tabby-rdp 0.5.0 → 0.5.1

package/dist/drives.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SharedDrives = void 0;
+exports.SharedDrives = exports.WINDOW_OPEN_FILES = exports.MAX_OPEN_FILES = void 0;
 exports.sharedFolders = sharedFolders;
 exports.driveName = driveName;
+exports.openFilesInWindow = openFilesInWindow;
 const fs = require("fs");
 const path = require("path");
 const fsp = fs.promises;
@@ -43,6 +44,69 @@ function fail(code, message) {
 }
 /** One read's worth: the server asks for 64 KiB or so; the proxy takes messages up to 32 MiB. */
 const READ_LIMIT = 4 * 1024 * 1024;
+/**
+ * Files a desktop may have open at once. Each one holds a file descriptor of Tabby's window, which all its tabs and
+ * connections share, and the server decides how many it opens and when it closes them: with no limit, a hostile one
+ * could take them all, and the window could then open no file or connection, or crash. Programs on the remote keep
+ * far fewer open. More are refused (EMFILE) until the server closes some.
+ */
+exports.MAX_OPEN_FILES = 1024;
+/**
+ * Files all the desktops in a window may have open at once. The window's descriptors are one process's, so a limit per
+ * desktop alone would let several desktops together hold that many times more. The window may have 8192 open on
+ * Windows (the C runtime's most); on macOS, Node raises its soft limit to the hard one as it starts, which
+ * kern.maxfilesperproc caps (some 138,000 on a Mac measured with Electron 40). This many is a quarter of the smaller of
+ * those, which leaves most of them to everything else whatever the desktops do, and one desktop can't take it all
+ * (MAX_OPEN_FILES is half of it). On Linux the window's limit wasn't measured (the system's hard limit, often half a
+ * million or more, if Node raises it there as on macOS): where it is 4,096 or less, this many is half of it or more.
+ */
+exports.WINDOW_OPEN_FILES = 2 * exports.MAX_OPEN_FILES;
+/**
+ * Files open, being opened, or being closed, through every SharedDrives of this window (the plugin is loaded once per
+ * window). A file counts until its close has finished: closing waits for what is under way on the file (a slow disk or
+ * network folder), and the descriptor is the window's until then.
+ */
+let openInWindow = 0;
+/** Files open, being opened or being closed, on the desktops of this window (see WINDOW_OPEN_FILES). */
+function openFilesInWindow() {
+    return openInWindow;
+}
+/**
+ * Space a desktop leaves free on the disk a shared file is on when it makes the file larger than the data it sends:
+ * a write past the end of a file, or a larger end of file. One request can ask for any size, and where files can't
+ * have holes (HFS+, NTFS, exFAT) the space is taken at once, on the whole disk; elsewhere the file looks petabytes
+ * long, and grows again with every request. Explorer sets a copy's size before writing it, so sizes aren't capped as
+ * such: the part of a file the server sent no data for (its size beyond what it has on disk, see room) may be no
+ * larger than the disk's free space less this much (1 GB, or a twentieth of a disk smaller than 20 GB). Data the
+ * server does send isn't checked: that takes as long as any copy.
+ */
+function reserve(total) {
+    return Math.min(1024 ** 3, Math.floor(total / 20));
+}
+/**
+ * Growth on each disk (by device number) in this window, one at a time across its desktops: from the reading of the
+ * disk's free space (see room) until the file has grown. A check then never goes by free space another desktop's growth
+ * has taken since it was read, so two desktops can't each be told the same free space is theirs. The latest growth's
+ * end, which the next one on that disk waits for.
+ */
+const growth = new Map();
+/** Runs `grow` once the growth before it on disk `dev`, in any desktop of this window, has ended (see growth). */
+async function inTurn(dev, grow) {
+    const before = growth.get(dev);
+    let done = () => { };
+    const mine = new Promise(resolve => { done = resolve; });
+    growth.set(dev, mine);
+    try {
+        await before;
+        return await grow();
+    }
+    finally {
+        done();
+        if (growth.get(dev) === mine) {
+            growth.delete(dev);
+        }
+    }
+}
 /**
  * The shared folders as the remote desktop's file system (MS-RDPEFS drive redirection), on Tabby's Node side.
  * IronRDP asks one thing at a time and waits for the answer, so everything here is asynchronous (Node's thread
@@ -51,28 +115,59 @@ const READ_LIMIT = 4 * 1024 * 1024;
  * The server's paths are relative to the drive, with backslashes. Each resolves inside its folder, also once
  * symbolic links are followed: a path that leaves the folder, by `..` or through a link, doesn't exist as far as
  * the remote is concerned. Only regular files and folders are served (no devices, pipes or sockets, which could
- * block or do things on being opened). Read-only folders refuse anything that writes.
