324 lines
13 KiB
Zig
324 lines
13 KiB
Zig
//! The one way a configuration file becomes a `model.Config`.
|
|
//!
|
|
//! `nxdns run --config <file>` and `nxdns check --config <file>` must grade the
|
|
//! same file the same way, so the read, the error classification and the parse
|
|
//! live here rather than once per subcommand. `config/faults.zig` exists for the
|
|
//! same reason one layer up: two copies of a rule are two rules.
|
|
//!
|
|
//! **The classification.** `faults.isConfigFault` deliberately excludes
|
|
//! `FileNotFound` and `AccessDenied` in general — a missing file is usually a
|
|
//! broken box, not a wrong configuration. The managed file is the one place
|
|
//! where the opposite holds: the operator named that path, so a path that does
|
|
//! not resolve is a configuration fault (exit 2, `nxdns check` is the next
|
|
//! step). Only the path class converts:
|
|
//!
|
|
//! `FileNotFound`, `AccessDenied`, `PermissionDenied`, `NotDir`, `IsDir`,
|
|
//! `SymLinkLoop`, `NameTooLong`, `BadPathName` → `ManagedConfigUnreadable`
|
|
//!
|
|
//! Everything else `readFileAllocOptions` can return — `SystemResources`, the
|
|
//! two fd-quota errors, I/O failures, `OutOfMemory` — propagates unmapped and
|
|
//! exits 1. Those are box faults a retry can clear, and the shipped unit carries
|
|
//! `RestartPreventExitStatus=2 64`: mapping a transient failure to exit 2 would
|
|
//! stop the service permanently on a fault that would have cleared itself.
|
|
//!
|
|
//! The mapping is a named error set switched exhaustively with
|
|
//! `else => |other| return other`, so an error a Zig upgrade adds to
|
|
//! `ReadFileAllocError` defaults to exit 1 rather than silently to exit 2.
|
|
|
|
const std = @import("std");
|
|
const Allocator = std.mem.Allocator;
|
|
|
|
const model = @import("model.zig");
|
|
const validate = @import("validate.zig");
|
|
|
|
/// The ceiling on a configuration file. A file above it is a configuration
|
|
/// fault, not a resource failure: nothing an operator writes by hand comes near
|
|
/// 4 MiB, so this is a typo or a wrong path rather than a real config.
|
|
pub const max_config_bytes = 4 * 1024 * 1024;
|
|
|
|
/// Every error `readFileAllocOptions` can hand back, plus the parse.
|
|
pub const ReadError = std.Io.Dir.ReadFileAllocError;
|
|
|
|
/// The open failures that mean the operator's path is wrong rather than the box
|
|
/// being broken. Spelled out as a set rather than as switch prongs so that the
|
|
/// list is one thing a reader can find and a test can enumerate.
|
|
pub const PathFault = error{
|
|
FileNotFound,
|
|
AccessDenied,
|
|
PermissionDenied,
|
|
NotDir,
|
|
IsDir,
|
|
SymLinkLoop,
|
|
NameTooLong,
|
|
BadPathName,
|
|
};
|
|
|
|
pub const Error = ReadError || error{ ManagedConfigUnreadable, ConfigTooLarge, ParseZon };
|
|
|
|
/// The classification itself, pure and testable on its own: a path-class
|
|
/// failure becomes `ManagedConfigUnreadable`, the size limit becomes
|
|
/// `ConfigTooLarge`, and every other member travels unchanged.
|
|
pub fn mapReadError(e: ReadError) Error {
|
|
return switch (e) {
|
|
error.StreamTooLong => error.ConfigTooLarge,
|
|
error.FileNotFound,
|
|
error.AccessDenied,
|
|
error.PermissionDenied,
|
|
error.NotDir,
|
|
error.IsDir,
|
|
error.SymLinkLoop,
|
|
error.NameTooLong,
|
|
error.BadPathName,
|
|
=> error.ManagedConfigUnreadable,
|
|
else => |other| other,
|
|
};
|
|
}
|
|
|
|
/// The file, NUL-terminated because `std.zon.parse` needs a sentinel and
|
|
/// `readFileAlloc` cannot supply one. Errors travel exactly as the filesystem
|
|
/// returned them: `nxdns import` reads an operator-supplied argument, not a
|
|
/// managed file, and its exit codes are its own.
