|
|
|
|
@@ -53,15 +53,23 @@
|
|
|
|
|
static char*
|
|
|
|
|
_make_dedup_key(const char* stanza_id, const char* timestamp, const char* from_jid, const char* body)
|
|
|
|
|
{
|
|
|
|
|
if (stanza_id && strlen(stanza_id) > 0)
|
|
|
|
|
if (stanza_id && stanza_id[0] != '\0')
|
|
|
|
|
return g_strdup(stanza_id);
|
|
|
|
|
|
|
|
|
|
// Fallback: composite key from timestamp + sender + body prefix
|
|
|
|
|
auto_gchar gchar* raw = g_strdup_printf("%s|%s|%.256s",
|
|
|
|
|
timestamp ? timestamp : "",
|
|
|
|
|
from_jid ? from_jid : "",
|
|
|
|
|
body ? body : "");
|
|
|
|
|
return g_compute_checksum_for_string(G_CHECKSUM_SHA256, raw, -1);
|
|
|
|
|
// Fallback for messages without stanza-id: SHA-256 over the FULL body,
|
|
|
|
|
// not the first 256 bytes. The previous prefix-only hash collided on
|
|
|
|
|
// legitimate near-identical templates (signatures, code blocks, paste-
|
|
|
|
|
// bombs) — second occurrence was silently dropped on import. Hashing
|
|
|
|
|
// whole body is microseconds of extra work per row.
|
|
|
|
|
GChecksum* sum = g_checksum_new(G_CHECKSUM_SHA256);
|
|
|
|
|
g_checksum_update(sum, (const guchar*)(timestamp ? timestamp : ""), -1);
|
|
|
|
|
g_checksum_update(sum, (const guchar*)"|", 1);
|
|
|
|
|
g_checksum_update(sum, (const guchar*)(from_jid ? from_jid : ""), -1);
|
|
|
|
|
g_checksum_update(sum, (const guchar*)"|", 1);
|
|
|
|
|
g_checksum_update(sum, (const guchar*)(body ? body : ""), -1);
|
|
|
|
|
char* key = g_strdup(g_checksum_get_string(sum));
|
|
|
|
|
g_checksum_free(sum);
|
|
|
|
|
return key;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// =========================================================================
|
|
|
|
|
@@ -126,6 +134,12 @@ _ff_list_contacts(void)
|
|
|
|
|
// Returns GSList<ff_parsed_line_t*>. Caller frees with g_slist_free_full(list, (GDestroyNotify)ff_parsed_line_free).
|
|
|
|
|
// =========================================================================
|
|
|
|
|
|
|
|
|
|
// Hard ceiling on the total size of a single contact's history.log that
|
|
|
|
|
// _ff_read_all_lines is willing to slurp into memory. Each line expands
|
|
|
|
|
// ~10x on parse (12 g_strdup'd fields + GDateTime), so 2 GB on disk
|
|
|
|
|
// becomes ~20 GB peak heap — well past any realistic working set.
|
|
|
|
|
#define FF_EXPORT_MAX_FILE_BYTES (2LL * 1024 * 1024 * 1024)
|
|
|
|
|
|
|
|
|
|
static GSList*
|
|
|
|
|
_ff_read_all_lines(const char* contact_barejid)
|
|
|
|
|
{
|
|
|
|
|
@@ -134,6 +148,20 @@ _ff_read_all_lines(const char* contact_barejid)
|
|
|
|
|
if (!log_path)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
// Refuse upfront if the file is so large that parsing will OOM the
|
|
|
|
|
// process. We have no streaming-parse path; the whole file becomes
|
|
|
|
|
// a GSList of ff_parsed_line_t in memory. Surface a clear error so
|
|
|
|
|
// the user knows what hit them, rather than the kernel killing prof.
