CasperSecurity
o
��JhHf � @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z m Z m
Z
mZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
l m Z d d l m Z m Z d d l!m"Z"m#Z#m$Z$ e �%� Z&e �'e�(e)��Z*g d
�Z+ddgZ,e+e, e+e, e+d�Z-g d�Z.g d�Z/g d�Z0e+e, e. e+e, e/ e+e0 d�Z1G dd� dej2�Z3G dd� de3�Z4G dd� de3�Z5G dd� de4�Z6dS )� N)�groupby)�List�Optional�Tuple)�api�apt� event_logger�
exceptions�messages�system�util)�NoCloudTypeReason�get_cloud_type)�repo)�EntitlementWithMessage)�ApplicationStatus)�notices)�Notice)�ServicesOnceEnabledData�services_once_enabled_file)�MessagingOperations�MessagingOperationsDict�StaticAffordance)�
strongswan�strongswan-hmac�openssh-client�openssh-server� shim-signed�openssh-client-hmac�openssh-server-hmac)�xenial�bionic�focal)�openssl� libssl1.0.0�libssl1.0.0-hmac)r# � libssl1.1�libssl1.1-hmac� libgcrypt20�libgcrypt20-hmacc s� e Zd ZdZdZdZejZdZ dZ
ej j Z
g d�Zedefdd��Zed d
� �Zd edefd d
�Zdejfdd�Zdefdd�Zdejfdd�Z d6dejdeee deddf� fdd�
Z defdd�Z d7d e d eddfd d �Z d!e d"e def� fd#d$� Z ede!e"d%f fd&d'��Z#edee f� fd(d)� �Z$de!e%eej& f f� fd*d+� Z'd8d,d-�Z(dejdef� fd.d/� Z)dejdef� fd0d1� Z*d2d3� Z+dejddf� fd4d5� Z,� Z-S )9�FIPSCommonEntitlementi� zubuntu-pro-fips.gpgz /proc/sys/crypto/fips_enabledT) zfips-initramfszfips-initramfs-genericr( r) �libgmp10� libgnutls30� libhogweed6�
libnettle8r$ r% r$ r% r& r' �libssl3�
linux-fipsr r r r r# �openssl-fips-module-3r r r z ubuntu-fipszubuntu-aws-fipszubuntu-azure-fips�ubuntu-gcp-fips�returnc C s0 d }d }| j s't�� r tjj| jd�}| �� stjg}n| j }t
j d|ifg}d }| j s=| j s=t
j dtj
j| jd�ifg}| j sF| ji fgnd }||||d�}t| j�dkr�| jd }t�d|�}|ri|�d�} nd} t�� j}
| |
kr�|�d�pzg }tjj| | j| |
p�d d
�} |�t
j d| if� ||d< |S ) N��title�msg)�
pre_enable� pre_install� post_enable� pre_disable� r zubuntu-([a-z]+)-fips�genericr7 �unknown)�variant�service� base_flavor�current_flavor)� access_onlyr � is_containerr
� PROMPT_FIPS_CONTAINER_PRE_ENABLE�formatr5 �auto_upgrade_all_on_enable�FIPS_RUN_APT_UPGRADE�pre_enable_msgr �prompt_for_confirmation�purge�PROMPT_FIPS_PRE_DISABLE�prompt_if_kernel_downgrade�len�packages�re�match�group�get_kernel_info�flavor�get�#KERNEL_FLAVOR_CHANGE_WARNING_PROMPT�name�append) �selfr7 r9 �pre_enable_promptr: r8 � messaging�ubuntu_fips_package_name� ubuntu_fips_package_flavor_match�ubuntu_fips_package_flavorrA r6 � r^ �</usr/lib/python3/dist-packages/uaclient/entitlements/fips.pyrZ � s~ ����� �������� �
��
���z FIPSCommonEntitlement.messagingc C s* t �� j}t �� rt�|g �S t�|g �S )a�
Dictionary of conditional packages to be installed when
enabling FIPS services. For example, if we are enabling
FIPS services in a machine that has openssh-client installed,
we will perform two actions:
1. Upgrade the package to the FIPS version
2. Install the corresponding hmac version of that package
when available.
