profanity/baseline.csv at 1aaa382d5e2bb00bd7cf6e4712ba4c6f7b07052d

mirror of https://git.jabber.space/devs/cproof.git synced 2026-07-18 10:46:21 +00:00

Files

feat(history): flat-file backend with bidirectional SQLite migration

A flat-file alternative to the SQLite chatlog backend with runtime
switching, full migration tooling, integrity verification, and a
synthetic load harness. SQLite remains the default; both backends share
one dispatch layer (db_backend_t vtable) so callers don't change.

Storage layout
- Per-contact append-only `flatlog/<account>/<contact>/history.log`
  under XDG_DATA_HOME, one line per message
- Single-line file header with embedded format-version marker
  (FLATFILE_FORMAT_VERSION); reader warns on missing or mismatched
  marker, writer and checker stay in sync via preprocessor
  stringification
- Deterministic key=value metadata (`id`, `aid`, `corrects`, `to`,
  `to_res`, `read`) plus escaped body \u2014 `\|`, `\]`, `\\`, `\n`, `\r`
  literals prevent log injection
- Sparse byte-offset index (FF_INDEX_STEP=500) per contact for
  O(log n) time-range lookups; rebuilt on inode / size / mtime
  change, extended in-place when the file just grew
- Per-contact GHashTable caches for archive_id presence and
  stanza_id \u2192 from_jid mapping (O(1) MAM dedup, O(1) LMC sender
  validation)

Hardening
- Path-traversal protection: JID directory name normalisation
  (`@` \u2192 `_at_`, slashes and `..` rejected at construction); every
  per-contact path is anchored under the account's flatlog/
  directory and validated before open
- Symlink-attack protection: every fopen / open uses O_NOFOLLOW; on
  ELOOP the operation aborts with an error rather than following
- Filesystem permissions: log files created with mode 0600,
  directories with mode 0700; both enforced at creation, verified
  on each open and reported on drift by `/history verify`
- Atomic crash-safe export: write to a temp file via mkstemp (mode
  0600, random suffix, no name collisions between concurrent
  exports), fsync, then rename \u2014 partial state never replaces the
  live file
- Concurrency: advisory flock(LOCK_EX) held for the duration of
  every write, including append from live messages and full rewrite
  from export, so two profanity processes can't interleave bytes
  on the same log
- DoS / abuse guards:
    * FF_MAX_LINE_LEN = 10 MB \u2014 lines longer than this are rejected
      at read with a warning; the parser will not allocate
      unbounded memory for a single record
    * FF_MAX_LMC_DEPTH = 100 \u2014 `corrects:` chain walk stops at this
      depth and emits a warning, preventing a malicious correction
      cycle from spinning the apply pass
    * FF_VERSION_SCAN_MAX = 16 \u2014 header version probe never reads
      past 16 leading comment lines, even on garbage input
    * Empty / inverted byte-range early-return in page-up read path
      so a malformed time filter cannot cause an unbounded scan
    * Zero-entry index guard so a file whose every line failed to
      parse cannot cause a NULL deref on later page-up
- LMC sender validation: an incoming correction whose sender does
  not match the original message's sender is rejected at write
  time and surfaced via cons_show_error; a cycle in the apply pass
  is broken via a visited-set
- jid_create_from_bare_and_resource treats NULL, empty string, and
  the literal "(null)" as no resource and returns a bare jid;
  similar normalisation for barejid eliminates the legacy
  "user@host/(null)" artefact that leaked into stored fulljids
  whenever g_strdup_printf("%s", NULL) ran inside create_fulljid

Commands
- `/history switch sqlite|flatfile` \u2014 runtime backend swap, closes
  the old backend and opens the new one without reconnecting
- `/history export [<jid>]` \u2014 SQLite -> flat-file, merging with any
  existing flatlog (dedup keyed on a SHA-256 hash mixing stanza_id,
  timestamp, from_jid, body \u2014 robust against id reuse by older
  clients)
- `/history import [<jid>]` \u2014 flat-file -> SQLite, same merge
  semantics, runs inside a single SQLite transaction with rollback
  on per-contact failure
- `/history verify [<jid>]` \u2014 integrity check; emits a structured
  list of issues (ERROR / WARNING / INFO) per file:
    * file-level: missing log, wrong permissions (\u2260 0600), UTF-8
      BOM present, CRLF line endings, empty file
    * line-level: invalid UTF-8 (with byte offset), embedded
      control characters, unparsable lines, timestamps out of
      order, duplicate `id:` and `aid:` (tracked separately so a
      stanza/archive id collision isn't double-reported)
    * cross-line: broken `corrects:` references whose target id is
      not present in the file
- `/history backend` \u2014 show currently active backend
- Active backend indicator `[sqlite]` / `[flatfile]` in the status
  bar next to the JID
- Roster-JID autocomplete for verify / export / import
- export and import open a SQLite handle on demand when the
  flatfile backend is currently active, so migration works
  regardless of which backend is live

