1 // 2 // Copyright (C) 2012 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 // 16 17 #include "update_engine/omaha_request_action.h" 18 19 #include <inttypes.h> 20 21 #include <limits> 22 #include <map> 23 #include <sstream> 24 #include <string> 25 #include <utility> 26 #include <vector> 27 28 #include <base/bind.h> 29 #include <base/logging.h> 30 #include <base/rand_util.h> 31 #include <base/strings/string_number_conversions.h> 32 #include <base/strings/string_split.h> 33 #include <base/strings/string_util.h> 34 #include <base/strings/stringprintf.h> 35 #include <base/time/time.h> 36 #include <brillo/key_value_store.h> 37 #include <expat.h> 38 #include <metrics/metrics_library.h> 39 #include <policy/libpolicy.h> 40 41 #include "update_engine/common/action_pipe.h" 42 #include "update_engine/common/constants.h" 43 #include "update_engine/common/hardware_interface.h" 44 #include "update_engine/common/hash_calculator.h" 45 #include "update_engine/common/platform_constants.h" 46 #include "update_engine/common/prefs_interface.h" 47 #include "update_engine/common/utils.h" 48 #include "update_engine/connection_manager_interface.h" 49 #include "update_engine/metrics_reporter_interface.h" 50 #include "update_engine/metrics_utils.h" 51 #include "update_engine/omaha_request_params.h" 52 #include "update_engine/p2p_manager.h" 53 #include "update_engine/payload_state_interface.h" 54 55 using base::Time; 56 using base::TimeDelta; 57 using chromeos_update_manager::kRollforwardInfinity; 58 using std::map; 59 using std::numeric_limits; 60 using std::string; 61 using std::vector; 62 63 namespace chromeos_update_engine { 64 65 // List of custom attributes that we interpret in the Omaha response: 66 constexpr char kAttrDeadline[] = "deadline"; 67 constexpr char kAttrDisableP2PForDownloading[] = "DisableP2PForDownloading"; 68 constexpr char kAttrDisableP2PForSharing[] = "DisableP2PForSharing"; 69 constexpr char kAttrDisablePayloadBackoff[] = "DisablePayloadBackoff"; 70 constexpr char kAttrVersion[] = "version"; 71 // Deprecated: "IsDelta" 72 constexpr char kAttrIsDeltaPayload[] = "IsDeltaPayload"; 73 constexpr char kAttrMaxFailureCountPerUrl[] = "MaxFailureCountPerUrl"; 74 constexpr char kAttrMaxDaysToScatter[] = "MaxDaysToScatter"; 75 // Deprecated: "ManifestSignatureRsa" 76 // Deprecated: "ManifestSize" 77 constexpr char kAttrMetadataSignatureRsa[] = "MetadataSignatureRsa"; 78 constexpr char kAttrMetadataSize[] = "MetadataSize"; 79 constexpr char kAttrMoreInfo[] = "MoreInfo"; 80 constexpr char kAttrNoUpdate[] = "noupdate"; 81 // Deprecated: "NeedsAdmin" 82 constexpr char kAttrPollInterval[] = "PollInterval"; 83 constexpr char kAttrPowerwash[] = "Powerwash"; 84 constexpr char kAttrPrompt[] = "Prompt"; 85 constexpr char kAttrPublicKeyRsa[] = "PublicKeyRsa"; 86 87 // List of attributes that we interpret in the Omaha response: 88 constexpr char kAttrAppId[] = "appid"; 89 constexpr char kAttrCodeBase[] = "codebase"; 90 constexpr char kAttrCohort[] = "cohort"; 91 constexpr char kAttrCohortHint[] = "cohorthint"; 92 constexpr char kAttrCohortName[] = "cohortname"; 93 constexpr char kAttrElapsedDays[] = "elapsed_days"; 94 constexpr char kAttrElapsedSeconds[] = "elapsed_seconds"; 95 constexpr char kAttrEvent[] = "event"; 96 constexpr char kAttrHashSha256[] = "hash_sha256"; 97 // Deprecated: "hash"; Although we still need to pass it from the server for 98 // backward compatibility. 99 constexpr char kAttrName[] = "name"; 100 // Deprecated: "sha256"; Although we still need to pass it from the server for 101 // backward compatibility. 102 constexpr char kAttrSize[] = "size"; 103 constexpr char kAttrStatus[] = "status"; 104 105 // List of values that we interpret in the Omaha response: 106 constexpr char kValPostInstall[] = "postinstall"; 107 constexpr char kValNoUpdate[] = "noupdate"; 108 109 constexpr char kOmahaUpdaterVersion[] = "0.1.0.0"; 110 111 // X-Goog-Update headers. 112 constexpr char kXGoogleUpdateInteractivity[] = "X-Goog-Update-Interactivity"; 113 constexpr char kXGoogleUpdateAppId[] = "X-Goog-Update-AppId"; 114 constexpr char kXGoogleUpdateUpdater[] = "X-Goog-Update-Updater"; 115 116 // updatecheck attributes (without the underscore prefix). 117 constexpr char kAttrEol[] = "eol"; 118 constexpr char kAttrRollback[] = "rollback"; 119 constexpr char kAttrFirmwareVersion[] = "firmware_version"; 120 constexpr char kAttrKernelVersion[] = "kernel_version"; 121 122 namespace { 123 124 // Returns an XML ping element attribute assignment with attribute 125 // |name| and value |ping_days| if |ping_days| has a value that needs 126 // to be sent, or an empty string otherwise. 127 string GetPingAttribute(const string& name, int ping_days) { 128 if (ping_days > 0 || ping_days == OmahaRequestAction::kNeverPinged) 129 return base::StringPrintf(" %s=\"%d\"", name.c_str(), ping_days); 130 return ""; 131 } 132 133 // Returns an XML ping element if any of the elapsed days need to be 134 // sent, or an empty string otherwise. 135 string GetPingXml(int ping_active_days, int ping_roll_call_days) { 136 string ping_active = GetPingAttribute("a", ping_active_days); 137 string ping_roll_call = GetPingAttribute("r", ping_roll_call_days); 138 if (!ping_active.empty() || !ping_roll_call.empty()) { 139 return base::StringPrintf(" <ping active=\"1\"%s%s></ping>\n", 140 ping_active.c_str(), 141 ping_roll_call.c_str()); 142 } 143 return ""; 144 } 145 146 // Returns an XML that goes into the body of the <app> element of the Omaha 147 // request based on the given parameters. 148 string GetAppBody(const OmahaEvent* event, 149 OmahaRequestParams* params, 150 bool ping_only, 151 bool include_ping, 152 bool skip_updatecheck, 153 int ping_active_days, 154 int ping_roll_call_days, 155 PrefsInterface* prefs) { 156 string app_body; 157 if (event == nullptr) { 158 if (include_ping) 159 app_body = GetPingXml(ping_active_days, ping_roll_call_days); 160 if (!ping_only) { 161 if (!skip_updatecheck) { 162 app_body += " <updatecheck"; 163 if (!params->target_version_prefix().empty()) { 164 app_body += base::StringPrintf( 165 " targetversionprefix=\"%s\"", 166 XmlEncodeWithDefault(params->target_version_prefix(), "") 167 .c_str()); 168 // Rollback requires target_version_prefix set. 169 if (params->rollback_allowed()) { 170 app_body += " rollback_allowed=\"true\""; 171 } 172 } 173 app_body += "></updatecheck>\n"; 174 } 175 176 // If this is the first update check after a reboot following a previous 177 // update, generate an event containing the previous version number. If 178 // the previous version preference file doesn't exist the event is still 179 // generated with a previous version of 0.0.0.0 -- this is relevant for 180 // older clients or new installs. The previous version event is not sent 181 // for ping-only requests because they come before the client has 182 // rebooted. The previous version event is also not sent if it was already 183 // sent for this new version with a previous updatecheck. 184 string prev_version; 185 if (!prefs->GetString(kPrefsPreviousVersion, &prev_version)) { 186 prev_version = "0.0.0.0"; 187 } 188 // We only store a non-empty previous version value after a successful 189 // update in the previous boot. After reporting it back to the server, 190 // we clear the previous version value so it doesn't get reported again. 191 if (!prev_version.empty()) { 192 app_body += base::StringPrintf( 193 " <event eventtype=\"%d\" eventresult=\"%d\" " 194 "previousversion=\"%s\"></event>\n", 195 OmahaEvent::kTypeRebootedAfterUpdate, 196 OmahaEvent::kResultSuccess, 197 XmlEncodeWithDefault(prev_version, "0.0.0.0").c_str()); 198 LOG_IF(WARNING, !prefs->SetString(kPrefsPreviousVersion, "")) 199 << "Unable to reset the previous version."; 200 } 201 } 202 } else { 203 // The error code is an optional attribute so append it only if the result 204 // is not success. 205 string error_code; 206 if (event->result != OmahaEvent::kResultSuccess) { 207 error_code = base::StringPrintf(" errorcode=\"%d\"", 208 static_cast<int>(event->error_code)); 209 } 210 app_body = base::StringPrintf( 211 " <event eventtype=\"%d\" eventresult=\"%d\"%s></event>\n", 212 event->type, 213 event->result, 214 error_code.c_str()); 215 } 216 217 return app_body; 218 } 219 220 // Returns the cohort* argument to include in the <app> tag for the passed 221 // |arg_name| and |prefs_key|, if any. The return value is suitable to 222 // concatenate to the list of arguments and includes a space at the end. 223 string GetCohortArgXml(PrefsInterface* prefs, 224 const string arg_name, 225 const string prefs_key) { 226 // There's nothing wrong with not having a given cohort setting, so we check 227 // existence first to avoid the warning log message. 228 if (!prefs->Exists(prefs_key)) 229 return ""; 230 string cohort_value; 231 if (!prefs->GetString(prefs_key, &cohort_value) || cohort_value.empty()) 232 return ""; 233 // This is a sanity check to avoid sending a huge XML file back to Ohama due 234 // to a compromised stateful partition making the update check fail in low 235 // network environments envent after a reboot. 236 if (cohort_value.size() > 1024) { 237 LOG(WARNING) << "The omaha cohort setting " << arg_name 238 << " has a too big value, which must be an error or an " 239 "attacker trying to inhibit updates."; 240 return ""; 241 } 242 243 string escaped_xml_value; 244 if (!XmlEncode(cohort_value, &escaped_xml_value)) { 245 LOG(WARNING) << "The omaha cohort setting " << arg_name 246 << " is ASCII-7 invalid, ignoring it."; 247 return ""; 248 } 249 250 return base::StringPrintf( 251 "%s=\"%s\" ", arg_name.c_str(), escaped_xml_value.c_str()); 252 } 253 254 struct OmahaAppData { 255 string id; 256 string version; 257 string product_components; 258 }; 259 260 bool IsValidComponentID(const string& id) { 261 for (char c : id) { 262 if (!isalnum(c) && c != '-' && c != '_' && c != '.') 