kobako 0.29.0 → 0.30.0

data/crates/kobako-wasmtime/src/preview1/differential.rs

@@ -15,7 +15,7 @@ use wasmtime_wasi::p1::{self, WasiP1Ctx};
 use wasmtime_wasi::p2::pipe::{MemoryInputPipe, MemoryOutputPipe};
 use wasmtime_wasi::WasiCtxBuilder;
 
-use crate::cache::shared_engine;
+use crate::cache::load_engine;
 use crate::config::Config;
 use crate::imports;
 use crate::invocation::Invocation;
@@ -91,6 +91,7 @@ const PROBE_WAT: &str = r#"
   (func (export "fd_fdstat_set_rights") (param i32) (result i32) (call $fd_fdstat_set_rights (local.get 0) (i64.const 0) (i64.const 0)))
   (func (export "fd_filestat_get") (param i32) (result i32) (call $fd_filestat_get (local.get 0) (i32.const 256)))
   (func (export "fd_filestat_set_size") (param i32) (result i32) (call $fd_filestat_set_size (local.get 0) (i64.const 0)))
+  (func (export "fd_filestat_set_size_huge") (param i32) (result i32) (call $fd_filestat_set_size (local.get 0) (i64.const -1)))
   (func (export "fd_filestat_set_times") (param i32) (result i32) (call $fd_filestat_set_times (local.get 0) (i64.const 0) (i64.const 0) (i32.const 0)))
   (func (export "fd_pread") (param i32) (result i32) (call $fd_pread (local.get 0) (i32.const 64) (i32.const 1) (i64.const 0) (i32.const 128)))
   (func (export "fd_prestat_get") (param i32) (result i32) (call $fd_prestat_get (local.get 0) (i32.const 256)))
@@ -282,7 +283,7 @@ fn observe<T>(
 }
 
 fn through_kobako(call: &str, fd: i32, limit: Option<usize>) -> Observation {
-    let engine = shared_engine().expect("shared engine must be constructible");
+    let engine = load_engine().expect("shared engine must be constructible");
     let config = Config {
         timeout: None,
         setup_timeout: None,
@@ -291,8 +292,9 @@ fn through_kobako(call: &str, fd: i32, limit: Option<usize>) -> Observation {
         stderr_limit: limit,
         open_file_limit: None,
         profile: Profile::Hermetic,
+        security: Vec::new(),
     };
-    let wasi = Wasi::for_invocation(&config, PREAMBLE, &[]).expect("WASI context must build");
+    let wasi = Wasi::for_invocation(&config, stdin_bytes(), &[]).expect("WASI context must build");
     let mut store = Store::new(engine, Invocation::new(None, wasi));
     store.set_epoch_deadline(NO_TIMEOUT_EPOCH_DELTA);
     let linker = imports::linker().expect("host imports must link");
@@ -310,9 +312,9 @@ struct Oracle {
 }
 
