990 lines
37 KiB
Rust
990 lines
37 KiB
Rust
//! The versioned, checksummed binary inventory format and snapshot
|
||
//! comparison.
|
||
//!
|
||
//! Layout (all integers little-endian / varint):
|
||
//!
|
||
//! ```text
|
||
//! magic 8 bytes brand::SNAPSHOT_MAGIC
|
||
//! version uint16 currently 1
|
||
//! flags uint16 bit 0: body is gzip-compressed (always set by save)
|
||
//! body gzip stream of:
|
||
//! meta uvarint length + JSON (root, timestamps, counters, options)
|
||
//! exts uvarint count, then count × (uvarint length + bytes)
|
||
//! nodes uvarint count, then per node:
|
||
//! uvarint parentDelta (id-parent; 0 only for the root)
|
||
//! byte kind, byte category, uvarint flags
|
||
//! uvarint nameLen + name
|
||
//! varint size, varint alloc, varint mtime
|
||
//! uvarint mode, uid, gid, nlink, ext
|
||
//! errors uvarint count, then per record: uvarint node, byte kind,
|
||
//! uvarint len + name, uvarint len + message
|
||
//! sha256 32 bytes over the uncompressed body
|
||
//! ```
|
||
//!
|
||
//! Varints are Go's encoding/binary (zig-zag for signed). Nodes are written
|
||
//! in ID order; a parent always precedes its children, so a reader can
|
||
//! rebuild the tree in one pass and malformed input cannot create cycles.
|
||
//! Aggregates are recomputed on load, never trusted.
|
||
|
||
mod compare;
|
||
|
||
pub use compare::*;
|
||
|
||
use crate::brand;
|
||
use crate::inventory::{Category, ErrKind, ErrorRecord, Kind, NodeId, Tree, MAX_ERROR_RECORDS, NUM_CATEGORIES};
|
||
use crossbeam_channel::Receiver;
|
||
use flate2::{bufread::GzDecoder, write::GzEncoder, Compression};
|
||
use serde::{Deserialize, Serialize};
|
||
use sha2::{Digest, Sha256};
|
||
use std::fs::{self, File, OpenOptions};
|
||
use std::io::{self, BufReader, BufWriter, Read, Write};
|
||
use std::os::unix::fs::OpenOptionsExt;
|
||
use std::path::{Path, PathBuf};
|
||
use std::time::{Duration, SystemTime, UNIX_EPOCH};
|
||
|
||
/// The current format version.
|
||
pub const VERSION: u16 = 1;
|
||
|
||
// Limits applied when reading untrusted snapshots.
|
||
pub const MAX_NODES: u64 = (1 << 31) - 1;
|
||
pub const MAX_DEPTH: u16 = 4096; // far beyond any real path; bounds recursion in exporters
|
||
pub const MAX_SIZE: i64 = 1 << 60; // per-node size cap (1 EiB); keeps aggregates from overflowing
|
||
/// Caps the decompressed body for load. load_file uses a limit proportional
|
||
/// to the file size instead (see body_limit).
|
||
pub const DEFAULT_MAX_BODY: i64 = 4 << 30;
|
||
pub const MAX_NAME_LEN: u64 = 1 << 16;
|
||
pub const MAX_META_LEN: u64 = 16 << 20;
|
||
pub const MAX_EXT_LEN: u64 = 64;
|
||
pub const MAX_MSG_LEN: u64 = 4096;
|
||
const MAX_EXTS: u64 = (1 << 16) - 1;
|
||
const FLAG_GZIPPED: u16 = 1;
|
||
|
||
#[derive(Serialize, Deserialize, Default)]
|
||
#[serde(default)]
|
||
struct Meta {
|
||
root: String,
|
||
created: GoTime,
|
||
start: GoTime,
|
||
end: GoTime,
|
||
complete: bool,
|
||
cancelled: bool,
|
||
files: i64,
|
||
dirs: i64,
|
||
symlinks: i64,
|
||
others: i64,
|
||
err_counts: Option<Vec<i64>>,
|
||
excluded: i64,
|
||
skipped_mounts: i64,
|
||
virtual_skipped: i64,
|
||
loops_skipped: i64,
|
||
broken_links: i64,
|
||
hardlink_dups: i64,
|
||
unscanned: i64,
|
||
excludes: Option<Vec<String>>,
|
||
one_file_system: bool,
|
||
follow: String,
|
||
workers: i64,
|
||
host: String,
|
||
generator: String,
|
||
}
|
||
|
||
/// Reports whether path starts with the snapshot magic.
|
||
pub fn is_snapshot(path: &Path) -> bool {
|
||
let mut b = [0u8; 8];
|
||
File::open(path).and_then(|mut f| f.read_exact(&mut b)).is_ok() && &b == brand::SNAPSHOT_MAGIC
|
||
}
|
||
|
||
/// Accumulates the body; flushes it through the hash and gzip in chunks.
|
||
struct Writer<W: Write> {
|
||
gz: GzEncoder<W>,
|
||
h: Sha256,
|
||
buf: Vec<u8>,
|
||
}
|
||
|
||
impl<W: Write> Writer<W> {
|
||
fn bytes(&mut self, b: &[u8]) -> io::Result<()> {
|
||
self.buf.extend_from_slice(b);
|
||
if self.buf.len() >= 256 << 10 {
|
||
self.flush()?;
|
||
}
|
||
Ok(())
|
||
}
|
||
fn flush(&mut self) -> io::Result<()> {
|
||
self.h.update(&self.buf);
|
||
self.gz.write_all(&self.buf)?;
|
||
self.buf.clear();
|
||
Ok(())
|
||
}
|
||
fn uvarint(&mut self, mut v: u64) -> io::Result<()> {
|
||
let (mut b, mut i) = ([0u8; 10], 0);
|
||
while v >= 0x80 {
|
||
b[i] = v as u8 | 0x80;
|
||
v >>= 7;
|
||
i += 1;
|
||
}
|
||
b[i] = v as u8;
|
||
self.bytes(&b[..=i])
|
||
}
|
||
fn varint(&mut self, v: i64) -> io::Result<()> {
|
||
self.uvarint(((v << 1) ^ (v >> 63)) as u64) // zig-zag, as encoding/binary.PutVarint
|
||
}
|
||
fn str(&mut self, s: &[u8]) -> io::Result<()> {
|
||
self.uvarint(s.len() as u64)?;
|
||
self.bytes(s)
|
||
}
|
||
}
|
||
|
||
/// Writes t to out. The caller holds t's read lock.
