DanSandClaude Opus 4.8
bf5cb39566
Both the HEAD size probe and the archive download followed redirects with no restriction on where they could go. A redirect could therefore downgrade the transfer to plain http or point at a file:// URL, defeating the TLS verification the initial https request was relying on. - Redirects on both requests are now limited to https, so a redirect can no longer leave TLS or reach a local path. - The limit is set with the string-based curl option where available and the protocol-mask option on older libcurl. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1185 lines
50 KiB
C++
1185 lines
50 KiB
C++
// DragonX Wallet - ImGui Edition
|
|
// Copyright 2024-2026 The Hush Developers
|
|
// Released under the GPLv3
|
|
|
|
#include "bootstrap.h"
|
|
#include "../daemon/embedded_daemon.h"
|
|
|
|
#include <curl/curl.h>
|
|
#include <miniz.h>
|
|
#include <sodium.h>
|
|
|
|
#include <cstdint>
|
|
#include <cstdio>
|
|
#include <cstring>
|
|
#include <filesystem>
|
|
#include <algorithm>
|
|
#include <sstream>
|
|
#include <iomanip>
|
|
#include "../util/logger.h"
|
|
#include "http_download.h"
|
|
|
|
namespace fs = std::filesystem;
|
|
|
|
namespace dragonx {
|
|
namespace util {
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Helpers
|
|
// ---------------------------------------------------------------------------
|
|
|
|
static bool endsWith(const std::string& s, const std::string& suffix) {
|
|
if (suffix.size() > s.size()) return false;
|
|
return s.compare(s.size() - suffix.size(), suffix.size(), suffix) == 0;
|
|
}
|
|
|
|
// The components of an archive member name as the file system resolves them, so that the zip-slip check
|
|
// and the deny-list judge the path a member really lands on. '\' is a separator, empty and "." components
|
|
// are dropped ("./wallet.dat" is wallet.dat), and each component loses its trailing dots and spaces, which
|
|
// Win32 strips ("DRAGONX.conf." opens DRAGONX.conf). Anything from a ':' on is cut off: an NTFS alternate
|
|
// data stream ("DRAGONX.conf::$DATA" is the file itself). The Windows rules apply on every platform; a
|
|
// chain snapshot carries none of these names, so treating them alike everywhere costs nothing.
|
|
// Returns false (unsafe) for an absolute or drive-rooted name, a ".." component, any ':' (drive letter,
|
|
// ADS), an 8.3 short name ("DRAGON~1.CON" can open DRAGONX.conf), a component that the stripping
|
|
// empties ("...", ".. "), and any byte >= 0x80 or ASCII control character. A chain snapshot's names are
|
|
// plain ASCII, while macOS APFS/HFS+ fold or ignore some Unicode ("databa\u017Fe" is database,
|
|
// ".coo\u212Aie" is .cookie, "DRAGONX.co\u200Cnf" is DRAGONX.conf), which no byte-wise check here could
|
|
// follow. *comps is filled either way.
|
|
static bool canonicalArchivePath(const std::string& name, std::vector<std::string>* comps) {
|
|
std::vector<std::string> out;
|
|
bool safe = !name.empty();
|
|
for (unsigned char c : name)
|
|
if (c < 0x20 || c >= 0x7f) safe = false; // control character (incl. DEL) or non-ASCII
|
|
std::string n = name;
|
|
std::replace(n.begin(), n.end(), '\\', '/'); // normalize Windows separators
|
|
if (!n.empty() && n.front() == '/') safe = false; // absolute POSIX path, UNC (\\server)
|
|
size_t start = 0;
|
|
for (;;) {
|
|
const size_t slash = n.find('/', start);
|
|
std::string comp = n.substr(start, slash == std::string::npos ? std::string::npos : slash - start);
|
|
if (comp == "..") {
|
|
safe = false; // path traversal component
|
|
} else if (!comp.empty() && comp != ".") {
|
|
const size_t colon = comp.find(':');
|
|
if (colon != std::string::npos) { // drive letter (C:...) or alternate data stream
|
|
safe = false;
|
|
comp.erase(colon);
|
|
}
|
|
for (size_t t = comp.find('~'); t != std::string::npos; t = comp.find('~', t + 1))
|
|
if (t + 1 < comp.size() && comp[t + 1] >= '0' && comp[t + 1] <= '9') safe = false; // 8.3 alias
|
|
while (!comp.empty() && (comp.back() == '.' || comp.back() == ' ')) comp.pop_back();
|
|
if (comp.empty()) safe = false; // "...", ".. ", " ": no name of its own
|
|
else out.push_back(comp);
|
|
}
|
|
if (slash == std::string::npos) break;
|
|
start = slash + 1;
|
|
}
|
|
if (comps) *comps = std::move(out);
|
|
return safe;
|
|
}
|
|
|
|
// Reject archive member names that would escape the extraction root (zip-slip) or that a Windows file
|
|
// system would resolve onto another name (see canonicalArchivePath). The snapshot legitimately carries
|
|
// sub-paths (blocks/, chainstate/), so — unlike the updaters, which flatten to baseName() — we keep the
|
|
// relative path.
|
|
static bool isSafeArchivePath(const std::string& name) {
|
|
return canonicalArchivePath(name, nullptr);
|
|
}
|
|
|
|
// A member name as it may appear in an error or a log line: bytes outside printable ASCII become \xNN, so a
|
|
// refused name cannot break the log into forged lines or carry terminal escapes.
|
|
static std::string printableArchiveName(const std::string& name) {
|
|
static const char kHex[] = "0123456789ABCDEF";
|
|
std::string out;
|
|
out.reserve(name.size());
|
|
for (unsigned char c : name) {
|
|
if (c >= 0x20 && c < 0x7f) {
|
|
out.push_back(static_cast<char>(c));
|
|
} else {
|
|
out += "\\x";
|
|
out.push_back(kHex[c >> 4]);
|
|
out.push_back(kHex[c & 0xF]);
|
|
}
|
|
}
|
|
return out;
|
|
}
|
|
|
|
static std::string joinArchivePath(const std::vector<std::string>& comps) {
|
|
std::string p;
|
|
for (const std::string& c : comps) {
|
|
if (!p.empty()) p += '/';
|
|
p += c;
|
|
}
|
|
return p;
|
|
}
|
|
|
|
static std::uint64_t satAdd(std::uint64_t a, std::uint64_t b) {
|
|
return (a > UINT64_MAX - b) ? UINT64_MAX : a + b;
|
|
}
|
|
|
|
// fs::file_size is 64-bit on every platform; ftell() returns a 32-bit long on Win LLP64.
|
|
static long long fileSizeOrZero(const std::string& path) {
|
|
std::error_code ec;
|
|
auto sz = fs::file_size(path, ec);
|
|
return ec ? 0 : (long long)sz;
|
|
}
|
|
|
|
static std::string lowerAscii(std::string s) {
|
|
for (char& c : s)
|
|
if (c >= 'A' && c <= 'Z') c = static_cast<char>(c - 'A' + 'a');
|
|
return s;
|
|
}
|
|
|
|
// The production probes: the daemon is gone only when its PROCESS has exited, not just its RPC port.
