src/import/pull-tar.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2015 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <curl/curl.h>
  21 #include <sys/prctl.h>
  22
  23 #include "sd-daemon.h"
  24
  25 #include "alloc-util.h"
  26 #include "btrfs-util.h"
  27 #include "copy.h"
  28 #include "curl-util.h"
  29 #include "fd-util.h"
  30 #include "fileio.h"
  31 #include "fs-util.h"
  32 #include "hostname-util.h"
  33 #include "import-common.h"
  34 #include "import-util.h"
  35 #include "macro.h"
  36 #include "mkdir.h"
  37 #include "path-util.h"
  38 #include "process-util.h"
  39 #include "pull-common.h"
  40 #include "pull-job.h"
  41 #include "pull-tar.h"
  42 #include "rm-rf.h"
  43 #include "string-util.h"
  44 #include "strv.h"
  45 #include "utf8.h"
  46 #include "util.h"
  47 #include "web-util.h"
  48
  49 typedef enum TarProgress {
  50         TAR_DOWNLOADING,
  51         TAR_VERIFYING,
  52         TAR_FINALIZING,
  53         TAR_COPYING,
  54 } TarProgress;
  55
  56 struct TarPull {
  57         sd_event *event;
  58         CurlGlue *glue;
  59
  60         char *image_root;
  61
  62         PullJob *tar_job;
  63         PullJob *settings_job;
  64         PullJob *checksum_job;
  65         PullJob *signature_job;
  66
  67         TarPullFinished on_finished;
  68         void *userdata;
  69
  70         char *local;
  71         bool force_local;
  72         bool grow_machine_directory;
  73         bool settings;
  74
  75         pid_t tar_pid;
  76
  77         char *final_path;
  78         char *temp_path;
  79
  80         char *settings_path;
  81         char *settings_temp_path;
  82
  83         ImportVerify verify;
  84 };
  85
  86 TarPull* tar_pull_unref(TarPull *i) {
  87         if (!i)
  88                 return NULL;
  89
  90         if (i->tar_pid > 1) {
  91                 (void) kill_and_sigcont(i->tar_pid, SIGKILL);
  92                 (void) wait_for_terminate(i->tar_pid, NULL);
  93         }
  94
  95         pull_job_unref(i->tar_job);
  96         pull_job_unref(i->settings_job);
  97         pull_job_unref(i->checksum_job);
  98         pull_job_unref(i->signature_job);
  99
 100         curl_glue_unref(i->glue);
 101         sd_event_unref(i->event);
 102
 103         if (i->temp_path) {
 104                 (void) rm_rf(i->temp_path, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
 105                 free(i->temp_path);
 106         }
 107
 108         if (i->settings_temp_path) {
 109                 (void) unlink(i->settings_temp_path);
 110                 free(i->settings_temp_path);
 111         }
 112
 113         free(i->final_path);
 114         free(i->settings_path);
 115         free(i->image_root);
 116         free(i->local);
 117         return mfree(i);
 118 }
 119
 120 int tar_pull_new(
 121                 TarPull **ret,
 122                 sd_event *event,
 123                 const char *image_root,
 124                 TarPullFinished on_finished,
 125                 void *userdata) {
 126
 127         _cleanup_(tar_pull_unrefp) TarPull *i = NULL;
 128         int r;
 129
 130         assert(ret);
 131
 132         i = new0(TarPull, 1);
 133         if (!i)
 134                 return -ENOMEM;
 135
 136         i->on_finished = on_finished;
 137         i->userdata = userdata;
 138
 139         i->image_root = strdup(image_root ?: "/var/lib/machines");
 140         if (!i->image_root)
 141                 return -ENOMEM;
 142
 143         i->grow_machine_directory = path_startswith(i->image_root, "/var/lib/machines");
 144
 145         if (event)
 146                 i->event = sd_event_ref(event);
 147         else {
 148                 r = sd_event_default(&i->event);
 149                 if (r < 0)
 150                         return r;
 151         }
 152
 153         r = curl_glue_new(&i->glue, i->event);
 154         if (r < 0)
 155                 return r;
 156
 157         i->glue->on_finished = pull_job_curl_on_finished;
 158         i->glue->userdata = i;
 159
 160         *ret = i;
 161         i = NULL;
 162
 163         return 0;
 164 }
 165
 166 static void tar_pull_report_progress(TarPull *i, TarProgress p) {
 167         unsigned percent;
 168
 169         assert(i);
 170
 171         switch (p) {
 172
 173         case TAR_DOWNLOADING: {
 174                 unsigned remain = 85;
 175
 176                 percent = 0;
 177
 178                 if (i->settings_job) {
 179                         percent += i->settings_job->progress_percent * 5 / 100;
 180                         remain -= 5;
 181                 }
 182
 183                 if (i->checksum_job) {
