⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
uaclient
/
__pycache__
/
View File Name :
contract.cpython-312.pyc
mfw ~ d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z m Z d dl m c m Z d dlmZmZmZmZmZmZmZmZmZ d dlmZ d dlm Z d dl m Z d dl m Z d d l!m"Z"m#Z# d d l$m%Z% d d l&m'Z' d Z(d Z)d Z*dZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2dddddZ3 ejh Z5 ejl ejn e8 Z9 edddg Z: G d d e%jv Z<d e=fd Z> d;d e d!ee?ef d"ee?ef d#e@d$e@d%df d&ZA d<d e d'ee?ef d(ee?ef d#e@d$e@d%e ee@f f d)ZBd*ej d%ej fd+ZEd e fd,ZFd e d%ee fd-ZGd e d.e?d%ee?ef fd/ZHd0ee?e?f d1ee?e?f d%eIfd2ZJ d=d3ee?ef d4e?d5e?de e? d%eeIee?ef f f d6ZK d>d'ee?ef d7e e? de e? d%dfd8ZLd e d9ee?ef d%ee: fd:ZMy)? N) namedtuple)AnyDictListOptionalTuple) clouds event_logger exceptionshttpmessagessecret_managersystemutilversion)_enabled_services) _is_attached)UAConfig)ATTACH_FAIL_DATE_FORMAT)attachment_data_filemachine_id_file) serviceclient) get_user_or_root_log_file_pathz/v1/context/machines/tokenz3/v1/contracts/{contract}/context/machines/{machine}z /v1/resourcesz3/v1/resources/{resource}/context/machines/{machine}z /v1/clouds/{cloud_type}/tokenz3/v1/contracts/{contract}/machine-activity/{machine}z /v1/contractz/v1/magic-attach )series_overridesseriescloudvariantEnableByDefaultServicenamer! c e Zd ZdZ ddee ddf fd Z ej e j g d dd Z de e ef fd Zd e de e ef fd Z ej e j g d d ej$ fd Z dde de dee de e ef fdZd Zde de e ef fdZde e ef fdZde fdZ dde de dee de e ef fdZ dde de dee de fdZd Z xZ S ) UAContractClient contract_urlNcfgreturnc X t | | t j | _ y )Nr' )super__init__mtfget_machine_token_filemachine_token_file)selfr' __class__s 3/usr/lib/python3/dist-packages/uaclient/contract.pyr, zUAContractClient.__init__E s& S!"%"<"<"> )r r r ) retry_sleepsc < |s t j | j }| j }|j ddj | i | j }|j |d< ||d}t | }| j t || }|j dk( rt j |j dk( r t | |j dk7 r0t j t |j |j |j" } t$ j& j) | j+ d d | j+ d g D ]1 } t$ j& j) | j+ d d 3 | S )a} Requests machine attach to the provided machine_id. @param contract_token: Token string providing authentication to ContractBearer service endpoint. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing the machine-token. Authorization Bearer {}lastAttachment machineId activityInfo)dataheaders i urlcodebody machineToken resourceTokenstoken)r get_machine_idr' r= updateformat_get_activity_info isoformat_support_old_machine_info request_urlAPI_V1_ADD_CONTRACT_MACHINErB r AttachInvalidTokenError _raise_attach_forbidden_messageContractAPIErrorrC json_dictr secrets add_secretget) r0 contract_token attachment_dt machine_idr= activity_infor< backcompat_dataresponse response_jsonrG s r2 add_contract_machinez%UAContractClient.add_contract_machineL se ..txx8J,,.););N)KLM //1 *7*A*A*C &' ' G3D9## 'ow $ ==C 446 6 ]]c ! +H 5 ==C --/ ]] ]] !