|
|
static bool realDaemonUp() {
|
|
return daemon::EmbeddedDaemon::isRpcPortInUse() || daemon::EmbeddedDaemon::isDaemonProcessRunning();
|
|
}
|
|
|
|
static fs::space_info realSpace(const std::string& path, std::error_code& ec) {
|
|
return fs::space(path, ec);
|
|
}
|
|
|
|
// HEAD and checksum transfers: end at once on cancel. libcurl calls this about once a second even while it
|
|
// resolves or connects, so a quit never waits out their 15-30 s timeouts.
|
|
static int abortOnCancelCallback(void* clientp, curl_off_t, curl_off_t, curl_off_t, curl_off_t) {
|
|
return static_cast<const std::atomic<bool>*>(clientp)->load() ? 1 : 0;
|
|
}
|
|
|
|
static size_t writeFileCallback(void* contents, size_t size, size_t nmemb, void* userp) {
|
|
size_t total = size * nmemb;
|
|
FILE* fp = static_cast<FILE*>(userp);
|
|
return fwrite(contents, 1, total, fp);
|
|
}
|
|
|
|
std::string Bootstrap::formatSize(double bytes) {
|
|
const char* units[] = { "B", "KB", "MB", "GB", "TB" };
|
|
int idx = 0;
|
|
double v = bytes;
|
|
while (v >= 1024.0 && idx < 4) {
|
|
v /= 1024.0;
|
|
idx++;
|
|
}
|
|
char buf[64];
|
|
if (idx == 0)
|
|
snprintf(buf, sizeof(buf), "%.0f %s", v, units[idx]);
|
|
else
|
|
snprintf(buf, sizeof(buf), "%.2f %s", v, units[idx]);
|
|
return buf;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Lifecycle
|
|
// ---------------------------------------------------------------------------
|
|
|
|
Bootstrap::~Bootstrap() {
|
|
cancel();
|
|
if (worker_.joinable()) worker_.join();
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Public API
|
|
// ---------------------------------------------------------------------------
|
|
|
|
void Bootstrap::beginRun() {
|
|
cancel_requested_ = false;
|
|
worker_running_ = true;
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
progress_ = Progress{};
|
|
}
|
|
|
|
void Bootstrap::start(const std::string& dataDir, const std::string& url) {
|
|
if (worker_running_) return; // already running
|
|
if (worker_.joinable()) worker_.join();
|
|
|
|
beginRun();
|
|
|
|
// Ensure data dir exists
|
|
std::error_code ec;
|
|
fs::create_directories(dataDir, ec);
|
|
|
|
worker_ = std::thread([this, dataDir, url]() {
|
|
runDownloadAndInstall(dataDir, url);
|
|
worker_running_ = false; // after the terminal publish: isDone() turns true only now
|
|
});
|
|
}
|
|
|
|
void Bootstrap::startFromZip(const std::string& dataDir, const std::string& zipPath,
|
|
DaemonUpFn daemonUp, SpaceFn spaceFn) {
|
|
if (worker_running_) return; // already running
|
|
if (worker_.joinable()) worker_.join();
|
|
|
|
beginRun();
|
|
if (!daemonUp) daemonUp = realDaemonUp;
|
|
if (!spaceFn) spaceFn = realSpace;
|
|
|
|
std::error_code ec;
|
|
fs::create_directories(dataDir, ec);
|
|
|
|
worker_ = std::thread([this, dataDir, zipPath, daemonUp, spaceFn]() {
|
|
installFromZip(dataDir, zipPath, daemonUp, spaceFn);
|
|
worker_running_ = false;
|
|
});
|
|
}
|
|
|
|
void Bootstrap::runDownloadAndInstall(const std::string& dataDir, const std::string& url) {
|
|
std::string zipPath = dataDir + "/bootstrap_tmp.zip";
|
|
|
|
// Step 1: Download (with resume support)
|
|
// Check for a partial file from a previous interrupted download.
|
|
{
|
|
std::error_code ec;
|
|
if (fs::exists(zipPath, ec) && fs::file_size(zipPath, ec) > 0 && !ec) {
|
|
auto partial = fs::file_size(zipPath, ec);
|
|
DEBUG_LOGF("[Bootstrap] Found partial download: %s (%s)\n",
|
|
zipPath.c_str(), formatSize((double)partial).c_str());
|
|
setProgress(State::Downloading,
|
|
"Resuming download (" + formatSize((double)partial) + " already on disk)...");
|
|
} else {
|
|
setProgress(State::Downloading, "Connecting to dragonx.is...");
|
|
}
|
|
}
|
|
if (!download(url, zipPath)) {
|
|
// Keep the partial file so the next attempt can resume.
|
|
// Only delete if the file is empty / doesn't exist.
|
|
std::error_code ec;
|
|
auto sz = fs::exists(zipPath, ec) ? fs::file_size(zipPath, ec) : 0;
|
|
if (sz == 0) fs::remove(zipPath, ec);
|
|
std::string why;
|
|
if (cancel_requested_)
|
|
why = "Download cancelled";
|
|
else if (!download_error_.empty())
|
|
why = download_error_;
|
|
else if (last_curl_ == CURLE_WRITE_ERROR)
|
|
why = (sz > 0 && sz != static_cast<std::uintmax_t>(-1))
|
|
? "Could not write the download to disk (disk full?) - kept " + zipPath + " (" +
|
|
formatSize((double)sz) + ") to resume"
|
|
: std::string("Could not write the download to disk (disk full?)");
|
|
else
|
|
why = (sz > 0 && sz != static_cast<std::uintmax_t>(-1))
|
|
? "Download failed — " + formatSize((double)sz) + " kept, will resume on retry"
|
|
: std::string("Download failed — check your internet connection");
|
|
setProgress(State::Failed, why); // last: after the partial-file cleanup
|
|
return;
|
|
}
|
|
|
|
if (cancel_requested_) {
|
|
setProgress(State::Failed, "Download cancelled");
|
|
// Keep partial file for resume on retry.
|
|
return;
|
|
}
|
|
// Step 2: Verify checksums (also for a reused complete download)
|
|
{
|
|
// Derive base URL from the zip URL (strip filename)
|
|
std::string baseUrl = url;
|
|
auto lastSlash = baseUrl.rfind('/');
|
|
if (lastSlash != std::string::npos)
|
|
baseUrl = baseUrl.substr(0, lastSlash);
|
|
|
|
if (!verifyChecksums(zipPath, baseUrl)) {
|
|
if (cancel_requested_) {
|
|
setProgress(State::Failed, "Verification cancelled"); // the download is kept
|
|
return;
|
|
}
|
|
const std::string why = getProgress().error; // verifyChecksums' own reason
|
|
std::error_code ec;
|
|
if (last_verify_mismatch_) // delete only a genuinely corrupt archive;
|
|
fs::remove(zipPath, ec); // keep it on a missing/unusable sidecar or fetch blip
|
|
setProgress(State::Failed, why.empty() ? std::string("Checksum verification failed") : why);
|
|
return;
|
|
}
|
|
}
|
|
|
|
if (cancel_requested_) {
|
|
setProgress(State::Failed, "Verification cancelled");
|
|
return;
|
|
}
|
|
|
|
installFromZip(dataDir, zipPath, realDaemonUp, realSpace);
|
|
}
|
|
|
|
void Bootstrap::installFromZip(const std::string& dataDir, const std::string& zipPath,
|
|
const DaemonUpFn& daemonUp, const SpaceFn& spaceFn) {
|
|
// Step 3: Ensure daemon is fully stopped before touching chain data. Gone means the PROCESS has
|
|
// exited, not just its RPC port: dragonxd unbinds RPC early in its shutdown and keeps its files
|
|
// (and the datadir lock) until it exits — deleting chain data under it corrupts it, or fails on
|
|
// Windows' locked files.