|
|
pub fn readSource(
|
|
io: std.Io,
|
|
gpa: Allocator,
|
|
dir: std.Io.Dir,
|
|
path: []const u8,
|
|
) ReadError![:0]u8 {
|
|
return dir.readFileAllocOptions(io, path, gpa, .limited(max_config_bytes), .of(u8), 0);
|
|
}
|
|
|
|
/// `readSource` under the managed-file classification, with the reason recorded
|
|
/// as a diagnostic. A Zig error carries no text, so the path an operator has to
|
|
/// go and fix reaches them through `Diagnostics` — the same channel every other
|
|
/// configuration problem travels down, and the reason `check` and `run` print
|
|
/// these in one shape.
|
|
pub fn readManaged(
|
|
io: std.Io,
|
|
gpa: Allocator,
|
|
dir: std.Io.Dir,
|
|
path: []const u8,
|
|
diags: *validate.Diagnostics,
|
|
) Error![:0]u8 {
|
|
return readSource(io, gpa, dir, path) catch |e| {
|
|
switch (e) {
|
|
error.StreamTooLong => try diags.add(
|
|
error.ConfigTooLarge,
|
|
"{s}",
|
|
.{path},
|
|
"larger than {d} bytes",
|
|
.{max_config_bytes},
|
|
),
|
|
error.FileNotFound => try diags.add(
|
|
error.ManagedConfigUnreadable,
|
|
"{s}",
|
|
.{path},
|
|
"no such file",
|
|
.{},
|
|
),
|
|
error.AccessDenied, error.PermissionDenied => try diags.add(
|
|
error.ManagedConfigUnreadable,
|
|
"{s}",
|
|
.{path},
|
|
"not readable",
|
|
.{},
|
|
),
|
|
error.IsDir => try diags.add(
|
|
error.ManagedConfigUnreadable,
|
|
"{s}",
|
|
.{path},
|
|
"is a directory, not a configuration file",
|
|
.{},
|
|
),
|
|
error.NotDir, error.SymLinkLoop, error.NameTooLong, error.BadPathName => try diags.add(
|
|
error.ManagedConfigUnreadable,
|
|
"{s}",
|
|
.{path},
|
|
"cannot be opened ({s})",
|
|
.{@errorName(e)},
|
|
),
|
|
// A box fault. It exits 1 with its own name and records nothing: a
|
|
// diagnostic would file it under "the configuration is wrong".
|
|
else => {},
|
|
}
|
|
return mapReadError(e);
|
|
};
|
|
}
|
|
|
|
/// The line and column of a ZON syntax error are the only thing the operator can
|
|
/// act on, so they travel the same channel as every other config problem: the
|
|
/// caller's `Diagnostics`, which `run`, `check` and `import` all render. The
|
|
/// global log is not that channel — an operator reading command output would see
|
|
/// a bare `ParseZon` and nothing else.
|
|
///
|
|
/// `std.zon.parse.Diagnostics` renders one "line:column: error: text" line per
|
|
/// problem, plus a "note:" line each, so each rendered line becomes one
|
|
/// `Problem` and the list keeps the parser's order. Rendering them inline would
|
|
/// put newlines inside a single `FAIL` record.