** )) nb 1 #&&'7<E " " - -eii.D E = r3 c | j }| j t |d |d |d |d d }|j dk7 r0t j t |j |j |j S ) z=Requests list of entitlements available to this machine type. architecturer kernelvirtr` r ra rb ) query_paramsr? r@ )rK rN API_V1_AVAILABLE_RESOURCESrB r rR rC rS )r0 rZ r\ s r2 available_resourcesz$UAContractClient.available_resourcesw s //1 ## & -n ='1'1%f- $ ==C --. ]] ]] !!!r3 rW c * | j }|j ddj | i | j t | }|j dk7 r0t j t |j |j |j S )Nr6 r7 r= r? r@ ) r= rI rJ rN API_V1_GET_CONTRACT_USING_TOKENrB r rR rC rS )r0 rW r= r\ s r2 get_contract_using_tokenz)UAContractClient.get_contract_using_token s ,,.););N)KLM## +W $ ==C --3 ]] ]] !!!r3 instancec | j t j |j |j }|j dk7 ry|j j dd }|r+t j | t j | t j t |j |j |j }t j j! |j dd |S ) zRequests contract token for auto-attach images for Pro clouds. @param instance: AutoAttachCloudInstance for the cloud. @return: Dict of the JSON response containing the contract-token. ) cloud_type)r< r? messagerE ) error_msgr@ contractToken)rN ,API_V1_GET_CONTRACT_TOKEN_FOR_CLOUD_INSTANCErJ rm identity_docrB rS rV LOGdebugr InvalidProImagerR rC r rT rU )r0 rk r\ msgr] s r2 %get_contract_token_for_cloud_instancez6UAContractClient.get_contract_token_for_cloud_instance s ## 8 ? ?#.. @ && $ ==C $$((B7C # 003?? --@ ]] ]] !** )) or 2 r3 machine_tokenresourcerY c |s t j | j }| j }|j ddj | i t j || }| j || }|j dk7 r0t j t |j |j |j j d r |j d |j d< |j }|j dg D ]1 }t j j! |j d d 3 |S ) a Requests machine access context for a given resource @param machine_token: The authentication token needed to talk to this contract service endpoint. @param resource: Entitlement name. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing entitlement accessInfo. r6 r7 )ry machinerh r? r@ expiresrF rG rE )r rH r' r= rI rJ "API_V1_GET_RESOURCE_MACHINE_ACCESSrN rB r rR rC rV rS r rT rU ) r0 rx ry rY r= rA r\ r] rG s r2 get_resource_machine_accessz,UAContractClient.get_resource_machine_access s ..txx8J,,.););M)JKL077 z 8 ##C#9 ==C --6 ]] ]] *,4,<,<Y,GH y ) ** "&&'7<E " " - -eii.D E = r3 c | j j }| j j j d }t j | j }| j }t j || }| j }|j ddj | i | j ||| }|j dk7 r,t j ||j |j |j" rA| j j }|j" |d< | j j% | y y ) zReport current activity token and enabled services. This will report to the contracts backend all the current enabled services in the system. rD contractr{ r6 r7 )r= r< r? r@ r; N)r/ contract_idrx rV r rH r' rK API_V1_UPDATE_ACTIVITY_TOKENrJ r= rI rN rB r rR rC rS write)r0 r rx rY request_datarA r= r\ s r2 update_activity_tokenz&UAContractClient.update_activity_token s' --99 //==AA **4884 ..0 *11 * 2 ,,.););M)JKL##C|#L ==C --hmm(-- 3 3 A AM -5,>,>M. ) # # ) )- 8 r3 magic_tokenc . | j }|j ddj | i | j t | }|j dk( rt j |j dk( rt j |j dk7 r0t j t |j |j |j }g d}|D ]1 }t j j |j |d 3 |S ) zRequest magic attach token info. When the magic token is registered, it will contain new fields that will allow us to know that the attach process can proceed r6 r7 rh r> r? r@ rG userCoderp rE )r= rI rJ rN "API_V1_GET_MAGIC_ATTACH_TOKEN_INFOrB r MagicAttachTokenErrorMagicAttachUnavailablerR rC rS r rT rU rV )r0 r r= r\ r] secret_fieldsfields r2 get_magic_attach_token_infoz,UAContractClient.get_magic_attach_token_info s ,,.););K)HIJ## . $ ==C 224 4 ==C 335 5 ==C --6 ]] ]] !** > "E " " - -m.?.?r.J K # r3 c | j }| j t |d }|j dk( rt j |j dk7 r0t j t |j |j |j }g d}|D ]1 }t j j |j |d 3 |S )z)Create a magic attach token for the user.POSTr= methodr r? r@ r rE ) r= rN API_V1_NEW_MAGIC_ATTACHrB r r rR rC rS r rT rU rV )r0 r= r\ r] r r s r2 new_magic_attach_tokenz'UAContractClient.new_magic_attach_token$ s ,,.## # $ ==C 335 5 ==C --+ ]] ]] !