|
|
{
|
|
setProgress(State::Extracting, "Waiting for daemon to stop...");
|
|
int waited = 0;
|
|
while (daemonUp() && waited < 120 && !cancel_requested_) {
|
|
std::this_thread::sleep_for(std::chrono::seconds(1));
|
|
waited++;
|
|
if (waited % 5 == 0)
|
|
DEBUG_LOGF("[Bootstrap] Still waiting for daemon to stop... (%ds)\n", waited);
|
|
}
|
|
if (cancel_requested_) {
|
|
setProgress(State::Failed, "Cancelled while waiting for daemon");
|
|
return;
|
|
}
|
|
if (daemonUp()) {
|
|
setProgress(State::Failed, "Daemon is still running — stop it before using bootstrap");
|
|
return;
|
|
}
|
|
}
|
|
|
|
// Step 3b: check the archive and the disk BEFORE anything is deleted. Every failure here keeps the
|
|
// old chain data and the download.
|
|
setProgress(State::Extracting, "Checking the download and free disk space...");
|
|
const ArchivePlan plan = planArchive(zipPath);
|
|
if (!plan.ok) {
|
|
LOGF("[Bootstrap] Preflight refused the archive: %s\n", plan.error.c_str());
|
|
setProgress(State::Failed, plan.error);
|
|
return;
|
|
}
|
|
{
|
|
std::error_code ec;
|
|
const fs::space_info sp = spaceFn(dataDir, ec);
|
|
std::string msg;
|
|
if (ec) {
|
|
LOGF("[Bootstrap] Free space unknown (%s) - not checked\n", ec.message().c_str());
|
|
} else if (!spaceSufficient(plan.bytes, sp.available, sp.capacity, reclaimableBytes(dataDir), &msg)) {
|
|
LOGF("[Bootstrap] Preflight: %s\n", msg.c_str());
|
|
setProgress(State::Failed, msg);
|
|
return;
|
|
}
|
|
}
|
|
|
|
// The destructive window starts: from here the user cannot cancel (quit still can, see cancel_requested_
|
|
// in extract), and a failure removes the partial chain again before the result is published. The flip and
|
|
// the re-check share requestCancel()'s lock: a user cancel lands before this point or is refused.
|
|
bool cancelledBeforeWindow = false;
|
|
{
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
progress_.cancellable = false;
|
|
cancelledBeforeWindow = cancel_requested_;
|
|
}
|
|
if (cancelledBeforeWindow) {
|
|
setProgress(State::Failed, "Cancelled - the old chain data was not touched");
|
|
return;
|
|
}
|
|
|
|
// Step 4: Clean old chain data (verified: a locked file must not leave old and new chain files mixed)
|
|
setProgress(State::Extracting, "Removing old chain data...");
|
|
std::string err;
|
|
bool ok = cleanChainData(dataDir);
|
|
if (!ok)
|
|
err = "Could not remove all of the old chain data (a file may be in use). Close other programs and retry.";
|
|
|
|
// Step 5: Extract (skipping wallet.dat and the other protected names)
|
|
if (ok && !extract(zipPath, dataDir, &err)) ok = false;
|
|
if (!ok) {
|
|
// Never leave a half-written blocks/ + chainstate/ for dragonxd to start on. wallet.dat, *.conf and
|
|
// database/ are untouched by cleanChainData.
|
|
cleanChainData(dataDir);
|
|
if (cancel_requested_)
|
|
err = "Bootstrap stopped - the old chain data had already been removed. Run it again (the download "
|
|
"is kept) or let the node resync.";
|
|
else if (err.empty())
|
|
err = "Extraction failed - zip file may be corrupted";
|
|
setProgress(State::Failed, err); // LAST: nothing touches the data dir after this
|
|
return;
|
|
}
|
|
|
|
setProgress(State::Completed, "Bootstrap complete!");
|
|
}
|
|
|
|
void Bootstrap::cancel() {
|
|
cancel_requested_ = true;
|
|
}
|
|
|
|
bool Bootstrap::requestCancel() {
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
if (!progress_.cancellable) return false; // the old chain data is being replaced: a no-op
|
|
cancel_requested_ = true;
|
|
return true;
|
|
}
|
|
|
|
bool Bootstrap::safeToAbandon() const {
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
return !worker_running_ || (cancel_requested_ && progress_.cancellable);
|
|
}
|
|
|
|
bool Bootstrap::cancelAndWait(std::chrono::steady_clock::time_point deadline) {
|
|
cancel();
|
|
while (worker_running_ && std::chrono::steady_clock::now() < deadline)
|
|
std::this_thread::sleep_for(std::chrono::milliseconds(10));
|
|
if (!worker_running_) {
|
|
if (worker_.joinable()) worker_.join(); // at once: worker_running_ clears as the worker's last action
|
|
return true;
|
|
}
|
|
LOGF("[Bootstrap] Still running at quit - left to the process exit (%s)\n",
|
|
safeToAbandon() ? "the chain data was not touched"
|
|
: "the chain data may be left part-replaced; dragonxd will offer a reindex");
|
|
return false;
|
|
}
|
|
|
|
Bootstrap::Progress Bootstrap::getProgress() const {
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
return progress_;
|
|
}
|
|
|
|
bool Bootstrap::isDone() const {
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
// worker_running_ is cleared only after the worker's last action, so a failure that a step reported
|
|
// before its own cleanup (download, checksum) is not "done" until that cleanup has finished either.
|
|
return (progress_.state == State::Completed || progress_.state == State::Failed) && !worker_running_;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Progress update (thread-safe)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
void Bootstrap::setProgress(State state, const std::string& text, double downloaded, double total) {
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
progress_.state = state;
|
|
progress_.status_text = text;
|
|
progress_.downloaded_bytes = downloaded;
|
|
progress_.total_bytes = total;
|
|
progress_.percent = (total > 0) ? (float)(100.0 * downloaded / total) : 0.0f;
|
|
if (state == State::Failed) {
|
|
progress_.error = text;
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// HEAD request for remote file size
|
|
// ---------------------------------------------------------------------------
|
|
|
|
Bootstrap::RemoteInfo Bootstrap::getRemoteFileSize(const std::string& url) {
|
|
RemoteInfo info;
|
|
CURL* curl = curl_easy_init();
|
|
if (!curl) return info;
|
|
|
|
curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
|
|
curl_easy_setopt(curl, CURLOPT_NOBODY, 1L); // HEAD request
|
|
curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
|
|
// Redirects may only stay on HTTPS (no downgrade / file:// etc.).
