storage/browser/fileapi/sandbox_directory_database.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "storage/browser/fileapi/sandbox_directory_database.h"
   6
   7 #include <math.h>
   8 #include <algorithm>
   9 #include <set>
  10 #include <stack>
  11
  12 #include "base/files/file_enumerator.h"
  13 #include "base/files/file_util.h"
  14 #include "base/location.h"
  15 #include "base/metrics/histogram.h"
  16 #include "base/pickle.h"
  17 #include "base/strings/string_number_conversions.h"
  18 #include "base/strings/string_util.h"
  19 #include "storage/browser/fileapi/file_system_usage_cache.h"
  20 #include "storage/common/fileapi/file_system_util.h"
  21 #include "third_party/leveldatabase/env_chromium.h"
  22 #include "third_party/leveldatabase/src/include/leveldb/db.h"
  23 #include "third_party/leveldatabase/src/include/leveldb/write_batch.h"
  24
  25 namespace {
  26
  27 bool PickleFromFileInfo(const storage::SandboxDirectoryDatabase::FileInfo& info,
  28                         base::Pickle* pickle) {
  29   DCHECK(pickle);
  30   std::string data_path;
  31   // Round off here to match the behavior of the filesystem on real files.
  32   base::Time time =
  33       base::Time::FromDoubleT(floor(info.modification_time.ToDoubleT()));
  34   std::string name;
  35
  36   data_path = storage::FilePathToString(info.data_path);
  37   name = storage::FilePathToString(base::FilePath(info.name));
  38
  39   if (pickle->WriteInt64(info.parent_id) &&
  40       pickle->WriteString(data_path) &&
  41       pickle->WriteString(name) &&
  42       pickle->WriteInt64(time.ToInternalValue()))
  43     return true;
  44
  45   NOTREACHED();
  46   return false;
  47 }
  48
  49 bool FileInfoFromPickle(const base::Pickle& pickle,
  50                         storage::SandboxDirectoryDatabase::FileInfo* info) {
  51   base::PickleIterator iter(pickle);
  52   std::string data_path;
  53   std::string name;
  54   int64 internal_time;
  55
  56   if (iter.ReadInt64(&info->parent_id) &&
  57       iter.ReadString(&data_path) &&
  58       iter.ReadString(&name) &&
  59       iter.ReadInt64(&internal_time)) {
  60     info->data_path = storage::StringToFilePath(data_path);
  61     info->name = storage::StringToFilePath(name).value();
  62     info->modification_time = base::Time::FromInternalValue(internal_time);
  63     return true;
  64   }
  65   LOG(ERROR) << "base::Pickle could not be digested!";
  66   return false;
  67 }
  68
  69 const base::FilePath::CharType kDirectoryDatabaseName[] =
  70     FILE_PATH_LITERAL("Paths");
  71 const char kChildLookupPrefix[] = "CHILD_OF:";
  72 const char kChildLookupSeparator[] = ":";
  73 const char kLastFileIdKey[] = "LAST_FILE_ID";
  74 const char kLastIntegerKey[] = "LAST_INTEGER";
  75 const int64 kMinimumReportIntervalHours = 1;
  76 const char kInitStatusHistogramLabel[] = "FileSystem.DirectoryDatabaseInit";
  77 const char kDatabaseRepairHistogramLabel[] =
  78     "FileSystem.DirectoryDatabaseRepair";
  79
  80 // These values are recorded in UMA. Changing existing values will invalidate
  81 // results for older Chrome releases. Only add new values.
  82 enum InitStatus {
  83   INIT_STATUS_OK = 0,
  84   INIT_STATUS_CORRUPTION,
  85   INIT_STATUS_IO_ERROR,
  86   INIT_STATUS_UNKNOWN_ERROR,
  87   INIT_STATUS_MAX
  88 };
  89
  90 // These values are recorded in UMA. Changing existing values will invalidate
  91 // results for older Chrome releases. Only add new values.
  92 enum RepairResult {
  93   DB_REPAIR_SUCCEEDED = 0,
  94   DB_REPAIR_FAILED,
  95   DB_REPAIR_MAX
  96 };
  97
  98 std::string GetChildLookupKey(
  99     storage::SandboxDirectoryDatabase::FileId parent_id,
 100     const base::FilePath::StringType& child_name) {
 101   std::string name;
 102   name = storage::FilePathToString(base::FilePath(child_name));
 103   return std::string(kChildLookupPrefix) + base::Int64ToString(parent_id) +
 104       std::string(kChildLookupSeparator) + name;
 105 }
 106
 107 std::string GetChildListingKeyPrefix(
 108     storage::SandboxDirectoryDatabase::FileId parent_id) {
 109   return std::string(kChildLookupPrefix) + base::Int64ToString(parent_id) +
 110       std::string(kChildLookupSeparator);
 111 }
 112
 113 const char* LastFileIdKey() {
 114   return kLastFileIdKey;
 115 }
 116
 117 const char* LastIntegerKey() {
 118   return kLastIntegerKey;
 119 }
 120
 121 std::string GetFileLookupKey(
 122     storage::SandboxDirectoryDatabase::FileId file_id) {
 123   return base::Int64ToString(file_id);
 124 }
 125
 126 // Assumptions:
 127 //  - Any database entry is one of:
 128 //    - ("CHILD_OF:|parent_id|:<name>", "|file_id|"),
 129 //    - ("LAST_FILE_ID", "|last_file_id|"),
 130 //    - ("LAST_INTEGER", "|last_integer|"),
 131 //    - ("|file_id|", "pickled FileInfo")
 132 //        where FileInfo has |parent_id|, |data_path|, |name| and
 133 //        |modification_time|,
 134 // Constraints:
 135 //  - Each file in the database has unique backing file.
