mirror of
https://git.jabber.space/devs/cproof.git
synced 2026-07-18 14:06:21 +00:00
A flat-file alternative to the SQLite chatlog backend with runtime
switching, full migration tooling, integrity verification, and a
synthetic load harness. SQLite remains the default; both backends share
one dispatch layer (db_backend_t vtable) so callers don't change.
Storage layout
- Per-contact append-only `flatlog/<account>/<contact>/history.log`
under XDG_DATA_HOME, one line per message
- Single-line file header with embedded format-version marker
(FLATFILE_FORMAT_VERSION); reader warns on missing or mismatched
marker, writer and checker stay in sync via preprocessor
stringification
- Deterministic key=value metadata (`id`, `aid`, `corrects`, `to`,
`to_res`, `read`) plus escaped body \u2014 `\|`, `\]`, `\\`, `\n`, `\r`
literals prevent log injection
- Sparse byte-offset index (FF_INDEX_STEP=500) per contact for
O(log n) time-range lookups; rebuilt on inode / size / mtime
change, extended in-place when the file just grew
- Per-contact GHashTable caches for archive_id presence and
stanza_id \u2192 from_jid mapping (O(1) MAM dedup, O(1) LMC sender
validation)
Hardening
- Path-traversal protection: JID directory name normalisation
(`@` \u2192 `_at_`, slashes and `..` rejected at construction); every
per-contact path is anchored under the account's flatlog/
directory and validated before open
- Symlink-attack protection: every fopen / open uses O_NOFOLLOW; on
ELOOP the operation aborts with an error rather than following
- Filesystem permissions: log files created with mode 0600,
directories with mode 0700; both enforced at creation, verified
on each open and reported on drift by `/history verify`
- Atomic crash-safe export: write to a temp file via mkstemp (mode
0600, random suffix, no name collisions between concurrent
exports), fsync, then rename \u2014 partial state never replaces the
live file
- Concurrency: advisory flock(LOCK_EX) held for the duration of
every write, including append from live messages and full rewrite
from export, so two profanity processes can't interleave bytes
on the same log
- DoS / abuse guards:
* FF_MAX_LINE_LEN = 10 MB \u2014 lines longer than this are rejected
at read with a warning; the parser will not allocate
unbounded memory for a single record
* FF_MAX_LMC_DEPTH = 100 \u2014 `corrects:` chain walk stops at this
depth and emits a warning, preventing a malicious correction
cycle from spinning the apply pass
* FF_VERSION_SCAN_MAX = 16 \u2014 header version probe never reads
past 16 leading comment lines, even on garbage input
* Empty / inverted byte-range early-return in page-up read path
so a malformed time filter cannot cause an unbounded scan
* Zero-entry index guard so a file whose every line failed to
parse cannot cause a NULL deref on later page-up
- LMC sender validation: an incoming correction whose sender does
not match the original message's sender is rejected at write
time and surfaced via cons_show_error; a cycle in the apply pass
is broken via a visited-set
- jid_create_from_bare_and_resource treats NULL, empty string, and
the literal "(null)" as no resource and returns a bare jid;
similar normalisation for barejid eliminates the legacy
"user@host/(null)" artefact that leaked into stored fulljids
whenever g_strdup_printf("%s", NULL) ran inside create_fulljid
Commands
- `/history switch sqlite|flatfile` \u2014 runtime backend swap, closes
the old backend and opens the new one without reconnecting
- `/history export [<jid>]` \u2014 SQLite -> flat-file, merging with any
existing flatlog (dedup keyed on a SHA-256 hash mixing stanza_id,
timestamp, from_jid, body \u2014 robust against id reuse by older
clients)
- `/history import [<jid>]` \u2014 flat-file -> SQLite, same merge
semantics, runs inside a single SQLite transaction with rollback
on per-contact failure
- `/history verify [<jid>]` \u2014 integrity check; emits a structured
list of issues (ERROR / WARNING / INFO) per file:
* file-level: missing log, wrong permissions (\u2260 0600), UTF-8
BOM present, CRLF line endings, empty file
* line-level: invalid UTF-8 (with byte offset), embedded
control characters, unparsable lines, timestamps out of
order, duplicate `id:` and `aid:` (tracked separately so a
stanza/archive id collision isn't double-reported)
* cross-line: broken `corrects:` references whose target id is
not present in the file
- `/history backend` \u2014 show currently active backend
- Active backend indicator `[sqlite]` / `[flatfile]` in the status
bar next to the JID
- Roster-JID autocomplete for verify / export / import
- export and import open a SQLite handle on demand when the
flatfile backend is currently active, so migration works
regardless of which backend is live
Tests
- Unit: database_export (parser round-trip, escape/unescape, dedup
key stability, JID normalisation), database_stress (14 cases
exercising rapid writes, large messages, deep LMC chains, MAM
dedup, concurrent contacts)
- Functional: history persistence across reconnects, export /
import round-trip with content equality, MUC migration,
timestamp normalisation across timezones
- Bench harness P1\u2013P5 (synthetic load: bulk insert, time-range
read, page-up scroll, MAM ingest, mixed workload) and failure
modes F1\u2013F17 (page-up cursor and forward-iteration symmetry,
oversized lines, MAM dedup, LMC depth and cycles, BOM/CRLF,
missing log, empty file, mtime+inode flip, broken corrects, etc.)
