security/hakurei
security/hakurei
6
3
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases 7 Wiki Activity

cmd/hakurei/parse: use new store interface
All checks were successful
Test / Create distribution (push) Successful in 35s
Details
Test / Sandbox (push) Successful in 2m21s
Details
Test / Sandbox (race detector) (push) Successful in 4m16s
Details
Test / Hpkg (push) Successful in 4m15s
Details
Test / Hakurei (race detector) (push) Successful in 4m58s
Details
Test / Hakurei (push) Successful in 2m16s
Details
Test / Flake checks (push) Successful in 1m28s
Details

Browse Source 
This greatly reduces overhead. The iterator also significantly cleans up the usage code.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-11-02 15:59:46 +09:00
parent 898b5aed3d
commit 23ae7822bf
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
5 changed files with 137 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
cmd/hakurei/command.go
View File

@ -294,7 +294,10 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
}
{
var flagShort bool
var (
flagShort bool
flagNoStore bool
)
c.NewCommand("show", "Show live or local app configuration", func(args []string) error {
switch len(args) {
case 0: // system
@ -302,10 +305,23 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
case 1: // instance
name := args[0]
config, entry := tryIdentifier(msg, name)
if config == nil {
config = tryPath(msg, name)
var (
config *hst.Config
entry *hst.State
)
if !flagNoStore {
var sc hst.Paths
env.CopyPaths().Copy(&sc, new(outcome.Hsu).MustID(nil))
entry = tryIdentifier(msg, name, outcome.NewStore(&sc))
}
if entry == nil {
config = tryPath(msg, name)
} else {
config = entry.Config
}
if !printShowInstance(os.Stdout, time.Now().UTC(), entry, config, flagShort, flagJSON) {
os.Exit(1)
}
@ -314,7 +330,9 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
log.Fatal("show requires 1 argument")
}
return errSuccess
}).Flag(&flagShort, "short", command.BoolFlag(false), "Omit filesystem information")
}).
Flag(&flagShort, "short", command.BoolFlag(false), "Omit filesystem information").
Flag(&flagNoStore, "no-store", command.BoolFlag(false), "Do not attempt to match from active instances")
}
{

81
cmd/hakurei/parse.go
View File

@ -11,8 +11,6 @@ import (
"syscall"
"hakurei.app/hst"
"hakurei.app/internal/env"
"hakurei.app/internal/outcome"
"hakurei.app/internal/store"
"hakurei.app/message"
)
@ -81,26 +79,7 @@ func shortIdentifierString(s string) string {
}
// tryIdentifier attempts to match [hst.State] from a [hex] representation of [hst.ID] or a prefix of its lower half.
func tryIdentifier(msg message.Msg, name string) (config *hst.Config, entry *hst.State) {
return tryIdentifierEntries(msg, name, func() map[hst.ID]*hst.State {
var sc hst.Paths
env.CopyPaths().Copy(&sc, new(outcome.Hsu).MustID(nil))
s := store.NewMulti(msg, sc.SharePath)
if entries, err := store.Join(s); err != nil {
msg.GetLogger().Printf("cannot join store: %v", err) // not fatal
return nil
} else {
return entries
}
})
}
// tryIdentifierEntries implements tryIdentifier with a custom entries pair getter.
func tryIdentifierEntries(
msg message.Msg,
name string,
getEntries func() map[hst.ID]*hst.State,
) (config *hst.Config, entry *hst.State) {
func tryIdentifier(msg message.Msg, name string, s *store.Store) *hst.State {
const (
likeShort = 1 << iota
likeFull
@ -116,7 +95,7 @@ func tryIdentifierEntries(
if c >= 'a' && c <= 'f' {
continue
}
return
return nil
}
likely |= likeShort
} else if len(name) == hex.EncodedLen(len(hst.ID{})) {
@ -124,40 +103,58 @@ func tryIdentifierEntries(
}
if likely == 0 {
return
}
entries := getEntries()
if entries == nil {
return
return nil
}
entries, copyError := s.All()
defer func() {
if err := copyError(); err != nil {
msg.GetLogger().Println(getMessage("cannot iterate over store:", err))
}
}()
switch {
case likely&likeShort != 0:
msg.Verbose("argument looks like short identifier")
for id := range entries {
v := id.String()
if strings.HasPrefix(v[len(hst.ID{}):], name) {
// match, use config from this state entry
entry = entries[id]
config = entry.Config
break
for eh := range entries {
if eh.DecodeErr != nil {
msg.Verbose(getMessage("skipping instance:", eh.DecodeErr))
continue
}
msg.Verbosef("instance %s skipped", v)
if strings.HasPrefix(eh.ID.String()[len(hst.ID{}):], name) {
var entry hst.State
if _, err := eh.Load(&entry); err != nil {
msg.GetLogger().Println(getMessage("cannot load state entry:", err))
continue
}
return &entry
}
}
return
return nil
case likely&likeFull != 0:
var likelyID hst.ID
if likelyID.UnmarshalText([]byte(name)) != nil {
return
return nil
}
msg.Verbose("argument looks like identifier")
if ent, ok := entries[likelyID]; ok {
entry = ent
config = ent.Config
for eh := range entries {
if eh.DecodeErr != nil {
msg.Verbose(getMessage("skipping instance:", eh.DecodeErr))
continue
}
if eh.ID == likelyID {
var entry hst.State
if _, err := eh.Load(&entry); err != nil {
msg.GetLogger().Println(getMessage("cannot load state entry:", err))
continue
}
return &entry
}
}
return
return nil
default:
panic("unreachable")

