Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 1 | // Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
| 5 | #ifndef CHROMEOS_PLATFORM_UPDATE_ENGINE_DELTA_PERFORMER_H__ |
| 6 | #define CHROMEOS_PLATFORM_UPDATE_ENGINE_DELTA_PERFORMER_H__ |
| 7 | |
| 8 | #include <inttypes.h> |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 9 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 10 | #include <vector> |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 11 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 12 | #include <google/protobuf/repeated_field.h> |
Andrew de los Reyes | 353777c | 2010-10-08 10:34:30 -0700 | [diff] [blame] | 13 | #include <gtest/gtest_prod.h> // for FRIEND_TEST |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 14 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 15 | #include "update_engine/file_writer.h" |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 16 | #include "update_engine/install_plan.h" |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 17 | #include "update_engine/omaha_hash_calculator.h" |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 18 | #include "update_engine/update_metadata.pb.h" |
| 19 | |
| 20 | namespace chromeos_update_engine { |
| 21 | |
Darin Petkov | 73058b4 | 2010-10-06 16:32:19 -0700 | [diff] [blame] | 22 | class PrefsInterface; |
| 23 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 24 | // This class performs the actions in a delta update synchronously. The delta |
| 25 | // update itself should be passed in in chunks as it is received. |
| 26 | |
| 27 | class DeltaPerformer : public FileWriter { |
| 28 | public: |
Darin Petkov | 9574f7e | 2011-01-13 10:48:12 -0800 | [diff] [blame] | 29 | enum MetadataParseResult { |
| 30 | kMetadataParseSuccess, |
| 31 | kMetadataParseError, |
| 32 | kMetadataParseInsufficientData, |
| 33 | }; |
| 34 | |
Jay Srinivasan | f431870 | 2012-09-24 11:56:24 -0700 | [diff] [blame] | 35 | static const uint64_t kDeltaVersionSize; |
| 36 | static const uint64_t kDeltaManifestSizeSize; |
Darin Petkov | abc7bc0 | 2011-02-23 14:39:43 -0800 | [diff] [blame] | 37 | static const char kUpdatePayloadPublicKeyPath[]; |
| 38 | |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 39 | DeltaPerformer(PrefsInterface* prefs, InstallPlan* install_plan) |
Darin Petkov | 73058b4 | 2010-10-06 16:32:19 -0700 | [diff] [blame] | 40 | : prefs_(prefs), |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 41 | install_plan_(install_plan), |
Darin Petkov | 73058b4 | 2010-10-06 16:32:19 -0700 | [diff] [blame] | 42 | fd_(-1), |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 43 | kernel_fd_(-1), |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 44 | manifest_valid_(false), |
Darin Petkov | 437adc4 | 2010-10-07 13:12:24 -0700 | [diff] [blame] | 45 | manifest_metadata_size_(0), |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 46 | next_operation_num_(0), |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 47 | buffer_offset_(0), |
Darin Petkov | 0406e40 | 2010-10-06 21:33:11 -0700 | [diff] [blame] | 48 | last_updated_buffer_offset_(kuint64max), |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 49 | block_size_(0), |
| 50 | public_key_path_(kUpdatePayloadPublicKeyPath) {} |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 51 | |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 52 | // Opens the kernel. Should be called before or after Open(), but before |
| 53 | // Write(). The kernel file will be close()d when Close() is called. |
| 54 | bool OpenKernel(const char* kernel_path); |
| 55 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 56 | // flags and mode ignored. Once Close()d, a DeltaPerformer can't be |
| 57 | // Open()ed again. |
| 58 | int Open(const char* path, int flags, mode_t mode); |
| 59 | |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 60 | // FileWriter's Write implementation where caller doesn't care about |
| 61 | // error codes. |
| 62 | bool Write(const void* bytes, size_t count) { |
| 63 | ActionExitCode error; |
| 64 | return Write(bytes, count, &error); |
| 65 | } |
| 66 | |
| 67 | // FileWriter's Write implementation that returns a more specific |error| code |
| 68 | // in case of failures in Write operation. |
| 69 | bool Write(const void* bytes, size_t count, ActionExitCode *error); |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 70 | |
| 71 | // Wrapper around close. Returns 0 on success or -errno on error. |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 72 | // Closes both 'path' given to Open() and the kernel path. |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 73 | int Close(); |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 74 | |
