GKiddlZddlZddlZddlmZddlmZmZmZm Z m Z ddl m cm ZddlmZmZmZmZmZmZmZmZmZddlmZddlmZddlmZddlm Z dd l!m"Z"m#Z#dd l$m%Z%dd l&m'Z'd Z(d Z)d Z*dZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2dZ3dddddZ4ejjZ6ejnejpe9Z:edddgZ;GddejxZ=Gdd e%j|Z?d!e@fd"ZA d?d#ed$eeBefd%eeBefd&eCd'eCd(eCd)dfd*ZD d@d#ed+eeBefd,eeBefd&eCd'eCd(eCd)e eeCffd-ZEd.ejd)ejfd/ZHdAd#efd0ZId#ed)eefd1ZJd#ed2eBd)eeBeffd3ZKd4eeBeBfd5eeBeBfd)eLfd6ZM dBd7eeBefd8eBd9eBde eBd)eeLeeBefff d:ZN dCd+eeBefd;e eBde eBd)dfd<ZOd#ed=eeBefd)ee;fd>ZPy)DN) namedtuple)AnyDictListOptionalTuple) data_types event_logger exceptionshttpmessagessecret_managersystemutilversion)_enabled_services) _is_attached)UAConfig)ATTACH_FAIL_DATE_FORMAT)attachment_data_filemachine_id_file) serviceclient)get_user_or_root_log_file_pathz/v1/context/machines/tokenz3/v1/contracts/{contract}/context/machines/{machine}z /v1/resourcesz3/v1/resources/{resource}/context/machines/{machine}z/v1/clouds/{cloud_type}/tokenz3/v1/contracts/{contract}/machine-activity/{machine}z /v1/contractz/v1/magic-attachz?/v1/contracts/{contract}/context/machines/{machine}/guest-token)series_overridesseriescloudvariantEnableByDefaultServicenamer!c eZdZejdej dejdej dejdej dejdej dejdej dejdej dejd ej dejd ej dejd ej dejd ej dejd ej dejdej dejdej dejdej dgZ ddeedeedeedeedeedeed eed eed eed eed eedeedeedeefdZ y) CPUTypeData cpuinfo_cpuF)requiredcpuinfo_cpu_architecturecpuinfo_cpu_familycpuinfo_cpu_implementercpuinfo_cpu_partcpuinfo_cpu_revisioncpuinfo_cpu_variant cpuinfo_modelcpuinfo_model_namecpuinfo_steppingcpuinfo_vendor_id"sys_firmware_devicetree_base_model sysinfo_model sysinfo_typeNc||_||_||_||_||_||_||_||_| |_| |_ | |_ | |_ | |_ ||_ yNr&r(r)r*r+r,r-r.r/r0r1r2r3r4)selfr&r(r)r*r+r,r-r.r/r0r1r2r3r4s 3/usr/lib/python3/dist-packages/uaclient/contract.py__init__zCPUTypeData.__init__zsy"'(@%"4'>$ 0$8!#6 *"4 0!2 . /+()NNNNNNNNNNNNNN) __name__ __module__ __qualname__r FieldStringDataValuefieldsrstrr:r;r9r%r%Fs  :55    &  & &   *"<"$>    !:#=#=    Z77%    *"<"r;)rrr) retry_sleepsc<|stj|j}|j}|j ddj |i|j }|j|d<||d}t|}|jt||}|jdk(rtj|jdk(r t||jdk7r0tjt|j|j |j"} t$j&j)| j+d d | j+d gD]1} t$j&j)| j+d d 3| S)a}Requests machine attach to the provided machine_id. @param contract_token: Token string providing authentication to ContractBearer service endpoint. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing the machine-token. Authorization Bearer {}lastAttachment machineId activityInfo)dataheadersiurlcodebody machineTokenresourceTokenstoken)rget_machine_idrGrYupdateformat_get_activity_info isoformat_support_old_machine_info request_urlAPI_V1_ADD_CONTRACT_MACHINEr^r AttachInvalidTokenError_raise_attach_forbidden_messageContractAPIErrorr_ json_dictrsecrets add_secretget) r8contract_token attachment_dt machine_idrY activity_inforXbackcompat_dataresponse response_jsonrcs r9add_contract_machinez%UAContractClient.add_contract_machinesl..txx8J,,.););N)KLM//1 *7*A*A*C &''G3D9## 'ow$  ==C 446 6 ]]c ! +H 5 ==C --/]]]]  !** ))   nb 1 #&&'7< FE  " " - -eii.D E Fr;c|j}|jt|d|d|d|dd}|jdk7r0t j t|j|j |jS) z=Requests list of entitlements available to this machine type. architecturerkernelvirtr|rr}r~) query_paramsr[r\)rgrjAPI_V1_AVAILABLE_RESOURCESr^r rnr_ro)r8rvrxs r9available_resourcesz$UAContractClient.available_resourcess//1 ## & -n ='1'1%f- $  ==C --.]]]]  !!!r;rsc*|j}|jddj|i|jt|}|j dk7r0t jt|j |j|jS)NrRrSrYr[r\) rYrerfrjAPI_V1_GET_CONTRACT_USING_TOKENr^r rnr_ro)r8rsrYrxs r9get_contract_using_tokenz)UAContractClient.get_contract_using_tokens,,.););N)KLM## +W$  ==C --3]]]]  !!!r; cloud_typerXc|jtj||}|jdk7ry|jj dd}|r+t j|tj|tjt|j|j|j}tjj|j dd|S) zRequests contract token for auto-attach images for Pro clouds. @param instance: AutoAttachCloudInstance for the cloud. @return: Dict of the JSON response containing the contract-token. )r)rXr[messagera) error_msgr\ contractToken)rj,API_V1_GET_CONTRACT_TOKEN_FOR_CLOUD_INSTANCErfr^rorrLOGdebugr InvalidProImagernr_rrprq)r8rrXrxmsgrys r9%get_contract_token_for_cloud_instancez6UAContractClient.get_contract_token_for_cloud_instances## 8 ? ?% @  $  ==C $$((B7C # 003??--@]]]]  !** ))   or 2 r; machine_tokenresourceruc|stj|j}|j}|j ddj |it j ||}|j||}|jdk7r0tjt |j|j|jjdr|jd|jd<|j}|jdgD]1}tjj!|jd d 3|S) aRequests machine access context for a given resource @param machine_token: The authentication token needed to talk to this contract service endpoint. @param resource: Entitlement name. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing entitlement accessInfo. rRrS)rmachinerr[r\expiresrbrcra)rrdrGrYrerf"API_V1_GET_RESOURCE_MACHINE_ACCESSrjr^r rnr_rrrorrprq) r8rrrurYr]rxryrcs r9get_resource_machine_accessz,UAContractClient.get_resource_machine_accesss# ..txx8J,,.););M)JKL077z8 ##C#9 ==C --6]]]]       *,4,<,,>M. )  # # ) )- 8 r; magic_tokenc.|j}|jddj|i|jt|}|j dk(rt j|j dk(rt j|j dk7r0t jt|j |j|j}gd}|D]1}tjj|j|d 3|S) zRequest magic attach token info. When the magic token is registered, it will contain new fields that will allow us to know that the attach process can proceed rRrSrrZr[r\rcuserCoderra)rYrerfrj"API_V1_GET_MAGIC_ATTACH_TOKEN_INFOr^r MagicAttachTokenErrorMagicAttachUnavailablernr_rorrprqrr)r8rrYrxry secret_fieldsfields r9get_magic_attach_token_infoz,UAContractClient.get_magic_attach_token_infocs ,,.););K)HIJ## .$  ==C 224 4 ==C 335 5 ==C --6]]]]  !** > " LE  " " - -m.?.?r.J K Lr;c|j}|jt|d}|jdk(rt j |jdk7r0t j t|j|j|j}gd}|D]1}tjj|j|d3|S)z)Create a magic attach token for the user.POSTrYmethodrr[r\rra) rYrjAPI_V1_NEW_MAGIC_ATTACHr^r rrnr_rorrprqrr)r8rYrxryrrs r9new_magic_attach_tokenz'UAContractClient.new_magic_attach_tokens,,.## #$  ==C 335 5 ==C --+]]]]  !** > " LE  " " - -m.?.?r.J K Lr;c|j}|jddj|i|jt|d}|j dk(rt j|j dk(rt j|j dk(rt j|j dk7r0t jt|j |j y ) z)Revoke a magic attach token for the user.rRrSDELETErrZrr[r\N) rYrerfrjAPI_V1_REVOKE_MAGIC_ATTACHr^r MagicAttachTokenAlreadyActivatedrrrnr_)r8rrYrxs r9revoke_magic_attach_tokenz*UAContractClient.revoke_magic_attach_tokens,,.););K)HIJ## &$  ==C ==? ? ==C 224 4 ==C 335 5 ==C --.]]]]  r;rc >|stj|j}|j}|j ddj |it j ||}|j}|j|d||d|d|d|dd  }|jd k7r,tj||j|j |jjd r|jd |jd <|jS)a|Get the updated machine token from the contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. rRrSrGETr|rr}r~r)rrYrr[r\r)rrdrGrYrerfAPI_V1_GET_CONTRACT_MACHINErgrjr^r rnr_rrro)r8rrrurYr]rvrxs r9get_contract_machinez%UAContractClient.get_contract_machines..txx8J,,.););M)JKL)00 1 //1 ##  -n ='1'1%f-  $   ==C --hmm(--       *,4,<,)*J r6)r<r=r>cfg_url_base_attrrrr:rretrysockettimeoutrzrrBrrrrrrrrrrrrrg __classcell__)rOs@r9rErEs&#'? h ? ?TZZY78<(8(T"T#s(^"( "s "tCH~ "TZZY7 (,S#X8H%) $$$SM $ c3h $L&9PstCH~8S#X.S6%) )")")"SM )" c3h )"^%) &"&"&"SM &"  &"P!"