File: //lib/python3/dist-packages/uaclient/api/u/pro/security/cves/_common/__pycache__/v1.cpython-38.pyc
U
��Jh�L � @ s� d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z m
Z
mZ d dlmZ d dlmZmZmZmZmZ d dlmZ d dlmZ d d lm Z d d
l m Z m Z m Z m!Z! d d l"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d d l)m*Z*m+Z+ d d
l,m-Z- d dl.m/Z/ G dd� de �Z0G dd� de �Z1ej2G dd� dej3��Z4G dd� d�Z5e e e6ee6 f e4d�dd�Z7e
ddeej fd e e6e e6e
f f fg�Z8G d d � d �Z9G d d � d e j:d!�Z;G d"d#� d#�Z<e;e ee6 d$�d%d&�Z=dS )'� N)� defaultdict)� lru_cache)�Any�Dict�List�
NamedTuple�Optional)�urljoin)�apt�
exceptions�http�system�util)�#query_installed_source_pkg_versions)�_enabled_services)�UAConfig)�
DataObject�Field�FloatDataValue�StringDataValue)�VULNERABILITY_CACHE_PATH�VULNERABILITY_DATA_CACHE�VULNERABILITY_DATA_TMPL�$VULNERABILITY_DPKG_STATUS_DATE_CACHE�VULNERABILITY_ETAG_CACHE�VULNERABILITY_RESULT_CACHE)�FIPSEntitlement�FIPSUpdatesEntitlement)�DataObjectFile)�UAFilec @ s e Zd Zede�gZdd� ZdS )�VulnerabilityCacheETag�etagc C s
|| _ d S �N�r! )�selfr! � r% �M/usr/lib/python3/dist-packages/uaclient/api/u/pro/security/cves/_common/v1.py�__init__' s z VulnerabilityCacheETag.__init__N)�__name__�
__module__� __qualname__r r �fieldsr' r% r% r% r& r $ s r c @ s& e Zd Zede�gZed�dd�ZdS )�VulnerabilityDpkgCacheDate�dpkg_status_date�r- c C s
|| _ d S r" r. )r$ r- r% r% r& r' . s z#VulnerabilityDpkgCacheDate.__init__N)r( r) r* r r r+ �floatr' r% r% r% r& r, + s r, c @ s e Zd ZdZdZdZdZdS )�VulnerabilityStatusz<
An enum to represent the status of a vulnerability
Zno�partialZyesN)r( r) r* �__doc__�NO_FIX_AVAILABLE�PARTIAL_FIX_AVAILABLE�FULL_FIX_AVAILABLEr% r% r% r& r0 2 s r0 c @ s� e Zd Zdeee d�dd�Zedd� �Zdd� Z d d
� Z
e ee f d �d d
�Z
eed�dd�Zdd� Zdd� Zdd� Zdd� Zdd� ZdS ) �VulnerabilityDataN��cfg�seriesc C s& || _ |pt�� j| _d | _d| _d S )NF)r8 r
�get_release_infor9 �_etag�
_refreshed)r$ r8 r9 r% r% r& r' ? s zVulnerabilityData.__init__c C s | j S r" )r< �r$ r% r% r& � refreshedI s zVulnerabilityData.refreshedc C s t j�t| jt�S r" )�os�path�joinr r9 r r= r% r% r& �_get_cache_data_pathM s
�z&VulnerabilityData._get_cache_data_pathc C s" t ttttj�t| j�dd�d�S �NF)�nameZ directoryZprivate)Zdata_object_clsZua_file) r r r r r? r@ rA r r9 r= r% r% r& �_get_etag_cache_fileR s ��z&VulnerabilityData._get_etag_cache_file)� json_datac C s t �| �� t�|�� d S r" )r
�
write_filerB �json�dumps)r$ rF r% r% r& �_save_cache_data\ s z"VulnerabilityData._save_cache_data)�cache_etag_filer! c C s |� t|d�� d S )Nr# )�writer )r$ rK r! r% r% r& �_save_etag_cache_ s z"VulnerabilityData._save_etag_cachec C s( | j s"| �� }|�� }|r"|j| _ | j S r" )r; rE �readr! )r$ Z etag_fileZ etag_datar% r% r& � _get_etagb s zVulnerabilityData._get_etagc C s t �t�| �� ��S r" )rH �loadsr