| 75 | // Verifies the downloaded payload against the signed hash included in the |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 76 | // payload, against the update check hash (which is in base64 format) and |
| 77 | // size using the public key and returns kActionCodeSuccess on success, an |
| 78 | // error code on failure. This method should be called after closing the |
| 79 | // stream. Note this method skips the signed hash check if the public key is |
| 80 | // unavailable; it returns kActionCodeSignedDeltaPayloadExpectedError if the |
| 81 | // public key is available but the delta payload doesn't include a signature. |
| 82 | ActionExitCode VerifyPayload(const std::string& update_check_response_hash, |
Andrew de los Reyes | 771e1bd | 2011-08-30 14:47:23 -0700 | [diff] [blame] | 83 | const uint64_t update_check_response_size); |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 84 | |
Darin Petkov | 3aefa86 | 2010-12-07 14:45:00 -0800 | [diff] [blame] | 85 | // Reads from the update manifest the expected sizes and hashes of the target |
| 86 | // kernel and rootfs partitions. These values can be used for applied update |
| 87 | // hash verification. This method must be called after the update manifest has |
| 88 | // been parsed (e.g., after closing the stream). Returns true on success, and |
| 89 | // false on failure (e.g., when the values are not present in the update |
| 90 | // manifest). |
| 91 | bool GetNewPartitionInfo(uint64_t* kernel_size, |
| 92 | std::vector<char>* kernel_hash, |
| 93 | uint64_t* rootfs_size, |
| 94 | std::vector<char>* rootfs_hash); |
Darin Petkov | 2dd0109 | 2010-10-08 15:43:05 -0700 | [diff] [blame] | 95 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 96 | // Converts an ordered collection of Extent objects which contain data of |
| 97 | // length full_length to a comma-separated string. For each Extent, the |
| 98 | // string will have the start offset and then the length in bytes. |
| 99 | // The length value of the last extent in the string may be short, since |
| 100 | // the full length of all extents in the string is capped to full_length. |
| 101 | // Also, an extent starting at kSparseHole, appears as -1 in the string. |
| 102 | // For example, if the Extents are {1, 1}, {4, 2}, {kSparseHole, 1}, |
| 103 | // {0, 1}, block_size is 4096, and full_length is 5 * block_size - 13, |
| 104 | // the resulting string will be: "4096:4096,16384:8192,-1:4096,0:4083" |
| 105 | static bool ExtentsToBsdiffPositionsString( |
| 106 | const google::protobuf::RepeatedPtrField<Extent>& extents, |
| 107 | uint64_t block_size, |
| 108 | uint64_t full_length, |
| 109 | std::string* positions_string); |
| 110 | |
Darin Petkov | 0406e40 | 2010-10-06 21:33:11 -0700 | [diff] [blame] | 111 | // Returns true if a previous update attempt can be continued based on the |
| 112 | // persistent preferences and the new update check response hash. |
| 113 | static bool CanResumeUpdate(PrefsInterface* prefs, |
| 114 | std::string update_check_response_hash); |
| 115 | |
| 116 | // Resets the persistent update progress state to indicate that an update |
Darin Petkov | 9b23057 | 2010-10-08 10:20:09 -0700 | [diff] [blame] | 117 | // can't be resumed. Performs a quick update-in-progress reset if |quick| is |
| 118 | // true, otherwise resets all progress-related update state. Returns true on |
| 119 | // success, false otherwise. |
| 120 | static bool ResetUpdateProgress(PrefsInterface* prefs, bool quick); |
Darin Petkov | 0406e40 | 2010-10-06 21:33:11 -0700 | [diff] [blame] | 121 | |
Darin Petkov | 9574f7e | 2011-01-13 10:48:12 -0800 | [diff] [blame] | 122 | // Attempts to parse the update metadata starting from the beginning of |
| 123 | // |payload| into |manifest|. On success, sets |metadata_size| to the total |
| 124 | // metadata bytes (including the delta magic and metadata size fields), and |
| 125 | // returns kMetadataParseSuccess. Returns kMetadataParseInsufficientData if |
| 126 | // more data is needed to parse the complete metadata. Returns |
| 127 | // kMetadataParseError if the metadata can't be parsed given the payload. |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 128 | MetadataParseResult ParsePayloadMetadata( |
Darin Petkov | 9574f7e | 2011-01-13 10:48:12 -0800 | [diff] [blame] | 129 | const std::vector<char>& payload, |
| 130 | DeltaArchiveManifest* manifest, |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 131 | uint64_t* metadata_size, |
| 132 | ActionExitCode* error); |
Darin Petkov | 9574f7e | 2011-01-13 10:48:12 -0800 | [diff] [blame] | 133 | |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 134 | void set_public_key_path(const std::string& public_key_path) { |