263 return false; 264 } 265 return true; 266 } 267 268 // Returns an XML that corresponds to the entire <app> node of the Omaha 269 // request based on the given parameters. 270 string GetAppXml(const OmahaEvent* event, 271 OmahaRequestParams* params, 272 const OmahaAppData& app_data, 273 bool ping_only, 274 bool include_ping, 275 bool skip_updatecheck, 276 int ping_active_days, 277 int ping_roll_call_days, 278 int install_date_in_days, 279 SystemState* system_state) { 280 string app_body = GetAppBody(event, 281 params, 282 ping_only, 283 include_ping, 284 skip_updatecheck, 285 ping_active_days, 286 ping_roll_call_days, 287 system_state->prefs()); 288 string app_versions; 289 290 // If we are downgrading to a more stable channel and we are allowed to do 291 // powerwash, then pass 0.0.0.0 as the version. This is needed to get the 292 // highest-versioned payload on the destination channel. 293 if (params->ShouldPowerwash()) { 294 LOG(INFO) << "Passing OS version as 0.0.0.0 as we are set to powerwash " 295 << "on downgrading to the version in the more stable channel"; 296 app_versions = "version=\"0.0.0.0\" from_version=\"" + 297 XmlEncodeWithDefault(app_data.version, "0.0.0.0") + "\" "; 298 } else { 299 app_versions = "version=\"" + 300 XmlEncodeWithDefault(app_data.version, "0.0.0.0") + "\" "; 301 } 302 303 string download_channel = params->download_channel(); 304 string app_channels = 305 "track=\"" + XmlEncodeWithDefault(download_channel, "") + "\" "; 306 if (params->current_channel() != download_channel) { 307 app_channels += "from_track=\"" + 308 XmlEncodeWithDefault(params->current_channel(), "") + "\" "; 309 } 310 311 string delta_okay_str = params->delta_okay() ? "true" : "false"; 312 313 // If install_date_days is not set (e.g. its value is -1 ), don't 314 // include the attribute. 315 string install_date_in_days_str = ""; 316 if (install_date_in_days >= 0) { 317 install_date_in_days_str = 318 base::StringPrintf("installdate=\"%d\" ", install_date_in_days); 319 } 320 321 string app_cohort_args; 322 app_cohort_args += 323 GetCohortArgXml(system_state->prefs(), "cohort", kPrefsOmahaCohort); 324 app_cohort_args += GetCohortArgXml( 325 system_state->prefs(), "cohorthint", kPrefsOmahaCohortHint); 326 app_cohort_args += GetCohortArgXml( 327 system_state->prefs(), "cohortname", kPrefsOmahaCohortName); 328 329 string fingerprint_arg; 330 if (!params->os_build_fingerprint().empty()) { 331 fingerprint_arg = "fingerprint=\"" + 332 XmlEncodeWithDefault(params->os_build_fingerprint(), "") + 333 "\" "; 334 } 335 336 string buildtype_arg; 337 if (!params->os_build_type().empty()) { 338 buildtype_arg = "os_build_type=\"" + 339 XmlEncodeWithDefault(params->os_build_type(), "") + "\" "; 340 } 341 342 string product_components_args; 343 if (!params->ShouldPowerwash() && !app_data.product_components.empty()) { 344 brillo::KeyValueStore store; 345 if (store.LoadFromString(app_data.product_components)) { 346 for (const string& key : store.GetKeys()) { 347 if (!IsValidComponentID(key)) { 348 LOG(ERROR) << "Invalid component id: " << key; 349 continue; 350 } 351 string version; 352 if (!store.GetString(key, &version)) { 353 LOG(ERROR) << "Failed to get version for " << key 354 << " in product_components."; 355 continue; 356 } 357 product_components_args += 358 base::StringPrintf("_%s.version=\"%s\" ", 359 key.c_str(), 360 XmlEncodeWithDefault(version, "").c_str()); 361 } 362 } else { 363 LOG(ERROR) << "Failed to parse product_components:\n" 364 << app_data.product_components; 365 } 366 } 367 368 // clang-format off 369 string app_xml = " <app " 370 "appid=\"" + XmlEncodeWithDefault(app_data.id, "") + "\" " + 371 app_cohort_args + 372 app_versions + 373 app_channels + 374 product_components_args + 375 fingerprint_arg + 376 buildtype_arg + 377 "lang=\"" + XmlEncodeWithDefault(params->app_lang(), "en-US") + "\" " + 378 "board=\"" + XmlEncodeWithDefault(params->os_board(), "") + "\" " + 379 "hardware_class=\"" + XmlEncodeWithDefault(params->hwid(), "") + "\" " + 380 "delta_okay=\"" + delta_okay_str + "\" " 381 "fw_version=\"" + XmlEncodeWithDefault(params->fw_version(), "") + "\" " + 382 "ec_version=\"" + XmlEncodeWithDefault(params->ec_version(), "") + "\" " + 383 install_date_in_days_str + 384 ">\n" + 385 app_body + 386 " </app>\n"; 387 // clang-format on 388 return app_xml; 389 } 390 391 // Returns an XML that corresponds to the entire <os> node of the Omaha 392 // request based on the given parameters. 393 string GetOsXml(OmahaRequestParams* params) { 394 string os_xml = 395 " <os " 396 "version=\"" + 397 XmlEncodeWithDefault(params->os_version(), "") + "\" " + "platform=\"" + 398 XmlEncodeWithDefault(params->os_platform(), "") + "\" " + "sp=\"" + 399 XmlEncodeWithDefault(params->os_sp(), "") + 400 "\">" 401 "</os>\n"; 402 return os_xml; 403 } 404 405 // Returns an XML that corresponds to the entire Omaha request based on the 406 // given parameters. 407 string GetRequestXml(const OmahaEvent* event, 408 OmahaRequestParams* params, 409 bool ping_only, 410 bool include_ping, 411 int ping_active_days, 412 int ping_roll_call_days, 413 int install_date_in_days, 414 SystemState* system_state) { 415 string os_xml = GetOsXml(params); 416 OmahaAppData product_app = { 417 .id = params->GetAppId(), 418 .version = params->app_version(), 419 .product_components = params->product_components()}; 420 // Skips updatecheck for platform app in case of an install operation. 421 string app_xml = GetAppXml(event, 422 params, 423 product_app, 424 ping_only, 425 include_ping, 426 params->is_install(), /* skip_updatecheck */ 427 ping_active_days, 428 ping_roll_call_days, 429 install_date_in_days, 430 system_state); 431 if (!params->system_app_id().empty()) { 432 OmahaAppData system_app = {.id = params->system_app_id(), 433 .version = params->system_version()}; 434 app_xml += GetAppXml(event, 435 params, 436 system_app, 437 ping_only, 438 include_ping, 439 false, /* skip_updatecheck */ 440 ping_active_days, 441 ping_roll_call_days, 442 install_date_in_days, 443 system_state); 444 } 445 // Create APP ID according to |dlc_module_id| (sticking the current AppID to 446 // the DLC module ID with an underscode). 447 for (const auto& dlc_module_id : params->dlc_module_ids()) { 448 OmahaAppData dlc_module_app = { 449 .id = params->GetAppId() + "_" + dlc_module_id, 450 .version = params->app_version()}; 451 app_xml += GetAppXml(event, 452 params, 453 dlc_module_app, 454 ping_only, 455 include_ping, 456 false, /* skip_updatecheck */ 457 ping_active_days, 458 ping_roll_call_days, 459 install_date_in_days, 460 system_state); 461 } 462 463 string install_source = base::StringPrintf( 464 "installsource=\"%s\" ", 465 (params->interactive() ? "ondemandupdate" : "scheduler")); 466 467 string updater_version = XmlEncodeWithDefault( 468 base::StringPrintf( 469 "%s-%s", constants::kOmahaUpdaterID, kOmahaUpdaterVersion), 470 ""); 471 string request_xml = 472 "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" 473 "<request protocol=\"3.0\" " + 474 ("version=\"" + updater_version + 475 "\" " 476 "updaterversion=\"" + 477 updater_version + "\" " + install_source + "ismachine=\"1\">\n") + 478 os_xml + app_xml + "</request>\n"; 479 480 return request_xml; 481 } 482 483 } // namespace 484 485 // Struct used for holding data obtained when parsing the XML. 486 struct OmahaParserData { 487 explicit OmahaParserData(XML_Parser _xml_parser) : xml_parser(_xml_parser) {} 488 489 // Pointer to the expat XML_Parser object. 490 XML_Parser xml_parser; 491 492 // This is the state of the parser as it's processing the XML. 493 bool failed = false; 494 bool entity_decl = false; 495 string current_path; 496 497 // These are the values extracted from the XML. 498 string updatecheck_poll_interval; 499 map<string, string> updatecheck_attrs; 500 string daystart_elapsed_days; 501 string daystart_elapsed_seconds; 502 503 struct App { 504 string id; 505 vector<string> url_codebase; 506 string manifest_version; 507 map<string, string> action_postinstall_attrs; 508 string updatecheck_status; 509 string cohort; 510 string cohorthint; 511 string cohortname; 512 bool cohort_set = false; 513 bool cohorthint_set = false; 514 bool cohortname_set = false; 515 516 struct Package { 517 string name; 518 string size; 519 string hash; 520 }; 521 vector<Package> packages; 522 }; 523 vector<App> apps; 524 }; 525 526 namespace { 527 528 // Callback function invoked by expat. 529 void ParserHandlerStart(void* user_data, 530 const XML_Char* element, 531 const XML_Char** attr) { 532 OmahaParserData* data = reinterpret_cast<OmahaParserData*>(user_data); 533 534 if (data->failed) 535 return; 536 537 data->current_path += string("/") + element; 538 539 map<string, string> attrs; 540 if (attr != nullptr) { 541 for (int n = 0; attr[n] != nullptr && attr[n + 1] != nullptr; n += 2) { 542 string key = attr[n]; 543 string value = attr[n + 1]; 544 attrs[key] = value; 545 } 546 } 547 548 if (data->current_path == "/response/app") { 549 OmahaParserData::App app; 550 if (attrs.find(kAttrAppId) != attrs.end()) { 551 app.id = attrs[kAttrAppId]; 552 } 553 if (attrs.find(kAttrCohort) != attrs.end()) { 554 app.cohort_set = true; 555 app.cohort = attrs[kAttrCohort]; 556 } 557 if (attrs.find(kAttrCohortHint) != attrs.end()) { 558 app.cohorthint_set = true; 559 app.cohorthint = attrs[kAttrCohortHint]; 560 } 561 if (attrs.find(kAttrCohortName) != attrs.end()) { 562 app.cohortname_set = true; 563 app.cohortname = attrs[kAttrCohortName]; 564 } 565 data->apps.push_back(std::move(app)); 566 } else if (data->current_path == "/response/app/updatecheck") { 567 if (!data->apps.empty()) 568 data->apps.back().updatecheck_status = attrs[kAttrStatus]; 569 if (data->updatecheck_poll_interval.empty()) 570 data->updatecheck_poll_interval = attrs[kAttrPollInterval]; 571 // Omaha sends arbitrary key-value pairs as extra attributes starting with 572 // an underscore. 