 136 //  - Each file in |filesystem_data_directory_| has a database entry.
 137 //  - Directory structure is tree, i.e. connected and acyclic.
 138 class DatabaseCheckHelper {
 139  public:
 140   typedef storage::SandboxDirectoryDatabase::FileId FileId;
 141   typedef storage::SandboxDirectoryDatabase::FileInfo FileInfo;
 142
 143   DatabaseCheckHelper(storage::SandboxDirectoryDatabase* dir_db,
 144                       leveldb::DB* db,
 145                       const base::FilePath& path);
 146
 147   bool IsFileSystemConsistent() {
 148     return IsDatabaseEmpty() ||
 149         (ScanDatabase() && ScanDirectory() && ScanHierarchy());
 150   }
 151
 152  private:
 153   bool IsDatabaseEmpty();
 154   // These 3 methods need to be called in the order.  Each method requires its
 155   // previous method finished successfully. They also require the database is
 156   // not empty.
 157   bool ScanDatabase();
 158   bool ScanDirectory();
 159   bool ScanHierarchy();
 160
 161   storage::SandboxDirectoryDatabase* dir_db_;
 162   leveldb::DB* db_;
 163   base::FilePath path_;
 164
 165   std::set<base::FilePath> files_in_db_;
 166
 167   size_t num_directories_in_db_;
 168   size_t num_files_in_db_;
 169   size_t num_hierarchy_links_in_db_;
 170
 171   FileId last_file_id_;
 172   FileId last_integer_;
 173 };
 174
 175 DatabaseCheckHelper::DatabaseCheckHelper(
 176     storage::SandboxDirectoryDatabase* dir_db,
 177     leveldb::DB* db,
 178     const base::FilePath& path)
 179     : dir_db_(dir_db),
 180       db_(db),
 181       path_(path),
 182       num_directories_in_db_(0),
 183       num_files_in_db_(0),
 184       num_hierarchy_links_in_db_(0),
 185       last_file_id_(-1),
 186       last_integer_(-1) {
 187   DCHECK(dir_db_);
 188   DCHECK(db_);
 189   DCHECK(!path_.empty() && base::DirectoryExists(path_));
 190 }
 191
 192 bool DatabaseCheckHelper::IsDatabaseEmpty() {
 193   scoped_ptr<leveldb::Iterator> itr(db_->NewIterator(leveldb::ReadOptions()));
 194   itr->SeekToFirst();
 195   return !itr->Valid();
 196 }
 197
 198 bool DatabaseCheckHelper::ScanDatabase() {
 199   // Scans all database entries sequentially to verify each of them has unique
 200   // backing file.
 201   int64 max_file_id = -1;
 202   std::set<FileId> file_ids;
 203
 204   scoped_ptr<leveldb::Iterator> itr(db_->NewIterator(leveldb::ReadOptions()));
 205   for (itr->SeekToFirst(); itr->Valid(); itr->Next()) {
 206     std::string key = itr->key().ToString();
 207     if (base::StartsWithASCII(key, kChildLookupPrefix, true)) {
 208       // key: "CHILD_OF:<parent_id>:<name>"
 209       // value: "<child_id>"
 210       ++num_hierarchy_links_in_db_;
 211     } else if (key == kLastFileIdKey) {
 212       // key: "LAST_FILE_ID"
 213       // value: "<last_file_id>"
 214       if (last_file_id_ >= 0 ||
 215           !base::StringToInt64(itr->value().ToString(), &last_file_id_))
 216         return false;
 217
 218       if (last_file_id_ < 0)
 219         return false;
 220     } else if (key == kLastIntegerKey) {
 221       // key: "LAST_INTEGER"
 222       // value: "<last_integer>"
 223       if (last_integer_ >= 0 ||
 224           !base::StringToInt64(itr->value().ToString(), &last_integer_))
 225         return false;
 226     } else {
 227       // key: "<entry_id>"
 228       // value: "<pickled FileInfo>"
 229       FileInfo file_info;
 230       if (!FileInfoFromPickle(
 231               base::Pickle(itr->value().data(), itr->value().size()),
 232               &file_info))
 233         return false;
 234
 235       FileId file_id = -1;
 236       if (!base::StringToInt64(key, &file_id) || file_id < 0)
 237         return false;
 238
 239       if (max_file_id < file_id)
 240         max_file_id = file_id;
 241       if (!file_ids.insert(file_id).second)
 242         return false;
 243
 244       if (file_info.is_directory()) {
 245         ++num_directories_in_db_;
 246         DCHECK(file_info.data_path.empty());
 247       } else {
 248         // Ensure any pair of file entry don't share their data_path.