 fn through_wasmtime_wasi(call: &str, fd: i32, limit: Option<usize>) -> Observation {
-    let engine = shared_engine().expect("shared engine must be constructible");
-    let stdout = MemoryOutputPipe::new(crate::capture::pipe_capacity(limit));
-    let stderr = MemoryOutputPipe::new(crate::capture::pipe_capacity(limit));
+    let engine = load_engine().expect("shared engine must be constructible");
+    let stdout = MemoryOutputPipe::new(kobako_runtime::endpoint::pipe_capacity(limit));
+    let stderr = MemoryOutputPipe::new(kobako_runtime::endpoint::pipe_capacity(limit));
     let ctx = WasiCtxBuilder::new()
         .stdin(MemoryInputPipe::new(stdin_bytes()))
         .stdout(stdout.clone())
@@ -360,8 +362,18 @@ fn every_descriptor_call_answers_as_wasmtime_wasi_preview1() {
     for limit in CHANNEL_LIMITS {
         for call in CALLS {
             for fd in 0..=3 {
+                let kobako = through_kobako(call, fd, limit);
+                if let Some(errno) = answered_as_linux(call, fd) {
+                    assert_eq!(
+                        kobako.errno,
+                        Some(errno),
+                        "{call} on descriptor {fd} through kobako's preview1 imports must answer \
+                         as Linux does"
+                    );
+                    continue;
+                }
                 assert_eq!(
-                    through_kobako(call, fd, limit),
+                    kobako,
                     through_wasmtime_wasi(call, fd, limit),
                     "{call} on descriptor {fd} with Channels capped at {limit:?} through \
                      kobako's preview1 imports must answer as wasmtime-wasi's preview1 does"
@@ -370,3 +382,105 @@ fn every_descriptor_call_answers_as_wasmtime_wasi_preview1() {
         }
     }
 }
+
+/// Where kobako parts from wasmtime-wasi, the errno Linux answers, which
+/// outranks it. For a standard stream it answers as for a pipe: an offset, a
+/// sync, or a size is no pipe's, and a pipe is no directory to open beneath.
+/// Linux also takes `O_APPEND` on a pipe, reports one link where wasmtime-wasi
+/// reports none, checks neither path nor descriptor for a call setting no
+/// time, as `utimensat` returns first, and reports a wait on a descriptor not
+/// open in its event, as `poll` marks it `POLLNVAL`.
+fn answered_as_linux(call: &str, fd: i32) -> Option<i32> {
+    const ERRNO_SUCCESS: i32 = 0;
+    const ERRNO_INVAL: i32 = 28;
+    const ERRNO_NOTDIR: i32 = 54;
+    const ERRNO_SPIPE: i32 = 70;
+    match (call, fd) {
+        ("fd_filestat_set_times" | "path_filestat_set_times", 3) => Some(ERRNO_SUCCESS),
+        ("poll_oneoff_read" | "poll_oneoff_write", 3) => Some(ERRNO_SUCCESS),
+        ("fd_advise", 0..=2) => Some(ERRNO_SPIPE),
+        ("fd_allocate" | "fd_sync" | "fd_datasync" | "fd_filestat_set_size", 0..=2) => {
+            Some(ERRNO_INVAL)
+        }
+        (
+            "fd_fdstat_set_flags"
+            | "fd_filestat_get"
+            | "fd_filestat_set_times"
+            | "path_filestat_set_times",
+            0..=2,
+        ) => Some(ERRNO_SUCCESS),
+        ("fd_read_empty", 0) => Some(ERRNO_SUCCESS),
+        ("fd_readdir" | "fd_readdir_far", 0..=2) => Some(ERRNO_NOTDIR),
+        (
+            "path_create_directory"
+            | "path_filestat_get"
+            | "path_link"
+            | "path_open"
+            | "path_readlink"
+            | "path_remove_directory"
+            | "path_rename"
+            | "path_symlink"
+            | "path_unlink_file",
+            0..=2,
+        ) => Some(ERRNO_NOTDIR),
+        ("fd_pread" | "fd_pread_far", 1 | 2) => Some(ERRNO_SPIPE),
+        ("fd_pwrite" | "fd_pwrite_far", 0) => Some(ERRNO_SPIPE),
+        _ => None,
+    }
+}
+
+// wasmtime-wasi fails the whole wait; the witx gives each event its own error,
+// and Linux's `do_pollfd` marks the descriptor `POLLNVAL`, which wasi-libc reads
+// back from an event's EBADF.
+// @behavior RT-295
+#[test]
+fn a_wait_on_a_descriptor_not_open_reports_it_in_its_event() {
+    let read = through_kobako("poll_oneoff_read", 3, None);
+    let write = through_kobako("poll_oneoff_write", 3, None);
+    let event = |seen: &Observation| {
+        (
+            seen.errno,
+            u64::from_le_bytes(seen.memory[896..904].try_into().expect("eight bytes")),
+            u16::from_le_bytes([seen.memory[904], seen.memory[905]]),
+            u32::from_le_bytes(seen.memory[128..132].try_into().expect("four bytes")),
+        )
+    };
+    assert_eq!(
+        (event(&read), event(&write)),
+        ((Some(0), 7, 8, 1), (Some(0), 7, 8, 1)),
+        "poll_oneoff on descriptor 3, not open, through kobako's preview1 imports must succeed \
+         with one event whose error is EBADF, as Linux's poll marks it POLLNVAL"
+    );
+}
+
+// Linux's `ksys_ftruncate` reads the length as a signed `loff_t` and refuses a
+// negative one before it looks for the descriptor.
+// @behavior RT-296
+#[test]
+fn a_size_no_file_can_take_answers_before_the_descriptor_is_found() {
+    assert_eq!(
+        through_kobako("fd_filestat_set_size_huge", 3, None).errno,
+        Some(28),
+        "fd_filestat_set_size of 2^64 - 1 on descriptor 3, not open, through kobako's preview1 \
+         imports must answer EINVAL, as ftruncate checks the length before the descriptor"
+    );
+}
+
+// wasmtime-wasi answers EBADF for the end a call cannot use; Linux reads
+// `FMODE_PREAD` first, and a pipe has none on either end.
+// @behavior RT-178
+#[test]
+fn a_standard_stream_takes_no_offset() {
+    let errno = |call, fd| through_kobako(call, fd, None).errno;
+    assert_eq!(
+        [
+            errno("fd_pread", 0),
+            errno("fd_pread", 1),
+            errno("fd_pwrite", 0),
+            errno("fd_pwrite", 1),
+        ],
+        [Some(70), Some(70), Some(70), Some(70)],
+        "fd_pread and fd_pwrite on standard input and output through kobako's preview1 imports \
+         must answer ESPIPE, as Linux answers for a pipe's either end"
+    );
+}

data/crates/kobako-wasmtime/src/preview1/errno.rs

@@ -2,223 +2,86 @@
 //! the guest reads, or a trap that ends the invocation.
 
