]>
Commit | Line | Data |
---|---|---|
52ad194e | 1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
e3bff60a | 2 | |
e3bff60a | 3 | #include <curl/curl.h> |
db2df898 | 4 | #include <sys/prctl.h> |
e3bff60a MP |
5 | |
6 | #include "sd-daemon.h" | |
db2df898 MP |
7 | |
8 | #include "alloc-util.h" | |
e3bff60a | 9 | #include "btrfs-util.h" |
db2df898 MP |
10 | #include "copy.h" |
11 | #include "curl-util.h" | |
12 | #include "fd-util.h" | |
db2df898 MP |
13 | #include "fs-util.h" |
14 | #include "hostname-util.h" | |
15 | #include "import-common.h" | |
16 | #include "import-util.h" | |
e3bff60a MP |
17 | #include "macro.h" |
18 | #include "mkdir.h" | |
e3bff60a | 19 | #include "path-util.h" |
13d276d0 | 20 | #include "process-util.h" |
e3bff60a | 21 | #include "pull-common.h" |
db2df898 | 22 | #include "pull-job.h" |
e3bff60a | 23 | #include "pull-tar.h" |
db2df898 MP |
24 | #include "rm-rf.h" |
25 | #include "string-util.h" | |
26 | #include "strv.h" | |
6e866b33 | 27 | #include "tmpfile-util.h" |
db2df898 MP |
28 | #include "utf8.h" |
29 | #include "util.h" | |
30 | #include "web-util.h" | |
e3bff60a MP |
31 | |
32 | typedef enum TarProgress { | |
33 | TAR_DOWNLOADING, | |
34 | TAR_VERIFYING, | |
35 | TAR_FINALIZING, | |
36 | TAR_COPYING, | |
37 | } TarProgress; | |
38 | ||
39 | struct TarPull { | |
40 | sd_event *event; | |
41 | CurlGlue *glue; | |
42 | ||
43 | char *image_root; | |
44 | ||
45 | PullJob *tar_job; | |
6300502b | 46 | PullJob *settings_job; |
e3bff60a MP |
47 | PullJob *checksum_job; |
48 | PullJob *signature_job; | |
49 | ||
50 | TarPullFinished on_finished; | |
51 | void *userdata; | |
52 | ||
53 | char *local; | |
54 | bool force_local; | |
6300502b | 55 | bool settings; |
e3bff60a MP |
56 | |
57 | pid_t tar_pid; | |
58 | ||
e3bff60a | 59 | char *final_path; |
6300502b MP |
60 | char *temp_path; |
61 | ||
62 | char *settings_path; | |
63 | char *settings_temp_path; | |
e3bff60a MP |
64 | |
65 | ImportVerify verify; | |
66 | }; | |
67 | ||
68 | TarPull* tar_pull_unref(TarPull *i) { | |
69 | if (!i) | |
70 | return NULL; | |
71 | ||
72 | if (i->tar_pid > 1) { | |
73 | (void) kill_and_sigcont(i->tar_pid, SIGKILL); | |
74 | (void) wait_for_terminate(i->tar_pid, NULL); | |
75 | } | |
76 | ||
77 | pull_job_unref(i->tar_job); | |
6300502b | 78 | pull_job_unref(i->settings_job); |
e3bff60a MP |
79 | pull_job_unref(i->checksum_job); |
80 | pull_job_unref(i->signature_job); | |
81 | ||
82 | curl_glue_unref(i->glue); | |
83 | sd_event_unref(i->event); | |
84 | ||
85 | if (i->temp_path) { | |
86 | (void) rm_rf(i->temp_path, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME); | |
87 | free(i->temp_path); | |
88 | } | |
89 | ||
6300502b MP |
90 | if (i->settings_temp_path) { |
91 | (void) unlink(i->settings_temp_path); | |
92 | free(i->settings_temp_path); | |
93 | } | |
94 | ||
e3bff60a | 95 | free(i->final_path); |
6300502b | 96 | free(i->settings_path); |
e3bff60a MP |
97 | free(i->image_root); |
98 | free(i->local); | |
81c58355 | 99 | |
8a584da2 | 100 | return mfree(i); |
e3bff60a MP |
101 | } |