� load_filerB r= r% r% r& �_get_cache_datal s z!VulnerabilityData._get_cache_datac C sd | j }dd� t| j�jD �}tj|kr4d�| j �}ntj|krJd�| j �}tj|d�}t | jj
|�S )Nc S s g | ]
}|j �qS r% )rD )�.0�sr% r% r& �
<listcomp>r s z3VulnerabilityData._get_data_url.<locals>.<listcomp>zfips_{}zfips-updates_{})r9 ) r9 r r8 Zenabled_servicesr rD �formatr r r Z vulnerability_data_url_prefix)r$ Z data_nameZenabled_services_namesZ data_filer% r% r& �
_get_data_urlo s
�
z VulnerabilityData._get_data_urlc C s | � � }|d S )N� published_at)�get)r$ Zvulnerability_json_datar% r% r& �get_published_date} s z$VulnerabilityData.get_published_datec C s� | � � }z$tj| j| �� |d�\}}d| _W n tjk
rJ | �� Y S X t �
|� d��}t �
� r�| �|� |r�| �| �� |� |S )N)r8 Zurlr! Tzutf-8)rO r Zdownload_xz_file_from_urlr8 rW r< r Z
ETagUnchangedrR rH rP �decoder �we_are_currently_rootrJ rM rE )r$ Z last_etag�datar! rF r% r% r& rY � s �
zVulnerabilityData.get)N)r( r) r* r r �strr' �propertyr> rB rE r r rJ r rM rO rR rW rZ rY r% r% r% r& r6 = s ��
r6 )�affected_packages�returnc C sP t j}d}| D ]}|�d�d k r|d7 }q|t| �kr>t j}n|dkrLt j}|S )Nr � fix_version� )r0 r3 rY �lenr5 r4 )r` Zvulnerability_statusZ num_fixes�pkgr% r% r& � _get_vulnerability_fix_status� s
rf �VulnerabilityParserResult� vulnerability_data_published_at�vulnerabilities_infoc @ s4 e Zd Zdd� Zd eeee d�dd�Zdd� ZdS )
�VulnerabilitiesAlreadyFixedc C s t t�| _t dd� �| _d S )Nc S s t t�S r" )r �intr% r% r% r& �<lambda>� � z6VulnerabilitiesAlreadyFixed.__init__.<locals>.<lambda>)r �set�_vulns�priority_counterr= r% r% r& r' � s
�z$VulnerabilitiesAlreadyFixed.__init__N)� vuln_name� vuln_pocket�
vuln_priorityc C s< || j | kr8| j | �|� |r8| j| | d7 < d S )Nrc )ro �addrp )r$ rq rr rs r% r% r& �add_vulnerability� s z-VulnerabilitiesAlreadyFixed.add_vulnerabilityc C sH i i d�}| j �� D ].\}}t|�|d |< t| j| �|d |< q|S )N)�count�inforv rw )ro �itemsrd �dictrp )r$ Z dict_repr�pocketZvulnsr% r% r& �to_dict� s �z#VulnerabilitiesAlreadyFixed.to_dict)N)r( r) r* r' r^ r ru r{ r% r% r% r& rj � s
�� rj c @ sz e Zd ZdZejeeef eeef d�dd��Z ejeeef eeef eeef d�dd��Z
eeef eeed�d d
�Z eeef eeeed �d d
�Z eeef eeeeeed�dd�Z
eeeef eeef eeef d�dd�Zeed�dd�Zedd�ed�dd��Zee eed�d d �Zeed �d d �Zeeef d!�d"d#�Zeeef eeeeef f d$�d%d&�ZdS )'�VulnerabilityParserN)� affected_pkgra c C s d S r" r% )r$ r} r% r% r& �get_package_vulnerabilities� s z/VulnerabilityParser.get_package_vulnerabilities)�vulnerability_info�vulnerabilities_datara c C s d S r" r% )r$ r r� r% r% r& � _post_process_vulnerability_info� s z4VulnerabilityParser._post_process_vulnerability_info��packages� bin_pkg_name�bin_pkg_versionrq c C s d|| j g i||< d S )NZcurrent_version)�vulnerability_type)r$ r� r� r� rq r% r% r& �_add_new_vulnerability� s
