get_cves.<locals>.<listcomp>)r^ � API_V1_CVES�coder �SecurityAPIError�bodyZ json_list) r7 rb rc rd re rf rg rh r0 rP rn r8 rD r9 �get_cves� s& �
�
�zUASecurityClient.get_cves)�cve_idrQ c C s@ t j|d�}| �|�}|jdkr2t�||j|j��t| |jd�S )zkQuery to match single-CVE.
@return: CVE instance for JSON response from the Security API.
)�cverk rl ) �API_V1_CVE_TMPL�formatr^ rr r rs rt ra � json_dict)r7 rv �urlrn r8 r8 r9 �get_cve� s
�zUASecurityClient.get_cve�USN)�details�releasere rf �orderrQ c sd � ||||d�}�j t|d�}|jdkr:t�t|j|j��t� �fdd�|j�dg �D �dd� d �S )
zuQuery to match multiple-USNs.
@return: Sorted list of USN instances based on the the JSON response.
)r~ r re rf r� rj rk c s0 g | ](}� d ks � |� dg �krt�|d��qS )N�cves_idsrl )rT r} )ro Zusn_md�r~ r7 r8 r9 rp � s �z0UASecurityClient.get_notices.<locals>.<listcomp>r c S s | j S r6 ��id��xr8 r8 r9 �<lambda>� � z.UASecurityClient.get_notices.<locals>.<lambda>��key) r^ �API_V1_NOTICESrr r rs rt �sortedrz rT )r7 r~ r re rf r� rP rn r8 r� r9 � get_notices� s&
�
� ��z UASecurityClient.get_notices)� notice_idrQ c C s@ t j|d�}| �|�}|jdkr2t�||j|j��t| |jd�S )zbQuery to match single-USN.
@return: USN instance representing the JSON response.
)�noticerk rl ) �API_V1_NOTICE_TMPLry r^ rr r rs rt r} rz )r7 r� r{ rn r8 r8 r9 �
get_notice� s
�zUASecurityClient.get_notice)NNNN)NNNNNNNN)NNNNN)r; r< r= Z url_timeoutZcfg_url_base_attrr r? r rV r Zretry�socketZtimeoutr^ r r> r ru r| r� r� �
__classcell__r8 r8 r_ r9 rN y sZ
� � �
� " �� !rN c @ s� e Zd ZdZeeef d�dd�Zedd� �Z edd� �Z
ed d
� �Z ed d � �Z ed
d� �Z
edd� �Zeed�dd��Zedd� �ZdS )�CVEPackageStatuszAClass representing specific CVE PackageStatus on an Ubuntu series�� cve_responsec C s
|| _ d S r6 �rn )r7 r� r8 r8 r9 r: � s zCVEPackageStatus.__init__c C s
| j d S �N� descriptionr� rD r8 r8 r9 r� s z CVEPackageStatus.descriptionc C s | j S r6 )r� rD r8 r8 r9 r. s z CVEPackageStatus.fixed_versionc C s
| j d S )N�pocketr� rD r8 r8 r9 r� s zCVEPackageStatus.pocketc C s
| j d S )N�release_codenamer� rD r8 r8 r9 r�
s z!CVEPackageStatus.release_codenamec C s
| j d S )Nr0 r� rD r8 r8 r9 r0 s zCVEPackageStatus.statusc C s� | j dkrtjS | j dkr tjS | j dkr0tjS | j dkr@tjS | j dkrPtjS | j dkr`tjS | j dkrztjj | j
d�S tj j | j d �S )
NZneededz needs-triage�pending)�ignored�deferredZDNErA �released)Z
fix_stream)r0 ) r0 r ZSECURITY_CVE_STATUS_NEEDEDZSECURITY_CVE_STATUS_TRIAGEZSECURITY_CVE_STATUS_PENDINGZSECURITY_CVE_STATUS_IGNOREDZSECURITY_CVE_STATUS_DNEZ SECURITY_CVE_STATUS_NOT_AFFECTEDZSECURITY_FIX_RELEASE_STREAMry �
pocket_sourceZSECURITY_CVE_STATUS_UNKNOWNrD r8 r8 r9 �status_message s"