)r �get_release_info�seriesrC �#FIPS_CONTAINER_CONDITIONAL_PACKAGESrT �FIPS_CONDITIONAL_PACKAGES)rX ra r^ r^ r_ �conditional_packages� s
z*FIPSCommonEntitlement.conditional_packages�
assume_yesc C s� t �� j}|du rt�d� dS t�d|�}t�d�}|durL|durL|� d�}t�
d||� t� ||�dk rJt �
tjj||d �� tjtj|d
�S d S t�d ||� d S )
ztCheck if installing a FIPS kernel will downgrade the kernel
and prompt for confirmation if it will.
Nz Cannot gather kernel informationFz!(?P<kernel_version>\d+\.\d+\.\d+)r0 �kernel_versionz*Kernel information: cur='%s' and fips='%s'r )�current_version� new_version)r6 re z2Cannot gather kernel information for '%s' and '%s'T)r rR � proc_version_signature_version�LOG�warningrO �searchr �get_pkg_candidate_versionrQ �debug�version_compare�event�infor
�KERNEL_DOWNGRADE_WARNINGrE r rI �
PROMPT_YES_NO)rX re �our_full_kernel_str�our_m�fips_kernel_version_str�our_kernel_version_strr^ r^ r_ rL � sJ �
�
������ ��z0FIPSCommonEntitlement.prompt_if_kernel_downgrade�progressc C s� g }t �� }tt| j�dd� d�}|D ] \}}||v r ||7 }q|D ](}zt j|gddig d�d� W q" tjyJ |�dt j
j | j |d �� Y q"w d S )
Nc S s | � dd�S )Nz-hmac� )�replace)�pkg_namer^ r^ r_ �<lambda># � zNFIPSCommonEntitlement.hardcoded_install_conditional_packages.<locals>.<lambda>)�key�DEBIAN_FRONTEND�noninteractive�z--allow-downgradesz$-o Dpkg::Options::="--force-confdef"z$-o Dpkg::Options::="--force-confold"�rN �override_env_vars� apt_optionsrq )r? �pkg)
r � get_installed_packages_namesr �sortedrd �run_apt_install_commandr �UbuntuProError�emitr
�FIPS_PACKAGE_NOT_AVAILABLErE r5 )rX rx �desired_packages�installed_packages�
pkg_groupsr{ �pkg_listr� r^ r^ r_ �&hardcoded_install_conditional_packages s4 � �
� ����z<FIPSCommonEntitlement.hardcoded_install_conditional_packagesc C s* t j| jjdd�}t�� jdv }|p| S )Nz features.fips_auto_upgrade_all��config�
path_to_value> r" r! r )r �is_config_value_true�cfgr r` ra )rX � install_all_updates_override�hardcoded_releaser^ r^ r_ rF = s
�
z0FIPSCommonEntitlement.auto_upgrade_all_on_enablec C s� dd� t �| j�D �}t�� jdkr|�d� |�� t|�dkrVz"|� dt
j j d�
|�d�� | �|� t j|d d
ig d �d � W d S tjyU |� dt
j� Y d S w d S )
Nc S s g | ]}|j �qS r^ )rV )�.0�packager^ r^ r_ �
<listcomp>L s ��zMFIPSCommonEntitlement.install_all_available_fips_upgrades.<locals>.<listcomp>�jammyr1 r rq � )rN r r� r� r� )r �;get_installed_packages_with_uninstalled_candidate_in_origin�originr r` ra rW �sortrM r� r
�INSTALLING_PACKAGESrE �join�unhold_packagesr� r r� � FIPS_PACKAGES_UPGRADE_FAILURE)rX rx �
to_upgrader^ r^ r_ �#install_all_available_fips_upgradesI s4 ��
��
� ��z9FIPSCommonEntitlement.install_all_available_fips_upgradesN� package_list�cleanup_on_failurec sl | j }|rt� j||d� n |�tjj| jd�� | �� r#| � |� n| �
|� | � � r4t �
tj� dS dS )z�Install contract recommended packages for the entitlement.