|
|
#if LIBCURL_VERSION_NUM >= 0x075500
|
|
curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "https");
|
|
#else
|
|
curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, (long)CURLPROTO_HTTPS);
|
|
#endif
|
|
curl_easy_setopt(curl, CURLOPT_USERAGENT, "ObsidianDragon/1.0");
|
|
curl_easy_setopt(curl, CURLOPT_TIMEOUT, 15L);
|
|
curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L);
|
|
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
|
|
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
|
|
curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L); // timeouts are safe on a worker thread
|
|
curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
|
|
curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, abortOnCancelCallback);
|
|
curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &cancel_requested_);
|
|
|
|
CURLcode res = curl_easy_perform(curl);
|
|
if (res != CURLE_OK) {
|
|
DEBUG_LOGF("[Bootstrap] HEAD request failed: %s\n", curl_easy_strerror(res));
|
|
curl_easy_cleanup(curl);
|
|
return info; // transportOk=false, size=-1
|
|
}
|
|
info.transportOk = true;
|
|
curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &info.httpCode);
|
|
curl_off_t cl = -1;
|
|
curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, &cl);
|
|
info.size = (long long)cl;
|
|
curl_easy_cleanup(curl);
|
|
|
|
DEBUG_LOGF("[Bootstrap] HEAD %ld, size %lld\n", info.httpCode, info.size);
|
|
return info;
|
|
}
|
|
|
|
Bootstrap::ResumeAction Bootstrap::decideResume(long long existingBytes, bool authoritative,
|
|
long long remoteSize) {
|
|
if (existingBytes <= 0) return ResumeAction::Fresh;
|
|
if (!authoritative) return ResumeAction::RangedGet; // keep the file; a non-206 reply is caught after perform
|
|
if (existingBytes > remoteSize) return ResumeAction::TruncateAndFresh; // stale: older/larger zip
|
|
if (existingBytes == remoteSize) return ResumeAction::ReuseComplete; // complete: skip the GET; verifyChecksums runs
|
|
return ResumeAction::RangedGet; // existing < remote
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Download (libcurl)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
int Bootstrap::progressCallback(void* clientp, long long dltotal, long long dlnow,
|
|
long long /*ultotal*/, long long /*ulnow*/) {
|
|
auto* self = static_cast<Bootstrap*>(clientp);
|
|
if (self->cancel_requested_) return 1; // abort transfer
|
|
|
|
// When resuming, dlnow/dltotal only reflect the *remaining* portion.
|
|
// Add resume_offset_ so the user sees true total progress.
|
|
double offset = self->resume_offset_;
|
|
double realNow = offset + (double)dlnow;
|
|
double realTotal = (dltotal > 0) ? (offset + (double)dltotal) : 0.0;
|
|
|
|
std::string sizeText = formatSize(realNow) + " / " +
|
|
(realTotal > 0 ? formatSize(realTotal) : "unknown");
|
|
self->setProgress(State::Downloading, sizeText, realNow, realTotal);
|
|
return 0;
|
|
}
|
|
|
|
bool Bootstrap::download(const std::string& url, const std::string& destZip) {
|
|
// Failures are reported through last_curl_ / download_error_; the caller publishes them.
|
|
last_curl_ = 0;
|
|
download_error_.clear();
|
|
CURL* curl = curl_easy_init();
|
|
if (!curl) {
|
|
download_error_ = "Failed to initialise libcurl";
|
|
return false;
|
|
}
|
|
|
|
// --- Resume support with integrity check ---
|
|
// Check if a partial file exists from a previous attempt.
|
|
long long existing_bytes = 0;
|
|
{
|
|
std::error_code ec;
|
|
if (fs::exists(destZip, ec) && !ec) {
|
|
existing_bytes = (long long)fs::file_size(destZip, ec);
|
|
if (ec) existing_bytes = 0;
|
|
}
|
|
}
|
|
|
|
// The remote size (HEAD) detects server-side changes that would corrupt a resumed download, lets a
|
|
// complete earlier download be reused, and feeds the early free-space check below.
|
|
const RemoteInfo info = getRemoteFileSize(url);
|
|
if (cancel_requested_) { // the HEAD was cut short: keep a partial file for the next resume
|
|
curl_easy_cleanup(curl);
|
|
return false;
|
|
}
|
|
const bool authoritative = info.transportOk && (info.httpCode / 100 == 2) && info.size > 0;
|
|
|
|
switch (decideResume(existing_bytes, authoritative, info.size)) {
|
|
case ResumeAction::ReuseComplete: {
|
|
// Complete from an earlier attempt (e.g. "free some space, then Retry"): reuse it instead of
|
|
// re-downloading several GB. verifyChecksums() still runs on it and deletes it on a mismatch.
|
|
DEBUG_LOGF("[Bootstrap] Local file is complete (%lld bytes) - reusing it\n", existing_bytes);
|
|
curl_easy_cleanup(curl);
|
|
resume_offset_ = 0;
|
|
setProgress(State::Downloading,
|
|
"Reusing the completed download (" + formatSize((double)existing_bytes) + ")",
|
|
(double)existing_bytes, (double)info.size);
|
|
return true;
|
|
}
|
|
case ResumeAction::TruncateAndFresh: {
|
|
DEBUG_LOGF("[Bootstrap] Local file (%lld) > remote (%lld), restarting\n", existing_bytes, info.size);
|
|
std::error_code ec;
|
|
fs::remove(destZip, ec);
|
|
existing_bytes = 0;
|
|
break;
|
|
}
|
|
case ResumeAction::Fresh:
|
|
existing_bytes = 0; // nothing usable on disk; fresh download
|
|
break;
|
|
case ResumeAction::RangedGet:
|
|
break; // resume from existing_bytes (may be an offline/unverified resume)
|
|
}
|
|
|
|
// Early, non-destructive free-space check: only when the remote size is authoritative. Nothing is
|
|
// deleted; a partial file is always kept for a later resume.
|
|
if (authoritative && info.size > existing_bytes) {
|
|
const std::uint64_t need = satAdd(static_cast<std::uint64_t>(info.size - existing_bytes),
|
|
256ull * 1024ull * 1024ull);
|
|
std::error_code ec;
|
|
const fs::space_info sp = fs::space(fs::path(destZip).parent_path(), ec);
|
|
if (!ec && sp.capacity != 0 && sp.available != static_cast<std::uintmax_t>(-1) &&
|
|
static_cast<std::uint64_t>(sp.available) < need) {
|
|
curl_easy_cleanup(curl);
|
|
download_error_ = "Not enough disk space for the download: need " + formatSize((double)need) +
|
|
", have " + formatSize((double)sp.available) + " free. Free some space and retry.";
|
|
LOGF("[Bootstrap] %s\n", download_error_.c_str());
|
|
return false;
|
|
}
|
|
}
|
|
|
|
resume_offset_ = (double)existing_bytes;
|
|
|
|
FILE* fp = nullptr;
|
|
if (existing_bytes > 0) {
|
|
// Open in append-binary mode and tell curl to resume
|
|
fp = fopen(destZip.c_str(), "ab");
|
|
if (!fp) {
|
|
curl_easy_cleanup(curl);
|
|
download_error_ = "Failed to open output file for resume: " + destZip;
|
|
return false;
|
|
}
|
|
curl_easy_setopt(curl, CURLOPT_RESUME_FROM_LARGE, (curl_off_t)existing_bytes);
|
|
DEBUG_LOGF("[Bootstrap] Resuming download from byte %lld\n", existing_bytes);
|
|
} else {
|
|
fp = fopen(destZip.c_str(), "wb");
|
|
if (!fp) {
|
|
curl_easy_cleanup(curl);
|
|
download_error_ = "Failed to open output file: " + destZip;
|
|
return false;
|
|
}
|
|
}
|
|
|
|
curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
|
|
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writeFileCallback);
|
|
curl_easy_setopt(curl, CURLOPT_WRITEDATA, fp);
|
|
curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
|
|
curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progressCallback);
|
|
curl_easy_setopt(curl, CURLOPT_XFERINFODATA, this);
|
|
curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
|
|
// Redirects may only stay on HTTPS (no downgrade / file:// etc.).