|
|
pub fn reportParseFailure(
|
|
diags: *validate.Diagnostics,
|
|
zon_diag: *const std.zon.parse.Diagnostics,
|
|
) error{OutOfMemory}!void {
|
|
const rendered = try std.fmt.allocPrint(diags.gpa, "{f}", .{zon_diag});
|
|
defer diags.gpa.free(rendered);
|
|
|
|
var lines = std.mem.splitScalar(u8, rendered, '\n');
|
|
while (lines.next()) |line| {
|
|
if (line.len == 0) continue;
|
|
try diags.add(error.ParseZon, "config", .{}, "{s}", .{line});
|
|
}
|
|
}
|
|
|
|
/// The parse, with its failure rendered. The result is arena-owned and
|
|
/// `std.zon.parse.free` is NEVER called on it: `Parser.parseStruct` fills an
|
|
/// absent field by copying the struct's default straight through
|
|
/// (parse.zig:874), so a defaulted `[]const u8` — and this model has many
|
|
/// non-empty string defaults — points into the binary's read-only data.
|
|
/// `parse.free` keeps no record of which fields were parsed and which were
|
|
/// defaulted, so it would `@memset` and free rodata. Freeing the arena is the
|
|
/// only correct release.
|
|
pub fn parse(
|
|
arena: Allocator,
|
|
source: [:0]const u8,
|
|
diags: *validate.Diagnostics,
|
|
) error{ ParseZon, OutOfMemory }!model.Config {
|
|
var zon_diag: std.zon.parse.Diagnostics = .{};
|
|
return std.zon.parse.fromSliceAlloc(model.Config, arena, source, &zon_diag, .{}) catch |e| switch (e) {
|
|
error.OutOfMemory => error.OutOfMemory,
|
|
error.ParseZon => {
|
|
try reportParseFailure(diags, &zon_diag);
|
|
return error.ParseZon;
|
|
},
|
|
};
|
|
}
|
|
|
|
/// Read and parse the managed file, everything a caller needs before
|
|
/// `validate.validate`. Validation is deliberately left to the caller: `check`
|
|
/// runs it beside its certificate and upstream probes, `run` runs it alone, and
|
|
/// both call the same validator on the same `Config`, which is what makes the
|
|
/// two agree.
|
|
///
|
|
/// `arena` owns both the source text and the returned configuration.
|
|
pub fn load(
|
|
io: std.Io,
|
|
arena: Allocator,
|
|
dir: std.Io.Dir,
|
|
path: []const u8,
|
|
diags: *validate.Diagnostics,
|
|
) Error!model.Config {
|
|
const source = try readManaged(io, arena, dir, path, diags);
|
|
return parse(arena, source, diags);
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// tests
|
|
// ---------------------------------------------------------------------------
|
|
|
|
const testing = std.testing;
|
|
|
|
test "every path-class open failure is a managed-config fault" {
|
|
inline for (@typeInfo(PathFault).error_set.?) |member| {
|
|
const e = @field(ReadError, member.name);
|
|
try testing.expectEqual(error.ManagedConfigUnreadable, mapReadError(e));
|
|
}
|
|
}
|
|
|
|
test "a box fault outside the path class propagates unmapped" {
|
|
// Each of these exits 1: a retry can clear them, and the shipped unit's
|
|
// `RestartPreventExitStatus=2 64` would make exit 2 permanent.
|
|
try testing.expectEqual(error.SystemResources, mapReadError(error.SystemResources));
|
|
try testing.expectEqual(error.ProcessFdQuotaExceeded, mapReadError(error.ProcessFdQuotaExceeded));
|
|
try testing.expectEqual(error.SystemFdQuotaExceeded, mapReadError(error.SystemFdQuotaExceeded));
|
|
try testing.expectEqual(error.OutOfMemory, mapReadError(error.OutOfMemory));
|
|
try testing.expectEqual(error.InputOutput, mapReadError(error.InputOutput));
|
|
}
|
|
|
|
test "the size limit is its own fault, not an unreadable path" {
|
|
try testing.expectEqual(error.ConfigTooLarge, mapReadError(error.StreamTooLong));
|
|
}
|
|
|
|
test "the path class is exactly the eight members the ruling names" {
|
|
// A member added to `PathFault` without a decision recorded in the spec
|
|
// fails here rather than quietly moving an exit code from 1 to 2.