 249         if (!files_in_db_.insert(file_info.data_path).second)
 250           return false;
 251
 252         // Ensure the backing file exists as a normal file.
 253         base::File::Info platform_file_info;
 254         if (!base::GetFileInfo(
 255                 path_.Append(file_info.data_path), &platform_file_info) ||
 256             platform_file_info.is_directory ||
 257             platform_file_info.is_symbolic_link) {
 258           // leveldb::Iterator iterates a snapshot of the database.
 259           // So even after RemoveFileInfo() call, we'll visit hierarchy link
 260           // from |parent_id| to |file_id|.
 261           if (!dir_db_->RemoveFileInfo(file_id))
 262             return false;
 263           --num_hierarchy_links_in_db_;
 264           files_in_db_.erase(file_info.data_path);
 265         } else {
 266           ++num_files_in_db_;
 267         }
 268       }
 269     }
 270   }
 271
 272   // TODO(tzik): Add constraint for |last_integer_| to avoid possible
 273   // data path confliction on ObfuscatedFileUtil.
 274   return max_file_id <= last_file_id_;
 275 }
 276
 277 bool DatabaseCheckHelper::ScanDirectory() {
 278   // TODO(kinuko): Scans all local file system entries to verify each of them
 279   // has a database entry.
 280   const base::FilePath kExcludes[] = {
 281       base::FilePath(kDirectoryDatabaseName),
 282       base::FilePath(storage::FileSystemUsageCache::kUsageFileName),
 283   };
 284
 285   // Any path in |pending_directories| is relative to |path_|.
 286   std::stack<base::FilePath> pending_directories;
 287   pending_directories.push(base::FilePath());
 288
 289   while (!pending_directories.empty()) {
 290     base::FilePath dir_path = pending_directories.top();
 291     pending_directories.pop();
 292
 293     base::FileEnumerator file_enum(
 294         dir_path.empty() ? path_ : path_.Append(dir_path),
 295         false /* not recursive */,
 296         base::FileEnumerator::DIRECTORIES | base::FileEnumerator::FILES);
 297
 298     base::FilePath absolute_file_path;
 299     while (!(absolute_file_path = file_enum.Next()).empty()) {
 300       base::FileEnumerator::FileInfo find_info = file_enum.GetInfo();
 301
 302       base::FilePath relative_file_path;
 303       if (!path_.AppendRelativePath(absolute_file_path, &relative_file_path))
 304         return false;
 305
 306       if (std::find(kExcludes, kExcludes + arraysize(kExcludes),
 307                     relative_file_path) != kExcludes + arraysize(kExcludes))
 308         continue;
 309
 310       if (find_info.IsDirectory()) {
 311         pending_directories.push(relative_file_path);
 312         continue;
 313       }
 314
 315       // Check if the file has a database entry.
 316       std::set<base::FilePath>::iterator itr =
 317           files_in_db_.find(relative_file_path);
 318       if (itr == files_in_db_.end()) {
 319         if (!base::DeleteFile(absolute_file_path, false))
 320           return false;
 321       } else {
 322         files_in_db_.erase(itr);
 323       }
 324     }
 325   }
 326
 327   return files_in_db_.empty();
 328 }
 329
 330 bool DatabaseCheckHelper::ScanHierarchy() {
 331   size_t visited_directories = 0;
 332   size_t visited_files = 0;
 333   size_t visited_links = 0;
 334
 335   std::stack<FileId> directories;
 336   directories.push(0);
 337
 338   // Check if the root directory exists as a directory.
 339   FileInfo file_info;
 340   if (!dir_db_->GetFileInfo(0, &file_info))
 341     return false;
 342   if (file_info.parent_id != 0 ||
 343       !file_info.is_directory())
 344     return false;
 345
 346   while (!directories.empty()) {
 347     ++visited_directories;
 348     FileId dir_id = directories.top();
 349     directories.pop();
 350
 351     std::vector<FileId> children;
 352     if (!dir_db_->ListChildren(dir_id, &children))
 353       return false;
 354     for (std::vector<FileId>::iterator itr = children.begin();
 355          itr != children.end();
 356          ++itr) {
 357       // Any directory must not have root directory as child.