�z*VulnerabilityParser._add_new_vulnerability�r� r� r� rq �vuln_pkg_statusc C s< ||kr| j ||||d� || | j �|d |d d�� d S �Nr� )rD rb Z
fix_statusZ
fix_origin�r� r� �append)r$ r� r� r� rq r� r% r% r& � _add_unfixable_vulnerability� s ���z0VulnerabilityParser._add_unfixable_vulnerability�r� r� r� rq r� �vuln_bin_fix_versionrr c C s< ||kr| j ||||d� || | j �||||d�� d S r� r� )r$ r� r� r� rq r� r� rr r% r% r& �_add_fixable_vulnerability s
���z.VulnerabilityParser._add_fixable_vulnerability�rq �vulnerabilities� vuln_info�
vulns_datac C s ||kr| j ||d�||< d S )N)r r� )r� )r$ rq r� r� r� r% r% r& �_add_vulnerability_info s
�z+VulnerabilityParser._add_vulnerability_info)�vuln_source_fixed_versionr� c C s |d kr|dkrdS dS )Nznot-vulnerableTFr% )r$ r� r� r% r% r& � is_vulnerability_not_fixable- s z0VulnerabilityParser.is_vulnerability_not_fixable)�maxsize)�binary_pkg_namec C s t �ddd|g�\}}|S )Nz
dpkg-queryz-Wz-f=${source:Version})r
Zsubp)r$ r� �out�_r% r% r& �!_get_installed_source_pkg_version; s �� z5VulnerabilityParser._get_installed_source_pkg_version)r� r� r� c C s. |dkr*| � |�}t�||�dkr&dS dS dS )aZ
This method checks if we can detect that a vulnerability
affects a binary package but can't be fixed. This
situation can happen during a package transition.
For example, suppose we have this entry for pkg1:
"pkg1": {
"source_version": {
"1.0": {
"bin-pkg1": "1.0",
"bin-pkg2": "1.1",
},
"1.1": {
"bin-pkg1": "1.2"
}
}
}
Notice that version 1.1 doesn't produce bin-pkg2 anymore.
Therefore, if we detect that a vulnerability is fixable
by version 1.1, we won't find the binary fixable bersion for
the bin-pkg2 package.
If we detect that, we will:
1. Check if versions of the source package associated with the
binary package is higher than the vulnerability source fix
version. If it is, we can say that the system is not vulnerable.
2. If it is not, then the binary package is affected by the issue, but
we can't say what the user needs to do to fix it.
Nr FT)r� r
�version_compare)r$ r� r� r� Z installed_source_pkg_versionr% r% r& �&is_vulnerability_valid_but_not_fixableH s '� ���z:VulnerabilityParser.is_vulnerability_valid_but_not_fixable)� bin_versionr� c C s t �||�dkS �Nr )r
r� )r$ r� r� r% r% r& � vulnerability_affects_system� s z0VulnerabilityParser.vulnerability_affects_system)�installed_pkgs_by_sourcec c s8 |� � D ]*\}}t|� � �D ]\}}|||fV q qd S r" )rx �sorted)r$ r� �
source_pkgZ binary_pkgsr� Zbinary_installed_versionr% r% r& �_list_binary_packages� s
�z)VulnerabilityParser._list_binary_packages�r� r� c C s� i }i }|� di �}|� di �� | ji �}| �|�D �]Z\}}} |� |i �}
|
� di �} t| �|
��� dd� d�D �]\} }
|� | d�}|
� d�}|
� d �}| j||d
�r�| j||| | |d � | j| |||d � qrz(| | � d
�}| | � di �� |�}W n t k
�r Y qrY nX | �
|||��rL| j||| | dd � | j| |||d � |d k�rXqr| � | |�rr| j ||| | |||d� | j| |||d � qrq4t