|
|
|
|
|
struct stat st;
|
|
|
|
|
if (stat(log_path, &st) == 0 && st.st_size > FF_EXPORT_MAX_FILE_BYTES) {
|
|
|
|
|
log_error("export: %s is %lld bytes (> %lld limit); refusing to load.",
|
|
|
|
|
log_path, (long long)st.st_size,
|
|
|
|
|
(long long)FF_EXPORT_MAX_FILE_BYTES);
|
|
|
|
|
cons_show_error("Flat-file for %s exceeds %lld MB load limit; cannot export.",
|
|
|
|
|
contact_barejid, (long long)(FF_EXPORT_MAX_FILE_BYTES / (1024 * 1024)));
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
FILE* fp = fopen(log_path, "r");
|
|
|
|
|
if (!fp)
|
|
|
|
|
return NULL;
|
|
|
|
|
@@ -234,25 +262,28 @@ _export_one_contact(const char* contact)
|
|
|
|
|
auto_gchar gchar* dir = g_path_get_dirname(log_path);
|
|
|
|
|
ff_ensure_dir(dir);
|
|
|
|
|
|
|
|
|
|
auto_gchar gchar* tmp_path = g_strdup_printf("%s.export.tmp", log_path);
|
|
|
|
|
|
|
|
|
|
// Use open() with O_NOFOLLOW|O_EXCL to prevent symlink attacks,
|
|
|
|
|
// and explicit 0600 permissions (chat history is private).
|
|
|
|
|
int tmp_fd = open(tmp_path, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW, S_IRUSR | S_IWUSR);
|
|
|
|
|
// Use mkstemp() to create a unique-named temp file. The previous fixed
|
|
|
|
|
// "{log_path}.export.tmp" name + unlink-retry was vulnerable to two
|
|
|
|
|
// concurrent exports clobbering each other's in-flight tmp files
|
|
|
|
|
// (process B unlinks A's mid-write tmp, both race to write, second
|
|
|
|
|
// rename wins). Random suffix eliminates that.
|
|
|
|
|
//
|
|
|
|
|
// mkstemp on glibc creates the file with mode 0600. We fchmod to be
|
|
|
|
|
// sure across libc implementations. mkstemp uses O_RDWR|O_CREAT|O_EXCL
|
|
|
|
|
// internally; symlink attacks aren't possible because the name was
|
|
|
|
|
// just generated and no other process knows it.
|
|
|
|
|
auto_gchar gchar* tmp_path = g_strdup_printf("%s.export.XXXXXX", log_path);
|
|
|
|
|
int tmp_fd = mkstemp(tmp_path);
|
|
|
|
|
if (tmp_fd < 0) {
|
|
|
|
|
if (errno == EEXIST) {
|
|
|
|
|
// Stale temp file from previous failed export — remove and retry
|
|
|
|
|
unlink(tmp_path);
|
|
|
|
|
tmp_fd = open(tmp_path, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW, S_IRUSR | S_IWUSR);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if (tmp_fd < 0) {
|
|
|
|
|
log_error("export: cannot create %s: %s", tmp_path, strerror(errno));
|
|
|
|
|
log_error("export: mkstemp(%s) failed: %s", tmp_path, strerror(errno));
|
|
|
|
|
g_hash_table_destroy(seen_keys);
|
|
|
|
|
g_slist_free_full(existing, (GDestroyNotify)ff_parsed_line_free);
|
|
|
|
|
g_slist_free_full(sqlite_lines, (GDestroyNotify)message_free);
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
if (fchmod(tmp_fd, S_IRUSR | S_IWUSR) != 0) {
|
|
|
|
|
log_warning("export: fchmod(%s, 0600) failed: %s", tmp_path, strerror(errno));
|
|
|
|
|
}
|
|
|
|
|
FILE* fp = fdopen(tmp_fd, "w");
|
|
|
|
|
if (!fp) {
|
|
|
|
|
log_error("export: fdopen failed for %s: %s", tmp_path, strerror(errno));
|
|
|
|
|
@@ -275,29 +306,18 @@ _export_one_contact(const char* contact)
|
|
|
|
|
int contact_exported = 0;
|
|
|
|
|
int contact_skipped = 0;
|
|
|
|
|
|
|
|
|
|
// Collect ALL lines into a merged list for sorted output
|
|
|
|
|
// Collect ALL lines into a merged list for sorted output.
|
|
|
|
|
// Transfer ownership of every parsed line from `existing` directly into
|
|
|
|
|
// `merged` instead of deep-copying — saves ~12 g_strdup calls per row,
|
|
|
|
|
// which dominate wall time at 100k+ rows. After splicing we free the
|
|
|
|
|
// list nodes (not the data) and NULL out existing so the final cleanup
|
|
|
|
|
// doesn't double-free.