 358       if (!*itr)
 359         return false;
 360
 361       // Check if the child knows the parent as its parent.
 362       FileInfo file_info;
 363       if (!dir_db_->GetFileInfo(*itr, &file_info))
 364         return false;
 365       if (file_info.parent_id != dir_id)
 366         return false;
 367
 368       // Check if the parent knows the name of its child correctly.
 369       FileId file_id;
 370       if (!dir_db_->GetChildWithName(dir_id, file_info.name, &file_id) ||
 371           file_id != *itr)
 372         return false;
 373
 374       if (file_info.is_directory())
 375         directories.push(*itr);
 376       else
 377         ++visited_files;
 378       ++visited_links;
 379     }
 380   }
 381
 382   // Check if we've visited all database entries.
 383   return num_directories_in_db_ == visited_directories &&
 384       num_files_in_db_ == visited_files &&
 385       num_hierarchy_links_in_db_ == visited_links;
 386 }
 387
 388 // Returns true if the given |data_path| contains no parent references ("..")
 389 // and does not refer to special system files.
 390 // This is called in GetFileInfo, AddFileInfo and UpdateFileInfo to
 391 // ensure we're only dealing with valid data paths.
 392 bool VerifyDataPath(const base::FilePath& data_path) {
 393   // |data_path| should not contain any ".." and should be a relative path
 394   // (to the filesystem_data_directory_).
 395   if (data_path.ReferencesParent() || data_path.IsAbsolute())
 396     return false;
 397   // See if it's not pointing to the special system paths.
 398   const base::FilePath kExcludes[] = {
 399       base::FilePath(kDirectoryDatabaseName),
 400       base::FilePath(storage::FileSystemUsageCache::kUsageFileName),
 401   };
 402   for (size_t i = 0; i < arraysize(kExcludes); ++i) {
 403     if (data_path == kExcludes[i] || kExcludes[i].IsParent(data_path))
 404       return false;
 405   }
 406   return true;
 407 }
 408
 409 }  // namespace
 410
 411 namespace storage {
 412
 413 SandboxDirectoryDatabase::FileInfo::FileInfo() : parent_id(0) {
 414 }
 415
 416 SandboxDirectoryDatabase::FileInfo::~FileInfo() {
 417 }
 418
 419 SandboxDirectoryDatabase::SandboxDirectoryDatabase(
 420     const base::FilePath& filesystem_data_directory,
 421     leveldb::Env* env_override)
 422     : filesystem_data_directory_(filesystem_data_directory),
 423       env_override_(env_override) {
 424 }
 425
 426 SandboxDirectoryDatabase::~SandboxDirectoryDatabase() {
 427 }
 428
 429 bool SandboxDirectoryDatabase::GetChildWithName(
 430     FileId parent_id,
 431     const base::FilePath::StringType& name,
 432     FileId* child_id) {
 433   if (!Init(REPAIR_ON_CORRUPTION))
 434     return false;
 435   DCHECK(child_id);
 436   std::string child_key = GetChildLookupKey(parent_id, name);
 437   std::string child_id_string;
 438   leveldb::Status status =
 439       db_->Get(leveldb::ReadOptions(), child_key, &child_id_string);
 440   if (status.IsNotFound())
 441     return false;
 442   if (status.ok()) {
 443     if (!base::StringToInt64(child_id_string, child_id)) {
 444       LOG(ERROR) << "Hit database corruption!";
 445       return false;
 446     }
 447     return true;
 448   }
 449   HandleError(FROM_HERE, status);
 450   return false;
 451 }
 452
 453 bool SandboxDirectoryDatabase::GetFileWithPath(
 454     const base::FilePath& path, FileId* file_id) {
 455   std::vector<base::FilePath::StringType> components;
 456   VirtualPath::GetComponents(path, &components);
 457   FileId local_id = 0;
 458   std::vector<base::FilePath::StringType>::iterator iter;
 459   for (iter = components.begin(); iter != components.end(); ++iter) {
 460     base::FilePath::StringType name;
 461     name = *iter;
 462     if (name == FILE_PATH_LITERAL("/"))
 463       continue;
 464     if (!GetChildWithName(local_id, name, &local_id))
 465       return false;
 466   }
 467   *file_id = local_id;
 468   return true;
 469 }
 470
 471 bool SandboxDirectoryDatabase::ListChildren(
 472     FileId parent_id, std::vector<FileId>* children) {
 473   // Check to add later: fail if parent is a file, at least in debug builds.