|
||
pub fn save(out: &mut dyn Write, t: &Tree) -> io::Result<()> {
|
||
let mut bw = BufWriter::with_capacity(1 << 20, out);
|
||
bw.write_all(brand::SNAPSHOT_MAGIC)?;
|
||
bw.write_all(&VERSION.to_le_bytes())?;
|
||
bw.write_all(&FLAG_GZIPPED.to_le_bytes())?;
|
||
let mut w = Writer { gz: GzEncoder::new(bw, Compression::fast()), h: Sha256::new(), buf: Vec::with_capacity(256 << 10) };
|
||
|
||
let st = &t.stats;
|
||
let m = Meta {
|
||
root: String::from_utf8_lossy(&st.root).into_owned(),
|
||
created: GoTime::from_system(SystemTime::now()),
|
||
start: GoTime::from_system(st.start).local(),
|
||
end: st.end.map(|e| GoTime::from_system(e).local()).unwrap_or_default(),
|
||
complete: st.complete,
|
||
cancelled: st.cancelled,
|
||
files: st.files,
|
||
dirs: st.dirs,
|
||
symlinks: st.symlinks,
|
||
others: st.others,
|
||
err_counts: Some(st.err_counts.to_vec()),
|
||
excluded: st.excluded,
|
||
skipped_mounts: st.skipped_mounts,
|
||
virtual_skipped: st.virtual_skipped,
|
||
loops_skipped: st.loops_skipped,
|
||
broken_links: st.broken_links,
|
||
hardlink_dups: st.hardlink_dups,
|
||
unscanned: st.unscanned,
|
||
excludes: Some(st.excludes.clone()),
|
||
one_file_system: st.one_file_system,
|
||
follow: st.follow.clone(),
|
||
workers: st.workers as i64,
|
||
host: hostname(),
|
||
generator: format!("{} {}", brand::NAME, brand::VERSION),
|
||
};
|
||
let mb = serde_json::to_vec(&m)?;
|
||
w.uvarint(mb.len() as u64)?;
|
||
w.bytes(&mb)?;
|
||
|
||
w.uvarint(t.ext_count() as u64)?;
|
||
for i in 0..t.ext_count() {
|
||
w.str(t.ext_by_index(i).as_bytes())?;
|
||
}
|
||
w.uvarint(t.len() as u64)?;
|
||
for id in 0..t.len() as NodeId {
|
||
let n = t.node(id);
|
||
w.uvarint(if id == 0 { 0 } else { (id - n.parent) as u64 })?;
|
||
w.bytes(&[n.kind as u8, n.cat as u8])?;
|
||
w.uvarint(n.flags as u64)?;
|
||
w.str(&n.name)?;
|
||
w.varint(n.size)?;
|
||
w.varint(n.alloc)?;
|
||
w.varint(n.mtime)?;
|
||
for v in [n.mode, n.uid, n.gid, n.nlink, n.ext as u32] {
|
||
w.uvarint(v as u64)?;
|
||
}
|
||
}
|
||
w.uvarint(st.errors.len() as u64)?;
|
||
for e in &st.errors {
|
||
w.uvarint(e.node as u64)?;
|
||
w.bytes(&[e.kind as u8])?;
|
||
w.str(&e.name)?;
|
||
w.str(e.msg.as_bytes())?;
|
||
}
|
||
w.flush()?;
|
||
let mut bw = w.gz.finish()?;
|
||
bw.write_all(&w.h.finalize())?;
|
||
bw.flush()
|
||
}
|
||
|
||
/// Writes a snapshot atomically (temp file + rename).
|
||
pub fn save_file(path: &Path, t: &Tree) -> io::Result<()> {
|
||
let dir = match path.parent() {
|
||
Some(d) if !d.as_os_str().is_empty() => d,
|
||
_ => Path::new("."),
|
||
};
|
||
let (tmp, mut f) = create_temp(dir)?;
|
||
let res = save(&mut f, t).and_then(|_| {
|
||
drop(f);
|
||
fs::rename(&tmp, path)
|
||
});
|
||
if res.is_err() {
|
||
let _ = fs::remove_file(&tmp);
|
||
}
|
||
res
|
||
}
|
||
|
||
/// Creates a new 0600 file named .mapsize-*.tmp in dir (like os.CreateTemp).
|
||
fn create_temp(dir: &Path) -> io::Result<(PathBuf, File)> {
|
||
let seed = SystemTime::now().duration_since(UNIX_EPOCH).unwrap_or_default().subsec_nanos() ^ std::process::id();
|
||
for i in 0..10000u32 {
|
||
let p = dir.join(format!(".mapsize-{}.tmp", seed.wrapping_add(i.wrapping_mul(7919))));
|
||
match OpenOptions::new().write(true).create_new(true).mode(0o600).open(&p) {
|
||
Ok(f) => return Ok((p, f)),
|
||
Err(e) if e.kind() == io::ErrorKind::AlreadyExists => continue,
|
||
Err(e) => return Err(e),
|
||
}
|
||
}
|
||
Err(io::Error::new(io::ErrorKind::AlreadyExists, "snapshot: cannot create temporary file"))
|
||
}
|
||
|
||
fn hostname() -> String {
|
||
let mut b = [0u8; 256];
|
||
if unsafe { libc::gethostname(b.as_mut_ptr() as *mut libc::c_char, b.len()) } != 0 {
|
||
return String::new();
|
||
}
|
||
let n = b.iter().position(|&c| c == 0).unwrap_or(b.len());
|
||
String::from_utf8_lossy(&b[..n]).into_owned()
|
||
}
|
||
|
||
/// The decompressed body, fed in chunks by the decompressing thread.
|
||
struct Body {
|
||
rx: Receiver<Result<Vec<u8>, String>>,
|
||
buf: Vec<u8>,
|
||
pos: usize,
|
||
err: Option<String>,
|
||
}
|
||
|
||
const EOF: &str = "EOF";
|
||
const UNEXPECTED_EOF: &str = "unexpected EOF";
|
||
|
||
impl Body {
|
||
fn new(rx: Receiver<Result<Vec<u8>, String>>) -> Body {
|
||
Body { rx, buf: Vec::new(), pos: 0, err: None }
|
||
}
|
||
|
||
/// Ensures unread bytes are buffered; false at end of stream.
