1 // 2 // Copyright (C) 2012 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 // 16 17 #include "update_engine/omaha_request_action.h" 18 19 #include <inttypes.h> 20 21 #include <map> 22 #include <sstream> 23 #include <string> 24 #include <vector> 25 26 #include <base/bind.h> 27 #include <base/logging.h> 28 #include <base/rand_util.h> 29 #include <base/strings/string_number_conversions.h> 30 #include <base/strings/string_split.h> 31 #include <base/strings/string_util.h> 32 #include <base/strings/stringprintf.h> 33 #include <base/time/time.h> 34 #include <expat.h> 35 #include <metrics/metrics_library.h> 36 37 #include "update_engine/common/action_pipe.h" 38 #include "update_engine/common/constants.h" 39 #include "update_engine/common/hardware_interface.h" 40 #include "update_engine/common/hash_calculator.h" 41 #include "update_engine/common/platform_constants.h" 42 #include "update_engine/common/prefs_interface.h" 43 #include "update_engine/common/utils.h" 44 #include "update_engine/connection_manager_interface.h" 45 #include "update_engine/metrics.h" 46 #include "update_engine/metrics_utils.h" 47 #include "update_engine/omaha_request_params.h" 48 #include "update_engine/p2p_manager.h" 49 #include "update_engine/payload_state_interface.h" 50 51 using base::Time; 52 using base::TimeDelta; 53 using std::map; 54 using std::string; 55 using std::vector; 56 57 namespace chromeos_update_engine { 58 59 // List of custom pair tags that we interpret in the Omaha Response: 60 static const char* kTagDeadline = "deadline"; 61 static const char* kTagDisablePayloadBackoff = "DisablePayloadBackoff"; 62 static const char* kTagVersion = "version"; 63 // Deprecated: "IsDelta" 64 static const char* kTagIsDeltaPayload = "IsDeltaPayload"; 65 static const char* kTagMaxFailureCountPerUrl = "MaxFailureCountPerUrl"; 66 static const char* kTagMaxDaysToScatter = "MaxDaysToScatter"; 67 // Deprecated: "ManifestSignatureRsa" 68 // Deprecated: "ManifestSize" 69 static const char* kTagMetadataSignatureRsa = "MetadataSignatureRsa"; 70 static const char* kTagMetadataSize = "MetadataSize"; 71 static const char* kTagMoreInfo = "MoreInfo"; 72 // Deprecated: "NeedsAdmin" 73 static const char* kTagPrompt = "Prompt"; 74 static const char* kTagDisableP2PForDownloading = "DisableP2PForDownloading"; 75 static const char* kTagDisableP2PForSharing = "DisableP2PForSharing"; 76 static const char* kTagPublicKeyRsa = "PublicKeyRsa"; 77 78 static const char* kOmahaUpdaterVersion = "0.1.0.0"; 79 80 // X-GoogleUpdate headers. 81 static const char* kXGoogleUpdateInteractivity = "X-GoogleUpdate-Interactivity"; 82 static const char* kXGoogleUpdateAppId = "X-GoogleUpdate-AppId"; 83 static const char* kXGoogleUpdateUpdater = "X-GoogleUpdate-Updater"; 84 85 // updatecheck attributes (without the underscore prefix). 86 static const char* kEolAttr = "eol"; 87 88 namespace { 89 90 // Returns an XML ping element attribute assignment with attribute 91 // |name| and value |ping_days| if |ping_days| has a value that needs 92 // to be sent, or an empty string otherwise. 93 string GetPingAttribute(const string& name, int ping_days) { 94 if (ping_days > 0 || ping_days == OmahaRequestAction::kNeverPinged) 95 return base::StringPrintf(" %s=\"%d\"", name.c_str(), ping_days); 96 return ""; 97 } 98 99 // Returns an XML ping element if any of the elapsed days need to be 100 // sent, or an empty string otherwise. 101 string GetPingXml(int ping_active_days, int ping_roll_call_days) { 102 string ping_active = GetPingAttribute("a", ping_active_days); 103 string ping_roll_call = GetPingAttribute("r", ping_roll_call_days); 104 if (!ping_active.empty() || !ping_roll_call.empty()) { 105 return base::StringPrintf(" <ping active=\"1\"%s%s></ping>\n", 106 ping_active.c_str(), 107 ping_roll_call.c_str()); 108 } 109 return ""; 110 } 111 112 // Returns an XML that goes into the body of the <app> element of the Omaha 113 // request based on the given parameters. 114 string GetAppBody(const OmahaEvent* event, 115 OmahaRequestParams* params, 116 bool ping_only, 117 bool include_ping, 118 int ping_active_days, 119 int ping_roll_call_days, 120 PrefsInterface* prefs) { 121 string app_body; 122 if (event == nullptr) { 123 if (include_ping) 124 app_body = GetPingXml(ping_active_days, ping_roll_call_days); 125 if (!ping_only) { 126 app_body += base::StringPrintf( 127 " <updatecheck targetversionprefix=\"%s\"" 128 "></updatecheck>\n", 129 XmlEncodeWithDefault(params->target_version_prefix(), "").c_str()); 130 131 // If this is the first update check after a reboot following a previous 132 // update, generate an event containing the previous version number. If 133 // the previous version preference file doesn't exist the event is still 134 // generated with a previous version of 0.0.0.0 -- this is relevant for 135 // older clients or new installs. The previous version event is not sent 136 // for ping-only requests because they come before the client has 137 // rebooted. The previous version event is also not sent if it was already 138 // sent for this new version with a previous updatecheck. 139 string prev_version; 140 if (!prefs->GetString(kPrefsPreviousVersion, &prev_version)) { 141 prev_version = "0.0.0.0"; 142 } 143 // We only store a non-empty previous version value after a successful 144 // update in the previous boot. After reporting it back to the server, 145 // we clear the previous version value so it doesn't get reported again. 146 if (!prev_version.empty()) { 147 app_body += base::StringPrintf( 148 " <event eventtype=\"%d\" eventresult=\"%d\" " 149 "previousversion=\"%s\"></event>\n", 150 OmahaEvent::kTypeRebootedAfterUpdate, 151 OmahaEvent::kResultSuccess, 152 XmlEncodeWithDefault(prev_version, "0.0.0.0").c_str()); 153 LOG_IF(WARNING, !prefs->SetString(kPrefsPreviousVersion, "")) 154 << "Unable to reset the previous version."; 155 } 156 } 157 } else { 158 // The error code is an optional attribute so append it only if the result 159 // is not success. 160 string error_code; 161 if (event->result != OmahaEvent::kResultSuccess) { 162 error_code = base::StringPrintf(" errorcode=\"%d\"", 163 static_cast<int>(event->error_code)); 164 } 165 app_body = base::StringPrintf( 166 " <event eventtype=\"%d\" eventresult=\"%d\"%s></event>\n", 167 event->type, event->result, error_code.c_str()); 168 } 169 170 return app_body; 171 } 172 173 // Returns the cohort* argument to include in the <app> tag for the passed 174 // |arg_name| and |prefs_key|, if any. The return value is suitable to 175 // concatenate to the list of arguments and includes a space at the end. 176 string GetCohortArgXml(PrefsInterface* prefs, 177 const string arg_name, 178 const string prefs_key) { 179 // There's nothing wrong with not having a given cohort setting, so we check 180 // existance first to avoid the warning log message. 181 if (!prefs->Exists(prefs_key)) 182 return ""; 183 string cohort_value; 184 if (!prefs->GetString(prefs_key, &cohort_value) || cohort_value.empty()) 185 return ""; 186 // This is a sanity check to avoid sending a huge XML file back to Ohama due 187 // to a compromised stateful partition making the update check fail in low 188 // network environments envent after a reboot. 189 if (cohort_value.size() > 1024) { 190 LOG(WARNING) << "The omaha cohort setting " << arg_name 191 << " has a too big value, which must be an error or an " 192 "attacker trying to inhibit updates."; 193 return ""; 194 } 195 196 string escaped_xml_value; 197 if (!XmlEncode(cohort_value, &escaped_xml_value)) { 198 LOG(WARNING) << "The omaha cohort setting " << arg_name 199 << " is ASCII-7 invalid, ignoring it."; 200 return ""; 201 } 202 203 return base::StringPrintf("%s=\"%s\" ", 204 arg_name.c_str(), escaped_xml_value.c_str()); 205 } 206 207 struct OmahaAppData { 208 string id; 209 string version; 210 }; 211 212 // Returns an XML that corresponds to the entire <app> node of the Omaha 213 // request based on the given parameters. 