!"!" !"  !"F7 r;rE request_bodyc |jdi}|jd||jd|jd|jd|jddtjjdd S) a? Transforms a request_body that has the new activity_info into a body that includes both old and new forms of machineInfo/activityInfo This is necessary because there may be old ua-airgapped contract servers deployed that we need to support. This function is used for attach and refresh calls. rWrVr|rr}rLinux)rr}rtyperelease)rVrWr|os)rrrrr)rrvs r9riri]s!$$^R8M"%%k2%%)).9)--n=#''1#''1..088  r;rGpast_entitlementsnew_entitlements allow_enablerverboserHc ddlm}d}g}g} ||D]J} || } g} t||j | i| |||\} } | s3| s6t j | Lt j| t|dkDretj t#| |D cgc]9\} }| t$j&j)t+|t- f;c}} |r4tj.| D cgc]} | t$j0fc} y#t$rYwxYw#tj$rJ}tj|d}| j| tjd| | Yd}~td}~wt$rY}tj||j|| j| tjd| | Yd}~d}~wwxYwcc}} wcc} w) aIterate over all entitlements in new_entitlement and apply any delta found according to past_entitlements. :param cfg: UAConfig instance :param past_entitlements: dict containing the last valid information regarding service entitlements. :param new_entitlements: dict containing the current information regarding service entitlements. :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. :param verbose: If True, display output to stdout r)entitlements_enable_orderF)rG orig_access new_accessrrrTz+Failed to process contract delta for %s: %rNz5Unexpected error processing contract delta for %s: %r)rlog_path)failed_services)uaclient.entitlementsrKeyErrorprocess_entitlement_deltarreventservice_processedr UbuntuProErrorr exceptionappenderror Exceptionservices_failedlenAttachFailureUnknownErrorzipr UNEXPECTED_ERRORrfrBrAttachFailureDefaultServices!E_ATTACH_FAILURE_DEFAULT_SERVICES)rGrrrrrr delta_errorunexpected_errorsrr#new_entitlementdeltasservice_enableders r9process_entitlements_deltarxs .@KO)#.&. .t4O .&?-11$;*)!1 ' #FO:6''-M&.N /* !22(+?G1 ?G7! D.-D.1G.?F  G.AG))G.rrc*ddlm}|r t|tj||}d}|r|j dij d} | s!|j dij d} | st j|||j dij dij d d } ||| | } | j||||}||fS#t j$r} tjd | | d } ~ wwxYw)abProcess a entitlement access dictionary deltas if they exist. :param cfg: UAConfig instance :param orig_access: Dict with original entitlement access details before contract refresh deltas :param new_access: Dict with updated entitlement access details after contract refresh :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. :param verbose: If True, display output to stdout :raise UbuntuProError: on failure to process deltas. :return: A tuple containing a dict of processed deltas and a boolean indicating if the service was fully processed rentitlement_factoryF entitlementr)orignew entitlements obligations use_selectorrarGr#r!z3Skipping entitlement deltas for "%s". No such classNrr) rrapply_contract_overridesrget_dict_deltasrrr InvalidContractDeltasServiceTypeEntitlementNotFoundErrorrrprocess_contract_deltas) rGrrrrrrr retr#r!rexcs r9rrs!4: ,  ! !+z :F C }b155f=::mR044V2 . S # S $  -K11 lG2  3;22  IIEt I  s> C""D5D  Drxc|jjd}|r|d}|d}|dk(rB|djt}t j |||djd|dk(rB|djt}t j |||djd |d k(rt j| t j) Ninfo contractIdreasonzno-longer-effectivetimez%m-%d-%Y)rdatecontract_expiry_dateznot-effective-yet)rr'contract_effective_dateznever-effective)r) rorrstrftimerr AttachForbiddenExpiredAttachForbiddenNotYetAttachForbiddenNeverAttachExpiredToken)rxr#rr%r's r9rmrms    ! !