:param package_list: Optional package list to use instead of
self.packages.
:param cleanup_on_failure: Cleanup apt files if apt install fails.
)r� r4 N)rN �super�install_packagesrx r
�INSTALLING_SERVICE_PACKAGESrE r5 rF r� r� �_check_for_rebootr �addr �FIPS_SYSTEM_REBOOT_REQUIRED)rX rx r� r� �mandatory_packages�� __class__r^ r_ r� m s" ��
��z&FIPSCommonEntitlement.install_packagesc C s t �� S )z=Check if system needs to be rebooted because of this service.)r �
should_reboot�rX r^ r^ r_ r� � s z'FIPSCommonEntitlement._check_for_rebootF� operation�silentc C sN | � � }t�|� |r#|st�tjj|d�� |dkr%t�t j
� dS dS dS )z�Check if user should be alerted that a reboot must be performed.
@param operation: The operation being executed.
@param silent: Boolean set True to silence print/log of messages
)r� zdisable operationN) r� rp � needs_rebootrq r
�ENABLE_REBOOT_REQUIRED_TMPLrE r r� r � FIPS_DISABLE_REBOOT_REQUIRED)rX r� r� �reboot_requiredr^ r^ r_ �_check_for_reboot_msg� s
����z+FIPSCommonEntitlement._check_for_reboot_msgra �cloud_idc s> |dkr t j| jjdd�rdS |dv rdS tdt� jv �S dS )aV Return False when FIPS is allowed on this cloud and series.
On Xenial GCP there will be no cloud-optimized kernel so
block default ubuntu-fips enable. This can be overridden in
config with features.allow_xenial_fips_on_cloud.
GCP doesn't yet have a cloud-optimized kernel or metapackage so
block enable of fips if the contract does not specify ubuntu-gcp-fips.
This also can be overridden in config with
features.allow_default_fips_metapackage_on_gcp.
:return: False when this cloud, series or config override allows FIPS.
�gcez.features.allow_default_fips_metapackage_on_gcpr� T)r! r" r2 )r r� r� �boolr� rN �rX ra r� r� r^ r_ � _allow_fips_on_cloud_instance� s �z3FIPSCommonEntitlement._allow_fips_on_cloud_instance.c s^ dddd�}t � \� }� d u rd� t�� j�tjj��� |�� �d�}|� ��fdd�d ffS )
Nzan AWSzan Azureza GCP)�aws�azurer� ry )ra �cloudc s �� �� �S �N)r� r^ �r� rX ra r^ r_ r| � r} z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>T) r r r` ra r
�FIPS_BLOCK_ON_CLOUDrE r5 rT )rX � cloud_titles�_�blocked_messager^ r� r_ �static_affordances� s
���z(FIPSCommonEntitlement.static_affordancesc s t �� rg S t� jS r� )r rC r� rN r� r� r^ r_ rN � s z FIPSCommonEntitlement.packagesc s t � �� \}}t�� rt�� st�tj� ||fS t j
� | j �rSt�t
| j��s.t�tj� t�| j ��� dkrBt�tj� ||fS t�tj� tjtjj| j d�fS |tjkr\||fS t�� }g }| jD ] }||vrp|�|� qe|r�tj tj jd� |�| j d�fS tjtj fS )N�1)� file_namer� )rN r? )!r� �application_statusr rC r� r �remover r� �os�path�exists�FIPS_PROC_FILE�setrN � load_file�strip�FIPS_MANUAL_DISABLE_URLr� r �DISABLEDr
�FIPS_PROC_FILE_ERRORrE �ENABLEDr r� rW �WARNING�FIPS_PACKAGES_NOT_INSTALLEDr� rV �FIPS_REBOOT_REQUIRED)rX � super_status� super_msgr� �missingr� r� r^ r_ r� � sR ������
� ���z(FIPSCommonEntitlement.application_statusc C sT t t�� �}t | j��t | j��}|�|�}|r(t�t|�t j
j | j d�� dS dS )z�Remove fips meta package to disable the service.
