Merge ~mitchdz/ubuntu/+source/hibagent:mitch/focal-imdsv2 into ubuntu/+source/hibagent:ubuntu/focal-devel

[Mitchell Dzurick]

PPA - https://code.launchpad.net/~mitchdz/ubuntu/+source/hibagent/+git/hibagent

diff --git a/debian/changelog b/debian/changelog
index 6e04bd0..eaa086d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,17 @@
+hibagent (1.0.1-0ubuntu1.20.04.2) focal; urgency=medium
+
+  * Use imdsv2 and do nothing if ODH is configured (LP: #2043739).
+    - d/p/disable-hibernate-test.patch: disable a test that only works on an
+      actual EC2 instance.
+    - d/p/use-imdsv2: use IMDSv2 instead of IMDSv1. This is important because
+      IMDSv1 is an insecure protocol.
+    - d/control: add python3-requests as Depends.
+    - d/p/do-nothing-if-ODH-is-configured.patch: do nothing if ODH is configured
+      this fixes an issue when this package and ec2-hibinit-agent are installed
+      and configured at the same time.
+
+ -- Mitchell Dzurick <[e-mail]>  Thu, 16 Nov 2023 16:19:12 -0700
+
 hibagent (1.0.1-0ubuntu1.20.04.1) focal; urgency=medium
 