 use kobako_runtime::filesystem::FilesystemError;
-use kobako_runtime::mount::Denial;
+use wiggle::GuestError;
 
-/// One preview1 `errno`, numbered as the witx `$errno` enum numbers it.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-#[repr(u16)]
-pub(crate) enum Errno {
-    TooBig = 1,
-    Acces = 2,
-    Addrinuse = 3,
-    Addrnotavail = 4,
-    Afnosupport = 5,
-    Again = 6,
-    Already = 7,
-    Badf = 8,
-    Badmsg = 9,
-    Busy = 10,
-    Canceled = 11,
-    Child = 12,
-    Connaborted = 13,
-    Connrefused = 14,
-    Connreset = 15,
-    Deadlk = 16,
-    Destaddrreq = 17,
-    Dom = 18,
-    Dquot = 19,
-    Exist = 20,
-    Fault = 21,
-    Fbig = 22,
-    Hostunreach = 23,
-    Idrm = 24,
-    Ilseq = 25,
-    Inprogress = 26,
-    Intr = 27,
-    Inval = 28,
-    Io = 29,
-    Isconn = 30,
-    Isdir = 31,
-    Loop = 32,
-    Mfile = 33,
-    Mlink = 34,
-    Msgsize = 35,
-    Multihop = 36,
-    Nametoolong = 37,
-    Netdown = 38,
-    Netreset = 39,
-    Netunreach = 40,
-    Nfile = 41,
-    Nobufs = 42,
-    Nodev = 43,
-    Noent = 44,
-    Noexec = 45,
-    Nolck = 46,
-    Nolink = 47,
-    Nomem = 48,
-    Nomsg = 49,
-    Noprotoopt = 50,
-    Nospc = 51,
-    Nosys = 52,
-    Notconn = 53,
-    Notdir = 54,
-    Notempty = 55,
-    Notrecoverable = 56,
-    Notsock = 57,
-    Notsup = 58,
-    Notty = 59,
-    Nxio = 60,
-    Overflow = 61,
-    Ownerdead = 62,
-    Perm = 63,
-    Pipe = 64,
-    Proto = 65,
-    Protonosupport = 66,
-    Prototype = 67,
-    Range = 68,
-    Rofs = 69,
-    Spipe = 70,
-    Srch = 71,
-    Stale = 72,
-    Timedout = 73,
-    Txtbsy = 74,
-    Xdev = 75,
-    Notcapable = 76,
-}
-
-impl Errno {
-    /// The code a POSIX error name stands for: the witx case, `E`
-    /// prefixed and upper-cased. `ENOTCAPABLE` is WASI's own.
-    fn from_posix_name(name: &str) -> Option<Self> {
-        Some(match name {
-            "E2BIG" => Self::TooBig,
-            "EACCES" => Self::Acces,
-            "EADDRINUSE" => Self::Addrinuse,
-            "EADDRNOTAVAIL" => Self::Addrnotavail,
-            "EAFNOSUPPORT" => Self::Afnosupport,
-            "EAGAIN" => Self::Again,
-            "EALREADY" => Self::Already,
-            "EBADF" => Self::Badf,
-            "EBADMSG" => Self::Badmsg,
-            "EBUSY" => Self::Busy,
-            "ECANCELED" => Self::Canceled,
-            "ECHILD" => Self::Child,
-            "ECONNABORTED" => Self::Connaborted,
-            "ECONNREFUSED" => Self::Connrefused,
-            "ECONNRESET" => Self::Connreset,
-            "EDEADLK" => Self::Deadlk,
-            "EDESTADDRREQ" => Self::Destaddrreq,
-            "EDOM" => Self::Dom,
-            "EDQUOT" => Self::Dquot,
-            "EEXIST" => Self::Exist,
-            "EFAULT" => Self::Fault,
-            "EFBIG" => Self::Fbig,
-            "EHOSTUNREACH" => Self::Hostunreach,
-            "EIDRM" => Self::Idrm,
-            "EILSEQ" => Self::Ilseq,
-            "EINPROGRESS" => Self::Inprogress,
-            "EINTR" => Self::Intr,
-            "EINVAL" => Self::Inval,
-            "EIO" => Self::Io,
-            "EISCONN" => Self::Isconn,
-            "EISDIR" => Self::Isdir,
-            "ELOOP" => Self::Loop,
-            "EMFILE" => Self::Mfile,
-            "EMLINK" => Self::Mlink,
-            "EMSGSIZE" => Self::Msgsize,
-            "EMULTIHOP" => Self::Multihop,
-            "ENAMETOOLONG" => Self::Nametoolong,
-            "ENETDOWN" => Self::Netdown,
-            "ENETRESET" => Self::Netreset,
-            "ENETUNREACH" => Self::Netunreach,
-            "ENFILE" => Self::Nfile,
-            "ENOBUFS" => Self::Nobufs,
-            "ENODEV" => Self::Nodev,
-            "ENOENT" => Self::Noent,
-            "ENOEXEC" => Self::Noexec,
-            "ENOLCK" => Self::Nolck,
-            "ENOLINK" => Self::Nolink,
-            "ENOMEM" => Self::Nomem,
-            "ENOMSG" => Self::Nomsg,
-            "ENOPROTOOPT" => Self::Noprotoopt,
-            "ENOSPC" => Self::Nospc,
-            "ENOSYS" => Self::Nosys,
-            "ENOTCONN" => Self::Notconn,
-            "ENOTDIR" => Self::Notdir,
-            "ENOTEMPTY" => Self::Notempty,
-            "ENOTRECOVERABLE" => Self::Notrecoverable,
-            "ENOTSOCK" => Self::Notsock,
-            "ENOTSUP" => Self::Notsup,
-            "ENOTTY" => Self::Notty,
-            "ENXIO" => Self::Nxio,
-            "EOVERFLOW" => Self::Overflow,
-            "EOWNERDEAD" => Self::Ownerdead,
-            "EPERM" => Self::Perm,
-            "EPIPE" => Self::Pipe,
-            "EPROTO" => Self::Proto,
-            "EPROTONOSUPPORT" => Self::Protonosupport,
-            "EPROTOTYPE" => Self::Prototype,
-            "ERANGE" => Self::Range,
-            "EROFS" => Self::Rofs,
-            "ESPIPE" => Self::Spipe,
-            "ESRCH" => Self::Srch,
-            "ESTALE" => Self::Stale,
-            "ETIMEDOUT" => Self::Timedout,
-            "ETXTBSY" => Self::Txtbsy,
-            "EXDEV" => Self::Xdev,
-            "ENOTCAPABLE" => Self::Notcapable,
-            _ => return None,
-        })
-    }
-}
+use super::types;
+pub(crate) use super::types::Errno;
 