** > "E " " - -m.?.?r.J K # r3 c | j }|j ddj | i | j t |d }|j dk( rt j |j dk( rt j |j dk( rt j |j dk7 r0t j t |j |j y ) z)Revoke a magic attach token for the user.r6 r7 DELETEr i r> r r? r@ N) r= rI rJ rN API_V1_REVOKE_MAGIC_ATTACHrB r MagicAttachTokenAlreadyActivatedr r rR rC )r0 r r= r\ s r2 revoke_magic_attach_tokenz*UAContractClient.revoke_magic_attach_token; s ,,.););K)HIJ## & $ ==C ==? ? ==C 224 4 ==C 335 5 ==C --. ]] ]] r3 r c > |s t j | j }| j }|j ddj | i t j || }| j }| j |d||d |d |d |d d }|j d k7 r,t j ||j |j |j j d r |j d |j d < |j S )a| Get the updated machine token from the contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. r6 r7 r GETr` r ra rb rc )r r= rd r? r@ r| )r rH r' r= rI rJ API_V1_GET_CONTRACT_MACHINErK rN rB r rR rC rV rS )r0 rx r rY r= rA rZ r\ s r2 get_contract_machinez%UAContractClient.get_contract_machineR s ..txx8J,,.););M)JKL)00 1 //1 ## -n ='1'1%f- $ ==C --hmm(-- *,4,<,<Y,GH y )!!!r3 c 8 |s t j | j }| j }|j ddj | i || j d}t | }t j || }| j ||d| }|j dk7 r,t j ||j |j |j j d r |j d |j d < |j S ) a Request machine token refresh from contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing refreshed machine-token r6 r7 r9 r r )r= r r< r? r@ r| )r rH r' r= rI rJ rK rM API_V1_UPDATE_CONTRACT_MACHINErN rB r rR rC rV rS ) r0 rx r rY r= r< r[ rA r\ s r2 update_contract_machinez(UAContractClient.update_contract_machine} s ..txx8J,,.););M)JKL# 3 3 5 4D9,33 * 4 ## o $ ==C --hmm(-- *,4,<,<Y,GH y )!!!r3 c t j j t j j t j j t j t j t j t j d}t | j j rt | j j }t! j" }| j$ j& xs t j( | j | j$ j* |D cg c] }|j, c}|D ci c]% }|j. r|j, |j0 ' c}|r|j2 j5 ndd}ni }i ||S c c}w c c}w )z9Return a dict of activity info data for contract requests) distributionra r r` desktoprb clientVersionN) activityID activityToken resourcesresourceVariantsr8 )r get_release_infor get_kernel_info uname_releaser get_dpkg_arch is_desktop get_virt_typer get_versionr r' is_attachedr enabled_servicesr readr/ activity_idrH activity_tokenr# variant_enabled variant_name attached_atrL )r0 machine_infor attachment_dataservicerZ s r2 rK z#UAContractClient._get_activity_info sy # 3 3 5 B B ,,.<< --/66 " 0 0 2 ((*((* $ 0 0 2 ! - - 0 : K K 2 7 7 9O " 5 5 A A 3((2!%!8!8!G!G:J K:Jwgll:J K $4%#3 .. LL'"6"66#3% ' $//99; M" M L%s F6!*F; N) __name__ __module__ __qualname__cfg_url_base_attrr r r, r retrysockettimeoutr^ r strr rf rj r AutoAttachCloudInstancerw r~ r r r r r r rK __classcell__)r1 s @r2 r% r% B s & #'? h ? ? TZZY78<( 8( T"T#s(^ "( "s "tCH~ " TZZY7 !99 8 H %) $ $ $ SM $ c3h $ L&9P s tCH~ 8 S#X .S 6 %) )")" )" SM )" c3h )"^ %) &"&" &" SM &" &"P& r3 r% request_bodyc | j di }| j d ||j d |j d |j d |j d dt j j dd S ) a? Transforms a request_body that has the new activity_info into a body that includes both old and new forms of machineInfo/activityInfo This is necessary because there may be old ua-airgapped contract servers deployed that we need to support. This function is used for attach and refresh calls. r; r: r` r ra r Linux)r ra r typerelease)r: r; r` os)rV r r r )r rZ s r2 rM rM s !