1//
2// Copyright (C) 2012 The Android Open Source Project
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8//      http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15//
16
17#include "update_engine/update_attempter.h"
18
19#include <stdint.h>
20
21#include <algorithm>
22#include <memory>
23#include <set>
24#include <string>
25#include <utility>
26#include <vector>
27
28#include <base/bind.h>
29#include <base/files/file_util.h>
30#include <base/logging.h>
31#include <base/rand_util.h>
32#include <base/strings/string_util.h>
33#include <base/strings/stringprintf.h>
34#include <brillo/bind_lambda.h>
35#include <brillo/make_unique_ptr.h>
36#include <brillo/message_loops/message_loop.h>
37#include <debugd/dbus-constants.h>
38#include <policy/device_policy.h>
39#include <policy/libpolicy.h>
40#include <power_manager/dbus-constants.h>
41#include <power_manager/dbus-proxies.h>
42#include <update_engine/dbus-constants.h>
43
44#include "update_engine/certificate_checker.h"
45#include "update_engine/common/boot_control_interface.h"
46#include "update_engine/common/clock_interface.h"
47#include "update_engine/common/constants.h"
48#include "update_engine/common/hardware_interface.h"
49#include "update_engine/common/multi_range_http_fetcher.h"
50#include "update_engine/common/platform_constants.h"
51#include "update_engine/common/prefs_interface.h"
52#include "update_engine/common/subprocess.h"
53#include "update_engine/common/utils.h"
54#include "update_engine/dbus_service.h"
55#include "update_engine/libcurl_http_fetcher.h"
56#include "update_engine/metrics.h"
57#include "update_engine/omaha_request_action.h"
58#include "update_engine/omaha_request_params.h"
59#include "update_engine/omaha_response_handler_action.h"
60#include "update_engine/p2p_manager.h"
61#include "update_engine/payload_consumer/download_action.h"
62#include "update_engine/payload_consumer/filesystem_verifier_action.h"
63#include "update_engine/payload_consumer/postinstall_runner_action.h"
64#include "update_engine/payload_state_interface.h"
65#include "update_engine/system_state.h"
66#include "update_engine/update_manager/policy.h"
67#include "update_engine/update_manager/update_manager.h"
68#include "update_engine/update_status_utils.h"
69
70using base::Bind;
71using base::Callback;
72using base::Time;
73using base::TimeDelta;
74using base::TimeTicks;
75using brillo::MessageLoop;
76using chromeos_update_manager::EvalStatus;
77using chromeos_update_manager::Policy;
78using chromeos_update_manager::UpdateCheckParams;
79using std::set;
80using std::shared_ptr;
81using std::string;
82using std::vector;
83
84namespace chromeos_update_engine {
85
86const int UpdateAttempter::kMaxDeltaUpdateFailures = 3;
87
88namespace {
89const int kMaxConsecutiveObeyProxyRequests = 20;
90
91// Minimum threshold to broadcast an status update in progress and time.
92const double kBroadcastThresholdProgress = 0.01;  // 1%
93const int kBroadcastThresholdSeconds = 10;
94
95// By default autest bypasses scattering. If we want to test scattering,
96// use kScheduledAUTestURLRequest. The URL used is same in both cases, but
97// different params are passed to CheckForUpdate().
98const char kAUTestURLRequest[] = "autest";
99const char kScheduledAUTestURLRequest[] = "autest-scheduled";
100}  // namespace
101
102// Turns a generic ErrorCode::kError to a generic error code specific
103// to |action| (e.g., ErrorCode::kFilesystemVerifierError). If |code| is
104// not ErrorCode::kError, or the action is not matched, returns |code|
105// unchanged.
106ErrorCode GetErrorCodeForAction(AbstractAction* action,
107                                     ErrorCode code) {
108  if (code != ErrorCode::kError)
109    return code;
110
111  const string type = action->Type();
112  if (type == OmahaRequestAction::StaticType())
113    return ErrorCode::kOmahaRequestError;
114  if (type == OmahaResponseHandlerAction::StaticType())
115    return ErrorCode::kOmahaResponseHandlerError;
116  if (type == FilesystemVerifierAction::StaticType())
117    return ErrorCode::kFilesystemVerifierError;
118  if (type == PostinstallRunnerAction::StaticType())
119    return ErrorCode::kPostinstallRunnerError;
120
121  return code;
122}
123
124UpdateAttempter::UpdateAttempter(
125    SystemState* system_state,
126    CertificateChecker* cert_checker,
127    LibCrosProxy* libcros_proxy,
128    org::chromium::debugdProxyInterface* debugd_proxy)
129    : processor_(new ActionProcessor()),
130      system_state_(system_state),
131      cert_checker_(cert_checker),
132#if USE_LIBCROS
133      chrome_proxy_resolver_(libcros_proxy),
134#endif  // USE_LIBCROS
135      debugd_proxy_(debugd_proxy) {
136}
137
138UpdateAttempter::~UpdateAttempter() {
139  // CertificateChecker might not be initialized in unittests.
140  if (cert_checker_)
141    cert_checker_->SetObserver(nullptr);
142  // Release ourselves as the ActionProcessor's delegate to prevent
143  // re-scheduling the updates due to the processing stopped.
144  processor_->set_delegate(nullptr);
145}
146
147void UpdateAttempter::Init() {
148  // Pulling from the SystemState can only be done after construction, since
149  // this is an aggregate of various objects (such as the UpdateAttempter),
150  // which requires them all to be constructed prior to it being used.
151  prefs_ = system_state_->prefs();
152  omaha_request_params_ = system_state_->request_params();
153
154  if (cert_checker_)
155    cert_checker_->SetObserver(this);
156
157  // In case of update_engine restart without a reboot we need to restore the
158  // reboot needed state.
159  if (GetBootTimeAtUpdate(nullptr))
160    status_ = UpdateStatus::UPDATED_NEED_REBOOT;
161  else
162    status_ = UpdateStatus::IDLE;
163
164#if USE_LIBCROS
165  chrome_proxy_resolver_.Init();
166#endif  // USE_LIBCROS
167}
168
169void UpdateAttempter::ScheduleUpdates() {
170  if (IsUpdateRunningOrScheduled())
171    return;
172
173  chromeos_update_manager::UpdateManager* const update_manager =
174      system_state_->update_manager();
175  CHECK(update_manager);
176  Callback<void(EvalStatus, const UpdateCheckParams&)> callback = Bind(
177      &UpdateAttempter::OnUpdateScheduled, base::Unretained(this));
178  // We limit the async policy request to a reasonably short time, to avoid a
179  // starvation due to a transient bug.
180  update_manager->AsyncPolicyRequest(callback, &Policy::UpdateCheckAllowed);
181  waiting_for_scheduled_check_ = true;
182}
183
184void UpdateAttempter::CertificateChecked(ServerToCheck server_to_check,
185                                         CertificateCheckResult result) {
186  metrics::ReportCertificateCheckMetrics(system_state_,
187                                         server_to_check,
188                                         result);
189}
190
191bool UpdateAttempter::CheckAndReportDailyMetrics() {
192  int64_t stored_value;
193  Time now = system_state_->clock()->GetWallclockTime();
194  if (system_state_->prefs()->Exists(kPrefsDailyMetricsLastReportedAt) &&
195      system_state_->prefs()->GetInt64(kPrefsDailyMetricsLastReportedAt,
196                                       &stored_value)) {
197    Time last_reported_at = Time::FromInternalValue(stored_value);
198    TimeDelta time_reported_since = now - last_reported_at;
199    if (time_reported_since.InSeconds() < 0) {
200      LOG(WARNING) << "Last reported daily metrics "
201                   << utils::FormatTimeDelta(time_reported_since) << " ago "
202                   << "which is negative. Either the system clock is wrong or "
203                   << "the kPrefsDailyMetricsLastReportedAt state variable "
204                   << "is wrong.";
205      // In this case, report daily metrics to reset.