- All bench tests integrate with the existing make targets and
emit CSV rows for baseline comparison
Author: jabber.developer2 <jabber.developer2@jabber.space>
Reviewed-by: jabber.developer <jabber.developer@jabber.space>
376 lines
8.2 KiB
C
376 lines
8.2 KiB
C
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
//
|
|
// This file is part of CProof.
|
|
// See LICENSE for the full GPLv3 text and the special OpenSSL linking exception.
|
|
|
|
/*
|
|
* bench_stubs.c
|
|
* vim: expandtab:ts=4:sts=4:sw=4
|
|
*
|
|
* Minimal stubs so we can link the flat-file backend (database_flatfile*.c)
|
|
* into the bench harness without pulling in the rest of profanity (xmpp,
|
|
* ui, prefs, connection state, ...).
|
|
*
|
|
* Only ff_* helpers and ff_state_* / ff_verify_integrity are exercised
|
|
* by the harness, so most code paths inside database_flatfile.c that
|
|
* reference these symbols are never reached. The stubs exist purely to
|
|
* resolve the linker.
|
|
*
|
|
* log_* writes to stderr when BENCH_LOG=1 in the environment, otherwise
|
|
* silent — keeps the harness output clean while still letting us debug.
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <stdarg.h>
|
|
|
|
#include <glib.h>
|
|
|
|
#include "log.h"
|
|
#include "common.h"
|
|
#include "config/files.h"
|
|
#include "config/preferences.h"
|
|
#include "database.h"
|
|
#include "database_flatfile.h" // for ff_jid_to_dir() in stub
|
|
#include "xmpp/xmpp.h"
|
|
#include "xmpp/jid.h"
|
|
#include "xmpp/message.h"
|
|
#include "ui/ui.h"
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// log_* (real impl, gated by BENCH_LOG=1)
|
|
|
|
static int
|
|
_bench_log_enabled(void)
|
|
{
|
|
static int cached = -1;
|
|
if (cached == -1) {
|
|
const char* env = getenv("BENCH_LOG");
|
|
cached = (env && env[0] && env[0] != '0') ? 1 : 0;
|
|
}
|
|
return cached;
|
|
}
|
|
|
|
static void
|
|
_bench_log(const char* level, const char* fmt, va_list ap)
|
|
{
|
|
if (!_bench_log_enabled())
|
|
return;
|
|
fprintf(stderr, "[%s] ", level);
|
|
vfprintf(stderr, fmt, ap);
|
|
fputc('\n', stderr);
|
|
}
|
|
|
|
void
|
|
log_debug(const char* const msg, ...)
|
|
{
|
|
va_list ap;
|
|
va_start(ap, msg);
|
|
_bench_log("DEBUG", msg, ap);
|
|
va_end(ap);
|
|
}
|
|
|
|
void
|
|
log_info(const char* const msg, ...)
|
|
{
|
|
va_list ap;
|
|
va_start(ap, msg);
|
|
_bench_log("INFO", msg, ap);
|
|
va_end(ap);
|
|
}
|
|
|
|
void
|
|
log_warning(const char* const msg, ...)
|
|
{
|
|
va_list ap;
|
|
va_start(ap, msg);
|
|
_bench_log("WARN", msg, ap);
|
|
va_end(ap);
|
|
}
|
|
|
|
void
|
|
log_error(const char* const msg, ...)
