⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.220
Server IP:
104.21.64.1
Server:
Linux vmi2315822.contaboserver.net 5.15.0-134-generic #145-Ubuntu SMP Wed Feb 12 20:08:39 UTC 2025 x86_64
Server Software:
LiteSpeed
PHP Version:
8.3.21
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
uaclient
/
__pycache__
/
View File Name :
contract.cpython-310.pyc
o ��gW� � @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z m Z d dl m m Z d dlmZmZmZmZmZmZmZmZmZ d dlmZ d dlm Z d dl m Z d dl m Z d d l!m"Z"m#Z# d d l$m%Z% d d l&m'Z' d Z(d Z)d Z*dZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2dZ3ddddd�Z4e�5� Z6e�7e�8e9��Z:eddd g�Z;G d d � d ej<�Z=G d d � d e%j>�Z?d!e@fd"d#�ZA $dKd%e d&eeBef d'eeBef d(eCd)eCd*df d+d,�ZD - $dLd%e d.eeBef d/eeBef d(eCd)eCd*e eeCf f d0d1�ZEd2ejFd*ejGfd3d4�ZHd%e fd5d6�ZId%e d*ee fd7d8�ZJd%e d9eBd*eeBef fd:d;�ZKd<eeBeBf d=eeBeBf d*eLfd>d?�ZM dMd@eeBef dAeBdBeBd e eB d*eeLeeBef f f dCdD�ZN dNd.eeBef dEe eB d e eB d*dfdFdG�ZOd%e dHeeBef d*ee; fdIdJ�ZPdS )O� N)� namedtuple)�Any�Dict�List�Optional�Tuple) � data_types� event_logger� exceptions�http�messages�secret_manager�system�util�version)�_enabled_services)� _is_attached)�UAConfig)�ATTACH_FAIL_DATE_FORMAT)�attachment_data_file�machine_id_file)� serviceclient)� get_user_or_root_log_file_pathz/v1/context/machines/tokenz3/v1/contracts/{contract}/context/machines/{machine}z /v1/resourcesz3/v1/resources/{resource}/context/machines/{machine}z /v1/clouds/{cloud_type}/tokenz3/v1/contracts/{contract}/machine-activity/{machine}z /v1/contractz/v1/magic-attachz?/v1/contracts/{contract}/context/machines/{machine}/guest-token� � � � )�series_overrides�series�cloud�variant�EnableByDefaultService�namer c @ s� e Zd Zejdejdd�ejdejdd�ejdejdd�ejdejdd�ejdejdd�ejdejdd�ejd ejdd�ejd ejdd�ejd ejdd�ejd ejdd�ejd ejdd�ejdejdd�ejdejdd�ejdejdd�gZ ddee dee dee dee dee dee d ee d ee d ee d ee d ee dee dee dee f dd�Z dS )� CPUTypeData� cpuinfo_cpuF)�required�cpuinfo_cpu_architecture�cpuinfo_cpu_family�cpuinfo_cpu_implementer�cpuinfo_cpu_part�cpuinfo_cpu_revision�cpuinfo_cpu_variant� cpuinfo_model�cpuinfo_model_name�cpuinfo_stepping�cpuinfo_vendor_id�"sys_firmware_devicetree_base_model� sysinfo_model� sysinfo_typeNc C sX || _ || _|| _|| _|| _|| _|| _|| _| | _| | _ | | _ | | _ | | _ || _ d S �N�r$ r& r' r( r) r* r+ r, r- r. r/ r0 r1 r2 )�selfr$ r& r' r( r) r* r+ r, r- r. r/ r0 r1 r2 � r6 �3/usr/lib/python3/dist-packages/uaclient/contract.py�__init__z s � zCPUTypeData.__init__)NNNNNNNNNNNNNN) �__name__� __module__� __qualname__r �Field�StringDataValue�fieldsr �strr8 r6 r6 r6 r7 r# F s� ���������������5�������� � � � � ���r# c s� e Zd ZdZ d+dee ddf� fdd� Zeje j g d�d� d+d d ��Z de e ef fd d �Zd e de e ef fdd�Zeje j g d�d�de de e ef fdd��Z d+de de dee de e ef fdd�Zdd� Zde de e ef fd d �Zde e ef fd d �Zde fd d!�Z d+de d"e dee de e ef fd#d$�Z d+de d"e dee de fd%d&�Zde d"e de de fd'd(�Zd)d*� Z� ZS ),�UAContractClient� contract_urlN�cfg�returnc s t � j|d� t�� | _d S )N�rB )�superr8 �mtf�get_machine_token_file�machine_token_file)r5 rB �� __class__r6 r7 r8 � s zUAContractClient.__init__)r r r )� retry_sleepsc C s� |st �| j�}| �� }|�dd�|�i� | �� }|�� |d< ||d�}t|�}| j t ||d�}|j dkr:t � � �|j dkrCt|� |j dkrRt jt |j |jd ��|j} tj�| �d d �� | �d g �D ] } tj�| �d d �� qe| S )a} Requests machine attach to the provided machine_id. @param contract_token: Token string providing authentication to ContractBearer service endpoint. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing the machine-token. � Authorization� Bearer {}�lastAttachment�� machineId� activityInfo)�data�headers� i� �� ��url�code�body� machineToken� �resourceTokens�token)r �get_machine_idrB rS �update�format�_get_activity_info� isoformat�_support_old_machine_info� request_url�API_V1_ADD_CONTRACT_MACHINErX r �AttachInvalidTokenError� _raise_attach_forbidden_message�ContractAPIErrorrY � json_dictr �secrets� add_secret�get) r5 �contract_token� attachment_dt� machine_idrS � activity_inforR �backcompat_data�response� response_jsonr] r6 r6 r7 �add_contract_machine� s8 � � �z%UAContractClient.add_contract_machinec C sT | � � }| jt|d |d |d |d d�d�}|jdkr'tjt|j|jd��|jS ) z=Requests list of entitlements available to this machine type.� architecturer �kernel�virt�ru r rv rw )� query_paramsrU rV )ra rd �API_V1_AVAILABLE_RESOURCESrX r rh rY ri )r5 rp rr r6 r6 r7 �available_resources� s �� �z$UAContractClient.available_resourcesrm c C sN | � � }|�dd�|�i� | jt|d�}|jdkr$tjt|j|jd��|j S )NrL rM �rS rU rV ) rS r_ r` rd � API_V1_GET_CONTRACT_USING_TOKENrX r rh rY ri )r5 rm rS rr r6 r6 r7 �get_contract_using_token� s � �z)UAContractClient.get_contract_using_token� cloud_typerR c C sz | j tj|d�|d�}|jdkr.|j�dd�}|r$t�|� tj |d��tj t|j|j d��|j}t j �|�dd�� |S ) z�Requests contract token for auto-attach images for Pro clouds. @param instance: AutoAttachCloudInstance for the cloud. @return: Dict of the JSON response containing the contract-token. )r )rR rU �messager[ )� error_msgrV � contractToken)rd �,API_V1_GET_CONTRACT_TOKEN_FOR_CLOUD_INSTANCEr` rX ri rl �LOG�debugr �InvalidProImagerh rY r rj rk )r5 r rR rr �msgrs r6 r6 r7 �%get_contract_token_for_cloud_instance� s* �� � �z6UAContractClient.get_contract_token_for_cloud_instance� machine_token�resourcero c C s� |st �| j�}| �� }|�dd�|�i� tj||d�}| j||d�}|jdkr3t j t|j|j d��|j� d�rA|jd |j d< |j }|� dg �D ] }tj�|� d d �� qJ|S ) a� Requests machine access context for a given resource @param machine_token: The authentication token needed to talk to this contract service endpoint. @param resource: Entitlement name. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing entitlement accessInfo. rL rM )r� �machiner| rU rV �expiresr\ r] r[ )r r^ rB rS r_ r` �"API_V1_GET_RESOURCE_MACHINE_ACCESSrd rX r rh rY rl ri r rj rk ) r5 r� r� ro rS rW rr rs r] r6 r6 r7 �get_resource_machine_access s( � � z,UAContractClient.get_resource_machine_accessc C s� | j j}| j j�d�}t�| j�}| �� }tj ||d�}| � � }|� dd� |�i� | j |||d�}|j dkrAtj||j |jd��|jrU| j j}|j|d< | j �|� d S d S ) z�Report current activity token and enabled services. This will report to the contracts backend all the current enabled services in the system. rZ ��contractr� rL rM )rS rR rU rV rQ N)rH � contract_idr� rl r r^ rB ra � API_V1_UPDATE_ACTIVITY_TOKENr` rS r_ rd rX r rh rY ri �write)r5 r� r� ro � request_datarW rS rr r6 r6 r7 �update_activity_token; s* � � � �z&UAContractClient.update_activity_token� magic_tokenc C s� | � � }|�dd�|�i� | jt|d�}|jdkr t�� �|jdkr't�� �|jdkr6tj t|j|j d��|j }g d�}|D ] }t j �|�|d �� q?|S ) z�Request magic attach token info. When the magic token is registered, it will contain new fields that will allow us to know that the attach process can proceed rL rM r| rT � rU rV �r] �userCoder� r[ )rS r_ r` rd �"API_V1_GET_MAGIC_ATTACH_TOKEN_INFOrX r �MagicAttachTokenError�MagicAttachUnavailablerh rY ri r rj rk rl )r5 r� rS rr rs � secret_fields�fieldr6 r6 r7 �get_magic_attach_token_infoc s( � �z,UAContractClient.get_magic_attach_token_infoc C sx | � � }| jt|dd�}|jdkrt�� �|jdkr$tjt|j|jd��|j}g d�}|D ] }t j � |� |d�� q-|S )z)Create a magic attach token for the user.