214 string GetAppXml(const OmahaEvent* event, 215 OmahaRequestParams* params, 216 const OmahaAppData& app_data, 217 bool ping_only, 218 bool include_ping, 219 int ping_active_days, 220 int ping_roll_call_days, 221 int install_date_in_days, 222 SystemState* system_state) { 223 string app_body = GetAppBody(event, params, ping_only, include_ping, 224 ping_active_days, ping_roll_call_days, 225 system_state->prefs()); 226 string app_versions; 227 228 // If we are upgrading to a more stable channel and we are allowed to do 229 // powerwash, then pass 0.0.0.0 as the version. This is needed to get the 230 // highest-versioned payload on the destination channel. 231 if (params->to_more_stable_channel() && params->is_powerwash_allowed()) { 232 LOG(INFO) << "Passing OS version as 0.0.0.0 as we are set to powerwash " 233 << "on downgrading to the version in the more stable channel"; 234 app_versions = "version=\"0.0.0.0\" from_version=\"" + 235 XmlEncodeWithDefault(app_data.version, "0.0.0.0") + "\" "; 236 } else { 237 app_versions = "version=\"" + 238 XmlEncodeWithDefault(app_data.version, "0.0.0.0") + "\" "; 239 } 240 241 string download_channel = params->download_channel(); 242 string app_channels = 243 "track=\"" + XmlEncodeWithDefault(download_channel, "") + "\" "; 244 if (params->current_channel() != download_channel) { 245 app_channels += "from_track=\"" + XmlEncodeWithDefault( 246 params->current_channel(), "") + "\" "; 247 } 248 249 string delta_okay_str = params->delta_okay() ? "true" : "false"; 250 251 // If install_date_days is not set (e.g. its value is -1 ), don't 252 // include the attribute. 253 string install_date_in_days_str = ""; 254 if (install_date_in_days >= 0) { 255 install_date_in_days_str = base::StringPrintf("installdate=\"%d\" ", 256 install_date_in_days); 257 } 258 259 string app_cohort_args; 260 app_cohort_args += GetCohortArgXml(system_state->prefs(), 261 "cohort", kPrefsOmahaCohort); 262 app_cohort_args += GetCohortArgXml(system_state->prefs(), 263 "cohorthint", kPrefsOmahaCohortHint); 264 app_cohort_args += GetCohortArgXml(system_state->prefs(), 265 "cohortname", kPrefsOmahaCohortName); 266 267 string fingerprint_arg; 268 if (!params->os_build_fingerprint().empty()) { 269 fingerprint_arg = 270 "fingerprint=\"" + XmlEncodeWithDefault(params->os_build_fingerprint(), "") + "\" "; 271 } 272 273 string buildtype_arg; 274 if (!params->os_build_type().empty()) { 275 buildtype_arg = "os_build_type=\"" + 276 XmlEncodeWithDefault(params->os_build_type(), "") + "\" "; 277 } 278 279 string app_xml = " <app " 280 "appid=\"" + XmlEncodeWithDefault(app_data.id, "") + "\" " + 281 app_cohort_args + 282 app_versions + 283 app_channels + 284 fingerprint_arg + 285 buildtype_arg + 286 "lang=\"" + XmlEncodeWithDefault(params->app_lang(), "en-US") + "\" " + 287 "board=\"" + XmlEncodeWithDefault(params->os_board(), "") + "\" " + 288 "hardware_class=\"" + XmlEncodeWithDefault(params->hwid(), "") + "\" " + 289 "delta_okay=\"" + delta_okay_str + "\" " 290 "fw_version=\"" + XmlEncodeWithDefault(params->fw_version(), "") + "\" " + 291 "ec_version=\"" + XmlEncodeWithDefault(params->ec_version(), "") + "\" " + 292 install_date_in_days_str + 293 ">\n" + 294 app_body + 295 " </app>\n"; 296 297 return app_xml; 298 } 299 300 // Returns an XML that corresponds to the entire <os> node of the Omaha 301 // request based on the given parameters. 302 string GetOsXml(OmahaRequestParams* params) { 303 string os_xml =" <os " 304 "version=\"" + XmlEncodeWithDefault(params->os_version(), "") + "\" " + 305 "platform=\"" + XmlEncodeWithDefault(params->os_platform(), "") + "\" " + 306 "sp=\"" + XmlEncodeWithDefault(params->os_sp(), "") + "\">" 307 "</os>\n"; 308 return os_xml; 309 } 310 311 // Returns an XML that corresponds to the entire Omaha request based on the 312 // given parameters. 313 string GetRequestXml(const OmahaEvent* event, 314 OmahaRequestParams* params, 315 bool ping_only, 316 bool include_ping, 317 int ping_active_days, 318 int ping_roll_call_days, 319 int install_date_in_days, 320 SystemState* system_state) { 321 string os_xml = GetOsXml(params); 322 OmahaAppData product_app = {.id = params->GetAppId(), 323 .version = params->app_version()}; 324 string app_xml = GetAppXml(event, 325 params, 326 product_app, 327 ping_only, 328 include_ping, 329 ping_active_days, 330 ping_roll_call_days, 331 install_date_in_days, 332 system_state); 333 if (!params->system_app_id().empty()) { 334 OmahaAppData system_app = {.id = params->system_app_id(), 335 .version = params->system_version()}; 336 app_xml += GetAppXml(event, 337 params, 338 system_app, 339 ping_only, 340 include_ping, 341 ping_active_days, 342 ping_roll_call_days, 343 install_date_in_days, 344 system_state); 345 } 346 347 string install_source = base::StringPrintf("installsource=\"%s\" ", 348 (params->interactive() ? "ondemandupdate" : "scheduler")); 349 350 string updater_version = XmlEncodeWithDefault( 351 base::StringPrintf("%s-%s", 352 constants::kOmahaUpdaterID, 353 kOmahaUpdaterVersion), ""); 354 string request_xml = 355 "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" 356 "<request protocol=\"3.0\" " + ( 357 "version=\"" + updater_version + "\" " 358 "updaterversion=\"" + updater_version + "\" " + 359 install_source + 360 "ismachine=\"1\">\n") + 361 os_xml + 362 app_xml + 363 "</request>\n"; 364 365 return request_xml; 366 } 367 368 } // namespace 369 370 // Struct used for holding data obtained when parsing the XML. 371 struct OmahaParserData { 372 explicit OmahaParserData(XML_Parser _xml_parser) : xml_parser(_xml_parser) {} 373 374 // Pointer to the expat XML_Parser object. 375 XML_Parser xml_parser; 376 377 // This is the state of the parser as it's processing the XML. 378 bool failed = false; 379 bool entity_decl = false; 380 string current_path; 381 382 // These are the values extracted from the XML. 383 string app_cohort; 384 string app_cohorthint; 385 string app_cohortname; 386 bool app_cohort_set = false; 387 bool app_cohorthint_set = false; 388 bool app_cohortname_set = false; 389 string updatecheck_poll_interval; 390 map<string, string> updatecheck_attrs; 391 string daystart_elapsed_days; 392 string daystart_elapsed_seconds; 393 394 struct App { 395 vector<string> url_codebase; 396 string manifest_version; 397 map<string, string> action_postinstall_attrs; 398 string updatecheck_status; 399 400 struct Package { 401 string name; 402 string size; 403 string hash; 404 }; 405 vector<Package> packages; 406 }; 407 vector<App> apps; 408 }; 409 410 namespace { 411 412 // Callback function invoked by expat. 413 void ParserHandlerStart(void* user_data, const XML_Char* element, 414 const XML_Char** attr) { 415 OmahaParserData* data = reinterpret_cast<OmahaParserData*>(user_data); 416 417 if (data->failed) 418 return; 419 420 data->current_path += string("/") + element; 421 422 map<string, string> attrs; 423 if (attr != nullptr) { 424 for (int n = 0; attr[n] != nullptr && attr[n+1] != nullptr; n += 2) { 425 string key = attr[n]; 426 string value = attr[n + 1]; 427 attrs[key] = value; 428 } 429 } 430 431 if (data->current_path == "/response/app") { 432 data->apps.emplace_back(); 433 if (attrs.find("cohort") != attrs.end()) { 434 data->app_cohort_set = true; 435 data->app_cohort = attrs["cohort"]; 436 } 437 if (attrs.find("cohorthint") != attrs.end()) { 438 data->app_cohorthint_set = true; 439 data->app_cohorthint = attrs["cohorthint"]; 440 } 441 if (attrs.find("cohortname") != attrs.end()) { 442 data->app_cohortname_set = true; 443 data->app_cohortname = attrs["cohortname"]; 444 } 445 } else if (data->current_path == "/response/app/updatecheck") { 446 if (!data->apps.empty()) 447 data->apps.back().updatecheck_status = attrs["status"]; 448 if (data->updatecheck_poll_interval.empty()) 449 data->updatecheck_poll_interval = attrs["PollInterval"]; 450 // Omaha sends arbitrary key-value pairs as extra attributes starting with 451 // an underscore. 