-/// A call that did not succeed. preview1 traps rather than answering
-/// for a pointer outside guest memory or an argument outside what the
-/// witx defines, as wasmtime-wasi does.
-pub(crate) enum Failure {
-    Errno(Errno),
-    Trap(wasmtime::Error),
-}
+pub(crate) type Answer<T = ()> = Result<T, types::Error>;
 
-impl Failure {
-    /// A trap saying what the guest handed over that preview1 cannot hold.
-    pub(crate) fn trap(message: &'static str) -> Self {
-        Self::Trap(wasmtime::Error::msg(message))
-    }
+/// The code a POSIX error name a Filesystem's failure carries stands for:
+/// the witx case, `E` prefixed and upper-cased.
+fn from_posix_name(name: &str) -> Option<Errno> {
+    Some(match name {
+        "EAGAIN" => Errno::Again,
+        "ENOENT" => Errno::Noent,
+        "EEXIST" => Errno::Exist,
+        "ENOTDIR" => Errno::Notdir,
+        "EISDIR" => Errno::Isdir,
+        "ENOTEMPTY" => Errno::Notempty,
+        "EACCES" => Errno::Acces,
+        "EROFS" => Errno::Rofs,
+        "EINVAL" => Errno::Inval,
+        "ENOTSUP" => Errno::Notsup,
+        "ENOSPC" => Errno::Nospc,
+        "EFBIG" => Errno::Fbig,
+        "EXDEV" => Errno::Xdev,
+        "EDEADLK" => Errno::Deadlk,
+        "ELOOP" => Errno::Loop,
+        "EPERM" => Errno::Perm,
+        "EBADF" => Errno::Badf,
+        "EBUSY" => Errno::Busy,
+        "EILSEQ" => Errno::Ilseq,
+        "EINTR" => Errno::Intr,
+        "EMFILE" => Errno::Mfile,
+        "ENAMETOOLONG" => Errno::Nametoolong,
+        "ENOMEM" => Errno::Nomem,
+        "ENOTSOCK" => Errno::Notsock,
+        "EOVERFLOW" => Errno::Overflow,
+        "ESPIPE" => Errno::Spipe,
+        "ENODEV" => Errno::Nodev,
+        "ESTALE" => Errno::Stale,
+        _ => return None,
+    })
 }
 