+ * block or do things on being opened). Read-only folders refuse anything that writes, and so does a file with more
+ * than one name (a hard link), which may be outside the folder too. What the server opens and how much space it
+ * takes without sending data are limited (MAX_OPEN_FILES and WINDOW_OPEN_FILES, reserve).
  */
 class SharedDrives {
-    constructor(folders, log = () => null) {
+    /** `flow`: the room for what is read for the server (the desktop's proxy, see ServerFlow and read). */
+    constructor(folders, log = () => null, flow) {
         this.log = log;
+        this.flow = flow;
         this.byId = new Map();
         this.roots = new Map();
         this.handles = new Map();
         this.nextHandle = 1;
+        /** Opens under way, which count towards MAX_OPEN_FILES too. */
+        this.opening = 0;
+        /** Closes under way, which count too: the descriptor is still open until the close has finished. */
+        this.closing = 0;
+        /** A limit on open files was reached (and logged, once). */
+        this.full = false;
+        /** The connection ended (see dispose): nothing more is opened, and what was still opening is closed again. */
+        this.disposed = false;
         // RDPDR device ids are the session's: the audio device, when there is one, takes 0 in IronRDP.
         this.drives = folders.map((folder, i) => {
             this.byId.set(i + 1, folder);
             return { id: i + 1, name: folder.name };
         });
     }
-    /** Closes whatever the server left open (the connection ended). */
+    /**
+     * Closes whatever the server left open (the connection ended), and what it was still opening once that is open.
+     * Each counts towards the limits until its close has finished (see closeFile), not before.
+     */
     dispose() {
+        this.disposed = true;
         for (const handle of this.handles.values()) {
-            handle.file.close().catch(() => null);
+            this.closeFile(handle.file).catch(() => null);
         }
         this.handles.clear();
     }
+    /**
+     * Closes a file that was counted as open (or being opened), and stops counting it once the close has finished,
+     * whether it worked or not: closing waits for what is under way on the file, and a slot handed on before then would
+     * let more descriptors be open than the limits allow.
+     */
+    async closeFile(file) {
+        this.closing++;
+        try {
+            await file.close();
+        }
+        finally {
+            this.closing--;
+            openInWindow--;
+        }
+    }
     /** The folder's own real path (it may be reached through a link itself, as /tmp is on macOS). */
     rootOf(folder) {
         let root = this.roots.get(folder);
@@ -139,6 +234,54 @@ class SharedDrives {
     handle(id) {
         return this.handles.get(id) ?? fail('EBADF', `no open file ${id}`);
     }
+    /**
+     * Makes sure the disk of an open file (`now`: its stat) can take the file being `end` bytes long without the server
+     * sending data for what that adds (see reserve). What counts is the part of the file that isn't on disk, from what
+     * the file has there, not from its size: on file systems with holes, growing a file takes no space, so growing it
+     * again and again would pass a check of each growth alone. Called in the disk's turn (see grow).
+     */
+    async room(handle, now, end) {
+        const space = await this.spaceOf(handle, now);
+        // 512-byte blocks, as POSIX counts them (and libuv on Windows); a file system that doesn't say has its size.
+        const onDisk = Number.isFinite(now.blocks) ? now.blocks * 512 : now.size;
+        const unsent = Math.max(0, end - onDisk);
+        if (unsent > space.bsize * space.bavail - reserve(space.bsize * space.blocks)) {
+            fail('ENOSPC', `${handle.folder.name}: not enough free space for a file ${end} bytes long`);
+        }
+    }
+    /**
+     * Makes an open file larger than the data the server sends for it, with `change`: `end` bytes long, with no data
+     * from `from` (past the end of the file now) on. In its disk's turn (see growth), once room() has checked the space
+     * against the file as it is then: another request may have changed it while this one waited its turn.
+     */
+    grow(handle, dev, from, end, change) {
+        return inTurn(dev, async () => {
+            const now = await handle.file.stat();
+            if (from > now.size) {
+                await this.room(handle, now, end);
+            }
+            return change();
+        });
+    }
+    /**
+     * The free space of the disk an open file (`now`) is on: that of the folder it was opened in, or else of the shared
+     * folder, whichever is on that disk (the same device). A disk mounted somewhere in a shared folder (a USB stick in
+     * a shared /Volumes, a disk image in a shared home) has its own free space, which the shared folder's doesn't say.
+     * When neither is on it (the file's folder was moved away meanwhile), the space isn't known, and the file isn't
+     * grown (ENOSPC).
