1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
8 #include "alloc-util.h"
9 #include "btrfs-util.h"
11 #include "curl-util.h"
14 #include "hostname-util.h"
15 #include "import-common.h"
16 #include "import-util.h"
17 #include "install-file.h"
19 #include "mkdir-label.h"
20 #include "path-util.h"
21 #include "process-util.h"
22 #include "pull-common.h"
26 #include "string-util.h"
28 #include "tmpfile-util.h"
29 #include "user-util.h"
33 typedef enum TarProgress
{
49 PullJob
*checksum_job
;
50 PullJob
*signature_job
;
51 PullJob
*settings_job
;
53 TarPullFinished on_finished
;
64 char *settings_temp_path
;
69 TarPull
* tar_pull_unref(TarPull
*i
) {
74 sigkill_wait(i
->tar_pid
);
76 pull_job_unref(i
->tar_job
);
77 pull_job_unref(i
->checksum_job
);
78 pull_job_unref(i
->signature_job
);
79 pull_job_unref(i
->settings_job
);
81 curl_glue_unref(i
->glue
);
82 sd_event_unref(i
->event
);
84 rm_rf_subvolume_and_free(i
->temp_path
);
85 unlink_and_free(i
->settings_temp_path
);
88 free(i
->settings_path
);
99 const char *image_root
,
100 TarPullFinished on_finished
,
103 _cleanup_(curl_glue_unrefp
) CurlGlue
*g
= NULL
;
104 _cleanup_(sd_event_unrefp
) sd_event
*e
= NULL
;
105 _cleanup_(tar_pull_unrefp
) TarPull
*i
= NULL
;
106 _cleanup_free_
char *root
= NULL
;
111 root
= strdup(image_root
?: "/var/lib/machines");
116 e
= sd_event_ref(event
);
118 r
= sd_event_default(&e
);
123 r
= curl_glue_new(&g
, e
);
132 .on_finished
= on_finished
,
133 .userdata
= userdata
,
134 .image_root
= TAKE_PTR(root
),
135 .event
= TAKE_PTR(e
),
139 i
->glue
->on_finished
= pull_job_curl_on_finished
;
140 i
->glue
->userdata
= i
;
147 static void tar_pull_report_progress(TarPull
*i
, TarProgress p
) {
154 case TAR_DOWNLOADING
: {
155 unsigned remain
= 85;
159 if (i
->checksum_job
) {
160 percent
+= i
->checksum_job
->progress_percent
* 5 / 100;
164 if (i
->signature_job
) {
165 percent
+= i
->signature_job
->progress_percent
* 5 / 100;
169 if (i
->settings_job
) {
170 percent
+= i
->settings_job
->progress_percent
* 5 / 100;
175 percent
+= i
->tar_job
->progress_percent
* remain
/ 100;
192 assert_not_reached();
195 sd_notifyf(false, "X_IMPORT_PROGRESS=%u", percent
);
196 log_debug("Combined progress %u%%", percent
);
199 static int tar_pull_determine_path(
202 char **field
/* input + output (!) */) {
213 r
= pull_make_path(i
->tar_job
->url
, i
->tar_job
->etag
, i
->image_root
, ".tar-", suffix
, field
);
220 static int tar_pull_make_local_copy(TarPull
*i
) {
221 _cleanup_(rm_rf_subvolume_and_freep
) char *t
= NULL
;
231 assert(i
->final_path
);
233 p
= prefix_roota(i
->image_root
, i
->local
);
235 r
= tempfn_random(p
, NULL
, &t
);
237 return log_error_errno(r
, "Failed to generate temporary filename for %s: %m", p
);
239 if (i
->flags
& PULL_BTRFS_SUBVOL
)
240 r
= btrfs_subvol_snapshot_at(
241 AT_FDCWD
, i
->final_path
,
243 (i
->flags
& PULL_BTRFS_QUOTA
? BTRFS_SNAPSHOT_QUOTA
: 0)|
244 BTRFS_SNAPSHOT_FALLBACK_COPY
|
