mirror of
https://git.jabber.space/devs/cproof.git
synced 2026-07-18 22:36:22 +00:00
Jabber Developer
3f36c303c2
A flat-file alternative to the SQLite chatlog backend with runtime
switching, full migration tooling, integrity verification, and a
synthetic load harness. SQLite remains the default; both backends share
one dispatch layer (db_backend_t vtable) so callers don't change.
Storage layout
- Per-contact append-only `flatlog/<account>/<contact>/history.log`
under XDG_DATA_HOME, one line per message
- Single-line file header with embedded format-version marker
(FLATFILE_FORMAT_VERSION); reader warns on missing or mismatched
marker, writer and checker stay in sync via preprocessor
stringification
- Deterministic key=value metadata (`id`, `aid`, `corrects`, `to`,
`to_res`, `read`) plus escaped body \u2014 `\|`, `\]`, `\\`, `\n`, `\r`
literals prevent log injection
- Sparse byte-offset index (FF_INDEX_STEP=500) per contact for
O(log n) time-range lookups; rebuilt on inode / size / mtime
change, extended in-place when the file just grew
- Per-contact GHashTable caches for archive_id presence and
stanza_id \u2192 from_jid mapping (O(1) MAM dedup, O(1) LMC sender
validation)
Hardening
- Path-traversal protection: JID directory name normalisation
(`@` \u2192 `_at_`, slashes and `..` rejected at construction); every
per-contact path is anchored under the account's flatlog/
directory and validated before open
- Symlink-attack protection: every fopen / open uses O_NOFOLLOW; on
ELOOP the operation aborts with an error rather than following
- Filesystem permissions: log files created with mode 0600,
directories with mode 0700; both enforced at creation, verified
on each open and reported on drift by `/history verify`
- Atomic crash-safe export: write to a temp file via mkstemp (mode
0600, random suffix, no name collisions between concurrent
exports), fsync, then rename \u2014 partial state never replaces the
live file
- Concurrency: advisory flock(LOCK_EX) held for the duration of
every write, including append from live messages and full rewrite
from export, so two profanity processes can't interleave bytes
on the same log
- DoS / abuse guards:
* FF_MAX_LINE_LEN = 10 MB \u2014 lines longer than this are rejected
at read with a warning; the parser will not allocate
unbounded memory for a single record
* FF_MAX_LMC_DEPTH = 100 \u2014 `corrects:` chain walk stops at this
depth and emits a warning, preventing a malicious correction
cycle from spinning the apply pass
* FF_VERSION_SCAN_MAX = 16 \u2014 header version probe never reads
past 16 leading comment lines, even on garbage input
* Empty / inverted byte-range early-return in page-up read path
so a malformed time filter cannot cause an unbounded scan
* Zero-entry index guard so a file whose every line failed to
parse cannot cause a NULL deref on later page-up
- LMC sender validation: an incoming correction whose sender does
not match the original message's sender is rejected at write
time and surfaced via cons_show_error; a cycle in the apply pass
is broken via a visited-set
- jid_create_from_bare_and_resource treats NULL, empty string, and
the literal "(null)" as no resource and returns a bare jid;
similar normalisation for barejid eliminates the legacy
"user@host/(null)" artefact that leaked into stored fulljids
whenever g_strdup_printf("%s", NULL) ran inside create_fulljid
Commands
- `/history switch sqlite|flatfile` \u2014 runtime backend swap, closes
the old backend and opens the new one without reconnecting
- `/history export [<jid>]` \u2014 SQLite -> flat-file, merging with any
existing flatlog (dedup keyed on a SHA-256 hash mixing stanza_id,
timestamp, from_jid, body \u2014 robust against id reuse by older
clients)
- `/history import [<jid>]` \u2014 flat-file -> SQLite, same merge
semantics, runs inside a single SQLite transaction with rollback
on per-contact failure
- `/history verify [<jid>]` \u2014 integrity check; emits a structured
list of issues (ERROR / WARNING / INFO) per file:
* file-level: missing log, wrong permissions (\u2260 0600), UTF-8
BOM present, CRLF line endings, empty file
* line-level: invalid UTF-8 (with byte offset), embedded
control characters, unparsable lines, timestamps out of
order, duplicate `id:` and `aid:` (tracked separately so a
stanza/archive id collision isn't double-reported)
* cross-line: broken `corrects:` references whose target id is
not present in the file
- `/history backend` \u2014 show currently active backend
- Active backend indicator `[sqlite]` / `[flatfile]` in the status
bar next to the JID
- Roster-JID autocomplete for verify / export / import
- export and import open a SQLite handle on demand when the
flatfile backend is currently active, so migration works
regardless of which backend is live
Tests
- Unit: database_export (parser round-trip, escape/unescape, dedup
key stability, JID normalisation), database_stress (14 cases
exercising rapid writes, large messages, deep LMC chains, MAM
dedup, concurrent contacts)
- Functional: history persistence across reconnects, export /
import round-trip with content equality, MUC migration,
timestamp normalisation across timezones
- Bench harness P1\u2013P5 (synthetic load: bulk insert, time-range
read, page-up scroll, MAM ingest, mixed workload) and failure
modes F1\u2013F17 (page-up cursor and forward-iteration symmetry,
oversized lines, MAM dedup, LMC depth and cycles, BOM/CRLF,
missing log, empty file, mtime+inode flip, broken corrects, etc.)