-impl From<Errno> for Failure {
-    fn from(errno: Errno) -> Self {
-        Self::Errno(errno)
+/// A pointer outside the memory or misaligned traps, as the witx
+/// documentation requires; a value inside memory that no witx type holds is
+/// `INVAL`, as in wasmtime-wasi.
+impl From<GuestError> for types::Error {
+    fn from(error: GuestError) -> Self {
+        match error {
+            GuestError::InvalidFlagValue { .. } | GuestError::InvalidEnumValue { .. } => {
+                Errno::Inval.into()
+            }
+            GuestError::PtrOverflow
+            | GuestError::PtrOutOfBounds { .. }
+            | GuestError::PtrNotAligned { .. } => Self::trap(error.into()),
+            GuestError::InvalidUtf8 { .. } => Errno::Ilseq.into(),
+            GuestError::TryFromIntError { .. } => Errno::Overflow.into(),
+            GuestError::SliceLengthsDiffer => Errno::Fault.into(),
+            GuestError::InFunc { err, .. } => Self::from(*err),
+        }
     }
 }
 
-/// The code a Filesystem's failure reaches the guest as: the one its
-/// POSIX name stands for, or `IO` for a failure without one.
-impl From<FilesystemError> for Failure {
+/// The code a call's failure reaches the guest as: the one its POSIX name
+/// stands for, or `IO` for a failure without one. A path escaping its
+/// descriptor is `NOTCAPABLE`, as preview1 names a capability the guest does
+/// not hold, where Linux answers EXDEV.
+impl From<FilesystemError> for types::Error {
     fn from(error: FilesystemError) -> Self {
-        Self::Errno(
-            error
+        match error {
+            FilesystemError::Escape => Errno::Notcapable,
+            error => error
                 .posix_name()
-                .and_then(Errno::from_posix_name)
+                .and_then(from_posix_name)
                 .unwrap_or(Errno::Io),
-        )
-    }
-}
-
-/// A change beneath a read-only Mount is `ROFS`; a Policy's refusal is
-/// `ACCES`.
-impl From<Denial> for Failure {
-    fn from(denial: Denial) -> Self {
-        Self::Errno(match denial {
-            Denial::ReadOnly => Errno::Rofs,
-            Denial::Refused => Errno::Acces,
-        })
+        }
+        .into()
     }
 }
 
-pub(crate) type Answer<T = ()> = Result<T, Failure>;
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -238,6 +101,7 @@ mod tests {
             (FilesystemError::StorageFull, 51),
             (FilesystemError::FileTooLarge, 22),
             (FilesystemError::CrossesDevices, 75),
+            (FilesystemError::Escape, 76),
             (FilesystemError::Deadlock, 16),
             (FilesystemError::FilesystemLoop, 32),
             (FilesystemError::NotPermitted, 63),
@@ -245,22 +109,26 @@ mod tests {
             (FilesystemError::ResourceBusy, 10),
             (FilesystemError::IllegalSequence, 25),
             (FilesystemError::Interrupted, 27),
+            (FilesystemError::WouldBlock, 6),
             (FilesystemError::TooManyOpenFiles, 33),
             (FilesystemError::InvalidFilename, 37),
             (FilesystemError::OutOfMemory, 48),
             (FilesystemError::NotASocket, 57),
             (FilesystemError::ValueTooLarge, 61),
             (FilesystemError::NotSeekable, 70),
+            (FilesystemError::NoSuchDevice, 43),
+            (FilesystemError::StaleNetworkFileHandle, 72),
             (FilesystemError::Other("x".into()), 29),
         ];
         for (error, code) in cases {
             let label = format!("{error:?}");
-            let Failure::Errno(errno) = Failure::from(error) else {
+            let Ok(errno) = types::Error::from(error).downcast() else {
                 panic!("{label} must answer an error code, not a trap");
             };
             assert_eq!(
-                errno as u16, code,
-                "{label} through Failure::from must reach the guest as preview1 errno {code}"
+                u16::from(errno),
+                code,
+                "{label} through types::Error::from must reach the guest as preview1 errno {code}"
             );
         }
     }