�z CVEPackageStatus.status_message�rQ c C s t | jtk�S )z?Return True if the package requires an active Pro subscription.)�boolr� � UBUNTU_STANDARD_UPDATES_POCKETrD r8 r8 r9 � requires_ua) s z CVEPackageStatus.requires_uac C sH | j dkrt}n4| j dkr t}n$| j dkr0t}nd| jkr@t}nt}|S )z>Human-readable string representing where the fix is published.� esm-infra�esm-apps)ZupdatesZsecurityZesm)r� �UA_INFRA_POCKET�UA_APPS_POCKETr� r. )r7 Z
fix_sourcer8 r8 r9 r� . s
z CVEPackageStatus.pocket_sourceN)r; r< r= rG r r? r r: rL r� r. r� r� r0 r� r� r� r� r8 r8 r8 r9 r� � s$
r� c @ s� e Zd ZdZeeeef d�dd�Ze d�dd�Z
e dd � �Z d
d � Z
e ee d�d d
��Ze ed d�dd��Ze dd� �Ze eeef d�dd��ZdS )ra z7Class representing CVE response from the SecurityClientrl c C s || _ || _d S r6 �rn rm �r7 rm rn r8 r8 r9 r: C s z CVE.__init__r� c C s t |t�sdS | j|jkS �NF)�
isinstancera rn �r7 �otherr8 r8 r9 �__eq__G s
z
CVE.__eq__c C s | j �dd��� S )Nr� ZUNKNOWN_CVE_ID�rn rT �upperrD r8 r8 r9 r� L s zCVE.idc C sB | j }| jD ]}|j} q q dj| j|d�d�| j�g}d�|�S )z2Return a string representing the URL for this cve.�{issue}: {title}��issue�title�! - https://ubuntu.com/security/{}�
)r� r r� ry r� �join)r7 r� r� �linesr8 r8 r9 �get_url_headerP s
�zCVE.get_url_headerc C s | j �dg �S )N� notices_ids�rn rT rD r8 r8 r9 r� ] s zCVE.notices_idsr} c s< t � d�s6t� fdd�� j�dg �D �dd� dd�� _� jS ) z�Return a list of USN instances from API response 'notices'.
Cache the value to avoid extra work on multiple calls.
�_noticesc s g | ]}t � j|��qS r8 )r} rm )ro r� rD r8 r9 rp i s �z CVE.notices.<locals>.<listcomp>r c S s | j S r6 r� ��nr8 r8 r9 r� m r� z CVE.notices.<locals>.<lambda>T�r� �reverse)�hasattrr� rn rT r� rD r8 rD r9 r a s
��z CVE.noticesc C s | j �d�S r� r� rD r8 r8 r9 r� r s zCVE.descriptionc C sb t | d�r| jS i | _t�� j}| jd D ]0}|d D ]"}|d |kr6t|�| j|d < q6q*| jS )z�Dict of package status dicts for the current Ubuntu series.
Top-level keys are source packages names and each value is a
CVEPackageStatus object
�_packages_statusZpackagesZstatusesr� �name)r� r� r �get_release_info�seriesrn r� )r7 r� rd �
pkg_statusr8 r8 r9 �packages_statusv s
�zCVE.packages_statusN)r; r< r= rG rN r r? r r: r� r� rL r� r� r r� r r� r� r� r8 r8 r8 r9 ra @ s
ra c @ s� e Zd ZdZeeeef d�dd�Ze d�dd�Z
e ed�dd ��Z e e
e d�d
d ��Ze e
e d�d d
��Ze dd� �Ze dd� �Zdd� Ze eeeeeeef f f d�dd��ZdS )r} z7Class representing USN response from the SecurityClientrl c C s || _ || _d S r6 r� r� r8 r8 r9 r: � s z USN.__init__r� c C s t |t�sdS | j|jkS r� )r� r} rn r� r8 r8 r9 r� � s
z
USN.__eq__c C s | j �dd��� S )Nr� ZUNKNOWN_USN_IDr� rD r8 r8 r9 r� � s zUSN.idc C s | j �dg �S )z$List of CVE IDs related to this USN.r� r� rD r8 r8 r9 r� � s z USN.cves_idsc s< t � d�s6t� fdd�� j�dg �D �dd� dd�� _� jS ) z�List of CVE instances based on API response 'cves' key.
Cache the values to avoid extra work for multiple call-sites.
