Collect modification time in list_winreg_keys.

Author: panhania

crates/rrg/src/action/list_winreg_keys.rs

@@ -23,6 +23,8 @@ struct Item {
     key: std::ffi::OsString,
     /// Listed subkey relative to `root` and `key`.
     subkey: std::ffi::OsString,
+    /// Last modification time of the listed subkey.
+    modified: Option<std::time::SystemTime>,
 }
 
 /// Handles invocations of the `list_winreg_keys` action.
@@ -33,11 +35,15 @@ where
 {
     let key = args.root.open(&args.key)
         .map_err(crate::session::Error::action)?;
+    let key_info = key.info()
+        .map_err(crate::session::Error::action)?;
 
     /// Single "stack frame" of the recursive key listing procedure.
     struct PendingKey {
         /// Handle to the key specified in the `key_rel_name`.
         key: winreg::OpenKey,
+        /// Information about the key specified in the `key_rel_name`.
+        key_info: winreg::KeyInfo,
         /// Name of the `key` relative to the key from which we started.
         key_rel_name: std::ffi::OsString,
         /// Current depth of the recursive walk.
@@ -50,31 +56,22 @@ where
     let mut pending_keys = Vec::new();
     pending_keys.push(PendingKey {
         key,
+        key_info,
         key_rel_name: std::ffi::OsString::new(),
         depth: 0,
     });
 
     loop {
         let PendingKey {
             key,
+            key_info,
             key_rel_name,
             depth,
         } = match pending_keys.pop() {
             Some(pending_key) => pending_key,
             None => break,
         };
 
-        let key_info = match key.info() {
-            Ok(key_info) => key_info,
-            Err(error) => {
-                log::error! {
-                    "failed to obtain information for key {:?}: {}",
-                    winreg::path::join(&args.key, &key_rel_name), error,
-                };
-                continue
-            }
-        };
-
         for subkey_name in key_info.subkeys() {
             let subkey_name = match subkey_name {
                 Ok(subkey_name) => subkey_name,
@@ -88,30 +85,54 @@ where
             };
             let subkey_rel_name = winreg::path::join(&key_rel_name, &subkey_name);
 
-            if depth + 1 < args.max_depth {
-                match key.open(&subkey_name) {
-                    Ok(subkey) => {
-                        pending_keys.push(PendingKey {
-                            key: subkey,
-                            key_rel_name: subkey_rel_name.clone(),
-                            depth: depth + 1,
-                        });
-                    }
-                    Err(error) => {
-                        log::error! {
-                            "failed to open subkey '{:?}': {}",
-                            winreg::path::join(&key_rel_name, &subkey_name), error,
-                        };
-                    }
+            let subkey = match key.open(&subkey_name) {
+                Ok(subkey) => subkey,
+                Err(error) => {
+                    log::error! {
+                        "failed to open subkey '{:?}': {error}",
+                        subkey_rel_name,
+                    };
+                    continue
                 }
-            }
+            };
+            let subkey_info = match subkey.info() {
+                Ok(subkey_info) => subkey_info,
+                Err(error) => {
+                    log::error! {
+                        "failed to obtain information for subkey {:?}: {error}",
+                        subkey_rel_name,
+                    };
+                    continue
+                }
+            };
+
+            let modified = match subkey_info.modified() {
+                Ok(modified) => Some(modified),
+                Err(error) => {
+                    log::error! {
+                        "failed to obtain modification time for subkey {:?}: {error}",
+                        subkey_rel_name,
+                    };
+                    None
+                }
+            };
 
             session.reply(Item {
                 root: args.root,
                 // TODO(@panhania): Add support for case-correcting the key.
                 key: args.key.clone(),
-                subkey: subkey_rel_name,
+                subkey: subkey_rel_name.clone(),
+                modified,
             })?;
+
+            if depth + 1 < args.max_depth {
+                pending_keys.push(PendingKey {
+                    key: subkey,
+                    key_info: subkey_info,
+                    key_rel_name: subkey_rel_name,
+                    depth: depth + 1,
+                });
+            }
         }
     }
 
@@ -160,6 +181,10 @@ impl crate::response::Item for Item {
         proto.set_key(self.key.to_string_lossy().into_owned());
         proto.set_subkey(self.subkey.to_string_lossy().into_owned());
 
+        if let Some(modified) = self.modified {
+            proto.set_modification_time(modified.into());
+        }
+
         proto
     }
 }

crates/winreg/src/windows.rs

@@ -153,6 +153,8 @@ pub struct KeyInfo {
     max_value_name_len: u32,
     // Maximum length of the value data (in bytes).
     max_value_data_len: u32,
+    // Last modification time of this key.
+    modified: Result<std::time::SystemTime, UnsupportedFiletimeError>,
 }
 
 impl KeyInfo {
@@ -189,6 +191,11 @@ impl KeyInfo {
             data_buf: Vec::with_capacity(self.max_value_data_len as usize),
         }
     }
+
+    /// Returns the last modification time of this key.
+    pub fn modified(&self) -> std::io::Result<std::time::SystemTime> {
+        self.modified.map_err(|error| std::io::Error::from(error))
+    }
 }
 
 /// Iterator over registry key subkey names.
@@ -612,6 +619,8 @@ unsafe fn query_raw_key_info(
     let mut max_value_name_len = std::mem::MaybeUninit::uninit();
     let mut max_value_data_len = std::mem::MaybeUninit::uninit();
 