245 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY
|
246 BTRFS_SNAPSHOT_RECURSIVE
);
248 r
= copy_tree(i
->final_path
, t
, UID_INVALID
, GID_INVALID
, COPY_REFLINK
|COPY_HARDLINKS
, NULL
);
250 return log_error_errno(r
, "Failed to create local image: %m");
252 r
= install_file(AT_FDCWD
, t
,
254 (i
->flags
& PULL_FORCE
? INSTALL_REPLACE
: 0) |
255 (i
->flags
& PULL_READ_ONLY
? INSTALL_READ_ONLY
: 0) |
256 (i
->flags
& PULL_SYNC
? INSTALL_SYNCFS
: 0));
258 return log_error_errno(r
, "Failed to install local image '%s': %m", p
);
262 log_info("Created new local image '%s'.", i
->local
);
264 if (FLAGS_SET(i
->flags
, PULL_SETTINGS
)) {
265 const char *local_settings
;
266 assert(i
->settings_job
);
268 r
= tar_pull_determine_path(i
, ".nspawn", &i
->settings_path
);
272 local_settings
= strjoina(i
->image_root
, "/", i
->local
, ".nspawn");
274 r
= copy_file_atomic(
279 (FLAGS_SET(i
->flags
, PULL_FORCE
) ? COPY_REPLACE
: 0) |
280 (FLAGS_SET(i
->flags
, PULL_SYNC
) ? COPY_FSYNC_FULL
: 0));
282 log_warning_errno(r
, "Settings file %s already exists, not replacing.", local_settings
);
283 else if (r
== -ENOENT
)
284 log_debug_errno(r
, "Skipping creation of settings file, since none was found.");
286 log_warning_errno(r
, "Failed to copy settings files %s, ignoring: %m", local_settings
);
288 log_info("Created new settings file %s.", local_settings
);
294 static bool tar_pull_is_done(TarPull
*i
) {
298 if (!PULL_JOB_IS_COMPLETE(i
->tar_job
))
300 if (i
->checksum_job
&& !PULL_JOB_IS_COMPLETE(i
->checksum_job
))
302 if (i
->signature_job
&& !PULL_JOB_IS_COMPLETE(i
->signature_job
))
304 if (i
->settings_job
&& !PULL_JOB_IS_COMPLETE(i
->settings_job
))
310 static void tar_pull_job_on_finished(PullJob
*j
) {
320 if (j
== i
->tar_job
) {
321 if (j
->error
== ENOMEDIUM
) /* HTTP 404 */
322 r
= log_error_errno(j
->error
, "Failed to retrieve image file. (Wrong URL?)");
324 r
= log_error_errno(j
->error
, "Failed to retrieve image file.");
326 } else if (j
== i
->checksum_job
) {
327 r
= log_error_errno(j
->error
, "Failed to retrieve SHA256 checksum, cannot verify. (Try --verify=no?)");
329 } else if (j
== i
->signature_job
)
330 log_debug_errno(j
->error
, "Signature job for %s failed, proceeding for now.", j
->url
);
331 else if (j
== i
->settings_job
)
332 log_info_errno(j
->error
, "Settings file could not be retrieved, proceeding without.");
334 assert("unexpected job");
337 /* This is invoked if either the download completed successfully, or the download was skipped because
338 * we already have the etag. */
340 if (!tar_pull_is_done(i
))
343 if (i
->signature_job
&& i
->signature_job
->error
!= 0) {
344 VerificationStyle style
;
346 assert(i
->checksum_job
);
348 r
= verification_style_from_url(i
->checksum_job
->url
, &style
);
350 log_error_errno(r
, "Failed to determine verification style from checksum URL: %m");
354 if (style
== VERIFICATION_PER_DIRECTORY
) { /* A failed signature file download only matters