452 for (const auto& attr : attrs) { 453 if (!attr.first.empty() && attr.first[0] == '_') 454 data->updatecheck_attrs[attr.first.substr(1)] = attr.second; 455 } 456 } else if (data->current_path == "/response/daystart") { 457 // Get the install-date. 458 data->daystart_elapsed_days = attrs["elapsed_days"]; 459 data->daystart_elapsed_seconds = attrs["elapsed_seconds"]; 460 } else if (data->current_path == "/response/app/updatecheck/urls/url") { 461 // Look at all <url> elements. 462 if (!data->apps.empty()) 463 data->apps.back().url_codebase.push_back(attrs["codebase"]); 464 } else if (data->current_path == 465 "/response/app/updatecheck/manifest/packages/package") { 466 // Look at all <package> elements. 467 if (!data->apps.empty()) 468 data->apps.back().packages.push_back({.name = attrs["name"], 469 .size = attrs["size"], 470 .hash = attrs["hash_sha256"]}); 471 } else if (data->current_path == "/response/app/updatecheck/manifest") { 472 // Get the version. 473 if (!data->apps.empty()) 474 data->apps.back().manifest_version = attrs[kTagVersion]; 475 } else if (data->current_path == 476 "/response/app/updatecheck/manifest/actions/action") { 477 // We only care about the postinstall action. 478 if (attrs["event"] == "postinstall" && !data->apps.empty()) { 479 data->apps.back().action_postinstall_attrs = std::move(attrs); 480 } 481 } 482 } 483 484 // Callback function invoked by expat. 485 void ParserHandlerEnd(void* user_data, const XML_Char* element) { 486 OmahaParserData* data = reinterpret_cast<OmahaParserData*>(user_data); 487 if (data->failed) 488 return; 489 490 const string path_suffix = string("/") + element; 491 492 if (!base::EndsWith(data->current_path, path_suffix, 493 base::CompareCase::SENSITIVE)) { 494 LOG(ERROR) << "Unexpected end element '" << element 495 << "' with current_path='" << data->current_path << "'"; 496 data->failed = true; 497 return; 498 } 499 data->current_path.resize(data->current_path.size() - path_suffix.size()); 500 } 501 502 // Callback function invoked by expat. 503 // 504 // This is called for entity declarations. Since Omaha is guaranteed 505 // to never return any XML with entities our course of action is to 506 // just stop parsing. This avoids potential resource exhaustion 507 // problems AKA the "billion laughs". CVE-2013-0340. 508 void ParserHandlerEntityDecl(void *user_data, 509 const XML_Char *entity_name, 510 int is_parameter_entity, 511 const XML_Char *value, 512 int value_length, 513 const XML_Char *base, 514 const XML_Char *system_id, 515 const XML_Char *public_id, 516 const XML_Char *notation_name) { 517 OmahaParserData* data = reinterpret_cast<OmahaParserData*>(user_data); 518 519 LOG(ERROR) << "XML entities are not supported. Aborting parsing."; 520 data->failed = true; 521 data->entity_decl = true; 522 XML_StopParser(data->xml_parser, false); 523 } 524 525 } // namespace 526 527 bool XmlEncode(const string& input, string* output) { 528 if (std::find_if(input.begin(), input.end(), 529 [](const char c){return c & 0x80;}) != input.end()) { 530 LOG(WARNING) << "Invalid ASCII-7 string passed to the XML encoder:"; 531 utils::HexDumpString(input); 532 return false; 533 } 534 output->clear(); 535 // We need at least input.size() space in the output, but the code below will 536 // handle it if we need more. 537 output->reserve(input.size()); 538 for (char c : input) { 539 switch (c) { 540 case '\"': 541 output->append("""); 542 break; 543 case '\'': 544 output->append("'"); 545 break; 546 case '&': 547 output->append("&"); 548 break; 549 case '<': 550 output->append("<"); 551 break; 552 case '>': 553 output->append(">"); 554 break; 555 default: 556 output->push_back(c); 557 } 558 } 559 return true; 560 } 561 562 string XmlEncodeWithDefault(const string& input, const string& default_value) { 563 string output; 564 if (XmlEncode(input, &output)) 565 return output; 566 return default_value; 567 } 568 569 OmahaRequestAction::OmahaRequestAction( 570 SystemState* system_state, 571 OmahaEvent* event, 572 std::unique_ptr<HttpFetcher> http_fetcher, 573 bool ping_only) 574 : system_state_(system_state), 575 event_(event), 576 http_fetcher_(std::move(http_fetcher)), 577 ping_only_(ping_only), 578 ping_active_days_(0), 579 ping_roll_call_days_(0) { 580 params_ = system_state->request_params(); 581 } 582 583 OmahaRequestAction::~OmahaRequestAction() {} 584 585 // Calculates the value to use for the ping days parameter. 586 int OmahaRequestAction::CalculatePingDays(const string& key) { 587 int days = kNeverPinged; 588 int64_t last_ping = 0; 589 if (system_state_->prefs()->GetInt64(key, &last_ping) && last_ping >= 0) { 590 days = (Time::Now() - Time::FromInternalValue(last_ping)).InDays(); 591 if (days < 0) { 592 // If |days| is negative, then the system clock must have jumped 593 // back in time since the ping was sent. Mark the value so that 594 // it doesn't get sent to the server but we still update the 595 // last ping daystart preference. This way the next ping time 596 // will be correct, hopefully. 597 days = kPingTimeJump; 598 LOG(WARNING) << 599 "System clock jumped back in time. Resetting ping daystarts."; 600 } 601 } 602 return days; 603 } 604 605 void OmahaRequestAction::InitPingDays() { 606 // We send pings only along with update checks, not with events. 607 if (IsEvent()) { 608 return; 609 } 610 // TODO(petkov): Figure a way to distinguish active use pings 611 // vs. roll call pings. Currently, the two pings are identical. A 612 // fix needs to change this code as well as UpdateLastPingDays and ShouldPing. 613 ping_active_days_ = CalculatePingDays(kPrefsLastActivePingDay); 614 ping_roll_call_days_ = CalculatePingDays(kPrefsLastRollCallPingDay); 615 } 616 617 bool OmahaRequestAction::ShouldPing() const { 618 if (ping_active_days_ == OmahaRequestAction::kNeverPinged && 619 ping_roll_call_days_ == OmahaRequestAction::kNeverPinged) { 620 int powerwash_count = system_state_->hardware()->GetPowerwashCount(); 621 if (powerwash_count > 0) { 622 LOG(INFO) << "Not sending ping with a=-1 r=-1 to omaha because " 623 << "powerwash_count is " << powerwash_count; 624 return false; 625 } 626 return true; 627 } 628 return ping_active_days_ > 0 || ping_roll_call_days_ > 0; 629 } 630 631 // static 632 int OmahaRequestAction::GetInstallDate(SystemState* system_state) { 633 PrefsInterface* prefs = system_state->prefs(); 634 if (prefs == nullptr) 635 return -1; 636 637 // If we have the value stored on disk, just return it. 638 int64_t stored_value; 639 if (prefs->GetInt64(kPrefsInstallDateDays, &stored_value)) { 640 // Convert and sanity-check. 641 int install_date_days = static_cast<int>(stored_value); 642 if (install_date_days >= 0) 643 return install_date_days; 644 LOG(ERROR) << "Dropping stored Omaha InstallData since its value num_days=" 645 << install_date_days << " looks suspicious."; 646 prefs->Delete(kPrefsInstallDateDays); 647 } 648 649 // Otherwise, if OOBE is not complete then do nothing and wait for 650 // ParseResponse() to call ParseInstallDate() and then 651 // PersistInstallDate() to set the kPrefsInstallDateDays state 652 // variable. Once that is done, we'll then report back in future 653 // Omaha requests. This works exactly because OOBE triggers an 654 // update check. 655 // 656 // However, if OOBE is complete and the kPrefsInstallDateDays state 657 // variable is not set, there are two possibilities 658 // 659 // 1. The update check in OOBE failed so we never got a response 660 // from Omaha (no network etc.); or 661 // 662 // 2. OOBE was done on an older version that didn't write to the 663 // kPrefsInstallDateDays state variable. 