102 | ||
103 | int tar_pull_new( | |
104 | TarPull **ret, | |
105 | sd_event *event, | |
106 | const char *image_root, | |
107 | TarPullFinished on_finished, | |
108 | void *userdata) { | |
109 | ||
6e866b33 MB |
110 | _cleanup_(curl_glue_unrefp) CurlGlue *g = NULL; |
111 | _cleanup_(sd_event_unrefp) sd_event *e = NULL; | |
e3bff60a | 112 | _cleanup_(tar_pull_unrefp) TarPull *i = NULL; |
6e866b33 | 113 | _cleanup_free_ char *root = NULL; |
e3bff60a MP |
114 | int r; |
115 | ||
116 | assert(ret); | |
e3bff60a | 117 | |
6e866b33 MB |
118 | root = strdup(image_root ?: "/var/lib/machines"); |
119 | if (!root) | |
e3bff60a MP |
120 | return -ENOMEM; |
121 | ||
6300502b | 122 | if (event) |
6e866b33 | 123 | e = sd_event_ref(event); |
6300502b | 124 | else { |
6e866b33 | 125 | r = sd_event_default(&e); |
6300502b MP |
126 | if (r < 0) |
127 | return r; | |
128 | } | |
e3bff60a | 129 | |
6e866b33 | 130 | r = curl_glue_new(&g, e); |
e3bff60a MP |
131 | if (r < 0) |
132 | return r; | |
133 | ||
6e866b33 MB |
134 | i = new(TarPull, 1); |
135 | if (!i) | |
136 | return -ENOMEM; | |
137 | ||
138 | *i = (TarPull) { | |
139 | .on_finished = on_finished, | |
140 | .userdata = userdata, | |
141 | .image_root = TAKE_PTR(root), | |
142 | .event = TAKE_PTR(e), | |
143 | .glue = TAKE_PTR(g), | |
144 | }; | |
145 | ||
e3bff60a MP |
146 | i->glue->on_finished = pull_job_curl_on_finished; |
147 | i->glue->userdata = i; | |
148 | ||
b012e921 | 149 | *ret = TAKE_PTR(i); |
e3bff60a MP |
150 | |
151 | return 0; | |
152 | } | |
153 | ||
154 | static void tar_pull_report_progress(TarPull *i, TarProgress p) { | |
155 | unsigned percent; | |
156 | ||
157 | assert(i); | |
158 | ||
159 | switch (p) { | |
160 | ||
161 | case TAR_DOWNLOADING: { | |
162 | unsigned remain = 85; | |
163 | ||
164 | percent = 0; | |
165 | ||
6300502b MP |
166 | if (i->settings_job) { |
167 | percent += i->settings_job->progress_percent * 5 / 100; | |
168 | remain -= 5; | |
169 | } | |
170 | ||
e3bff60a MP |
171 | if (i->checksum_job) { |
172 | percent += i->checksum_job->progress_percent * 5 / 100; | |
173 | remain -= 5; | |
174 | } | |
175 | ||
176 | if (i->signature_job) { | |
177 | percent += i->signature_job->progress_percent * 5 / 100; | |
178 | remain -= 5; | |
179 | } | |
180 | ||
181 | if (i->tar_job) | |
182 | percent += i->tar_job->progress_percent * remain / 100; | |
183 | break; | |
184 | } | |
185 | ||
186 | case TAR_VERIFYING: | |
187 | percent = 85; | |
188 | break; | |
189 | ||
190 | case TAR_FINALIZING: | |
191 | percent = 90; | |
192 | break; | |
193 | ||
194 | case TAR_COPYING: | |
195 | percent = 95; | |
196 | break; | |
197 | ||
198 | default: | |
199 | assert_not_reached("Unknown progress state"); | |
200 | } | |
201 | ||
202 | sd_notifyf(false, "X_IMPORT_PROGRESS=%u", percent); | |
203 | log_debug("Combined progress %u%%", percent); | |
204 | } | |
205 | ||
2897b343 MP |
206 | static int tar_pull_determine_path(TarPull *i, const char *suffix, char **field) { |
207 | int r; | |
208 | ||
209 | assert(i); | |
210 | assert(field); | |
211 | ||