Tests
- Unit: database_export (parser round-trip, escape/unescape, dedup
  key stability, JID normalisation), database_stress (14 cases
  exercising rapid writes, large messages, deep LMC chains, MAM
  dedup, concurrent contacts)
- Functional: history persistence across reconnects, export /
  import round-trip with content equality, MUC migration,
  timestamp normalisation across timezones
- Bench harness P1\u2013P5 (synthetic load: bulk insert, time-range
  read, page-up scroll, MAM ingest, mixed workload) and failure
  modes F1\u2013F17 (page-up cursor and forward-iteration symmetry,
  oversized lines, MAM dedup, LMC depth and cycles, BOM/CRLF,
  missing log, empty file, mtime+inode flip, broken corrects, etc.)
- All bench tests integrate with the existing make targets and
  emit CSV rows for baseline comparison

Author: jabber.developer2 <jabber.developer2@jabber.space>
Reviewed-by: jabber.developer <jabber.developer@jabber.space>

2026-05-05 19:26:07 +00:00

5.1 KiB

Raw Blame History

1	scenario	volume	bytes	lines	wall_ms	peak_rss_kb	note
2	S1_cold_tail	small	39494716	10002	46.040	14408	tail page=100
3	S2_warm_tail	small	39494716	10002	33.878	14716	tail page=100
4	S3_deep_pagination	small	39494716	10002	1.024	14716	n_pages=1000
5	S4_first_build	small	39494716	10002	39.139	14716	idx_entries=20
6	S5_incremental_extend	small	104411	1000	0.859	14716	appended=1000_lines
7	S6_verify	small	39494716	10002	396.022	16424	total=1 err=0 warn=1 info=0
8	L1	longmsg	110586	100	1.486	9432	n=100 body=1024 write=0.8ms read=0.6ms parsed=100 mismatch=0 parse_fail=0 1KB body x100
9	L2	longmsg	1032186	100	10.468	9432	n=100 body=10240 write=5.7ms read=4.8ms parsed=100 mismatch=0 parse_fail=0 10KB body x100
10	L3	longmsg	10248186	100	100.337	9816	n=100 body=102400 write=57.3ms read=43.1ms parsed=100 mismatch=0 parse_fail=0 100KB body x100
11	L4	longmsg	52432936	50	502.785	13608	n=50 body=1048576 write=264.5ms read=238.3ms parsed=50 mismatch=0 parse_fail=0 1MB body x50
12	L5	longmsg	52429696	10	518.558	27764	n=10 body=5242880 write=264.4ms read=254.2ms parsed=10 mismatch=0 parse_fail=0 5MB body x10
13	L6	longmsg	41435552	4	407.803	45852	n=4 body=10358784 write=211.3ms read=196.5ms parsed=4 mismatch=0 parse_fail=0 9.9MB body x4 (just under FF_MAX_LINE_LEN)
14	L7	longmsg	10485981	2	3.750	45852	oversize=10485761_rejected=yes read=3.8ms parsed=1
15	L8	longmsg	5175286	50	45.549	45852	n=50 body=102400 write=26.6ms read=18.9ms parsed=50 mismatch=0 parse_fail=0 100KB body w/ \n every 100B
16	L9	longmsg	5124136	50	45.487	45852	n=50 body=102400 write=24.5ms read=21.0ms parsed=50 mismatch=0 parse_fail=0 100KB body w/ pipes
17	L10	longmsg	5124136	50	43.254	45852	n=50 body=102400 write=18.9ms read=24.4ms parsed=50 mismatch=0 parse_fail=0 100KB body utf-8 emoji
18	L11	longmsg	110586	100	1.284	45852	n=100 body=1024 write=0.7ms read=0.6ms parsed=100 mismatch=0 parse_fail=0 sanity baseline
19	L12	longmsg	5415366	1000	26.437	45852	5x1MB_in_last_100 parsed=1000
20	L13	longmsg	104865786	100	932.630	45852	n=100 body=1048576 write=485.7ms read=446.9ms parsed=100 mismatch=0 parse_fail=0 verify-equiv full parse on 100x1MB