|
|
|
|
|
GSList* merged = NULL;
|
|
|
|
|
|
|
|
|
|
// Add existing flatfile lines (mark as already seen in dedup)
|
|
|
|
|
for (GSList* l = existing; l; l = l->next) {
|
|
|
|
|
ff_parsed_line_t* pl = l->data;
|
|
|
|
|
// Create a shallow copy for the merged list (originals freed separately)
|
|
|
|
|
ff_parsed_line_t* copy = g_malloc0(sizeof(ff_parsed_line_t));
|
|
|
|
|
copy->timestamp_str = g_strdup(pl->timestamp_str);
|
|
|
|
|
copy->timestamp = pl->timestamp ? g_date_time_ref(pl->timestamp) : NULL;
|
|
|
|
|
copy->type = g_strdup(pl->type);
|
|
|
|
|
copy->enc = g_strdup(pl->enc);
|
|
|
|
|
copy->stanza_id = g_strdup(pl->stanza_id);
|
|
|
|
|
copy->archive_id = g_strdup(pl->archive_id);
|
|
|
|
|
copy->replace_id = g_strdup(pl->replace_id);
|
|
|
|
|
copy->from_jid = g_strdup(pl->from_jid);
|
|
|
|
|
copy->from_resource = g_strdup(pl->from_resource);
|
|
|
|
|
copy->to_jid = g_strdup(pl->to_jid);
|
|
|
|
|
copy->to_resource = g_strdup(pl->to_resource);
|
|
|
|
|
copy->marked_read = pl->marked_read;
|
|
|
|
|
copy->message = g_strdup(pl->message);
|
|
|
|
|
merged = g_slist_prepend(merged, copy);
|
|
|
|
|
merged = g_slist_prepend(merged, l->data);
|
|
|
|
|
}
|
|
|
|
|
g_slist_free(existing);
|
|
|
|
|
existing = NULL;
|
|
|
|
|
|
|
|
|
|
// Add SQLite messages that aren't already in the flatfile
|
|
|
|
|
for (GSList* l = sqlite_lines; l; l = l->next) {
|
|
|
|
|
@@ -339,6 +359,11 @@ _export_one_contact(const char* contact)
|
|
|
|
|
// Sort merged list by timestamp (ISO8601 is lexicographically sortable)
|
|
|
|
|
merged = g_slist_sort(merged, _compare_parsed_lines_by_timestamp);
|
|
|
|
|
|
|
|
|
|
// Cache the total length once — calling g_slist_length() inside the
|
|
|
|
|
// write loop is O(n) per call, turning the loop into O(n²) wall time
|
|
|
|
|
// (catastrophic at >100k rows).
|
|
|
|
|
int merged_total = (int)g_slist_length(merged);
|
|
|
|
|
|
|
|
|
|
// Write all lines sorted
|
|
|
|
|
int written = 0;
|
|
|
|
|
for (GSList* l = merged; l; l = l->next) {
|
|
|
|
|
@@ -351,7 +376,7 @@ _export_one_contact(const char* contact)
|
|
|
|
|
pl->message);
|
|
|
|
|
written++;
|
|
|
|
|
if (written % EXPORT_PROGRESS_INTERVAL == 0) {
|
|
|
|
|
cons_show(" ... %s: %d/%d written so far", contact, written, (int)g_slist_length(merged));
|
|
|
|
|
cons_show(" ... %s: %d/%d written so far", contact, written, merged_total);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@@ -572,6 +597,16 @@ log_database_import_from_flatfile(const gchar* const contact_jid)
|
|
|
|
|
|
|
|
|
|
g_hash_table_destroy(seen_keys);
|
|
|
|
|
g_slist_free_full(ff_lines, (GDestroyNotify)ff_parsed_line_free);
|
|
|
|
|
|
|
|
|
|
// If the per-contact import bailed mid-stream (likely a system-level
|
|
|
|
|
// problem: disk full, sqlite locked, etc.) — don't blindly try the
|
|
|
|
|
// remaining contacts; they'll almost certainly hit the same error
|
|
|
|
|
// and produce a confusing wall of "Import of X failed" messages.
|
|
|
|
|
// Stop here so the user can investigate the root cause.
|
|
|
|
|
if (!import_ok) {
|
|
|
|
|
cons_show_error("Aborting import — system-level failure suspected. Fix the underlying issue and retry.");
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
g_slist_free_full(contacts, g_free);
|
|
|
|
|
|