�_cvesc s g | ]}t � j|��qS r8 )ra rm )ro rw rD r8 r9 rp � s �z USN.cves.<locals>.<listcomp>�cvesc S s | j S r6 r� r� r8 r8 r9 r� � r� zUSN.cves.<locals>.<lambda>Tr� )r� r� rn rT r� rD r8 rD r9 r� � s
��zUSN.cvesc C s | j �d�S )Nr� r� rD r8 r8 r9 r� � s z USN.titlec C s | j �d�S )N�
referencesr� rD r8 r8 r9 r� � s zUSN.referencesc C sv dj | j| jd�g}| jrB|�d� | jD ]}|�d� |�� q*n*| jrl|�d� | jD ]}|�d| � qXd�|�S )z5Return a string representing the URL for this notice.r� r� z Found CVEs:r� zFound Launchpad bugs:z - r� )ry r� r� r� �appendr� r� )r7 r� rw Z referencer8 r8 r9 r� � s
zUSN.get_url_headerc C sP t | d�r| jS t�� j}i | _| j�di ��|g �D �]}|�d�r�|d | jkr�d| j|d kr�tjdj | j
|d d�| j
d��|| j|d d< nd|i| j|d < q6|�d �s�tjd
j | j
|d d �| j
d��n4d |d k�rtjd
j | j
|d |d d�| j
d��|d � d �d }|| jk�r6i | j|< || j| |d < q6| jS )aW Binary package information available for this release.
Reformat the USN.release_packages response to key it based on source
package name and related binary package names.
:return: Dict keyed by source package name. The second-level key will
be binary package names generated from that source package and the
values will be the dict response from USN.release_packages for
that binary package. The binary metadata contains the following
keys: name, version.
Optional additional keys: pocket and component.
�_release_packages�release_packagesZ is_sourcer� �sourcez6{usn} metadata defines duplicate source packages {pkg})�usnr$ ��issue_idZ source_linkzL{issue} metadata does not define release_packages source_link for {bin_pkg}.)r� �bin_pkg�/zX{issue} metadata has unexpected release_packages source_link value for {bin_pkg}: {link})r� r� �link���) r� r� r r� r� rn rT r �SecurityAPIMetadataErrorry r� �split)r7 r� r$ �source_pkg_namer8 r8 r9 r� � sN
��
����
zUSN.release_packagesN)r; r< r= rG rN r r? r r: r� r� rL r� r r� ra r� r� r� r� r� r8 r8 r8 r9 r} � s
r} r� c C s| d} t �dd| d dg�\}}i }|�� D ]J}|�d�\}}}}|sJ|}d|krTq,||krj||| |< q,||i||< q,|S )z�Return a dict of all source packages installed on the system.
The dict keys will be source package name: "krb5". The value will be a dict
with keys binary_pkg and version.
z${db:Status-Status}z
dpkg-queryz#-f=${Package},${Source},${Version},r� z-W�,Z installed)r Zsubp�
splitlinesr� ) Z status_field�outZ_err�installed_packagesZpkg_line�pkg_namer� Z pkg_versionr0 r8 r8 r9 �#query_installed_source_pkg_versions s$
�� r� )�usns� beta_pocketsrQ c s� i }| D ]�}|j �� D ]�\}}� fdd�|�� D �}||krJ|rJ|||< q||kr|| }|�� D ]D\}} ||kr|| ||< qb|| d }
| d } t�| |
d�sb| ||< qbqq|S )a Walk related USNs, merging the released binary package versions.
For each USN, iterate over release_packages to collect released binary
package names and required fix version. If multiple related USNs
require different version fixes to the same binary package, track the
maximum version required across all USNs.
:param usns: List of USN response instances from which to calculate merge.
:param beta_pockets: Dict keyed on service name: esm-infra, esm-apps
the values of which will be true of USN response instances
from which to calculate merge.
:return: Dict keyed by source package name. Under each source package will
be a dict with binary package name as keys and binary package metadata
as the value.
c s. i | ]&\}}d � � |� dd�d �kr||�qS )Fr� �None�rT )ro Z bin_pkg_nameZ
bin_pkg_md�r� r8 r9 �
<dictcomp>: s �� z>merge_usn_released_binary_package_versions.<locals>.<dictcomp>rh �le)r� �itemsr �compare_versions) r� r� Zusn_pkg_versionsr� �src_pkgZbinary_pkg_versionsZpublic_bin_pkg_versionsZ usn_src_pkgr� Z
binary_pkg_mdZ prev_versionZcurrent_versionr8 r� r9 �*merge_usn_released_binary_package_versions# s,
�
�r� c C sn | j s
g S i }| j D ]@}|jD ]4}|�d�s.q || jkr:q ||kr |j|d�||< q qtt|�� dd� d��S )z�For a give usn, get the related USNs for it.