|
|
{
|
|
va_list ap;
|
|
va_start(ap, msg);
|
|
_bench_log("ERROR", msg, ap);
|
|
va_end(ap);
|
|
}
|
|
|
|
void
|
|
log_init(log_level_t filter, const char* const log_file)
|
|
{
|
|
(void)filter;
|
|
(void)log_file;
|
|
}
|
|
void
|
|
log_close(void)
|
|
{
|
|
}
|
|
void
|
|
log_msg(log_level_t level, const char* const area, const char* const msg)
|
|
{
|
|
(void)level;
|
|
(void)area;
|
|
(void)msg;
|
|
}
|
|
const char*
|
|
get_log_file_location(void)
|
|
{
|
|
return "";
|
|
}
|
|
log_level_t
|
|
log_get_filter(void)
|
|
{
|
|
return PROF_LEVEL_INFO;
|
|
}
|
|
int
|
|
log_level_from_string(char* log_level, log_level_t* level)
|
|
{
|
|
(void)log_level;
|
|
if (level)
|
|
*level = PROF_LEVEL_INFO;
|
|
return 0;
|
|
}
|
|
void
|
|
log_stderr_init(log_level_t level)
|
|
{
|
|
(void)level;
|
|
}
|
|
void
|
|
log_stderr_handler(void)
|
|
{
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// prefs / files / xmpp / ui — never reached by the harness, but database_flatfile.c
|
|
// references them, so we resolve the symbols.
|
|
|
|
gchar*
|
|
prefs_get_string(preference_t pref)
|
|
{
|
|
(void)pref;
|
|
return NULL;
|
|
}
|
|
|
|
gboolean
|
|
prefs_get_boolean(preference_t pref)
|
|
{
|
|
(void)pref;
|
|
return FALSE;
|
|
}
|
|
|
|
void
|
|
prefs_set_string(preference_t pref, const gchar* new_value)
|
|
{
|
|
(void)pref;
|
|
(void)new_value;
|
|
}
|
|
|
|
void
|
|
prefs_set_boolean(preference_t pref, gboolean value)
|
|
{
|
|
(void)pref;
|
|
(void)value;
|
|
}
|
|
|
|
gchar*
|
|
files_get_data_path(const char* const location)
|
|
{
|
|
const char* base = getenv("BENCH_DATA_DIR");
|
|
if (!base || !base[0])
|
|
base = "/tmp/cproof-bench";
|
|
if (location && location[0])
|
|
return g_strdup_printf("%s/%s", base, location);
|
|
return g_strdup(base);
|
|
}
|
|
|
|
gchar*
|
|
files_get_config_path(const char* const location)
|
|
{
|
|
const char* base = getenv("BENCH_DATA_DIR");
|
|
if (!base || !base[0])
|
|
base = "/tmp/cproof-bench";
|
|
if (location && location[0])
|
|
return g_strdup_printf("%s/%s", base, location);
|
|
return g_strdup(base);
|
|
}
|
|
|
|
// $BENCH_DATA_DIR/$location/$jid_dir/$filename — mirrors the canonical
|
|
// per-account layout. Caller g_free's. Required by _get_db_filename in
|
|
// database_sqlite.c during _sqlite_init.
|
|
char*
|
|
files_file_in_account_data_path(const char* const location, const char* const account_jid,
|
|
const char* const filename)
|
|
{
|
|
if (!account_jid || !filename)
|
|
return NULL;
|
|
const char* base = getenv("BENCH_DATA_DIR");
|
|
if (!base || !base[0])
|
|
base = "/tmp/cproof-bench";
|
|
auto_gchar gchar* jid_dir = ff_jid_to_dir(account_jid);
|
|
auto_gchar gchar* parent = g_strdup_printf("%s/%s/%s", base,
|
|
location && location[0] ? location : "",
|
|
jid_dir);
|
|
g_mkdir_with_parents(parent, 0755);
|
|
return g_strdup_printf("%s/%s", parent, filename);
|
|
}
|
|
|
|
// jid_destroy is the public name; bench doesn't define a jid_destroy stub
|
|
// because src/xmpp/jid.c isn't linked in. We emulate just enough for cleanup.