$$^R8M "%%k2%%)).9 ) - -n =#''1#''1 ..088 r3 r' past_entitlementsnew_entitlements allow_enabler r( c ddl m} d}g }g } || D ]I } || } g } t | |j | i | || \ } } | s2| s5t j | K t j | t | dkD ret j t# || D cg c]9 \ } }| t$ j& j) t+ | t- f; c}} |r4t j. |D cg c] } | t$ j0 f c} y# t $ r Y w xY w# t j $ rJ} t j | d}|j | t j d| | Y d} ~ sd} ~ wt $ rY} t j | |j | |j | t j d| | Y d} ~ d} ~ ww xY wc c}} w c c} w ) a Iterate over all entitlements in new_entitlement and apply any delta found according to past_entitlements. :param cfg: UAConfig instance :param past_entitlements: dict containing the last valid information regarding service entitlements. :param new_entitlements: dict containing the current information regarding service entitlements. :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. r )entitlements_enable_orderF)r' orig_access new_accessr r Tz+Failed to process contract delta for %s: %rNz5Unexpected error processing contract delta for %s: %r)ro log_path)failed_services)uaclient.entitlementsr KeyErrorprocess_entitlement_deltarV eventservice_processedr UbuntuProErrorrs exceptionappenderror Exceptionservices_failedlenAttachFailureUnknownErrorzipr UNEXPECTED_ERRORrJ r r AttachFailureDefaultServices!E_ATTACH_FAILURE_DEFAULT_SERVICES)r' r r r r r delta_errorunexpected_errorsr r# new_entitlementdeltasservice_enableder s r2 process_entitlements_deltar s * @K O)#. .t 4O .&? - 1 1$ ;* )!1 ' #FO8 6''-K /L /* !22 (+?<M'N (OOD) --44"%i.!?!A 5 (O 55 , +D xAAB + c (( MM! K " "4 ( II= MM! $ $Q ' " "4 ( MMG " sA D #D0">G0 >G6 D-,D-0G-?F G-AG((G-r r c ( ddl m} |r t | t j || }d}|r|j di j d }|s!|j di j d }|st j || |j di j di j d d } || || } | j ||| }||fS # t j $ r } t j d | | d } ~ ww xY w)a, Process a entitlement access dictionary deltas if they exist. :param cfg: UAConfig instance :param orig_access: Dict with original entitlement access details before contract refresh deltas :param new_access: Dict with updated entitlement access details after contract refresh :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. :raise UbuntuProError: on failure to process deltas. :return: A tuple containing a dict of processed deltas and a boolean indicating if the service was fully processed r entitlement_factoryF entitlementr )orignew entitlements obligations use_selectorrE r' r# r! z3Skipping entitlement deltas for "%s". No such classNr ) r r apply_contract_overridesr get_dict_deltasrV r InvalidContractDeltasServiceTypeEntitlementNotFoundErrorrs rt process_contract_deltas) r' r r r r r r retr# r! r excs r2 r r C s 0 : , ! !+z :F C }b155f=::mR044V<D == j NN>2 . S # S $ - K 11 l 2 3; 22 IIEt I s > C! !D4D Dr\ c | j j d }|r|d }|d }|dk( rB|d j t }t j |||d j d |dk( rB|d j t }t j |||d j d |d k( rt j | t j ) Ninfo contractIdreasonzno-longer-effectivetimez%m-%d-%Y)r datecontract_expiry_dateznot-effective-yet)r r contract_effective_dateznever-effective)r ) rS rV strftimer r AttachForbiddenExpiredAttachForbiddenNotYetAttachForbiddenNeverAttachExpiredToken)r\ r r r r s r2 rQ rQ s ! !