- All bench tests integrate with the existing make targets and
emit CSV rows for baseline comparison
Author: jabber.developer2 <jabber.developer2@jabber.space>
Reviewed-by: jabber.developer <jabber.developer@jabber.space>
52 lines
5.1 KiB
CSV
52 lines
5.1 KiB
CSV
scenario,volume,bytes,lines,wall_ms,peak_rss_kb,note
|
|
S1_cold_tail,small,39494716,10002,46.040,14408,tail page=100
|
|
S2_warm_tail,small,39494716,10002,33.878,14716,tail page=100
|
|
S3_deep_pagination,small,39494716,10002,1.024,14716,n_pages=1000
|
|
S4_first_build,small,39494716,10002,39.139,14716,idx_entries=20
|
|
S5_incremental_extend,small,104411,1000,0.859,14716,appended=1000_lines
|
|
S6_verify,small,39494716,10002,396.022,16424,total=1 err=0 warn=1 info=0
|
|
L1,longmsg,110586,100,1.486,9432,n=100 body=1024 write=0.8ms read=0.6ms parsed=100 mismatch=0 parse_fail=0 1KB body x100
|
|
L2,longmsg,1032186,100,10.468,9432,n=100 body=10240 write=5.7ms read=4.8ms parsed=100 mismatch=0 parse_fail=0 10KB body x100
|
|
L3,longmsg,10248186,100,100.337,9816,n=100 body=102400 write=57.3ms read=43.1ms parsed=100 mismatch=0 parse_fail=0 100KB body x100
|
|
L4,longmsg,52432936,50,502.785,13608,n=50 body=1048576 write=264.5ms read=238.3ms parsed=50 mismatch=0 parse_fail=0 1MB body x50
|
|
L5,longmsg,52429696,10,518.558,27764,n=10 body=5242880 write=264.4ms read=254.2ms parsed=10 mismatch=0 parse_fail=0 5MB body x10
|
|
L6,longmsg,41435552,4,407.803,45852,n=4 body=10358784 write=211.3ms read=196.5ms parsed=4 mismatch=0 parse_fail=0 9.9MB body x4 (just under FF_MAX_LINE_LEN)
|
|
L7,longmsg,10485981,2,3.750,45852,oversize=10485761_rejected=yes read=3.8ms parsed=1
|
|
L8,longmsg,5175286,50,45.549,45852,n=50 body=102400 write=26.6ms read=18.9ms parsed=50 mismatch=0 parse_fail=0 100KB body w/ \n every 100B
|
|
L9,longmsg,5124136,50,45.487,45852,n=50 body=102400 write=24.5ms read=21.0ms parsed=50 mismatch=0 parse_fail=0 100KB body w/ pipes
|
|
L10,longmsg,5124136,50,43.254,45852,n=50 body=102400 write=18.9ms read=24.4ms parsed=50 mismatch=0 parse_fail=0 100KB body utf-8 emoji
|
|
L11,longmsg,110586,100,1.284,45852,n=100 body=1024 write=0.7ms read=0.6ms parsed=100 mismatch=0 parse_fail=0 sanity baseline
|
|
L12,longmsg,5415366,1000,26.437,45852,5x1MB_in_last_100 parsed=1000
|
|
L13,longmsg,104865786,100,932.630,45852,n=100 body=1048576 write=485.7ms read=446.9ms parsed=100 mismatch=0 parse_fail=0 verify-equiv full parse on 100x1MB
|
|
L14,longmsg,102481986,1000,962.342,45852,n=1000 body=102400 write=510.4ms read=452.0ms parsed=1000 mismatch=0 parse_fail=0 rapid append 1000x100KB
|
|
F1,fail-pass,904,0,0.118,9540,issues total=1 err=0 warn=1 (partial-line tail; expect graceful handle)
|
|
F2,fail-pass,1119,0,0.113,9540,warnings=2 (expect CRLF warning) first_warn=File permissions are 644 expected 600 (sensitive data)