573 for (const auto& attr : attrs) { 574 if (!attr.first.empty() && attr.first[0] == '_') 575 data->updatecheck_attrs[attr.first.substr(1)] = attr.second; 576 } 577 } else if (data->current_path == "/response/daystart") { 578 // Get the install-date. 579 data->daystart_elapsed_days = attrs[kAttrElapsedDays]; 580 data->daystart_elapsed_seconds = attrs[kAttrElapsedSeconds]; 581 } else if (data->current_path == "/response/app/updatecheck/urls/url") { 582 // Look at all <url> elements. 583 if (!data->apps.empty()) 584 data->apps.back().url_codebase.push_back(attrs[kAttrCodeBase]); 585 } else if (data->current_path == 586 "/response/app/updatecheck/manifest/packages/package") { 587 // Look at all <package> elements. 588 if (!data->apps.empty()) 589 data->apps.back().packages.push_back({.name = attrs[kAttrName], 590 .size = attrs[kAttrSize], 591 .hash = attrs[kAttrHashSha256]}); 592 } else if (data->current_path == "/response/app/updatecheck/manifest") { 593 // Get the version. 594 if (!data->apps.empty()) 595 data->apps.back().manifest_version = attrs[kAttrVersion]; 596 } else if (data->current_path == 597 "/response/app/updatecheck/manifest/actions/action") { 598 // We only care about the postinstall action. 599 if (attrs[kAttrEvent] == kValPostInstall && !data->apps.empty()) { 600 data->apps.back().action_postinstall_attrs = std::move(attrs); 601 } 602 } 603 } 604 605 // Callback function invoked by expat. 606 void ParserHandlerEnd(void* user_data, const XML_Char* element) { 607 OmahaParserData* data = reinterpret_cast<OmahaParserData*>(user_data); 608 if (data->failed) 609 return; 610 611 const string path_suffix = string("/") + element; 612 613 if (!base::EndsWith( 614 data->current_path, path_suffix, base::CompareCase::SENSITIVE)) { 615 LOG(ERROR) << "Unexpected end element '" << element 616 << "' with current_path='" << data->current_path << "'"; 617 data->failed = true; 618 return; 619 } 620 data->current_path.resize(data->current_path.size() - path_suffix.size()); 621 } 622 623 // Callback function invoked by expat. 624 // 625 // This is called for entity declarations. Since Omaha is guaranteed 626 // to never return any XML with entities our course of action is to 627 // just stop parsing. This avoids potential resource exhaustion 628 // problems AKA the "billion laughs". CVE-2013-0340. 629 void ParserHandlerEntityDecl(void* user_data, 630 const XML_Char* entity_name, 631 int is_parameter_entity, 632 const XML_Char* value, 633 int value_length, 634 const XML_Char* base, 635 const XML_Char* system_id, 636 const XML_Char* public_id, 637 const XML_Char* notation_name) { 638 OmahaParserData* data = reinterpret_cast<OmahaParserData*>(user_data); 639 640 LOG(ERROR) << "XML entities are not supported. Aborting parsing."; 641 data->failed = true; 642 data->entity_decl = true; 643 XML_StopParser(data->xml_parser, false); 644 } 645 646 } // namespace 647 648 bool XmlEncode(const string& input, string* output) { 649 if (std::find_if(input.begin(), input.end(), [](const char c) { 650 return c & 0x80; 651 }) != input.end()) { 652 LOG(WARNING) << "Invalid ASCII-7 string passed to the XML encoder:"; 653 utils::HexDumpString(input); 654 return false; 655 } 656 output->clear(); 657 // We need at least input.size() space in the output, but the code below will 658 // handle it if we need more. 659 output->reserve(input.size()); 660 for (char c : input) { 661 switch (c) { 662 case '\"': 663 output->append("""); 664 break; 665 case '\'': 666 output->append("'"); 667 break; 668 case '&': 669 output->append("&"); 670 break; 671 case '<': 672 output->append("<"); 673 break; 674 case '>': 675 output->append(">"); 676 break; 677 default: 678 output->push_back(c); 679 } 680 } 681 return true; 682 } 683 684 string XmlEncodeWithDefault(const string& input, const string& default_value) { 685 string output; 686 if (XmlEncode(input, &output)) 687 return output; 688 return default_value; 689 } 690 691 OmahaRequestAction::OmahaRequestAction( 692 SystemState* system_state, 693 OmahaEvent* event, 694 std::unique_ptr<HttpFetcher> http_fetcher, 695 bool ping_only) 696 : system_state_(system_state), 697 params_(system_state->request_params()), 698 event_(event), 699 http_fetcher_(std::move(http_fetcher)), 700 policy_provider_(std::make_unique<policy::PolicyProvider>()), 701 ping_only_(ping_only), 702 ping_active_days_(0), 703 ping_roll_call_days_(0) { 704 policy_provider_->Reload(); 705 } 706 707 OmahaRequestAction::~OmahaRequestAction() {} 708 709 // Calculates the value to use for the ping days parameter. 710 int OmahaRequestAction::CalculatePingDays(const string& key) { 711 int days = kNeverPinged; 712 int64_t last_ping = 0; 713 if (system_state_->prefs()->GetInt64(key, &last_ping) && last_ping >= 0) { 714 days = (Time::Now() - Time::FromInternalValue(last_ping)).InDays(); 715 if (days < 0) { 716 // If |days| is negative, then the system clock must have jumped 717 // back in time since the ping was sent. Mark the value so that 718 // it doesn't get sent to the server but we still update the 719 // last ping daystart preference. This way the next ping time 720 // will be correct, hopefully. 721 days = kPingTimeJump; 722 LOG(WARNING) 723 << "System clock jumped back in time. Resetting ping daystarts."; 724 } 725 } 726 return days; 727 } 728 729 void OmahaRequestAction::InitPingDays() { 730 // We send pings only along with update checks, not with events. 731 if (IsEvent()) { 732 return; 733 } 734 // TODO(petkov): Figure a way to distinguish active use pings 735 // vs. roll call pings. Currently, the two pings are identical. A 736 // fix needs to change this code as well as UpdateLastPingDays and ShouldPing. 737 ping_active_days_ = CalculatePingDays(kPrefsLastActivePingDay); 738 ping_roll_call_days_ = CalculatePingDays(kPrefsLastRollCallPingDay); 739 } 740 741 bool OmahaRequestAction::ShouldPing() const { 742 if (ping_active_days_ == OmahaRequestAction::kNeverPinged && 743 ping_roll_call_days_ == OmahaRequestAction::kNeverPinged) { 744 int powerwash_count = system_state_->hardware()->GetPowerwashCount(); 745 if (powerwash_count > 0) { 746 LOG(INFO) << "Not sending ping with a=-1 r=-1 to omaha because " 747 << "powerwash_count is " << powerwash_count; 748 return false; 749 } 750 if (system_state_->hardware()->GetFirstActiveOmahaPingSent()) { 751 LOG(INFO) << "Not sending ping with a=-1 r=-1 to omaha because " 752 << "the first_active_omaha_ping_sent is true"; 753 return false; 754 } 755 return true; 756 } 757 return ping_active_days_ > 0 || ping_roll_call_days_ > 0; 758 } 759 760 // static 761 int OmahaRequestAction::GetInstallDate(SystemState* system_state) { 762 PrefsInterface* prefs = system_state->prefs(); 763 if (prefs == nullptr) 764 return -1; 765 766 // If we have the value stored on disk, just return it. 767 int64_t stored_value; 768 if (prefs->GetInt64(kPrefsInstallDateDays, &stored_value)) { 769 // Convert and sanity-check. 770 int install_date_days = static_cast<int>(stored_value); 771 if (install_date_days >= 0) 772 return install_date_days; 773 LOG(ERROR) << "Dropping stored Omaha InstallData since its value num_days=" 774 << install_date_days << " looks suspicious."; 775 prefs->Delete(kPrefsInstallDateDays); 776 } 777 778 // Otherwise, if OOBE is not complete then do nothing and wait for 779 // ParseResponse() to call ParseInstallDate() and then 780 // PersistInstallDate() to set the kPrefsInstallDateDays state 781 // variable. Once that is done, we'll then report back in future 782 // Omaha requests. This works exactly because OOBE triggers an 783 // update check. 784 // 785 // However, if OOBE is complete and the kPrefsInstallDateDays state 786 // variable is not set, there are two possibilities 787 // 788 // 1. The update check in OOBE failed so we never got a response 789 // from Omaha (no network etc.); or 790 // 791 // 2. OOBE was done on an older version that didn't write to the 792 // kPrefsInstallDateDays state variable. 793 // 794 // In both cases, we approximate the install date by simply 795 // inspecting the timestamp of when OOBE happened. 796 797 Time time_of_oobe; 798 if (!system_state->hardware()->IsOOBEEnabled() || 799 !system_state->hardware()->IsOOBEComplete(&time_of_oobe)) { 800 LOG(INFO) << "Not generating Omaha InstallData as we have " 801 << "no prefs file and OOBE is not complete or not enabled."; 802 return -1; 803 } 804 805 int num_days; 806 if (!utils::ConvertToOmahaInstallDate(time_of_oobe, &num_days)) { 807 LOG(ERROR) << "Not generating Omaha InstallData from time of OOBE " 808 << "as its value '" << utils::ToString(time_of_oobe) 809 << "' looks suspicious."; 810 return -1; 811 } 812 813 // Persist this to disk, for future use. 814 if (!OmahaRequestAction::PersistInstallDate( 815 system_state, num_days, kProvisionedFromOOBEMarker)) 816 return -1; 817 818 LOG(INFO) << "Set the Omaha InstallDate from OOBE time-stamp to " << num_days 819 << " days"; 820 821 return num_days; 822 } 823 824 void OmahaRequestAction::PerformAction() { 825 http_fetcher_->set_delegate(this); 826 InitPingDays(); 827 if (ping_only_ && !ShouldPing()) { 828 processor_->ActionComplete(this, ErrorCode::kSuccess); 829 return; 830 } 831 832 string request_post(GetRequestXml(event_.get(), 833 params_, 834 ping_only_, 835 ShouldPing(), // include_ping 836 ping_active_days_, 837 ping_roll_call_days_, 838 GetInstallDate(system_state_), 839 system_state_)); 840 841 // Set X-Goog-Update headers. 