+     */
+    async spaceOf(handle, now) {
+        for (const dir of [path.dirname(handle.local), await this.rootOf(handle.folder).catch(() => null)]) {
+            if (dir === null) {
+                continue;
+            }
+            const [at, space] = await Promise.all([fsp.stat(dir), fsp.statfs(dir)]).catch(() => [null, null]);
+            if (at && space && at.dev === now.dev) {
+                return space;
+            }
+        }
+        return fail('ENOSPC', `${handle.folder.name}: the free space of this file's disk isn't known`);
+    }
     async stat(deviceId, remote) {
         let s;
         let folder;
@@ -163,7 +306,8 @@ class SharedDrives {
             created: s.birthtimeMs || s.ctimeMs,
             accessed: s.atimeMs,
             modified: s.mtimeMs,
-            readonly: folder.readOnly || (s.mode & 0o200) === 0,
+            // A file with other names (hard links) isn't changed through the share (see open), so it shows read-only.
+            readonly: folder.readOnly || (s.mode & 0o200) === 0 || (s.isFile() && s.nlink > 1),
         };
     }
     async list(deviceId, remote) {
@@ -171,6 +315,43 @@ class SharedDrives {
         return fsp.readdir(local);
     }
     async open(deviceId, remote, mode) {
+        if (this.disposed) {
+            fail('EBADF', `${remote}: the connection has ended`);
+        }
+        const mine = this.handles.size + this.opening + this.closing >= exports.MAX_OPEN_FILES;
+        if (mine || openInWindow >= exports.WINDOW_OPEN_FILES) {
+            if (!this.full) {
+                this.full = true;
+                this.log(mine
+                    ? `drives: the remote has ${exports.MAX_OPEN_FILES} files open, the most a desktop may; more are refused until it closes some`
+                    : `drives: the desktops in this window have ${exports.WINDOW_OPEN_FILES} files open, the most they may together; more are refused until some are closed`);
+            }
+            fail('EMFILE', `${remote}: ${mine ? exports.MAX_OPEN_FILES : exports.WINDOW_OPEN_FILES} files are open already`);
+        }
+        this.opening++;
+        openInWindow++;
+        let handle;
+        try {
+            handle = await this.openFile(deviceId, remote, mode);
+        }
+        catch (e) {
+            openInWindow--;
+            throw e;
+        }
+        finally {
+            this.opening--;
+        }
+        // The connection ended while the file was being opened: dispose() has closed the others, and nothing would
+        // close this one.
+        if (this.disposed) {
+            await this.closeFile(handle.file).catch(() => null);
+            fail('EBADF', `${remote}: the connection has ended`);
+        }
+        const id = this.nextHandle++;
+        this.handles.set(id, handle);
+        return id;
+    }
+    async openFile(deviceId, remote, mode) {
         const { folder, local } = await this.locate(deviceId, remote, true);
         if (mode.write || mode.create || mode.truncate) {
             this.writable(folder, `can't write ${remote}`);
@@ -180,51 +361,109 @@ class SharedDrives {
             fail(existing.isDirectory() ? 'EISDIR' : 'EACCES', `${remote}: not a file`);
         }
         // The path was resolved just now: a link (or a pipe) put in its place meanwhile isn't followed (or waited on).
-        const { O_RDONLY, O_RDWR, O_CREAT, O_EXCL, O_TRUNC } = fs.constants;
+        // Truncating waits until the file is known to be one the remote may change (below).
+        const { O_RDONLY, O_RDWR, O_CREAT, O_EXCL } = fs.constants;
         const guard = (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0);
-        const flags = (mode.write ? O_RDWR : O_RDONLY) | (mode.create ? O_CREAT : 0) | (mode.exclusive ? O_EXCL : 0) | (mode.truncate ? O_TRUNC : 0) | guard;
+        const flags = (mode.write || mode.truncate ? O_RDWR : O_RDONLY) | (mode.create ? O_CREAT : 0) | (mode.exclusive ? O_EXCL : 0) | guard;
         const file = await fsp.open(local, flags, 0o644);
-        if (!(await file.stat()).isFile()) {
-            await file.close();
-            fail('EACCES', `${remote}: not a file`);
+        try {
+            const s = await file.stat();
+            if (!s.isFile()) {
+                fail('EACCES', `${remote}: not a file`);
+            }
+            // A file with another name (a hard link) is the same file there, which may be outside the shared folder:
+            // what the remote writes would change it there too. Reading it is reading what is in the folder.