FIPS meta-package will unset grub config options which will deactivate
FIPS on any related packages.
r4 N)
r� r r� rN �
differencerd � intersection�remove_packages�listr
�DISABLE_FAILED_TMPLrE r5 )rX r� �fips_metapackager� r^ r^ r_ r� s
�
��z%FIPSCommonEntitlement.remove_packagesc s8 t � �|�rt�tj� t�tj� t�tj� dS dS �NTF)r� �_perform_enabler r� r � WRONG_FIPS_METAPACKAGE_ON_CLOUDr� r� �rX rx r� r^ r_ r� 1 s � z%FIPSCommonEntitlement._perform_enablec s( t � �|�r| �� rt�tj� dS dS r� )r� �_perform_disabler� r r� r r� r� r� r^ r_ r� < s �z&FIPSCommonEntitlement._perform_disablec C s| ddg}t �|tjjd�|�d��}g }|�� D ] }||v r#|�|� q|r<ddg| }t �|tjjd�|�d��}d S d S )Nzapt-mark� showholdsr� )�command�unhold)r �run_apt_commandr
�EXECUTING_COMMAND_FAILEDrE r� �
splitlinesrW )rX �
package_names�cmd�holds�unholds�hold�
unhold_cmdr^ r^ r_ r� F s& �
� ���z%FIPSCommonEntitlement.unhold_packagesc s | � | j� t� �|� dS )z�Setup apt config based on the resourceToken and directives.
FIPS-specifically handle apt-mark unhold
:raise UbuntuProError: on failure to setup any aspect of this apt
configuration
N)r� �fips_pro_package_holdsr� �setup_apt_configr� r� r^ r_ r� Y s z&FIPSCommonEntitlement.setup_apt_config�NT)F)r3 N).�__name__�
__module__� __qualname__�repo_pin_priority�
repo_key_filer� r
�PROMPT_FIPS_PRE_ENABLErH �supports_access_only�apt_noninteractive�urls�FIPS_HOME_PAGE� help_doc_urlr� �propertyr rZ rd r� rL r �ProgressWrapperr� rF r� r r �strr� r� r� r� r r r� rN r � NamedMessager� r� r� r� r� r� �
__classcell__r^ r^ r� r_ r* V sx T
.
