update_engine: Create cros vs. aosp boundary clear
Its time to make the boundary between Chrome OS and Android code more
clear. This CL moves all CrOS only code to "chromeos" directory and the
same for Android (in "android" directory). This way we would easily know
which code is uses in which project and can keep the code cleaner and
more maintainable.
One big remaining problem is download_action* files. It seems like
DownloadAction class does a lot of things that chrome OS needs and it
depends on a lot of Chrome OS stuff, but Android is also using thie
Action in a way that circumvent the Chrome OS stuff. For example Android
checks for SystemState to be nullptr to not do things. This is really
fragile and needs to change. Probably Android Team has to implement
their own DownloadAction of some sort and not re use the Chrome OS one
in a very fragile way.
Removed a few android files that have not been used anywhere.
Changed some clang-format and lint issues in order to pass preupload.
BUG=b:171829801
TEST=cros_workon_make --board reef --test update_engine
Change-Id: I3fff1d4a100a065a5c1484a845241b5521614d9f
Reviewed-on: https://chromium-review.googlesource.com/c/aosp/platform/system/update_engine/+/2508965
Tested-by: Amin Hassani <ahassani@chromium.org>
Auto-Submit: Amin Hassani <ahassani@chromium.org>
Reviewed-by: Jae Hoon Kim <kimjae@chromium.org>
Reviewed-by: Tianjie Xu <xunchang@google.com>
Reviewed-by: Kelvin Zhang <zhangkelvin@google.com>
Commit-Queue: Amin Hassani <ahassani@chromium.org>
diff --git a/cros/omaha_response_handler_action.cc b/cros/omaha_response_handler_action.cc
new file mode 100644
index 0000000..b6c223f
--- /dev/null
+++ b/cros/omaha_response_handler_action.cc
@@ -0,0 +1,334 @@
+//
+// Copyright (C) 2011 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "update_engine/cros/omaha_response_handler_action.h"
+
+#include <limits>
+#include <string>
+
+#include <base/logging.h>
+#include <base/strings/string_number_conversions.h>
+#include <base/version.h>
+#include <policy/device_policy.h>
+
+#include "update_engine/common/constants.h"
+#include "update_engine/common/hardware_interface.h"
+#include "update_engine/common/prefs_interface.h"
+#include "update_engine/common/utils.h"
+#include "update_engine/cros/connection_manager_interface.h"
+#include "update_engine/cros/omaha_request_params.h"
+#include "update_engine/cros/payload_state_interface.h"
+#include "update_engine/payload_consumer/delta_performer.h"
+#include "update_engine/update_manager/policy.h"
+#include "update_engine/update_manager/update_manager.h"
+
+using chromeos_update_manager::kRollforwardInfinity;
+using chromeos_update_manager::Policy;
+using chromeos_update_manager::UpdateManager;
+using std::numeric_limits;
+using std::string;
+
+namespace chromeos_update_engine {
+
+OmahaResponseHandlerAction::OmahaResponseHandlerAction(
+ SystemState* system_state)
+ : system_state_(system_state),
+ deadline_file_(constants::kOmahaResponseDeadlineFile) {}
+
+void OmahaResponseHandlerAction::PerformAction() {
+ CHECK(HasInputObject());
+ ScopedActionCompleter completer(processor_, this);
+ const OmahaResponse& response = GetInputObject();
+ if (!response.update_exists) {
+ LOG(INFO) << "There are no updates. Aborting.";
+ completer.set_code(ErrorCode::kNoUpdate);
+ return;
+ }
+
+ // All decisions as to which URL should be used have already been done. So,
+ // make the current URL as the download URL.
+ string current_url = system_state_->payload_state()->GetCurrentUrl();
+ if (current_url.empty()) {
+ // This shouldn't happen as we should always supply the HTTPS backup URL.
+ // Handling this anyway, just in case.
+ LOG(ERROR) << "There are no suitable URLs in the response to use.";
+ completer.set_code(ErrorCode::kOmahaResponseInvalid);
+ return;
+ }
+
+ // This is the url to the first package, not all packages.