842 http_fetcher_->SetHeader(kXGoogleUpdateInteractivity, 843 params_->interactive() ? "fg" : "bg"); 844 http_fetcher_->SetHeader(kXGoogleUpdateAppId, params_->GetAppId()); 845 http_fetcher_->SetHeader( 846 kXGoogleUpdateUpdater, 847 base::StringPrintf( 848 "%s-%s", constants::kOmahaUpdaterID, kOmahaUpdaterVersion)); 849 850 http_fetcher_->SetPostData( 851 request_post.data(), request_post.size(), kHttpContentTypeTextXml); 852 LOG(INFO) << "Posting an Omaha request to " << params_->update_url(); 853 LOG(INFO) << "Request: " << request_post; 854 http_fetcher_->BeginTransfer(params_->update_url()); 855 } 856 857 void OmahaRequestAction::TerminateProcessing() { 858 http_fetcher_->TerminateTransfer(); 859 } 860 861 // We just store the response in the buffer. Once we've received all bytes, 862 // we'll look in the buffer and decide what to do. 863 bool OmahaRequestAction::ReceivedBytes(HttpFetcher* fetcher, 864 const void* bytes, 865 size_t length) { 866 const uint8_t* byte_ptr = reinterpret_cast<const uint8_t*>(bytes); 867 response_buffer_.insert(response_buffer_.end(), byte_ptr, byte_ptr + length); 868 return true; 869 } 870 871 namespace { 872 873 // Parses a 64 bit base-10 int from a string and returns it. Returns 0 874 // on error. If the string contains "0", that's indistinguishable from 875 // error. 876 off_t ParseInt(const string& str) { 877 off_t ret = 0; 878 int rc = sscanf(str.c_str(), "%" PRIi64, &ret); // NOLINT(runtime/printf) 879 if (rc < 1) { 880 // failure 881 return 0; 882 } 883 return ret; 884 } 885 886 // Parses |str| and returns |true| if, and only if, its value is "true". 887 bool ParseBool(const string& str) { 888 return str == "true"; 889 } 890 891 // Update the last ping day preferences based on the server daystart 892 // response. Returns true on success, false otherwise. 893 bool UpdateLastPingDays(OmahaParserData* parser_data, PrefsInterface* prefs) { 894 int64_t elapsed_seconds = 0; 895 TEST_AND_RETURN_FALSE(base::StringToInt64( 896 parser_data->daystart_elapsed_seconds, &elapsed_seconds)); 897 TEST_AND_RETURN_FALSE(elapsed_seconds >= 0); 898 899 // Remember the local time that matches the server's last midnight 900 // time. 901 Time daystart = Time::Now() - TimeDelta::FromSeconds(elapsed_seconds); 902 prefs->SetInt64(kPrefsLastActivePingDay, daystart.ToInternalValue()); 903 prefs->SetInt64(kPrefsLastRollCallPingDay, daystart.ToInternalValue()); 904 return true; 905 } 906 907 // Parses the package node in the given XML document and populates 908 // |output_object| if valid. Returns true if we should continue the parsing. 909 // False otherwise, in which case it sets any error code using |completer|. 910 bool ParsePackage(OmahaParserData::App* app, 911 OmahaResponse* output_object, 912 ScopedActionCompleter* completer) { 913 if (app->updatecheck_status.empty() || 914 app->updatecheck_status == kValNoUpdate) { 915 if (!app->packages.empty()) { 916 LOG(ERROR) << "No update in this <app> but <package> is not empty."; 917 completer->set_code(ErrorCode::kOmahaResponseInvalid); 918 return false; 919 } 920 return true; 921 } 922 if (app->packages.empty()) { 923 LOG(ERROR) << "Omaha Response has no packages"; 924 completer->set_code(ErrorCode::kOmahaResponseInvalid); 925 return false; 926 } 927 if (app->url_codebase.empty()) { 928 LOG(ERROR) << "No Omaha Response URLs"; 929 completer->set_code(ErrorCode::kOmahaResponseInvalid); 930 return false; 931 } 932 LOG(INFO) << "Found " << app->url_codebase.size() << " url(s)"; 933 vector<string> metadata_sizes = 934 base::SplitString(app->action_postinstall_attrs[kAttrMetadataSize], 935 ":", 936 base::TRIM_WHITESPACE, 937 base::SPLIT_WANT_ALL); 938 vector<string> metadata_signatures = base::SplitString( 939 app->action_postinstall_attrs[kAttrMetadataSignatureRsa], 940 ":", 941 base::TRIM_WHITESPACE, 942 base::SPLIT_WANT_ALL); 943 vector<string> is_delta_payloads = 944 base::SplitString(app->action_postinstall_attrs[kAttrIsDeltaPayload], 945 ":", 946 base::TRIM_WHITESPACE, 947 base::SPLIT_WANT_ALL); 948 for (size_t i = 0; i < app->packages.size(); i++) { 949 const auto& package = app->packages[i]; 950 if (package.name.empty()) { 951 LOG(ERROR) << "Omaha Response has empty package name"; 952 completer->set_code(ErrorCode::kOmahaResponseInvalid); 953 return false; 954 } 955 LOG(INFO) << "Found package " << package.name; 956 957 OmahaResponse::Package out_package; 958 for (const string& codebase : app->url_codebase) { 959 if (codebase.empty()) { 960 LOG(ERROR) << "Omaha Response URL has empty codebase"; 961 completer->set_code(ErrorCode::kOmahaResponseInvalid); 962 return false; 963 } 964 out_package.payload_urls.push_back(codebase + package.name); 965 } 966 // Parse the payload size. 967 base::StringToUint64(package.size, &out_package.size); 968 if (out_package.size <= 0) { 969 LOG(ERROR) << "Omaha Response has invalid payload size: " << package.size; 970 completer->set_code(ErrorCode::kOmahaResponseInvalid); 971 return false; 972 } 973 LOG(INFO) << "Payload size = " << out_package.size << " bytes"; 974 975 if (i < metadata_sizes.size()) 976 base::StringToUint64(metadata_sizes[i], &out_package.metadata_size); 977 LOG(INFO) << "Payload metadata size = " << out_package.metadata_size 978 << " bytes"; 979 980 if (i < metadata_signatures.size()) 981 out_package.metadata_signature = metadata_signatures[i]; 982 LOG(INFO) << "Payload metadata signature = " 983 << out_package.metadata_signature; 984 985 out_package.hash = package.hash; 986 if (out_package.hash.empty()) { 987 LOG(ERROR) << "Omaha Response has empty hash_sha256 value"; 988 completer->set_code(ErrorCode::kOmahaResponseInvalid); 989 return false; 990 } 991 LOG(INFO) << "Payload hash = " << out_package.hash; 992 993 if (i < is_delta_payloads.size()) 994 out_package.is_delta = ParseBool(is_delta_payloads[i]); 995 LOG(INFO) << "Payload is delta = " << utils::ToString(out_package.is_delta); 996 997 output_object->packages.push_back(std::move(out_package)); 998 } 999 1000 return true; 1001 } 1002 1003 // Parses the 2 key version strings kernel_version and firmware_version. If the 1004 // field is not present, or cannot be parsed the values default to 0xffff. 1005 void ParseRollbackVersions(OmahaParserData* parser_data, 1006 OmahaResponse* output_object) { 1007 utils::ParseRollbackKeyVersion( 1008 parser_data->updatecheck_attrs[kAttrFirmwareVersion], 1009 &output_object->rollback_key_version.firmware_key, 1010 &output_object->rollback_key_version.firmware); 1011 utils::ParseRollbackKeyVersion( 1012 parser_data->updatecheck_attrs[kAttrKernelVersion], 1013 &output_object->rollback_key_version.kernel_key, 1014 &output_object->rollback_key_version.kernel); 1015 } 1016 1017 } // namespace 1018 1019 bool OmahaRequestAction::ParseResponse(OmahaParserData* parser_data, 1020 OmahaResponse* output_object, 1021 ScopedActionCompleter* completer) { 1022 if (parser_data->apps.empty()) { 1023 completer->set_code(ErrorCode::kOmahaResponseInvalid); 1024 return false; 1025 } 1026 LOG(INFO) << "Found " << parser_data->apps.size() << " <app>."; 1027 1028 // chromium-os:37289: The PollInterval is not supported by Omaha server 1029 // currently. But still keeping this existing code in case we ever decide to 1030 // slow down the request rate from the server-side. Note that the PollInterval 1031 // is not persisted, so it has to be sent by the server on every response to 1032 // guarantee that the scheduler uses this value (otherwise, if the device got 1033 // rebooted after the last server-indicated value, it'll revert to the default 1034 // value). Also kDefaultMaxUpdateChecks value for the scattering logic is 1035 // based on the assumption that we perform an update check every hour so that 1036 // the max value of 8 will roughly be equivalent to one work day. If we decide 1037 // to use PollInterval permanently, we should update the 1038 // max_update_checks_allowed to take PollInterval into account. Note: The 1039 // parsing for PollInterval happens even before parsing of the status because 1040 // we may want to specify the PollInterval even when there's no update. 1041 base::StringToInt(parser_data->updatecheck_poll_interval, 1042 &output_object->poll_interval); 1043 1044 // Check for the "elapsed_days" attribute in the "daystart" 1045 // element. This is the number of days since Jan 1 2007, 0:00 1046 // PST. If we don't have a persisted value of the Omaha InstallDate, 1047 // we'll use it to calculate it and then persist it. 1048 if (ParseInstallDate(parser_data, output_object) && 1049 !HasInstallDate(system_state_)) { 1050 // Since output_object->install_date_days is never negative, the 1051 // elapsed_days -> install-date calculation is reduced to simply 1052 // rounding down to the nearest number divisible by 7. 1053 int remainder = output_object->install_date_days % 7; 1054 int install_date_days_rounded = 1055 output_object->install_date_days - remainder; 1056 if (PersistInstallDate(system_state_, 1057 install_date_days_rounded, 1058 kProvisionedFromOmahaResponse)) { 1059 LOG(INFO) << "Set the Omaha InstallDate from Omaha Response to " 1060 << install_date_days_rounded << " days"; 1061 } 1062 } 1063 1064 // We persist the cohorts sent by omaha even if the status is "noupdate". 