myxce/src/controller/config_repl.h

#pragma once
/* config_repl.h — config storage, SHA-256, and replication functions */
#define _GNU_SOURCE
#include <stddef.h>
#include <stdint.h>
#include <time.h>

#include "myconf.h"
#include "clusterconfig.h"
#include "netio.h"
#include "request.h"

/* Max config blob size — reject before allocating */
#define CONF_MAX_SIZE (1 * 1024 * 1024)   /* 1 MiB */

/* Sentinel name for the synthetic lost-and-found queue and host */
#define XCE_LOST_AND_FOUND_NAME "lost_and_found"

/* Compile-time gate for OP_upgradeConfig (Phase 2, default disabled) */
#ifndef CONF_ENABLE_UPGRADE_CONFIG
#define CONF_ENABLE_UPGRADE_CONFIG 0
#endif

/* Push timeout for standby fan-out (ms) */
#ifndef CONF_PUSH_TIMEOUT_MS
#define CONF_PUSH_TIMEOUT_MS 500
#endif

/* Certificate expiry warning threshold (days) */
#define CERT_WARN_DAYS 30

/* ── Phase 1: Storage ────────────────────────────────────────── */

/*
 * conf_read_current_filename: read HEAD-style pointer file at
 * <workdir>/conf/current. Strips trailing newline. Validates format:
 * must start with "cluster.bin." followed by exactly 12 hex chars.
 * Returns 0 on success; -ENOENT if absent; -ENODATA if empty (zero-length);
 * -EINVAL if malformed (path separator, wrong prefix, wrong hex length).
 * out must be at least NAME_MAX bytes.
 */
int conf_read_current_filename(const char *workdir, char *out, size_t outsz);

/*
 * conf_save_config: atomically write versioned file and update HEAD pointer.
 * 1. Writes <conf_dir>/cluster.bin.<hex>.tmp, fsyncs, renames to versioned path.
 * 2. Writes <conf_dir>/current.<tid>.tmp, fsyncs, renames to conf/current.
 * 3. fsyncs the conf/ directory.
 * 4. Trims old versions.
 * 5. Updates myconf->conffile (heap-allocated via asprintf; caller must free).
 * 6. Updates myconf->config_version_tag and myconf->config_sha256.
 * Returns 0 on success, -errno on failure.
 */
int conf_save_config(myconf_t *myconf, const uint8_t *bytes, size_t len,
                     const uint8_t sha256[32]);

/*
 * conf_read_raw: read versioned file at conffile path.
 * Allocates *bytes (caller must free). Enforces CONF_MAX_SIZE.
 * Returns 0 on success; -EFBIG if exceeds limit; -errno on I/O error.
 */
int conf_read_raw(const char *conffile, uint8_t **bytes, size_t *len);

/*
 * conf_get_saved_tag: return first 8 bytes of SHA-256 of the current
 * versioned file in host byte order. Returns 0 if conf/current absent.
 * This is the "no config saved" zero-tag sentinel.
 */
uint64_t conf_get_saved_tag(const char *workdir);

/*
 * conf_check_stale: returns 1 if the current versioned file's mtime is
 * older than stale_timeout_s seconds. Returns 0 if within timeout or
 * if stale_timeout_s == 0 (disabled). Returns 0 if conf/current absent.
 */
int conf_check_stale(const char *workdir, time_t stale_timeout_s);

/*
 * conf_trim_old_versions: keep at most keep_n versioned cluster.bin.* files
 * sorted by mtime (newest first). Always preserves the file named by the
 * current conf/current pointer. Also removes stale .tmp files.
 */
void conf_trim_old_versions(const char *workdir, int keep_n);

/*
 * config_contains_reserved_name: returns 1 if ClusterConfig contains a
 * queue or host named "lost_and_found". Returns 0 for NULL config.
 * Checks queues[i]->queue (queue name) and hconfigs[i]->name (host name).
 */
int config_contains_reserved_name(cluster_config_t *cfg);

/*
 * create_lost_and_found: ensure the synthetic "lost_and_found" queue and
 * host exist before persist_recover() runs. Stub for Task 10.
 */
void create_lost_and_found(cluster_t *c);

/*
 * handle_config_request: handle an OP_replConfig request from a standby.
 * Reads the current versioned config blob and sends it back.
 * Stub for Task 8 (full implementation in Task 9).
 */
int handle_config_request(cluster_t *c, endpoint_t *ep, xce_request_t *req);

/*
 * push_config_to_standbys: fan-out a new config blob to all connected standby
 * controllers in parallel.  Best-effort — standbys that miss the push will
 * pull on reconnect via handle_config_request().
 * Returns the number of standbys that successfully received the push.
 * Only meaningful when CONF_ENABLE_UPGRADE_CONFIG is set, but always declared
 * so callers can reference it without an #if guard.
 */
int push_config_to_standbys(cluster_t *c, const uint8_t *bytes, size_t blen,
                            const uint8_t sha256[32], uint64_t new_tag);

/*
 * handle_upgrade_config: handle an OP_upgradeConfig request from an admin tool.
 * Validates, stores, and fans out the new config blob; triggers restart.
 * Only callable when CONF_ENABLE_UPGRADE_CONFIG is set.
 */
int handle_upgrade_config(cluster_t *c, endpoint_t *ep, xce_request_t *req);

/*
 * sanitise_cn: copy at most maxlen printable ASCII chars from src to a
 * static buffer, replacing non-printable/control chars with '?'.
 * Returns pointer to the static buffer. NOT thread-safe (static storage).
 */
char *sanitise_cn(const char *src, size_t maxlen);

#ifdef XCE_TESTING
/*
 * load_primary_config_for_test: test-only wrapper that exercises the path
 * resolution logic of load_primary_config() without calling FATAL.
 * Returns 0 if conf/current resolves to a valid filename, negative errno
 * otherwise. Does NOT perform Cap'n Proto decode or SHA-256 computation.
 */
int load_primary_config_for_test(cluster_t *c);
#endif