|
||
fn fill(&mut self) -> Result<bool, String> {
|
||
while self.pos == self.buf.len() {
|
||
if let Some(e) = &self.err {
|
||
return Err(e.clone());
|
||
}
|
||
match self.rx.recv() {
|
||
Ok(Ok(b)) => (self.buf, self.pos) = (b, 0),
|
||
Ok(Err(e)) => self.err = Some(e),
|
||
Err(_) => return Ok(false),
|
||
}
|
||
}
|
||
Ok(true)
|
||
}
|
||
|
||
/// The next byte; Err("EOF") at end of stream.
|
||
#[inline]
|
||
fn byte(&mut self) -> Result<u8, String> {
|
||
if self.pos == self.buf.len() && !self.fill()? {
|
||
return Err(EOF.into());
|
||
}
|
||
self.pos += 1;
|
||
Ok(self.buf[self.pos - 1])
|
||
}
|
||
|
||
/// Fills out completely (errors like io.ReadFull).
|
||
fn read_full(&mut self, out: &mut [u8]) -> Result<(), String> {
|
||
let mut done = 0;
|
||
while done < out.len() {
|
||
if !self.fill()? {
|
||
return Err(if done == 0 { EOF } else { UNEXPECTED_EOF }.into());
|
||
}
|
||
let k = (out.len() - done).min(self.buf.len() - self.pos);
|
||
out[done..done + k].copy_from_slice(&self.buf[self.pos..self.pos + k]);
|
||
self.pos += k;
|
||
done += k;
|
||
}
|
||
Ok(())
|
||
}
|
||
|
||
fn byte1(&mut self) -> Result<u8, String> {
|
||
self.byte().map_err(|e| format!("snapshot: truncated: {e}"))
|
||
}
|
||
|
||
fn uvarint(&mut self, max: u64, what: &str) -> Result<u64, String> {
|
||
let v = read_uvarint(self).map_err(|e| format!("snapshot: bad {what}: {e}"))?;
|
||
if v > max {
|
||
return Err(format!("snapshot: {what} {v} exceeds limit {max}"));
|
||
}
|
||
Ok(v)
|
||
}
|
||
|
||
fn varint(&mut self, what: &str) -> Result<i64, String> {
|
||
let ux = read_uvarint(self).map_err(|e| format!("snapshot: bad {what}: {e}"))?;
|
||
let v = (ux >> 1) as i64; // zig-zag, as encoding/binary.PutVarint
|
||
Ok(if ux & 1 != 0 { !v } else { v })
|
||
}
|
||
|
||
fn bytes_n(&mut self, n: u64) -> Result<Vec<u8>, String> {
|
||
let mut b = vec![0u8; n as usize];
|
||
self.read_full(&mut b).map_err(|e| format!("snapshot: truncated: {e}"))?;
|
||
Ok(b)
|
||
}
|
||
|
||
fn str(&mut self, max: u64, what: &str) -> Result<Vec<u8>, String> {
|
||
let n = self.uvarint(max, &format!("{what} length"))?;
|
||
self.bytes_n(n)
|
||
}
|
||
}
|
||
|
||
/// encoding/binary.ReadUvarint over the body.
|
||
fn read_uvarint(b: &mut Body) -> Result<u64, String> {
|
||
let (mut x, mut s) = (0u64, 0u32);
|
||
for i in 0..10 {
|
||
let c = match b.byte() {
|
||
Ok(c) => c,
|
||
Err(e) if i > 0 && e == EOF => return Err(UNEXPECTED_EOF.into()),
|
||
Err(e) => return Err(e),
|
||
};
|
||
if c < 0x80 {
|
||
if i == 9 && c > 1 {
|
||
break;
|
||
}
|
||
return Ok(x | (c as u64) << s);
|
||
}
|
||
x |= ((c & 0x7f) as u64) << s;
|
||
s += 7;
|
||
}
|
||
Err("varint overflows 64 bits".into())
|
||
}
|
||
|
||
const BOMB: &str = "snapshot: decompressed size exceeds limit (possible decompression bomb)";
|
||
|
||
/// Allows decompressed bodies up to 64× the compressed file size (real
|
||
/// snapshots compress ~6×), with a 64 MiB floor for tiny files.
|
||
fn body_limit(file_size: i64) -> i64 {
|
||
(64 << 20).max(file_size.saturating_mul(64))
|
||
}
|
||
|
||
/// Caps the node count for a file of file_size bytes. Real snapshots spend
|
||
/// ~15 compressed bytes per node; a crafted one describes a node in a
|
||
/// fraction of a byte, so without this a 1 MB file can demand gigabytes of
|
||
/// memory while staying within body_limit.
|
||
fn node_limit(file_size: i64) -> u64 {
|
||
(1u64 << 20).max(file_size.max(0) as u64)
|
||
}
|
||
|
||
/// Reads and validates a snapshot, allowing up to DEFAULT_MAX_BODY bytes of
|
||
/// decompressed data.
|
||
pub fn load(r: impl Read) -> Result<Tree, crate::Error> {
|
||
load_limit(r, DEFAULT_MAX_BODY)
|
||
}
|
||
|
||
/// load with an explicit decompressed-size limit.
|
||
pub fn load_limit(r: impl Read, max_body: i64) -> Result<Tree, crate::Error> {
|
||
load_inner(r, max_body, MAX_NODES).map_err(Into::into)
|
||
}
|
||
|
||
/// Opens and loads a snapshot file.
|
||
pub fn load_file(path: &Path) -> Result<Tree, crate::Error> {
|
||
let f = File::open(path)?;
|
||
let (limit, nodes) = match f.metadata() {
|
||
Ok(m) => (body_limit(m.len() as i64), node_limit(m.len() as i64)),
|
||
Err(_) => (DEFAULT_MAX_BODY, MAX_NODES),
|
||
};
|
||
load_inner(f, limit, nodes).map_err(Into::into)
|
||
}
|
||
|
||
fn load_inner(input: impl Read, max_body: i64, max_nodes: u64) -> Result<Tree, String> {
|
||
let mut br = BufReader::with_capacity(1 << 20, input);
|
||
let mut hdr = [0u8; 12];
|
||
br.read_exact(&mut hdr).map_err(|_| "snapshot: file too short".to_string())?;
|
||
if &hdr[..8] != brand::SNAPSHOT_MAGIC {
|
||
return Err(format!("snapshot: not a {} snapshot", brand::NAME));
|
||
}
|
||
let v = u16::from_le_bytes([hdr[8], hdr[9]]);
|
||
if v != VERSION {
|
||
return Err(format!("snapshot: unsupported version {v} (this build reads {VERSION})"));
|
||
}
|
||
if u16::from_le_bytes([hdr[10], hdr[11]]) & FLAG_GZIPPED == 0 {
|
||
return Err("snapshot: uncompressed bodies are not supported".into());
|
||
}
|
||
// Decompression and hashing run on this thread while a scoped thread
|
||
// parses, overlapping the two. The parser only sees end of stream once
|
||
// the channel's sender is dropped, i.e. after decompression finished.