+ // (For updates): All |Action|s prior to this must pass in non-excluded URLs
+ // within the |OmahaResponse|, reference exlusion logic in
+ // |OmahaRequestAction| and keep the enforcement of exclusions for updates.
+ install_plan_.download_url = current_url;
+ install_plan_.version = response.version;
+
+ OmahaRequestParams* const params = system_state_->request_params();
+ PayloadStateInterface* const payload_state = system_state_->payload_state();
+
+ // If we're using p2p to download and there is a local peer, use it.
+ if (payload_state->GetUsingP2PForDownloading() &&
+ !payload_state->GetP2PUrl().empty()) {
+ LOG(INFO) << "Replacing URL " << install_plan_.download_url
+ << " with local URL " << payload_state->GetP2PUrl()
+ << " since p2p is enabled.";
+ install_plan_.download_url = payload_state->GetP2PUrl();
+ payload_state->SetUsingP2PForDownloading(true);
+ }
+
+ // Fill up the other properties based on the response.
+ string update_check_response_hash;
+ for (const auto& package : response.packages) {
+ brillo::Blob raw_hash;
+ if (!base::HexStringToBytes(package.hash, &raw_hash)) {
+ LOG(ERROR) << "Failed to convert payload hash from hex string to bytes: "
+ << package.hash;
+ completer.set_code(ErrorCode::kOmahaResponseInvalid);
+ return;
+ }
+ install_plan_.payloads.push_back(
+ {.payload_urls = package.payload_urls,
+ .size = package.size,
+ .metadata_size = package.metadata_size,
+ .metadata_signature = package.metadata_signature,
+ .hash = raw_hash,
+ .type = package.is_delta ? InstallPayloadType::kDelta
+ : InstallPayloadType::kFull});
+ update_check_response_hash += package.hash + ":";
+ }
+ install_plan_.public_key_rsa = response.public_key_rsa;
+ install_plan_.hash_checks_mandatory = AreHashChecksMandatory(response);
+ install_plan_.is_resume = DeltaPerformer::CanResumeUpdate(
+ system_state_->prefs(), update_check_response_hash);
+ if (install_plan_.is_resume) {
+ payload_state->UpdateResumed();
+ } else {
+ payload_state->UpdateRestarted();
+ LOG_IF(WARNING,
+ !DeltaPerformer::ResetUpdateProgress(system_state_->prefs(), false))
+ << "Unable to reset the update progress.";
+ LOG_IF(WARNING,
+ !system_state_->prefs()->SetString(kPrefsUpdateCheckResponseHash,
+ update_check_response_hash))
+ << "Unable to save the update check response hash.";
+ }
+
+ if (params->is_install()) {
+ install_plan_.target_slot = system_state_->boot_control()->GetCurrentSlot();
+ install_plan_.source_slot = BootControlInterface::kInvalidSlot;
+ } else {
+ install_plan_.source_slot = system_state_->boot_control()->GetCurrentSlot();
+ install_plan_.target_slot = install_plan_.source_slot == 0 ? 1 : 0;
+ }
+
+ // The Omaha response doesn't include the channel name for this image, so we
+ // use the download_channel we used during the request to tag the target slot.
+ // This will be used in the next boot to know the channel the image was
+ // downloaded from.
+ string current_channel_key =
+ kPrefsChannelOnSlotPrefix + std::to_string(install_plan_.target_slot);
+ system_state_->prefs()->SetString(current_channel_key,
+ params->download_channel());
+
+ // Checking whether device is able to boot up the returned rollback image.
+ if (response.is_rollback) {
+ if (!params->rollback_allowed()) {
+ LOG(ERROR) << "Received rollback image but rollback is not allowed.";
+ completer.set_code(ErrorCode::kOmahaResponseInvalid);
+ return;
+ }
+
+ // Calculate the values on the version values on current device.