1065 for (const auto& app : parser_data->apps) { 1066 if (app.id == params_->GetAppId()) { 1067 if (app.cohort_set) 1068 PersistCohortData(kPrefsOmahaCohort, app.cohort); 1069 if (app.cohorthint_set) 1070 PersistCohortData(kPrefsOmahaCohortHint, app.cohorthint); 1071 if (app.cohortname_set) 1072 PersistCohortData(kPrefsOmahaCohortName, app.cohortname); 1073 break; 1074 } 1075 } 1076 1077 // Parse the updatecheck attributes. 1078 PersistEolStatus(parser_data->updatecheck_attrs); 1079 // Rollback-related updatecheck attributes. 1080 // Defaults to false if attribute is not present. 1081 output_object->is_rollback = 1082 ParseBool(parser_data->updatecheck_attrs[kAttrRollback]); 1083 1084 // Parses the rollback versions of the current image. If the fields do not 1085 // exist they default to 0xffff for the 4 key versions. 1086 ParseRollbackVersions(parser_data, output_object); 1087 1088 if (!ParseStatus(parser_data, output_object, completer)) 1089 return false; 1090 1091 if (!ParseParams(parser_data, output_object, completer)) 1092 return false; 1093 1094 // Package has to be parsed after Params now because ParseParams need to make 1095 // sure that postinstall action exists. 1096 for (auto& app : parser_data->apps) 1097 if (!ParsePackage(&app, output_object, completer)) 1098 return false; 1099 1100 return true; 1101 } 1102 1103 bool OmahaRequestAction::ParseStatus(OmahaParserData* parser_data, 1104 OmahaResponse* output_object, 1105 ScopedActionCompleter* completer) { 1106 output_object->update_exists = false; 1107 for (const auto& app : parser_data->apps) { 1108 const string& status = app.updatecheck_status; 1109 if (status == kValNoUpdate) { 1110 // Don't update if any app has status="noupdate". 1111 LOG(INFO) << "No update for <app> " << app.id; 1112 output_object->update_exists = false; 1113 break; 1114 } else if (status == "ok") { 1115 auto const& attr_no_update = 1116 app.action_postinstall_attrs.find(kAttrNoUpdate); 1117 if (attr_no_update != app.action_postinstall_attrs.end() && 1118 attr_no_update->second == "true") { 1119 // noupdate="true" in postinstall attributes means it's an update to 1120 // self, only update if there's at least one app really have update. 1121 LOG(INFO) << "Update to self for <app> " << app.id; 1122 } else { 1123 LOG(INFO) << "Update for <app> " << app.id; 1124 output_object->update_exists = true; 1125 } 1126 } else if (status.empty() && params_->is_install() && 1127 params_->GetAppId() == app.id) { 1128 // Skips the platform app for install operation. 1129 LOG(INFO) << "No payload (and ignore) for <app> " << app.id; 1130 } else { 1131 LOG(ERROR) << "Unknown Omaha response status: " << status; 1132 completer->set_code(ErrorCode::kOmahaResponseInvalid); 1133 return false; 1134 } 1135 } 1136 if (!output_object->update_exists) { 1137 SetOutputObject(*output_object); 1138 completer->set_code(ErrorCode::kSuccess); 1139 } 1140 1141 return output_object->update_exists; 1142 } 1143 1144 bool OmahaRequestAction::ParseParams(OmahaParserData* parser_data, 1145 OmahaResponse* output_object, 1146 ScopedActionCompleter* completer) { 1147 map<string, string> attrs; 1148 for (auto& app : parser_data->apps) { 1149 if (app.id == params_->GetAppId()) { 1150 // this is the app (potentially the only app) 1151 output_object->version = app.manifest_version; 1152 } else if (!params_->system_app_id().empty() && 1153 app.id == params_->system_app_id()) { 1154 // this is the system app (this check is intentionally skipped if there is 1155 // no system_app_id set) 1156 output_object->system_version = app.manifest_version; 1157 } else if (params_->is_install() && 1158 app.manifest_version != params_->app_version()) { 1159 LOG(WARNING) << "An app has a different version (" << app.manifest_version 1160 << ") that is different than platform app version (" 1161 << params_->app_version() << ")"; 1162 } 1163 if (!app.action_postinstall_attrs.empty() && attrs.empty()) { 1164 attrs = app.action_postinstall_attrs; 1165 } 1166 } 1167 if (params_->is_install()) { 1168 LOG(INFO) << "Use request version for Install operation."; 1169 output_object->version = params_->app_version(); 1170 } 1171 if (output_object->version.empty()) { 1172 LOG(ERROR) << "Omaha Response does not have version in manifest!"; 1173 completer->set_code(ErrorCode::kOmahaResponseInvalid); 1174 return false; 1175 } 1176 1177 LOG(INFO) << "Received omaha response to update to version " 1178 << output_object->version; 1179 1180 if (attrs.empty()) { 1181 LOG(ERROR) << "Omaha Response has no postinstall event action"; 1182 completer->set_code(ErrorCode::kOmahaResponseInvalid); 1183 return false; 1184 } 1185 1186 // Get the optional properties one by one. 1187 output_object->more_info_url = attrs[kAttrMoreInfo]; 1188 output_object->prompt = ParseBool(attrs[kAttrPrompt]); 1189 output_object->deadline = attrs[kAttrDeadline]; 1190 output_object->max_days_to_scatter = ParseInt(attrs[kAttrMaxDaysToScatter]); 1191 output_object->disable_p2p_for_downloading = 1192 ParseBool(attrs[kAttrDisableP2PForDownloading]); 1193 output_object->disable_p2p_for_sharing = 1194 ParseBool(attrs[kAttrDisableP2PForSharing]); 1195 output_object->public_key_rsa = attrs[kAttrPublicKeyRsa]; 1196 1197 string max = attrs[kAttrMaxFailureCountPerUrl]; 1198 if (!base::StringToUint(max, &output_object->max_failure_count_per_url)) 1199 output_object->max_failure_count_per_url = kDefaultMaxFailureCountPerUrl; 1200 1201 output_object->disable_payload_backoff = 1202 ParseBool(attrs[kAttrDisablePayloadBackoff]); 1203 output_object->powerwash_required = ParseBool(attrs[kAttrPowerwash]); 1204 1205 return true; 1206 } 1207 1208 // If the transfer was successful, this uses expat to parse the response 1209 // and fill in the appropriate fields of the output object. Also, notifies 1210 // the processor that we're done. 1211 void OmahaRequestAction::TransferComplete(HttpFetcher* fetcher, 1212 bool successful) { 1213 ScopedActionCompleter completer(processor_, this); 1214 string current_response(response_buffer_.begin(), response_buffer_.end()); 1215 LOG(INFO) << "Omaha request response: " << current_response; 1216 1217 PayloadStateInterface* const payload_state = system_state_->payload_state(); 1218 1219 // Set the max kernel key version based on whether rollback is allowed. 1220 SetMaxKernelKeyVersionForRollback(); 1221 1222 // Events are best effort transactions -- assume they always succeed. 1223 if (IsEvent()) { 1224 CHECK(!HasOutputPipe()) << "No output pipe allowed for event requests."; 1225 completer.set_code(ErrorCode::kSuccess); 1226 return; 1227 } 1228 1229 if (!successful) { 1230 LOG(ERROR) << "Omaha request network transfer failed."; 1231 int code = GetHTTPResponseCode(); 1232 // Makes sure we send sane error values. 1233 if (code < 0 || code >= 1000) { 1234 code = 999; 1235 } 1236 completer.set_code(static_cast<ErrorCode>( 1237 static_cast<int>(ErrorCode::kOmahaRequestHTTPResponseBase) + code)); 1238 return; 1239 } 1240 1241 XML_Parser parser = XML_ParserCreate(nullptr); 1242 OmahaParserData parser_data(parser); 1243 XML_SetUserData(parser, &parser_data); 1244 XML_SetElementHandler(parser, ParserHandlerStart, ParserHandlerEnd); 1245 XML_SetEntityDeclHandler(parser, ParserHandlerEntityDecl); 1246 XML_Status res = 1247 XML_Parse(parser, 1248 reinterpret_cast<const char*>(response_buffer_.data()), 1249 response_buffer_.size(), 1250 XML_TRUE); 1251 1252 if (res != XML_STATUS_OK || parser_data.failed) { 1253 LOG(ERROR) << "Omaha response not valid XML: " 1254 << XML_ErrorString(XML_GetErrorCode(parser)) << " at line " 1255 << XML_GetCurrentLineNumber(parser) << " col " 1256 << XML_GetCurrentColumnNumber(parser); 1257 XML_ParserFree(parser); 1258 ErrorCode error_code = ErrorCode::kOmahaRequestXMLParseError; 1259 if (response_buffer_.empty()) { 1260 error_code = ErrorCode::kOmahaRequestEmptyResponseError; 1261 } else if (parser_data.entity_decl) { 1262 error_code = ErrorCode::kOmahaRequestXMLHasEntityDecl; 1263 } 1264 completer.set_code(error_code); 1265 return; 1266 } 1267 XML_ParserFree(parser); 1268 1269 // Update the last ping day preferences based on the server daystart response 1270 // even if we didn't send a ping. Omaha always includes the daystart in the 1271 // response, but log the error if it didn't. 1272 LOG_IF(ERROR, !UpdateLastPingDays(&parser_data, system_state_->prefs())) 1273 << "Failed to update the last ping day preferences!"; 1274 1275 // Sets first_active_omaha_ping_sent to true (vpd in CrOS). We only do this if 1276 // we have got a response from omaha and if its value has never been set to 1277 // true before. Failure of this function should be ignored. There should be no 1278 // need to check if a=-1 has been sent because older devices have already sent 1279 // their a=-1 in the past and we have to set first_active_omaha_ping_sent for 1280 // future checks. 