206    } else {
207      if (time_reported_since.InSeconds() < 24*60*60) {
208        LOG(INFO) << "Last reported daily metrics "
209                  << utils::FormatTimeDelta(time_reported_since) << " ago.";
210        return false;
211      }
212      LOG(INFO) << "Last reported daily metrics "
213                << utils::FormatTimeDelta(time_reported_since) << " ago, "
214                << "which is more than 24 hours ago.";
215    }
216  }
217
218  LOG(INFO) << "Reporting daily metrics.";
219  system_state_->prefs()->SetInt64(kPrefsDailyMetricsLastReportedAt,
220                                   now.ToInternalValue());
221
222  ReportOSAge();
223
224  return true;
225}
226
227void UpdateAttempter::ReportOSAge() {
228  struct stat sb;
229
230  if (system_state_ == nullptr)
231    return;
232
233  if (stat("/etc/lsb-release", &sb) != 0) {
234    PLOG(ERROR) << "Error getting file status for /etc/lsb-release "
235                << "(Note: this may happen in some unit tests)";
236    return;
237  }
238
239  Time lsb_release_timestamp = utils::TimeFromStructTimespec(&sb.st_ctim);
240  Time now = system_state_->clock()->GetWallclockTime();
241  TimeDelta age = now - lsb_release_timestamp;
242  if (age.InSeconds() < 0) {
243    LOG(ERROR) << "The OS age (" << utils::FormatTimeDelta(age)
244               << ") is negative. Maybe the clock is wrong? "
245               << "(Note: this may happen in some unit tests.)";
246    return;
247  }
248
249  metrics::ReportDailyMetrics(system_state_, age);
250}
251
252void UpdateAttempter::Update(const string& app_version,
253                             const string& omaha_url,
254                             const string& target_channel,
255                             const string& target_version_prefix,
256                             bool obey_proxies,
257                             bool interactive) {
258  // This is normally called frequently enough so it's appropriate to use as a
259  // hook for reporting daily metrics.
260  // TODO(garnold) This should be hooked to a separate (reliable and consistent)
261  // timeout event.
262  CheckAndReportDailyMetrics();
263
264  // Notify of the new update attempt, clearing prior interactive requests.
265  if (forced_update_pending_callback_.get())
266    forced_update_pending_callback_->Run(false, false);
267
268  fake_update_success_ = false;
269  if (status_ == UpdateStatus::UPDATED_NEED_REBOOT) {
270    // Although we have applied an update, we still want to ping Omaha
271    // to ensure the number of active statistics is accurate.
272    //
273    // Also convey to the UpdateEngine.Check.Result metric that we're
274    // not performing an update check because of this.
275    LOG(INFO) << "Not updating b/c we already updated and we're waiting for "
276              << "reboot, we'll ping Omaha instead";
277    metrics::ReportUpdateCheckMetrics(system_state_,
278                                      metrics::CheckResult::kRebootPending,
279                                      metrics::CheckReaction::kUnset,
280                                      metrics::DownloadErrorCode::kUnset);
281    PingOmaha();
282    return;
283  }
284  if (status_ != UpdateStatus::IDLE) {
285    // Update in progress. Do nothing
286    return;
287  }
288
289  if (!CalculateUpdateParams(app_version,
290                             omaha_url,
291                             target_channel,
292                             target_version_prefix,
293                             obey_proxies,
294                             interactive)) {
295    return;
296  }
297
298  BuildUpdateActions(interactive);
299
300  SetStatusAndNotify(UpdateStatus::CHECKING_FOR_UPDATE);
301
302  // Update the last check time here; it may be re-updated when an Omaha
303  // response is received, but this will prevent us from repeatedly scheduling
304  // checks in the case where a response is not received.
305  UpdateLastCheckedTime();
306
307  // Just in case we didn't update boot flags yet, make sure they're updated
308  // before any update processing starts.
309  start_action_processor_ = true;
310  UpdateBootFlags();
311}
312
313void UpdateAttempter::RefreshDevicePolicy() {
314  // Lazy initialize the policy provider, or reload the latest policy data.
315  if (!policy_provider_.get())
316    policy_provider_.reset(new policy::PolicyProvider());
317  policy_provider_->Reload();
318
319  const policy::DevicePolicy* device_policy = nullptr;
320  if (policy_provider_->device_policy_is_loaded())
321    device_policy = &policy_provider_->GetDevicePolicy();
322
323  if (device_policy)
324    LOG(INFO) << "Device policies/settings present";
325  else
326    LOG(INFO) << "No device policies/settings present.";
327
328  system_state_->set_device_policy(device_policy);
329  system_state_->p2p_manager()->SetDevicePolicy(device_policy);
330}
331
332void UpdateAttempter::CalculateP2PParams(bool interactive) {
333  bool use_p2p_for_downloading = false;
334  bool use_p2p_for_sharing = false;
335
336  // Never use p2p for downloading in interactive checks unless the
337  // developer has opted in for it via a marker file.
338  //
339  // (Why would a developer want to opt in? If he's working on the
340  // update_engine or p2p codebases so he can actually test his
341  // code.).
342
343  if (system_state_ != nullptr) {
344    if (!system_state_->p2p_manager()->IsP2PEnabled()) {
345      LOG(INFO) << "p2p is not enabled - disallowing p2p for both"
346                << " downloading and sharing.";
347    } else {
348      // Allow p2p for sharing, even in interactive checks.
349      use_p2p_for_sharing = true;
350      if (!interactive) {
351        LOG(INFO) << "Non-interactive check - allowing p2p for downloading";
352        use_p2p_for_downloading = true;
353      } else {
354        LOG(INFO) << "Forcibly disabling use of p2p for downloading "
355                  << "since this update attempt is interactive.";
356      }
357    }
358  }
359
360  PayloadStateInterface* const payload_state = system_state_->payload_state();
361  payload_state->SetUsingP2PForDownloading(use_p2p_for_downloading);
362  payload_state->SetUsingP2PForSharing(use_p2p_for_sharing);
363}
364
365bool UpdateAttempter::CalculateUpdateParams(const string& app_version,
366                                            const string& omaha_url,
367                                            const string& target_channel,
368                                            const string& target_version_prefix,
369                                            bool obey_proxies,
370                                            bool interactive) {
371  http_response_code_ = 0;
372  PayloadStateInterface* const payload_state = system_state_->payload_state();
373
374  // Refresh the policy before computing all the update parameters.
375  RefreshDevicePolicy();
376
377  // Set the target version prefix, if provided.
378  if (!target_version_prefix.empty())
379    omaha_request_params_->set_target_version_prefix(target_version_prefix);
380
381  CalculateScatteringParams(interactive);
382
383  CalculateP2PParams(interactive);
384  if (payload_state->GetUsingP2PForDownloading() ||
385      payload_state->GetUsingP2PForSharing()) {
386    // OK, p2p is to be used - start it and perform housekeeping.
387    if (!StartP2PAndPerformHousekeeping()) {
388      // If this fails, disable p2p for this attempt
389      LOG(INFO) << "Forcibly disabling use of p2p since starting p2p or "
390                << "performing housekeeping failed.";
391      payload_state->SetUsingP2PForDownloading(false);
392      payload_state->SetUsingP2PForSharing(false);
393    }
394  }
395
396  if (!omaha_request_params_->Init(app_version,
397                                   omaha_url,
398                                   interactive)) {
399    LOG(ERROR) << "Unable to initialize Omaha request params.";
400    return false;
401  }
402
403  // Set the target channel, if one was provided.
404  if (target_channel.empty()) {
405    LOG(INFO) << "No target channel mandated by policy.";
406  } else {
407    LOG(INFO) << "Setting target channel as mandated: " << target_channel;
408    // Pass in false for powerwash_allowed until we add it to the policy
409    // protobuf.
410    string error_message;
411    if (!omaha_request_params_->SetTargetChannel(target_channel, false,
412                                                 &error_message)) {
413      LOG(ERROR) << "Setting the channel failed: " << error_message;
414    }
415    // Notify observers the target channel change.
416    BroadcastChannel();
417
418    // Since this is the beginning of a new attempt, update the download
419    // channel. The download channel won't be updated until the next attempt,
420    // even if target channel changes meanwhile, so that how we'll know if we
421    // should cancel the current download attempt if there's such a change in
422    // target channel.
423    omaha_request_params_->UpdateDownloadChannel();
424  }
425
426  LOG(INFO) << "target_version_prefix = "
427            << omaha_request_params_->target_version_prefix()
428            << ", scatter_factor_in_seconds = "
429            << utils::FormatSecs(scatter_factor_.InSeconds());
430
431  LOG(INFO) << "Wall Clock Based Wait Enabled = "
432            << omaha_request_params_->wall_clock_based_wait_enabled()
433            << ", Update Check Count Wait Enabled = "
434            << omaha_request_params_->update_check_count_wait_enabled()
435            << ", Waiting Period = " << utils::FormatSecs(
436               omaha_request_params_->waiting_period().InSeconds());
437
438  LOG(INFO) << "Use p2p For Downloading = "
439            << payload_state->GetUsingP2PForDownloading()
440            << ", Use p2p For Sharing = "
441            << payload_state->GetUsingP2PForSharing();
442
443  obeying_proxies_ = true;
444  if (obey_proxies || proxy_manual_checks_ == 0) {
445    LOG(INFO) << "forced to obey proxies";
446    // If forced to obey proxies, every 20th request will not use proxies
447    proxy_manual_checks_++;
448    LOG(INFO) << "proxy manual checks: " << proxy_manual_checks_;
449    if (proxy_manual_checks_ >= kMaxConsecutiveObeyProxyRequests) {
450      proxy_manual_checks_ = 0;
451      obeying_proxies_ = false;
452    }
453  } else if (base::RandInt(0, 4) == 0) {
454    obeying_proxies_ = false;
455  }
456  LOG_IF(INFO, !obeying_proxies_) << "To help ensure updates work, this update "
457      "check we are ignoring the proxy settings and using "
458      "direct connections.";
459
460  DisableDeltaUpdateIfNeeded();
461  return true;
462}
463
464void UpdateAttempter::CalculateScatteringParams(bool interactive) {
465  // Take a copy of the old scatter value before we update it, as
466  // we need to update the waiting period if this value changes.