664 // 665 // In both cases, we approximate the install date by simply 666 // inspecting the timestamp of when OOBE happened. 667 668 Time time_of_oobe; 669 if (!system_state->hardware()->IsOOBEEnabled() || 670 !system_state->hardware()->IsOOBEComplete(&time_of_oobe)) { 671 LOG(INFO) << "Not generating Omaha InstallData as we have " 672 << "no prefs file and OOBE is not complete or not enabled."; 673 return -1; 674 } 675 676 int num_days; 677 if (!utils::ConvertToOmahaInstallDate(time_of_oobe, &num_days)) { 678 LOG(ERROR) << "Not generating Omaha InstallData from time of OOBE " 679 << "as its value '" << utils::ToString(time_of_oobe) 680 << "' looks suspicious."; 681 return -1; 682 } 683 684 // Persist this to disk, for future use. 685 if (!OmahaRequestAction::PersistInstallDate(system_state, 686 num_days, 687 kProvisionedFromOOBEMarker)) 688 return -1; 689 690 LOG(INFO) << "Set the Omaha InstallDate from OOBE time-stamp to " 691 << num_days << " days"; 692 693 return num_days; 694 } 695 696 void OmahaRequestAction::PerformAction() { 697 http_fetcher_->set_delegate(this); 698 InitPingDays(); 699 if (ping_only_ && !ShouldPing()) { 700 processor_->ActionComplete(this, ErrorCode::kSuccess); 701 return; 702 } 703 704 string request_post(GetRequestXml(event_.get(), 705 params_, 706 ping_only_, 707 ShouldPing(), // include_ping 708 ping_active_days_, 709 ping_roll_call_days_, 710 GetInstallDate(system_state_), 711 system_state_)); 712 713 // Set X-GoogleUpdate headers. 714 http_fetcher_->SetHeader(kXGoogleUpdateInteractivity, 715 params_->interactive() ? "fg" : "bg"); 716 http_fetcher_->SetHeader(kXGoogleUpdateAppId, params_->GetAppId()); 717 http_fetcher_->SetHeader( 718 kXGoogleUpdateUpdater, 719 base::StringPrintf( 720 "%s-%s", constants::kOmahaUpdaterID, kOmahaUpdaterVersion)); 721 722 http_fetcher_->SetPostData(request_post.data(), request_post.size(), 723 kHttpContentTypeTextXml); 724 LOG(INFO) << "Posting an Omaha request to " << params_->update_url(); 725 LOG(INFO) << "Request: " << request_post; 726 http_fetcher_->BeginTransfer(params_->update_url()); 727 } 728 729 void OmahaRequestAction::TerminateProcessing() { 730 http_fetcher_->TerminateTransfer(); 731 } 732 733 // We just store the response in the buffer. Once we've received all bytes, 734 // we'll look in the buffer and decide what to do. 735 void OmahaRequestAction::ReceivedBytes(HttpFetcher *fetcher, 736 const void* bytes, 737 size_t length) { 738 const uint8_t* byte_ptr = reinterpret_cast<const uint8_t*>(bytes); 739 response_buffer_.insert(response_buffer_.end(), byte_ptr, byte_ptr + length); 740 } 741 742 namespace { 743 744 // Parses a 64 bit base-10 int from a string and returns it. Returns 0 745 // on error. If the string contains "0", that's indistinguishable from 746 // error. 747 off_t ParseInt(const string& str) { 748 off_t ret = 0; 749 int rc = sscanf(str.c_str(), "%" PRIi64, &ret); // NOLINT(runtime/printf) 750 if (rc < 1) { 751 // failure 752 return 0; 753 } 754 return ret; 755 } 756 757 // Parses |str| and returns |true| if, and only if, its value is "true". 758 bool ParseBool(const string& str) { 759 return str == "true"; 760 } 761 762 // Update the last ping day preferences based on the server daystart 763 // response. Returns true on success, false otherwise. 764 bool UpdateLastPingDays(OmahaParserData *parser_data, PrefsInterface* prefs) { 765 int64_t elapsed_seconds = 0; 766 TEST_AND_RETURN_FALSE( 767 base::StringToInt64(parser_data->daystart_elapsed_seconds, 768 &elapsed_seconds)); 769 TEST_AND_RETURN_FALSE(elapsed_seconds >= 0); 770 771 // Remember the local time that matches the server's last midnight 772 // time. 773 Time daystart = Time::Now() - TimeDelta::FromSeconds(elapsed_seconds); 774 prefs->SetInt64(kPrefsLastActivePingDay, daystart.ToInternalValue()); 775 prefs->SetInt64(kPrefsLastRollCallPingDay, daystart.ToInternalValue()); 776 return true; 777 } 778 779 // Parses the package node in the given XML document and populates 780 // |output_object| if valid. Returns true if we should continue the parsing. 781 // False otherwise, in which case it sets any error code using |completer|. 782 bool ParsePackage(OmahaParserData::App* app, 783 OmahaResponse* output_object, 784 ScopedActionCompleter* completer) { 785 if (app->updatecheck_status == "noupdate") { 786 if (!app->packages.empty()) { 787 LOG(ERROR) << "No update in this <app> but <package> is not empty."; 788 completer->set_code(ErrorCode::kOmahaResponseInvalid); 789 return false; 790 } 791 return true; 792 } 793 if (app->packages.empty()) { 794 LOG(ERROR) << "Omaha Response has no packages"; 795 completer->set_code(ErrorCode::kOmahaResponseInvalid); 796 return false; 797 } 798 if (app->url_codebase.empty()) { 799 LOG(ERROR) << "No Omaha Response URLs"; 800 completer->set_code(ErrorCode::kOmahaResponseInvalid); 801 return false; 802 } 803 LOG(INFO) << "Found " << app->url_codebase.size() << " url(s)"; 804 vector<string> metadata_sizes = 805 base::SplitString(app->action_postinstall_attrs[kTagMetadataSize], 806 ":", 807 base::TRIM_WHITESPACE, 808 base::SPLIT_WANT_ALL); 809 vector<string> metadata_signatures = 810 base::SplitString(app->action_postinstall_attrs[kTagMetadataSignatureRsa], 811 ":", 812 base::TRIM_WHITESPACE, 813 base::SPLIT_WANT_ALL); 814 vector<string> is_delta_payloads = 815 base::SplitString(app->action_postinstall_attrs[kTagIsDeltaPayload], 816 ":", 817 base::TRIM_WHITESPACE, 818 base::SPLIT_WANT_ALL); 819 for (size_t i = 0; i < app->packages.size(); i++) { 820 const auto& package = app->packages[i]; 821 if (package.name.empty()) { 822 LOG(ERROR) << "Omaha Response has empty package name"; 823 completer->set_code(ErrorCode::kOmahaResponseInvalid); 824 return false; 825 } 826 LOG(INFO) << "Found package " << package.name; 827 828 OmahaResponse::Package out_package; 829 for (const string& codebase : app->url_codebase) { 830 if (codebase.empty()) { 831 LOG(ERROR) << "Omaha Response URL has empty codebase"; 832 completer->set_code(ErrorCode::kOmahaResponseInvalid); 833 return false; 834 } 835 out_package.payload_urls.push_back(codebase + package.name); 836 } 837 // Parse the payload size. 838 base::StringToUint64(package.size, &out_package.size); 839 if (out_package.size <= 0) { 840 LOG(ERROR) << "Omaha Response has invalid payload size: " << package.size; 841 completer->set_code(ErrorCode::kOmahaResponseInvalid); 842 return false; 843 } 844 LOG(INFO) << "Payload size = " << out_package.size << " bytes"; 845 846 if (i < metadata_sizes.size()) 847 base::StringToUint64(metadata_sizes[i], &out_package.metadata_size); 848 LOG(INFO) << "Payload metadata size = " << out_package.metadata_size 849 << " bytes"; 850 851 if (i < metadata_signatures.size()) 852 out_package.metadata_signature = metadata_signatures[i]; 853 LOG(INFO) << "Payload metadata signature = " 854 << out_package.metadata_signature; 855 856 out_package.hash = package.hash; 857 if (out_package.hash.empty()) { 858 LOG(ERROR) << "Omaha Response has empty hash_sha256 value"; 859 completer->set_code(ErrorCode::kOmahaResponseInvalid); 860 return false; 861 } 862 LOG(INFO) << "Payload hash = " << out_package.hash; 863 864 if (i < is_delta_payloads.size()) 865 out_package.is_delta = ParseBool(is_delta_payloads[i]); 866 LOG(INFO) << "Payload is delta = " << utils::ToString(out_package.is_delta); 867 868 output_object->packages.push_back(std::move(out_package)); 869 } 870 871 return true; 872 } 873 874 } // namespace 875 876 bool OmahaRequestAction::ParseResponse(OmahaParserData* parser_data, 877 OmahaResponse* output_object, 878 ScopedActionCompleter* completer) { 879 if (parser_data->apps.empty()) { 880 completer->set_code(ErrorCode::kOmahaResponseInvalid); 881 return false; 882 } 883 LOG(INFO) << "Found " << parser_data->apps.size() << " <app>."; 884 885 // chromium-os:37289: The PollInterval is not supported by Omaha server 886 // currently. But still keeping this existing code in case we ever decide to 887 // slow down the request rate from the server-side. Note that the PollInterval 888 // is not persisted, so it has to be sent by the server on every response to 889 // guarantee that the scheduler uses this value (otherwise, if the device got 890 // rebooted after the last server-indicated value, it'll revert to the default 891 // value). Also kDefaultMaxUpdateChecks value for the scattering logic is 892 // based on the assumption that we perform an update check every hour so that 893 // the max value of 8 will roughly be equivalent to one work day. If we decide 894 // to use PollInterval permanently, we should update the 895 // max_update_checks_allowed to take PollInterval into account. Note: The 896 // parsing for PollInterval happens even before parsing of the status because 897 // we may want to specify the PollInterval even when there's no update. 