+            if ((mode.write || mode.truncate) && s.nlink > 1) {
+                fail('EACCES', `${remote}: has more than one name (a hard link), so it isn't changed from the remote`);
+            }
+            if (mode.truncate) {
+                await file.truncate(0);
+            }
         }
-        const id = this.nextHandle++;
-        this.handles.set(id, { file, folder });
-        return id;
+        catch (e) {
+            await file.close().catch(() => null);
+            throw e;
+        }
+        return { file, folder, local };
     }
+    /**
+     * A read of the server's: up to READ_LIMIT, as much as it asks for. Its answer is handed to the connection, where
+     * it stays, in the window's memory, until the proxy has read it, as the server takes what is sent: a server that
+     * keeps asking and reads slowly, or not at all, would otherwise have every answer kept there. So it takes room for
+     * it first (see ServerFlow), waiting while there is none, and gives back what it didn't read.
+     *
+     * How far the room holds the answers back: see ServerFlow (the proxy reading the connection's other messages makes
+     * room too).
+     */
     async read(handle, offset, length) {
+        const size = Math.min(length, READ_LIMIT);
+        while (this.flow && !this.flow.room()) {
+            await this.flow.whenRoom();
+        }
         const { file } = this.handle(handle);
-        const buffer = Buffer.allocUnsafe(Math.min(length, READ_LIMIT));
+        this.flow?.spend(size);
+        const buffer = Buffer.allocUnsafe(size);
         let read = 0;
-        // A read can come back short before the end of the file: fill what was asked.
-        while (read < buffer.length) {
-            const { bytesRead } = await file.read(buffer, read, buffer.length - read, offset + read);
-            if (bytesRead === 0) {
-                break;
+        try {
+            // A read can come back short before the end of the file: fill what was asked.
+            while (read < buffer.length) {
+                const { bytesRead } = await file.read(buffer, read, buffer.length - read, offset + read);
+                if (bytesRead === 0) {
+                    break;
+                }
+                read += bytesRead;
             }
-            read += bytesRead;
         }
+        catch (e) {
+            this.flow?.refund(size);
+            throw e;
+        }
+        this.flow?.refund(size - read);
         return new Uint8Array(buffer.buffer, buffer.byteOffset, read);
     }
     async write(handle, offset, data) {
-        const { file, folder } = this.handle(handle);
+        const entry = this.handle(handle);
+        const { file, folder } = entry;
         this.writable(folder, 'can\'t write');
-        let written = 0;
-        while (written < data.length) {
-            written += (await file.write(data, written, data.length - written, offset + written)).bytesWritten;
+        const end = offset + data.length;
+        if (!(offset >= 0 && Number.isSafeInteger(offset) && Number.isSafeInteger(end))) {
+            fail('ENOSPC', `can't write at ${offset}: past what a file can hold`);
         }
-        return written;
+        const writeAll = async () => {
+            let written = 0;
+            while (written < data.length) {
+                written += (await file.write(data, written, data.length - written, offset + written)).bytesWritten;
+            }
+            return written;
+        };
+        // Past the end of the file, the gap up to the data is made as well, with nothing sent for it (see room).
+        if (offset > 0) {
+            const now = await file.stat();
+            if (offset > now.size) {
+                return this.grow(entry, now.dev, offset, end, writeAll);
+            }
+        }
+        return writeAll();
     }
     async truncate(handle, size) {
-        const { file, folder } = this.handle(handle);
+        const entry = this.handle(handle);
+        const { file, folder } = entry;
         this.writable(folder, 'can\'t resize');
+        if (!(size >= 0 && Number.isSafeInteger(size))) {
+            fail('ENOSPC', `can't make a file ${size} bytes long`);
+        }
+        // A larger end of file: what it adds has no data sent for it (see room).
+        const now = await file.stat();
+        if (size > now.size) {
+            return this.grow(entry, now.dev, size, size, () => file.truncate(size));
+        }
         await file.truncate(size);
     }
     async close(handle) {
         const entry = this.handles.get(handle);
         if (entry) {
             this.handles.delete(handle);
-            await entry.file.close();
+            await this.closeFile(entry.file);
         }
     }
     async mkdir(deviceId, remote) {
@@ -272,7 +511,10 @@ class SharedDrives {
         const folder = this.byId.get(deviceId) ?? fail('ENOENT', `no drive ${deviceId}`);
         try {
             const s = await fsp.statfs(await this.rootOf(folder));
-            return { total: s.bsize * s.blocks, free: s.bsize * s.bavail, label: folder.name };
+            const total = s.bsize * s.blocks;
+            // Free space less the reserve, which the remote can't take by making files larger (see room): Explorer
+            // checks a copy fits before starting it.
+            return { total, free: Math.max(0, s.bsize * s.bavail - reserve(total)), label: folder.name };
         }
         catch (e) {
             this.log(`drives: ${folder.name}: no volume information: ${e?.message ?? e}`);
@@ -281,4 +523,3 @@ class SharedDrives {
     }
 }
 exports.SharedDrives = SharedDrives;
-//# sourceMappingURL=drives.js.map