116
cmd/hakurei/parse_test.go
View File

@ -1,10 +1,14 @@
package main
import (
"bytes"
"reflect"
"testing"
"time"
"hakurei.app/container/check"
"hakurei.app/hst"
"hakurei.app/internal/store"
"hakurei.app/message"
)
@ -23,17 +27,47 @@ func TestShortIdentifier(t *testing.T) {
func TestTryIdentifier(t *testing.T) {
t.Parallel()
msg := message.NewMsg(nil)
id := hst.ID{
0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
}
withBase := func(extra ...hst.State) []hst.State {
return append([]hst.State{
{ID: (hst.ID)(bytes.Repeat([]byte{0xaa}, len(hst.ID{}))), PID: 0xbeef, ShimPID: 0xcafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef0)},
{ID: (hst.ID)(bytes.Repeat([]byte{0xab}, len(hst.ID{}))), PID: 0x1beef, ShimPID: 0x1cafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef1)},
{ID: (hst.ID)(bytes.Repeat([]byte{0xf0}, len(hst.ID{}))), PID: 0x2beef, ShimPID: 0x2cafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef2)},
{ID: (hst.ID)(bytes.Repeat([]byte{0xfe}, len(hst.ID{}))), PID: 0xbed, ShimPID: 0xfff, Config: func() *hst.Config {
template := hst.Template()
template.Identity = hst.IdentityMax
return template
}(), Time: time.Unix(0, 0xcafebabe0)},
{ID: (hst.ID)(bytes.Repeat([]byte{0xfc}, len(hst.ID{}))), PID: 0x1bed, ShimPID: 0x1fff, Config: func() *hst.Config {
template := hst.Template()
template.Identity = 0xfc
return template
}(), Time: time.Unix(0, 0xcafebabe1)},
{ID: (hst.ID)(bytes.Repeat([]byte{0xce}, len(hst.ID{}))), PID: 0x2bed, ShimPID: 0x2fff, Config: func() *hst.Config {
template := hst.Template()
template.Identity = 0xce
return template
}(), Time: time.Unix(0, 0xcafebabe2)},
}, extra...)
}
sampleEntry := hst.State{
ID: id,
PID: 0xcafebabe,
ShimPID: 0xdeadbeef,
Config: hst.Template(),
}
testCases := []struct {
name string
s string
entries map[hst.ID]*hst.State
want *hst.State
name string
s string
data []hst.State
want *hst.State
}{
{"likely entries fault", "ffffffff", nil, nil},
@ -41,58 +75,40 @@ func TestTryIdentifier(t *testing.T) {
{"likely short too long", "fffffffffffffffff", nil, nil},
{"likely short invalid lower", "fffffff\x00", nil, nil},
{"likely short invalid higher", "0000000\xff", nil, nil},
{"short no match", "fedcba98", map[hst.ID]*hst.State{hst.ID{}: nil}, nil},
{"short match", "fedcba98", map[hst.ID]*hst.State{
hst.ID{}: nil,
id: {
ID: id,
PID: 0xcafebabe,
ShimPID: 0xdeadbeef,
Config: hst.Template(),
},
}, &hst.State{
ID: id,
PID: 0xcafebabe,
ShimPID: 0xdeadbeef,
Config: hst.Template(),
}},
{"short match longer", "fedcba98765", map[hst.ID]*hst.State{
hst.ID{}: nil,
id: {
ID: id,
PID: 0xcafebabe,
