One Hat Cyber Team
Your IP :
10.30.1.1
Server IP :
103.148.201.5
Server :
Linux web-olt 5.15.0-156-generic #166-Ubuntu SMP Sat Aug 9 00:02:46 UTC 2025 x86_64
Server Software :
Apache/2.4.52 (Ubuntu)
PHP Version :
8.1.29
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
uaclient
/
__pycache__
/
View File Name :
contract.cpython-310.pyc
o ~�'f�{ � @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z m Z d dl m Z m Z mZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlm Z d d l m Z m Z d d l m!Z! d d l"m#Z# d Z$d Z%d Z&dZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.ddddd�Z/e �0� Z1e�2e�3e4��Z5edddg�Z6G d d � d e!j7�Z8d e9fd d �Z: !dJd"ed#ee;ef d$ee;ef d%e<d&e<d'df d(d)�Z= * !dKd"ed+ee;ef d,ee;ef d%e<d&e<d'e ee<f f d-d.�Z>d/ej?d'ej@fd0d1�ZAd2d3� ZBd"ed'ee fd4d5�ZCd"ed6e;d'ee;ef fd7d8�ZDd"ed'e<fd9d:�ZEd;ee;e;f d<ee;e;f d'eFfd=d>�ZG dLd?ee;ef d@e;dAe;de e; d'eeFee;ef f f dBdC�ZH dMd+ee;ef dDe e; de e; d'dfdEdF�ZId"edGee;ef d'ee6 fdHdI�ZJdS )N� N)� namedtuple)�Any�Dict�List�Optional�Tuple) �clouds� event_logger� exceptions�http�messages�secret_manager�system�util�version)�_enabled_services)� _is_attached)�UAConfig)�ATTACH_FAIL_DATE_FORMAT)�attachment_data_file�machine_id_file)� serviceclient)� get_user_or_root_log_file_pathz/v1/context/machines/tokenz3/v1/contracts/{contract}/context/machines/{machine}z /v1/resourcesz3/v1/resources/{resource}/context/machines/{machine}z /v1/clouds/{cloud_type}/tokenz3/v1/contracts/{contract}/machine-activity/{machine}z /v1/contractz/v1/magic-attach� � � � )�series_overrides�series�cloud�variant�EnableByDefaultService�namer c @ sH e Zd ZdZejejg d�d� d%dd��Zde e e f fdd �Z d e de e e f fd d �Z ejejg d�d�d ejfdd��Z d%de de dee de e e f fdd�Zdd� Zde de e e f fdd�Zde e e f fdd�Zde fd d �Z d%de d e dee de e e f fd d �Z d%de d e dee de fd!d"�Zd#d$� ZdS )&�UAContractClient� contract_url)r r r )� retry_sleepsNc C s� |st �| j�}| �� }|�dd�|�i� | �� }|�� |d< ||d�}t|�}| j t ||d�}|j dkr:t � � �|j dkrCt|� |j dkrRt jt |j |jd ��|j} tj�| �d d �� | �d g �D ] } tj�| �d d �� qe| S )a} Requests machine attach to the provided machine_id. @param contract_token: Token string providing authentication to ContractBearer service endpoint. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing the machine-token. � Authorization� Bearer {}�lastAttachment�� machineId� activityInfo)�data�headers� i� �� ��url�code�body� machineToken� �resourceTokens�token)r �get_machine_id�cfgr- �update�format�_get_activity_info� isoformat�_support_old_machine_info� request_url�API_V1_ADD_CONTRACT_MACHINEr2 r �AttachInvalidTokenError� _raise_attach_forbidden_message�ContractAPIErrorr3 � json_dictr �secrets� add_secret�get) �self�contract_token� attachment_dt� machine_idr- � activity_infor, �backcompat_data�response� response_jsonr7 � rP �3/usr/lib/python3/dist-packages/uaclient/contract.py�add_contract_machineD s8 � � �z%UAContractClient.add_contract_machine�returnc C sT | � � }| jt|d |d |d |d d�d�}|jdkr'tjt|j|jd��|jS ) z=Requests list of entitlements available to this machine type.