|
||
let mut h = Sha256::new();
|
||
let res = {
|
||
let mut gz = GzDecoder::new(&mut br); // single member, like gz.Multistream(false)
|
||
std::thread::scope(|s| {
|
||
let (tx, rx) = crossbeam_channel::bounded(4);
|
||
let parser = s.spawn(move || parse(&mut Body::new(rx), max_nodes));
|
||
let mut left = max_body;
|
||
loop {
|
||
if left <= 0 {
|
||
let _ = tx.send(Err(BOMB.to_string()));
|
||
break;
|
||
}
|
||
let mut buf = vec![0u8; (256 << 10).min(left as usize)];
|
||
match gz.read(&mut buf) {
|
||
Ok(0) => break,
|
||
Ok(n) => {
|
||
buf.truncate(n);
|
||
left -= n as i64;
|
||
h.update(&buf);
|
||
if tx.send(Ok(buf)).is_err() {
|
||
break; // parser bailed out
|
||
}
|
||
}
|
||
Err(e) if e.kind() == io::ErrorKind::Interrupted => {}
|
||
Err(e) => {
|
||
let _ = tx.send(Err(format!("gzip: {e}")));
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
drop(tx);
|
||
parser.join().unwrap_or_else(|p| std::panic::resume_unwind(p))
|
||
})
|
||
};
|
||
let (mut t, m) = res?;
|
||
// The checksum follows the gzip stream.
|
||
let mut sum = [0u8; 32];
|
||
br.read_exact(&mut sum).map_err(|_| "snapshot: missing checksum".to_string())?;
|
||
if sum[..] != h.finalize()[..] {
|
||
return Err("snapshot: checksum mismatch (file corrupt)".into());
|
||
}
|
||
|
||
t.recompute();
|
||
let st = &mut t.stats;
|
||
st.start = m.start.to_system();
|
||
st.end = (!m.end.is_zero()).then(|| m.end.to_system());
|
||
st.complete = true;
|
||
st.cancelled = m.cancelled;
|
||
(st.files, st.dirs, st.symlinks, st.others) = (m.files, m.dirs, m.symlinks, m.others);
|
||
for (d, s) in st.err_counts.iter_mut().zip(m.err_counts.unwrap_or_default()) {
|
||
*d = s;
|
||
}
|
||
(st.excluded, st.skipped_mounts, st.virtual_skipped) = (m.excluded, m.skipped_mounts, m.virtual_skipped);
|
||
(st.loops_skipped, st.broken_links, st.hardlink_dups, st.unscanned) =
|
||
(m.loops_skipped, m.broken_links, m.hardlink_dups, m.unscanned);
|
||
st.excludes = m.excludes.unwrap_or_default();
|
||
st.one_file_system = m.one_file_system;
|
||
st.follow = m.follow;
|
||
st.workers = m.workers.max(0) as usize;
|
||
st.from_snapshot = format!("{} ({}, {})", m.created.local_minutes(), m.host, m.generator);
|
||
Ok(t)
|
||
}
|
||
|
||
/// Parses the decompressed body up to (and including) its end.
|
||
fn parse(r: &mut Body, max_nodes: u64) -> Result<(Tree, Meta), String> {
|
||
let n = r.uvarint(MAX_META_LEN, "metadata length")?;
|
||
let mb = r.bytes_n(n)?;
|
||
let m: Meta = serde_json::from_slice(&mb).map_err(|e| format!("snapshot: metadata: {e}"))?;
|
||
let mut t = Tree::new(m.root.as_bytes(), Kind::Dir);
|
||
|
||
let n_ext = r.uvarint(MAX_EXTS, "extension count")?;
|
||
let mut exts = Vec::with_capacity(n_ext.min(1024) as usize);
|
||
for _ in 0..n_ext {
|
||
exts.push(String::from_utf8_lossy(&r.str(MAX_EXT_LEN, "extension")?).into_owned());
|
||
}
|
||
let n_nodes = r.uvarint(max_nodes, "node count")?;
|
||
if n_nodes == 0 {
|
||
return Err("snapshot: no root node".into());
|
||
}
|
||
let mut depth: Vec<u16> = vec![0]; // per node, for the depth limit; parents precede children
|
||
for i in 0..n_nodes {
|
||
let pd = r.uvarint(MAX_NODES, "parent")?;
|
||
let kind = r.byte1()?;
|
||
let cat = r.byte1()?;
|
||
let flags = r.uvarint((1 << 16) - 1, "flags")? as u16;
|
||
let name = r.str(MAX_NAME_LEN, "name")?;
|
||
let (size, alloc, mtime) = (r.varint("size")?, r.varint("alloc")?, r.varint("mtime")?);
|
||
let mode = r.uvarint(u32::MAX as u64, "mode")? as u32;
|
||
let uid = r.uvarint(u32::MAX as u64, "uid")? as u32;
|
||
let gid = r.uvarint(u32::MAX as u64, "gid")? as u32;
|
||
let nlink = r.uvarint(u32::MAX as u64, "nlink")? as u32;
|
||
let ext = r.uvarint(n_ext, "ext")?;
|
||
if kind > Kind::Other as u8 || cat as usize >= NUM_CATEGORIES {
|
||
return Err(format!("snapshot: node {i}: invalid kind/category"));
|
||
}
|
||
let kind = Kind::from_u8(kind);
|
||
if size < 0 || alloc < 0 || size > MAX_SIZE || alloc > MAX_SIZE {
|
||
return Err(format!("snapshot: node {i}: size out of range"));
|
||
}
|
||
let id = if i == 0 {
|
||
if pd != 0 || kind != Kind::Dir && n_nodes > 1 {
|
||
return Err("snapshot: invalid root".into());
|
||
}
|
||
t.node_mut(0).kind = kind;
|
||
0
|
||
} else {
|
||
if pd == 0 || pd > i {
|
||
return Err(format!("snapshot: node {i}: invalid parent reference"));
|
||
}
|
||
let parent = (i - pd) as NodeId;
|
||
if t.node(parent).kind != Kind::Dir {
|
||
return Err(format!("snapshot: node {i}: parent is not a directory"));
|
||
}
|
||
if !valid_name(&name) {
|
||
return Err(format!("snapshot: node {i}: invalid name {:?}", String::from_utf8_lossy(&name)));
|
||
}
|
||
let d = depth[parent as usize] + 1;
|
||
if d > MAX_DEPTH {
|
||
return Err(format!("snapshot: node {i}: deeper than {MAX_DEPTH} levels"));
|
||
}
|
||
depth.push(d);
|
||
t.add(parent, &name, kind)
|
||
};
|
||
let n = t.node_mut(id);
|
||
n.cat = Category::from_u8(cat);
|
||
n.flags = flags;
|
||
(n.size, n.alloc, n.mtime) = (size, alloc, mtime);
|
||
(n.mode, n.uid, n.gid, n.nlink) = (mode, uid, gid, nlink);
|
||
if kind != Kind::Dir && (ext as usize) < exts.len() {
|
||
let e = t.intern_ext(&exts[ext as usize]);
|
||
t.node_mut(id).ext = e;
|
||
}
|
||
}
|
||
let n_err = r.uvarint(MAX_ERROR_RECORDS as u64, "error count")?;
|
||
for _ in 0..n_err {
|
||
let node = r.uvarint(n_nodes - 1, "error node")? as NodeId;
|
||
let kind = ErrKind::from_u8(r.byte1()?); // out-of-range kinds become Other
|
||
let name = r.str(MAX_NAME_LEN, "error name")?;
|
||
let msg = String::from_utf8_lossy(&r.str(MAX_MSG_LEN, "error message")?).into_owned();
|
||
t.stats.errors.push(ErrorRecord { node, kind, name, msg });
|
||
}
|
||
// The body must end here.