|
|
#if LIBCURL_VERSION_NUM >= 0x075500
|
|
curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "https");
|
|
#else
|
|
curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, (long)CURLPROTO_HTTPS);
|
|
#endif
|
|
curl_easy_setopt(curl, CURLOPT_USERAGENT, "ObsidianDragon/1.0");
|
|
curl_easy_setopt(curl, CURLOPT_TIMEOUT, 0L); // no timeout for large file
|
|
curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 30L);
|
|
curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, 1024L); // abort if < 1 KB/s
|
|
curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, 60L); // ... for 60 seconds
|
|
|
|
// HTTPS certificate verification
|
|
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
|
|
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
|
|
|
|
CURLcode res = curl_easy_perform(curl);
|
|
long httpCode = 0;
|
|
curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode);
|
|
fclose(fp);
|
|
curl_easy_cleanup(curl);
|
|
|
|
if (res == CURLE_RANGE_ERROR) {
|
|
// Server does not support range requests — restart from scratch
|
|
DEBUG_LOGF("[Bootstrap] Server does not support resume, restarting download\n");
|
|
resume_offset_ = 0;
|
|
std::error_code ec;
|
|
fs::remove(destZip, ec);
|
|
return download(url, destZip); // recursive retry without resume
|
|
}
|
|
|
|
// We asked to resume but the server answered 200 (whole file), not 206: libcurl may append it to the
|
|
// partial instead of erroring, which would corrupt the archive. Restart cleanly from scratch.
|
|
if (res == CURLE_OK && existing_bytes > 0 && httpCode != 206) {
|
|
DEBUG_LOGF("[Bootstrap] Ranged request answered %ld (not 206) - restarting without resume\n", httpCode);
|
|
resume_offset_ = 0;
|
|
std::error_code ec;
|
|
fs::remove(destZip, ec);
|
|
return download(url, destZip);
|
|
}
|
|
|
|
if (res != CURLE_OK) {
|
|
DEBUG_LOGF("[Bootstrap] curl error: %s\n", curl_easy_strerror(res));
|
|
last_curl_ = static_cast<int>(res);
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Preflight helpers (pure, static)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
bool Bootstrap::isProtectedEntry(const std::string& name) {
|
|
// Judged on the name the member lands on: "./wallet.dat", "DRAGONX.conf." and "database./log.1" are
|
|
// wallet.dat, DRAGONX.conf and database/log.1 (a trailing '/' of a directory entry is an empty component).
|
|
std::vector<std::string> comps;
|
|
canonicalArchivePath(name, &comps); // an unsafe name is refused separately (isSafeArchivePath)
|
|
if (comps.empty()) return false;
|
|
for (std::string& comp : comps) {
|
|
comp = lowerAscii(comp); // Windows/macOS data dirs are case-insensitive
|
|
if (comp.rfind("wallet", 0) == 0) return true; // wallet.dat, wallet-*.dat (incl. symlinks), wallets/
|
|
if (comp == "database") return true; // the wallet's BDB environment
|
|
}
|
|
const std::string& base = comps.back();
|
|
if (base == ".cookie" || endsWith(base, ".conf")) return true;
|
|
// Top-level *.dat other than the node's own caches: -wallet=<name>.dat files can have any name.
|
|
if (comps.size() == 1 && endsWith(base, ".dat") &&
|
|
base != "fee_estimates.dat" && base != "peers.dat" && base != "banlist.dat")
|
|
return true;
|
|
return false;
|
|
}
|
|
|
|
Bootstrap::ArchivePlan Bootstrap::planArchive(const std::string& zipPath) {
|
|
ArchivePlan plan;
|
|
mz_zip_archive zip = {};
|
|
if (!mz_zip_reader_init_file(&zip, zipPath.c_str(), 0)) {
|
|
plan.error = "Failed to open zip file - the download may be corrupted";
|
|
return plan;
|
|
}
|
|
|
|
const mz_uint numFiles = mz_zip_reader_get_num_files(&zip);
|
|
for (mz_uint i = 0; i < numFiles; i++) {
|
|
mz_zip_archive_file_stat stat;
|
|
if (!mz_zip_reader_file_stat(&zip, i, &stat)) {
|
|
plan.error = "Unreadable archive entry #" + std::to_string(i) + " - the download may be corrupted";
|
|
mz_zip_reader_end(&zip);
|
|
return plan;
|
|
}
|
|
const std::string filename = stat.m_filename;
|
|
if (!isSafeArchivePath(filename)) {
|
|
plan.error = "Refusing unsafe archive entry: " + printableArchiveName(filename);
|
|
mz_zip_reader_end(&zip);
|
|
return plan;
|
|
}
|
|
if (mz_zip_reader_is_file_a_directory(&zip, i) || isProtectedEntry(filename)) continue;
|
|
plan.bytes = satAdd(plan.bytes, static_cast<std::uint64_t>(stat.m_uncomp_size));
|
|
}
|
|
mz_zip_reader_end(&zip);
|
|
plan.ok = true;
|
|
return plan;
|
|
}
|
|
|
|
std::uint64_t Bootstrap::reclaimableBytes(const std::string& dataDir) {
|
|
std::uint64_t total = 0;
|
|
for (const char* subdir : {"blocks", "chainstate", "notarizations"}) {
|
|
const fs::path p = fs::path(dataDir) / subdir;
|
|
std::error_code ec;
|
|
const fs::file_status st = fs::symlink_status(p, ec);
|
|
if (fs::is_symlink(st)) continue; // remove_all drops the link; the target's space is not freed here
|
|
if (fs::is_regular_file(st)) {
|
|
const auto sz = fs::file_size(p, ec);
|
|
if (!ec) total = satAdd(total, static_cast<std::uint64_t>(sz));
|
|
continue;
|
|
}
|
|
if (!fs::is_directory(st)) continue;
|
|
// Directory symlinks inside are not followed (no follow_directory_symlink); file symlinks count 0.
|
|
fs::recursive_directory_iterator it(p, fs::directory_options::skip_permission_denied, ec);
|
|
const fs::recursive_directory_iterator end;
|
|
while (!ec && it != end) {
|
|
std::error_code fec;
|
|
const fs::file_status est = it->symlink_status(fec);
|
|
if (!fec && fs::is_regular_file(est)) {
|
|
const auto sz = it->file_size(fec);
|
|
if (!fec) total = satAdd(total, static_cast<std::uint64_t>(sz));
|
|
}
|
|
it.increment(ec);
|
|
}
|
|
}
|
|
return total;
|
|
}
|
|
|
|
bool Bootstrap::spaceSufficient(std::uint64_t needed, std::uint64_t avail, std::uint64_t capacity,
|
|
std::uint64_t reclaimable, std::string* msg) {
|
|
// Unknown (e.g. some FUSE/network mounts): fail open. A known capacity with avail 0 is a full disk.