�POST�rS �methodr� rU rV r� r[ ) rS rd �API_V1_NEW_MAGIC_ATTACHrX r r� rh rY ri r rj rk rl )r5 rS rr rs r� r� r6 r6 r7 �new_magic_attach_token s& � �z'UAContractClient.new_magic_attach_tokenc C s� | � � }|�dd�|�i� | jt|dd�}|jdkr t�� �|jdkr(t�� �|jdkr1t� � �|jdkr@tj t|j|j d ��d S ) z)Revoke a magic attach token for the user.rL rM �DELETEr� � rT r� rU rV N) rS r_ r` rd �API_V1_REVOKE_MAGIC_ATTACHrX r � MagicAttachTokenAlreadyActivatedr� r� rh rY )r5 r� rS rr r6 r6 r7 �revoke_magic_attach_token� s( � ��z*UAContractClient.revoke_magic_attach_tokenr� c C s� |st �| j�}| �� }|�dd�|�i� tj||d�}| �� }| j|d||d |d |d |d d �d �}|j d krFt j ||j |j d ��|j� d �rT|jd |jd < |jS )a| Get the updated machine token from the contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. rL rM r� �GETru r rv rw rx )r� rS ry rU rV r� )r r^ rB rS r_ r` �API_V1_GET_CONTRACT_MACHINEra rd rX r rh rY rl ri )r5 r� r� ro rS rW rp rr r6 r6 r7 �get_contract_machine� s4 ��� � z%UAContractClient.get_contract_machinec C s� |st �| j�}| �� }|�dd�|�i� || �� d�}t|�}tj||d�}| j ||d|d�}|j dkr@t j ||j |j d��|j�d �rN|jd |jd < |jS ) a� Request machine token refresh from contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing refreshed machine-token rL rM rO r� r� )rS r� rR rU rV r� )r r^ rB rS r_ r` ra rc � API_V1_UPDATE_CONTRACT_MACHINErd rX r rh rY rl ri ) r5 r� r� ro rS rR rq rW rr r6 r6 r7 �update_contract_machine� s* ��� � z(UAContractClient.update_contract_machinec C st | � � }|�dd�|�i� tj||d�}| j||dd�}|jdkr(tjdd��|jd kr7tj||j|j d ��|j S ) a� Request guest token associated with this machine's contract @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service @param machine_id: Unique machine id that was registered with the pro backend on attach. @return: Dict of the JSON response containing the guest token rL rM r� r� r� r� �get_guest_token)� feature_namerU rV ) rS r_ r` �API_V1_GET_GUEST_TOKENrd rX r � FeatureNotSupportedOldTokenErrorrh rY ri )r5 r� r� ro rS rW rr r6 r6 r7 r� s$ � � �z UAContractClient.get_guest_tokenc C s� t �� }t �� jt �� jt �� jt �� t �� t � � t � � t |j |j|j|j|j|j|j|j|j|j|j|j|j|jd�jdd�d�}t | j �j rvt | j �j }t!�"� }| j#j$p[t �%| j �| j#j&dd� |D �dd� |D �|rq|j'�(� nd d �}ni }i |�|�S ) z9Return a dict of activity info data for contract requestsr4 F)� keep_none)� distributionrv r ru �desktoprw � clientVersion�cpu_typec S s g | ]}|j �qS r6 )r" ��.0�servicer6 r6 r7 � <listcomp>H s z7UAContractClient._get_activity_info.<locals>.<listcomp>c S s i | ] }|j r|j|j�qS r6 )�variant_enabledr" � variant_namer� r6 r6 r7 � <dictcomp>I s ��z7UAContractClient._get_activity_info.<locals>.<dictcomp>N)� activityID� activityToken� resources�resourceVariantsrN ))r � get_cpu_info�get_release_infor� �get_kernel_info� uname_releaser � get_dpkg_arch� is_desktop� get_virt_typer � get_versionr# r$ r& r' r( r) r* r+ r, r- r. r/ r0 r1 r2 �to_dictr rB � is_attachedr �enabled_servicesr �readrH � activity_idr^ �activity_token� attached_atrb )r5 �cpuinfo� machine_infor� �attachment_datarp r6 r6 r7 ra # s^ ��� � ����z#UAContractClient._get_activity_infor3 ) r9 r: r; �cfg_url_base_attrr r r8 r �retry�socket�timeoutrt r r? r