For each CVE associated with the given USN, we capture
other USNs that are related to the CVE. We consider those
USNs related to the original USN.
zUSN-�r� c S s | j S r6 r� r� r8 r8 r9 r� o r� z"get_related_usns.<locals>.<lambda>r� )r� r� �
startswithr� r� �listr� �values)r� rm � related_usnsrw Zrelated_usn_idr8 r8 r9 �get_related_usnsT s
�r� )r� rQ c C sf t �� }|d k rb|j d k rb|j jd k rb|j jD ]2}|j| �� kr.|jr.|j jpPd}tj|f S q.dS )NzN/A)NN) r
r0 �fixesr� �lowerZpatchedrh r2 rH )r� Z lp_statusZfixrh r8 r8 r9 � _check_cve_fixed_by_livepatchr s ��
� r� )rw r� r� r� rS r� �dry_runrQ c C s2 t | |d�}t||�}t� t||||||d�jS )N)rw r� �rS r� �affected_pkg_statusr� �usn_released_pkgsr� )�'get_cve_affected_source_packages_statusr� �print� prompt_for_affected_packagesr0 ) rw r� r� r� rS r� r� r� r� r8 r8 r9 �_fix_cve� s" � ��r� ) r� r� r� r� rS r� r� �
no_relatedrQ c C s� t dtjj|d� � t| |d�}t| g|�} t||||| |d�\}
} |
tjtj fkrZ|
S |rb|rf|
S t dtj
jd� dd� |D ��d� � t dtj � i } |D ]R}
t d �|
j
�� t|
|d�}t|
g|�} t||
j
||| |d�}|| |
j
< t � q�t tj� t|
|d
d � d }|D ]�}
| |
j
j}t||
j
d
d � |tjk�r\t dtjjdd� � d}|tjk�r| |
j
j�pxg }|D ]"}|j�r~t d�|j|j�� �q~d}�q|�r�t dtjj|d� � |
S )Nr� r� �r� r� r� z
- c s s | ] }|j V qd S r6 r� )ro r� r8 r8 r9 � <genexpr>� s z_fix_usn.<locals>.<genexpr>)r� z- {}z [requested])�
extra_infoFz
[related]�- �
fix operation�Z operationTz
- {}: {})r� r Z SECURITY_FIXING_REQUESTED_USNry � get_affected_packages_from_usnr� r� r2 rH rI ZSECURITY_RELATED_USNSr� Z SECURITY_FIXING_RELATED_USNSr� ZSECURITY_USN_SUMMARY�_handle_fix_status_messager0 rK �ENABLE_REBOOT_REQUIRED_TMPLrJ r( r% r$ ZSECURITY_RELATED_USN_ERROR)r� r� r� r� rS r� r� r� r� r� Ztarget_fix_status�_Zrelated_usn_statusZ related_usnZrelated_fix_statusZfailure_on_related_usnr0 r( Z unfixed_pkgr8 r8 r9 �_fix_usn� s� � � ��
���� � ��
� � ��� � �� ��r F)rS r� r� r� rQ c
C s� |rt tj� |�� }t| d�}t� }tt| �tt| �d�}d|kr�t |�\}}|rlt tj
j ||d�� |S z |j |d�} |j
|d�}
W nP tjk
r� } z0t| �} | jdkr�tjj |d�j} t�| ��W 5 d } ~ X Y nX t | �� � t| |
||| ||d �S z|j|d
�}
t|
|�}
W nT tjk
�rj } z2t| �} | jdk�rPtjj |d�j} t�| ��W 5 d } ~ X Y nX t |
�� � |
jd �s�tjd � |�|d��t|
|
||| |||d
�S d S )N�rS )r� r� ra )r� rh )rv )r~ i� r� )rw r� r� r� rS r� r� r� r� z.{} metadata defines no fixed package versions.)r� r� r� r� rS r� r� r� ) r� r ZSECURITY_DRY_RUN_WARNINGr� rN r� � _is_pocket_used_by_beta_servicer� r� r� ZCVE_FIXED_BY_LIVEPATCHry r| r� r rs r? rr Z SECURITY_FIX_NOT_FOUND_ISSUEr5 �UserFacingErrorr� r� r� r� rn r� r )rS r� r� r� rm r� r� Zlivepatch_cve_statusZ
patch_versionrw r� �er5 r� r8 r8 r9 �fix_security_issue_id s�
����
� � � ���r
c C s^ i }| D ]P}t ||��� D ]<\}}||kr4|||< q|| j}t�||jd�s|||< qq|S )Nr� )r� r� r. r r� )r� r� �
affected_pkgsrw r� r� Z current_verr8 r8 r9 � get_affected_packages_from_cvesh s �
� r c C s� i }| j �� D ]n\}}||kr qtt�}d|d< dd� |�� D �}|sbd}tj|�| j�| jd��|�� |d< t |d�||< q|S ) Nr� r0 c S s" h | ]\}}|� d �r|d �qS )r� r� )ro r Z pkg_bin_infor8 r8 r9 � <setcomp>� s
�z1get_affected_packages_from_usn.<locals>.<setcomp>zC{} metadata defines no pocket information for any release packages.r� r� r� )
r� r� r r? r r� ry r� �popr� )r� r� r r� Zpkg_infor� Z all_pocketsr5 r8 r8 r9 r { s& ��
� r )r� r� rQ c C s | j rt| j |�S t| |�S dS )z�Walk CVEs related to a USN and return a dict of all affected packages.