|
|
if (capacity == 0 || avail == UINT64_MAX) return true;
|
|
const std::uint64_t kMinMargin = 256ull * 1024ull * 1024ull;
|
|
const std::uint64_t pctMargin = needed / 20; // 5%
|
|
const std::uint64_t margin = (pctMargin > kMinMargin) ? pctMargin : kMinMargin;
|
|
const std::uint64_t need = satAdd(needed, margin);
|
|
const std::uint64_t have = satAdd(avail, reclaimable);
|
|
if (have >= need) return true;
|
|
if (msg) {
|
|
*msg = "Not enough disk space for the bootstrap: need " + formatSize((double)need) + ", have " +
|
|
formatSize((double)avail) + " free (+" + formatSize((double)reclaimable) +
|
|
" from the old chain data). Free some space and retry - the download is kept.";
|
|
}
|
|
return false;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Zip extraction (miniz)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
bool Bootstrap::extract(const std::string& zipPath, const std::string& dataDir, std::string* err) {
|
|
// Never publishes a failure or a final state (only Extracting progress): the caller removes a partial chain first
|
|
// and publishes the outcome last.
|
|
auto fail = [err](const std::string& why) {
|
|
if (err) *err = why;
|
|
return false;
|
|
};
|
|
mz_zip_archive zip = {};
|
|
if (!mz_zip_reader_init_file(&zip, zipPath.c_str(), 0))
|
|
return fail("Failed to open zip file");
|
|
|
|
int numFiles = (int)mz_zip_reader_get_num_files(&zip);
|
|
int nonCriticalFailures = 0;
|
|
for (int i = 0; i < numFiles; i++) {
|
|
if (cancel_requested_) {
|
|
mz_zip_reader_end(&zip);
|
|
return fail("Extraction cancelled");
|
|
}
|
|
|
|
mz_zip_archive_file_stat stat;
|
|
if (!mz_zip_reader_file_stat(&zip, i, &stat)) {
|
|
nonCriticalFailures++;
|
|
continue;
|
|
}
|
|
|
|
std::string filename = stat.m_filename;
|
|
|
|
// *** SECURITY: reject zip-slip / path-traversal entries before building any path ***
|
|
// A legitimate snapshot from the project host never contains these; an entry that does
|
|
// indicates a malicious/corrupt archive, so abort rather than silently skip.
|
|
std::vector<std::string> comps;
|
|
if (!canonicalArchivePath(filename, &comps)) {
|
|
DEBUG_LOGF("[Bootstrap] Unsafe archive path rejected: %s\n", printableArchiveName(filename).c_str());
|
|
mz_zip_reader_end(&zip);
|
|
return fail("Refusing to extract unsafe archive entry: " + printableArchiveName(filename));
|
|
}
|
|
|
|
// *** CRITICAL: Skip wallet.dat (and every other wallet*, database/, *.conf, .cookie entry) ***
|
|
if (isProtectedEntry(filename)) {
|
|
LOGF("[Bootstrap] Skipping protected archive entry: %s\n", filename.c_str());
|
|
continue;
|
|
}
|
|
// The member is written where it was checked: the canonical path ("./blocks/x" is blocks/x).
|
|
const std::string relPath = joinArchivePath(comps);
|
|
if (relPath.empty()) continue; // "./": the data dir itself
|
|
|
|
std::string destPath = dataDir;
|
|
// Ensure trailing separator
|
|
if (!destPath.empty() && destPath.back() != '/' && destPath.back() != '\\')
|
|
destPath += '/';
|
|
destPath += relPath;
|
|
|
|
if (mz_zip_reader_is_file_a_directory(&zip, i)) {
|
|
std::error_code ec;
|
|
fs::create_directories(destPath, ec);
|
|
} else {
|
|
// Ensure parent directory exists
|
|
std::error_code ec;
|
|
fs::create_directories(fs::path(destPath).parent_path(), ec);
|
|
|
|
if (!mz_zip_reader_extract_to_file(&zip, i, destPath.c_str(), 0)) {
|
|
LOGF("[Bootstrap] Failed to extract: %s\n", filename.c_str());
|
|
// Critical chain data must extract successfully
|
|
if (relPath.rfind("blocks/", 0) == 0 || relPath.rfind("chainstate/", 0) == 0) {
|
|
mz_zip_reader_end(&zip);
|
|
return fail("Failed to extract critical file: " + filename);
|
|
}
|
|
// Non-fatal for other files: continue with remaining
|
|
nonCriticalFailures++;
|
|
}
|
|
}
|
|
|
|
// Update progress (percent = file count ratio)
|
|
setProgress(State::Extracting,
|
|
"Extracting: " + filename,
|
|
(double)(i + 1), (double)numFiles);
|
|
}
|
|
|
|
mz_zip_reader_end(&zip);
|
|
if (nonCriticalFailures > 0)
|
|
LOGF("[Bootstrap] %d non-critical archive member(s) could not be extracted\n", nonCriticalFailures);
|
|
|
|
// Clean up zip file
|
|
std::error_code ec;
|
|
fs::remove(zipPath, ec);
|
|
|
|
return true;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Pre-extraction cleanup
|
|
// ---------------------------------------------------------------------------
|
|
|
|
bool Bootstrap::cleanChainData(const std::string& dataDir) {
|
|
// Directories to remove completely.
|
|
// NOTE: "database" is intentionally NOT removed here. It contains BDB
|
|
// environment/log files for wallet.dat. Deleting it while keeping wallet.dat
|
|
// creates a BDB LSN mismatch that causes the daemon to "salvage" the wallet
|
|
// (renaming it to wallet.{timestamp}.bak and creating an empty replacement).
|
|
// The daemon's DB_RECOVER flag in CDBEnv::Open() handles stale environment
|
|
// files gracefully when the environment dir still exists.
|
|
static const char* const kChainDirs[] = {"blocks", "chainstate", "notarizations"};
|
|
for (const char* subdir : kChainDirs) {
|
|
fs::path p = fs::path(dataDir) / subdir;
|
|
std::error_code ec;
|
|
// symlink_status: a symlinked (even dangling) entry is removed as a link, never followed.
|
|
if (fs::symlink_status(p, ec).type() != fs::file_type::not_found) {
|
|
fs::remove_all(p, ec);
|
|
if (ec) LOGF("[Bootstrap] Warning: could not remove %s: %s\n", subdir, ec.message().c_str());
|
|
}
|
|
}
|
|
// Individual files to remove (will be replaced by bootstrap)
|
|
for (const char* file : {"fee_estimates.dat", "peers.dat", "banlist.dat", "db.log", ".lock"}) {
|
|
fs::path p = fs::path(dataDir) / file;
|
|
std::error_code ec;
|
|
if (fs::exists(p, ec)) {
|
|
fs::remove(p, ec);
|
|
}
|
|
}
|
|
// NEVER remove: wallet.dat, debug.log, *.conf
|
|
|
|
// Verified, not assumed: a locked file (Windows: antivirus, a lingering handle) leaves part of the old
|
|
// chain behind, and a new chainstate extracted over leftover .ldb files is an inconsistent LevelDB.