1281 if (!system_state_->hardware()->GetFirstActiveOmahaPingSent()) { 1282 if (!system_state_->hardware()->SetFirstActiveOmahaPingSent()) { 1283 system_state_->metrics_reporter()->ReportInternalErrorCode( 1284 ErrorCode::kFirstActiveOmahaPingSentPersistenceError); 1285 } 1286 } 1287 1288 if (!HasOutputPipe()) { 1289 // Just set success to whether or not the http transfer succeeded, 1290 // which must be true at this point in the code. 1291 completer.set_code(ErrorCode::kSuccess); 1292 return; 1293 } 1294 1295 OmahaResponse output_object; 1296 if (!ParseResponse(&parser_data, &output_object, &completer)) 1297 return; 1298 output_object.update_exists = true; 1299 SetOutputObject(output_object); 1300 1301 LoadOrPersistUpdateFirstSeenAtPref(); 1302 1303 ErrorCode error = ErrorCode::kSuccess; 1304 if (ShouldIgnoreUpdate(output_object, &error)) { 1305 // No need to change output_object.update_exists here, since the value 1306 // has been output to the pipe. 1307 completer.set_code(error); 1308 return; 1309 } 1310 1311 // If Omaha says to disable p2p, respect that 1312 if (output_object.disable_p2p_for_downloading) { 1313 LOG(INFO) << "Forcibly disabling use of p2p for downloading as " 1314 << "requested by Omaha."; 1315 payload_state->SetUsingP2PForDownloading(false); 1316 } 1317 if (output_object.disable_p2p_for_sharing) { 1318 LOG(INFO) << "Forcibly disabling use of p2p for sharing as " 1319 << "requested by Omaha."; 1320 payload_state->SetUsingP2PForSharing(false); 1321 } 1322 1323 // Update the payload state with the current response. The payload state 1324 // will automatically reset all stale state if this response is different 1325 // from what's stored already. We are updating the payload state as late 1326 // as possible in this method so that if a new release gets pushed and then 1327 // got pulled back due to some issues, we don't want to clear our internal 1328 // state unnecessarily. 1329 payload_state->SetResponse(output_object); 1330 1331 // It could be we've already exceeded the deadline for when p2p is 1332 // allowed or that we've tried too many times with p2p. Check that. 1333 if (payload_state->GetUsingP2PForDownloading()) { 1334 payload_state->P2PNewAttempt(); 1335 if (!payload_state->P2PAttemptAllowed()) { 1336 LOG(INFO) << "Forcibly disabling use of p2p for downloading because " 1337 << "of previous failures when using p2p."; 1338 payload_state->SetUsingP2PForDownloading(false); 1339 } 1340 } 1341 1342 // From here on, we'll complete stuff in CompleteProcessing() so 1343 // disable |completer| since we'll create a new one in that 1344 // function. 1345 completer.set_should_complete(false); 1346 1347 // If we're allowed to use p2p for downloading we do not pay 1348 // attention to wall-clock-based waiting if the URL is indeed 1349 // available via p2p. Therefore, check if the file is available via 1350 // p2p before deferring... 1351 if (payload_state->GetUsingP2PForDownloading()) { 1352 LookupPayloadViaP2P(output_object); 1353 } else { 1354 CompleteProcessing(); 1355 } 1356 } 1357 1358 void OmahaRequestAction::CompleteProcessing() { 1359 ScopedActionCompleter completer(processor_, this); 1360 OmahaResponse& output_object = const_cast<OmahaResponse&>(GetOutputObject()); 1361 PayloadStateInterface* payload_state = system_state_->payload_state(); 1362 1363 if (ShouldDeferDownload(&output_object)) { 1364 output_object.update_exists = false; 1365 LOG(INFO) << "Ignoring Omaha updates as updates are deferred by policy."; 1366 completer.set_code(ErrorCode::kOmahaUpdateDeferredPerPolicy); 1367 return; 1368 } 1369 1370 if (payload_state->ShouldBackoffDownload()) { 1371 output_object.update_exists = false; 1372 LOG(INFO) << "Ignoring Omaha updates in order to backoff our retry " 1373 << "attempts"; 1374 completer.set_code(ErrorCode::kOmahaUpdateDeferredForBackoff); 1375 return; 1376 } 1377 completer.set_code(ErrorCode::kSuccess); 1378 } 1379 1380 void OmahaRequestAction::OnLookupPayloadViaP2PCompleted(const string& url) { 1381 LOG(INFO) << "Lookup complete, p2p-client returned URL '" << url << "'"; 1382 if (!url.empty()) { 1383 system_state_->payload_state()->SetP2PUrl(url); 1384 } else { 1385 LOG(INFO) << "Forcibly disabling use of p2p for downloading " 1386 << "because no suitable peer could be found."; 1387 system_state_->payload_state()->SetUsingP2PForDownloading(false); 1388 } 1389 CompleteProcessing(); 1390 } 1391 1392 void OmahaRequestAction::LookupPayloadViaP2P(const OmahaResponse& response) { 1393 // If the device is in the middle of an update, the state variables 1394 // kPrefsUpdateStateNextDataOffset, kPrefsUpdateStateNextDataLength 1395 // tracks the offset and length of the operation currently in 1396 // progress. The offset is based from the end of the manifest which 1397 // is kPrefsManifestMetadataSize bytes long. 1398 // 1399 // To make forward progress and avoid deadlocks, we need to find a 1400 // peer that has at least the entire operation we're currently 1401 // working on. Otherwise we may end up in a situation where two 1402 // devices bounce back and forth downloading from each other, 1403 // neither making any forward progress until one of them decides to 1404 // stop using p2p (via kMaxP2PAttempts and kMaxP2PAttemptTimeSeconds 1405 // safe-guards). See http://crbug.com/297170 for an example) 1406 size_t minimum_size = 0; 1407 int64_t manifest_metadata_size = 0; 1408 int64_t manifest_signature_size = 0; 1409 int64_t next_data_offset = 0; 1410 int64_t next_data_length = 0; 1411 if (system_state_ && 1412 system_state_->prefs()->GetInt64(kPrefsManifestMetadataSize, 1413 &manifest_metadata_size) && 1414 manifest_metadata_size != -1 && 1415 system_state_->prefs()->GetInt64(kPrefsManifestSignatureSize, 1416 &manifest_signature_size) && 1417 manifest_signature_size != -1 && 1418 system_state_->prefs()->GetInt64(kPrefsUpdateStateNextDataOffset, 1419 &next_data_offset) && 1420 next_data_offset != -1 && 1421 system_state_->prefs()->GetInt64(kPrefsUpdateStateNextDataLength, 1422 &next_data_length)) { 1423 minimum_size = manifest_metadata_size + manifest_signature_size + 1424 next_data_offset + next_data_length; 1425 } 1426 1427 // TODO(senj): Fix P2P for multiple package. 1428 brillo::Blob raw_hash; 1429 if (!base::HexStringToBytes(response.packages[0].hash, &raw_hash)) 1430 return; 1431 string file_id = 1432 utils::CalculateP2PFileId(raw_hash, response.packages[0].size); 1433 if (system_state_->p2p_manager()) { 1434 LOG(INFO) << "Checking if payload is available via p2p, file_id=" << file_id 1435 << " minimum_size=" << minimum_size; 1436 system_state_->p2p_manager()->LookupUrlForFile( 1437 file_id, 1438 minimum_size, 1439 TimeDelta::FromSeconds(kMaxP2PNetworkWaitTimeSeconds), 1440 base::Bind(&OmahaRequestAction::OnLookupPayloadViaP2PCompleted, 1441 base::Unretained(this))); 1442 } 1443 } 1444 1445 bool OmahaRequestAction::ShouldDeferDownload(OmahaResponse* output_object) { 1446 if (params_->interactive()) { 1447 LOG(INFO) << "Not deferring download because update is interactive."; 1448 return false; 1449 } 1450 1451 // If we're using p2p to download _and_ we have a p2p URL, we never 1452 // defer the download. This is because the download will always 1453 // happen from a peer on the LAN and we've been waiting in line for 1454 // our turn. 1455 const PayloadStateInterface* payload_state = system_state_->payload_state(); 1456 if (payload_state->GetUsingP2PForDownloading() && 1457 !payload_state->GetP2PUrl().empty()) { 1458 LOG(INFO) << "Download not deferred because download " 1459 << "will happen from a local peer (via p2p)."; 1460 return false; 1461 } 1462 1463 // We should defer the downloads only if we've first satisfied the 1464 // wall-clock-based-waiting period and then the update-check-based waiting 1465 // period, if required. 1466 if (!params_->wall_clock_based_wait_enabled()) { 1467 LOG(INFO) << "Wall-clock-based waiting period is not enabled," 1468 << " so no deferring needed."; 1469 return false; 1470 } 1471 1472 switch (IsWallClockBasedWaitingSatisfied(output_object)) { 1473 case kWallClockWaitNotSatisfied: 1474 // We haven't even satisfied the first condition, passing the 1475 // wall-clock-based waiting period, so we should defer the downloads 1476 // until that happens. 1477 LOG(INFO) << "wall-clock-based-wait not satisfied."; 1478 return true; 1479 1480 case kWallClockWaitDoneButUpdateCheckWaitRequired: 1481 LOG(INFO) << "wall-clock-based-wait satisfied and " 1482 << "update-check-based-wait required."; 1483 return !IsUpdateCheckCountBasedWaitingSatisfied(); 1484 1485 case kWallClockWaitDoneAndUpdateCheckWaitNotRequired: 1486 // Wall-clock-based waiting period is satisfied, and it's determined 1487 // that we do not need the update-check-based wait. so no need to 1488 // defer downloads. 1489 LOG(INFO) << "wall-clock-based-wait satisfied and " 1490 << "update-check-based-wait is not required."; 1491 return false; 1492 1493 default: 1494 // Returning false for this default case so we err on the 1495 // side of downloading updates than deferring in case of any bugs. 1496 NOTREACHED(); 1497 return false; 1498 } 1499 } 1500 1501 OmahaRequestAction::WallClockWaitResult 1502 OmahaRequestAction::IsWallClockBasedWaitingSatisfied( 1503 OmahaResponse* output_object) { 1504 Time update_first_seen_at = LoadOrPersistUpdateFirstSeenAtPref(); 1505 if (update_first_seen_at == base::Time()) { 1506 LOG(INFO) << "Not scattering as UpdateFirstSeenAt value cannot be read or " 1507 "persisted"; 1508 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1509 } 1510 1511 TimeDelta elapsed_time = 1512 system_state_->clock()->GetWallclockTime() - update_first_seen_at; 1513 TimeDelta max_scatter_period = 1514 TimeDelta::FromDays(output_object->max_days_to_scatter); 1515 int64_t staging_wait_time_in_days = 0; 1516 // Use staging and its default max value if staging is on. 1517 if (system_state_->prefs()->GetInt64(kPrefsWallClockStagingWaitPeriod, 1518 &staging_wait_time_in_days) && 1519 staging_wait_time_in_days > 0) 1520 max_scatter_period = TimeDelta::FromDays(kMaxWaitTimeStagingInDays); 1521 1522 LOG(INFO) << "Waiting Period = " 1523 << utils::FormatSecs(params_->waiting_period().InSeconds()) 1524 << ", Time Elapsed = " 1525 << utils::FormatSecs(elapsed_time.InSeconds()) 1526 << ", MaxDaysToScatter = " << max_scatter_period.InDays(); 1527 1528 if (!output_object->deadline.empty()) { 1529 // The deadline is set for all rules which serve a delta update from a 1530 // previous FSI, which means this update will be applied mostly in OOBE 1531 // cases. For these cases, we shouldn't scatter so as to finish the OOBE 1532 // quickly. 