   * d/p/lp1896638-set-resume-device-by-partition-uuid: Set resume device
diff --git a/debian/control b/debian/control
index 25d37a7..74f1d40 100644
--- a/debian/control
+++ b/debian/control
@@ -7,6 +7,7 @@ Build-Depends: debhelper (>= 9),
                dh-python,
                python3-all,
                python3-pytest,
+               python3-requests,
                python3-setuptools
 Standards-Version: 3.9.6
 X-Python3-Version: >= 3.3
diff --git a/debian/patches/disable-hibernate-test.patch b/debian/patches/disable-hibernate-test.patch
 new file mode 100644
index 0000000..9e3c5e7
--- /dev/null
+++ b/debian/patches/disable-hibernate-test.patch
@@ -0,0 +1,18 @@
+IDescription: Skip test needing EC2 instance
+ The polling test now actually needs to be run on an EC2 instance as it tries
+ to contact an HTTP endpoint on a hardcoded link-local IP that matches the monitoring
+ system at AWS. We don't have this in our builders or autopkgtests.
+Author: Simon Chopin <[e-mail]>
+Last-Update: 2023-02-16
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/test/hibagent_test.py
++++ b/test/hibagent_test.py
+@@ -261,6 +261,7 @@
+         except:
+             pass
+ 
++    @unittest.skip("can only run on an actual EC2 instance")
+     def test_itn_polls(self):
+         fi = FakeInitializer()
+         poller = hibagent.ItnPoller("http://localhost:%d/blah" % self.server.port,
diff --git a/debian/patches/do-nothing-if-ODH-is-configured.patch b/debian/patches/do-nothing-if-ODH-is-configured.patch
 new file mode 100644
index 0000000..8be4ec2
--- /dev/null
+++ b/debian/patches/do-nothing-if-ODH-is-configured.patch
@@ -0,0 +1,77 @@
+Description: Update the Spot hibernate agent to do nothing if ODH is configured
+Author: Jeongin Cho <[e-mail]>
+Origin: upstream, https://github.com/aws/ec2-hibernate-linux-agent/commit/2ee4ae3fd1333fb3c9aab25bf02b109c3b7b8d9f
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/hibagent/+bug/2043739
+Last-Update: 2023-11-16
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/agent/hibagent
++++ b/agent/hibagent
+@@ -18,6 +18,7 @@
+ import struct
+ import sys
+ import syslog
++import requests
+ from subprocess import check_call, check_output
+ from threading import Thread
+ from math import ceil
+@@ -39,6 +40,9 @@
+ log_to_syslog = True
+ log_to_stderr = True
+ 
++IMDS_BASEURL = 'http://169.254.169.254'
++IMDS_API_TOKEN_PATH = 'latest/api/token'
++IMDS_SPOT_ACTION_PATH = 'latest/meta-data/hibernation/configured'
+ 
+ def log(message):
+     if log_to_syslog:
+@@ -511,6 +515,37 @@
+         log("Failed to adjust pm_freeze_timeout to %d. Error: %s" % (timeout, str(e)))
+         exit(1)
+ 
++def get_imds_token(seconds=21600):
++    """ Get a token to access instance metadata. """
++    log("Requesting new IMDSv2 token.")
++    request_header = {'X-aws-ec2-metadata-token-ttl-seconds': '{}'.format(seconds)}
++    token_url = '{}/{}'.format(IMDS_BASEURL, IMDS_API_TOKEN_PATH)
++    response = requests.put(token_url, headers=request_header)
++    response.close()
++    if response.status_code != requests.codes.ok:
++        return None
++
++    return response.text
++
++def hibernation_enabled():
++    """Returns a boolean indicating whether hibernation-option.configured is enabled or not."""
++
++    imds_token = get_imds_token()
++    if imds_token is None:
++        log("IMDS_V2 http endpoint is disabled")
++        # IMDS http endpoint is disabled
++        return False
++
++    request_header = {'X-aws-ec2-metadata-token': imds_token}
++    response = requests.get("{}/{}".format(IMDS_BASEURL, IMDS_SPOT_ACTION_PATH),
++                 headers=request_header)
++    response.close()
++    if response.status_code != requests.codes.ok or response.text.lower() == "false":
++        return False
++
++    log("Hibernation Configured Flag found")
++
++    return True
+ 
+ def main():
+     # Parse arguments
+@@ -550,6 +585,11 @@
+ 
+     log("Effective config: %s" % config)
+ 
++    # Let's first check if we need to kill the Spot Hibernate Agent
++    if hibernation_enabled():
++        log("Spot Instance Launch has enabled Hibernation Configured Flag. hibagent exiting!!")
++        exit(0)
++
+     target_swap_size = config.swap_mb * 1024 * 1024
+     ram_bytes = os.sysconf('SC_PAGE_SIZE') * os.sysconf('SC_PHYS_PAGES')
+     swap_percentage_size = ram_bytes * config.swap_percentage // 100
diff --git a/debian/patches/series b/debian/patches/series
index 68b33b1..e3435d5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,6 @@ add-lsb-init-info.patch
 fix-enable-ec2-spot-hibernation.patch
 lp1896638-set-resume-device-by-partition-uuid.patch
 lp2013336-do-not-modify-GRUB-config-on-GRUB2-systems.patch
+use-imdsv2.patch
+do-nothing-if-ODH-is-configured.patch
+disable-hibernate-test.patch
diff --git a/debian/patches/use-imdsv2.patch b/debian/patches/use-imdsv2.patch
 new file mode 100644
index 0000000..6c91a91
--- /dev/null
+++ b/debian/patches/use-imdsv2.patch
@@ -0,0 +1,44 @@
+Description: IMDS V2 updates
+Author: shivasan@ <[e-mail]>
+Origin: upstream, https://github.com/aws/ec2-hibernate-linux-agent/commit/559558f28de4456f14b38539eed967df6e1f9217
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/hibagent/+bug/2043739
+Last-Update: 2023-11-16
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/agent/hibagent
++++ b/agent/hibagent
+@@ -315,16 +315,28 @@
+ 
+     def poll_for_termination(self):
+         # noinspection PyBroadException
+-        response = None
++        response1 = None
++        response2 = None
+         try:
+-            response = urlopen(self.url)
+-            res_str = response.read()
+-            return b"hibernate" in res_str
++            request1 = Request("http://169.254.169.254/latest/api/token")
++            request1.add_header('X-aws-ec2-metadata-token-ttl-seconds', '21600')
++            request1.get_method = lambda:"PUT"
++            response1 = urlopen(request1)
++
++            token = response1.read()
++
++            request2 = Request(self.url)
++            request2.add_header('X-aws-ec2-metadata-token', token)
++            response2 = urlopen(request2)
++            res = response2.read()
++            return b"hibernate" in res
+         except:
+             return False
+         finally:
+-            if response:
+-                response.close()
++            if response1:
++                response1.close()
++            if response2:
++                response2.close()
+ 
+     def do_hibernate(self):
+         log("Attempting to hibernate")