Jabber Developer
3f36c303c2
All checks were successful
CI Code / Check spelling (push) Successful in 21s
CI Code / Check coding style (push) Successful in 31s
CI Code / Code Coverage (push) Successful in 2m21s
CI Code / Linux (ubuntu) (push) Successful in 4m30s
CI Code / Linux (debian) (push) Successful in 6m43s
CI Code / Linux (arch) (push) Successful in 10m8s
A flat-file alternative to the SQLite chatlog backend with runtime
switching, full migration tooling, integrity verification, and a
synthetic load harness. SQLite remains the default; both backends share
one dispatch layer (db_backend_t vtable) so callers don't change.
Storage layout
- Per-contact append-only `flatlog/<account>/<contact>/history.log`
under XDG_DATA_HOME, one line per message
- Single-line file header with embedded format-version marker
(FLATFILE_FORMAT_VERSION); reader warns on missing or mismatched
marker, writer and checker stay in sync via preprocessor
stringification
- Deterministic key=value metadata (`id`, `aid`, `corrects`, `to`,
`to_res`, `read`) plus escaped body \u2014 `\|`, `\]`, `\\`, `\n`, `\r`
literals prevent log injection
- Sparse byte-offset index (FF_INDEX_STEP=500) per contact for
O(log n) time-range lookups; rebuilt on inode / size / mtime
change, extended in-place when the file just grew
- Per-contact GHashTable caches for archive_id presence and
stanza_id \u2192 from_jid mapping (O(1) MAM dedup, O(1) LMC sender
validation)
Hardening
- Path-traversal protection: JID directory name normalisation
(`@` \u2192 `_at_`, slashes and `..` rejected at construction); every
per-contact path is anchored under the account's flatlog/
directory and validated before open
- Symlink-attack protection: every fopen / open uses O_NOFOLLOW; on
ELOOP the operation aborts with an error rather than following
- Filesystem permissions: log files created with mode 0600,
directories with mode 0700; both enforced at creation, verified
on each open and reported on drift by `/history verify`
- Atomic crash-safe export: write to a temp file via mkstemp (mode
0600, random suffix, no name collisions between concurrent
exports), fsync, then rename \u2014 partial state never replaces the
live file
- Concurrency: advisory flock(LOCK_EX) held for the duration of
every write, including append from live messages and full rewrite
from export, so two profanity processes can't interleave bytes
on the same log
- DoS / abuse guards:
* FF_MAX_LINE_LEN = 10 MB \u2014 lines longer than this are rejected
at read with a warning; the parser will not allocate
unbounded memory for a single record
* FF_MAX_LMC_DEPTH = 100 \u2014 `corrects:` chain walk stops at this
depth and emits a warning, preventing a malicious correction
cycle from spinning the apply pass
* FF_VERSION_SCAN_MAX = 16 \u2014 header version probe never reads
past 16 leading comment lines, even on garbage input
* Empty / inverted byte-range early-return in page-up read path
so a malformed time filter cannot cause an unbounded scan
* Zero-entry index guard so a file whose every line failed to
parse cannot cause a NULL deref on later page-up
- LMC sender validation: an incoming correction whose sender does
not match the original message's sender is rejected at write
time and surfaced via cons_show_error; a cycle in the apply pass
is broken via a visited-set
- jid_create_from_bare_and_resource treats NULL, empty string, and
the literal "(null)" as no resource and returns a bare jid;
similar normalisation for barejid eliminates the legacy
"user@host/(null)" artefact that leaked into stored fulljids
whenever g_strdup_printf("%s", NULL) ran inside create_fulljid
Commands
- `/history switch sqlite|flatfile` \u2014 runtime backend swap, closes
the old backend and opens the new one without reconnecting
- `/history export [<jid>]` \u2014 SQLite -> flat-file, merging with any
existing flatlog (dedup keyed on a SHA-256 hash mixing stanza_id,
timestamp, from_jid, body \u2014 robust against id reuse by older
clients)
- `/history import [<jid>]` \u2014 flat-file -> SQLite, same merge
semantics, runs inside a single SQLite transaction with rollback
on per-contact failure
- `/history verify [<jid>]` \u2014 integrity check; emits a structured
list of issues (ERROR / WARNING / INFO) per file:
* file-level: missing log, wrong permissions (\u2260 0600), UTF-8
BOM present, CRLF line endings, empty file
* line-level: invalid UTF-8 (with byte offset), embedded
control characters, unparsable lines, timestamps out of
order, duplicate `id:` and `aid:` (tracked separately so a
stanza/archive id collision isn't double-reported)
* cross-line: broken `corrects:` references whose target id is
not present in the file
- `/history backend` \u2014 show currently active backend
- Active backend indicator `[sqlite]` / `[flatfile]` in the status
bar next to the JID
- Roster-JID autocomplete for verify / export / import
- export and import open a SQLite handle on demand when the
flatfile backend is currently active, so migration works
regardless of which backend is live
Tests
- Unit: database_export (parser round-trip, escape/unescape, dedup
key stability, JID normalisation), database_stress (14 cases
exercising rapid writes, large messages, deep LMC chains, MAM
dedup, concurrent contacts)
- Functional: history persistence across reconnects, export /
import round-trip with content equality, MUC migration,
timestamp normalisation across timezones
- Bench harness P1\u2013P5 (synthetic load: bulk insert, time-range
read, page-up scroll, MAM ingest, mixed workload) and failure
modes F1\u2013F17 (page-up cursor and forward-iteration symmetry,
oversized lines, MAM dedup, LMC depth and cycles, BOM/CRLF,
missing log, empty file, mtime+inode flip, broken corrects, etc.)