|
||
if r.byte() != Err(EOF.into()) {
|
||
return Err("snapshot: trailing data in body".into());
|
||
}
|
||
Ok((t, m))
|
||
}
|
||
|
||
fn valid_name(s: &[u8]) -> bool {
|
||
!s.is_empty() && s != b"." && s != b".." && !s.iter().any(|&c| c == b'/' || c == 0)
|
||
}
|
||
|
||
/// A Go time.Time as JSON carries it: unix seconds plus nanoseconds, and
|
||
/// the UTC offset it is written with. The default is Go's zero time
|
||
/// (0001-01-01T00:00:00Z).
|
||
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
|
||
struct GoTime {
|
||
secs: i64,
|
||
nanos: u32,
|
||
off: i32, // seconds east of UTC; presentation only
|
||
}
|
||
|
||
const GO_ZERO_SECS: i64 = -62_135_596_800;
|
||
|
||
impl Default for GoTime {
|
||
fn default() -> Self {
|
||
GoTime { secs: GO_ZERO_SECS, nanos: 0, off: 0 }
|
||
}
|
||
}
|
||
|
||
impl GoTime {
|
||
fn from_system(t: SystemTime) -> GoTime {
|
||
match t.duration_since(UNIX_EPOCH) {
|
||
Ok(d) => GoTime { secs: d.as_secs() as i64, nanos: d.subsec_nanos(), off: 0 },
|
||
Err(e) => {
|
||
let d = e.duration();
|
||
let (s, n) = (d.as_secs() as i64, d.subsec_nanos());
|
||
let (secs, nanos) = if n == 0 { (-s, 0) } else { (-s - 1, 1_000_000_000 - n) };
|
||
GoTime { secs, nanos, off: 0 }
|
||
}
|
||
}
|
||
}
|
||
|
||
/// The same instant in the local time zone (as Go's time.Now()).
|
||
fn local(self) -> GoTime {
|
||
let off = localtime(self.secs).map_or(0, |tm| tm.tm_gmtoff as i32);
|
||
GoTime { off, ..self }
|
||
}
|
||
|
||
fn is_zero(self) -> bool {
|
||
(self.secs, self.nanos) == (GO_ZERO_SECS, 0)
|
||
}
|
||
|
||
fn to_system(self) -> SystemTime {
|
||
if self.secs >= 0 {
|
||
UNIX_EPOCH + Duration::new(self.secs as u64, self.nanos)
|
||
} else {
|
||
UNIX_EPOCH - Duration::from_secs(self.secs.unsigned_abs()) + Duration::from_nanos(self.nanos as u64)
|
||
}
|
||
}
|
||
|
||
/// RFC 3339 with trimmed nanoseconds, like Go's MarshalJSON.
|
||
fn format(self) -> String {
|
||
let secs = self.secs + self.off as i64;
|
||
let (y, mo, d) = civil_from_days(secs.div_euclid(86400));
|
||
let rem = secs.rem_euclid(86400);
|
||
let mut s = format!("{y:04}-{mo:02}-{d:02}T{:02}:{:02}:{:02}", rem / 3600, rem / 60 % 60, rem % 60);
|
||
if self.nanos != 0 {
|
||
s += format!(".{:09}", self.nanos).trim_end_matches('0');
|
||
}
|
||
if self.off == 0 {
|
||
return s + "Z";
|
||
}
|
||
let a = self.off.unsigned_abs() / 60;
|
||
format!("{s}{}{:02}:{:02}", if self.off < 0 { '-' } else { '+' }, a / 60, a % 60)
|
||
}
|
||
|
||
/// Parses RFC 3339 ("2026-10-08T10:40:00.123456789+01:00").
|
||
fn parse(s: &str) -> Option<GoTime> {
|
||
let b = s.as_bytes();
|
||
let num = |r: std::ops::Range<usize>| -> Option<i64> {
|
||
let p = b.get(r)?;
|
||
p.iter().all(u8::is_ascii_digit).then(|| p.iter().fold(0i64, |a, &c| a * 10 + (c - b'0') as i64))
|
||
};
|
||
if b.len() < 20 || b[4] != b'-' || b[7] != b'-' || b[10] != b'T' || b[13] != b':' || b[16] != b':' {
|
||
return None;
|
||
}
|
||
let (y, mo, d, h, mi, se) = (num(0..4)?, num(5..7)?, num(8..10)?, num(11..13)?, num(14..16)?, num(17..19)?);
|
||
if !(1..=12).contains(&mo) || !(1..=31).contains(&d) || h > 23 || mi > 59 || se > 59 {
|
||
return None;
|
||
}
|
||
let mut i = 19;
|
||
let mut nanos = 0u32;
|
||
if b[i] == b'.' {
|
||
let start = i + 1;
|
||
i = start;
|
||
while i < b.len() && b[i].is_ascii_digit() {
|
||
if i - start < 9 {
|
||
nanos = nanos * 10 + (b[i] - b'0') as u32;
|
||
}
|
||
i += 1;
|
||
}
|
||
if i == start {
|
||
return None;
|
||
}
|
||
for _ in (i - start)..9 {
|
||
nanos *= 10;
|
||
}
|
||
}
|
||
let off = match b.get(i)? {
|
||
b'Z' if b.len() == i + 1 => 0,
|
||
&c @ (b'+' | b'-') if b.len() == i + 6 && b[i + 3] == b':' => {
|
||
let (oh, om) = (num(i + 1..i + 3)?, num(i + 4..i + 6)?);
|
||
if oh > 23 || om > 59 {
|
||
return None;
|
||
}
|
||
(oh * 3600 + om * 60) * if c == b'-' { -1 } else { 1 }
|
||
}
|
||
_ => return None,
|
||
};
|
||
let secs = days_from_civil(y, mo, d) * 86400 + h * 3600 + mi * 60 + se - off;
|
||
Some(GoTime { secs, nanos, off: off as i32 })
|
||
}
|
||
|
||
/// "2006-01-02 15:04" in local time.