|� d�||d�d�S )Nr� Zsecurity_issuesZsource_versionsc S s | d S r� r% )�xr% r% r& rl � rm zLVulnerabilityParser.get_vulnerabilities_for_installed_pkgs.<locals>.<lambda>)�key� Zsource_fixed_versionZstatus)r� r� r� r� rz Zbinary_packages�unknownr� rX )r� r� �rh ri )rY r� r� r� r~ rx r� r� r� �KeyErrorr� r� r� rg )r$ r� r� r� r� Z
affected_pkgsZ
vulns_infor� r� r� r} Zvuln_source_versionsrq Zvulnr� r� r� rz r� r% r% r& �&get_vulnerabilities_for_installed_pkgs� s� �� �
����� ���
���
�� �
���z:VulnerabilityParser.get_vulnerabilities_for_installed_pkgs)r( r) r* r� �abc�abstractmethodr r^ r r~ r� r� r� r� r� r� r r� r r� r� r� r� r% r% r% r& r| � sd
�
�
�
�
�
� � � :�
�r| )� metaclassc @ sh e Zd Zdeee d�dd�Zdd� Zeeef d�dd �Z d
d � Z
d d
� Z dd� Z dd� Z
dd� ZdS )�VulnerabilityResultCacheN)r� r9 c C s2 |p t �� j| _|| _tttttdd�d�| _ d S rC )
r
r: r9 r� r r, r r r �dpkg_status_cache)r$ r� r9 r% r% r& r' s ��z!VulnerabilityResultCache.__init__c C s t j�t| j| jt�S r" )r? r@ rA r r9 r� r r= r% r% r& �_get_result_cache_path s �z/VulnerabilityResultCache._get_result_cache_path)�vulnerability_datac C s@ t �� r<t�� pd}| j�t|d�� t�| � � t
� |�� d S )Nr r. ) r r\ r
�get_dpkg_status_timer� rL r, r
rG r� rH rI )r$ r� �latest_dpkg_status_timer% r% r& �save_result_cache s ���z*VulnerabilityResultCache.save_result_cachec C s( t �� p
d}| j�� }|s dS ||jkS )Nr T)r
r� r� rN r- )r$ r� Zdpkg_status_cache_objr% r% r& �_has_apt_state_changed& s
z/VulnerabilityResultCache._has_apt_state_changedc C s t j�| �� �S r" )r? r@ �existsr� r= r% r% r& �_cache_result_exists. s z-VulnerabilityResultCache._cache_result_existsc C s | � � s dS | �� rdS dS )NFT)r� r� r= r% r% r& �_is_cache_result_valid1 s
z/VulnerabilityResultCache._is_cache_result_validc C s | � � S r" )r� r= r% r% r& �is_cache_valid: s z'VulnerabilityResultCache.is_cache_validc C s t �t�| �� ��S r" )rH rP r
rQ r� r= r% r% r& �get_result_cache= s z)VulnerabilityResultCache.get_result_cache)N)r( r) r* r^ r r' r� r r r� r� r� r� r� r� r% r% r% r& r� s
r� )�parserr8 r9 c C sh t ||d�}t|| jd�}|�� }|jsD|�� rDt|�� |�� d�S t � }| j
||d�}|� |j � |S )Nr7 )r9 r� r� r� )
r6 r� r� rY r> r� rg rZ r� r r� r� ri )r� r8 r9 r� Zvulnerabilities_resultZvulnerabilities_json_datar� Z vulnerabilities_parser_resultr% r% r& �get_vulnerabilitiesA s2 ������r� )>r� Zdatetime�enumrH r? � collectionsr � functoolsr �typingr r r r r Z urllib.parser Zuaclientr
r r r
r Z'uaclient.api.u.pro.security.fix._commonr Z-uaclient.api.u.pro.status.enabled_services.v1r Zuaclient.configr Zuaclient.data_typesr r r r Zuaclient.defaultsr r r r r r Zuaclient.entitlements.fipsr r Zuaclient.files.data_typesr Zuaclient.files.filesr r r, �unique�Enumr0 r6 r^ rf rg rj �ABCMetar| r� r� r% r% r% r& �<module> sP
Z� �� 6?