355 * in per-directory verification mode, since only
356 * then the signature is detached, and thus a file
358 r
= log_error_errno(i
->signature_job
->error
,
359 "Failed to retrieve signature file, cannot verify. (Try --verify=no?)");
364 pull_job_close_disk_fd(i
->tar_job
);
365 pull_job_close_disk_fd(i
->settings_job
);
367 if (i
->tar_pid
> 0) {
368 r
= wait_for_terminate_and_check("tar", TAKE_PID(i
->tar_pid
), WAIT_LOG
);
371 if (r
!= EXIT_SUCCESS
) {
377 if (!i
->tar_job
->etag_exists
) {
378 /* This is a new download, verify it, and move it into place */
380 tar_pull_report_progress(i
, TAR_VERIFYING
);
382 r
= pull_verify(i
->verify
,
388 /* roothash_job = */ NULL
,
389 /* roothash_signature_job = */ NULL
,
390 /* verity_job = */ NULL
);
395 if (i
->flags
& PULL_DIRECT
) {
396 assert(!i
->settings_job
);
398 assert(!i
->temp_path
);
400 tar_pull_report_progress(i
, TAR_FINALIZING
);
402 r
= import_mangle_os_tree(i
->local
);
409 (i
->flags
& PULL_READ_ONLY
) ? INSTALL_READ_ONLY
: 0 |
410 (i
->flags
& PULL_SYNC
? INSTALL_SYNCFS
: 0));
412 log_error_errno(r
, "Failed to finalize '%s': %m", i
->local
);
416 r
= tar_pull_determine_path(i
, NULL
, &i
->final_path
);
420 if (!i
->tar_job
->etag_exists
) {
421 /* This is a new download, verify it, and move it into place */
423 assert(i
->temp_path
);
424 assert(i
->final_path
);
426 tar_pull_report_progress(i
, TAR_FINALIZING
);
428 r
= import_mangle_os_tree(i
->temp_path
);
433 AT_FDCWD
, i
->temp_path
,
434 AT_FDCWD
, i
->final_path
,
436 (i
->flags
& PULL_SYNC
? INSTALL_SYNCFS
: 0));
438 log_error_errno(r
, "Failed to rename to final image name to %s: %m", i
->final_path
);
442 i
->temp_path
= mfree(i
->temp_path
);
444 if (i
->settings_job
&&
445 i
->settings_job
->error
== 0) {
447 /* Also move the settings file into place, if it exists. Note that we do so only if we also
448 * moved the tar file in place, to keep things strictly in sync. */
449 assert(i
->settings_temp_path
);
451 /* Regenerate final name for this auxiliary file, we might know the etag of the file now, and
452 * we should incorporate it in the file name if we can */
453 i
->settings_path
= mfree(i
->settings_path
);
455 r
= tar_pull_determine_path(i
, ".nspawn", &i
->settings_path
);
460 AT_FDCWD
, i
->settings_temp_path
,
461 AT_FDCWD
, i
->settings_path
,
463 (i
->flags
& PULL_SYNC
? INSTALL_FSYNC_FULL
: 0));
465 log_error_errno(r
, "Failed to rename settings file to %s: %m", i
->settings_path
);
469 i
->settings_temp_path
= mfree(i
->settings_temp_path
);
473 tar_pull_report_progress(i
, TAR_COPYING
);
475 r
= tar_pull_make_local_copy(i
);
484 i
->on_finished(i
, r
, i
->userdata
);
486 sd_event_exit(i
->event
, r
);
489 static int tar_pull_job_on_open_disk_tar(PullJob
*j
) {
498 assert(i
->tar_job
== j
);
499 assert(i
->tar_pid
<= 0);
501 if (i
->flags
& PULL_DIRECT
)
505 r
= tempfn_random_child(i
->image_root
, "tar", &i
->temp_path
);
510 where
= i
->temp_path
;