|
||
fn local_minutes(self) -> String {
|
||
let Some(tm) = localtime(self.secs) else { return self.format() };
|
||
format!("{:04}-{:02}-{:02} {:02}:{:02}", tm.tm_year as i64 + 1900, tm.tm_mon + 1, tm.tm_mday, tm.tm_hour, tm.tm_min)
|
||
}
|
||
}
|
||
|
||
fn localtime(secs: i64) -> Option<libc::tm> {
|
||
let t = secs as libc::time_t;
|
||
let mut tm: libc::tm = unsafe { std::mem::zeroed() };
|
||
(!unsafe { libc::localtime_r(&t, &mut tm) }.is_null()).then_some(tm)
|
||
}
|
||
|
||
impl Serialize for GoTime {
|
||
fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
|
||
s.serialize_str(&self.format())
|
||
}
|
||
}
|
||
|
||
impl<'de> Deserialize<'de> for GoTime {
|
||
fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
|
||
// null leaves the zero time, as in Go.
|
||
match Option::<String>::deserialize(d)? {
|
||
None => Ok(GoTime::default()),
|
||
Some(s) => GoTime::parse(&s).ok_or_else(|| serde::de::Error::custom(format!("parsing time {s:?}"))),
|
||
}
|
||
}
|
||
}
|
||
|
||
/// Civil-from-days (Howard Hinnant).
|
||
fn civil_from_days(days: i64) -> (i64, i64, i64) {
|
||
let z = days + 719468;
|
||
let era = z.div_euclid(146097);
|
||
let doe = z - era * 146097;
|
||
let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
|
||
let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
|
||
let mp = (5 * doy + 2) / 153;
|
||
let d = doy - (153 * mp + 2) / 5 + 1;
|
||
let m = if mp < 10 { mp + 3 } else { mp - 9 };
|
||
(yoe + era * 400 + (m <= 2) as i64, m, d)
|
||
}
|
||
|
||
fn days_from_civil(y: i64, m: i64, d: i64) -> i64 {
|
||
let y = if m <= 2 { y - 1 } else { y };
|
||
let era = y.div_euclid(400);
|
||
let yoe = y - era * 400;
|
||
let doy = (153 * ((m + 9) % 12) + 2) / 5 + d - 1;
|
||
let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
|
||
era * 146097 + doe - 719468
|
||
}
|
||
|
||
#[cfg(test)]
|
||
mod tests {
|
||
use super::*;
|
||
use crate::inventory::{SizeMode, FLAG_SPARSE};
|
||
use std::collections::HashMap;
|
||
|
||
fn sample() -> Tree {
|
||
let mut t = Tree::new(b"/srv", Kind::Dir);
|
||
let a = t.add(0, b"a", Kind::Dir);
|
||
let b = t.add(0, b"b", Kind::Dir);
|
||
let f1 = t.add(a, b"x.iso", Kind::File);
|
||
(t.node_mut(f1).size, t.node_mut(f1).alloc) = (1000, 1024);
|
||
let f2 = t.add(b, b"y.log", Kind::File);
|
||
(t.node_mut(f2).size, t.node_mut(f2).alloc) = (50, 4096);
|
||
t.node_mut(f2).flags = FLAG_SPARSE;
|
||
t.recompute();
|
||
(t.stats.files, t.stats.dirs) = (2, 3);
|
||
t.stats.add_error(ErrorRecord { node: b, kind: ErrKind::Permission, msg: "denied".into(), ..Default::default() });
|
||
t
|
||
}
|
||
|
||
fn saved(t: &Tree) -> Vec<u8> {
|
||
let mut buf = Vec::new();
|
||
save(&mut buf, t).unwrap();
|
||
buf
|
||
}
|
||
|
||
#[test]
|
||
fn round_trip() {
|
||
let src = sample();
|
||
let got = load(&saved(&src)[..]).unwrap();
|
||
assert_eq!(got.len(), src.len());
|
||
for i in 0..src.len() as NodeId {
|
||
let (a, b) = (src.node(i), got.node(i));
|
||
assert!(
|
||
a.name == b.name && a.tot_size == b.tot_size && a.tot_alloc == b.tot_alloc && a.flags == b.flags
|
||
&& src.path(i) == got.path(i) && src.ext_name(a) == got.ext_name(b),
|
||
"node {i} differs: {a:?} vs {b:?}"
|
||
);
|
||
}
|
||
assert_eq!(got.stats.err_counts[ErrKind::Permission as usize], 1);
|
||
assert_eq!(got.stats.errors.len(), 1);
|
||
assert_eq!(got.stats.start, src.stats.start);
|
||
assert_eq!(got.stats.end, None);
|
||
}
|
||
|
||
#[test]
|
||
fn corruption_detected() {
|
||
let data = saved(&sample());
|
||
let mut bad = data.clone();
|
||
*bad.last_mut().unwrap() ^= 0xff; // flip a byte in the checksum trailer
|
||
assert!(load(&bad[..]).is_err(), "checksum corruption not detected");
|
||
// Every truncation must fail cleanly.