212 | if (*field) | |
213 | return 0; | |
214 | ||
215 | assert(i->tar_job); | |
216 | ||
217 | r = pull_make_path(i->tar_job->url, i->tar_job->etag, i->image_root, ".tar-", suffix, field); | |
218 | if (r < 0) | |
219 | return log_oom(); | |
220 | ||
221 | return 1; | |
222 | } | |
223 | ||
e3bff60a MP |
224 | static int tar_pull_make_local_copy(TarPull *i) { |
225 | int r; | |
226 | ||
227 | assert(i); | |
228 | assert(i->tar_job); | |
229 | ||
230 | if (!i->local) | |
231 | return 0; | |
232 | ||
e3bff60a MP |
233 | r = pull_make_local_copy(i->final_path, i->image_root, i->local, i->force_local); |
234 | if (r < 0) | |
235 | return r; | |
236 | ||
6300502b MP |
237 | if (i->settings) { |
238 | const char *local_settings; | |
239 | assert(i->settings_job); | |
240 | ||
2897b343 MP |
241 | r = tar_pull_determine_path(i, ".nspawn", &i->settings_path); |
242 | if (r < 0) | |
243 | return r; | |
6300502b MP |
244 | |
245 | local_settings = strjoina(i->image_root, "/", i->local, ".nspawn"); | |
246 | ||
2897b343 | 247 | r = copy_file_atomic(i->settings_path, local_settings, 0664, 0, COPY_REFLINK | (i->force_local ? COPY_REPLACE : 0)); |
6300502b MP |
248 | if (r == -EEXIST) |
249 | log_warning_errno(r, "Settings file %s already exists, not replacing.", local_settings); | |
aa27b158 MP |
250 | else if (r == -ENOENT) |
251 | log_debug_errno(r, "Skipping creation of settings file, since none was found."); | |
252 | else if (r < 0) | |
db2df898 MP |
253 | log_warning_errno(r, "Failed to copy settings files %s, ignoring: %m", local_settings); |
254 | else | |
aa27b158 | 255 | log_info("Created new settings file %s.", local_settings); |
6300502b MP |
256 | } |
257 | ||
e3bff60a MP |
258 | return 0; |
259 | } | |
260 | ||
261 | static bool tar_pull_is_done(TarPull *i) { | |
262 | assert(i); | |
263 | assert(i->tar_job); | |
264 | ||
6300502b | 265 | if (!PULL_JOB_IS_COMPLETE(i->tar_job)) |
e3bff60a | 266 | return false; |
6300502b | 267 | if (i->settings_job && !PULL_JOB_IS_COMPLETE(i->settings_job)) |
e3bff60a | 268 | return false; |
6300502b MP |
269 | if (i->checksum_job && !PULL_JOB_IS_COMPLETE(i->checksum_job)) |
270 | return false; | |
271 | if (i->signature_job && !PULL_JOB_IS_COMPLETE(i->signature_job)) | |
e3bff60a MP |
272 | return false; |
273 | ||
274 | return true; | |
275 | } | |
276 | ||
277 | static void tar_pull_job_on_finished(PullJob *j) { | |
278 | TarPull *i; | |
279 | int r; | |
280 | ||
281 | assert(j); | |
282 | assert(j->userdata); | |
283 | ||
284 | i = j->userdata; | |
6300502b MP |
285 | |
286 | if (j == i->settings_job) { | |
287 | if (j->error != 0) | |
288 | log_info_errno(j->error, "Settings file could not be retrieved, proceeding without."); | |
81c58355 | 289 | } else if (j->error != 0 && j != i->signature_job) { |
e3bff60a MP |
290 | if (j == i->checksum_job) |
291 | log_error_errno(j->error, "Failed to retrieve SHA256 checksum, cannot verify. (Try --verify=no?)"); | |
e3bff60a MP |
292 | else |
293 | log_error_errno(j->error, "Failed to retrieve image file. (Wrong URL?)"); | |
294 | ||
295 | r = j->error; | |