898 base::StringToInt(parser_data->updatecheck_poll_interval, 899 &output_object->poll_interval); 900 901 // Check for the "elapsed_days" attribute in the "daystart" 902 // element. This is the number of days since Jan 1 2007, 0:00 903 // PST. If we don't have a persisted value of the Omaha InstallDate, 904 // we'll use it to calculate it and then persist it. 905 if (ParseInstallDate(parser_data, output_object) && 906 !HasInstallDate(system_state_)) { 907 // Since output_object->install_date_days is never negative, the 908 // elapsed_days -> install-date calculation is reduced to simply 909 // rounding down to the nearest number divisible by 7. 910 int remainder = output_object->install_date_days % 7; 911 int install_date_days_rounded = 912 output_object->install_date_days - remainder; 913 if (PersistInstallDate(system_state_, 914 install_date_days_rounded, 915 kProvisionedFromOmahaResponse)) { 916 LOG(INFO) << "Set the Omaha InstallDate from Omaha Response to " 917 << install_date_days_rounded << " days"; 918 } 919 } 920 921 // We persist the cohorts sent by omaha even if the status is "noupdate". 922 if (parser_data->app_cohort_set) 923 PersistCohortData(kPrefsOmahaCohort, parser_data->app_cohort); 924 if (parser_data->app_cohorthint_set) 925 PersistCohortData(kPrefsOmahaCohortHint, parser_data->app_cohorthint); 926 if (parser_data->app_cohortname_set) 927 PersistCohortData(kPrefsOmahaCohortName, parser_data->app_cohortname); 928 929 // Parse the updatecheck attributes. 930 PersistEolStatus(parser_data->updatecheck_attrs); 931 932 if (!ParseStatus(parser_data, output_object, completer)) 933 return false; 934 935 if (!ParseParams(parser_data, output_object, completer)) 936 return false; 937 938 // Package has to be parsed after Params now because ParseParams need to make 939 // sure that postinstall action exists. 940 for (auto& app : parser_data->apps) 941 if (!ParsePackage(&app, output_object, completer)) 942 return false; 943 944 return true; 945 } 946 947 bool OmahaRequestAction::ParseStatus(OmahaParserData* parser_data, 948 OmahaResponse* output_object, 949 ScopedActionCompleter* completer) { 950 output_object->update_exists = false; 951 for (size_t i = 0; i < parser_data->apps.size(); i++) { 952 const string& status = parser_data->apps[i].updatecheck_status; 953 if (status == "noupdate") { 954 // Don't update if any app has status="noupdate". 955 LOG(INFO) << "No update for <app> " << i; 956 output_object->update_exists = false; 957 break; 958 } else if (status == "ok") { 959 if (parser_data->apps[i].action_postinstall_attrs["noupdate"] == "true") { 960 // noupdate="true" in postinstall attributes means it's an update to 961 // self, only update if there's at least one app really have update. 962 LOG(INFO) << "Update to self for <app> " << i; 963 } else { 964 LOG(INFO) << "Update for <app> " << i; 965 output_object->update_exists = true; 966 } 967 } else { 968 LOG(ERROR) << "Unknown Omaha response status: " << status; 969 completer->set_code(ErrorCode::kOmahaResponseInvalid); 970 return false; 971 } 972 } 973 if (!output_object->update_exists) { 974 SetOutputObject(*output_object); 975 completer->set_code(ErrorCode::kSuccess); 976 } 977 978 return output_object->update_exists; 979 } 980 981 bool OmahaRequestAction::ParseParams(OmahaParserData* parser_data, 982 OmahaResponse* output_object, 983 ScopedActionCompleter* completer) { 984 map<string, string> attrs; 985 for (auto& app : parser_data->apps) { 986 if (!app.manifest_version.empty() && output_object->version.empty()) 987 output_object->version = app.manifest_version; 988 if (!app.action_postinstall_attrs.empty() && attrs.empty()) 989 attrs = app.action_postinstall_attrs; 990 } 991 if (output_object->version.empty()) { 992 LOG(ERROR) << "Omaha Response does not have version in manifest!"; 993 completer->set_code(ErrorCode::kOmahaResponseInvalid); 994 return false; 995 } 996 997 LOG(INFO) << "Received omaha response to update to version " 998 << output_object->version; 999 1000 if (attrs.empty()) { 1001 LOG(ERROR) << "Omaha Response has no postinstall event action"; 1002 completer->set_code(ErrorCode::kOmahaResponseInvalid); 1003 return false; 1004 } 1005 1006 // Get the optional properties one by one. 1007 output_object->more_info_url = attrs[kTagMoreInfo]; 1008 output_object->prompt = ParseBool(attrs[kTagPrompt]); 1009 output_object->deadline = attrs[kTagDeadline]; 1010 output_object->max_days_to_scatter = ParseInt(attrs[kTagMaxDaysToScatter]); 1011 output_object->disable_p2p_for_downloading = 1012 ParseBool(attrs[kTagDisableP2PForDownloading]); 1013 output_object->disable_p2p_for_sharing = 1014 ParseBool(attrs[kTagDisableP2PForSharing]); 1015 output_object->public_key_rsa = attrs[kTagPublicKeyRsa]; 1016 1017 string max = attrs[kTagMaxFailureCountPerUrl]; 1018 if (!base::StringToUint(max, &output_object->max_failure_count_per_url)) 1019 output_object->max_failure_count_per_url = kDefaultMaxFailureCountPerUrl; 1020 1021 output_object->disable_payload_backoff = 1022 ParseBool(attrs[kTagDisablePayloadBackoff]); 1023 1024 return true; 1025 } 1026 1027 // If the transfer was successful, this uses expat to parse the response 1028 // and fill in the appropriate fields of the output object. Also, notifies 1029 // the processor that we're done. 1030 void OmahaRequestAction::TransferComplete(HttpFetcher *fetcher, 1031 bool successful) { 1032 ScopedActionCompleter completer(processor_, this); 1033 string current_response(response_buffer_.begin(), response_buffer_.end()); 1034 LOG(INFO) << "Omaha request response: " << current_response; 1035 1036 PayloadStateInterface* const payload_state = system_state_->payload_state(); 1037 1038 // Events are best effort transactions -- assume they always succeed. 1039 if (IsEvent()) { 1040 CHECK(!HasOutputPipe()) << "No output pipe allowed for event requests."; 1041 completer.set_code(ErrorCode::kSuccess); 1042 return; 1043 } 1044 1045 if (!successful) { 1046 LOG(ERROR) << "Omaha request network transfer failed."; 1047 int code = GetHTTPResponseCode(); 1048 // Makes sure we send sane error values. 