:return: Dict keyed on source package name, with active CVEPackageStatus
for the current Ubuntu release.
N)r� r r r� r8 r8 r9 � get_usn_affected_packages_status� s r )rw r� rQ c C s8 i }| j �� D ]$\}}|jdkr"q||kr|||< q|S )z�Get a dict of any CVEPackageStatuses affecting this Ubuntu release.
:return: Dict of active CVEPackageStatus keyed by source package names.
rA )r� r� r0 )rw r� Zaffected_pkg_versionsr, Zpackage_statusr8 r8 r9 r� � s
r� )r� r� c C s� t |�}|dkrDttjjddd�d � tdtjj| dd� � d S |d
krRd }nd}tjj||d�d d
�t|�� �� }tt j
|t ddd�� d S )a Print header strings describing affected packages related to a CVE/USN.
:param issue_id: String of USN or CVE issue id.
:param affected_pkg_status: Dict keyed on source package name, with active
CVEPackageStatus for the current Ubuntu release.
r ZNozs are)�count�
plural_str�.r� � �r� r NrB z isz: �, � F)�width�subsequent_indentZreplace_whitespace) �lenr� r ZSECURITY_AFFECTED_PKGSry �SECURITY_ISSUE_UNAFFECTEDr� r� �keys�textwrap�fillr )r� r� r r r5 r8 r8 r9 � print_affected_packages_header� sN ��� ��� ������r! )r� �usn_src_released_pkgsrQ c C sf t �| �}|rb|�d�rbd|jd< |d d |jd< |�� D ]$\}}|�d�}|r<||jd< qbq<|S )a� Parse release status based on both pkg_status and USN.release_packages.
Since some source packages in universe are not represented in
CVEPackageStatus, rely on presence of such source packages in
usn_src_released_pkgs to represent package as a "released" status.
:param pkg_status: the CVEPackageStatus for this source package.
:param usn_src_released_pkgs: The USN.release_packages representing only
this source package. Normally, release_packages would have data on
multiple source packages.
:return: Tuple of:
human-readable status message, boolean whether released,
boolean whether the fix requires access to UA
r� r� r0 rh r� r� )�copy�deepcopyrT rn r� )r� r" �usn_pkg_statusr� Zusn_released_pkgr� r8 r8 r9 �#override_usn_release_package_status� s
��
r& c C sd i }t | �� �D ]N\}}|�|i �}t||�}|j�dd�}||krLg ||< || �||f� q|S )Nr� r� )r� r� rT r& r0 �replacer� )r� r� Z
status_groupsr� r� �usn_released_srcr% Z status_groupr8 r8 r9 �group_by_usn_package_status s �r) )�pkg_status_list� pkg_index�num_pkgsrQ c C s� | sdS g }g }| D ],\}}|d7 }|� d�||�� |� |� qtjd�dd�|� d d�t|���tdd �}d
�||j�S ) z;Format the packages and status to an user friendly message.r rB z{}/{}z{} {}:�(r �)r �r r z{}
{})r� ry r r r� r� r r� )r* r+ r, Z msg_indexZsrc_pkgsr� r� Z
msg_headerr8 r8 r9 �_format_packages_message s" ��r0 )r� rS c C s: d}| t krd}n | tkr d}t||d�}|r6||�S d S )Nzno-service-neededr� r� )rS r� )r� r� r )r� rS Zservice_to_checkZent_clsr8 r8 r9 �_get_service_for_pocket0 s r1 )r� rS rQ c C s4 t | |�}|r0|�� \}}|tjkr(dS |j S dS )zBCheck if the pocket where the fix is at belongs to a beta service.F)r1 �user_facing_statusr �ACTIVEZ