+ auto min_kernel_key_version = static_cast<uint32_t>(
+ system_state_->hardware()->GetMinKernelKeyVersion());
+ auto min_firmware_key_version = static_cast<uint32_t>(
+ system_state_->hardware()->GetMinFirmwareKeyVersion());
+
+ uint32_t kernel_key_version =
+ static_cast<uint32_t>(response.rollback_key_version.kernel_key) << 16 |
+ static_cast<uint32_t>(response.rollback_key_version.kernel);
+ uint32_t firmware_key_version =
+ static_cast<uint32_t>(response.rollback_key_version.firmware_key)
+ << 16 |
+ static_cast<uint32_t>(response.rollback_key_version.firmware);
+
+ LOG(INFO) << "Rollback image versions:"
+ << " device_kernel_key_version=" << min_kernel_key_version
+ << " image_kernel_key_version=" << kernel_key_version
+ << " device_firmware_key_version=" << min_firmware_key_version
+ << " image_firmware_key_version=" << firmware_key_version;
+
+ // Don't attempt a rollback if the versions are incompatible or the
+ // target image does not specify the version information.
+ if (kernel_key_version == numeric_limits<uint32_t>::max() ||
+ firmware_key_version == numeric_limits<uint32_t>::max() ||
+ kernel_key_version < min_kernel_key_version ||
+ firmware_key_version < min_firmware_key_version) {
+ LOG(ERROR) << "Device won't be able to boot up the rollback image.";
+ completer.set_code(ErrorCode::kRollbackNotPossible);
+ return;
+ }
+ install_plan_.is_rollback = true;
+ install_plan_.rollback_data_save_requested =
+ params->rollback_data_save_requested();
+ }
+
+ // Powerwash if either the response requires it or the parameters indicated
+ // powerwash (usually because there was a channel downgrade) and we are
+ // downgrading the version. Enterprise rollback, indicated by
+ // |response.is_rollback| is dealt with separately above.
+ if (response.powerwash_required) {
+ install_plan_.powerwash_required = true;
+ } else if (params->ShouldPowerwash() && !response.is_rollback) {
+ base::Version new_version(response.version);
+ base::Version current_version(params->app_version());
+
+ if (!new_version.IsValid()) {
+ LOG(WARNING) << "Not powerwashing,"
+ << " the update's version number is unreadable."
+ << " Update's version number: " << response.version;
+ } else if (!current_version.IsValid()) {
+ LOG(WARNING) << "Not powerwashing,"
+ << " the current version number is unreadable."
+ << " Current version number: " << params->app_version();
+ } else if (new_version < current_version) {
+ install_plan_.powerwash_required = true;
+ // Always try to preserve enrollment and wifi data for enrolled devices.
+ install_plan_.rollback_data_save_requested =
+ system_state_ && system_state_->device_policy() &&
+ system_state_->device_policy()->IsEnterpriseEnrolled();
+ }
+ }
+
+ TEST_AND_RETURN(HasOutputPipe());
+ if (HasOutputPipe())
+ SetOutputObject(install_plan_);
+ LOG(INFO) << "Using this install plan:";
+ install_plan_.Dump();
+
+ // Send the deadline data (if any) to Chrome through a file. This is a pretty
+ // hacky solution but should be OK for now.
+ //
+ // TODO(petkov): Re-architect this to avoid communication through a
+ // file. Ideally, we would include this information in D-Bus's GetStatus
+ // method and UpdateStatus signal. A potential issue is that update_engine may
+ // be unresponsive during an update download.
+ if (!deadline_file_.empty()) {
+ if (payload_state->GetRollbackHappened()) {
+ // Don't do forced update if rollback has happened since the last update
+ // check where policy was present.
+ LOG(INFO) << "Not forcing update because a rollback happened.";
+ utils::WriteFile(deadline_file_.c_str(), nullptr, 0);
+ } else {
+ utils::WriteFile(deadline_file_.c_str(),
+ response.deadline.data(),
+ response.deadline.size());
+ }
+ chmod(deadline_file_.c_str(), S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+ }
+
+ // Check the generated install-plan with the Policy to confirm that
+ // it can be applied at this time (or at all).