r{ r~ r� r� r� r� r� r� r� r� r� ra � __classcell__r6 r6 rI r7 r@ � s~ ��� �*� �$���� �&( ���� �/���� �(��� �#r@ � request_bodyc C sJ | � di �}| � d�||� d�|� d�|� d�|� d�dt�� jd�d �S ) a? Transforms a request_body that has the new activity_info into a body that includes both old and new forms of machineInfo/activityInfo This is necessary because there may be old ua-airgapped contract servers deployed that we need to support. This function is used for attach and refresh calls. rQ rP ru r� rv r �Linux)r� rv r �type�release)rP rQ ru �os)rl r r� r� )r� rp r6 r6 r7 rc ] s ��rc TrB �past_entitlements�new_entitlements� allow_enabler rC c C sj ddl m} d}g }g }|| �D ]|} z|| } W n ty! Y qw g }zt| |�| i �| ||d�\} } W nM tjy[ } zt�| � d}|� | � t� d| | � W Y d} ~ qd} ~ w t y� } z t�| � |� | � |� | � t�d| | � W Y d} ~ qd} ~ ww | r�| r�t � | � qt �|� t|�dkr�tjd d � t||�D �d ��|r�tjd d � |D �d ��dS ) a� Iterate over all entitlements in new_entitlement and apply any delta found according to past_entitlements. :param cfg: UAConfig instance :param past_entitlements: dict containing the last valid information regarding service entitlements. :param new_entitlements: dict containing the current information regarding service entitlements. :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. r )�entitlements_enable_orderF)rB � orig_access� new_accessr� r Tz+Failed to process contract delta for %s: %rNz5Unexpected error processing contract delta for %s: %rc S s* g | ]\}}|t jjt|�t� d �f�qS ))r� �log_path)r �UNEXPECTED_ERRORr` r? r )r� r" � exceptionr6 r6 r7 r� � s ����z.process_entitlements_delta.<locals>.<listcomp>)�failed_servicesc S s g | ]}|t jf�qS r6 )r �!E_ATTACH_FAILURE_DEFAULT_SERVICES)r� r" r6 r6 r7 r� � s ��)�uaclient.entitlementsr� �KeyError�process_entitlement_deltarl r �UbuntuProErrorr� r� �append�error� Exception�event�service_processed�services_failed�len�AttachFailureUnknownError�zip� AttachFailureDefaultServices)rB r� r� r� r r� � delta_error�unexpected_errorsr� r" �new_entitlement�deltas�service_enabled�er6 r6 r7 �process_entitlements_deltax sr � � �� ��� � �� ���r� Fr� r� c C s� ddl m} |r t|� t�||�}d}|rh|�di ��d�}|s*|�di ��d�}|s3tj||d��|�di ��di ��d d �} z || || d �} W n tjy_ } zt � d |� | �d } ~ ww | j |||d�}||fS )a, Process a entitlement access dictionary deltas if they exist. :param cfg: UAConfig instance :param orig_access: Dict with original entitlement access details before contract refresh deltas :param new_access: Dict with updated entitlement access details after contract refresh :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. :raise UbuntuProError: on failure to process deltas. :return: A tuple containing a dict of processed deltas and a boolean indicating if the service was fully processed r ��entitlement_factoryF� entitlementr� )�orig�new� entitlements� obligations� use_selectorr[ �rB r" r z3Skipping entitlement deltas for "%s". No such classN�r� ) r� r �apply_contract_overridesr �get_dict_deltasrl r � InvalidContractDeltasServiceType�EntitlementNotFoundErrorr� r� �process_contract_deltas) rB r� r� r� r r r� �retr" r r �excr6 r6 r7 r� � sD � � �����r� rr c C s� | j �d�}|rJ|d }|d }|dkr(|d �t�}tj|||d �d�d��|dkr@|d �t�}tj|||d �d�d ��|d krJtj|d ��t�� �) N�info� contractId�reasonzno-longer-effective�timez%m-%d-%Y)r� �date�contract_expiry_dateznot-effective-yet)r� r �contract_effective_dateznever-effective)r� ) ri rl �strftimer r �AttachForbiddenExpired�AttachForbiddenNotYet�AttachForbiddenNever�AttachExpiredToken)rr r r� r r r6 r6 r7 rg s* � � rg c C s� t �| �}|�� }|j}|d }|d d d }t| d�}|j||d�}|�|� tj� � |� di �� dt�| ��}t �|� t | ||�� dd � d S ) z�Request contract refresh from ua-contracts service. :raise UbuntuProError: on failure to update contract or error processing contract deltas :raise ConnectivityError: On failure during a connection rZ �machineTokenInfo� contractInfo�idrD )r� r� rP Fr N) rF rG r r� r@ r� r� r r^ � cache_clearrl r r� ) rB rH �orig_entitlements� orig_tokenr� r� �contract_client�respro r6 r6 r7 �refresh. s* � � �r$ c C s t | �}|�� }|�dg �S )zDQuery available resources from the contract server for this machine.r� )r@ r{ rl )rB �clientr� r6 r6 r7 �get_available_resourcesO s r& r] c C s t | �}|�|�S )z/Query contract information for a specific token)r@ r~ )rB r] r% r6 r6 r7 �get_contract_informationV s r' �override_selector�selector_valuesc C s< d}| � � D ]\}}||f|� � vr dS |t| 7 }q|S )Nr )�items�OVERRIDE_SELECTOR_WEIGHTS)r( r) �override_weight�selector�valuer6 r6 r7 �_get_override_weight\ s r/ r � series_namer c C sz i }||d�}|r ||d< | � di �� |i �}|r ||td < t�| �dg ��}|D ]}t|� d�|�} | r:||| < q*|S )N)r r r r r � overridesr- )�popr+ �copy�deepcopyrl r/ ) r r0 r r r1 r) r �general_overrides�override�weightr6 r6 r7 �_select_overridesh s" � ��r8 r c C s� ddl m} tt| t�d| v g�std�| ���|du r!t�� j n|}|� \}}| � di �}t ||||�}t |� � �D ]%\} } | � � D ] \} } | d � | �} t| t�rY| �| � qC| | d | < qCq;dS )a� Apply series-specific overrides to an entitlement dict. This function mutates orig_access dict by applying any series-overrides to the top-level keys under 'entitlement'. The series-overrides are sparse and intended to supplement existing top-level dict values. So, sub-keys under the top-level directives, obligations and affordance sub-key values will be preserved if unspecified in series-overrides. To more clearly indicate that orig_access in memory has already had the overrides applied, the 'series' key is also removed from the orig_access dict. :param orig_access: Dict with original entitlement access details r )�get_cloud_typer z?Expected entitlement access dict. Missing "entitlement" key: {}N)�uaclient.clouds.identityr9 �all� isinstance�dict� RuntimeErrorr` r r� r rl r8 �sortedr* r_ )r� r r r9 r0 r �_�orig_entitlementr1 �_weight�overrides_to_apply�keyr. �currentr6 r6 r7 r � s* �� � ��r r c C s� ddl m} g }|�� D ]H\}}|�di ��dd�}z || ||d�}W n tjy- Y q w |�di ��di �}|�d�} |�|| �rT|�� \} } | rT|�t ||d �� q |S ) Nr r� r r r[ r r � resourceToken)r" r ) r� r r* rl r r �_should_enable_by_default� can_enabler� r! ) rB r r �enable_by_default_services�ent_name� ent_valuer �entr rF rH r@ r6 r6 r7 � get_enabled_by_default_services� s, � ���rM )T)FTr3 )NN)Qr3 �loggingr� � collectionsr �typingr r r r r � uaclient.files.machine_token�filesr� rF �uaclientr r r r r r r r r �-uaclient.api.u.pro.status.enabled_services.v1r �(uaclient.api.u.pro.status.is_attached.v1r �uaclient.configr �uaclient.defaultsr �uaclient.files.state_filesr r � uaclient.httpr � uaclient.logr re r� r� rz r� r� r� r} r� r� r� r� r+ �get_event_loggerr� � getLogger� replace_top_level_logger_namer9 r� r! � DataObjectr# �UAServiceClientr@ r= rc r? �boolr� r� � HTTPResponse� NamedMessagerg r$ r& r' �intr/ r8 r rM r6 r6 r6 r7 �<module> s� , �������W C �� � ��� �^�� � ��� �?� � ! � � �� ���� � � ��� �1� ��