467  TimeDelta old_scatter_factor = scatter_factor_;
468  const policy::DevicePolicy* device_policy = system_state_->device_policy();
469  if (device_policy) {
470    int64_t new_scatter_factor_in_secs = 0;
471    device_policy->GetScatterFactorInSeconds(&new_scatter_factor_in_secs);
472    if (new_scatter_factor_in_secs < 0)  // sanitize input, just in case.
473      new_scatter_factor_in_secs  = 0;
474    scatter_factor_ = TimeDelta::FromSeconds(new_scatter_factor_in_secs);
475  }
476
477  bool is_scatter_enabled = false;
478  if (scatter_factor_.InSeconds() == 0) {
479    LOG(INFO) << "Scattering disabled since scatter factor is set to 0";
480  } else if (interactive) {
481    LOG(INFO) << "Scattering disabled as this is an interactive update check";
482  } else if (!system_state_->hardware()->IsOOBEComplete(nullptr)) {
483    LOG(INFO) << "Scattering disabled since OOBE is not complete yet";
484  } else {
485    is_scatter_enabled = true;
486    LOG(INFO) << "Scattering is enabled";
487  }
488
489  if (is_scatter_enabled) {
490    // This means the scattering policy is turned on.
491    // Now check if we need to update the waiting period. The two cases
492    // in which we'd need to update the waiting period are:
493    // 1. First time in process or a scheduled check after a user-initiated one.
494    //    (omaha_request_params_->waiting_period will be zero in this case).
495    // 2. Admin has changed the scattering policy value.
496    //    (new scattering value will be different from old one in this case).
497    int64_t wait_period_in_secs = 0;
498    if (omaha_request_params_->waiting_period().InSeconds() == 0) {
499      // First case. Check if we have a suitable value to set for
500      // the waiting period.
501      if (prefs_->GetInt64(kPrefsWallClockWaitPeriod, &wait_period_in_secs) &&
502          wait_period_in_secs > 0 &&
503          wait_period_in_secs <= scatter_factor_.InSeconds()) {
504        // This means:
505        // 1. There's a persisted value for the waiting period available.
506        // 2. And that persisted value is still valid.
507        // So, in this case, we should reuse the persisted value instead of
508        // generating a new random value to improve the chances of a good
509        // distribution for scattering.
510        omaha_request_params_->set_waiting_period(
511          TimeDelta::FromSeconds(wait_period_in_secs));
512        LOG(INFO) << "Using persisted wall-clock waiting period: " <<
513            utils::FormatSecs(
514                omaha_request_params_->waiting_period().InSeconds());
515      } else {
516        // This means there's no persisted value for the waiting period
517        // available or its value is invalid given the new scatter_factor value.
518        // So, we should go ahead and regenerate a new value for the
519        // waiting period.
520        LOG(INFO) << "Persisted value not present or not valid ("
521                  << utils::FormatSecs(wait_period_in_secs)
522                  << ") for wall-clock waiting period.";
523        GenerateNewWaitingPeriod();
524      }
525    } else if (scatter_factor_ != old_scatter_factor) {
526      // This means there's already a waiting period value, but we detected
527      // a change in the scattering policy value. So, we should regenerate the
528      // waiting period to make sure it's within the bounds of the new scatter
529      // factor value.
530      GenerateNewWaitingPeriod();
531    } else {
532      // Neither the first time scattering is enabled nor the scattering value
533      // changed. Nothing to do.
534      LOG(INFO) << "Keeping current wall-clock waiting period: " <<
535          utils::FormatSecs(
536              omaha_request_params_->waiting_period().InSeconds());
537    }
538
539    // The invariant at this point is that omaha_request_params_->waiting_period
540    // is non-zero no matter which path we took above.
541    LOG_IF(ERROR, omaha_request_params_->waiting_period().InSeconds() == 0)
542        << "Waiting Period should NOT be zero at this point!!!";
543
544    // Since scattering is enabled, wall clock based wait will always be
545    // enabled.
546    omaha_request_params_->set_wall_clock_based_wait_enabled(true);
547
548    // If we don't have any issues in accessing the file system to update
549    // the update check count value, we'll turn that on as well.
550    bool decrement_succeeded = DecrementUpdateCheckCount();
551    omaha_request_params_->set_update_check_count_wait_enabled(
552      decrement_succeeded);
553  } else {
554    // This means the scattering feature is turned off or disabled for
555    // this particular update check. Make sure to disable
556    // all the knobs and artifacts so that we don't invoke any scattering
557    // related code.
558    omaha_request_params_->set_wall_clock_based_wait_enabled(false);
559    omaha_request_params_->set_update_check_count_wait_enabled(false);
560    omaha_request_params_->set_waiting_period(TimeDelta::FromSeconds(0));
561    prefs_->Delete(kPrefsWallClockWaitPeriod);
562    prefs_->Delete(kPrefsUpdateCheckCount);
563    // Don't delete the UpdateFirstSeenAt file as we don't want manual checks
564    // that result in no-updates (e.g. due to server side throttling) to
565    // cause update starvation by having the client generate a new
566    // UpdateFirstSeenAt for each scheduled check that follows a manual check.
567  }
568}
569
570void UpdateAttempter::GenerateNewWaitingPeriod() {
571  omaha_request_params_->set_waiting_period(TimeDelta::FromSeconds(
572      base::RandInt(1, scatter_factor_.InSeconds())));
573
574  LOG(INFO) << "Generated new wall-clock waiting period: " << utils::FormatSecs(
575                omaha_request_params_->waiting_period().InSeconds());
576
577  // Do a best-effort to persist this in all cases. Even if the persistence
578  // fails, we'll still be able to scatter based on our in-memory value.
579  // The persistence only helps in ensuring a good overall distribution
580  // across multiple devices if they tend to reboot too often.
581  system_state_->payload_state()->SetScatteringWaitPeriod(
582      omaha_request_params_->waiting_period());
583}
584
585void UpdateAttempter::BuildPostInstallActions(
586    InstallPlanAction* previous_action) {
587  shared_ptr<PostinstallRunnerAction> postinstall_runner_action(
588      new PostinstallRunnerAction(system_state_->boot_control(),
589                                  system_state_->hardware()));
590  postinstall_runner_action->set_delegate(this);
591  actions_.push_back(shared_ptr<AbstractAction>(postinstall_runner_action));
592  BondActions(previous_action,
593              postinstall_runner_action.get());
594}
595
596void UpdateAttempter::BuildUpdateActions(bool interactive) {
597  CHECK(!processor_->IsRunning());
598  processor_->set_delegate(this);
599
600  // Actions:
601  std::unique_ptr<LibcurlHttpFetcher> update_check_fetcher(
602      new LibcurlHttpFetcher(GetProxyResolver(), system_state_->hardware()));
603  update_check_fetcher->set_server_to_check(ServerToCheck::kUpdate);
604  // Try harder to connect to the network, esp when not interactive.
605  // See comment in libcurl_http_fetcher.cc.