 184                         percent += i->checksum_job->progress_percent * 5 / 100;
 185                         remain -= 5;
 186                 }
 187
 188                 if (i->signature_job) {
 189                         percent += i->signature_job->progress_percent * 5 / 100;
 190                         remain -= 5;
 191                 }
 192
 193                 if (i->tar_job)
 194                         percent += i->tar_job->progress_percent * remain / 100;
 195                 break;
 196         }
 197
 198         case TAR_VERIFYING:
 199                 percent = 85;
 200                 break;
 201
 202         case TAR_FINALIZING:
 203                 percent = 90;
 204                 break;
 205
 206         case TAR_COPYING:
 207                 percent = 95;
 208                 break;
 209
 210         default:
 211                 assert_not_reached("Unknown progress state");
 212         }
 213
 214         sd_notifyf(false, "X_IMPORT_PROGRESS=%u", percent);
 215         log_debug("Combined progress %u%%", percent);
 216 }
 217
 218 static int tar_pull_determine_path(TarPull *i, const char *suffix, char **field) {
 219         int r;
 220
 221         assert(i);
 222         assert(field);
 223
 224         if (*field)
 225                 return 0;
 226
 227         assert(i->tar_job);
 228
 229         r = pull_make_path(i->tar_job->url, i->tar_job->etag, i->image_root, ".tar-", suffix, field);
 230         if (r < 0)
 231                 return log_oom();
 232
 233         return 1;
 234 }
 235
 236 static int tar_pull_make_local_copy(TarPull *i) {
 237         int r;
 238
 239         assert(i);
 240         assert(i->tar_job);
 241
 242         if (!i->local)
 243                 return 0;
 244
 245         r = pull_make_local_copy(i->final_path, i->image_root, i->local, i->force_local);
 246         if (r < 0)
 247                 return r;
 248
 249         if (i->settings) {
 250                 const char *local_settings;
 251                 assert(i->settings_job);
 252
 253                 r = tar_pull_determine_path(i, ".nspawn", &i->settings_path);
 254                 if (r < 0)
 255                         return r;
 256
 257                 local_settings = strjoina(i->image_root, "/", i->local, ".nspawn");
 258
 259                 r = copy_file_atomic(i->settings_path, local_settings, 0664, 0, COPY_REFLINK | (i->force_local ? COPY_REPLACE : 0));
 260                 if (r == -EEXIST)
 261                         log_warning_errno(r, "Settings file %s already exists, not replacing.", local_settings);
 262                 else if (r == -ENOENT)
 263                         log_debug_errno(r, "Skipping creation of settings file, since none was found.");
 264                 else if (r < 0)
 265                         log_warning_errno(r, "Failed to copy settings files %s, ignoring: %m", local_settings);
 266                 else
 267                         log_info("Created new settings file %s.", local_settings);
 268         }
 269
 270         return 0;
 271 }
 272
 273 static bool tar_pull_is_done(TarPull *i) {
 274         assert(i);
 275         assert(i->tar_job);
 276
 277         if (!PULL_JOB_IS_COMPLETE(i->tar_job))
 278                 return false;
 279         if (i->settings_job && !PULL_JOB_IS_COMPLETE(i->settings_job))
 280                 return false;
 281         if (i->checksum_job && !PULL_JOB_IS_COMPLETE(i->checksum_job))
 282                 return false;
 283         if (i->signature_job && !PULL_JOB_IS_COMPLETE(i->signature_job))
 284                 return false;
 285
 286         return true;
 287 }
 288
 289 static void tar_pull_job_on_finished(PullJob *j) {
 290         TarPull *i;
 291         int r;
 292
 293         assert(j);
 294         assert(j->userdata);
 295
 296         i = j->userdata;
 297
 298         if (j == i->settings_job) {
 299                 if (j->error != 0)
 300                         log_info_errno(j->error, "Settings file could not be retrieved, proceeding without.");
 301         } else if (j->error != 0 && j != i->signature_job) {
 302                 if (j == i->checksum_job)
 303                         log_error_errno(j->error, "Failed to retrieve SHA256 checksum, cannot verify. (Try --verify=no?)");
 304                 else
 305                         log_error_errno(j->error, "Failed to retrieve image file. (Wrong URL?)");
 306
 307                 r = j->error;
 308                 goto finish;
 309         }
 310
 311         /* This is invoked if either the download completed
 312          * successfully, or the download was skipped because we
 313          * already have the etag. */
 314
 315         if (!tar_pull_is_done(i))