valid_service)r� rS �ent�
ent_statusr r8 r8 r9 r
; s
r
r �r0 r� r c C s� | t jkr&tt�tjj||d��� nf| t jkrLtt�tj j||d��� n@| t j
krrtt�tj j||d��� ntt�tj j||d��� d S )Nr ) r2 rH r� r Zhandle_unicode_charactersr ZSECURITY_ISSUE_RESOLVEDry rI r rK ZSECURITY_ISSUE_NOT_RESOLVEDr6 r8 r8 r9 r K sF
���
���
��� ���r )rS �src_pocket_pkgs�binary_pocket_pkgsr+ r, r� rQ c sv d}d}g }t � } |�rftttfD �]@}
||
} ||
} tjj|
d�� |�r0t| ||d�}
|
r|t|
� | sxttj � q"nd}g }t
| �D ]t}|
tk}t j |j
|d�}|r�t �|j|d�r�|�|j
� q�tjj|j
|jd�j}td| � |�t|j|d �� q�|t| �7 }t| ||
|d
�}||jM }|j�p.d � |�sP|�� fd d
�| D �� q"| �dd� | D �� q"t||| |d�S )a% Handle the packages that could be fixed and have a released status.
:returns: Tuple of
boolean whether all packages were successfully upgraded,
list of strings containing the packages that were not upgraded,
boolean whether all packages were already installed
T��service�r* r+ r, F)�check_esm_cacher� )rd rh r �r$ r% )rS � upgrade_pkgsr� r� r c s g | ]\}}t |� d ��qS �r= �r# �ro r� r �Z failure_msgr8 r9 rp � s
��z2_handle_released_package_fixes.<locals>.<listcomp>c s s | ] }|j V qd S r6 )r- )ro r- r8 r8 r9 r� � s z1_handle_released_package_fixes.<locals>.<genexpr>)r' r( r) r* ) �setr� r� r� r � SECURITY_UA_SERVICE_REQUIREDry r0 r� ZSECURITY_UPDATE_INSTALLEDr� r Zget_pkg_candidate_versionr- r� r. r� ZFIX_CANNOT_INSTALL_PACKAGEr5 r# r, r �upgrade_packages_and_attachr0 r1 �extendrU r& )rS r7 r8 r+ r, r� r* Zupgrade_statusr( r) r� Z
pkg_src_groupZ binary_pkgsr5 r> r- r< Zcandidate_versionr% Zupgrade_resultr8 rB r9 � _handle_released_package_fixesp s� �
��
� ��� �� �
��
�
�rG )r( rQ c C sZ t dd� | D ��}t|�}tjtjj||dkr2dnd|dkr@dndd�|�d �jt d
d �S ) z�Format the list of unfixed packages into an message.
:returns: A string containing the message output for the unfixed
packages.
c S s h | ]
}|j �qS r8 )r$ )ro r$ r8 r8 r9 r � s z/_format_unfixed_packages_msg.<locals>.<setcomp>rB �sr Zare�isr )r, rH ZverbZpkgsr r/ )
r� r r r r ZSECURITY_PKG_STILL_AFFECTEDry r� r5 r )r( Z sorted_pkgsZnum_pkgs_unfixedr8 r8 r9 � _format_unfixed_packages_msg� s ��rJ )rS r� r� r� r� r� rQ c
s t |�}t||� |dkr(ttjdd�S tt�}tt�}d} t||�}
g } t|
� � �D ]�\} }
| dkr�tj
}t t |
| |d�� | t |
�7 } |
d d j
� | � fdd�|
D �7 } qV|
D ]�\}}||j �||f� || � � D ]Z\}}|�|i �}||kr�q�|�|i ��d d
�}t�||d �s�||j �t|||d �� q�q�qVt| ||| ||d
�}| |j7 } t � | �rrt t| �� |j�r�|j�r�| �r�tjntj
}n\tj|j d��r�t j j dd�}t |� t j!t"j#dd� | �r�tjntj$}n| �r�tjntj
}ntj}t%||� t|| d�S )a Process security CVE dict returning a CVEStatus object.
Since CVEs point to a USN if active, get_notice may be called to fill in
CVE title details.