|
|
bool clean = true;
|
|
for (const char* subdir : kChainDirs) {
|
|
std::error_code ec;
|
|
if (fs::symlink_status(fs::path(dataDir) / subdir, ec).type() != fs::file_type::not_found) {
|
|
LOGF("[Bootstrap] %s is still present after removing the old chain data\n", subdir);
|
|
clean = false;
|
|
}
|
|
}
|
|
return clean;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Small-file download (checksums)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Checksum helpers
|
|
// ---------------------------------------------------------------------------
|
|
|
|
std::string Bootstrap::parseChecksumFile(const std::string& content, std::size_t expectedHexLen) {
|
|
std::istringstream iss(content);
|
|
std::string token;
|
|
if (!(iss >> token)) return {};
|
|
if (token.size() != expectedHexLen) return {}; // reject error pages / wrong digests
|
|
for (char c : token)
|
|
if (!std::isxdigit(static_cast<unsigned char>(c))) return {};
|
|
std::transform(token.begin(), token.end(), token.begin(),
|
|
[](unsigned char c) { return std::tolower(c); });
|
|
return token;
|
|
}
|
|
|
|
std::string Bootstrap::computeSHA256(const std::string& filePath, float pctBase, float pctRange) {
|
|
FILE* fp = fopen(filePath.c_str(), "rb");
|
|
if (!fp) return {};
|
|
|
|
// File size for progress reporting (not a seek: ftell is 32-bit on Windows LLP64).
|
|
const long long fileSize = fileSizeOrZero(filePath);
|
|
|
|
crypto_hash_sha256_state state;
|
|
crypto_hash_sha256_init(&state);
|
|
|
|
unsigned char buf[65536];
|
|
size_t n;
|
|
long long processed = 0;
|
|
while ((n = fread(buf, 1, sizeof(buf), fp)) > 0) {
|
|
if (cancel_requested_) {
|
|
fclose(fp);
|
|
return {};
|
|
}
|
|
crypto_hash_sha256_update(&state, buf, n);
|
|
processed += (long long)n;
|
|
|
|
// Update progress every ~4MB
|
|
if (fileSize > 0 && (processed % (4 * 1024 * 1024)) < (long long)sizeof(buf)) {
|
|
float filePct = (float)(100.0 * processed / fileSize);
|
|
float overallPct = pctBase + pctRange * (float)processed / (float)fileSize;
|
|
char msg[128];
|
|
snprintf(msg, sizeof(msg), "Verifying SHA-256... %.0f%% (%s / %s)",
|
|
filePct, formatSize((double)processed).c_str(),
|
|
formatSize((double)fileSize).c_str());
|
|
{
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
progress_.state = State::Verifying;
|
|
progress_.status_text = msg;
|
|
progress_.percent = overallPct;
|
|
}
|
|
}
|
|
}
|
|
fclose(fp);
|
|
|
|
unsigned char hash[crypto_hash_sha256_BYTES];
|
|
crypto_hash_sha256_final(&state, hash);
|
|
|
|
std::ostringstream oss;
|
|
oss << std::hex << std::setfill('0');
|
|
for (int i = 0; i < crypto_hash_sha256_BYTES; i++)
|
|
oss << std::setw(2) << (int)hash[i];
|
|
return oss.str();
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// MD5 — minimal embedded implementation (RFC 1321)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
namespace {
|
|
|
|
struct MD5Context {
|
|
uint32_t state[4];
|
|
uint64_t count;
|
|
uint8_t buffer[64];
|
|
};
|
|
|
|
static const uint32_t md5_T[64] = {
|
|
0xd76aa478,0xe8c7b756,0x242070db,0xc1bdceee,0xf57c0faf,0x4787c62a,0xa8304613,0xfd469501,
|
|
0x698098d8,0x8b44f7af,0xffff5bb1,0x895cd7be,0x6b901122,0xfd987193,0xa679438e,0x49b40821,
|
|
0xf61e2562,0xc040b340,0x265e5a51,0xe9b6c7aa,0xd62f105d,0x02441453,0xd8a1e681,0xe7d3fbc8,
|
|
0x21e1cde6,0xc33707d6,0xf4d50d87,0x455a14ed,0xa9e3e905,0xfcefa3f8,0x676f02d9,0x8d2a4c8a,
|
|
0xfffa3942,0x8771f681,0x6d9d6122,0xfde5380c,0xa4beea44,0x4bdecfa9,0xf6bb4b60,0xbebfbc70,
|
|
0x289b7ec6,0xeaa127fa,0xd4ef3085,0x04881d05,0xd9d4d039,0xe6db99e5,0x1fa27cf8,0xc4ac5665,
|
|
0xf4292244,0x432aff97,0xab9423a7,0xfc93a039,0x655b59c3,0x8f0ccc92,0xffeff47d,0x85845dd1,
|
|
0x6fa87e4f,0xfe2ce6e0,0xa3014314,0x4e0811a1,0xf7537e82,0xbd3af235,0x2ad7d2bb,0xeb86d391
|
|
};
|
|
static const int md5_S[64] = {
|
|
7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,
|
|
5, 9,14,20,5, 9,14,20,5, 9,14,20,5, 9,14,20,
|
|
4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,
|
|
6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21
|
|
};
|
|
|
|
static inline uint32_t md5_rotl(uint32_t x, int n) { return (x << n) | (x >> (32 - n)); }
|
|
|
|
static void md5_transform(uint32_t state[4], const uint8_t block[64]) {
|
|
uint32_t M[16];
|
|
for (int i = 0; i < 16; i++)
|
|
M[i] = (uint32_t)block[i*4] | ((uint32_t)block[i*4+1]<<8) |
|
|
((uint32_t)block[i*4+2]<<16) | ((uint32_t)block[i*4+3]<<24);
|
|
|
|
uint32_t a=state[0], b=state[1], c=state[2], d=state[3];
|
|
for (int i = 0; i < 64; i++) {
|
|
uint32_t f, g;
|
|
if (i < 16) { f = (b & c) | (~b & d); g = i; }
|
|
else if (i < 32) { f = (d & b) | (~d & c); g = (5*i+1) % 16; }
|
|
else if (i < 48) { f = b ^ c ^ d; g = (3*i+5) % 16; }
|
|
else { f = c ^ (b | ~d); g = (7*i) % 16; }
|
|
uint32_t tmp = d; d = c; c = b;
|
|
b = b + md5_rotl(a + f + md5_T[i] + M[g], md5_S[i]);
|
|
a = tmp;
|
|
}
|
|
state[0]+=a; state[1]+=b; state[2]+=c; state[3]+=d;
|
|
}
|
|
|
|
static void md5_init(MD5Context* ctx) {
|
|
ctx->state[0]=0x67452301; ctx->state[1]=0xefcdab89;
|
|
ctx->state[2]=0x98badcfe; ctx->state[3]=0x10325476;
|
|
ctx->count = 0;
|
|
memset(ctx->buffer, 0, 64);
|
|
}
|
|
|
|
static void md5_update(MD5Context* ctx, const uint8_t* data, size_t len) {
|
|
size_t idx = (size_t)(ctx->count % 64);
|
|
ctx->count += len;
|
|
for (size_t i = 0; i < len; i++) {
|
|
ctx->buffer[idx++] = data[i];
|
|
if (idx == 64) { md5_transform(ctx->state, ctx->buffer); idx = 0; }
|
|
}
|
|
}
|
|
|
|
static void md5_final(MD5Context* ctx, uint8_t digest[16]) {
|
|
uint64_t bits = ctx->count * 8;
|
|
uint8_t pad = 0x80;
|
|
md5_update(ctx, &pad, 1);
|
|
pad = 0;
|
|
while (ctx->count % 64 != 56) md5_update(ctx, &pad, 1);
|
|
uint8_t bitbuf[8];
|
|
for (int i = 0; i < 8; i++) bitbuf[i] = (uint8_t)(bits >> (i*8));
|
|
md5_update(ctx, bitbuf, 8);
|
|
for (int i = 0; i < 4; i++) {
|
|
digest[i*4+0] = (uint8_t)(ctx->state[i]);
|
|
digest[i*4+1] = (uint8_t)(ctx->state[i]>>8);
|
|
digest[i*4+2] = (uint8_t)(ctx->state[i]>>16);
|
|
digest[i*4+3] = (uint8_t)(ctx->state[i]>>24);
|
|
}
|
|
}
|
|
|
|
} // anon namespace
|
|
|
|
std::string Bootstrap::computeMD5(const std::string& filePath, float pctBase, float pctRange) {
|
|
FILE* fp = fopen(filePath.c_str(), "rb");
|
|
if (!fp) return {};
|
|
|
|
// File size for progress reporting (not a seek: ftell is 32-bit on Windows LLP64).