& )D <( h * *<(()@AD33'%)&\%:%::%F   * *<(()@AD22'(,V (=(=j(I   ( (11kJ J  ' ' ))r;ctj|}|j}|j}|d}|ddd}t |}|j ||}|j |tjj|jdijdtj|} tj | t|||jd| y ) aRequest contract refresh from ua-contracts service. :param verbose: If True, display output to stdout :raise UbuntuProError: on failure to update contract or error processing contract deltas :raise ConnectivityError: On failure during a connection r`machineTokenInfo contractInfoidrJ)rrrVFrN) rLrMrrrErrrrd cache_clearrrrr) rGrrNorig_entitlements orig_tokenrrcontract_clientresprus r9refreshr83s33C8*779#11J~.M/0@FK&3/O  2 2# 3 DT" %%',b155V**3/J*% '') r;c\t|}|j}|jdgS)zDQuery available resources from the contract server for this machine.r)rErrr)rGclientrs r9get_available_resourcesr;Ws+ c "F**,I ==b ))r;rcc:t|}|j|S)z/Query contract information for a specific token)rEr)rGrcr:s r9get_contract_informationr=^s c "F  * *5 11r;override_selectorselector_valuesc~d}|jD]'\}}||f|jvry|t|z })|S)Nr)itemsOVERRIDE_SELECTOR_WEIGHTS)r>r?override_weightselectorvalues r9_get_override_weightrFdsVO,224?% e O$9$9$; ;4X>>? r;r series_namerc i}||d}|r||d<|jdij|i}|r ||td<tj|j dg}|D]%}t |jd|} | s!||| <'|S)N)rr r!rr overridesrD)poprBcopydeepcopyrrrF) rrGrr!rIr?rgeneral_overridesoverrideweights r9_select_overridesrPps I!,zBO%, ""x488bI  +,>?@ kook2&FG%)% LL $o   (If  ) r;rcddlm}tt|td|vgst dj ||tjjn|}|\}}|jdi}t||||}t|jD][\} } | jD]C\} } |dj| } t| tr| j| <| |d| <E]y)aApply series-specific overrides to an entitlement dict. This function mutates orig_access dict by applying any series-overrides to the top-level keys under 'entitlement'. The series-overrides are sparse and intended to supplement existing top-level dict values. So, sub-keys under the top-level directives, obligations and affordance sub-key values will be preserved if unspecified in series-overrides. To more clearly indicate that orig_access in memory has already had the overrides applied, the 'series' key is also removed from the orig_access dict. :param orig_access: Dict with original entitlement access details r)get_cloud_typerz?Expected entitlement access dict. Missing "entitlement" key: {}N)uaclient.clouds.identityrRall isinstancedict RuntimeErrorrfrrrrrrPsortedrAre)rrr!rRrGr_orig_entitlementrI_weightoverrides_to_applykeyrEcurrents r9rrs &8  ;-} /KL M &%  -3N!((#$MJ"}b9!+z7I(.ioo.?'@ 8##,224 8JC!-044S9G'4(u%38 M*3/ 8 8r;rcddlm}g}|jD]\}}|jdijdd} ||||}|jdijdi}|jd} |j || sz|j\} } | s|jt|| |S#tj $rYwxYw) Nrrrrrarr resourceToken)r#r!) rrrArrr r_should_enable_by_default can_enablerr") rGrrenable_by_default_servicesent_name ent_valuer!entrr`rbrYs r9get_enabled_by_default_servicesrgs:!#+113)-- r266~rJ %#HgNC mmM26::="M ! o6  ( (m DNN,MJ*11*% '* &%!22   s C  CC)TT)FTT)Tr6)NN)QrKloggingr collectionsrtypingrrrrruaclient.files.machine_tokenfilesrrLuaclientr r r r r rrrr-uaclient.api.u.pro.status.enabled_services.v1r(uaclient.api.u.pro.status.is_attached.v1ruaclient.configruaclient.defaultsruaclient.files.state_filesrr uaclient.httpr uaclient.logrrkrrrrrrrrrrrrBget_event_loggerr getLoggerreplace_top_level_logger_namer<rr" DataObjectr%UAServiceClientrErVrirBboolrr HTTPResponse NamedMessagermr8r;r=intrFrPrrgrCr;r9r~se  "33**   LA$5L'7;9:-9#0O,9#1%7",/F    & %%'g:::8DE$vy1 T)*''T)n} }44} @D@" Z Z CH~Z 38nZ  Z  Z  Z  Z B! > >c3h>S#X> >  >  > 4:>B** *:!!H**d4j*2(2324S>2 CH~ 8!!.8c3h.8 SM.8c].8 .8b& &!%c3h& !&r;