:returns: An FixStatus enum value corresponding to the system state
after processing the affected packages
r N)r0 r( r� r; rB c s g | ]\}}t |� d ��qS r? r@ rA �Z
status_msgr8 r9 rp s �z0prompt_for_affected_packages.<locals>.<listcomp>rh r r� )r, r- r. )rS r7 r8 r+ r, r� )r) r r )&r r! rM r2 rI r r� r) r� r� rH r� r0 r� r� r� rT r r� r+ rG r( rJ r' r* rJ r Z
should_rebootr) r r ry r �addr ZENABLE_REBOOT_REQUIREDrK r )rS r� r� r� r� r� r r7 r8 r+ Zpkg_status_groupsr( Z status_valueZpkg_status_groupZ
fix_resultr� r� r- rh r( r. Z released_pkgs_install_resultZ
reboot_msgr8 rK r9 r� � s�
� ��� �
� �
��
�
�
�����
�
�
�
�r� c C s0 t � \} }| tkr,ttjjt�| �| d�� dS )z:Alert the user when running Pro on cloud with PRO support.)r� ZcloudN)r r r� r ZSECURITY_USE_PRO_TMPLry r rT )Z
cloud_typer r8 r8 r9 �*_inform_ubuntu_pro_existence_if_applicableu s
��rM )rS �tokenrQ c
C s� ddl }ddlm} ttdd|gg�� z$|�|j|dddd�| �}|dkW S tjk
r� } zt|j � W Y �d S d}~X Y nX dS )
ztAttach to an Ubuntu Pro subscription with a given token.
:return: True if attach performed without errors.
r N��cli�proZattachTrP )rN Z auto_enablery Z
attach_configF)
�argparse�uaclientrP r� r" Z
action_attach� Namespacer r r5 )rS rN rR rP Zret_code�errr8 r8 r9 �_run_ua_attach� s" ��
rV r c
C s� t tj� t| d�}t dtjj|jd� � t|jd�}zt || d�}W nJ t
j k
r� } z*t tj � t
|jd�}t|| d� |�W 5 d }~X Y nX t dtj � t| |j�S )Nr r� )� user_code)Z magic_token)ZoptionsrS )r� r ZCLI_MAGIC_ATTACH_INITr ZCLI_MAGIC_ATTACH_SIGN_INry rW r rN r r ZMagicAttachTokenErrorZCLI_MAGIC_ATTACH_FAILEDr r ZCLI_MAGIC_ATTACH_PROCESSINGrV Zcontract_token)rS Z
initiate_respZ wait_optionsZ wait_respr Zrevoke_optionsr8 r8 r9 �_perform_magic_attach� s*
���
� rX )rS rQ c C sj t � ttj� tjtjdddgd�}|dkr2dS |dkrBt| �S |dkrfttj� t d�}t
| |�S dS )zZPrompt for attach to a subscription or token.
:return: True if attach performed.
rH �a�c�Z
valid_choicesF�> T) rM r� r Z*SECURITY_UPDATE_NOT_INSTALLED_SUBSCRIPTIONr �prompt_choicesZSECURITY_FIX_ATTACH_PROMPTrX ZPROMPT_ENTER_TOKEN�inputrV )rS �choicerN r8 r8 r9 �_prompt_for_attach� s
�
r` )rS r: rQ c C s� ddl }ddlm} ttjj|d�� tjd�|�ddgd�}|dkr�tt d d
|gg�� t
d|� |j |gd d d
d d�| �k�S d S )zMPrompt for enable a pro service.
:return: True if enable performed.
r NrO r9 z Choose: [E]nable {} [C]ancelr rZ r[ rQ �enableTFrP )r: �
assume_yesZbetary Z access_only)
rR rS rP r� r ZSECURITY_SERVICE_DISABLEDry r r] r" r� Z
action_enablerT )rS r: rR rP r_ r8 r8 r9 �_prompt_for_enable� s0 �����rc )rS r� rQ c C s |rt dtj � dS t| �S )z<Verify if machine is attached to an Ubuntu Pro subscription.r� T)r� r Z SECURITY_DRY_RUN_UA_NOT_ATTACHEDr` )rS r� r8 r8 r9 �_check_attached� s rd )r� rS r� rQ c C s� t | |�}|r�|�� \}}|tjkr(dS |�� \}}|tjkr�|r^tdtj j
|j d� � dS t ||j �rndS ttj
j
|j d�� nttjj
|j d�� dS )zQ
Verify if the Ubuntu Pro subscription has the required service enabled.