1049 if (code < 0 || code >= 1000) { 1050 code = 999; 1051 } 1052 completer.set_code(static_cast<ErrorCode>( 1053 static_cast<int>(ErrorCode::kOmahaRequestHTTPResponseBase) + code)); 1054 return; 1055 } 1056 1057 XML_Parser parser = XML_ParserCreate(nullptr); 1058 OmahaParserData parser_data(parser); 1059 XML_SetUserData(parser, &parser_data); 1060 XML_SetElementHandler(parser, ParserHandlerStart, ParserHandlerEnd); 1061 XML_SetEntityDeclHandler(parser, ParserHandlerEntityDecl); 1062 XML_Status res = XML_Parse( 1063 parser, 1064 reinterpret_cast<const char*>(response_buffer_.data()), 1065 response_buffer_.size(), 1066 XML_TRUE); 1067 XML_ParserFree(parser); 1068 1069 if (res != XML_STATUS_OK || parser_data.failed) { 1070 LOG(ERROR) << "Omaha response not valid XML: " 1071 << XML_ErrorString(XML_GetErrorCode(parser)) 1072 << " at line " << XML_GetCurrentLineNumber(parser) 1073 << " col " << XML_GetCurrentColumnNumber(parser); 1074 ErrorCode error_code = ErrorCode::kOmahaRequestXMLParseError; 1075 if (response_buffer_.empty()) { 1076 error_code = ErrorCode::kOmahaRequestEmptyResponseError; 1077 } else if (parser_data.entity_decl) { 1078 error_code = ErrorCode::kOmahaRequestXMLHasEntityDecl; 1079 } 1080 completer.set_code(error_code); 1081 return; 1082 } 1083 1084 // Update the last ping day preferences based on the server daystart response 1085 // even if we didn't send a ping. Omaha always includes the daystart in the 1086 // response, but log the error if it didn't. 1087 LOG_IF(ERROR, !UpdateLastPingDays(&parser_data, system_state_->prefs())) 1088 << "Failed to update the last ping day preferences!"; 1089 1090 if (!HasOutputPipe()) { 1091 // Just set success to whether or not the http transfer succeeded, 1092 // which must be true at this point in the code. 1093 completer.set_code(ErrorCode::kSuccess); 1094 return; 1095 } 1096 1097 OmahaResponse output_object; 1098 if (!ParseResponse(&parser_data, &output_object, &completer)) 1099 return; 1100 output_object.update_exists = true; 1101 SetOutputObject(output_object); 1102 1103 if (ShouldIgnoreUpdate(output_object)) { 1104 output_object.update_exists = false; 1105 completer.set_code(ErrorCode::kOmahaUpdateIgnoredPerPolicy); 1106 return; 1107 } 1108 1109 // If Omaha says to disable p2p, respect that 1110 if (output_object.disable_p2p_for_downloading) { 1111 LOG(INFO) << "Forcibly disabling use of p2p for downloading as " 1112 << "requested by Omaha."; 1113 payload_state->SetUsingP2PForDownloading(false); 1114 } 1115 if (output_object.disable_p2p_for_sharing) { 1116 LOG(INFO) << "Forcibly disabling use of p2p for sharing as " 1117 << "requested by Omaha."; 1118 payload_state->SetUsingP2PForSharing(false); 1119 } 1120 1121 // Update the payload state with the current response. The payload state 1122 // will automatically reset all stale state if this response is different 1123 // from what's stored already. We are updating the payload state as late 1124 // as possible in this method so that if a new release gets pushed and then 1125 // got pulled back due to some issues, we don't want to clear our internal 1126 // state unnecessarily. 1127 payload_state->SetResponse(output_object); 1128 1129 // It could be we've already exceeded the deadline for when p2p is 1130 // allowed or that we've tried too many times with p2p. Check that. 1131 if (payload_state->GetUsingP2PForDownloading()) { 1132 payload_state->P2PNewAttempt(); 1133 if (!payload_state->P2PAttemptAllowed()) { 1134 LOG(INFO) << "Forcibly disabling use of p2p for downloading because " 1135 << "of previous failures when using p2p."; 1136 payload_state->SetUsingP2PForDownloading(false); 1137 } 1138 } 1139 1140 // From here on, we'll complete stuff in CompleteProcessing() so 1141 // disable |completer| since we'll create a new one in that 1142 // function. 1143 completer.set_should_complete(false); 1144 1145 // If we're allowed to use p2p for downloading we do not pay 1146 // attention to wall-clock-based waiting if the URL is indeed 1147 // available via p2p. Therefore, check if the file is available via 1148 // p2p before deferring... 1149 if (payload_state->GetUsingP2PForDownloading()) { 1150 LookupPayloadViaP2P(output_object); 1151 } else { 1152 CompleteProcessing(); 1153 } 1154 } 1155 1156 void OmahaRequestAction::CompleteProcessing() { 1157 ScopedActionCompleter completer(processor_, this); 1158 OmahaResponse& output_object = const_cast<OmahaResponse&>(GetOutputObject()); 1159 PayloadStateInterface* payload_state = system_state_->payload_state(); 1160 1161 if (system_state_->hardware()->IsOOBEEnabled() && 1162 !system_state_->hardware()->IsOOBEComplete(nullptr) && 1163 output_object.deadline.empty() && 1164 params_->app_version() != "ForcedUpdate") { 1165 output_object.update_exists = false; 1166 LOG(INFO) << "Ignoring non-critical Omaha updates until OOBE is done."; 1167 completer.set_code(ErrorCode::kNonCriticalUpdateInOOBE); 1168 return; 1169 } 1170 1171 if (ShouldDeferDownload(&output_object)) { 1172 output_object.update_exists = false; 1173 LOG(INFO) << "Ignoring Omaha updates as updates are deferred by policy."; 1174 completer.set_code(ErrorCode::kOmahaUpdateDeferredPerPolicy); 1175 return; 1176 } 1177 1178 if (payload_state->ShouldBackoffDownload()) { 1179 output_object.update_exists = false; 1180 LOG(INFO) << "Ignoring Omaha updates in order to backoff our retry " 1181 << "attempts"; 1182 completer.set_code(ErrorCode::kOmahaUpdateDeferredForBackoff); 1183 return; 1184 } 1185 completer.set_code(ErrorCode::kSuccess); 1186 } 1187 1188 void OmahaRequestAction::OnLookupPayloadViaP2PCompleted(const string& url) { 1189 LOG(INFO) << "Lookup complete, p2p-client returned URL '" << url << "'"; 1190 if (!url.empty()) { 1191 system_state_->payload_state()->SetP2PUrl(url); 1192 } else { 1193 LOG(INFO) << "Forcibly disabling use of p2p for downloading " 1194 << "because no suitable peer could be found."; 1195 system_state_->payload_state()->SetUsingP2PForDownloading(false); 1196 } 1197 CompleteProcessing(); 1198 } 1199 1200 void OmahaRequestAction::LookupPayloadViaP2P(const OmahaResponse& response) { 1201 // If the device is in the middle of an update, the state variables 1202 // kPrefsUpdateStateNextDataOffset, kPrefsUpdateStateNextDataLength 1203 // tracks the offset and length of the operation currently in 1204 // progress. The offset is based from the end of the manifest which 1205 // is kPrefsManifestMetadataSize bytes long. 1206 // 1207 // To make forward progress and avoid deadlocks, we need to find a 1208 // peer that has at least the entire operation we're currently 1209 // working on. Otherwise we may end up in a situation where two 1210 // devices bounce back and forth downloading from each other, 1211 // neither making any forward progress until one of them decides to 1212 // stop using p2p (via kMaxP2PAttempts and kMaxP2PAttemptTimeSeconds 1213 // safe-guards). See http://crbug.com/297170 for an example) 1214 size_t minimum_size = 0; 1215 int64_t manifest_metadata_size = 0; 1216 int64_t manifest_signature_size = 0; 1217 int64_t next_data_offset = 0; 1218 int64_t next_data_length = 0; 1219 if (system_state_ && 1220 system_state_->prefs()->GetInt64(kPrefsManifestMetadataSize, 1221 &manifest_metadata_size) && 1222 manifest_metadata_size != -1 && 1223 system_state_->prefs()->GetInt64(kPrefsManifestSignatureSize, 1224 &manifest_signature_size) && 1225 manifest_signature_size != -1 && 1226 system_state_->prefs()->GetInt64(kPrefsUpdateStateNextDataOffset, 1227 &next_data_offset) && 1228 next_data_offset != -1 && 1229 system_state_->prefs()->GetInt64(kPrefsUpdateStateNextDataLength, 1230 &next_data_length)) { 1231 minimum_size = manifest_metadata_size + manifest_signature_size + 1232 next_data_offset + next_data_length; 1233 } 1234 1235 // TODO(senj): Fix P2P for multiple package. 1236 brillo::Blob raw_hash; 1237 if (!base::HexStringToBytes(response.packages[0].hash, &raw_hash)) 1238 return; 1239 string file_id = 1240 utils::CalculateP2PFileId(raw_hash, response.packages[0].size); 1241 if (system_state_->p2p_manager()) { 1242 LOG(INFO) << "Checking if payload is available via p2p, file_id=" << file_id 1243 << " minimum_size=" << minimum_size; 1244 system_state_->p2p_manager()->LookupUrlForFile( 1245 file_id, 1246 minimum_size, 1247 TimeDelta::FromSeconds(kMaxP2PNetworkWaitTimeSeconds), 1248 base::Bind(&OmahaRequestAction::OnLookupPayloadViaP2PCompleted, 1249 base::Unretained(this))); 1250 } 1251 } 1252 1253 bool OmahaRequestAction::ShouldDeferDownload(OmahaResponse* output_object) { 1254 if (params_->interactive()) { 1255 LOG(INFO) << "Not deferring download because update is interactive."; 1256 return false; 1257 } 1258 1259 // If we're using p2p to download _and_ we have a p2p URL, we never 1260 // defer the download. This is because the download will always 1261 // happen from a peer on the LAN and we've been waiting in line for 1262 // our turn. 1263 const PayloadStateInterface* payload_state = system_state_->payload_state(); 1264 if (payload_state->GetUsingP2PForDownloading() && 1265 !payload_state->GetP2PUrl().empty()) { 1266 LOG(INFO) << "Download not deferred because download " 1267 << "will happen from a local peer (via p2p)."; 1268 return false; 1269 } 1270 1271 // We should defer the downloads only if we've first satisfied the 1272 // wall-clock-based-waiting period and then the update-check-based waiting 1273 // period, if required. 