| 1 | import Foundation |
| 2 | import CryptoKit |
| 3 | import Darwin |
| 4 | |
| 5 | /// A private, bounded sidecar for each source. The anchored directory, advisory |
| 6 | /// lock and content revision preserve a newer or damaged file on every failure. |
| 7 | final class PetHabitatStore { |
| 8 | static let limit = 8 * 1024 * 1024 |
| 9 | private let url: URL |
| 10 | private let directory: Int32 |
| 11 | private let lock: Int32 |
| 12 | private let name: String |
| 13 | private let lockName: String |
| 14 | private var expected: Data? |
| 15 | private var loaded = false |
| 16 | |
| 17 | init(directory url: URL, source: String) throws { |
| 18 | guard ["wild", "demo", "live"].contains(source) else { throw Self.invalid("Invalid pet source.") } |
| 19 | try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true, attributes: [.posixPermissions: 0o700]) |
| 20 | let root = open(url.path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC) |
| 21 | guard root >= 0 else { throw Self.ioError() } |
| 22 | let key = source + ".lock" |
| 23 | let file = openat(root, key, O_RDWR | O_CREAT | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC, 0o600) |
| 24 | guard file >= 0 else { let error = Self.ioError(); close(root); throw error } |
| 25 | do { _ = try Self.regular(file) } |
| 26 | catch { close(file); close(root); throw error } |
| 27 | self.url = url; self.directory = root; self.lock = file; self.name = source + ".json"; self.lockName = key |
| 28 | } |
| 29 | deinit { close(lock); close(directory) } |
| 30 | |
| 31 | func load() throws -> Data? { |
| 32 | let value = try coordinated { try read() } |
| 33 | expected = value.map { Data(SHA256.hash(data: $0)) }; loaded = true |
| 34 | return value |
| 35 | } |
| 36 | |
| 37 | func save(_ value: Data, archive: Data? = nil, tick: Int = 0) throws { |
| 38 | guard loaded, value.count <= Self.limit else { throw Self.invalid("The pet habitat cannot be saved within its size limit.") } |
| 39 | try coordinated { |
| 40 | let current = try read().map { Data(SHA256.hash(data: $0)) } |
| 41 | guard current == expected else { throw Self.invalid("Another writer changed the saved habitat.") } |
| 42 | if let archive { |
| 43 | guard archive.count <= 64 * 1024 * 1024, tick >= 0 else { throw Self.invalid("Invalid recording archive.") } |
| 44 | let digest = SHA256.hash(data: archive).map { String(format: "%02x", $0) }.joined() |
| 45 | let key = name.dropLast(5) + "-segment-" + String(format: "%012lld", Int64(tick)) + "-" + digest + ".json" |
| 46 | try write(archive, name: key, immutable: true) |
| 47 | } |
| 48 | try write(value, name: name, immutable: false) |
| 49 | } |
| 50 | expected = Data(SHA256.hash(data: value)) |
| 51 | } |
| 52 | |
| 53 | func archives() throws -> [String] { |
| 54 | try FileManager.default.contentsOfDirectory(atPath: url.path).filter(validArchive).sorted(by: >) |
| 55 | } |
| 56 | func archivedRecording(_ key: String) throws -> Data { |
| 57 | guard validArchive(key) else { throw Self.invalid("Invalid recording archive.") } |
| 58 | guard let value = try read(name: key, limit: 64 * 1024 * 1024) else { throw Self.invalid("This recording is unavailable.") } |
| 59 | let digest = SHA256.hash(data: value).map { String(format: "%02x", $0) }.joined() |
| 60 | guard key.hasSuffix("-" + digest + ".json") else { throw Self.invalid("The archived recording was changed. Its file was kept.") } |
| 61 | return value |
| 62 | } |
| 63 | private func validArchive(_ key: String) -> Bool { |
| 64 | key.range(of: "^" + name.dropLast(5) + "-segment-[0-9]{12}-[a-f0-9]{64}\\.json$", options: .regularExpression) != nil |