296 | goto finish; | |
297 | } | |
298 | ||
299 | /* This is invoked if either the download completed | |
300 | * successfully, or the download was skipped because we | |
301 | * already have the etag. */ | |
302 | ||
303 | if (!tar_pull_is_done(i)) | |
304 | return; | |
305 | ||
81c58355 MB |
306 | if (i->signature_job && i->checksum_job->style == VERIFICATION_PER_DIRECTORY && i->signature_job->error != 0) { |
307 | log_error_errno(j->error, "Failed to retrieve signature file, cannot verify. (Try --verify=no?)"); | |
308 | ||
309 | r = i->signature_job->error; | |
310 | goto finish; | |
311 | } | |
312 | ||
6300502b MP |
313 | i->tar_job->disk_fd = safe_close(i->tar_job->disk_fd); |
314 | if (i->settings_job) | |
315 | i->settings_job->disk_fd = safe_close(i->settings_job->disk_fd); | |
e3bff60a | 316 | |
2897b343 MP |
317 | r = tar_pull_determine_path(i, NULL, &i->final_path); |
318 | if (r < 0) | |
319 | goto finish; | |
320 | ||
e3bff60a | 321 | if (i->tar_pid > 0) { |
1d42b86d | 322 | r = wait_for_terminate_and_check("tar", i->tar_pid, WAIT_LOG); |
e3bff60a MP |
323 | i->tar_pid = 0; |
324 | if (r < 0) | |
325 | goto finish; | |
1d42b86d | 326 | if (r != EXIT_SUCCESS) { |
6300502b MP |
327 | r = -EIO; |
328 | goto finish; | |
329 | } | |
e3bff60a MP |
330 | } |
331 | ||
332 | if (!i->tar_job->etag_exists) { | |
333 | /* This is a new download, verify it, and move it into place */ | |
334 | ||
335 | tar_pull_report_progress(i, TAR_VERIFYING); | |
336 | ||
2897b343 | 337 | r = pull_verify(i->tar_job, NULL, i->settings_job, i->checksum_job, i->signature_job); |
e3bff60a MP |
338 | if (r < 0) |
339 | goto finish; | |
340 | ||
341 | tar_pull_report_progress(i, TAR_FINALIZING); | |
342 | ||
343 | r = import_make_read_only(i->temp_path); | |
344 | if (r < 0) | |
345 | goto finish; | |
346 | ||
347 | r = rename_noreplace(AT_FDCWD, i->temp_path, AT_FDCWD, i->final_path); | |
348 | if (r < 0) { | |
81c58355 | 349 | log_error_errno(r, "Failed to rename to final image name to %s: %m", i->final_path); |
e3bff60a MP |
350 | goto finish; |
351 | } | |
352 | ||
6300502b MP |
353 | i->temp_path = mfree(i->temp_path); |
354 | ||
355 | if (i->settings_job && | |
2897b343 | 356 | i->settings_job->error == 0) { |
6300502b | 357 | |
81c58355 | 358 | /* Also move the settings file into place, if it exists. Note that we do so only if we also |
2897b343 | 359 | * moved the tar file in place, to keep things strictly in sync. */ |
81c58355 | 360 | assert(i->settings_temp_path); |
2897b343 | 361 | |
81c58355 MB |
362 | /* Regenerate final name for this auxiliary file, we might know the etag of the file now, and |
363 | * we should incorporate it in the file name if we can */ | |
2897b343 | 364 | i->settings_path = mfree(i->settings_path); |
81c58355 | 365 | |
2897b343 MP |
366 | r = tar_pull_determine_path(i, ".nspawn", &i->settings_path); |
367 | if (r < 0) | |
368 | goto finish; | |
6300502b MP |
369 | |
370 | r = import_make_read_only(i->settings_temp_path); | |
371 | if (r < 0) | |
372 | goto finish; | |
373 | ||