|
||
for i in (0..data.len() - 1).step_by(7) {
|
||
assert!(load(&data[..i]).is_err(), "truncation at {i} accepted");
|
||
}
|
||
}
|
||
|
||
#[test]
|
||
fn compare_trees() {
|
||
let old = sample();
|
||
let mut nw = Tree::new(b"/srv", Kind::Dir);
|
||
let a = nw.add(0, b"a", Kind::Dir);
|
||
let f1 = nw.add(a, b"x.iso", Kind::File);
|
||
(nw.node_mut(f1).size, nw.node_mut(f1).alloc) = (5000, 5120);
|
||
let c = nw.add(0, b"c", Kind::Dir);
|
||
let f3 = nw.add(c, b"z", Kind::File);
|
||
(nw.node_mut(f3).size, nw.node_mut(f3).alloc) = (10, 4096);
|
||
nw.recompute();
|
||
|
||
let d = compare(old, &nw);
|
||
let al = SizeMode::Allocated;
|
||
assert_eq!(d.status_of(&nw, f1, al), Status::Grew);
|
||
assert_eq!(d.delta(&nw, f1, al), 4096);
|
||
assert_eq!(d.status_of(&nw, c, al), Status::Added);
|
||
assert_eq!(d.removed.len(), 1);
|
||
assert_eq!(&d.old.node(d.removed[0]).name[..], b"b");
|
||
let ch = d.changes(&nw, 10, al);
|
||
let paths: HashMap<&str, Status> = ch.iter().map(|c| (c.path.as_str(), c.status)).collect();
|
||
assert_eq!(paths.get("/srv/a/x.iso"), Some(&Status::Grew), "{ch:?}");
|
||
assert_eq!(paths.get("/srv/b"), Some(&Status::Removed), "{ch:?}");
|
||
assert_eq!(paths.get("/srv/c"), Some(&Status::Added), "{ch:?}");
|
||
assert!(!paths.contains_key("/srv/a"), "/srv/a should be explained by its child");
|
||
assert!(!paths.contains_key("/srv/c/z"), "contents of new dirs should not be listed separately");
|
||
}
|
||
|
||
fn body(b: &[u8]) -> Body {
|
||
let (tx, rx) = crossbeam_channel::unbounded();
|
||
tx.send(Ok(b.to_vec())).unwrap();
|
||
Body::new(rx)
|
||
}
|
||
|
||
fn put_uvarint(v: u64) -> Vec<u8> {
|
||
let mut w = Writer { gz: GzEncoder::new(Vec::new(), Compression::fast()), h: Sha256::new(), buf: Vec::new() };
|
||
w.uvarint(v).unwrap();
|
||
w.buf
|
||
}
|
||
|
||
#[test]
|
||
fn read_uvarint_matches_go() {
|
||
for v in [0, 1, 127, 128, 300, 1 << 35, u64::MAX] {
|
||
assert_eq!(read_uvarint(&mut body(&put_uvarint(v))), Ok(v));
|
||
}
|
||
assert_eq!(put_uvarint(300), [0xac, 0x02]);
|
||
assert!(read_uvarint(&mut body(&[0xff; 11])).is_err(), "overflow not detected");
|
||
// Zig-zag as Go's PutVarint.
|
||
for (v, enc) in [(0i64, 0u64), (-1, 1), (1, 2), (-2, 3), (i64::MIN, u64::MAX)] {
|
||
assert_eq!(((v << 1) ^ (v >> 63)) as u64, enc);
|
||
assert_eq!(body(&put_uvarint(enc)).varint("v"), Ok(v));
|
||
}
|
||
}
|
||
|
||
#[test]
|
||
fn go_time_json() {
|
||
let t = GoTime::parse("2026-10-08T10:40:00.123456789+01:00").unwrap();
|
||
assert_eq!((t.secs, t.nanos, t.off), (1_791_452_400, 123_456_789, 3600));
|
||
assert_eq!(t.format(), "2026-10-08T10:40:00.123456789+01:00");
|
||
assert_eq!(GoTime { off: 0, ..t }.format(), "2026-10-08T09:40:00.123456789Z");
|
||
assert_eq!(GoTime { off: -5 * 3600 - 1800, ..t }.format(), "2026-10-08T04:10:00.123456789-05:30");
|
||
assert_eq!(GoTime::parse("2026-10-08T09:40:00.1Z").unwrap().format(), "2026-10-08T09:40:00.1Z");
|
||
assert_eq!(GoTime::parse("0001-01-01T00:00:00Z"), Some(GoTime::default()));
|
||
assert_eq!(GoTime::default().format(), "0001-01-01T00:00:00Z");
|
||
assert_eq!(GoTime::from_system(GoTime::default().to_system()), GoTime::default());
|
||
for bad in ["", "2026-10-08", "2026-13-08T00:00:00Z", "2026-10-08T00:00:00", "2026-10-08T00:00:00.Z"] {
|
||
assert_eq!(GoTime::parse(bad), None, "{bad}");
|
||
}
|
||
}
|
||
|
||
/// A tiny tree saved by the Go binary
|
||
/// (tree/{a/x.iso 10000 B, a/b/note.txt, c/y.log 3000 B, c/link -> ../a}).
|
||
#[test]
|
||
fn loads_go_snapshot() {
|
||
let t = load_file(Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/src/snapshot/testdata/go.msz"))).unwrap();
|
||
let r = t.node(0);
|
||
assert_eq!((r.tot_size, r.tot_alloc), (13310, 20480));
|
||
assert_eq!((t.stats.files, t.stats.dirs, t.stats.symlinks), (3, 4, 1));
|
||
assert_eq!(t.len(), 8);
|
||
assert!(t.stats.root.ends_with(b"/tree"));
|
||
assert!(t.stats.end.is_some() && t.stats.complete);
|
||
assert!(t.stats.from_snapshot.contains("mapsize"), "{}", t.stats.from_snapshot);
|
||
let iso = (0..t.len() as NodeId).find(|&i| &t.node(i).name[..] == b"x.iso").unwrap();
|
||
assert_eq!(t.node(iso).size, 10000);
|
||
assert_eq!(t.ext_name(t.node(iso)), "iso");
|
||
assert!(t.path_string(iso).ends_with("/tree/a/x.iso"));
|
||
// And it survives a Rust round trip unchanged.
|
||
let again = load(&saved(&t)[..]).unwrap();
|
||
assert_eq!((again.node(0).tot_size, again.len(), again.stats.start), (13310, 8, t.stats.start));
|
||
}
|
||
|
||
// Hostile input.
|
||
|
||
/// Builds a well-formed (correctly checksummed) but hostile snapshot.