1274 if (!params_->wall_clock_based_wait_enabled()) { 1275 LOG(INFO) << "Wall-clock-based waiting period is not enabled," 1276 << " so no deferring needed."; 1277 return false; 1278 } 1279 1280 switch (IsWallClockBasedWaitingSatisfied(output_object)) { 1281 case kWallClockWaitNotSatisfied: 1282 // We haven't even satisfied the first condition, passing the 1283 // wall-clock-based waiting period, so we should defer the downloads 1284 // until that happens. 1285 LOG(INFO) << "wall-clock-based-wait not satisfied."; 1286 return true; 1287 1288 case kWallClockWaitDoneButUpdateCheckWaitRequired: 1289 LOG(INFO) << "wall-clock-based-wait satisfied and " 1290 << "update-check-based-wait required."; 1291 return !IsUpdateCheckCountBasedWaitingSatisfied(); 1292 1293 case kWallClockWaitDoneAndUpdateCheckWaitNotRequired: 1294 // Wall-clock-based waiting period is satisfied, and it's determined 1295 // that we do not need the update-check-based wait. so no need to 1296 // defer downloads. 1297 LOG(INFO) << "wall-clock-based-wait satisfied and " 1298 << "update-check-based-wait is not required."; 1299 return false; 1300 1301 default: 1302 // Returning false for this default case so we err on the 1303 // side of downloading updates than deferring in case of any bugs. 1304 NOTREACHED(); 1305 return false; 1306 } 1307 } 1308 1309 OmahaRequestAction::WallClockWaitResult 1310 OmahaRequestAction::IsWallClockBasedWaitingSatisfied( 1311 OmahaResponse* output_object) { 1312 Time update_first_seen_at; 1313 int64_t update_first_seen_at_int; 1314 1315 if (system_state_->prefs()->Exists(kPrefsUpdateFirstSeenAt)) { 1316 if (system_state_->prefs()->GetInt64(kPrefsUpdateFirstSeenAt, 1317 &update_first_seen_at_int)) { 1318 // Note: This timestamp could be that of ANY update we saw in the past 1319 // (not necessarily this particular update we're considering to apply) 1320 // but never got to apply because of some reason (e.g. stop AU policy, 1321 // updates being pulled out from Omaha, changes in target version prefix, 1322 // new update being rolled out, etc.). But for the purposes of scattering 1323 // it doesn't matter which update the timestamp corresponds to. i.e. 1324 // the clock starts ticking the first time we see an update and we're 1325 // ready to apply when the random wait period is satisfied relative to 1326 // that first seen timestamp. 1327 update_first_seen_at = Time::FromInternalValue(update_first_seen_at_int); 1328 LOG(INFO) << "Using persisted value of UpdateFirstSeenAt: " 1329 << utils::ToString(update_first_seen_at); 1330 } else { 1331 // This seems like an unexpected error where the persisted value exists 1332 // but it's not readable for some reason. Just skip scattering in this 1333 // case to be safe. 1334 LOG(INFO) << "Not scattering as UpdateFirstSeenAt value cannot be read"; 1335 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1336 } 1337 } else { 1338 update_first_seen_at = system_state_->clock()->GetWallclockTime(); 1339 update_first_seen_at_int = update_first_seen_at.ToInternalValue(); 1340 if (system_state_->prefs()->SetInt64(kPrefsUpdateFirstSeenAt, 1341 update_first_seen_at_int)) { 1342 LOG(INFO) << "Persisted the new value for UpdateFirstSeenAt: " 1343 << utils::ToString(update_first_seen_at); 1344 } else { 1345 // This seems like an unexpected error where the value cannot be 1346 // persisted for some reason. Just skip scattering in this 1347 // case to be safe. 1348 LOG(INFO) << "Not scattering as UpdateFirstSeenAt value " 1349 << utils::ToString(update_first_seen_at) 1350 << " cannot be persisted"; 1351 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1352 } 1353 } 1354 1355 TimeDelta elapsed_time = 1356 system_state_->clock()->GetWallclockTime() - update_first_seen_at; 1357 TimeDelta max_scatter_period = 1358 TimeDelta::FromDays(output_object->max_days_to_scatter); 1359 1360 LOG(INFO) << "Waiting Period = " 1361 << utils::FormatSecs(params_->waiting_period().InSeconds()) 1362 << ", Time Elapsed = " 1363 << utils::FormatSecs(elapsed_time.InSeconds()) 1364 << ", MaxDaysToScatter = " 1365 << max_scatter_period.InDays(); 1366 1367 if (!output_object->deadline.empty()) { 1368 // The deadline is set for all rules which serve a delta update from a 1369 // previous FSI, which means this update will be applied mostly in OOBE 1370 // cases. For these cases, we shouldn't scatter so as to finish the OOBE 1371 // quickly. 1372 LOG(INFO) << "Not scattering as deadline flag is set"; 1373 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1374 } 1375 1376 if (max_scatter_period.InDays() == 0) { 1377 // This means the Omaha rule creator decides that this rule 1378 // should not be scattered irrespective of the policy. 1379 LOG(INFO) << "Not scattering as MaxDaysToScatter in rule is 0."; 1380 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1381 } 1382 1383 if (elapsed_time > max_scatter_period) { 1384 // This means we've waited more than the upperbound wait in the rule 1385 // from the time we first saw a valid update available to us. 1386 // This will prevent update starvation. 1387 LOG(INFO) << "Not scattering as we're past the MaxDaysToScatter limit."; 1388 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1389 } 1390 1391 // This means we are required to participate in scattering. 1392 // See if our turn has arrived now. 1393 TimeDelta remaining_wait_time = params_->waiting_period() - elapsed_time; 1394 if (remaining_wait_time.InSeconds() <= 0) { 1395 // Yes, it's our turn now. 1396 LOG(INFO) << "Successfully passed the wall-clock-based-wait."; 1397 1398 // But we can't download until the update-check-count-based wait is also 1399 // satisfied, so mark it as required now if update checks are enabled. 1400 return params_->update_check_count_wait_enabled() ? 1401 kWallClockWaitDoneButUpdateCheckWaitRequired : 1402 kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1403 } 1404 1405 // Not our turn yet, so we have to wait until our turn to 1406 // help scatter the downloads across all clients of the enterprise. 1407 LOG(INFO) << "Update deferred for another " 1408 << utils::FormatSecs(remaining_wait_time.InSeconds()) 1409 << " per policy."; 1410 return kWallClockWaitNotSatisfied; 1411 } 1412 1413 bool OmahaRequestAction::IsUpdateCheckCountBasedWaitingSatisfied() { 1414 int64_t update_check_count_value; 1415 1416 if (system_state_->prefs()->Exists(kPrefsUpdateCheckCount)) { 1417 if (!system_state_->prefs()->GetInt64(kPrefsUpdateCheckCount, 1418 &update_check_count_value)) { 1419 // We are unable to read the update check count from file for some reason. 1420 // So let's proceed anyway so as to not stall the update. 1421 LOG(ERROR) << "Unable to read update check count. " 1422 << "Skipping update-check-count-based-wait."; 1423 return true; 1424 } 1425 } else { 1426 // This file does not exist. This means we haven't started our update 1427 // check count down yet, so this is the right time to start the count down. 1428 update_check_count_value = base::RandInt( 1429 params_->min_update_checks_needed(), 1430 params_->max_update_checks_allowed()); 1431 1432 LOG(INFO) << "Randomly picked update check count value = " 1433 << update_check_count_value; 1434 1435 // Write out the initial value of update_check_count_value. 