606  update_check_fetcher->set_no_network_max_retries(interactive ? 1 : 3);
607  shared_ptr<OmahaRequestAction> update_check_action(
608      new OmahaRequestAction(system_state_,
609                             nullptr,
610                             std::move(update_check_fetcher),
611                             false));
612  shared_ptr<OmahaResponseHandlerAction> response_handler_action(
613      new OmahaResponseHandlerAction(system_state_));
614  shared_ptr<FilesystemVerifierAction> src_filesystem_verifier_action(
615      new FilesystemVerifierAction(system_state_->boot_control(),
616                                   VerifierMode::kComputeSourceHash));
617
618  shared_ptr<OmahaRequestAction> download_started_action(
619      new OmahaRequestAction(system_state_,
620                             new OmahaEvent(
621                                 OmahaEvent::kTypeUpdateDownloadStarted),
622                             brillo::make_unique_ptr(new LibcurlHttpFetcher(
623                                 GetProxyResolver(),
624                                 system_state_->hardware())),
625                             false));
626
627  LibcurlHttpFetcher* download_fetcher =
628      new LibcurlHttpFetcher(GetProxyResolver(), system_state_->hardware());
629  download_fetcher->set_server_to_check(ServerToCheck::kDownload);
630  shared_ptr<DownloadAction> download_action(new DownloadAction(
631      prefs_,
632      system_state_->boot_control(),
633      system_state_->hardware(),
634      system_state_,
635      new MultiRangeHttpFetcher(download_fetcher)));  // passes ownership
636  shared_ptr<OmahaRequestAction> download_finished_action(
637      new OmahaRequestAction(
638          system_state_,
639          new OmahaEvent(OmahaEvent::kTypeUpdateDownloadFinished),
640          brillo::make_unique_ptr(
641              new LibcurlHttpFetcher(GetProxyResolver(),
642                                     system_state_->hardware())),
643          false));
644  shared_ptr<FilesystemVerifierAction> dst_filesystem_verifier_action(
645      new FilesystemVerifierAction(system_state_->boot_control(),
646                                   VerifierMode::kVerifyTargetHash));
647  shared_ptr<OmahaRequestAction> update_complete_action(
648      new OmahaRequestAction(
649          system_state_,
650          new OmahaEvent(OmahaEvent::kTypeUpdateComplete),
651          brillo::make_unique_ptr(
652              new LibcurlHttpFetcher(GetProxyResolver(),
653                                     system_state_->hardware())),
654          false));
655
656  download_action->set_delegate(this);
657  response_handler_action_ = response_handler_action;
658  download_action_ = download_action;
659
660  actions_.push_back(shared_ptr<AbstractAction>(update_check_action));
661  actions_.push_back(shared_ptr<AbstractAction>(response_handler_action));
662  actions_.push_back(shared_ptr<AbstractAction>(
663      src_filesystem_verifier_action));
664  actions_.push_back(shared_ptr<AbstractAction>(download_started_action));
665  actions_.push_back(shared_ptr<AbstractAction>(download_action));
666  actions_.push_back(shared_ptr<AbstractAction>(download_finished_action));
667  actions_.push_back(shared_ptr<AbstractAction>(
668      dst_filesystem_verifier_action));
669
670  // Bond them together. We have to use the leaf-types when calling
671  // BondActions().
672  BondActions(update_check_action.get(),
673              response_handler_action.get());
674  BondActions(response_handler_action.get(),
675              src_filesystem_verifier_action.get());
676  BondActions(src_filesystem_verifier_action.get(),
677              download_action.get());
678  BondActions(download_action.get(),
679              dst_filesystem_verifier_action.get());
680  BuildPostInstallActions(dst_filesystem_verifier_action.get());
681
682  actions_.push_back(shared_ptr<AbstractAction>(update_complete_action));
683
684  // Enqueue the actions
685  for (const shared_ptr<AbstractAction>& action : actions_) {
686    processor_->EnqueueAction(action.get());
687  }
688}
689
690bool UpdateAttempter::Rollback(bool powerwash) {
691  if (!CanRollback()) {
692    return false;
693  }
694
695  // Extra check for enterprise-enrolled devices since they don't support
696  // powerwash.
697  if (powerwash) {
698    // Enterprise-enrolled devices have an empty owner in their device policy.
699    string owner;
700    RefreshDevicePolicy();
701    const policy::DevicePolicy* device_policy = system_state_->device_policy();
702    if (device_policy && (!device_policy->GetOwner(&owner) || owner.empty())) {
703      LOG(ERROR) << "Enterprise device detected. "
704                 << "Cannot perform a powerwash for enterprise devices.";
705      return false;
706    }
707  }
708
709  processor_->set_delegate(this);
710
711  // Initialize the default request params.
712  if (!omaha_request_params_->Init("", "", true)) {
713    LOG(ERROR) << "Unable to initialize Omaha request params.";
714    return false;
715  }
716
717  LOG(INFO) << "Setting rollback options.";
718  InstallPlan install_plan;
719
720  install_plan.target_slot = GetRollbackSlot();
721  install_plan.source_slot = system_state_->boot_control()->GetCurrentSlot();
722
723  TEST_AND_RETURN_FALSE(
724      install_plan.LoadPartitionsFromSlots(system_state_->boot_control()));
725  install_plan.powerwash_required = powerwash;
726
727  LOG(INFO) << "Using this install plan:";
728  install_plan.Dump();
729
730  shared_ptr<InstallPlanAction> install_plan_action(
731      new InstallPlanAction(install_plan));
732  actions_.push_back(shared_ptr<AbstractAction>(install_plan_action));
733
734  BuildPostInstallActions(install_plan_action.get());
735
736  // Enqueue the actions
737  for (const shared_ptr<AbstractAction>& action : actions_) {
738    processor_->EnqueueAction(action.get());
739  }
740
741  // Update the payload state for Rollback.
742  system_state_->payload_state()->Rollback();
743
744  SetStatusAndNotify(UpdateStatus::ATTEMPTING_ROLLBACK);
745
746  // Just in case we didn't update boot flags yet, make sure they're updated
747  // before any update processing starts. This also schedules the start of the
748  // actions we just posted.
749  start_action_processor_ = true;
750  UpdateBootFlags();
751  return true;
752}
753
754bool UpdateAttempter::CanRollback() const {
755  // We can only rollback if the update_engine isn't busy and we have a valid
756  // rollback partition.
757  return (status_ == UpdateStatus::IDLE &&
758          GetRollbackSlot() != BootControlInterface::kInvalidSlot);
759}
760
761BootControlInterface::Slot UpdateAttempter::GetRollbackSlot() const {
762  LOG(INFO) << "UpdateAttempter::GetRollbackSlot";
763  const unsigned int num_slots = system_state_->boot_control()->GetNumSlots();
764  const BootControlInterface::Slot current_slot =
765      system_state_->boot_control()->GetCurrentSlot();
766
767  LOG(INFO) << "  Installed slots: " << num_slots;
768  LOG(INFO) << "  Booted from slot: "
769            << BootControlInterface::SlotName(current_slot);
770
771  if (current_slot == BootControlInterface::kInvalidSlot || num_slots < 2) {
772    LOG(INFO) << "Device is not updateable.";
773    return BootControlInterface::kInvalidSlot;
774  }
775
776  vector<BootControlInterface::Slot> bootable_slots;
777  for (BootControlInterface::Slot slot = 0; slot < num_slots; slot++) {
778    if (slot != current_slot &&
779        system_state_->boot_control()->IsSlotBootable(slot)) {
780      LOG(INFO) << "Found bootable slot "
781                << BootControlInterface::SlotName(slot);
782      return slot;
783    }
784  }
785  LOG(INFO) << "No other bootable slot found.";
786  return BootControlInterface::kInvalidSlot;
787}
788
789void UpdateAttempter::CheckForUpdate(const string& app_version,
790                                     const string& omaha_url,
791                                     bool interactive) {
792  LOG(INFO) << "Forced update check requested.";
793  forced_app_version_.clear();
794  forced_omaha_url_.clear();
795
796  // Certain conditions must be met to allow setting custom version and update
797  // server URLs. However, kScheduledAUTestURLRequest and kAUTestURLRequest are
798  // always allowed regardless of device state.
799  if (IsAnyUpdateSourceAllowed()) {
800    forced_app_version_ = app_version;
801    forced_omaha_url_ = omaha_url;
802  }
803  if (omaha_url == kScheduledAUTestURLRequest) {
804    forced_omaha_url_ = constants::kOmahaDefaultAUTestURL;
805    // Pretend that it's not user-initiated even though it is,
806    // so as to test scattering logic, etc. which get kicked off
807    // only in scheduled update checks.
808    interactive = false;
809  } else if (omaha_url == kAUTestURLRequest) {
810    forced_omaha_url_ = constants::kOmahaDefaultAUTestURL;
811  }
812
813  if (forced_update_pending_callback_.get()) {
814    // Make sure that a scheduling request is made prior to calling the forced
815    // update pending callback.
