1 //
2 // Copyright (C) 2012 The Android Open Source Project
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 //      http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 //
16 
17 #include "update_engine/payload_consumer/filesystem_verifier_action.h"
18 
19 #include <errno.h>
20 #include <fcntl.h>
21 #include <sys/stat.h>
22 #include <sys/types.h>
23 
24 #include <algorithm>
25 #include <cstdlib>
26 #include <string>
27 
28 #include <base/bind.h>
29 #include <brillo/data_encoding.h>
30 #include <brillo/streams/file_stream.h>
31 #include <base/strings/string_util.h>
32 
33 #include "update_engine/common/utils.h"
34 
35 using brillo::data_encoding::Base64Encode;
36 using std::string;
37 
38 namespace chromeos_update_engine {
39 
40 namespace {
41 const off_t kReadFileBufferSize = 128 * 1024;
42 }  // namespace
43 
PerformAction()44 void FilesystemVerifierAction::PerformAction() {
45   // Will tell the ActionProcessor we've failed if we return.
46   ScopedActionCompleter abort_action_completer(processor_, this);
47 
48   if (!HasInputObject()) {
49     LOG(ERROR) << "FilesystemVerifierAction missing input object.";
50     return;
51   }
52   install_plan_ = GetInputObject();
53 
54   if (install_plan_.partitions.empty()) {
55     LOG(INFO) << "No partitions to verify.";
56     if (HasOutputPipe())
57       SetOutputObject(install_plan_);
58     abort_action_completer.set_code(ErrorCode::kSuccess);
59     return;
60   }
61   install_plan_.Dump();
62 
63   StartPartitionHashing();
64   abort_action_completer.set_should_complete(false);
65 }
66 
TerminateProcessing()67 void FilesystemVerifierAction::TerminateProcessing() {
68   cancelled_ = true;
69   Cleanup(ErrorCode::kSuccess);  // error code is ignored if canceled_ is true.
70 }
71 
Cleanup(ErrorCode code)72 void FilesystemVerifierAction::Cleanup(ErrorCode code) {
73   src_stream_.reset();
74   // This memory is not used anymore.
75   buffer_.clear();
76 
77   if (cancelled_)
78     return;
79   if (code == ErrorCode::kSuccess && HasOutputPipe())
80     SetOutputObject(install_plan_);
81   UpdateProgress(1.0);
82   processor_->ActionComplete(this, code);
83 }
84 
UpdateProgress(double progress)85 void FilesystemVerifierAction::UpdateProgress(double progress) {
86   if (delegate_ != nullptr) {
87     delegate_->OnVerifyProgressUpdate(progress);
88   }
89 }
90 
StartPartitionHashing()91 void FilesystemVerifierAction::StartPartitionHashing() {
92   if (partition_index_ == install_plan_.partitions.size()) {
93     if (!install_plan_.untouched_dynamic_partitions.empty()) {
94       LOG(INFO) << "Verifying extents of untouched dynamic partitions ["
95                 << base::JoinString(install_plan_.untouched_dynamic_partitions,
96                                     ", ")
97                 << "]";
98       if (!dynamic_control_->VerifyExtentsForUntouchedPartitions(
99               install_plan_.source_slot,
100               install_plan_.target_slot,
101               install_plan_.untouched_dynamic_partitions)) {
102         Cleanup(ErrorCode::kFilesystemVerifierError);
103         return;
104       }
105     }
106 
107     Cleanup(ErrorCode::kSuccess);
108     return;
109   }
110   const InstallPlan::Partition& partition =
111       install_plan_.partitions[partition_index_];
112 
113   string part_path;
114   switch (verifier_step_) {
115     case VerifierStep::kVerifySourceHash:
116       part_path = partition.source_path;
117       partition_size_ = partition.source_size;
118       break;
119     case VerifierStep::kVerifyTargetHash:
120       part_path = partition.target_path;
121       partition_size_ = partition.target_size;
122       break;
123   }
124 
125   if (part_path.empty()) {
126     if (partition_size_ == 0) {
127       LOG(INFO) << "Skip hashing partition " << partition_index_ << " ("
128                 << partition.name << ") because size is 0.";
129       partition_index_++;
130       StartPartitionHashing();
131       return;
132     }
133     LOG(ERROR) << "Cannot hash partition " << partition_index_ << " ("
134                << partition.name
135                << ") because its device path cannot be determined.";
136     Cleanup(ErrorCode::kFilesystemVerifierError);
137     return;
138   }
139 
140   LOG(INFO) << "Hashing partition " << partition_index_ << " ("
141             << partition.name << ") on device " << part_path;
142 
143   brillo::ErrorPtr error;
144   src_stream_ =
145       brillo::FileStream::Open(base::FilePath(part_path),
146                                brillo::Stream::AccessMode::READ,
147                                brillo::FileStream::Disposition::OPEN_EXISTING,
148                                &error);
149 
150   if (!src_stream_) {
151     LOG(ERROR) << "Unable to open " << part_path << " for reading";
152     Cleanup(ErrorCode::kFilesystemVerifierError);
153     return;
154   }
155 
156   buffer_.resize(kReadFileBufferSize);
157   hasher_ = std::make_unique<HashCalculator>();
158 
159   offset_ = 0;
160   if (verifier_step_ == VerifierStep::kVerifyTargetHash &&
161       install_plan_.write_verity) {
162     if (!verity_writer_->Init(partition)) {
163       Cleanup(ErrorCode::kVerityCalculationError);
164       return;
165     }
166   }
167 
168   // Start the first read.
169   ScheduleRead();
170 }
171 
ScheduleRead()172 void FilesystemVerifierAction::ScheduleRead() {
173   const InstallPlan::Partition& partition =
174       install_plan_.partitions[partition_index_];
175 
176   // We can only start reading anything past |hash_tree_offset| after we have
177   // already read all the data blocks that the hash tree covers. The same
178   // applies to FEC.
179   uint64_t read_end = partition_size_;
180   if (partition.hash_tree_size != 0 &&
181       offset_ < partition.hash_tree_data_offset + partition.hash_tree_data_size)
182     read_end = std::min(read_end, partition.hash_tree_offset);
183   if (partition.fec_size != 0 &&
184       offset_ < partition.fec_data_offset + partition.fec_data_size)
185     read_end = std::min(read_end, partition.fec_offset);
186   size_t bytes_to_read =
187       std::min(static_cast<uint64_t>(buffer_.size()), read_end - offset_);
188   if (!bytes_to_read) {
189     FinishPartitionHashing();
190     return;
191   }
192 
193   bool read_async_ok = src_stream_->ReadAsync(
194       buffer_.data(),
195       bytes_to_read,
196       base::Bind(&FilesystemVerifierAction::OnReadDoneCallback,
197                  base::Unretained(this)),
198       base::Bind(&FilesystemVerifierAction::OnReadErrorCallback,
199                  base::Unretained(this)),
200       nullptr);
201 
202   if (!read_async_ok) {
203     LOG(ERROR) << "Unable to schedule an asynchronous read from the stream.";
204     Cleanup(ErrorCode::kError);
205   }
206 }
207 
OnReadDoneCallback(size_t bytes_read)208 void FilesystemVerifierAction::OnReadDoneCallback(size_t bytes_read) {
209   if (cancelled_) {
210     Cleanup(ErrorCode::kError);
211     return;
212   }
213   if (bytes_read == 0) {
214     LOG(ERROR) << "Failed to read the remaining " << partition_size_ - offset_
215                << " bytes from partition "
216                << install_plan_.partitions[partition_index_].name;
217     Cleanup(ErrorCode::kFilesystemVerifierError);
218     return;
219   }
220 
221   if (!hasher_->Update(buffer_.data(), bytes_read)) {
222     LOG(ERROR) << "Unable to update the hash.";
223     Cleanup(ErrorCode::kError);
224     return;
225   }
226 
227   // WE don't consider sizes of each partition. Every partition
228   // has the same length on progress bar.