|
|
const long long fileSize = fileSizeOrZero(filePath);
|
|
|
|
MD5Context ctx;
|
|
md5_init(&ctx);
|
|
|
|
uint8_t buf[65536];
|
|
size_t n;
|
|
long long processed = 0;
|
|
while ((n = fread(buf, 1, sizeof(buf), fp)) > 0) {
|
|
if (cancel_requested_) {
|
|
fclose(fp);
|
|
return {};
|
|
}
|
|
md5_update(&ctx, buf, n);
|
|
processed += (long long)n;
|
|
|
|
// Update progress every ~4MB
|
|
if (fileSize > 0 && (processed % (4 * 1024 * 1024)) < (long long)sizeof(buf)) {
|
|
float filePct = (float)(100.0 * processed / fileSize);
|
|
float overallPct = pctBase + pctRange * (float)processed / (float)fileSize;
|
|
char msg[128];
|
|
snprintf(msg, sizeof(msg), "Verifying MD5... %.0f%% (%s / %s)",
|
|
filePct, formatSize((double)processed).c_str(),
|
|
formatSize((double)fileSize).c_str());
|
|
{
|
|
std::lock_guard<std::mutex> lk(mutex_);
|
|
progress_.state = State::Verifying;
|
|
progress_.status_text = msg;
|
|
progress_.percent = overallPct;
|
|
}
|
|
}
|
|
}
|
|
fclose(fp);
|
|
|
|
uint8_t digest[16];
|
|
md5_final(&ctx, digest);
|
|
|
|
std::ostringstream oss;
|
|
oss << std::hex << std::setfill('0');
|
|
for (int i = 0; i < 16; i++)
|
|
oss << std::setw(2) << (int)digest[i];
|
|
return oss.str();
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Checksum verification pipeline
|
|
// ---------------------------------------------------------------------------
|
|
|
|
bool Bootstrap::verifyChecksums(const std::string& zipPath, const std::string& baseUrl) {
|
|
last_verify_mismatch_ = false;
|
|
setProgress(State::Verifying, "Downloading checksums...");
|
|
|
|
HttpGetOptions opt; opt.cancel = &cancel_requested_;
|
|
|
|
std::string sha256Content = httpGetString(baseUrl + "/" + kZipName + ".sha256", "[bootstrap]", opt);
|
|
if (cancel_requested_) return false;
|
|
std::string expectedSha = parseChecksumFile(sha256Content, 64);
|
|
const bool haveSHA256 = !expectedSha.empty();
|
|
|
|
std::string expectedMd5;
|
|
bool haveMD5 = false;
|
|
if (!haveSHA256) { // MD5 only as a fallback when no SHA-256 is published
|
|
std::string md5Content = httpGetString(baseUrl + "/" + kZipName + ".md5", "[bootstrap]", opt);
|
|
if (cancel_requested_) return false;
|
|
expectedMd5 = parseChecksumFile(md5Content, 32);
|
|
haveMD5 = !expectedMd5.empty();
|
|
}
|
|
|
|
if (!haveSHA256 && !haveMD5) {
|
|
DEBUG_LOGF("[Bootstrap] No checksum published - refusing to install an unverified archive\n");
|
|
setProgress(State::Failed, "Verification failed: no checksum was published for the bootstrap. "
|
|
"Refusing to install an unverified archive.");
|
|
return false; // fail CLOSED; archive is KEPT
|
|
}
|
|
|
|
if (haveSHA256) {
|
|
setProgress(State::Verifying, "Verifying SHA-256...", 0, 1);
|
|
std::string actual = computeSHA256(zipPath, 0.0f, 100.0f);
|
|
if (cancel_requested_) return false;
|
|
if (actual.empty()) { setProgress(State::Failed, "SHA-256 verification error"); return false; }
|
|
if (expectedSha != actual) {
|
|
last_verify_mismatch_ = true;
|
|
DEBUG_LOGF("[Bootstrap] SHA-256 MISMATCH!\n expected: %s\n actual: %s\n",
|
|
expectedSha.c_str(), actual.c_str());
|
|
setProgress(State::Failed,
|
|
"SHA-256 mismatch \xe2\x80\x94 the server's checksum file may be out of date.\n"
|
|
"Expected: " + expectedSha.substr(0, 16) + "...\n"
|
|
"Got: " + actual.substr(0, 16) + "...\n"
|
|
"Try again or use a fresh download.");
|
|
return false;
|
|
}
|
|
DEBUG_LOGF("[Bootstrap] SHA-256 verified: %s\n", actual.c_str());
|
|
} else { // haveMD5
|
|
setProgress(State::Verifying, "Verifying MD5...", 0, 1);
|
|
std::string actual = computeMD5(zipPath, 0.0f, 100.0f);
|
|
if (cancel_requested_) return false;
|
|
if (actual.empty()) { setProgress(State::Failed, "MD5 verification error"); return false; }
|
|
if (expectedMd5 != actual) {
|
|
last_verify_mismatch_ = true;
|
|
DEBUG_LOGF("[Bootstrap] MD5 MISMATCH!\n expected: %s\n actual: %s\n",
|
|
expectedMd5.c_str(), actual.c_str());
|
|
setProgress(State::Failed,
|
|
"MD5 mismatch \xe2\x80\x94 the server's checksum file may be out of date.\n"
|
|
"Expected: " + expectedMd5 + "\nGot: " + actual + "\n"
|
|
"Try again or use a fresh download.");
|
|
return false;
|
|
}
|
|
DEBUG_LOGF("[Bootstrap] MD5 verified: %s\n", actual.c_str());
|
|
}
|
|
|
|
setProgress(State::Verifying, "Checksums verified \xe2\x9c\x93", 100.0, 100.0);
|
|
return true;
|
|
}
|
|
|
|
} // namespace util
|
|
} // namespace dragonx
|