21	L14	longmsg	102481986	1000	962.342	45852	n=1000 body=102400 write=510.4ms read=452.0ms parsed=1000 mismatch=0 parse_fail=0 rapid append 1000x100KB
22	F1	fail-pass	904	0	0.118	9540	issues total=1 err=0 warn=1 (partial-line tail; expect graceful handle)
23	F2	fail-pass	1119	0	0.113	9540	warnings=2 (expect CRLF warning) first_warn=File permissions are 644 expected 600 (sensitive data)
24	F3	fail-pass	341	0	0.072	9540	errors=1 warnings=1 (expect 1 unparsable line for mid-file BOM) first=Unparsable line
25	F7	fail-pass	527	0	0.082	9540	issues total=1 err=0 (cycle handled at read-time not verify)
26	F8	fail-pass	19044	0	0.981	9540	201 lines (1 orig + 200 corrections) errors=0 warns=1
27	F9	fail-pass	341	0	0.069	9540	errors=0 (parser splits at first ': ' — not flagged but body truncated)
28	F10	fail-pass	176	0	0.060	9540	errors=0 warnings=1 (RTL/ZWSP preserved literally)
29	F11	fail-pass	323	0	0.264	9540	errors=1 (Latin-1 byte: error or fallback OK)
30	F12	fail-pass	330	0	0.071	9540	errors=0 (empty body OK)
31	F14	fail-pass	23236	0	0.914	9540	v1_lines=100 v2_lines=250 (expect rebuild detected and 250 lines)
32	F15	fail-pass	0	0	0.121	9540	errors=0 infos=1 warnings=1 (empty file should yield INFO)
33	S1_cold_tail	lmc	389183687	100002	480.428	43456	tail page=100
34	S2_warm_tail	lmc	389183687	100002	477.482	43456	tail page=100
35	S3_deep_pagination	lmc	389183687	100002	1.066	43456	n_pages=1000
36	S4_first_build	lmc	389183687	100002	473.604	43456	idx_entries=200
37	S5_incremental_extend	lmc	104411	1000	0.902	43456	appended=1000_lines
38	S6_verify	lmc	389183687	100002	3892.137	43456	total=1 err=0 warn=1 info=0
39	S6_verify	ooo	397586720	100002	4037.058	33336	total=17573 err=0 warn=17573 info=0
40	S7a_export_cold	pipe100000	40714240	100000	1231.613	148128	exported=100000 db_rows=100000
41	S7b_export_dedup	pipe100000	40714240	100000	1484.406	199460	exported=0 db_rows=100000
42	S7_seed_export	pipe100000	40714240	100000	1238.138	148208	exported=100000 db_rows=100000
43	S8a_import_cold	pipe100000	40628224	100000	3237.481	123108	imported=100000 rows_before=0 rows_after=100000
44	S8b_import_idempotent	pipe100000	40628224	0	1047.286	194860	imported=0 rows_before=100000 rows_after=100000
45	S8e_roundtrip	pipe100000	40521728	100000	6520.475	148184	rows=100000 seed=1591ms export=1237ms import=3376ms diff=317ms exported=100000 imported=100000 rows_a=100000 rows_b=100000 mismatches=0 body=0 lmc=0
46	S7a_export_cold	pipe1000000	407732224	1000000	11247.107	1376772	exported=1000000 db_rows=1000000
47	S7b_export_dedup	pipe1000000	407732224	1000000	13262.643	1873220	exported=0 db_rows=1000000
48	S7_seed_export	pipe1000000	407732224	1000000	12125.624	1377076	exported=1000000 db_rows=1000000
49	S8a_import_cold	pipe1000000	406605824	1000000	36877.801	1124804	imported=1000000 rows_before=0 rows_after=1000000
50	S8b_import_idempotent	pipe1000000	406605824	0	11986.786	1841488	imported=0 rows_before=1000000 rows_after=1000000
51	S8e_roundtrip	pipe1000000	405757952	1000000	66449.762	1377084	rows=1000000 seed=20012ms export=11939ms import=31533ms diff=2966ms exported=1000000 imported=1000000 rows_a=1000000 rows_b=1000000 mismatches=0 body=0 lmc=0

5.1 KiB Raw Blame History

5.1 KiB

Raw Blame History