 316                 return;
 317
 318         if (i->checksum_job->style == VERIFICATION_PER_DIRECTORY && i->signature_job->error != 0) {
 319                 log_error_errno(j->error, "Failed to retrieve signature file, cannot verify. (Try --verify=no?)");
 320
 321                 r = i->signature_job->error;
 322                 goto finish;
 323         }
 324
 325         i->tar_job->disk_fd = safe_close(i->tar_job->disk_fd);
 326         if (i->settings_job)
 327                 i->settings_job->disk_fd = safe_close(i->settings_job->disk_fd);
 328
 329         r = tar_pull_determine_path(i, NULL, &i->final_path);
 330         if (r < 0)
 331                 goto finish;
 332
 333         if (i->tar_pid > 0) {
 334                 r = wait_for_terminate_and_warn("tar", i->tar_pid, true);
 335                 i->tar_pid = 0;
 336                 if (r < 0)
 337                         goto finish;
 338                 if (r > 0) {
 339                         r = -EIO;
 340                         goto finish;
 341                 }
 342         }
 343
 344         if (!i->tar_job->etag_exists) {
 345                 /* This is a new download, verify it, and move it into place */
 346
 347                 tar_pull_report_progress(i, TAR_VERIFYING);
 348
 349                 r = pull_verify(i->tar_job, NULL, i->settings_job, i->checksum_job, i->signature_job);
 350                 if (r < 0)
 351                         goto finish;
 352
 353                 tar_pull_report_progress(i, TAR_FINALIZING);
 354
 355                 r = import_make_read_only(i->temp_path);
 356                 if (r < 0)
 357                         goto finish;
 358
 359                 r = rename_noreplace(AT_FDCWD, i->temp_path, AT_FDCWD, i->final_path);
 360                 if (r < 0) {
 361                         log_error_errno(r, "Failed to rename to final image name: %m");
 362                         goto finish;
 363                 }
 364
 365                 i->temp_path = mfree(i->temp_path);
 366
 367                 if (i->settings_job &&
 368                     i->settings_job->error == 0) {
 369
 370                         assert(i->settings_temp_path);
 371                         assert(i->settings_path);
 372
 373                         /* Also move the settings file into place, if it exist. Note that we do so only if we also
 374                          * moved the tar file in place, to keep things strictly in sync. */
 375
 376                         i->settings_path = mfree(i->settings_path);
 377                         r = tar_pull_determine_path(i, ".nspawn", &i->settings_path);
 378                         if (r < 0)
 379                                 goto finish;
 380
 381                         r = import_make_read_only(i->settings_temp_path);
 382                         if (r < 0)
 383                                 goto finish;
 384
 385                         r = rename_noreplace(AT_FDCWD, i->settings_temp_path, AT_FDCWD, i->settings_path);
 386                         if (r < 0) {
 387                                 log_error_errno(r, "Failed to rename settings file: %m");
 388                                 goto finish;
 389                         }
 390
 391                         i->settings_temp_path = mfree(i->settings_temp_path);
 392                 }
 393         }
 394
 395         tar_pull_report_progress(i, TAR_COPYING);
 396
 397         r = tar_pull_make_local_copy(i);
 398         if (r < 0)
 399                 goto finish;
 400
 401         r = 0;
 402
 403 finish:
 404         if (i->on_finished)
 405                 i->on_finished(i, r, i->userdata);
 406         else
 407                 sd_event_exit(i->event, r);
 408 }
 409
 410 static int tar_pull_job_on_open_disk_tar(PullJob *j) {
 411         TarPull *i;
 412         int r;
 413
 414         assert(j);
 415         assert(j->userdata);
 416
 417         i = j->userdata;
 418         assert(i->tar_job == j);
 419         assert(i->tar_pid <= 0);
 420
 421         if (!i->temp_path) {
 422                 r = tempfn_random_child(i->image_root, "tar", &i->temp_path);
 423                 if (r < 0)
 424                         return log_oom();
 425         }
 426
 427         mkdir_parents_label(i->temp_path, 0700);
 428
 429         r = btrfs_subvol_make(i->temp_path);
 430         if (r == -ENOTTY) {
 431                 if (mkdir(i->temp_path, 0755) < 0)
 432                         return log_error_errno(errno, "Failed to create directory %s: %m", i->temp_path);
 433         } else if (r < 0)
 434                 return log_error_errno(r, "Failed to create subvolume %s: %m", i->temp_path);
 435         else