816    ScheduleUpdates();
817    forced_update_pending_callback_->Run(true, interactive);
818  }
819}
820
821bool UpdateAttempter::RebootIfNeeded() {
822  if (status_ != UpdateStatus::UPDATED_NEED_REBOOT) {
823    LOG(INFO) << "Reboot requested, but status is "
824              << UpdateStatusToString(status_) << ", so not rebooting.";
825    return false;
826  }
827
828  if (USE_POWER_MANAGEMENT && RequestPowerManagerReboot())
829    return true;
830
831  return RebootDirectly();
832}
833
834void UpdateAttempter::WriteUpdateCompletedMarker() {
835  string boot_id;
836  if (!utils::GetBootId(&boot_id))
837    return;
838  prefs_->SetString(kPrefsUpdateCompletedOnBootId, boot_id);
839
840  int64_t value = system_state_->clock()->GetBootTime().ToInternalValue();
841  prefs_->SetInt64(kPrefsUpdateCompletedBootTime, value);
842}
843
844bool UpdateAttempter::RequestPowerManagerReboot() {
845  org::chromium::PowerManagerProxyInterface* power_manager_proxy =
846      system_state_->power_manager_proxy();
847  if (!power_manager_proxy) {
848    LOG(WARNING) << "No PowerManager proxy defined, skipping reboot.";
849    return false;
850  }
851  LOG(INFO) << "Calling " << power_manager::kPowerManagerInterface << "."
852            << power_manager::kRequestRestartMethod;
853  brillo::ErrorPtr error;
854  return power_manager_proxy->RequestRestart(
855      power_manager::REQUEST_RESTART_FOR_UPDATE, &error);
856}
857
858bool UpdateAttempter::RebootDirectly() {
859  vector<string> command;
860  command.push_back("/sbin/shutdown");
861  command.push_back("-r");
862  command.push_back("now");
863  LOG(INFO) << "Running \"" << base::JoinString(command, " ") << "\"";
864  int rc = 0;
865  Subprocess::SynchronousExec(command, &rc, nullptr);
866  return rc == 0;
867}
868
869void UpdateAttempter::OnUpdateScheduled(EvalStatus status,
870                                        const UpdateCheckParams& params) {
871  waiting_for_scheduled_check_ = false;
872
873  if (status == EvalStatus::kSucceeded) {
874    if (!params.updates_enabled) {
875      LOG(WARNING) << "Updates permanently disabled.";
876      // Signal disabled status, then switch right back to idle. This is
877      // necessary for ensuring that observers waiting for a signal change will
878      // actually notice one on subsequent calls. Note that we don't need to
879      // re-schedule a check in this case as updates are permanently disabled;
880      // further (forced) checks may still initiate a scheduling call.
881      SetStatusAndNotify(UpdateStatus::DISABLED);
882      SetStatusAndNotify(UpdateStatus::IDLE);
883      return;
884    }
885
886    LOG(INFO) << "Running "
887              << (params.is_interactive ? "interactive" : "periodic")
888              << " update.";
889
890    string app_version, omaha_url;
891    if (params.is_interactive) {
892      app_version = forced_app_version_;
893      omaha_url = forced_omaha_url_;
894    }
895
896    Update(app_version, omaha_url, params.target_channel,
897           params.target_version_prefix, false, params.is_interactive);
898  } else {
899    LOG(WARNING)
900        << "Update check scheduling failed (possibly timed out); retrying.";
901    ScheduleUpdates();
902  }
903
904  // This check ensures that future update checks will be or are already
905  // scheduled. The check should never fail. A check failure means that there's
906  // a bug that will most likely prevent further automatic update checks. It
907  // seems better to crash in such cases and restart the update_engine daemon
908  // into, hopefully, a known good state.
909  CHECK(IsUpdateRunningOrScheduled());
910}
911
912void UpdateAttempter::UpdateLastCheckedTime() {
913  last_checked_time_ = system_state_->clock()->GetWallclockTime().ToTimeT();
914}
915
916// Delegate methods:
917void UpdateAttempter::ProcessingDone(const ActionProcessor* processor,
918                                     ErrorCode code) {
919  LOG(INFO) << "Processing Done.";
920  actions_.clear();
921
922  // Reset cpu shares back to normal.
923  cpu_limiter_.StopLimiter();
924
925  if (status_ == UpdateStatus::REPORTING_ERROR_EVENT) {
926    LOG(INFO) << "Error event sent.";
927
928    // Inform scheduler of new status;
929    SetStatusAndNotify(UpdateStatus::IDLE);
930    ScheduleUpdates();
931
932    if (!fake_update_success_) {
933      return;
934    }
935    LOG(INFO) << "Booted from FW B and tried to install new firmware, "
936        "so requesting reboot from user.";
937  }
938
939  if (code == ErrorCode::kSuccess) {
940    WriteUpdateCompletedMarker();
941    prefs_->SetInt64(kPrefsDeltaUpdateFailures, 0);
942    prefs_->SetString(kPrefsPreviousVersion,
943                      omaha_request_params_->app_version());
944    DeltaPerformer::ResetUpdateProgress(prefs_, false);
945
946    system_state_->payload_state()->UpdateSucceeded();
947
948    // Since we're done with scattering fully at this point, this is the
949    // safest point delete the state files, as we're sure that the status is
950    // set to reboot (which means no more updates will be applied until reboot)
951    // This deletion is required for correctness as we want the next update
952    // check to re-create a new random number for the update check count.
953    // Similarly, we also delete the wall-clock-wait period that was persisted
954    // so that we start with a new random value for the next update check
955    // after reboot so that the same device is not favored or punished in any
956    // way.
957    prefs_->Delete(kPrefsUpdateCheckCount);
958    system_state_->payload_state()->SetScatteringWaitPeriod(TimeDelta());
959    prefs_->Delete(kPrefsUpdateFirstSeenAt);
960
961    SetStatusAndNotify(UpdateStatus::UPDATED_NEED_REBOOT);
962    ScheduleUpdates();
963    LOG(INFO) << "Update successfully applied, waiting to reboot.";
964
965    // This pointer is null during rollback operations, and the stats
966    // don't make much sense then anyway.
967    if (response_handler_action_) {
968      const InstallPlan& install_plan =
969          response_handler_action_->install_plan();
970
971      // Generate an unique payload identifier.
972      const string target_version_uid =
973          install_plan.payload_hash + ":" + install_plan.metadata_signature;
974
975      // Expect to reboot into the new version to send the proper metric during
976      // next boot.
977      system_state_->payload_state()->ExpectRebootInNewVersion(
978          target_version_uid);
979    } else {
980      // If we just finished a rollback, then we expect to have no Omaha
981      // response. Otherwise, it's an error.
982      if (system_state_->payload_state()->GetRollbackVersion().empty()) {
983        LOG(ERROR) << "Can't send metrics because expected "
984            "response_handler_action_ missing.";
985      }
986    }
987    return;
988  }
989
990  if (ScheduleErrorEventAction()) {
991    return;
992  }
993  LOG(INFO) << "No update.";
994  SetStatusAndNotify(UpdateStatus::IDLE);
995  ScheduleUpdates();
996}
997
998void UpdateAttempter::ProcessingStopped(const ActionProcessor* processor) {
999  // Reset cpu shares back to normal.
1000  cpu_limiter_.StopLimiter();
1001  download_progress_ = 0.0;
1002  SetStatusAndNotify(UpdateStatus::IDLE);
1003  ScheduleUpdates();
1004  actions_.clear();
1005  error_event_.reset(nullptr);
1006}
1007
1008// Called whenever an action has finished processing, either successfully
1009// or otherwise.
1010void UpdateAttempter::ActionCompleted(ActionProcessor* processor,
1011                                      AbstractAction* action,
1012                                      ErrorCode code) {
1013  // Reset download progress regardless of whether or not the download
1014  // action succeeded. Also, get the response code from HTTP request
1015  // actions (update download as well as the initial update check
1016  // actions).
1017  const string type = action->Type();
1018  if (type == DownloadAction::StaticType()) {
1019    download_progress_ = 0.0;
1020    DownloadAction* download_action = static_cast<DownloadAction*>(action);
1021    http_response_code_ = download_action->GetHTTPResponseCode();
1022  } else if (type == OmahaRequestAction::StaticType()) {
1023    OmahaRequestAction* omaha_request_action =
1024        static_cast<OmahaRequestAction*>(action);
1025    // If the request is not an event, then it's the update-check.
1026    if (!omaha_request_action->IsEvent()) {
1027      http_response_code_ = omaha_request_action->GetHTTPResponseCode();
1028
1029      // Record the number of consecutive failed update checks.
1030      if (http_response_code_ == kHttpResponseInternalServerError ||
1031          http_response_code_ == kHttpResponseServiceUnavailable) {
1032        consecutive_failed_update_checks_++;
1033      } else {
1034        consecutive_failed_update_checks_ = 0;
1035      }
1036
1037      // Store the server-dictated poll interval, if any.
1038      server_dictated_poll_interval_ =
1039          std::max(0, omaha_request_action->GetOutputObject().poll_interval);
1040    }
1041  }
1042  if (code != ErrorCode::kSuccess) {
1043    // If the current state is at or past the download phase, count the failure
1044    // in case a switch to full update becomes necessary. Ignore network
1045    // transfer timeouts and failures.