|
|
const expected = [_][]const u8{
|
|
"FileNotFound", "AccessDenied", "PermissionDenied", "NotDir",
|
|
"IsDir", "SymLinkLoop", "NameTooLong", "BadPathName",
|
|
};
|
|
const members = @typeInfo(PathFault).error_set.?;
|
|
try testing.expectEqual(expected.len, members.len);
|
|
inline for (members) |member| {
|
|
var found = false;
|
|
for (expected) |name| {
|
|
if (std.mem.eql(u8, name, member.name)) found = true;
|
|
}
|
|
try testing.expect(found);
|
|
}
|
|
}
|
|
|
|
test "a missing managed file records the path and the reason" {
|
|
var tmp = testing.tmpDir(.{});
|
|
defer tmp.cleanup();
|
|
|
|
var diags: validate.Diagnostics = .init(testing.allocator);
|
|
defer diags.deinit();
|
|
|
|
var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
|
|
defer arena_state.deinit();
|
|
|
|
try testing.expectError(
|
|
error.ManagedConfigUnreadable,
|
|
load(testing.io, arena_state.allocator(), tmp.dir, "nope.zon", &diags),
|
|
);
|
|
try testing.expectEqual(@as(usize, 1), diags.failureCount());
|
|
try testing.expectEqualStrings("nope.zon", diags.problems.items[0].path);
|
|
try testing.expectEqualStrings("no such file", diags.problems.items[0].message);
|
|
}
|
|
|
|
test "a directory named as the managed file is a configuration fault, not a crash" {
|
|
var tmp = testing.tmpDir(.{});
|
|
defer tmp.cleanup();
|
|
try tmp.dir.createDirPath(testing.io, "sub");
|
|
|
|
var diags: validate.Diagnostics = .init(testing.allocator);
|
|
defer diags.deinit();
|
|
|
|
var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
|
|
defer arena_state.deinit();
|
|
|
|
try testing.expectError(
|
|
error.ManagedConfigUnreadable,
|
|
load(testing.io, arena_state.allocator(), tmp.dir, "sub", &diags),
|
|
);
|
|
try testing.expectEqual(@as(usize, 1), diags.failureCount());
|
|
}
|
|
|
|
test "load parses a valid file and renders a syntax error line by line" {
|
|
var tmp = testing.tmpDir(.{});
|
|
defer tmp.cleanup();
|
|
try tmp.dir.writeFile(testing.io, .{ .sub_path = "good.zon", .data =
|
|
\\.{
|
|
\\ .groups = .{ .{ .name = "default" } },
|
|
\\ .upstreams = .{ .{ .url = "https://dns.example/dns-query" } },
|
|
\\}
|
|
});
|
|
try tmp.dir.writeFile(testing.io, .{ .sub_path = "bad.zon", .data = ".{ .groups = " });
|
|
|
|
var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
|
|
defer arena_state.deinit();
|
|
const arena = arena_state.allocator();
|
|
|
|
var good_diags: validate.Diagnostics = .init(testing.allocator);
|
|
defer good_diags.deinit();
|
|
const cfg = try load(testing.io, arena, tmp.dir, "good.zon", &good_diags);
|
|
try testing.expectEqual(@as(usize, 0), good_diags.problems.items.len);
|
|
try testing.expectEqual(@as(usize, 1), cfg.upstreams.len);
|
|
|
|
var bad_diags: validate.Diagnostics = .init(testing.allocator);
|
|
defer bad_diags.deinit();
|
|
try testing.expectError(
|
|
error.ParseZon,
|
|
load(testing.io, arena, tmp.dir, "bad.zon", &bad_diags),
|
|
);
|
|
try testing.expect(bad_diags.failureCount() >= 1);
|
|
try testing.expectEqualStrings("config", bad_diags.problems.items[0].path);
|
|
}
|