+    let mut last_write_time = std::mem::MaybeUninit::uninit();
+
     // SAFETY: This is just an FFI call as described in the docs [1].
     //
     // [1]: https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryinfokeyw
@@ -628,7 +637,7 @@ unsafe fn query_raw_key_info(
             max_value_name_len.as_mut_ptr(),
             max_value_data_len.as_mut_ptr(),
             std::ptr::null_mut(),
-            std::ptr::null_mut(),
+            last_write_time.as_mut_ptr(),
         )
     };
 
@@ -653,6 +662,11 @@ unsafe fn query_raw_key_info(
         max_value_data_len: unsafe {
             max_value_data_len.assume_init()
         },
+        // SAFETY: We verified that the call above succeeded, the value is now
+        // initialized.
+        modified: filetime_to_system_time(unsafe {
+            last_write_time.assume_init()
+        }),
     })
 }
 
@@ -743,6 +757,82 @@ unsafe fn query_raw_key_value_data(
         .map_err(std::io::Error::from)
 }
 
+/// Converts the given Windows `FILETIME` object to Rust's [`SystemTime`].
+///
+/// [`SystemTime`]: std::time::SystemTime
+fn filetime_to_system_time(
+    filetime: windows_sys::Win32::Foundation::FILETIME,
+) -> Result<std::time::SystemTime, UnsupportedFiletimeError> {
+    let epoch_win_nanos100 = {
+        let hi = u64::from(filetime.dwHighDateTime);
+        let lo = u64::from(filetime.dwLowDateTime);
+        (hi << u32::BITS) | lo
+    };
+    // So, we have the last write time in 100-nanosecond intervals since Windows
+    // epoch, i.e. January 1, 1601 [1]. A difference between that and the UNIX
+    // epoch is 11,644,473,600 seconds [2, 3].
+    //
+    // [1]: https://learn.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime
+    // [2]: https://learn.microsoft.com/en-us/windows/win32/sysinfo/converting-a-time-t-value-to-a-file-time
+    // [3]: https://devblogs.microsoft.com/oldnewthing/20220602-00/?p=106706
+    let epoch_win_secs = {
+        epoch_win_nanos100 / (1_000_000_000 / 100)
+    };
+    let epoch_win_nanos = {
+        epoch_win_nanos100 % (1_000_000_000 / 100) * 100
+    };
+    let epoch_win_since = {
+        std::time::Duration::from_secs(epoch_win_secs) +
+        std::time::Duration::from_nanos(epoch_win_nanos)
+    };
+    let epoch_unix_since = epoch_win_since
+        // Windows epoch is before the UNIX one, so it is possible to underflow
+        // here.
+        .checked_sub(std::time::Duration::from_secs(11_644_473_600))
+        .ok_or(UnsupportedFiletimeError::Underflow(epoch_win_nanos100))?;
+
+    std::time::SystemTime::UNIX_EPOCH
+        // Generally this should not overflow as we started with a valid 64-bit
+        // value and then did a bunch of conversions to reach `SystemTime` that
+        // internally uses what we started with. But in practice if we pass max
+        // `FILETIME` object this does overflow so we need to back ourselves up.
+        .checked_add(epoch_unix_since)
+        .ok_or(UnsupportedFiletimeError::Overflow(epoch_win_nanos100))
+}
+
+#[derive(Clone, Copy, Debug)]
+enum UnsupportedFiletimeError {
+    Underflow(u64),
+    Overflow(u64),
+}
+
+impl std::fmt::Display for UnsupportedFiletimeError {
+
+    fn fmt(&self, fmt: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(fmt, "filetime value ")?;
+        match *self {
+            UnsupportedFiletimeError::Underflow(value) => {
+                write!(fmt, "underflow: {value}")?
+            }
+            UnsupportedFiletimeError::Overflow(value) => {
+                write!(fmt, "overflow: {value}")?
+            }
+        }
+
+        Ok(())
+    }
+}
+
+impl std::error::Error for UnsupportedFiletimeError {
+}
+
+impl From<UnsupportedFiletimeError> for std::io::Error {
+
+    fn from(error: UnsupportedFiletimeError) -> std::io::Error {
+        std::io::Error::new(std::io::ErrorKind::Unsupported, error)
+    }
+}
+
 #[cfg(test)]
 mod tests {
 
@@ -903,4 +993,27 @@ mod tests {
 
         assert!(matches!(current, ValueData::U32(_)));
     }
+
+    #[test]
+    fn filetime_to_system_time_epoch_win() {
+        let epoch_win = windows_sys::Win32::Foundation::FILETIME {
+            dwLowDateTime: 0,
+            dwHighDateTime: 0,
+        };
+
+        // Windows epoch is before the UNIX one.
+        let error = filetime_to_system_time(epoch_win).unwrap_err();
+        assert!(matches!(error, UnsupportedFiletimeError::Underflow(_)));
+    }
+
+    #[test]
+    fn filetime_to_system_max() {
+        let max = windows_sys::Win32::Foundation::FILETIME {
+            dwLowDateTime: u32::MAX,
+            dwHighDateTime: u32::MAX,
+        };
+
+        // We just want to verify that this does not panic.
+        let _ = filetime_to_system_time(max);
+    }
 }

proto/rrg/action/list_winreg_keys.proto

@@ -7,6 +7,7 @@ syntax = "proto3";
 package rrg.action.list_winreg_keys;
 
 import "rrg/winreg.proto";
+import "google/protobuf/timestamp.proto";
 
 message Args {
     // Root predefined key of the key to list subkeys of.
@@ -31,4 +32,7 @@ message Result {
 
     // Listed subkey relative to `root` and `key`.
     string subkey = 3;
+
+    // Last modification time of the listed subkey.
+    google.protobuf.Timestamp modification_time = 4;
 }