513 (void) mkdir_parents_label(where
, 0700);
515 if (FLAGS_SET(i
->flags
, PULL_DIRECT
|PULL_FORCE
))
516 (void) rm_rf(where
, REMOVE_ROOT
|REMOVE_PHYSICAL
|REMOVE_SUBVOLUME
);
518 if (i
->flags
& PULL_BTRFS_SUBVOL
)
519 r
= btrfs_subvol_make_fallback(where
, 0755);
521 r
= RET_NERRNO(mkdir(where
, 0755));
522 if (r
== -EEXIST
&& (i
->flags
& PULL_DIRECT
)) /* EEXIST is OK if in direct mode, but not otherwise,
523 * because in that case our temporary path collided */
526 return log_error_errno(r
, "Failed to create directory/subvolume %s: %m", where
);
527 if (r
> 0 && (i
->flags
& PULL_BTRFS_QUOTA
)) { /* actually btrfs subvol */
528 if (!(i
->flags
& PULL_DIRECT
))
529 (void) import_assign_pool_quota_and_warn(i
->image_root
);
530 (void) import_assign_pool_quota_and_warn(where
);
533 j
->disk_fd
= import_fork_tar_x(where
, &i
->tar_pid
);
540 static int tar_pull_job_on_open_disk_settings(PullJob
*j
) {
548 assert(i
->settings_job
== j
);
550 if (!i
->settings_temp_path
) {
551 r
= tempfn_random_child(i
->image_root
, "settings", &i
->settings_temp_path
);
556 (void) mkdir_parents_label(i
->settings_temp_path
, 0700);
558 j
->disk_fd
= open(i
->settings_temp_path
, O_RDWR
|O_CREAT
|O_EXCL
|O_NOCTTY
|O_CLOEXEC
, 0664);
560 return log_error_errno(errno
, "Failed to create %s: %m", i
->settings_temp_path
);
565 static void tar_pull_job_on_progress(PullJob
*j
) {
573 tar_pull_report_progress(i
, TAR_DOWNLOADING
);
582 const char *checksum
) {
588 assert(verify
== _IMPORT_VERIFY_INVALID
|| verify
< _IMPORT_VERIFY_MAX
);
589 assert(verify
== _IMPORT_VERIFY_INVALID
|| verify
>= 0);
590 assert((verify
< 0) || !checksum
);
591 assert(!(flags
& ~PULL_FLAGS_MASK_TAR
));
592 assert(!(flags
& PULL_SETTINGS
) || !(flags
& PULL_DIRECT
));
593 assert(!(flags
& PULL_SETTINGS
) || !checksum
);
595 if (!http_url_is_valid(url
) && !file_url_is_valid(url
))
598 if (local
&& !pull_validate_local(local
, flags
))
604 r
= free_and_strdup(&i
->local
, local
);
608 r
= free_and_strdup(&i
->checksum
, checksum
);
615 /* Set up download job for TAR file */
616 r
= pull_job_new(&i
->tar_job
, url
, i
->glue
, i
);
620 i
->tar_job
->on_finished
= tar_pull_job_on_finished
;
621 i
->tar_job
->on_open_disk
= tar_pull_job_on_open_disk_tar
;
622 i
->tar_job
->calc_checksum
= checksum
|| IN_SET(verify
, IMPORT_VERIFY_CHECKSUM
, IMPORT_VERIFY_SIGNATURE
);
624 if (!FLAGS_SET(flags
, PULL_DIRECT
)) {
625 r
= pull_find_old_etags(url
, i
->image_root
, DT_DIR
, ".tar-", NULL
, &i
->tar_job
->old_etags
);
630 /* Set up download of checksum/signature files */
631 r
= pull_make_verification_jobs(
638 tar_pull_job_on_finished
,
643 /* Set up download job for the settings file (.nspawn) */
644 if (FLAGS_SET(flags
, PULL_SETTINGS
)) {
645 r
= pull_make_auxiliary_job(
652 tar_pull_job_on_open_disk_settings
,
653 tar_pull_job_on_finished
,
668 j
->on_progress
= tar_pull_job_on_progress
;
669 j
->sync
= FLAGS_SET(flags
, PULL_SYNC
);
671 r
= pull_job_begin(j
);