� architecturer �kernel�virt�rT r rU rV )� query_paramsr/ r0 )r< r? �API_V1_AVAILABLE_RESOURCESr2 r rC r3 rD )rH rL rN rP rP rQ �available_resourceso s �� �z$UAContractClient.available_resourcesrI c C sN | � � }|�dd�|�i� | jt|d�}|jdkr$tjt|j|jd��|j S )Nr& r' �r- r/ r0 ) r- r: r; r? � API_V1_GET_CONTRACT_USING_TOKENr2 r rC r3 rD )rH rI r- rN rP rP rQ �get_contract_using_token� s � �z)UAContractClient.get_contract_using_token�instancec C s~ | j tj|jd�|jd�}|jdkr0|j�dd�}|r&t� |� t j |d��t j t|j|j d��|j}tj�|�dd�� |S ) z�Requests contract token for auto-attach images for Pro clouds. @param instance: AutoAttachCloudInstance for the cloud. @return: Dict of the JSON response containing the contract-token. )� cloud_type)r, r/ �messager5 )� error_msgr0 � contractToken)r? �,API_V1_GET_CONTRACT_TOKEN_FOR_CLOUD_INSTANCEr; r_ � identity_docr2 rD rG �LOG�debugr �InvalidProImagerC r3 r rE rF )rH r^ rN �msgrO rP rP rQ �%get_contract_token_for_cloud_instance� s* �� � �z6UAContractClient.get_contract_token_for_cloud_instance� machine_token�resourcerK c C s� |st �| j�}| �� }|�dd�|�i� tj||d�}| j||d�}|jdkr3t j t|j|j d��|j� d�rA|jd |j d< |j }|� dg �D ] }tj�|� d d �� qJ|S ) a� Requests machine access context for a given resource @param machine_token: The authentication token needed to talk to this contract service endpoint. @param resource: Entitlement name. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing entitlement accessInfo. r& r' )rk �machiner[ r/ r0 �expiresr6 r7 r5 )r r8 r9 r- r: r; �"API_V1_GET_RESOURCE_MACHINE_ACCESSr? r2 r rC r3 rG rD r rE rF ) rH rj rk rK r- r1 rN rO r7 rP rP rQ �get_resource_machine_access� s( � � z,UAContractClient.get_resource_machine_accessc C s� | j jj}| j j�d�}t�| j �}| �� }tj ||d�}| � � }|� dd� |�i� | j |||d�}|j dkrBtj||j |jd��|jrW| j j}|j|d< | j j�|� d S d S ) z�Report current activity token and enabled services. This will report to the contracts backend all the current enabled services in the system. r4 ��contractrl r& r' )r- r, r/ r0 r+ N)r9 �machine_token_file� contract_idrj rG r r8 r< � API_V1_UPDATE_ACTIVITY_TOKENr; r- r: r? r2 r rC r3 rD �write)rH rs rj rK � request_datar1 r- rN rP rP rQ �update_activity_token� s& � � �z&UAContractClient.update_activity_token� magic_tokenc C s� | � � }|�dd�|�i� | jt|d�}|jdkr t�� �|jdkr't�� �|jdkr6tj t|j|j d��|j }g d�}|D ] }t j �|�|d �� q?|S ) z�Request magic attach token info. When the magic token is registered, it will contain new fields that will allow us to know that the attach process can proceed r& r' r[ r. � r/ r0 �r7 �userCoderb r5 )r- r: r; r? �"API_V1_GET_MAGIC_ATTACH_TOKEN_INFOr2 r �MagicAttachTokenError�MagicAttachUnavailablerC r3 rD r rE rF rG )rH rx r- rN rO � secret_fields�fieldrP rP rQ �get_magic_attach_token_info� s( � �z,UAContractClient.get_magic_attach_token_infoc C sx | � � }| jt|dd�}|jdkrt�� �|jdkr$tjt|j|jd��|j}g d�}|D ] }t j � |� |d�� q-|S )z)Create a magic attach token for the user.