|
||
fn craft(n: usize, meta: &str, rec: impl Fn(usize, &mut Writer<Vec<u8>>)) -> Vec<u8> {
|
||
let mut out = Vec::new();
|
||
out.extend_from_slice(brand::SNAPSHOT_MAGIC);
|
||
out.extend_from_slice(&VERSION.to_le_bytes());
|
||
out.extend_from_slice(&FLAG_GZIPPED.to_le_bytes());
|
||
let mut w = Writer { gz: GzEncoder::new(out, Compression::best()), h: Sha256::new(), buf: Vec::new() };
|
||
w.uvarint(meta.len() as u64).unwrap();
|
||
w.bytes(meta.as_bytes()).unwrap();
|
||
w.uvarint(1).unwrap();
|
||
w.str(b"").unwrap();
|
||
w.uvarint(n as u64).unwrap();
|
||
for i in 0..n {
|
||
rec(i, &mut w);
|
||
}
|
||
w.uvarint(0).unwrap();
|
||
w.flush().unwrap();
|
||
let mut out = w.gz.finish().unwrap();
|
||
let sum = w.h.finalize();
|
||
out.extend_from_slice(&sum);
|
||
out
|
||
}
|
||
|
||
fn node(w: &mut Writer<Vec<u8>>, pd: u64, kind: Kind, name: &str, size: i64) {
|
||
w.uvarint(pd).unwrap();
|
||
w.bytes(&[kind as u8, 0]).unwrap();
|
||
w.uvarint(0).unwrap();
|
||
w.str(name.as_bytes()).unwrap();
|
||
w.varint(size).unwrap();
|
||
w.varint(size).unwrap();
|
||
w.varint(0).unwrap();
|
||
for _ in 0..5 {
|
||
w.uvarint(0).unwrap();
|
||
}
|
||
}
|
||
|
||
fn chain(n: usize) -> Vec<u8> {
|
||
craft(n, r#"{"root":"/r"}"#, |i, w| if i == 0 { node(w, 0, Kind::Dir, "", 0) } else { node(w, 1, Kind::Dir, "a", 0) })
|
||
}
|
||
|
||
#[test]
|
||
fn deep_chain_rejected() {
|
||
load(&chain(MAX_DEPTH as usize + 1)[..]).expect("depth at the limit must load");
|
||
let err = load(&chain(MAX_DEPTH as usize + 2)[..]).err().expect("over-deep chain accepted");
|
||
assert!(err.to_string().contains("deeper"), "{err}");
|
||
}
|
||
|
||
#[test]
|
||
fn decompression_bomb_limited() {
|
||
let flat = craft(100_000, r#"{"root":"/r"}"#, |i, w| {
|
||
if i == 0 { node(w, 0, Kind::Dir, "", 0) } else { node(w, i as u64, Kind::File, "f", 0) }
|
||
});
|
||
let err = load_limit(&flat[..], 64 << 10).err().expect("bomb not limited");
|
||
assert!(err.to_string().contains("limit"), "{err}");
|
||
assert!(body_limit(flat.len() as i64) >= 64 << 20, "body_limit floor");
|
||
}
|
||
|
||
#[test]
|
||
fn huge_sizes_do_not_wrap() {
|
||
let data = craft(3, r#"{"root":"/r"}"#, |i, w| {
|
||
if i == 0 { node(w, 0, Kind::Dir, "", 0) } else { node(w, i as u64, Kind::File, "f", MAX_SIZE) }
|
||
});
|
||
let tr = load(&data[..]).unwrap();
|
||
assert!(tr.node(0).tot_size >= 0, "aggregate wrapped negative");
|
||
let over = craft(2, r#"{"root":"/r"}"#, |i, w| {
|
||
if i == 0 { node(w, 0, Kind::Dir, "", 0) } else { node(w, 1, Kind::File, "f", MAX_SIZE + 1) }
|
||
});
|
||
assert!(load(&over[..]).is_err(), "size above MAX_SIZE accepted");
|
||
}
|
||
|
||
#[test]
|
||
fn hostile_metadata_sanitised_in_summary() {
|
||
let data = craft(1, r#"{"root":"/r\u001b[2J","excludes":["\u001b]0;PWNED\u0007"],"excluded":1}"#, |_, w| {
|
||
node(w, 0, Kind::Dir, "", 0)
|
||
});
|
||
let mut tr = load(&data[..]).unwrap();
|
||
tr.stats.excluded = 1;
|
||
let mut b = Vec::new();
|
||
crate::export::summary(&mut b, &tr).unwrap();
|
||
assert!(!b.iter().any(|&c| c == 0x1b || c == 0x07), "raw control characters in summary: {:?}", String::from_utf8_lossy(&b));
|
||
}
|
||
|
||
/// Blocks of one directory plus K-1 files repeat byte for byte, so a
|
||
/// small file describes millions of nodes; load_file must refuse before
|
||
/// allocating.
|
||
#[test]
|
||
fn node_amplification_limited() {
|
||
const K: usize = 1000;
|
||
const N: usize = 1_200_001;
|
||
let data = craft(N, r#"{"root":"/r"}"#, |i, w| match i {
|
||
0 => node(w, 0, Kind::Dir, "", 0),
|
||
1 => node(w, 1, Kind::Dir, "d", 0),
|
||
_ if (i - 1) % K == 0 => node(w, K as u64, Kind::Dir, "d", 0),
|
||
_ => node(w, ((i - 1) % K) as u64, Kind::File, "f", 0),
|
||
});
|
||
load(&data[..]).expect("crafted tree is otherwise valid");
|
||
let p = std::env::temp_dir().join(format!("mapsize-amp-{}.msz", std::process::id()));
|
||
fs::write(&p, &data).unwrap();
|
||
let res = load_file(&p);
|
||
let _ = fs::remove_file(&p);
|
||
let err = res.err().unwrap_or_else(|| panic!("{N} nodes from a {}-byte file accepted", data.len()));
|
||
assert!(err.to_string().contains("node count"), "{err}");
|
||
}
|
||
|
||
#[test]
|
||
fn save_file_is_atomic_and_detected() {
|
||
let dir = std::env::temp_dir().join(format!("mapsize-save-{}", std::process::id()));
|
||
fs::create_dir_all(&dir).unwrap();
|
||
let p = dir.join("s.msz");
|
||
save_file(&p, &sample()).unwrap();
|
||
assert!(is_snapshot(&p));
|
||
assert_eq!(load_file(&p).unwrap().len(), 5);
|
||
assert_eq!(fs::read_dir(&dir).unwrap().count(), 1, "temp file left behind");
|
||
fs::remove_dir_all(&dir).unwrap();
|
||
}
|
||
}
|