| 135 | public_key_path_ = public_key_path; |
Darin Petkov | 698d041 | 2010-10-13 10:59:44 -0700 | [diff] [blame] | 136 | } |
| 137 | |
Jay Srinivasan | f431870 | 2012-09-24 11:56:24 -0700 | [diff] [blame] | 138 | // Returns the byte offset at which the manifest protobuf begins in a |
| 139 | // payload. |
| 140 | static uint64_t GetManifestOffset(); |
| 141 | |
| 142 | // Returns the byte offset where the size of the manifest is stored in |
| 143 | // a payload. This offset precedes the actual start of the manifest |
| 144 | // that's returned by the GetManifestOffset method. |
| 145 | static uint64_t GetManifestSizeOffset(); |
| 146 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 147 | private: |
Andrew de los Reyes | 353777c | 2010-10-08 10:34:30 -0700 | [diff] [blame] | 148 | friend class DeltaPerformerTest; |
| 149 | FRIEND_TEST(DeltaPerformerTest, IsIdempotentOperationTest); |
| 150 | |
| 151 | static bool IsIdempotentOperation( |
| 152 | const DeltaArchiveManifest_InstallOperation& op); |
| 153 | |
Darin Petkov | 698d041 | 2010-10-13 10:59:44 -0700 | [diff] [blame] | 154 | // Verifies that the expected source partition hashes (if present) match the |
| 155 | // hashes for the current partitions. Returns true if there're no expected |
| 156 | // hashes in the payload (e.g., if it's a new-style full update) or if the |
| 157 | // hashes match; returns false otherwise. |
| 158 | bool VerifySourcePartitions(); |
| 159 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 160 | // Returns true if enough of the delta file has been passed via Write() |
| 161 | // to be able to perform a given install operation. |
| 162 | bool CanPerformInstallOperation( |
| 163 | const DeltaArchiveManifest_InstallOperation& operation); |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 164 | |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 165 | // Validates that the hash of the blobs corresponding to the given |operation| |
| 166 | // matches what's specified in the manifest in the payload. |
| 167 | // Returns kActionCodeSuccess on match or a suitable error code otherwise. |
| 168 | ActionExitCode ValidateOperationHash( |
Jay Srinivasan | 00f76b6 | 2012-09-17 18:48:36 -0700 | [diff] [blame] | 169 | const DeltaArchiveManifest_InstallOperation& operation, bool should_log); |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 170 | |
| 171 | // Interprets the given |protobuf| as a DeltaArchiveManifest protocol buffer |
| 172 | // of the given protobuf_length and verifies that the signed hash of the |
Jay Srinivasan | f431870 | 2012-09-24 11:56:24 -0700 | [diff] [blame] | 173 | // metadata matches what's specified in the install plan from Omaha. |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 174 | // Returns kActionCodeSuccess on match or a suitable error code otherwise. |
| 175 | // This method must be called before any part of the |protobuf| is parsed |
| 176 | // so that a man-in-the-middle attack on the SSL connection to the payload |
| 177 | // server doesn't exploit any vulnerability in the code that parses the |
| 178 | // protocol buffer. |
Jay Srinivasan | f431870 | 2012-09-24 11:56:24 -0700 | [diff] [blame] | 179 | ActionExitCode ValidateMetadataSignature(const char* protobuf, |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 180 | uint64_t protobuf_length); |
| 181 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 182 | // Returns true on success. |
| 183 | bool PerformInstallOperation( |
| 184 | const DeltaArchiveManifest_InstallOperation& operation); |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 185 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 186 | // These perform a specific type of operation and return true on success. |
| 187 | bool PerformReplaceOperation( |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 188 | const DeltaArchiveManifest_InstallOperation& operation, |
| 189 | bool is_kernel_partition); |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 190 | bool PerformMoveOperation( |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 191 | const DeltaArchiveManifest_InstallOperation& operation, |
| 192 | bool is_kernel_partition); |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 193 | bool PerformBsdiffOperation( |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 194 | const DeltaArchiveManifest_InstallOperation& operation, |
| 195 | bool is_kernel_partition); |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 196 | |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 197 | // Returns true if the payload signature message has been extracted from |