�POST�r- �methodry r/ r0 rz r5 ) r- r? �API_V1_NEW_MAGIC_ATTACHr2 r r~ rC r3 rD r rE rF rG )rH r- rN rO r r� rP rP rQ �new_magic_attach_token s& � �z'UAContractClient.new_magic_attach_tokenc C s� | � � }|�dd�|�i� | jt|dd�}|jdkr t�� �|jdkr(t�� �|jdkr1t� � �|jdkr@tj t|j|j d ��d S ) z)Revoke a magic attach token for the user.r& r' �DELETEr� i� r. ry r/ r0 N) r- r: r; r? �API_V1_REVOKE_MAGIC_ATTACHr2 r � MagicAttachTokenAlreadyActivatedr} r~ rC r3 )rH rx r- rN rP rP rQ �revoke_magic_attach_token1 s( � ��z*UAContractClient.revoke_magic_attach_tokenrs c C s� |st �| j�}| �� }|�dd�|�i� tj||d�}| �� }| j|d||d |d |d |d d �d �}|j d krFt j ||j |j d ��|j� d �rT|jd |jd < |jS )a| Get the updated machine token from the contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. r& r' rp �GETrT r rU rV rW )r� r- rX r/ r0 rm )r r8 r9 r- r: r; �API_V1_GET_CONTRACT_MACHINEr< r? r2 r rC r3 rG rD )rH rj rs rK r- r1 rL rN rP rP rQ �get_contract_machineH s4 ��� � z%UAContractClient.get_contract_machinec C s� |st �| j�}| �� }|�dd�|�i� || �� d�}t|�}tj||d�}| j ||d|d�}|j dkr@t j ||j |j d��|j�d �rN|jd |jd < |jS ) a� Request machine token refresh from contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing refreshed machine-token r& r' r) rp r� )r- r� r, r/ r0 rm )r r8 r9 r- r: r; r< r> � API_V1_UPDATE_CONTRACT_MACHINEr? r2 r rC r3 rG rD ) rH rj rs rK r- r, rM r1 rN rP rP rQ �update_contract_machines s* ��� � z(UAContractClient.update_contract_machinec C s� t �� jt �� jt �� jt �� t �� t �� t � � d�}t | j �j rQt| j �j}t�� }| j jjp5t �| j �| j jjdd� |D �dd� |D �|rL|j�� ndd�}ni }i |�|�S )z9Return a dict of activity info data for contract requests)� distributionrU r rT �desktoprV � clientVersionc S s g | ]}|j �qS rP )r" ��.0�servicerP rP rQ � <listcomp>� s z7UAContractClient._get_activity_info.<locals>.<listcomp>c S s i | ] }|j r|j|j�qS rP )�variant_enabledr" � variant_namer� rP rP rQ � <dictcomp>� s ��z7UAContractClient._get_activity_info.<locals>.<dictcomp>N)� activityID� activityToken� resources�resourceVariantsr( )r �get_release_infor� �get_kernel_info� uname_releaser � get_dpkg_arch� is_desktop� get_virt_typer � get_versionr r9 � is_attachedr �enabled_servicesr �readrr � activity_idr8 �activity_token� attached_atr= )rH � machine_infor� �attachment_datarL rP rP rQ r< � s8 � � ����z#UAContractClient._get_activity_info�N)�__name__� __module__� __qualname__�cfg_url_base_attrr �retry�socket�timeoutrR r �strr rZ r] r �AutoAttachCloudInstanceri r ro rw r� r� r� r� r� r< rP rP rP rQ r# A s\ �* �$���� �&& ���� �/���� � (r# � request_bodyc C sJ | � di �}| � d�||� d�|� d�|� d�|� d�dt�� jd�d �S ) a? Transforms a request_body that has the new activity_info into a body that includes both old and new forms of machineInfo/activityInfo This is necessary because there may be old ua-airgapped contract servers deployed that we need to support. This function is used for attach and refresh calls. r+ r* rT r� rU r �Linux)r� rU r �type�release)r* r+ rT �os)rG r r� r� )r� rL rP rP rQ r> � s ��r> Tr9 �past_entitlements�new_entitlements� allow_enabler rS c C sj ddl m} d}g }g }|| �D ]|} z|| } W n ty! Y qw g }zt| |�| i �| ||d�\} } W nM tjy[ } zt�| � d}|� | � t� d| | � W Y d} ~ qd} ~ w t y� } z t�| � |� | � |� | � t�d| | � W Y d} ~ qd} ~ ww | r�| r�t � | � qt �|� t|�dkr�tjd d � t||�D �d ��|r�tjd d � |D �d ��dS ) a� Iterate over all entitlements in new_entitlement and apply any delta found