 474   if (!Init(REPAIR_ON_CORRUPTION))
 475     return false;
 476   DCHECK(children);
 477   std::string child_key_prefix = GetChildListingKeyPrefix(parent_id);
 478
 479   scoped_ptr<leveldb::Iterator> iter(db_->NewIterator(leveldb::ReadOptions()));
 480   iter->Seek(child_key_prefix);
 481   children->clear();
 482   while (iter->Valid() && base::StartsWithASCII(iter->key().ToString(),
 483                                                 child_key_prefix, true)) {
 484     std::string child_id_string = iter->value().ToString();
 485     FileId child_id;
 486     if (!base::StringToInt64(child_id_string, &child_id)) {
 487       LOG(ERROR) << "Hit database corruption!";
 488       return false;
 489     }
 490     children->push_back(child_id);
 491     iter->Next();
 492   }
 493   return true;
 494 }
 495
 496 bool SandboxDirectoryDatabase::GetFileInfo(FileId file_id, FileInfo* info) {
 497   if (!Init(REPAIR_ON_CORRUPTION))
 498     return false;
 499   DCHECK(info);
 500   std::string file_key = GetFileLookupKey(file_id);
 501   std::string file_data_string;
 502   leveldb::Status status =
 503       db_->Get(leveldb::ReadOptions(), file_key, &file_data_string);
 504   if (status.ok()) {
 505     bool success = FileInfoFromPickle(
 506         base::Pickle(file_data_string.data(), file_data_string.length()), info);
 507     if (!success)
 508       return false;
 509     if (!VerifyDataPath(info->data_path)) {
 510       LOG(ERROR) << "Resolved data path is invalid: "
 511                  << info->data_path.value();
 512       return false;
 513     }
 514     return true;
 515   }
 516   // Special-case the root, for databases that haven't been initialized yet.
 517   // Without this, a query for the root's file info, made before creating the
 518   // first file in the database, will fail and confuse callers.
 519   if (status.IsNotFound() && !file_id) {
 520     info->name = base::FilePath::StringType();
 521     info->data_path = base::FilePath();
 522     info->modification_time = base::Time::Now();
 523     info->parent_id = 0;
 524     return true;
 525   }
 526   HandleError(FROM_HERE, status);
 527   return false;
 528 }
 529
 530 base::File::Error SandboxDirectoryDatabase::AddFileInfo(
 531     const FileInfo& info, FileId* file_id) {
 532   if (!Init(REPAIR_ON_CORRUPTION))
 533     return base::File::FILE_ERROR_FAILED;
 534   DCHECK(file_id);
 535   std::string child_key = GetChildLookupKey(info.parent_id, info.name);
 536   std::string child_id_string;
 537   leveldb::Status status =
 538       db_->Get(leveldb::ReadOptions(), child_key, &child_id_string);
 539   if (status.ok()) {
 540     LOG(ERROR) << "File exists already!";
 541     return base::File::FILE_ERROR_EXISTS;
 542   }
 543   if (!status.IsNotFound()) {
 544     HandleError(FROM_HERE, status);
 545     return base::File::FILE_ERROR_NOT_FOUND;
 546   }
 547
 548   if (!IsDirectory(info.parent_id)) {
 549     LOG(ERROR) << "New parent directory is a file!";
 550     return base::File::FILE_ERROR_NOT_A_DIRECTORY;
 551   }
 552
 553   // This would be a fine place to limit the number of files in a directory, if
 554   // we decide to add that restriction.
 555
 556   FileId temp_id;
 557   if (!GetLastFileId(&temp_id))
 558     return base::File::FILE_ERROR_FAILED;
 559   ++temp_id;
 560
 561   leveldb::WriteBatch batch;
 562   if (!AddFileInfoHelper(info, temp_id, &batch))
 563     return base::File::FILE_ERROR_FAILED;
 564
 565   batch.Put(LastFileIdKey(), base::Int64ToString(temp_id));
 566   status = db_->Write(leveldb::WriteOptions(), &batch);
 567   if (!status.ok()) {
 568     HandleError(FROM_HERE, status);
 569     return base::File::FILE_ERROR_FAILED;
 570   }
 571   *file_id = temp_id;
 572   return base::File::FILE_OK;
 573 }
 574
 575 bool SandboxDirectoryDatabase::RemoveFileInfo(FileId file_id) {
 576   if (!Init(REPAIR_ON_CORRUPTION))
 577     return false;
 578   leveldb::WriteBatch batch;
 579   if (!RemoveFileInfoHelper(file_id, &batch))
 580     return false;
 581   leveldb::Status status = db_->Write(leveldb::WriteOptions(), &batch);
 582   if (!status.ok()) {
 583     HandleError(FROM_HERE, status);
 584     return false;
 585   }
 586   return true;
 587 }
 588
 589 bool SandboxDirectoryDatabase::UpdateFileInfo(
 590     FileId file_id, const FileInfo& new_info) {
 591   // TODO(ericu): We should also check to see that this doesn't create a loop,
 592   // but perhaps only in a debug build.