1046    if (status_ >= UpdateStatus::DOWNLOADING &&
1047        code != ErrorCode::kDownloadTransferError) {
1048      MarkDeltaUpdateFailure();
1049    }
1050    // On failure, schedule an error event to be sent to Omaha.
1051    CreatePendingErrorEvent(action, code);
1052    return;
1053  }
1054  // Find out which action completed.
1055  if (type == OmahaResponseHandlerAction::StaticType()) {
1056    // Note that the status will be updated to DOWNLOADING when some bytes get
1057    // actually downloaded from the server and the BytesReceived callback is
1058    // invoked. This avoids notifying the user that a download has started in
1059    // cases when the server and the client are unable to initiate the download.
1060    CHECK(action == response_handler_action_.get());
1061    const InstallPlan& plan = response_handler_action_->install_plan();
1062    UpdateLastCheckedTime();
1063    new_version_ = plan.version;
1064    new_payload_size_ = plan.payload_size;
1065    SetupDownload();
1066    cpu_limiter_.StartLimiter();
1067    SetStatusAndNotify(UpdateStatus::UPDATE_AVAILABLE);
1068  } else if (type == DownloadAction::StaticType()) {
1069    SetStatusAndNotify(UpdateStatus::FINALIZING);
1070  }
1071}
1072
1073void UpdateAttempter::BytesReceived(uint64_t bytes_progressed,
1074                                    uint64_t bytes_received,
1075                                    uint64_t total) {
1076  // The PayloadState keeps track of how many bytes were actually downloaded
1077  // from a given URL for the URL skipping logic.
1078  system_state_->payload_state()->DownloadProgress(bytes_progressed);
1079
1080  double progress = 0;
1081  if (total)
1082    progress = static_cast<double>(bytes_received) / static_cast<double>(total);
1083  if (status_ != UpdateStatus::DOWNLOADING || bytes_received == total) {
1084    download_progress_ = progress;
1085    SetStatusAndNotify(UpdateStatus::DOWNLOADING);
1086  } else {
1087    ProgressUpdate(progress);
1088  }
1089}
1090
1091void UpdateAttempter::DownloadComplete() {
1092  system_state_->payload_state()->DownloadComplete();
1093}
1094
1095bool UpdateAttempter::OnCheckForUpdates(brillo::ErrorPtr* error) {
1096  CheckForUpdate(
1097      "" /* app_version */, "" /* omaha_url */, true /* interactive */);
1098  return true;
1099}
1100
1101bool UpdateAttempter::OnTrackChannel(const string& channel,
1102                                     brillo::ErrorPtr* error) {
1103  LOG(INFO) << "Setting destination channel to: " << channel;
1104  string error_message;
1105  if (!system_state_->request_params()->SetTargetChannel(
1106          channel, false /* powerwash_allowed */, &error_message)) {
1107    brillo::Error::AddTo(error,
1108                         FROM_HERE,
1109                         brillo::errors::dbus::kDomain,
1110                         "set_target_error",
1111                         error_message);
1112    return false;
1113  }
1114  // Notify observers the target channel change.
1115  BroadcastChannel();
1116  return true;
1117}
1118
1119bool UpdateAttempter::GetWeaveState(int64_t* last_checked_time,
1120                                    double* progress,
1121                                    UpdateStatus* update_status,
1122                                    string* current_channel,
1123                                    string* tracking_channel) {
1124  *last_checked_time = last_checked_time_;
1125  *progress = download_progress_;
1126  *update_status = status_;
1127  OmahaRequestParams* rp = system_state_->request_params();
1128  *current_channel = rp->current_channel();
1129  *tracking_channel = rp->target_channel();
1130  return true;
1131}
1132
1133void UpdateAttempter::ProgressUpdate(double progress) {
1134  // Self throttle based on progress. Also send notifications if progress is
1135  // too slow.
1136  if (progress == 1.0 ||
1137      progress - download_progress_ >= kBroadcastThresholdProgress ||
1138      TimeTicks::Now() - last_notify_time_ >=
1139          TimeDelta::FromSeconds(kBroadcastThresholdSeconds)) {
1140    download_progress_ = progress;
1141    BroadcastStatus();
1142  }
1143}
1144
1145bool UpdateAttempter::ResetStatus() {
1146  LOG(INFO) << "Attempting to reset state from "
1147            << UpdateStatusToString(status_) << " to UpdateStatus::IDLE";
1148
1149  switch (status_) {
1150    case UpdateStatus::IDLE:
1151      // no-op.
1152      return true;
1153
1154    case UpdateStatus::UPDATED_NEED_REBOOT:  {
1155      bool ret_value = true;
1156      status_ = UpdateStatus::IDLE;
1157
1158      // Remove the reboot marker so that if the machine is rebooted
1159      // after resetting to idle state, it doesn't go back to
1160      // UpdateStatus::UPDATED_NEED_REBOOT state.
1161      ret_value = prefs_->Delete(kPrefsUpdateCompletedOnBootId) && ret_value;
1162      ret_value = prefs_->Delete(kPrefsUpdateCompletedBootTime) && ret_value;
1163
1164      // Update the boot flags so the current slot has higher priority.
1165      BootControlInterface* boot_control = system_state_->boot_control();
1166      if (!boot_control->SetActiveBootSlot(boot_control->GetCurrentSlot()))
1167        ret_value = false;
1168
1169      // Mark the current slot as successful again, since marking it as active
1170      // may reset the successful bit. We ignore the result of whether marking
1171      // the current slot as successful worked.
1172      if (!boot_control_->MarkBootSuccessfulAsync(Bind([](bool successful){})))
1173        ret_value = false;
1174
1175      // Notify the PayloadState that the successful payload was canceled.
1176      system_state_->payload_state()->ResetUpdateStatus();
1177
1178      // The previous version is used to report back to omaha after reboot that
1179      // we actually rebooted into the new version from this "prev-version". We
1180      // need to clear out this value now to prevent it being sent on the next
1181      // updatecheck request.
1182      ret_value = prefs_->SetString(kPrefsPreviousVersion, "") && ret_value;
1183
1184      LOG(INFO) << "Reset status " << (ret_value ? "successful" : "failed");
1185      return ret_value;
1186    }
1187
1188    default:
1189      LOG(ERROR) << "Reset not allowed in this state.";
1190      return false;
1191  }
1192}
1193
1194bool UpdateAttempter::GetStatus(int64_t* last_checked_time,
1195                                double* progress,
1196                                string* current_operation,
1197                                string* new_version,
1198                                int64_t* new_payload_size) {
1199  *last_checked_time = last_checked_time_;
1200  *progress = download_progress_;
1201  *current_operation = UpdateStatusToString(status_);
1202  *new_version = new_version_;
1203  *new_payload_size = new_payload_size_;
1204  return true;
1205}
1206
1207void UpdateAttempter::UpdateBootFlags() {
1208  if (update_boot_flags_running_) {
1209    LOG(INFO) << "Update boot flags running, nothing to do.";
1210    return;
1211  }
1212  if (updated_boot_flags_) {
1213    LOG(INFO) << "Already updated boot flags. Skipping.";
1214    if (start_action_processor_) {
1215      ScheduleProcessingStart();
1216    }
1217    return;
1218  }
1219  // This is purely best effort. Failures should be logged by Subprocess. Run
1220  // the script asynchronously to avoid blocking the event loop regardless of
1221  // the script runtime.