1436 if (!system_state_->prefs()->SetInt64(kPrefsUpdateCheckCount, 1437 update_check_count_value)) { 1438 // We weren't able to write the update check count file for some reason. 1439 // So let's proceed anyway so as to not stall the update. 1440 LOG(ERROR) << "Unable to write update check count. " 1441 << "Skipping update-check-count-based-wait."; 1442 return true; 1443 } 1444 } 1445 1446 if (update_check_count_value == 0) { 1447 LOG(INFO) << "Successfully passed the update-check-based-wait."; 1448 return true; 1449 } 1450 1451 if (update_check_count_value < 0 || 1452 update_check_count_value > params_->max_update_checks_allowed()) { 1453 // We err on the side of skipping scattering logic instead of stalling 1454 // a machine from receiving any updates in case of any unexpected state. 1455 LOG(ERROR) << "Invalid value for update check count detected. " 1456 << "Skipping update-check-count-based-wait."; 1457 return true; 1458 } 1459 1460 // Legal value, we need to wait for more update checks to happen 1461 // until this becomes 0. 1462 LOG(INFO) << "Deferring Omaha updates for another " 1463 << update_check_count_value 1464 << " update checks per policy"; 1465 return false; 1466 } 1467 1468 // static 1469 bool OmahaRequestAction::ParseInstallDate(OmahaParserData* parser_data, 1470 OmahaResponse* output_object) { 1471 int64_t elapsed_days = 0; 1472 if (!base::StringToInt64(parser_data->daystart_elapsed_days, 1473 &elapsed_days)) 1474 return false; 1475 1476 if (elapsed_days < 0) 1477 return false; 1478 1479 output_object->install_date_days = elapsed_days; 1480 return true; 1481 } 1482 1483 // static 1484 bool OmahaRequestAction::HasInstallDate(SystemState *system_state) { 1485 PrefsInterface* prefs = system_state->prefs(); 1486 if (prefs == nullptr) 1487 return false; 1488 1489 return prefs->Exists(kPrefsInstallDateDays); 1490 } 1491 1492 // static 1493 bool OmahaRequestAction::PersistInstallDate( 1494 SystemState *system_state, 1495 int install_date_days, 1496 InstallDateProvisioningSource source) { 1497 TEST_AND_RETURN_FALSE(install_date_days >= 0); 1498 1499 PrefsInterface* prefs = system_state->prefs(); 1500 if (prefs == nullptr) 1501 return false; 1502 1503 if (!prefs->SetInt64(kPrefsInstallDateDays, install_date_days)) 1504 return false; 1505 1506 string metric_name = metrics::kMetricInstallDateProvisioningSource; 1507 system_state->metrics_lib()->SendEnumToUMA( 1508 metric_name, 1509 static_cast<int>(source), // Sample. 1510 kProvisionedMax); // Maximum. 1511 1512 return true; 1513 } 1514 1515 bool OmahaRequestAction::PersistCohortData( 1516 const string& prefs_key, 1517 const string& new_value) { 1518 if (new_value.empty() && system_state_->prefs()->Exists(prefs_key)) { 1519 LOG(INFO) << "Removing stored " << prefs_key << " value."; 1520 return system_state_->prefs()->Delete(prefs_key); 1521 } else if (!new_value.empty()) { 1522 LOG(INFO) << "Storing new setting " << prefs_key << " as " << new_value; 1523 return system_state_->prefs()->SetString(prefs_key, new_value); 1524 } 1525 return true; 1526 } 1527 1528 bool OmahaRequestAction::PersistEolStatus(const map<string, string>& attrs) { 1529 auto eol_attr = attrs.find(kEolAttr); 1530 if (eol_attr != attrs.end()) { 1531 return system_state_->prefs()->SetString(kPrefsOmahaEolStatus, 1532 eol_attr->second); 1533 } else if (system_state_->prefs()->Exists(kPrefsOmahaEolStatus)) { 1534 return system_state_->prefs()->Delete(kPrefsOmahaEolStatus); 1535 } 1536 return true; 1537 } 1538 1539 void OmahaRequestAction::ActionCompleted(ErrorCode code) { 1540 // We only want to report this on "update check". 1541 if (ping_only_ || event_ != nullptr) 1542 return; 1543 1544 metrics::CheckResult result = metrics::CheckResult::kUnset; 1545 metrics::CheckReaction reaction = metrics::CheckReaction::kUnset; 1546 metrics::DownloadErrorCode download_error_code = 1547 metrics::DownloadErrorCode::kUnset; 1548 1549 // Regular update attempt. 1550 switch (code) { 1551 case ErrorCode::kSuccess: 1552 // OK, we parsed the response successfully but that does 1553 // necessarily mean that an update is available. 1554 if (HasOutputPipe()) { 1555 const OmahaResponse& response = GetOutputObject(); 1556 if (response.update_exists) { 1557 result = metrics::CheckResult::kUpdateAvailable; 1558 reaction = metrics::CheckReaction::kUpdating; 1559 } else { 1560 result = metrics::CheckResult::kNoUpdateAvailable; 1561 } 1562 } else { 1563 result = metrics::CheckResult::kNoUpdateAvailable; 1564 } 1565 break; 1566 1567 case ErrorCode::kOmahaUpdateIgnoredPerPolicy: 1568 result = metrics::CheckResult::kUpdateAvailable; 1569 reaction = metrics::CheckReaction::kIgnored; 1570 break; 1571 1572 case ErrorCode::kOmahaUpdateDeferredPerPolicy: 1573 result = metrics::CheckResult::kUpdateAvailable; 1574 reaction = metrics::CheckReaction::kDeferring; 1575 break; 1576 1577 case ErrorCode::kOmahaUpdateDeferredForBackoff: 1578 result = metrics::CheckResult::kUpdateAvailable; 1579 reaction = metrics::CheckReaction::kBackingOff; 1580 break; 1581 1582 default: 1583 // We report two flavors of errors, "Download errors" and "Parsing 1584 // error". Try to convert to the former and if that doesn't work 1585 // we know it's the latter. 1586 metrics::DownloadErrorCode tmp_error = 1587 metrics_utils::GetDownloadErrorCode(code); 1588 if (tmp_error != metrics::DownloadErrorCode::kInputMalformed) { 1589 result = metrics::CheckResult::kDownloadError; 1590 download_error_code = tmp_error; 1591 } else { 1592 result = metrics::CheckResult::kParsingError; 1593 } 1594 break; 1595 } 1596 1597 metrics::ReportUpdateCheckMetrics(system_state_, 1598 result, reaction, download_error_code); 1599 } 1600 1601 bool OmahaRequestAction::ShouldIgnoreUpdate( 1602 const OmahaResponse& response) const { 1603 // Note: policy decision to not update to a version we rolled back from. 1604 string rollback_version = 1605 system_state_->payload_state()->GetRollbackVersion(); 1606 if (!rollback_version.empty()) { 1607 LOG(INFO) << "Detected previous rollback from version " << rollback_version; 1608 if (rollback_version == response.version) { 1609 LOG(INFO) << "Received version that we rolled back from. Ignoring."; 1610 return true; 1611 } 1612 } 1613 1614 if (!IsUpdateAllowedOverCurrentConnection()) { 1615 LOG(INFO) << "Update is not allowed over current connection."; 1616 return true; 1617 } 1618 1619 // Note: We could technically delete the UpdateFirstSeenAt state when we 1620 // return true. If we do, it'll mean a device has to restart the 1621 // UpdateFirstSeenAt and thus help scattering take effect when the AU is 1622 // turned on again. On the other hand, it also increases the chance of update 1623 // starvation if an admin turns AU on/off more frequently. We choose to err on 1624 // the side of preventing starvation at the cost of not applying scattering in 1625 // those cases. 1626 return false; 1627 } 1628 1629 bool OmahaRequestAction::IsUpdateAllowedOverCurrentConnection() const { 1630 ConnectionType type; 1631 ConnectionTethering tethering; 1632 ConnectionManagerInterface* connection_manager = 1633 system_state_->connection_manager(); 1634 if (!connection_manager->GetConnectionProperties(&type, &tethering)) { 1635 LOG(INFO) << "We could not determine our connection type. " 1636 << "Defaulting to allow updates."; 1637 return true; 1638 } 1639 bool is_allowed = connection_manager->IsUpdateAllowedOver(type, tethering); 1640 LOG(INFO) << "We are connected via " 1641 << connection_utils::StringForConnectionType(type) 1642 << ", Updates allowed: " << (is_allowed ? "Yes" : "No"); 1643 return is_allowed; 1644 } 1645 1646 } // namespace chromeos_update_engine 1647