 593   if (!Init(REPAIR_ON_CORRUPTION))
 594     return false;
 595   DCHECK(file_id);  // You can't remove the root, ever.  Just delete the DB.
 596   FileInfo old_info;
 597   if (!GetFileInfo(file_id, &old_info))
 598     return false;
 599   if (old_info.parent_id != new_info.parent_id &&
 600       !IsDirectory(new_info.parent_id))
 601     return false;
 602   if (old_info.parent_id != new_info.parent_id ||
 603       old_info.name != new_info.name) {
 604     // Check for name clashes.
 605     FileId temp_id;
 606     if (GetChildWithName(new_info.parent_id, new_info.name, &temp_id)) {
 607       LOG(ERROR) << "Name collision on move.";
 608       return false;
 609     }
 610   }
 611   leveldb::WriteBatch batch;
 612   if (!RemoveFileInfoHelper(file_id, &batch) ||
 613       !AddFileInfoHelper(new_info, file_id, &batch))
 614     return false;
 615   leveldb::Status status = db_->Write(leveldb::WriteOptions(), &batch);
 616   if (!status.ok()) {
 617     HandleError(FROM_HERE, status);
 618     return false;
 619   }
 620   return true;
 621 }
 622
 623 bool SandboxDirectoryDatabase::UpdateModificationTime(
 624     FileId file_id, const base::Time& modification_time) {
 625   FileInfo info;
 626   if (!GetFileInfo(file_id, &info))
 627     return false;
 628   info.modification_time = modification_time;
 629   base::Pickle pickle;
 630   if (!PickleFromFileInfo(info, &pickle))
 631     return false;
 632   leveldb::Status status = db_->Put(
 633       leveldb::WriteOptions(),
 634       GetFileLookupKey(file_id),
 635       leveldb::Slice(reinterpret_cast<const char *>(pickle.data()),
 636                      pickle.size()));
 637   if (!status.ok()) {
 638     HandleError(FROM_HERE, status);
 639     return false;
 640   }
 641   return true;
 642 }
 643
 644 bool SandboxDirectoryDatabase::OverwritingMoveFile(
 645     FileId src_file_id, FileId dest_file_id) {
 646   FileInfo src_file_info;
 647   FileInfo dest_file_info;
 648
 649   if (!GetFileInfo(src_file_id, &src_file_info))
 650     return false;
 651   if (!GetFileInfo(dest_file_id, &dest_file_info))
 652     return false;
 653   if (src_file_info.is_directory() || dest_file_info.is_directory())
 654     return false;
 655   leveldb::WriteBatch batch;
 656   // This is the only field that really gets moved over; if you add fields to
 657   // FileInfo, e.g. ctime, they might need to be copied here.
 658   dest_file_info.data_path = src_file_info.data_path;
 659   if (!RemoveFileInfoHelper(src_file_id, &batch))
 660     return false;
 661   base::Pickle pickle;
 662   if (!PickleFromFileInfo(dest_file_info, &pickle))
 663     return false;
 664   batch.Put(
 665       GetFileLookupKey(dest_file_id),
 666       leveldb::Slice(reinterpret_cast<const char *>(pickle.data()),
 667                      pickle.size()));
 668   leveldb::Status status = db_->Write(leveldb::WriteOptions(), &batch);
 669   if (!status.ok()) {
 670     HandleError(FROM_HERE, status);
 671     return false;
 672   }
 673   return true;
 674 }
 675
 676 bool SandboxDirectoryDatabase::GetNextInteger(int64* next) {
 677   if (!Init(REPAIR_ON_CORRUPTION))
 678     return false;
 679   DCHECK(next);
 680   std::string int_string;
 681   leveldb::Status status =
 682       db_->Get(leveldb::ReadOptions(), LastIntegerKey(), &int_string);
 683   if (status.ok()) {
 684     int64 temp;
 685     if (!base::StringToInt64(int_string, &temp)) {
 686       LOG(ERROR) << "Hit database corruption!";
 687       return false;
 688     }
 689     ++temp;
 690     status = db_->Put(leveldb::WriteOptions(), LastIntegerKey(),
 691         base::Int64ToString(temp));
 692     if (!status.ok()) {
 693       HandleError(FROM_HERE, status);
 694       return false;
 695     }
 696     *next = temp;
 697     return true;
 698   }
 699   if (!status.IsNotFound()) {
 700     HandleError(FROM_HERE, status);
 701     return false;
 702   }
 703   // The database must not yet exist; initialize it.
 704   if (!StoreDefaultValues())
 705     return false;
 706
 707   return GetNextInteger(next);
 708 }
 709
 710 bool SandboxDirectoryDatabase::DestroyDatabase() {
 711   db_.reset();
 712   const std::string path =
 713       FilePathToString(filesystem_data_directory_.Append(
 714           kDirectoryDatabaseName));
 715   leveldb::Options options;
 716   if (env_override_)
 717     options.env = env_override_;
 718   leveldb::Status status = leveldb::DestroyDB(path, options);
 719   if (status.ok())
 720     return true;
 721   LOG(WARNING) << "Failed to destroy a database with status " <<
 722       status.ToString();
 723   return false;
 724 }
 725
 726 bool SandboxDirectoryDatabase::Init(RecoveryOption recovery_option) {
 727   if (db_)
 728     return true;
 729
 730   std::string path =
 731       FilePathToString(filesystem_data_directory_.Append(
 732           kDirectoryDatabaseName));
 733   leveldb::Options options;
 734   options.max_open_files = 0;  // Use minimum.