ShimPID: 0xdeadbeef,
Config: hst.Template(),
},
}, &hst.State{
ID: id,
PID: 0xcafebabe,
ShimPID: 0xdeadbeef,
Config: hst.Template(),
}},
{"short no match", "fedcba98", withBase(), nil},
{"short match", "fedcba98", withBase(sampleEntry), &sampleEntry},
{"short match single", "fedcba98", []hst.State{sampleEntry}, &sampleEntry},
{"short match longer", "fedcba98765", withBase(sampleEntry), &sampleEntry},
{"likely long invalid", "0123456789abcdeffedcba987654321\x00", map[hst.ID]*hst.State{}, nil},
{"long no match", "0123456789abcdeffedcba9876543210", map[hst.ID]*hst.State{hst.ID{}: nil}, nil},
{"long match", "0123456789abcdeffedcba9876543210", map[hst.ID]*hst.State{
hst.ID{}: nil,
id: {
ID: id,
PID: 0xcafebabe,
ShimPID: 0xdeadbeef,
Config: hst.Template(),
},
}, &hst.State{
ID: id,
PID: 0xcafebabe,
ShimPID: 0xdeadbeef,
Config: hst.Template(),
}},
{"likely long invalid", "0123456789abcdeffedcba987654321\x00", nil, nil},
{"long no match", "0123456789abcdeffedcba9876543210", withBase(), nil},
{"long match", "0123456789abcdeffedcba9876543210", withBase(sampleEntry), &sampleEntry},
{"long match single", "0123456789abcdeffedcba9876543210", []hst.State{sampleEntry}, &sampleEntry},
}
for _, tc := range testCases {
base := check.MustAbs(t.TempDir()).Append("store")
s := store.New(base)
for i := range tc.data {
if h, err := s.Handle(tc.data[i].Identity); err != nil {
t.Fatalf("Handle: error = %v", err)
} else {
var unlock func()
if unlock, err = h.Lock(); err != nil {
t.Fatalf("Lock: error = %v", err)
}
_, err = h.Save(&tc.data[i])
unlock()
if err != nil {
t.Fatalf("Save: error = %v", err)
}
}
}
// store must not be written to beyond this point
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
_, got := tryIdentifierEntries(msg, tc.s, func() map[hst.ID]*hst.State { return tc.entries })
got := tryIdentifier(msg, tc.s, store.New(base))
if !reflect.DeepEqual(got, tc.want) {
t.Errorf("tryIdentifier: %#v, want %#v", got, tc.want)
}

8
cmd/hakurei/print.go
View File

@ -287,3 +287,11 @@ func mustPrintln(output io.Writer, a ...any) {
log.Fatalf("cannot print: %v", err)
}
}
// getMessage returns a [message.Error] message if available, or err prefixed with fallback otherwise.
func getMessage(fallback string, err error) string {
if m, ok := message.GetMessage(err); ok {
return m
}
return fmt.Sprintln(fallback, err)
}

2
nixos.nix
View File

@ -227,7 +227,7 @@ in
in
pkgs.runCommand "checked-${name}" { nativeBuildInputs = [ cfg.package ]; } ''
ln -vs ${file} "$out"
hakurei show ${file}
hakurei show --no-store ${file}
'';
in
pkgs.writeShellScriptBin app.name ''