1533 LOG(INFO) << "Not scattering as deadline flag is set"; 1534 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1535 } 1536 1537 if (max_scatter_period.InDays() == 0) { 1538 // This means the Omaha rule creator decides that this rule 1539 // should not be scattered irrespective of the policy. 1540 LOG(INFO) << "Not scattering as MaxDaysToScatter in rule is 0."; 1541 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1542 } 1543 1544 if (elapsed_time > max_scatter_period) { 1545 // This means we've waited more than the upperbound wait in the rule 1546 // from the time we first saw a valid update available to us. 1547 // This will prevent update starvation. 1548 LOG(INFO) << "Not scattering as we're past the MaxDaysToScatter limit."; 1549 return kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1550 } 1551 1552 // This means we are required to participate in scattering. 1553 // See if our turn has arrived now. 1554 TimeDelta remaining_wait_time = params_->waiting_period() - elapsed_time; 1555 if (remaining_wait_time.InSeconds() <= 0) { 1556 // Yes, it's our turn now. 1557 LOG(INFO) << "Successfully passed the wall-clock-based-wait."; 1558 1559 // But we can't download until the update-check-count-based wait is also 1560 // satisfied, so mark it as required now if update checks are enabled. 1561 return params_->update_check_count_wait_enabled() 1562 ? kWallClockWaitDoneButUpdateCheckWaitRequired 1563 : kWallClockWaitDoneAndUpdateCheckWaitNotRequired; 1564 } 1565 1566 // Not our turn yet, so we have to wait until our turn to 1567 // help scatter the downloads across all clients of the enterprise. 1568 LOG(INFO) << "Update deferred for another " 1569 << utils::FormatSecs(remaining_wait_time.InSeconds()) 1570 << " per policy."; 1571 return kWallClockWaitNotSatisfied; 1572 } 1573 1574 bool OmahaRequestAction::IsUpdateCheckCountBasedWaitingSatisfied() { 1575 int64_t update_check_count_value; 1576 1577 if (system_state_->prefs()->Exists(kPrefsUpdateCheckCount)) { 1578 if (!system_state_->prefs()->GetInt64(kPrefsUpdateCheckCount, 1579 &update_check_count_value)) { 1580 // We are unable to read the update check count from file for some reason. 1581 // So let's proceed anyway so as to not stall the update. 1582 LOG(ERROR) << "Unable to read update check count. " 1583 << "Skipping update-check-count-based-wait."; 1584 return true; 1585 } 1586 } else { 1587 // This file does not exist. This means we haven't started our update 1588 // check count down yet, so this is the right time to start the count down. 1589 update_check_count_value = 1590 base::RandInt(params_->min_update_checks_needed(), 1591 params_->max_update_checks_allowed()); 1592 1593 LOG(INFO) << "Randomly picked update check count value = " 1594 << update_check_count_value; 1595 1596 // Write out the initial value of update_check_count_value. 1597 if (!system_state_->prefs()->SetInt64(kPrefsUpdateCheckCount, 1598 update_check_count_value)) { 1599 // We weren't able to write the update check count file for some reason. 1600 // So let's proceed anyway so as to not stall the update. 1601 LOG(ERROR) << "Unable to write update check count. " 1602 << "Skipping update-check-count-based-wait."; 1603 return true; 1604 } 1605 } 1606 1607 if (update_check_count_value == 0) { 1608 LOG(INFO) << "Successfully passed the update-check-based-wait."; 1609 return true; 1610 } 1611 1612 if (update_check_count_value < 0 || 1613 update_check_count_value > params_->max_update_checks_allowed()) { 1614 // We err on the side of skipping scattering logic instead of stalling 1615 // a machine from receiving any updates in case of any unexpected state. 1616 LOG(ERROR) << "Invalid value for update check count detected. " 1617 << "Skipping update-check-count-based-wait."; 1618 return true; 1619 } 1620 1621 // Legal value, we need to wait for more update checks to happen 1622 // until this becomes 0. 1623 LOG(INFO) << "Deferring Omaha updates for another " 1624 << update_check_count_value << " update checks per policy"; 1625 return false; 1626 } 1627 1628 // static 1629 bool OmahaRequestAction::ParseInstallDate(OmahaParserData* parser_data, 1630 OmahaResponse* output_object) { 1631 int64_t elapsed_days = 0; 1632 if (!base::StringToInt64(parser_data->daystart_elapsed_days, &elapsed_days)) 1633 return false; 1634 1635 if (elapsed_days < 0) 1636 return false; 1637 1638 output_object->install_date_days = elapsed_days; 1639 return true; 1640 } 1641 1642 // static 1643 bool OmahaRequestAction::HasInstallDate(SystemState* system_state) { 1644 PrefsInterface* prefs = system_state->prefs(); 1645 if (prefs == nullptr) 1646 return false; 1647 1648 return prefs->Exists(kPrefsInstallDateDays); 1649 } 1650 1651 // static 1652 bool OmahaRequestAction::PersistInstallDate( 1653 SystemState* system_state, 1654 int install_date_days, 1655 InstallDateProvisioningSource source) { 1656 TEST_AND_RETURN_FALSE(install_date_days >= 0); 1657 1658 PrefsInterface* prefs = system_state->prefs(); 1659 if (prefs == nullptr) 1660 return false; 1661 1662 if (!prefs->SetInt64(kPrefsInstallDateDays, install_date_days)) 1663 return false; 1664 1665 system_state->metrics_reporter()->ReportInstallDateProvisioningSource( 1666 static_cast<int>(source), // Sample. 1667 kProvisionedMax); // Maximum. 1668 return true; 1669 } 1670 1671 bool OmahaRequestAction::PersistCohortData(const string& prefs_key, 1672 const string& new_value) { 1673 if (new_value.empty() && system_state_->prefs()->Exists(prefs_key)) { 1674 LOG(INFO) << "Removing stored " << prefs_key << " value."; 1675 return system_state_->prefs()->Delete(prefs_key); 1676 } else if (!new_value.empty()) { 1677 LOG(INFO) << "Storing new setting " << prefs_key << " as " << new_value; 1678 return system_state_->prefs()->SetString(prefs_key, new_value); 1679 } 1680 return true; 1681 } 1682 1683 bool OmahaRequestAction::PersistEolStatus(const map<string, string>& attrs) { 1684 auto eol_attr = attrs.find(kAttrEol); 1685 if (eol_attr != attrs.end()) { 1686 return system_state_->prefs()->SetString(kPrefsOmahaEolStatus, 1687 eol_attr->second); 1688 } else if (system_state_->prefs()->Exists(kPrefsOmahaEolStatus)) { 1689 return system_state_->prefs()->Delete(kPrefsOmahaEolStatus); 1690 } 1691 return true; 1692 } 1693 1694 void OmahaRequestAction::ActionCompleted(ErrorCode code) { 1695 // We only want to report this on "update check". 1696 if (ping_only_ || event_ != nullptr) 1697 return; 1698 1699 metrics::CheckResult result = metrics::CheckResult::kUnset; 1700 metrics::CheckReaction reaction = metrics::CheckReaction::kUnset; 1701 metrics::DownloadErrorCode download_error_code = 1702 metrics::DownloadErrorCode::kUnset; 1703 1704 // Regular update attempt. 1705 switch (code) { 1706 case ErrorCode::kSuccess: 1707 // OK, we parsed the response successfully but that does 1708 // necessarily mean that an update is available. 1709 if (HasOutputPipe()) { 1710 const OmahaResponse& response = GetOutputObject(); 1711 if (response.update_exists) { 1712 result = metrics::CheckResult::kUpdateAvailable; 1713 reaction = metrics::CheckReaction::kUpdating; 1714 } else { 1715 result = metrics::CheckResult::kNoUpdateAvailable; 1716 } 1717 } else { 1718 result = metrics::CheckResult::kNoUpdateAvailable; 1719 } 1720 break; 1721 1722 case ErrorCode::kOmahaUpdateIgnoredPerPolicy: 1723 case ErrorCode::kOmahaUpdateIgnoredOverCellular: 1724 result = metrics::CheckResult::kUpdateAvailable; 1725 reaction = metrics::CheckReaction::kIgnored; 1726 break; 1727 1728 case ErrorCode::kOmahaUpdateDeferredPerPolicy: 1729 result = metrics::CheckResult::kUpdateAvailable; 1730 reaction = metrics::CheckReaction::kDeferring; 1731 break; 1732 1733 case ErrorCode::kOmahaUpdateDeferredForBackoff: 1734 result = metrics::CheckResult::kUpdateAvailable; 1735 reaction = metrics::CheckReaction::kBackingOff; 1736 break; 1737 1738 default: 1739 // We report two flavors of errors, "Download errors" and "Parsing 1740 // error". Try to convert to the former and if that doesn't work 1741 // we know it's the latter. 