|
|
F3,fail-pass,341,0,0.072,9540,errors=1 warnings=1 (expect 1 unparsable line for mid-file BOM) first=Unparsable line
|
|
F7,fail-pass,527,0,0.082,9540,issues total=1 err=0 (cycle handled at read-time not verify)
|
|
F8,fail-pass,19044,0,0.981,9540,201 lines (1 orig + 200 corrections) errors=0 warns=1
|
|
F9,fail-pass,341,0,0.069,9540,errors=0 (parser splits at first ': ' — not flagged but body truncated)
|
|
F10,fail-pass,176,0,0.060,9540,errors=0 warnings=1 (RTL/ZWSP preserved literally)
|
|
F11,fail-pass,323,0,0.264,9540,errors=1 (Latin-1 byte: error or fallback OK)
|
|
F12,fail-pass,330,0,0.071,9540,errors=0 (empty body OK)
|
|
F14,fail-pass,23236,0,0.914,9540,v1_lines=100 v2_lines=250 (expect rebuild detected and 250 lines)
|
|
F15,fail-pass,0,0,0.121,9540,errors=0 infos=1 warnings=1 (empty file should yield INFO)
|
|
S1_cold_tail,lmc,389183687,100002,480.428,43456,tail page=100
|
|
S2_warm_tail,lmc,389183687,100002,477.482,43456,tail page=100
|
|
S3_deep_pagination,lmc,389183687,100002,1.066,43456,n_pages=1000
|
|
S4_first_build,lmc,389183687,100002,473.604,43456,idx_entries=200
|
|
S5_incremental_extend,lmc,104411,1000,0.902,43456,appended=1000_lines
|
|
S6_verify,lmc,389183687,100002,3892.137,43456,total=1 err=0 warn=1 info=0
|
|
S6_verify,ooo,397586720,100002,4037.058,33336,total=17573 err=0 warn=17573 info=0
|
|
S7a_export_cold,pipe100000,40714240,100000,1231.613,148128,exported=100000 db_rows=100000
|
|
S7b_export_dedup,pipe100000,40714240,100000,1484.406,199460,exported=0 db_rows=100000
|
|
S7_seed_export,pipe100000,40714240,100000,1238.138,148208,exported=100000 db_rows=100000
|
|
S8a_import_cold,pipe100000,40628224,100000,3237.481,123108,imported=100000 rows_before=0 rows_after=100000
|
|
S8b_import_idempotent,pipe100000,40628224,0,1047.286,194860,imported=0 rows_before=100000 rows_after=100000
|
|
S8e_roundtrip,pipe100000,40521728,100000,6520.475,148184,rows=100000 seed=1591ms export=1237ms import=3376ms diff=317ms exported=100000 imported=100000 rows_a=100000 rows_b=100000 mismatches=0 body=0 lmc=0
|
|
S7a_export_cold,pipe1000000,407732224,1000000,11247.107,1376772,exported=1000000 db_rows=1000000
|
|
S7b_export_dedup,pipe1000000,407732224,1000000,13262.643,1873220,exported=0 db_rows=1000000
|
|
S7_seed_export,pipe1000000,407732224,1000000,12125.624,1377076,exported=1000000 db_rows=1000000
|
|
S8a_import_cold,pipe1000000,406605824,1000000,36877.801,1124804,imported=1000000 rows_before=0 rows_after=1000000
|
|
S8b_import_idempotent,pipe1000000,406605824,0,11986.786,1841488,imported=0 rows_before=1000000 rows_after=1000000
|
|
S8e_roundtrip,pipe1000000,405757952,1000000,66449.762,1377084,rows=1000000 seed=20012ms export=11939ms import=31533ms diff=2966ms exported=1000000 imported=1000000 rows_a=1000000 rows_b=1000000 mismatches=0 body=0 lmc=0
|