1222  update_boot_flags_running_ = true;
1223  LOG(INFO) << "Marking booted slot as good.";
1224  if (!system_state_->boot_control()->MarkBootSuccessfulAsync(Bind(
1225          &UpdateAttempter::CompleteUpdateBootFlags, base::Unretained(this)))) {
1226    LOG(ERROR) << "Failed to mark current boot as successful.";
1227    CompleteUpdateBootFlags(false);
1228  }
1229}
1230
1231void UpdateAttempter::CompleteUpdateBootFlags(bool successful) {
1232  update_boot_flags_running_ = false;
1233  updated_boot_flags_ = true;
1234  if (start_action_processor_) {
1235    ScheduleProcessingStart();
1236  }
1237}
1238
1239void UpdateAttempter::BroadcastStatus() {
1240  for (const auto& observer : service_observers_) {
1241    observer->SendStatusUpdate(last_checked_time_,
1242                               download_progress_,
1243                               status_,
1244                               new_version_,
1245                               new_payload_size_);
1246  }
1247  last_notify_time_ = TimeTicks::Now();
1248}
1249
1250void UpdateAttempter::BroadcastChannel() {
1251  for (const auto& observer : service_observers_) {
1252    observer->SendChannelChangeUpdate(
1253        system_state_->request_params()->target_channel());
1254  }
1255}
1256
1257uint32_t UpdateAttempter::GetErrorCodeFlags()  {
1258  uint32_t flags = 0;
1259
1260  if (!system_state_->hardware()->IsNormalBootMode())
1261    flags |= static_cast<uint32_t>(ErrorCode::kDevModeFlag);
1262
1263  if (response_handler_action_.get() &&
1264      response_handler_action_->install_plan().is_resume)
1265    flags |= static_cast<uint32_t>(ErrorCode::kResumedFlag);
1266
1267  if (!system_state_->hardware()->IsOfficialBuild())
1268    flags |= static_cast<uint32_t>(ErrorCode::kTestImageFlag);
1269
1270  if (omaha_request_params_->update_url() !=
1271      constants::kOmahaDefaultProductionURL) {
1272    flags |= static_cast<uint32_t>(ErrorCode::kTestOmahaUrlFlag);
1273  }
1274
1275  return flags;
1276}
1277
1278bool UpdateAttempter::ShouldCancel(ErrorCode* cancel_reason) {
1279  // Check if the channel we're attempting to update to is the same as the
1280  // target channel currently chosen by the user.
1281  OmahaRequestParams* params = system_state_->request_params();
1282  if (params->download_channel() != params->target_channel()) {
1283    LOG(ERROR) << "Aborting download as target channel: "
1284               << params->target_channel()
1285               << " is different from the download channel: "
1286               << params->download_channel();
1287    *cancel_reason = ErrorCode::kUpdateCanceledByChannelChange;
1288    return true;
1289  }
1290
1291  return false;
1292}
1293
1294void UpdateAttempter::SetStatusAndNotify(UpdateStatus status) {
1295  status_ = status;
1296  BroadcastStatus();
1297}
1298
1299void UpdateAttempter::CreatePendingErrorEvent(AbstractAction* action,
1300                                              ErrorCode code) {
1301  if (error_event_.get()) {
1302    // This shouldn't really happen.
1303    LOG(WARNING) << "There's already an existing pending error event.";
1304    return;
1305  }
1306
1307  // For now assume that a generic Omaha response action failure means that
1308  // there's no update so don't send an event. Also, double check that the
1309  // failure has not occurred while sending an error event -- in which case
1310  // don't schedule another. This shouldn't really happen but just in case...
1311  if ((action->Type() == OmahaResponseHandlerAction::StaticType() &&
1312       code == ErrorCode::kError) ||
1313      status_ == UpdateStatus::REPORTING_ERROR_EVENT) {
1314    return;
1315  }
1316
1317  // Classify the code to generate the appropriate result so that
1318  // the Borgmon charts show up the results correctly.
1319  // Do this before calling GetErrorCodeForAction which could potentially
1320  // augment the bit representation of code and thus cause no matches for
1321  // the switch cases below.
1322  OmahaEvent::Result event_result;
1323  switch (code) {
1324    case ErrorCode::kOmahaUpdateIgnoredPerPolicy:
1325    case ErrorCode::kOmahaUpdateDeferredPerPolicy:
1326    case ErrorCode::kOmahaUpdateDeferredForBackoff:
1327      event_result = OmahaEvent::kResultUpdateDeferred;
1328      break;
1329    default:
1330      event_result = OmahaEvent::kResultError;
1331      break;
1332  }
1333
1334  code = GetErrorCodeForAction(action, code);
1335  fake_update_success_ = code == ErrorCode::kPostinstallBootedFromFirmwareB;
1336
1337  // Compute the final error code with all the bit flags to be sent to Omaha.
1338  code = static_cast<ErrorCode>(
1339      static_cast<uint32_t>(code) | GetErrorCodeFlags());
1340  error_event_.reset(new OmahaEvent(OmahaEvent::kTypeUpdateComplete,
1341                                    event_result,
1342                                    code));
1343}
1344
1345bool UpdateAttempter::ScheduleErrorEventAction() {
1346  if (error_event_.get() == nullptr)
1347    return false;
1348
1349  LOG(ERROR) << "Update failed.";
1350  system_state_->payload_state()->UpdateFailed(error_event_->error_code);
1351
1352  // Send it to Omaha.
1353  LOG(INFO) << "Reporting the error event";
1354  shared_ptr<OmahaRequestAction> error_event_action(
1355      new OmahaRequestAction(system_state_,
1356                             error_event_.release(),  // Pass ownership.
1357                             brillo::make_unique_ptr(new LibcurlHttpFetcher(
1358                                 GetProxyResolver(),
1359                                 system_state_->hardware())),
1360                             false));
1361  actions_.push_back(shared_ptr<AbstractAction>(error_event_action));
1362  processor_->EnqueueAction(error_event_action.get());
1363  SetStatusAndNotify(UpdateStatus::REPORTING_ERROR_EVENT);
1364  processor_->StartProcessing();
1365  return true;
1366}
1367
1368void UpdateAttempter::ScheduleProcessingStart() {
1369  LOG(INFO) << "Scheduling an action processor start.";
1370  start_action_processor_ = false;
1371  MessageLoop::current()->PostTask(
1372      FROM_HERE,
1373      Bind([this] { this->processor_->StartProcessing(); }));
1374}
1375
1376void UpdateAttempter::DisableDeltaUpdateIfNeeded() {
1377  int64_t delta_failures;
1378  if (omaha_request_params_->delta_okay() &&
1379      prefs_->GetInt64(kPrefsDeltaUpdateFailures, &delta_failures) &&
1380      delta_failures >= kMaxDeltaUpdateFailures) {
1381    LOG(WARNING) << "Too many delta update failures, forcing full update.";
1382    omaha_request_params_->set_delta_okay(false);
1383  }
1384}
1385
1386void UpdateAttempter::MarkDeltaUpdateFailure() {
1387  // Don't try to resume a failed delta update.
1388  DeltaPerformer::ResetUpdateProgress(prefs_, false);
1389  int64_t delta_failures;
1390  if (!prefs_->GetInt64(kPrefsDeltaUpdateFailures, &delta_failures) ||
1391      delta_failures < 0) {
1392    delta_failures = 0;
1393  }
1394  prefs_->SetInt64(kPrefsDeltaUpdateFailures, ++delta_failures);
1395}
1396
1397void UpdateAttempter::SetupDownload() {
1398  MultiRangeHttpFetcher* fetcher =
1399      static_cast<MultiRangeHttpFetcher*>(download_action_->http_fetcher());
1400  fetcher->ClearRanges();
1401  if (response_handler_action_->install_plan().is_resume) {
1402    // Resuming an update so fetch the update manifest metadata first.
1403    int64_t manifest_metadata_size = 0;
1404    int64_t manifest_signature_size = 0;
1405    prefs_->GetInt64(kPrefsManifestMetadataSize, &manifest_metadata_size);
1406    prefs_->GetInt64(kPrefsManifestSignatureSize, &manifest_signature_size);
1407    fetcher->AddRange(0, manifest_metadata_size + manifest_signature_size);
1408    // If there're remaining unprocessed data blobs, fetch them. Be careful not
1409    // to request data beyond the end of the payload to avoid 416 HTTP response
1410    // error codes.
1411    int64_t next_data_offset = 0;
1412    prefs_->GetInt64(kPrefsUpdateStateNextDataOffset, &next_data_offset);
1413    uint64_t resume_offset =
1414        manifest_metadata_size + manifest_signature_size + next_data_offset;
1415    if (resume_offset < response_handler_action_->install_plan().payload_size) {
1416      fetcher->AddRange(resume_offset);
1417    }
1418  } else {
1419    fetcher->AddRange(0);
1420  }
1421}
1422
1423void UpdateAttempter::PingOmaha() {
1424  if (!processor_->IsRunning()) {
1425    shared_ptr<OmahaRequestAction> ping_action(new OmahaRequestAction(
1426        system_state_,
1427        nullptr,
1428        brillo::make_unique_ptr(new LibcurlHttpFetcher(
1429            GetProxyResolver(),
1430            system_state_->hardware())),
1431        true));
1432    actions_.push_back(shared_ptr<OmahaRequestAction>(ping_action));
1433    processor_->set_delegate(nullptr);
1434    processor_->EnqueueAction(ping_action.get());
1435    // Call StartProcessing() synchronously here to avoid any race conditions
1436    // caused by multiple outstanding ping Omaha requests.  If we call
1437    // StartProcessing() asynchronously, the device can be suspended before we
1438    // get a chance to callback to StartProcessing().  When the device resumes
1439    // (assuming the device sleeps longer than the next update check period),
1440    // StartProcessing() is called back and at the same time, the next update
1441    // check is fired which eventually invokes StartProcessing().  A crash
1442    // can occur because StartProcessing() checks to make sure that the
1443    // processor is idle which it isn't due to the two concurrent ping Omaha
1444    // requests.