Tr� r9 F)r1 r2 r r3 �applicability_statusr Z
APPLICABLEr� r Z'SECURITY_DRY_RUN_UA_SERVICE_NOT_ENABLEDry r� rc Z SECURITY_UA_SERVICE_NOT_ENABLEDZ SECURITY_UA_SERVICE_NOT_ENTITLED)r� rS r� r4 r5 r re r8 r8 r9 �(_check_subscription_for_required_service� s:
��� ����rf c C s� ddl }ddlm} t� ttj� tjd� t
�ddgd�}|dkr�ttj � t d�}tt
d d
gg�� |�|jd d d
�| � t| |�S dS )zdPrompt for attach a new subscription token to the user.
:return: True if attach performed.
r NrO z2Choose: [R]enew your subscription (at {}) [C]ancel�rrZ r[ r\ rQ �detachTrP )rb ry F)rR rS rP rM r� r Z%SECURITY_UPDATE_NOT_INSTALLED_EXPIREDr r] ry r ZPROMPT_EXPIRED_ENTER_TOKENr^ r" Z
action_detachrT rV )rS rR rP r_ rN r8 r8 r9 �_prompt_for_new_token s(
��
�
ri )� status_cacherS r� rQ c C sV | � dd�}|sdS | � d�}|dks6|t�|j�k rR|rHttj� dS t|� S dS )zuCheck if the Ubuntu Pro subscription is expired.
:returns: True if subscription is expired and not renewed.
�attachedFZexpiresN)rT r ZnowZtzinfor� r Z(SECURITY_DRY_RUN_UA_EXPIRED_SUBSCRIPTIONri )rj rS r� rk Zcontract_expiry_datetimer8 r8 r9 � _check_subscription_is_expired; s
��
rl )rS r> r� r� rQ c
C sx |st ddd�S t�� s6|s6tj}t|� t d|d�S |tkr�| �d�pJi }|�dd�szt | |�s�t dtj
j |d�d�S n$t || |d�r�t dtj
j |d�d�S t|| |�s�t dtjj |d�d�S ttd d
d gd d d
dg t|� g�� |�slz*t�� tjdd d
dg| ddid� W nR tk
�rj } z2t|dt|��}t|�� � t dtjd� W Y �S d}~X Y nX t ddd�S )a Upgrade available packages to fix a CVE.
Upgrade all packages in upgrades_packages and, if necessary,
prompt regarding system attach prior to upgrading Ubuntu Pro packages.
:return: True if package upgrade completed or unneeded, False otherwise.
TN)r0 r1 Fz status-cacherk r9 )rj rS r� r rU z&&�installz--only-upgradez-yzapt-getZDEBIAN_FRONTENDZnoninteractive)�cmdZoverride_env_varsr5 )r/ r Zwe_are_currently_rootr ZSECURITY_APT_NON_ROOTr� r� Z
read_cacherT rd rD ry rl Z$SECURITY_UA_SERVICE_WITH_EXPIRED_SUBrf Z%SECURITY_UA_SERVICE_NOT_ENABLED_SHORTr" r� r Zrun_apt_update_commandZrun_apt_command� Exception�getattrr? �stripZSECURITY_UA_APT_FAILURE)rS r> r� r� r5 rj r r8 r8 r9 rE U sz
�� ��� ��
�����
��
� rE )FF)r )jr# �enumr� r � collectionsr r �typingr r r r r r r
rS r r r
r r r Z+uaclient.api.u.pro.attach.magic.initiate.v1r Z)uaclient.api.u.pro.attach.magic.revoke.v1r r Z'uaclient.api.u.pro.attach.magic.wait.v1r r Zuaclient.clouds.identityr r r Zuaclient.configr Zuaclient.defaultsr r Zuaclient.entitlementsr Z(uaclient.entitlements.entitlement_statusr r Zuaclient.filesr Zuaclient.files.noticesr Z
uaclient.httpr! Zuaclient.statusr" ZCVE_OR_USN_REGEXrq rx r� r� r� r� r� r? r# r� r& r+ r/ �Enumr2 rM ZUAServiceClientrN r� ra r} r� r� r� r� r� r r
r r r r� r! r& r) r> r0 r1 r
r rG rJ r� rM rV rX r` rc rd rf ri rl rE r8 r8 r8 r9 �<module> s` $ ���
�� ��
�� �� EJ|
� 1 �
�
� r �� Z
�
�
� /� #� � � &� l
� " � +
� �