+ UpdateManager* const update_manager = system_state_->update_manager();
+ CHECK(update_manager);
+ auto ec = ErrorCode::kSuccess;
+ update_manager->PolicyRequest(
+ &Policy::UpdateCanBeApplied, &ec, &install_plan_);
+ completer.set_code(ec);
+
+ const auto allowed_milestones = params->rollback_allowed_milestones();
+ if (allowed_milestones > 0) {
+ auto max_firmware_rollforward = numeric_limits<uint32_t>::max();
+ auto max_kernel_rollforward = numeric_limits<uint32_t>::max();
+
+ // Determine the version to update the max rollforward verified boot
+ // value.
+ OmahaResponse::RollbackKeyVersion version =
+ response.past_rollback_key_version;
+
+ // Determine the max rollforward values to be set in the TPM.
+ max_firmware_rollforward = static_cast<uint32_t>(version.firmware_key)
+ << 16 |
+ static_cast<uint32_t>(version.firmware);
+ max_kernel_rollforward = static_cast<uint32_t>(version.kernel_key) << 16 |
+ static_cast<uint32_t>(version.kernel);
+
+ // In the case that the value is 0xffffffff, log a warning because the
+ // device should not be installing a rollback image without having version
+ // information.
+ if (max_firmware_rollforward == numeric_limits<uint32_t>::max() ||
+ max_kernel_rollforward == numeric_limits<uint32_t>::max()) {
+ LOG(WARNING)
+ << "Max rollforward values were not sent in rollback response: "
+ << " max_kernel_rollforward=" << max_kernel_rollforward
+ << " max_firmware_rollforward=" << max_firmware_rollforward
+ << " rollback_allowed_milestones="
+ << params->rollback_allowed_milestones();
+ } else {
+ LOG(INFO) << "Setting the max rollforward values: "
+ << " max_kernel_rollforward=" << max_kernel_rollforward
+ << " max_firmware_rollforward=" << max_firmware_rollforward
+ << " rollback_allowed_milestones="
+ << params->rollback_allowed_milestones();
+ system_state_->hardware()->SetMaxKernelKeyRollforward(
+ max_kernel_rollforward);
+ // TODO(crbug/783998): Set max firmware rollforward when implemented.
+ }
+ } else {
+ LOG(INFO) << "Rollback is not allowed. Setting max rollforward values"
+ << " to infinity";
+ // When rollback is not allowed, explicitly set the max roll forward to
+ // infinity.
+ system_state_->hardware()->SetMaxKernelKeyRollforward(kRollforwardInfinity);
+ // TODO(crbug/783998): Set max firmware rollforward when implemented.
+ }
+}
+
+bool OmahaResponseHandlerAction::AreHashChecksMandatory(
+ const OmahaResponse& response) {
+ // We sometimes need to waive the hash checks in order to download from
+ // sources that don't provide hashes, such as dev server.
+ // At this point UpdateAttempter::IsAnyUpdateSourceAllowed() has already been
+ // checked, so an unofficial update URL won't get this far unless it's OK to
+ // use without a hash. Additionally, we want to always waive hash checks on
+ // unofficial builds (i.e. dev/test images).
+ // The end result is this:
+ // * Base image:
+ // - Official URLs require a hash.
+ // - Unofficial URLs only get this far if the IsAnyUpdateSourceAllowed()
+ // devmode/debugd checks pass, in which case the hash is waived.
+ // * Dev/test image:
+ // - Any URL is allowed through with no hash checking.
+ if (!system_state_->request_params()->IsUpdateUrlOfficial() ||
+ !system_state_->hardware()->IsOfficialBuild()) {
+ // Still do a hash check if a public key is included.
+ if (!response.public_key_rsa.empty()) {
+ // The autoupdate_CatchBadSignatures test checks for this string
+ // in log-files. Keep in sync.
+ LOG(INFO) << "Mandating payload hash checks since Omaha Response "
+ << "for unofficial build includes public RSA key.";
+ return true;
+ } else {
+ LOG(INFO) << "Waiving payload hash checks for unofficial update URL.";
+ return false;
+ }
+ }
+
+ LOG(INFO) << "Mandating hash checks for official URL on official build.";
+ return true;
+}
+
+} // namespace chromeos_update_engine