1742 metrics::DownloadErrorCode tmp_error = 1743 metrics_utils::GetDownloadErrorCode(code); 1744 if (tmp_error != metrics::DownloadErrorCode::kInputMalformed) { 1745 result = metrics::CheckResult::kDownloadError; 1746 download_error_code = tmp_error; 1747 } else { 1748 result = metrics::CheckResult::kParsingError; 1749 } 1750 break; 1751 } 1752 1753 system_state_->metrics_reporter()->ReportUpdateCheckMetrics( 1754 system_state_, result, reaction, download_error_code); 1755 } 1756 1757 bool OmahaRequestAction::ShouldIgnoreUpdate(const OmahaResponse& response, 1758 ErrorCode* error) const { 1759 // Note: policy decision to not update to a version we rolled back from. 1760 string rollback_version = 1761 system_state_->payload_state()->GetRollbackVersion(); 1762 if (!rollback_version.empty()) { 1763 LOG(INFO) << "Detected previous rollback from version " << rollback_version; 1764 if (rollback_version == response.version) { 1765 LOG(INFO) << "Received version that we rolled back from. Ignoring."; 1766 *error = ErrorCode::kOmahaUpdateIgnoredPerPolicy; 1767 return true; 1768 } 1769 } 1770 1771 if (system_state_->hardware()->IsOOBEEnabled() && 1772 !system_state_->hardware()->IsOOBEComplete(nullptr) && 1773 (response.deadline.empty() || 1774 system_state_->payload_state()->GetRollbackHappened()) && 1775 params_->app_version() != "ForcedUpdate") { 1776 LOG(INFO) << "Ignoring a non-critical Omaha update before OOBE completion."; 1777 *error = ErrorCode::kNonCriticalUpdateInOOBE; 1778 return true; 1779 } 1780 1781 if (!IsUpdateAllowedOverCurrentConnection(error, response)) { 1782 LOG(INFO) << "Update is not allowed over current connection."; 1783 return true; 1784 } 1785 1786 // Note: We could technically delete the UpdateFirstSeenAt state when we 1787 // return true. If we do, it'll mean a device has to restart the 1788 // UpdateFirstSeenAt and thus help scattering take effect when the AU is 1789 // turned on again. On the other hand, it also increases the chance of update 1790 // starvation if an admin turns AU on/off more frequently. We choose to err on 1791 // the side of preventing starvation at the cost of not applying scattering in 1792 // those cases. 1793 return false; 1794 } 1795 1796 bool OmahaRequestAction::IsUpdateAllowedOverCellularByPrefs( 1797 const OmahaResponse& response) const { 1798 PrefsInterface* prefs = system_state_->prefs(); 1799 1800 if (!prefs) { 1801 LOG(INFO) << "Disabling updates over cellular as the preferences are " 1802 "not available."; 1803 return false; 1804 } 1805 1806 bool is_allowed; 1807 1808 if (prefs->Exists(kPrefsUpdateOverCellularPermission) && 1809 prefs->GetBoolean(kPrefsUpdateOverCellularPermission, &is_allowed) && 1810 is_allowed) { 1811 LOG(INFO) << "Allowing updates over cellular as permission preference is " 1812 "set to true."; 1813 return true; 1814 } 1815 1816 if (!prefs->Exists(kPrefsUpdateOverCellularTargetVersion) || 1817 !prefs->Exists(kPrefsUpdateOverCellularTargetSize)) { 1818 LOG(INFO) << "Disabling updates over cellular as permission preference is " 1819 "set to false or does not exist while target does not exist."; 1820 return false; 1821 } 1822 1823 std::string target_version; 1824 int64_t target_size; 1825 1826 if (!prefs->GetString(kPrefsUpdateOverCellularTargetVersion, 1827 &target_version) || 1828 !prefs->GetInt64(kPrefsUpdateOverCellularTargetSize, &target_size)) { 1829 LOG(INFO) << "Disabling updates over cellular as the target version or " 1830 "size is not accessible."; 1831 return false; 1832 } 1833 1834 uint64_t total_packages_size = 0; 1835 for (const auto& package : response.packages) { 1836 total_packages_size += package.size; 1837 } 1838 if (target_version == response.version && 1839 static_cast<uint64_t>(target_size) == total_packages_size) { 1840 LOG(INFO) << "Allowing updates over cellular as the target matches the" 1841 "omaha response."; 1842 return true; 1843 } else { 1844 LOG(INFO) << "Disabling updates over cellular as the target does not" 1845 "match the omaha response."; 1846 return false; 1847 } 1848 } 1849 1850 bool OmahaRequestAction::IsUpdateAllowedOverCurrentConnection( 1851 ErrorCode* error, const OmahaResponse& response) const { 1852 ConnectionType type; 1853 ConnectionTethering tethering; 1854 ConnectionManagerInterface* connection_manager = 1855 system_state_->connection_manager(); 1856 if (!connection_manager->GetConnectionProperties(&type, &tethering)) { 1857 LOG(INFO) << "We could not determine our connection type. " 1858 << "Defaulting to allow updates."; 1859 return true; 1860 } 1861 1862 bool is_allowed = connection_manager->IsUpdateAllowedOver(type, tethering); 1863 bool is_device_policy_set = 1864 connection_manager->IsAllowedConnectionTypesForUpdateSet(); 1865 // Treats tethered connection as if it is cellular connection. 1866 bool is_over_cellular = type == ConnectionType::kCellular || 1867 tethering == ConnectionTethering::kConfirmed; 1868 1869 if (!is_over_cellular) { 1870 // There's no need to further check user preferences as we are not over 1871 // cellular connection. 1872 if (!is_allowed) 1873 *error = ErrorCode::kOmahaUpdateIgnoredPerPolicy; 1874 } else if (is_device_policy_set) { 1875 // There's no need to further check user preferences as the device policy 1876 // is set regarding updates over cellular. 1877 if (!is_allowed) 1878 *error = ErrorCode::kOmahaUpdateIgnoredPerPolicy; 1879 } else { 1880 // Deivce policy is not set, so user preferences overwrite whether to 1881 // allow updates over cellular. 1882 is_allowed = IsUpdateAllowedOverCellularByPrefs(response); 1883 if (!is_allowed) 1884 *error = ErrorCode::kOmahaUpdateIgnoredOverCellular; 1885 } 1886 1887 LOG(INFO) << "We are connected via " 1888 << connection_utils::StringForConnectionType(type) 1889 << ", Updates allowed: " << (is_allowed ? "Yes" : "No"); 1890 return is_allowed; 1891 } 1892 1893 bool OmahaRequestAction::IsRollbackEnabled() const { 1894 if (policy_provider_->IsConsumerDevice()) { 1895 LOG(INFO) << "Rollback is not enabled for consumer devices."; 1896 return false; 1897 } 1898 1899 if (!policy_provider_->device_policy_is_loaded()) { 1900 LOG(INFO) << "No device policy is loaded. Assuming rollback enabled."; 1901 return true; 1902 } 1903 1904 int allowed_milestones; 1905 if (!policy_provider_->GetDevicePolicy().GetRollbackAllowedMilestones( 1906 &allowed_milestones)) { 1907 LOG(INFO) << "RollbackAllowedMilestones policy can't be read. " 1908 "Defaulting to rollback enabled."; 1909 return true; 1910 } 1911 1912 LOG(INFO) << "Rollback allows " << allowed_milestones << " milestones."; 1913 return allowed_milestones > 0; 1914 } 1915 1916 void OmahaRequestAction::SetMaxKernelKeyVersionForRollback() const { 1917 int max_kernel_rollforward; 1918 int min_kernel_version = system_state_->hardware()->GetMinKernelKeyVersion(); 1919 if (IsRollbackEnabled()) { 1920 // If rollback is enabled, set the max kernel key version to the current 1921 // kernel key version. This has the effect of freezing kernel key roll 1922 // forwards. 1923 // 1924 // TODO(zentaro): This behavior is temporary, and ensures that no kernel 1925 // key roll forward happens until the server side components of rollback 1926 // are implemented. Future changes will allow the Omaha server to return 1927 // the kernel key version from max_rollback_versions in the past. At that 1928 // point the max kernel key version will be set to that value, creating a 1929 // sliding window of versions that can be rolled back to. 1930 LOG(INFO) << "Rollback is enabled. Setting kernel_max_rollforward to " 1931 << min_kernel_version; 1932 max_kernel_rollforward = min_kernel_version; 1933 } else { 1934 // For devices that are not rollback enabled (ie. consumer devices), the 1935 // max kernel key version is set to 0xfffffffe, which is logically 1936 // infinity. This maintains the previous behavior that that kernel key 1937 // versions roll forward each time they are incremented. 1938 LOG(INFO) << "Rollback is disabled. Setting kernel_max_rollforward to " 1939 << kRollforwardInfinity; 1940 max_kernel_rollforward = kRollforwardInfinity; 1941 } 1942 1943 bool max_rollforward_set = 1944 system_state_->hardware()->SetMaxKernelKeyRollforward( 1945 max_kernel_rollforward); 1946 if (!max_rollforward_set) { 1947 LOG(ERROR) << "Failed to set kernel_max_rollforward"; 1948 } 1949 // Report metrics 1950 system_state_->metrics_reporter()->ReportKeyVersionMetrics( 1951 min_kernel_version, max_kernel_rollforward, max_rollforward_set); 1952 } 1953 1954 base::Time OmahaRequestAction::LoadOrPersistUpdateFirstSeenAtPref() const { 1955 Time update_first_seen_at; 1956 int64_t update_first_seen_at_int; 1957 if (system_state_->prefs()->Exists(kPrefsUpdateFirstSeenAt)) { 1958 if (system_state_->prefs()->GetInt64(kPrefsUpdateFirstSeenAt, 1959 &update_first_seen_at_int)) { 1960 // Note: This timestamp could be that of ANY update we saw in the past 1961 // (not necessarily this particular update we're considering to apply) 1962 // but never got to apply because of some reason (e.g. stop AU policy, 1963 // updates being pulled out from Omaha, changes in target version prefix, 1964 // new update being rolled out, etc.). But for the purposes of scattering 1965 // it doesn't matter which update the timestamp corresponds to. i.e. 1966 // the clock starts ticking the first time we see an update and we're 1967 // ready to apply when the random wait period is satisfied relative to 1968 // that first seen timestamp. 1969 update_first_seen_at = Time::FromInternalValue(update_first_seen_at_int); 1970 LOG(INFO) << "Using persisted value of UpdateFirstSeenAt: " 1971 << utils::ToString(update_first_seen_at); 1972 } else { 1973 // This seems like an unexpected error where the persisted value exists 1974 // but it's not readable for some reason. 1975 LOG(INFO) << "UpdateFirstSeenAt value cannot be read"; 1976 return base::Time(); 1977 } 1978 } else { 1979 update_first_seen_at = system_state_->clock()->GetWallclockTime(); 1980 update_first_seen_at_int = update_first_seen_at.ToInternalValue(); 1981 if (system_state_->prefs()->SetInt64(kPrefsUpdateFirstSeenAt, 1982 update_first_seen_at_int)) { 1983 LOG(INFO) << "Persisted the new value for UpdateFirstSeenAt: " 1984 << utils::ToString(update_first_seen_at); 1985 } else { 1986 // This seems like an unexpected error where the value cannot be 1987 // persisted for some reason. 1988 LOG(INFO) << "UpdateFirstSeenAt value " 1989 << utils::ToString(update_first_seen_at) 1990 << " cannot be persisted"; 1991 return base::Time(); 1992 } 1993 } 1994 return update_first_seen_at; 1995 } 1996 1997 } // namespace chromeos_update_engine 1998