|
|
static void
|
|
_bench_jid_free(Jid* j)
|
|
{
|
|
if (!j)
|
|
return;
|
|
g_free(j->barejid);
|
|
g_free(j->fulljid);
|
|
g_free(j->resourcepart);
|
|
g_free(j);
|
|
}
|
|
|
|
Jid*
|
|
jid_create(const gchar* const fulljid)
|
|
{
|
|
if (!fulljid)
|
|
return NULL;
|
|
Jid* j = g_malloc0(sizeof(Jid));
|
|
j->fulljid = g_strdup(fulljid);
|
|
const char* slash = strchr(fulljid, '/');
|
|
if (slash) {
|
|
j->barejid = g_strndup(fulljid, slash - fulljid);
|
|
j->resourcepart = g_strdup(slash + 1);
|
|
} else {
|
|
j->barejid = g_strdup(fulljid);
|
|
}
|
|
return j;
|
|
}
|
|
|
|
void
|
|
jid_destroy(Jid* jid)
|
|
{
|
|
_bench_jid_free(jid);
|
|
}
|
|
|
|
// Weak so that bench targets which also link real database.c (which defines
|
|
// the same symbol) take the strong version. bench_runner / bench_long_messages /
|
|
// bench_failure_modes don't link database.c and rely on this stub.
|
|
__attribute__((weak)) void
|
|
integrity_issue_free(integrity_issue_t* issue)
|
|
{
|
|
if (!issue)
|
|
return;
|
|
g_free(issue->file);
|
|
g_free(issue->message);
|
|
g_free(issue);
|
|
}
|
|
|
|
void
|
|
message_free(ProfMessage* m)
|
|
{
|
|
if (!m)
|
|
return;
|
|
_bench_jid_free(m->from_jid);
|
|
_bench_jid_free(m->to_jid);
|
|
g_free(m->id);
|
|
g_free(m->originid);
|
|
g_free(m->replace_id);
|
|
g_free(m->stanzaid);
|
|
g_free(m->body);
|
|
g_free(m->encrypted);
|
|
g_free(m->plain);
|
|
if (m->timestamp)
|
|
g_date_time_unref(m->timestamp);
|
|
g_free(m);
|
|
}
|
|
|
|
// connection_get_jid: returns a process-wide stub Jid built from
|
|
// $BENCH_ACCOUNT_JID (default "bench@bench.example"). Allocated lazily on
|
|
// first call, freed at exit via atexit().
|
|
static Jid* g_bench_jid;
|
|
|
|
static void
|
|
_bench_jid_atexit(void)
|
|
{
|
|
if (!g_bench_jid)
|
|
return;
|
|
g_free(g_bench_jid->barejid);
|
|
g_free(g_bench_jid->fulljid);
|
|
g_free(g_bench_jid->resourcepart);
|
|
g_free(g_bench_jid);
|
|
g_bench_jid = NULL;
|
|
}
|
|
|
|
const Jid*
|
|
connection_get_jid(void)
|
|
{
|
|
if (g_bench_jid)
|
|
return g_bench_jid;
|
|
const char* env = getenv("BENCH_ACCOUNT_JID");
|
|
if (!env || !env[0])
|
|
env = "bench@bench.example";
|
|
g_bench_jid = g_malloc0(sizeof(Jid));
|
|
g_bench_jid->barejid = g_strdup(env);
|
|
g_bench_jid->fulljid = g_strdup(env);
|
|
g_bench_jid->resourcepart = NULL;
|
|
atexit(_bench_jid_atexit);
|
|
return g_bench_jid;
|
|
}
|
|
|
|
ProfMessage*
|
|
message_init(void)
|
|
{
|
|
return g_malloc0(sizeof(ProfMessage));
|
|
}
|
|
|
|
Jid*
|
|
jid_create_from_bare_and_resource(const char* const barejid, const char* const resource)
|
|
{
|
|
if (!barejid)
|
|
return NULL;
|
|
Jid* j = g_malloc0(sizeof(Jid));
|
|
j->barejid = g_strdup(barejid);
|
|
j->resourcepart = resource ? g_strdup(resource) : NULL;
|
|
j->fulljid = resource ? g_strdup_printf("%s/%s", barejid, resource) : g_strdup(barejid);
|
|
return j;
|
|
}
|
|
|
|
void
|
|
cons_show(const char* const msg, ...)
|
|
{
|
|
(void)msg;
|
|
}
|
|
|
|
void
|
|
cons_show_error(const char* const cmd, ...)
|
|
{
|
|
(void)cmd;
|
|
}
|
|
|
|
// session/account stubs — used by database.c when wiring up backend switch.
|
|
// Bench never goes through the dispatcher's switch path; just satisfy linker.
|
|
const char*
|
|
session_get_account_name(void)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
ProfAccount*
|
|
accounts_get_account(const char* const name)
|
|
{
|
|
(void)name;
|
|
return NULL;
|
|
}
|
|
|
|
void
|
|
account_free(ProfAccount* account)
|
|
{
|
|
if (!account)
|
|
return;
|
|
g_free(account->jid);
|
|
g_free(account);
|
|
}
|