229   // TODO(zhangkelvin) Take sizes of each partition into account
230 
231   UpdateProgress(
232       (static_cast<double>(offset_) / partition_size_ + partition_index_) /
233       install_plan_.partitions.size());
234   if (verifier_step_ == VerifierStep::kVerifyTargetHash &&
235       install_plan_.write_verity) {
236     if (!verity_writer_->Update(offset_, buffer_.data(), bytes_read)) {
237       Cleanup(ErrorCode::kVerityCalculationError);
238       return;
239     }
240   }
241 
242   offset_ += bytes_read;
243 
244   if (offset_ == partition_size_) {
245     FinishPartitionHashing();
246     return;
247   }
248 
249   ScheduleRead();
250 }
251 
OnReadErrorCallback(const brillo::Error * error)252 void FilesystemVerifierAction::OnReadErrorCallback(const brillo::Error* error) {
253   // TODO(deymo): Transform the read-error into an specific ErrorCode.
254   LOG(ERROR) << "Asynchronous read failed.";
255   Cleanup(ErrorCode::kError);
256 }
257 
FinishPartitionHashing()258 void FilesystemVerifierAction::FinishPartitionHashing() {
259   if (!hasher_->Finalize()) {
260     LOG(ERROR) << "Unable to finalize the hash.";
261     Cleanup(ErrorCode::kError);
262     return;
263   }
264   InstallPlan::Partition& partition =
265       install_plan_.partitions[partition_index_];
266   LOG(INFO) << "Hash of " << partition.name << ": "
267             << Base64Encode(hasher_->raw_hash());
268 
269   switch (verifier_step_) {
270     case VerifierStep::kVerifyTargetHash:
271       if (partition.target_hash != hasher_->raw_hash()) {
272         LOG(ERROR) << "New '" << partition.name
273                    << "' partition verification failed.";
274         if (partition.source_hash.empty()) {
275           // No need to verify source if it is a full payload.
276           Cleanup(ErrorCode::kNewRootfsVerificationError);
277           return;
278         }
279         // If we have not verified source partition yet, now that the target
280         // partition does not match, and it's not a full payload, we need to
281         // switch to kVerifySourceHash step to check if it's because the source
282         // partition does not match either.
283         verifier_step_ = VerifierStep::kVerifySourceHash;
284       } else {
285         partition_index_++;
286       }
287       break;
288     case VerifierStep::kVerifySourceHash:
289       if (partition.source_hash != hasher_->raw_hash()) {
290         LOG(ERROR) << "Old '" << partition.name
291                    << "' partition verification failed.";
292         LOG(ERROR) << "This is a server-side error due to mismatched delta"
293                    << " update image!";
294         LOG(ERROR) << "The delta I've been given contains a " << partition.name
295                    << " delta update that must be applied over a "
296                    << partition.name << " with a specific checksum, but the "
297                    << partition.name
298                    << " we're starting with doesn't have that checksum! This"
299                       " means that the delta I've been given doesn't match my"
300                       " existing system. The "
301                    << partition.name << " partition I have has hash: "
302                    << Base64Encode(hasher_->raw_hash())
303                    << " but the update expected me to have "
304                    << Base64Encode(partition.source_hash) << " .";
305         LOG(INFO) << "To get the checksum of the " << partition.name
306                   << " partition run this command: dd if="
307                   << partition.source_path
308                   << " bs=1M count=" << partition.source_size
309                   << " iflag=count_bytes 2>/dev/null | openssl dgst -sha256 "
310                      "-binary | openssl base64";
311         LOG(INFO) << "To get the checksum of partitions in a bin file, "
312                   << "run: .../src/scripts/sha256_partitions.sh .../file.bin";
313         Cleanup(ErrorCode::kDownloadStateInitializationError);
314         return;
315       }
316       // The action will skip kVerifySourceHash step if target partition hash
317       // matches, if we are in this step, it means target hash does not match,
318       // and now that the source partition hash matches, we should set the error
319       // code to reflect the error in target partition.
320       // We only need to verify the source partition which the target hash does
321       // not match, the rest of the partitions don't matter.
322       Cleanup(ErrorCode::kNewRootfsVerificationError);
323       return;
324   }
325   // Start hashing the next partition, if any.
326   hasher_.reset();
327   buffer_.clear();
328   src_stream_->CloseBlocking(nullptr);
329   StartPartitionHashing();
330 }
331 
332 }  // namespace chromeos_update_engine
333