& )D <( h * *<(()@AD 33 '%)&\%:%::%F * *<(()@AD 22 '(,V (=(=j(I ( ( 11kJ J ' ' ))r3 c t j | }|j }|j }|d }|d d d }t | }|j || }|j | t j j |j di j dt j | }t j | t | ||j d y ) zRequest contract refresh from ua-contracts service. :raise UbuntuProError: on failure to update contract or error processing contract deltas :raise ConnectivityError: On failure during a connection rD machineTokenInfo contractInfoidr* )rx r r: Fr N) r- r. r rx r% r r r rH cache_clearrV r r ) r' r/ orig_entitlements orig_tokenrx r contract_clientresprY s r2 refreshr s 33C8*779#11J ~.M /0 @FK&3/O 2 2# 3 D T" %%',b155V**3/J *% '') r3 c \ t | }|j }|j dg S )zDQuery available resources from the contract server for this machine.r )r% rf rV )r' clientr s r2 get_available_resourcesr s+ c "F**,I ==b ))r3 rG c : t | }|j | S )z/Query contract information for a specific token)r% rj )r' rG r s r2 get_contract_informationr s c "F * *5 11r3 override_selectorselector_valuesc ~ d}| j D ]' \ }}||f|j vr y|t | z }) |S )Nr )itemsOVERRIDE_SELECTOR_WEIGHTS)r r override_weightselectorvalues r2 _get_override_weightr& sQ O,224% e O$9$9$; ;4X>> 5 r3 r series_namerm c i }||d}|r||d< | j di j |i }|r ||t d < t j | j dg }|D ]% }t |j d | } | s!||| < ' |S )N)r r r! r r overridesr$ )popr" copydeepcopyrV r& ) r r' rm r! r) r r general_overridesoverrideweights r2 _select_overridesr0 s I!,zBO%, ""x488bI +,>?@ kook2&FG%% LL $o (If & r3 r c ddl m} t t | t d| v g st dj | | t j j n|} | \ }}| j di }t |||| }t |j D ][ \ } } | j D ]C \ } } | d j | } t | t r| j | <| | d | < E ] y)a Apply series-specific overrides to an entitlement dict. This function mutates orig_access dict by applying any series-overrides to the top-level keys under 'entitlement'. The series-overrides are sparse and intended to supplement existing top-level dict values. So, sub-keys under the top-level directives, obligations and affordance sub-key values will be preserved if unspecified in series-overrides. To more clearly indicate that orig_access in memory has already had the overrides applied, the 'series' key is also removed from the orig_access dict. :param orig_access: Dict with original entitlement access details r )get_cloud_typer z?Expected entitlement access dict. Missing "entitlement" key: {}N)uaclient.clouds.identityr2 all isinstancedict RuntimeErrorrJ r r r rV r0 sortedr! rI )r r r! r2 r' rm _orig_entitlementr) _weightoverrides_to_applykeyr% currents r2 r r s & 8 ;-} /KL M &% -3N !(( #$MJ"}b9!+z7I (.ioo.?'@##,224JC!-044S9G'4( u% 38 M*3/ 5 (Ar3 r c ddl m} g }|j D ] \ }}|j di j dd } || || }|j di j di }|j d } |j || sz|j \ } } | s|j t || |S # t j $ r Y w xY w) Nr r r r rE r r resourceToken)r# r! ) r r r! rV r r _should_enable_by_default can_enabler r" ) r' r r enable_by_default_servicesent_name ent_valuer! entr r@ rB r9 s r2 get_enabled_by_default_servicesrG ' s :!# + 1 1 3)-- r266~rJ %#HgNC mmM26::="M ! o6 ( (m D NN ,MJ*11* % ' 4* &%! 22 s C C C )T)FTr )NN)Nr+ loggingr collectionsr typingr r r r r uaclient.files.machine_tokenfilesrx r- uaclientr r r r r r r r r -uaclient.api.u.pro.status.enabled_services.v1r (uaclient.api.u.pro.status.is_attached.v1r uaclient.configr uaclient.defaultsr uaclient.files.state_filesr r uaclient.httpr uaclient.logr rO r r re r} rq r ri r r r r" get_event_loggerr getLogger replace_top_level_logger_namer rs r" UAServiceClientr% r6 rM r boolr r HTTPResponse NamedMessagerQ r r r intr& r0 r rG r3 r2 <module>r^ s* " 3 3 * * L A $ 5 L ' 7 ; 9 : - 9 # 0O ,9 #1 %7 ", / & %%'g:::8DE $ vy 1 I }44 I X D @ " W W CH~W 38nW W W W | ! < <c3h < S#X< < < 4: <~* * *: B* *d4j *2( 23 24S> 2 CH~ 8<S#X " c3h c] #tCH~ > ! !.8c3h .8 SM.8 c].8 .8b & &!%c3h & ! &r3