 735   options.create_if_missing = true;
 736   options.reuse_logs = leveldb_env::kDefaultLogReuseOptionValue;
 737   if (env_override_)
 738     options.env = env_override_;
 739   leveldb::DB* db;
 740   leveldb::Status status = leveldb::DB::Open(options, path, &db);
 741   ReportInitStatus(status);
 742   if (status.ok()) {
 743     db_.reset(db);
 744     return true;
 745   }
 746   HandleError(FROM_HERE, status);
 747
 748   // Corruption due to missing necessary MANIFEST-* file causes IOError instead
 749   // of Corruption error.
 750   // Try to repair database even when IOError case.
 751   if (!status.IsCorruption() && !status.IsIOError())
 752     return false;
 753
 754   switch (recovery_option) {
 755     case FAIL_ON_CORRUPTION:
 756       return false;
 757     case REPAIR_ON_CORRUPTION:
 758       LOG(WARNING) << "Corrupted SandboxDirectoryDatabase detected."
 759                    << " Attempting to repair.";
 760       if (RepairDatabase(path)) {
 761         UMA_HISTOGRAM_ENUMERATION(kDatabaseRepairHistogramLabel,
 762                                   DB_REPAIR_SUCCEEDED, DB_REPAIR_MAX);
 763         return true;
 764       }
 765       UMA_HISTOGRAM_ENUMERATION(kDatabaseRepairHistogramLabel,
 766                                 DB_REPAIR_FAILED, DB_REPAIR_MAX);
 767       LOG(WARNING) << "Failed to repair SandboxDirectoryDatabase.";
 768       // fall through
 769     case DELETE_ON_CORRUPTION:
 770       LOG(WARNING) << "Clearing SandboxDirectoryDatabase.";
 771       if (!base::DeleteFile(filesystem_data_directory_, true))
 772         return false;
 773       if (!base::CreateDirectory(filesystem_data_directory_))
 774         return false;
 775       return Init(FAIL_ON_CORRUPTION);
 776   }
 777
 778   NOTREACHED();
 779   return false;
 780 }
 781
 782 bool SandboxDirectoryDatabase::RepairDatabase(const std::string& db_path) {
 783   DCHECK(!db_.get());
 784   leveldb::Options options;
 785   options.max_open_files = 0;  // Use minimum.
 786   if (env_override_)
 787     options.env = env_override_;
 788   if (!leveldb::RepairDB(db_path, options).ok())
 789     return false;
 790   if (!Init(FAIL_ON_CORRUPTION))
 791     return false;
 792   if (IsFileSystemConsistent())
 793     return true;
 794   db_.reset();
 795   return false;
 796 }
 797
 798 bool SandboxDirectoryDatabase::IsDirectory(FileId file_id) {
 799   FileInfo info;
 800   if (!file_id)
 801     return true;  // The root is a directory.
 802   if (!GetFileInfo(file_id, &info))
 803     return false;
 804   if (!info.is_directory())
 805     return false;
 806   return true;
 807 }
 808
 809 bool SandboxDirectoryDatabase::IsFileSystemConsistent() {
 810   if (!Init(FAIL_ON_CORRUPTION))
 811     return false;
 812   DatabaseCheckHelper helper(this, db_.get(), filesystem_data_directory_);
 813   return helper.IsFileSystemConsistent();
 814 }
 815
 816 void SandboxDirectoryDatabase::ReportInitStatus(
 817     const leveldb::Status& status) {
 818   base::Time now = base::Time::Now();
 819   const base::TimeDelta minimum_interval =
 820       base::TimeDelta::FromHours(kMinimumReportIntervalHours);
 821   if (last_reported_time_ + minimum_interval >= now)
 822     return;
 823   last_reported_time_ = now;
 824
 825   if (status.ok()) {
 826     UMA_HISTOGRAM_ENUMERATION(kInitStatusHistogramLabel,
 827                               INIT_STATUS_OK, INIT_STATUS_MAX);
 828   } else if (status.IsCorruption()) {
 829     UMA_HISTOGRAM_ENUMERATION(kInitStatusHistogramLabel,
 830                               INIT_STATUS_CORRUPTION, INIT_STATUS_MAX);
 831   } else if (status.IsIOError()) {
 832     UMA_HISTOGRAM_ENUMERATION(kInitStatusHistogramLabel,
 833                               INIT_STATUS_IO_ERROR, INIT_STATUS_MAX);
 834   } else {
 835     UMA_HISTOGRAM_ENUMERATION(kInitStatusHistogramLabel,
 836                               INIT_STATUS_UNKNOWN_ERROR, INIT_STATUS_MAX);
 837   }
 838 }
 839
 840 bool SandboxDirectoryDatabase::StoreDefaultValues() {
 841   // Verify that this is a totally new database, and initialize it.