- All bench tests integrate with the existing make targets and
emit CSV rows for baseline comparison
Author: jabber.developer2 <jabber.developer2@jabber.space>
Reviewed-by: jabber.developer <jabber.developer@jabber.space>
138 lines
2.1 KiB
Plaintext
138 lines
2.1 KiB
Plaintext
# git ls-files --others --exclude-from=.git/info/exclude
|
|
# Lines that start with '#' are comments.
|
|
# For a project mostly in C, the following would be a good set of
|
|
# exclude patterns (uncomment them if you want to use them):
|
|
# *.[oa]
|
|
# *~
|
|
|
|
# IDE
|
|
.codelite/
|
|
profanity.mk
|
|
profanity.project
|
|
profanity.workspace
|
|
compile_commands.json
|
|
.tern-port
|
|
.tern-project
|
|
.cproject
|
|
.project
|
|
.settings/
|
|
.vscode/
|
|
*.plist/
|
|
|
|
# autotools
|
|
.libs/
|
|
/Makefile
|
|
/Makefile.in
|
|
_configs.sed
|
|
aclocal.m4
|
|
autom4te.cache/
|
|
build-aux/
|
|
config.log
|
|
config.status
|
|
configure
|
|
configure*~
|
|
libprofanity.la
|
|
libtool
|
|
m4/
|
|
**/.deps/
|
|
**.dirstamp
|
|
src/config.h
|
|
src/config.h.in
|
|
src/config.h.in~
|
|
src/gitversion.h
|
|
src/gitversion.h.in
|
|
src/stamp-h1
|
|
src/plugins/profapi.lo
|
|
|
|
# clangd
|
|
.cache/
|
|
|
|
# out-of-tree build folders
|
|
build*/
|
|
|
|
# binaries
|
|
profanity
|
|
**/*.o
|
|
|
|
# test output
|
|
tests/functionaltests/functionaltests
|
|
tests/functionaltests/functionaltests.log
|
|
tests/functionaltests/functionaltests.trs
|
|
tests/unittests/unittests
|
|
tests/unittests/unittests.log
|
|
tests/unittests/unittests.trs
|
|
test-suite.log
|
|
test-files/
|
|
test-logs/
|
|
|
|
# valgrind output
|
|
profval*
|
|
|
|
# local scripts
|
|
clean-test.sh
|
|
gen_docs.sh
|
|
gitpushall.sh
|
|
|
|
# website files
|
|
main_fragment.html
|
|
toc_fragment.html
|
|
|
|
# valgrind files
|
|
valgrind.out
|
|
my-prof.supp
|
|
|
|
# Generate docs
|
|
apidocs/python/_build/
|
|
apidocs/python/modules.rst
|
|
apidocs/python/prof.rst
|
|
apidocs/python/src/prof.pyc
|
|
apidocs/python/plugin.rst
|
|
apidocs/python/src/plugin.pyc
|
|
apidocs/c/html/
|
|
apidocs/c/doxygen_sqlite3.db
|
|
|
|
# Temp Vim files
|
|
**/*.swp
|
|
|
|
# Virtual envs
|
|
python2/
|
|
python3/
|
|
|
|
.DS_Store
|
|
.gdbinit
|
|
*.bak
|
|
*.orig
|
|
*.patch
|
|
*.rej
|
|
breaks
|
|
|
|
*.tar.*
|
|
*.zip
|
|
*.log*
|
|
coverage/
|
|
*.gcno
|
|
*.gcda
|
|
*.gcov
|
|
coverage.info
|
|
|
|
# Bench harness build artefacts (sources are committed; binaries/CSVs aren't)
|
|
tests/bench/gen_history
|
|
tests/bench/bench_runner
|
|
tests/bench/bench_long_messages
|
|
tests/bench/bench_failure_modes
|
|
tests/bench/bench_export_import
|
|
tests/bench/*.o
|
|
tests/bench/.deps/
|
|
tests/bench/current.csv
|
|
tests/bench/full.csv
|
|
tests/bench/quick.csv
|
|
tests/bench/longmsg.csv
|
|
tests/bench/fail.csv
|
|
tests/bench/multi.csv
|
|
tests/bench/lmc.csv
|
|
tests/bench/ooo.csv
|
|
tests/bench/pipe.csv
|
|
tests/bench/pipeline.csv
|
|
tests/bench/maxpipeline.csv
|
|
tests/bench/imp.csv
|