1445    processor_->StartProcessing();
1446  } else {
1447    LOG(WARNING) << "Action processor running, Omaha ping suppressed.";
1448  }
1449
1450  // Update the last check time here; it may be re-updated when an Omaha
1451  // response is received, but this will prevent us from repeatedly scheduling
1452  // checks in the case where a response is not received.
1453  UpdateLastCheckedTime();
1454
1455  // Update the status which will schedule the next update check
1456  SetStatusAndNotify(UpdateStatus::UPDATED_NEED_REBOOT);
1457  ScheduleUpdates();
1458}
1459
1460
1461bool UpdateAttempter::DecrementUpdateCheckCount() {
1462  int64_t update_check_count_value;
1463
1464  if (!prefs_->Exists(kPrefsUpdateCheckCount)) {
1465    // This file does not exist. This means we haven't started our update
1466    // check count down yet, so nothing more to do. This file will be created
1467    // later when we first satisfy the wall-clock-based-wait period.
1468    LOG(INFO) << "No existing update check count. That's normal.";
1469    return true;
1470  }
1471
1472  if (prefs_->GetInt64(kPrefsUpdateCheckCount, &update_check_count_value)) {
1473    // Only if we're able to read a proper integer value, then go ahead
1474    // and decrement and write back the result in the same file, if needed.
1475    LOG(INFO) << "Update check count = " << update_check_count_value;
1476
1477    if (update_check_count_value == 0) {
1478      // It could be 0, if, for some reason, the file didn't get deleted
1479      // when we set our status to waiting for reboot. so we just leave it
1480      // as is so that we can prevent another update_check wait for this client.
1481      LOG(INFO) << "Not decrementing update check count as it's already 0.";
1482      return true;
1483    }
1484
1485    if (update_check_count_value > 0)
1486      update_check_count_value--;
1487    else
1488      update_check_count_value = 0;
1489
1490    // Write out the new value of update_check_count_value.
1491    if (prefs_->SetInt64(kPrefsUpdateCheckCount, update_check_count_value)) {
1492      // We successfully wrote out te new value, so enable the
1493      // update check based wait.
1494      LOG(INFO) << "New update check count = " << update_check_count_value;
1495      return true;
1496    }
1497  }
1498
1499  LOG(INFO) << "Deleting update check count state due to read/write errors.";
1500
1501  // We cannot read/write to the file, so disable the update check based wait
1502  // so that we don't get stuck in this OS version by any chance (which could
1503  // happen if there's some bug that causes to read/write incorrectly).
1504  // Also attempt to delete the file to do our best effort to cleanup.
1505  prefs_->Delete(kPrefsUpdateCheckCount);
1506  return false;
1507}
1508
1509
1510void UpdateAttempter::UpdateEngineStarted() {
1511  // If we just booted into a new update, keep the previous OS version
1512  // in case we rebooted because of a crash of the old version, so we
1513  // can do a proper crash report with correct information.
1514  // This must be done before calling
1515  // system_state_->payload_state()->UpdateEngineStarted() since it will
1516  // delete SystemUpdated marker file.
1517  if (system_state_->system_rebooted() &&
1518      prefs_->Exists(kPrefsSystemUpdatedMarker)) {
1519    if (!prefs_->GetString(kPrefsPreviousVersion, &prev_version_)) {
1520      // If we fail to get the version string, make sure it stays empty.
1521      prev_version_.clear();
1522    }
1523  }
1524
1525  system_state_->payload_state()->UpdateEngineStarted();
1526  StartP2PAtStartup();
1527}
1528
1529bool UpdateAttempter::StartP2PAtStartup() {
1530  if (system_state_ == nullptr ||
1531      !system_state_->p2p_manager()->IsP2PEnabled()) {
1532    LOG(INFO) << "Not starting p2p at startup since it's not enabled.";
1533    return false;
1534  }
1535
1536  if (system_state_->p2p_manager()->CountSharedFiles() < 1) {
1537    LOG(INFO) << "Not starting p2p at startup since our application "
1538              << "is not sharing any files.";
1539    return false;
1540  }
1541
1542  return StartP2PAndPerformHousekeeping();
1543}
1544
1545bool UpdateAttempter::StartP2PAndPerformHousekeeping() {
1546  if (system_state_ == nullptr)
1547    return false;
1548
1549  if (!system_state_->p2p_manager()->IsP2PEnabled()) {
1550    LOG(INFO) << "Not starting p2p since it's not enabled.";
1551    return false;
1552  }
1553
1554  LOG(INFO) << "Ensuring that p2p is running.";
1555  if (!system_state_->p2p_manager()->EnsureP2PRunning()) {
1556    LOG(ERROR) << "Error starting p2p.";
1557    return false;
1558  }
1559
1560  LOG(INFO) << "Performing p2p housekeeping.";
1561  if (!system_state_->p2p_manager()->PerformHousekeeping()) {
1562    LOG(ERROR) << "Error performing housekeeping for p2p.";
1563    return false;
1564  }
1565
1566  LOG(INFO) << "Done performing p2p housekeeping.";
1567  return true;
1568}
1569
1570bool UpdateAttempter::GetBootTimeAtUpdate(Time *out_boot_time) {
1571  // In case of an update_engine restart without a reboot, we stored the boot_id
1572  // when the update was completed by setting a pref, so we can check whether
1573  // the last update was on this boot or a previous one.
1574  string boot_id;
1575  TEST_AND_RETURN_FALSE(utils::GetBootId(&boot_id));
1576
1577  string update_completed_on_boot_id;
1578  if (!prefs_->Exists(kPrefsUpdateCompletedOnBootId) ||
1579      !prefs_->GetString(kPrefsUpdateCompletedOnBootId,
1580                         &update_completed_on_boot_id) ||
1581      update_completed_on_boot_id != boot_id)
1582    return false;
1583
1584  // Short-circuit avoiding the read in case out_boot_time is nullptr.
1585  if (out_boot_time) {
1586    int64_t boot_time = 0;
1587    // Since the kPrefsUpdateCompletedOnBootId was correctly set, this pref
1588    // should not fail.
1589    TEST_AND_RETURN_FALSE(
1590        prefs_->GetInt64(kPrefsUpdateCompletedBootTime, &boot_time));
1591    *out_boot_time = Time::FromInternalValue(boot_time);
1592  }
1593  return true;
1594}
1595
1596bool UpdateAttempter::IsUpdateRunningOrScheduled() {
1597  return ((status_ != UpdateStatus::IDLE &&
1598           status_ != UpdateStatus::UPDATED_NEED_REBOOT) ||
1599          waiting_for_scheduled_check_);
1600}
1601
1602bool UpdateAttempter::IsAnyUpdateSourceAllowed() {
1603  // We allow updates from any source if either of these are true:
1604  //  * The device is running an unofficial (dev/test) image.
1605  //  * The debugd dev features are accessible (i.e. in devmode with no owner).
1606  // This protects users running a base image, while still allowing a specific
1607  // window (gated by the debug dev features) where `cros flash` is usable.
1608  if (!system_state_->hardware()->IsOfficialBuild()) {
1609    LOG(INFO) << "Non-official build; allowing any update source.";
1610    return true;
1611  }
1612
1613  // Even though the debugd tools are also gated on devmode, checking here can
1614  // save us a D-Bus call so it's worth doing explicitly.
1615  if (system_state_->hardware()->IsNormalBootMode()) {
1616    LOG(INFO) << "Not in devmode; disallowing custom update sources.";
1617    return false;
1618  }
1619
1620  // Official images in devmode are allowed a custom update source iff the
1621  // debugd dev tools are enabled.
1622  if (!debugd_proxy_)
1623    return false;
1624  int32_t dev_features = debugd::DEV_FEATURES_DISABLED;
1625  brillo::ErrorPtr error;
1626  bool success = debugd_proxy_->QueryDevFeatures(&dev_features, &error);
1627
1628  // Some boards may not include debugd so it's expected that this may fail,
1629  // in which case we default to disallowing custom update sources.
1630  if (success && !(dev_features & debugd::DEV_FEATURES_DISABLED)) {
1631    LOG(INFO) << "Debugd dev tools enabled; allowing any update source.";
1632    return true;
1633  }
1634  LOG(INFO) << "Debugd dev tools disabled; disallowing custom update sources.";
1635  return false;
1636}
1637
1638}  // namespace chromeos_update_engine
1639