374 | r = rename_noreplace(AT_FDCWD, i->settings_temp_path, AT_FDCWD, i->settings_path); | |
375 | if (r < 0) { | |
81c58355 | 376 | log_error_errno(r, "Failed to rename settings file to %s: %m", i->settings_path); |
6300502b MP |
377 | goto finish; |
378 | } | |
379 | ||
380 | i->settings_temp_path = mfree(i->settings_temp_path); | |
381 | } | |
e3bff60a MP |
382 | } |
383 | ||
384 | tar_pull_report_progress(i, TAR_COPYING); | |
385 | ||
386 | r = tar_pull_make_local_copy(i); | |
387 | if (r < 0) | |
388 | goto finish; | |
389 | ||
390 | r = 0; | |
391 | ||
392 | finish: | |
393 | if (i->on_finished) | |
394 | i->on_finished(i, r, i->userdata); | |
395 | else | |
396 | sd_event_exit(i->event, r); | |
397 | } | |
398 | ||
6300502b | 399 | static int tar_pull_job_on_open_disk_tar(PullJob *j) { |
e3bff60a MP |
400 | TarPull *i; |
401 | int r; | |
402 | ||
403 | assert(j); | |
404 | assert(j->userdata); | |
405 | ||
406 | i = j->userdata; | |
407 | assert(i->tar_job == j); | |
e3bff60a MP |
408 | assert(i->tar_pid <= 0); |
409 | ||
2897b343 MP |
410 | if (!i->temp_path) { |
411 | r = tempfn_random_child(i->image_root, "tar", &i->temp_path); | |
412 | if (r < 0) | |
413 | return log_oom(); | |
414 | } | |
e3bff60a MP |
415 | |
416 | mkdir_parents_label(i->temp_path, 0700); | |
417 | ||
418 | r = btrfs_subvol_make(i->temp_path); | |
419 | if (r == -ENOTTY) { | |
420 | if (mkdir(i->temp_path, 0755) < 0) | |
421 | return log_error_errno(errno, "Failed to create directory %s: %m", i->temp_path); | |
422 | } else if (r < 0) | |
db2df898 MP |
423 | return log_error_errno(r, "Failed to create subvolume %s: %m", i->temp_path); |
424 | else | |
425 | (void) import_assign_pool_quota_and_warn(i->temp_path); | |
e3bff60a MP |
426 | |
427 | j->disk_fd = import_fork_tar_x(i->temp_path, &i->tar_pid); | |
428 | if (j->disk_fd < 0) | |
429 | return j->disk_fd; | |
430 | ||
431 | return 0; | |
432 | } | |
433 | ||
6300502b MP |
434 | static int tar_pull_job_on_open_disk_settings(PullJob *j) { |
435 | TarPull *i; | |
436 | int r; | |
437 | ||
438 | assert(j); | |
439 | assert(j->userdata); | |
440 | ||
441 | i = j->userdata; | |
442 | assert(i->settings_job == j); | |
6300502b | 443 | |
2897b343 MP |
444 | if (!i->settings_temp_path) { |
445 | r = tempfn_random_child(i->image_root, "settings", &i->settings_temp_path); | |
446 | if (r < 0) | |
447 | return log_oom(); | |
448 | } | |
6300502b MP |
449 | |
450 | mkdir_parents_label(i->settings_temp_path, 0700); | |
451 | ||
452 | j->disk_fd = open(i->settings_temp_path, O_RDWR|O_CREAT|O_EXCL|O_NOCTTY|O_CLOEXEC, 0664); | |
453 | if (j->disk_fd < 0) | |
454 | return log_error_errno(errno, "Failed to create %s: %m", i->settings_temp_path); | |
455 | ||
456 | return 0; | |
457 | } | |
458 | ||
e3bff60a MP |
459 | static void tar_pull_job_on_progress(PullJob *j) { |
460 | TarPull *i; | |
461 | ||
462 | assert(j); | |
463 | assert(j->userdata); | |
464 | ||
465 | i = j->userdata; | |
466 | ||
467 | tar_pull_report_progress(i, TAR_DOWNLOADING); | |
468 | } | |
469 | ||
6300502b MP |
470 | int tar_pull_start( |