 842   scoped_ptr<leveldb::Iterator> iter(db_->NewIterator(leveldb::ReadOptions()));
 843   iter->SeekToFirst();
 844   if (iter->Valid()) {  // DB was not empty--we shouldn't have been called.
 845     LOG(ERROR) << "File system origin database is corrupt!";
 846     return false;
 847   }
 848   // This is always the first write into the database.  If we ever add a
 849   // version number, it should go in this transaction too.
 850   FileInfo root;
 851   root.parent_id = 0;
 852   root.modification_time = base::Time::Now();
 853   leveldb::WriteBatch batch;
 854   if (!AddFileInfoHelper(root, 0, &batch))
 855     return false;
 856   batch.Put(LastFileIdKey(), base::Int64ToString(0));
 857   batch.Put(LastIntegerKey(), base::Int64ToString(-1));
 858   leveldb::Status status = db_->Write(leveldb::WriteOptions(), &batch);
 859   if (!status.ok()) {
 860     HandleError(FROM_HERE, status);
 861     return false;
 862   }
 863   return true;
 864 }
 865
 866 bool SandboxDirectoryDatabase::GetLastFileId(FileId* file_id) {
 867   if (!Init(REPAIR_ON_CORRUPTION))
 868     return false;
 869   DCHECK(file_id);
 870   std::string id_string;
 871   leveldb::Status status =
 872       db_->Get(leveldb::ReadOptions(), LastFileIdKey(), &id_string);
 873   if (status.ok()) {
 874     if (!base::StringToInt64(id_string, file_id)) {
 875       LOG(ERROR) << "Hit database corruption!";
 876       return false;
 877     }
 878     return true;
 879   }
 880   if (!status.IsNotFound()) {
 881     HandleError(FROM_HERE, status);
 882     return false;
 883   }
 884   // The database must not yet exist; initialize it.
 885   if (!StoreDefaultValues())
 886     return false;
 887   *file_id = 0;
 888   return true;
 889 }
 890
 891 // This does very few safety checks!
 892 bool SandboxDirectoryDatabase::AddFileInfoHelper(
 893     const FileInfo& info, FileId file_id, leveldb::WriteBatch* batch) {
 894   if (!VerifyDataPath(info.data_path)) {
 895     LOG(ERROR) << "Invalid data path is given: " << info.data_path.value();
 896     return false;
 897   }
 898   std::string id_string = GetFileLookupKey(file_id);
 899   if (!file_id) {
 900     // The root directory doesn't need to be looked up by path from its parent.
 901     DCHECK(!info.parent_id);
 902     DCHECK(info.data_path.empty());
 903   } else {
 904     std::string child_key = GetChildLookupKey(info.parent_id, info.name);
 905     batch->Put(child_key, id_string);
 906   }
 907   base::Pickle pickle;
 908   if (!PickleFromFileInfo(info, &pickle))
 909     return false;
 910   batch->Put(
 911       id_string,
 912       leveldb::Slice(reinterpret_cast<const char *>(pickle.data()),
 913                      pickle.size()));
 914   return true;
 915 }
 916
 917 // This does very few safety checks!
 918 bool SandboxDirectoryDatabase::RemoveFileInfoHelper(
 919     FileId file_id, leveldb::WriteBatch* batch) {
 920   DCHECK(file_id);  // You can't remove the root, ever.  Just delete the DB.
 921   FileInfo info;
 922   if (!GetFileInfo(file_id, &info))
 923     return false;
 924   if (info.data_path.empty()) {  // It's a directory
 925     std::vector<FileId> children;
 926     // TODO(ericu): Make a faster is-the-directory-empty check.
 927     if (!ListChildren(file_id, &children))
 928       return false;
 929     if (children.size()) {
 930       LOG(ERROR) << "Can't remove a directory with children.";
 931       return false;
 932     }
 933   }
 934   batch->Delete(GetChildLookupKey(info.parent_id, info.name));
 935   batch->Delete(GetFileLookupKey(file_id));
 936   return true;
 937 }
 938
 939 void SandboxDirectoryDatabase::HandleError(
 940     const tracked_objects::Location& from_here,
 941     const leveldb::Status& status) {
 942   LOG(ERROR) << "SandboxDirectoryDatabase failed at: "
 943              << from_here.ToString() << " with error: " << status.ToString();
 944   db_.reset();
 945 }
 946
 947 }  // namespace storage