�#
�'��
���&���
���� �
;
r* c s� e Zd ZdZejZejZej Z
dZ ej Z
edeedf fdd��Zedeedf f� fdd� �Zd ejdef� fd
d � Z� ZS ) �FIPSEntitlement�fips�
UbuntuFIPSr3 .c C s: ddl m} ddlm} t|tj�tttj�t|tj �fS )Nr )�LivepatchEntitlement��RealtimeKernelEntitlement)
� uaclient.entitlements.livepatchr � uaclient.entitlements.realtimer
r r
�LIVEPATCH_INVALIDATES_FIPS�FIPSUpdatesEntitlement� FIPS_UPDATES_INVALIDATES_FIPS�REALTIME_FIPS_INCOMPATIBLE)rX r r
r^ r^ r_ �incompatible_servicesm s ����z%FIPSEntitlement.incompatible_servicesc s� t � j}t| jd�}tj}t|�� d |k��t� � }|r |j
nd� |t j j
| j|jd��fdd�dft jj
| j|jd�� fdd�dff S )N)r� r F)r � fips_updatesc � � S r� r^ r^ )�is_fips_updates_enabledr^ r_ r| � � z4FIPSEntitlement.static_affordances.<locals>.<lambda>c r r� r^ r^ )�fips_updates_once_enabledr^ r_ r| � r )r� r� r r� r r� r� r� r �readr r
�$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrE r5 �)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)rX r� r �disabled_status�services_once_enabled_objr� )r r r_ r� ~ s2 ����
��
��z"FIPSEntitlement.static_affordancesrx c sR t � \}}|d u r|tjkrt�d� t�tj� t � �
|�r't � t
j� dS dS )Nz>Could not determine cloud, defaulting to generic FIPS package.TF)r r
�CLOUD_ID_ERRORrj rk rp rq r
�.FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGEr� r� r r� r �FIPS_INSTALL_OUT_OF_DATE)rX rx �
cloud_type�errorr� r^ r_ r� � s
� �z FIPSEntitlement._perform_enable)r� r� r� rV r
�
FIPS_TITLEr5 �FIPS_DESCRIPTION� description�FIPS_HELP_TEXT� help_textr� r� rH r r r r r r� r r r� r� r r^ r^ r� r_ r e s !r c sb e Zd ZdZejZdZejZ ej
Z ej Z
edeedf fdd��Zdejdef� fdd � Z� ZS )
r z fips-updates�UbuntuFIPSUpdatesr3 .c C s$ ddl m} tttj�t|tj�fS )Nr r )r r
r r r
� FIPS_INVALIDATES_FIPS_UPDATES�"REALTIME_FIPS_UPDATES_INCOMPATIBLE)rX r
r^ r^ r_ r � s ���z,FIPSUpdatesEntitlement.incompatible_servicesrx c s& t � j|d�rt�tdd�� dS dS )N)rx T)r F)r� r� r �writer r� r� r^ r_ r� � s �z&FIPSUpdatesEntitlement._perform_enable)r� r� r� rV r
�FIPS_UPDATES_TITLEr5 r� �FIPS_UPDATES_DESCRIPTIONr& �FIPS_UPDATES_HELP_TEXTr( � PROMPT_FIPS_UPDATES_PRE_ENABLErH r r r r r r r� r� r r^ r^ r� r_ r � s
r c sh e Zd ZdZejZejZej Z
dZ ej Z
dZedeedf f� fdd� �Zded edefd
d �Z� ZS ) �FIPSPreviewEntitlementz fips-preview�UbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgr3 .c s t � jtttj�f S r� )r� r r r r
r* r� r� r^ r_ r � s
��z,FIPSPreviewEntitlement.incompatible_servicesra r� c C s dS r� r^ r� r^ r^ r_ r� � s z4FIPSPreviewEntitlement._allow_fips_on_cloud_instance)r� r� r� rV r
�FIPS_PREVIEW_TITLEr5 �FIPS_PREVIEW_DESCRIPTIONr& �FIPS_PREVIEW_HELP_TEXTr( r� � PROMPT_FIPS_PREVIEW_PRE_ENABLErH r� r r r r r r� r� r r^ r^ r� r_ r1 � s" ���r1 )7�loggingr� rO � itertoolsr �typingr r r �uaclientr r r r r
r r �uaclient.clouds.identityr
r �uaclient.entitlementsr �uaclient.entitlements.baser �(uaclient.entitlements.entitlement_statusr �uaclient.filesr �uaclient.files.noticesr �uaclient.files.state_filesr r �uaclient.typesr r r �get_event_loggerrp � getLogger� replace_top_level_logger_namer� rj � CONDITIONAL_PACKAGES_EVERYWHERE�!CONDITIONAL_PACKAGES_OPENSSH_HMACrc �&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIAL�&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONIC�%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALrb �RepoEntitlementr* r r r1 r^ r^ r^ r_ �<module> sj $ ���������� L