according to past_entitlements. :param cfg: UAConfig instance :param past_entitlements: dict containing the last valid information regarding service entitlements. :param new_entitlements: dict containing the current information regarding service entitlements. :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. r )�entitlements_enable_orderF)r9 � orig_access� new_accessr� r Tz+Failed to process contract delta for %s: %rNz5Unexpected error processing contract delta for %s: %rc S s* g | ]\}}|t jjt|�t� d �f�qS ))ra �log_path)r �UNEXPECTED_ERRORr; r� r )r� r" � exceptionrP rP rQ r� % s ����z.process_entitlements_delta.<locals>.<listcomp>)�failed_servicesc S s g | ]}|t jf�qS rP )r �!E_ATTACH_FAILURE_DEFAULT_SERVICES)r� r" rP rP rQ r� 2 s ��)�uaclient.entitlementsr� �KeyError�process_entitlement_deltarG r �UbuntuProErrorre r� �append�error� Exception�event�service_processed�services_failed�len�AttachFailureUnknownError�zip� AttachFailureDefaultServices)r9 r� r� r� r r� � delta_error�unexpected_errorsr� r" �new_entitlement�deltas�service_enabled�erP rP rQ �process_entitlements_delta� sr � � �� ��� � �� ���r� Fr� r� c C s� ddl m} |r t|� t�||�}d}|rn|�di ��d�}|s*|�di ��d�}|s3tj||d��|�di ��di ��d d �} z || || d �} W n tjy_ } zt � d |� | �d } ~ ww | | |d�} | j |||d�}||fS )a, Process a entitlement access dictionary deltas if they exist. :param cfg: UAConfig instance :param orig_access: Dict with original entitlement access details before contract refresh deltas :param new_access: Dict with updated entitlement access details after contract refresh :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. :raise UbuntuProError: on failure to process deltas. :return: A tuple containing a dict of processed deltas and a boolean indicating if the service was fully processed r ��entitlement_factoryF� entitlementr� )�orig�new� entitlements� obligations� use_selectorr5 �r9 r" r z3Skipping entitlement deltas for "%s". No such classN)r9 � assume_yes�r� ) r� r� �apply_contract_overridesr �get_dict_deltasrG r � InvalidContractDeltasServiceType�EntitlementNotFoundErrorre rf �process_contract_deltas) r9 r� r� r� r r� r� �retr" r �ent_cls�excr� rP rP rQ r� 9 s> � ���� �r� rN c C s� | j �d�}|rJ|d }|d }|dkr(|d �t�}tj|||d �d�d��|dkr@|d �t�}tj|||d �d�d ��|d krJtj|d ��t�� �) N�info� contractId�reasonzno-longer-effective�timez%m-%d-%Y)rs �date�contract_expiry_dateznot-effective-yet)rs r� �contract_effective_dateznever-effective)rs ) rD rG �strftimer r �AttachForbiddenExpired�AttachForbiddenNotYet�AttachForbiddenNever�AttachExpiredToken)rN r� rs r� r� rP rP rQ rB u s* � � rB c C s� | j j}| j}|d }|d d d }t| �}|j||d�}| j �|� tj�� |� di �� dt�| ��}t �|� t | || j jdd� d S ) a Request contract refresh from ua-contracts service. :param cfg: Instance of UAConfig for this machine. :raise UbuntuProError: on failure to update contract or error processing contract deltas :raise ConnectivityError: On failure during a connection r4 �machineTokenInfo� contractInfo�id)rj rs r* Fr� N) rr r� rj r# r� ru r r8 � cache_clearrG r r� )r9 �orig_entitlements� orig_tokenrj rs �contract_client�resprK rP rP rQ �refresh� s( � � �r c C s t | �}|�� }|�dg �S )zDQuery available resources from the contract server for this machine.r� )r# rZ rG )r9 �clientr� rP rP rQ �get_available_resources� s r r7 c C s t | �}|�|�S )z/Query contract information for a specific token)r# r] )r9 r7 r rP rP rQ �get_contract_information� s r c C s� | j }| jj}|�dd�}|�di ��di ��dd �}|s dS t| �}|�||�}|�di ��di ��dd �}|r;|n| jj}| jj|krGdS | j�|�} t| � � �D ]\} } t � |�| i �| �} | rf dS qSdS ) Nr4 r5 r� r� r� F� effectiveToT) rj rr r� rG r# r� �contract_expiry_datetime�get_entitlements_from_token�sorted�itemsr r� ) r9 r r� rj rs r r � resp_expiry� new_expiry�curr_entitlementsr" r� r� rP rP rQ �is_contract_changed� s@ � ��� � ��r �override_selector�selector_valuesc C s< d}| � � D ]\}}||f|� � vr dS |t| 7 }q|S )Nr )r �OVERRIDE_SELECTOR_WEIGHTS)r r �override_weight�selector�valuerP rP rQ �_get_override_weight� s r r� � series_namer_ c C sz i }||d�}|r ||d< | � di �� |i �}|r ||td < t�| �dg ��}|D ]}t|� d�|�} | r:||| < q*|S )N)r r r r r � overridesr )�popr �copy�deepcopyrG r ) r� r r_ r r r r �general_overrides�override�weightrP rP rQ �_select_overrides� s" � ��r r c C s� ddl m} tt| t�d| v g�std�| ���|du r!t�� j n|}|� \}}| � di �}t ||||�}t |� � �D ]%\} } | � � D ] \} } | d � | �} t| t�rY| �| � qC| | d | < qCq;dS )a� Apply series-specific overrides to an entitlement dict. This function mutates orig_access dict by applying any series-overrides to the top-level keys under 'entitlement'. The series-overrides are sparse and intended to supplement existing top-level dict values. So, sub-keys under the top-level directives, obligations and affordance sub-key values will be preserved if unspecified in series-overrides. To more clearly indicate that orig_access in memory has already had the overrides applied, the 'series' key is also removed from the orig_access dict. :param orig_access: Dict with original entitlement access details r )�get_cloud_typer� z?Expected entitlement access dict. Missing "entitlement" key: {}N)�uaclient.clouds.identityr �all� isinstance�dict� RuntimeErrorr; r r� r rG r r r r: )r� r r r r r_ �_�orig_entitlementr �_weight�overrides_to_apply�keyr �currentrP rP rQ r� s* �� � ��r� r� c C s� ddl m} g }|�� D ]L\}}|�di ��dd�}z || ||d�}W n tjy- Y q w || �}|�di ��di �} |�d�} |�| | �rX|�� \} } | rX|�t ||d �� q |S ) Nr r� r� r� r5 r� r� � resourceToken)r" r ) r� r� r rG r r� �_should_enable_by_default� can_enabler� r! ) r9 r� r� �enable_by_default_services�ent_name� ent_valuer r� �entr� r, r. r& rP rP rQ � get_enabled_by_default_servicesA s2 �� ���r3 )T)FTr� )NN)Kr �loggingr� � collectionsr �typingr r r r r �uaclientr r r r r r r r r �-uaclient.api.u.pro.status.enabled_services.v1r �(uaclient.api.u.pro.status.is_attached.v1r �uaclient.configr �uaclient.defaultsr �uaclient.files.state_filesr r � uaclient.httpr � uaclient.logr r@ r� r� rY rn rc rt r\ r| r� r� r �get_event_loggerr� � getLogger� replace_top_level_logger_namer� re r! �UAServiceClientr# r$ r> r� �boolr� r� � HTTPResponse� NamedMessagerB r r r r �intr r r� r3 rP rP rP rQ �<module> s� , ������ �� � ��� �^�� � ��� �<� � " & � � �� ���� � � ��� �1� ��