 436                 (void) import_assign_pool_quota_and_warn(i->temp_path);
 437
 438         j->disk_fd = import_fork_tar_x(i->temp_path, &i->tar_pid);
 439         if (j->disk_fd < 0)
 440                 return j->disk_fd;
 441
 442         return 0;
 443 }
 444
 445 static int tar_pull_job_on_open_disk_settings(PullJob *j) {
 446         TarPull *i;
 447         int r;
 448
 449         assert(j);
 450         assert(j->userdata);
 451
 452         i = j->userdata;
 453         assert(i->settings_job == j);
 454
 455         if (!i->settings_temp_path) {
 456                 r = tempfn_random_child(i->image_root, "settings", &i->settings_temp_path);
 457                 if (r < 0)
 458                         return log_oom();
 459         }
 460
 461         mkdir_parents_label(i->settings_temp_path, 0700);
 462
 463         j->disk_fd = open(i->settings_temp_path, O_RDWR|O_CREAT|O_EXCL|O_NOCTTY|O_CLOEXEC, 0664);
 464         if (j->disk_fd < 0)
 465                 return log_error_errno(errno, "Failed to create %s: %m", i->settings_temp_path);
 466
 467         return 0;
 468 }
 469
 470 static void tar_pull_job_on_progress(PullJob *j) {
 471         TarPull *i;
 472
 473         assert(j);
 474         assert(j->userdata);
 475
 476         i = j->userdata;
 477
 478         tar_pull_report_progress(i, TAR_DOWNLOADING);
 479 }
 480
 481 int tar_pull_start(
 482                 TarPull *i,
 483                 const char *url,
 484                 const char *local,
 485                 bool force_local,
 486                 ImportVerify verify,
 487                 bool settings) {
 488
 489         int r;
 490
 491         assert(i);
 492         assert(verify < _IMPORT_VERIFY_MAX);
 493         assert(verify >= 0);
 494
 495         if (!http_url_is_valid(url))
 496                 return -EINVAL;
 497
 498         if (local && !machine_name_is_valid(local))
 499                 return -EINVAL;
 500
 501         if (i->tar_job)
 502                 return -EBUSY;
 503
 504         r = free_and_strdup(&i->local, local);
 505         if (r < 0)
 506                 return r;
 507
 508         i->force_local = force_local;
 509         i->verify = verify;
 510         i->settings = settings;
 511
 512         /* Set up download job for TAR file */
 513         r = pull_job_new(&i->tar_job, url, i->glue, i);
 514         if (r < 0)
 515                 return r;
 516
 517         i->tar_job->on_finished = tar_pull_job_on_finished;
 518         i->tar_job->on_open_disk = tar_pull_job_on_open_disk_tar;
 519         i->tar_job->on_progress = tar_pull_job_on_progress;
 520         i->tar_job->calc_checksum = verify != IMPORT_VERIFY_NO;
 521         i->tar_job->grow_machine_directory = i->grow_machine_directory;
 522
 523         r = pull_find_old_etags(url, i->image_root, DT_DIR, ".tar-", NULL, &i->tar_job->old_etags);
 524         if (r < 0)
 525                 return r;
 526
 527         /* Set up download job for the settings file (.nspawn) */
 528         if (settings) {
 529                 r = pull_make_auxiliary_job(&i->settings_job, url, tar_strip_suffixes, ".nspawn", i->glue, tar_pull_job_on_finished, i);
 530                 if (r < 0)
 531                         return r;
 532
 533                 i->settings_job->on_open_disk = tar_pull_job_on_open_disk_settings;
 534                 i->settings_job->on_progress = tar_pull_job_on_progress;
 535                 i->settings_job->calc_checksum = verify != IMPORT_VERIFY_NO;
 536         }
 537
 538         /* Set up download of checksum/signature files */
 539         r = pull_make_verification_jobs(&i->checksum_job, &i->signature_job, verify, url, i->glue, tar_pull_job_on_finished, i);
 540         if (r < 0)
 541                 return r;
 542
 543         r = pull_job_begin(i->tar_job);
 544         if (r < 0)
 545                 return r;
 546
 547         if (i->settings_job) {
 548                 r = pull_job_begin(i->settings_job);
 549                 if (r < 0)
 550                         return r;
 551         }
 552
 553         if (i->checksum_job) {
 554                 i->checksum_job->on_progress = tar_pull_job_on_progress;
 555                 i->checksum_job->style = VERIFICATION_PER_FILE;
 556
 557                 r = pull_job_begin(i->checksum_job);
 558                 if (r < 0)
 559                         return r;
 560         }
 561
 562         if (i->signature_job) {
 563                 i->signature_job->on_progress = tar_pull_job_on_progress;
 564
 565                 r = pull_job_begin(i->signature_job);
 566                 if (r < 0)
 567                         return r;
 568         }
 569
 570         return 0;
 571 }