| 198 | // |operation|, false otherwise. |
| 199 | bool ExtractSignatureMessage( |
| 200 | const DeltaArchiveManifest_InstallOperation& operation); |
| 201 | |
Darin Petkov | 437adc4 | 2010-10-07 13:12:24 -0700 | [diff] [blame] | 202 | // Updates the hash calculator with |count| bytes at the head of |buffer_| and |
| 203 | // then discards them. |
| 204 | void DiscardBufferHeadBytes(size_t count); |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 205 | |
Darin Petkov | 0406e40 | 2010-10-06 21:33:11 -0700 | [diff] [blame] | 206 | // Checkpoints the update progress into persistent storage to allow this |
| 207 | // update attempt to be resumed after reboot. |
Darin Petkov | 73058b4 | 2010-10-06 16:32:19 -0700 | [diff] [blame] | 208 | bool CheckpointUpdateProgress(); |
| 209 | |
Darin Petkov | 9b23057 | 2010-10-08 10:20:09 -0700 | [diff] [blame] | 210 | // Primes the required update state. Returns true if the update state was |
| 211 | // successfully initialized to a saved resume state or if the update is a new |
| 212 | // update. Returns false otherwise. |
| 213 | bool PrimeUpdateState(); |
| 214 | |
Darin Petkov | 73058b4 | 2010-10-06 16:32:19 -0700 | [diff] [blame] | 215 | // Update Engine preference store. |
| 216 | PrefsInterface* prefs_; |
| 217 | |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 218 | // Install Plan based on Omaha Response. |
| 219 | InstallPlan* install_plan_; |
| 220 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 221 | // File descriptor of open device. |
| 222 | int fd_; |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 223 | |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 224 | // File descriptor of the kernel device |
| 225 | int kernel_fd_; |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 226 | |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 227 | std::string path_; // Path that fd_ refers to. |
| 228 | std::string kernel_path_; // Path that kernel_fd_ refers to. |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 229 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 230 | DeltaArchiveManifest manifest_; |
| 231 | bool manifest_valid_; |
Darin Petkov | 437adc4 | 2010-10-07 13:12:24 -0700 | [diff] [blame] | 232 | uint64_t manifest_metadata_size_; |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 233 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 234 | // Index of the next operation to perform in the manifest. |
Andrew de los Reyes | f4c7ef1 | 2010-04-30 10:37:00 -0700 | [diff] [blame] | 235 | int next_operation_num_; |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 236 | |
| 237 | // buffer_ is a window of the data that's been downloaded. At first, |
| 238 | // it contains the beginning of the download, but after the protobuf |
| 239 | // has been downloaded and parsed, it contains a sliding window of |
| 240 | // data blobs. |
| 241 | std::vector<char> buffer_; |
| 242 | // Offset of buffer_ in the binary blobs section of the update. |
| 243 | uint64_t buffer_offset_; |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 244 | |
Darin Petkov | 0406e40 | 2010-10-06 21:33:11 -0700 | [diff] [blame] | 245 | // Last |buffer_offset_| value updated as part of the progress update. |
| 246 | uint64_t last_updated_buffer_offset_; |
| 247 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 248 | // The block size (parsed from the manifest). |
| 249 | uint32_t block_size_; |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 250 | |
Darin Petkov | 437adc4 | 2010-10-07 13:12:24 -0700 | [diff] [blame] | 251 | // Calculates the payload hash. |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 252 | OmahaHashCalculator hash_calculator_; |
| 253 | |
Darin Petkov | 437adc4 | 2010-10-07 13:12:24 -0700 | [diff] [blame] | 254 | // Saves the signed hash context. |
| 255 | std::string signed_hash_context_; |
| 256 | |
Darin Petkov | d7061ab | 2010-10-06 14:37:09 -0700 | [diff] [blame] | 257 | // Signatures message blob extracted directly from the payload. |
| 258 | std::vector<char> signatures_message_data_; |
| 259 | |
Jay Srinivasan | 51dcf26 | 2012-09-13 17:24:32 -0700 | [diff] [blame] | 260 | // The public key to be used. Provided as a member so that tests can |
| 261 | // override with test keys. |
| 262 | std::string public_key_path_; |
Darin Petkov | 698d041 | 2010-10-13 10:59:44 -0700 | [diff] [blame] | 263 | |
Andrew de los Reyes | 09e56d6 | 2010-04-23 13:45:53 -0700 | [diff] [blame] | 264 | DISALLOW_COPY_AND_ASSIGN(DeltaPerformer); |
| 265 | }; |
| 266 | |
| 267 | } // namespace chromeos_update_engine |
| 268 | |
| 269 | #endif // CHROMEOS_PLATFORM_UPDATE_ENGINE_DELTA_PERFORMER_H__ |