| 65 | } |
| 66 | private func write(_ value: Data, name: String, immutable: Bool) throws { |
| 67 | let temporary = ".pet-" + UUID().uuidString |
| 68 | let file = openat(directory, temporary, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW | O_CLOEXEC, 0o600) |
| 69 | guard file >= 0 else { throw Self.ioError() } |
| 70 | defer { close(file); unlinkat(directory, temporary, 0) } |
| 71 | try value.withUnsafeBytes { bytes in |
| 72 | var offset = 0 |
| 73 | while offset < bytes.count { |
| 74 | let written = Darwin.write(file, bytes.baseAddress!.advanced(by: offset), bytes.count - offset) |
| 75 | if written < 0 && errno == EINTR { continue } |
| 76 | guard written > 0 else { throw Self.ioError() } |
| 77 | offset += written |
| 78 | } |
| 79 | } |
| 80 | guard fsync(file) == 0 else { throw Self.ioError() } |
| 81 | if immutable { |
| 82 | if linkat(directory, temporary, directory, name, 0) != 0 { |
| 83 | guard errno == EEXIST, try read(name: name, limit: 64 * 1024 * 1024) == value else { throw Self.ioError() } |
| 84 | } |
| 85 | } else if renameat(directory, temporary, directory, name) != 0 { throw Self.ioError() } |
| 86 | } |
| 87 | |
| 88 | private func coordinated<T>(_ action: () throws -> T) throws -> T { |
| 89 | guard flock(lock, LOCK_EX | LOCK_NB) == 0 else { throw Self.ioError() } |
| 90 | defer { flock(lock, LOCK_UN) } |
| 91 | let current = openat(directory, lockName, O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC) |
| 92 | guard current >= 0 else { throw Self.ioError() } |
| 93 | defer { close(current) } |
| 94 | let original = try Self.regular(lock), now = try Self.regular(current) |
| 95 | guard original.st_dev == now.st_dev && original.st_ino == now.st_ino else { throw Self.invalid("The habitat writer lock was replaced.") } |
| 96 | return try action() |
| 97 | } |
| 98 | |
| 99 | private func read(name key: String? = nil, limit: Int = PetHabitatStore.limit) throws -> Data? { |
| 100 | let file = openat(directory, key ?? name, O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC) |
| 101 | if file < 0 && errno == ENOENT { return nil } |
| 102 | guard file >= 0 else { throw Self.ioError() } |
| 103 | defer { close(file) } |
| 104 | let info = try Self.regular(file) |
| 105 | guard info.st_size >= 0 && info.st_size <= limit else { throw Self.invalid("The saved habitat exceeds 8 MiB.") } |
| 106 | var value = Data(), buffer = [UInt8](repeating: 0, count: 16_384) |
| 107 | while true { |
| 108 | let count = Darwin.read(file, &buffer, min(buffer.count, limit + 1 - value.count)) |
| 109 | if count < 0 && errno == EINTR { continue } |
| 110 | guard count >= 0 else { throw Self.ioError() } |
| 111 | if count == 0 { break } |
| 112 | value.append(contentsOf: buffer.prefix(count)) |
| 113 | guard value.count <= limit else { throw Self.invalid("The saved habitat exceeds its size limit.") } |
| 114 | } |
| 115 | return value |
| 116 | } |
| 117 | |
| 118 | private static func regular(_ file: Int32) throws -> stat { |
| 119 | var info = stat() |
| 120 | guard fstat(file, &info) == 0 else { throw ioError() } |
| 121 | guard info.st_mode & S_IFMT == S_IFREG, info.st_nlink == 1 else { throw invalid("A habitat file must be a regular file without links.") } |
| 122 | return info |
| 123 | } |
| 124 | private static func ioError() -> Error { NSError(domain: NSPOSIXErrorDomain, code: Int(errno)) } |
| 125 | private static func invalid(_ message: String) -> Error { NSError(domain: "CodewhalePet", code: 1, userInfo: [NSLocalizedDescriptionKey: message]) } |
| 126 | } |
| 127 |