471 | TarPull *i, | |
472 | const char *url, | |
473 | const char *local, | |
474 | bool force_local, | |
475 | ImportVerify verify, | |
476 | bool settings) { | |
477 | ||
e3bff60a MP |
478 | int r; |
479 | ||
480 | assert(i); | |
6300502b MP |
481 | assert(verify < _IMPORT_VERIFY_MAX); |
482 | assert(verify >= 0); | |
e3bff60a MP |
483 | |
484 | if (!http_url_is_valid(url)) | |
485 | return -EINVAL; | |
486 | ||
487 | if (local && !machine_name_is_valid(local)) | |
488 | return -EINVAL; | |
489 | ||
490 | if (i->tar_job) | |
491 | return -EBUSY; | |
492 | ||
493 | r = free_and_strdup(&i->local, local); | |
494 | if (r < 0) | |
495 | return r; | |
6300502b | 496 | |
e3bff60a MP |
497 | i->force_local = force_local; |
498 | i->verify = verify; | |
6300502b | 499 | i->settings = settings; |
e3bff60a | 500 | |
6300502b | 501 | /* Set up download job for TAR file */ |
e3bff60a MP |
502 | r = pull_job_new(&i->tar_job, url, i->glue, i); |
503 | if (r < 0) | |
504 | return r; | |
505 | ||
506 | i->tar_job->on_finished = tar_pull_job_on_finished; | |
6300502b | 507 | i->tar_job->on_open_disk = tar_pull_job_on_open_disk_tar; |
e3bff60a MP |
508 | i->tar_job->on_progress = tar_pull_job_on_progress; |
509 | i->tar_job->calc_checksum = verify != IMPORT_VERIFY_NO; | |
e3bff60a MP |
510 | |
511 | r = pull_find_old_etags(url, i->image_root, DT_DIR, ".tar-", NULL, &i->tar_job->old_etags); | |
512 | if (r < 0) | |
513 | return r; | |
514 | ||
6300502b MP |
515 | /* Set up download job for the settings file (.nspawn) */ |
516 | if (settings) { | |
2897b343 | 517 | r = pull_make_auxiliary_job(&i->settings_job, url, tar_strip_suffixes, ".nspawn", i->glue, tar_pull_job_on_finished, i); |
6300502b MP |
518 | if (r < 0) |
519 | return r; | |
520 | ||
521 | i->settings_job->on_open_disk = tar_pull_job_on_open_disk_settings; | |
522 | i->settings_job->on_progress = tar_pull_job_on_progress; | |
523 | i->settings_job->calc_checksum = verify != IMPORT_VERIFY_NO; | |
6300502b MP |
524 | } |
525 | ||
526 | /* Set up download of checksum/signature files */ | |
e3bff60a MP |
527 | r = pull_make_verification_jobs(&i->checksum_job, &i->signature_job, verify, url, i->glue, tar_pull_job_on_finished, i); |
528 | if (r < 0) | |
529 | return r; | |
530 | ||
531 | r = pull_job_begin(i->tar_job); | |
532 | if (r < 0) | |
533 | return r; | |
534 | ||
6300502b MP |
535 | if (i->settings_job) { |
536 | r = pull_job_begin(i->settings_job); | |
537 | if (r < 0) | |
538 | return r; | |
539 | } | |
540 | ||
e3bff60a MP |
541 | if (i->checksum_job) { |
542 | i->checksum_job->on_progress = tar_pull_job_on_progress; | |
81c58355 | 543 | i->checksum_job->style = VERIFICATION_PER_FILE; |
e3bff60a MP |
544 | |
545 | r = pull_job_begin(i->checksum_job); | |
546 | if (r < 0) | |
547 | return r; | |
548 | } | |
549 | ||
550 | if (i->signature_job) { | |
551 | i->signature_job->on_progress = tar_pull_job_on_progress; | |
552 | ||
553 | r = pull_job_begin(i->signature_job); | |
554 | if (r < 0) | |
555 | return r; | |
556 | } | |
557 | ||
558 | return 0; | |
559 | } |