@amritk/nish-x86_64-linux 0.15.0 → 0.17.0

package/runtime/nish.mjs

@@ -16,14 +16,14 @@
  * That is enough for a real and useful subset — **f64 mode**, where JavaScript's
  * `+ - * / %` on doubles *are* `fadd/fsub/fmul/fdiv/frem` and `Math.*` are the
  * same IEEE operations, so the arithmetic needs no help. It is not enough for
- * i32 mode, and it never will be: `number` is a wrapping 32-bit integer there
- * and every operator would have to change.
+ * i32 mode, and it never will be: `number` is a 32-bit integer there, whose
+ * signed overflow panics, and every operator would have to change.
  *
  * `docs/RUN_UNDER_NODE.md` states the overlap and the whole list of what stays
  * divergent. The short version, because it belongs next to the code too:
  *
- *   - **i32 mode is out.** Wrapping, truncating `/`, and the divide-by-zero
- *     panic are all operator-level and cannot be reached from here.
+ *   - **i32 mode is out.** The overflow panic, truncating `/`, and the
+ *     divide-by-zero panic are all operator-level and cannot be reached from here.
  *   - **`s.length` is UTF-16 units under Node** and UTF-8 bytes natively, and
  *     so is every string offset. ASCII agrees; nothing else does.
  *   - **`a[i]` is unchecked**: out of range is `undefined` here and an exit-1
@@ -109,6 +109,8 @@ for (const name of [
   "netWrite",
   "netShutdown",
   "netClose",
+  "tcpConnect",
+  "connectResult",
   "udpBind",
   "udpSendTo",
   "udpRecvFrom",
@@ -174,6 +176,49 @@ provide("bitsToF64", shim.bitsToF64);
 // agree with a native run; the timing does not, and is not claimed here.
 provide("ctSelect", shim.ctSelect);
 provide("ctEq", shim.ctEq);
+// `secureZero` (#385): the bytes are zero afterwards here too, though what a
+// collector may have copied before is out of reach.
+provide("secureZero", shim.secureZero);
+// The RT-9 owner checks (#386): one `lstat`, the effective uid and
+// `access(X_OK)`, answered as `runtime-host.c` answers them.
+provide("lstatOwnerModeSync", shim.lstatOwnerModeSync);
+provide("geteuid", shim.geteuid);
+provide("isExecutableSync", shim.isExecutableSync);
+
+// `nish:unsafe`. The element access is JavaScript's own, which never checks
+// anything; the wraps are the two's-complement ones the native instructions
+// perform: `| 0` and `Math.imul` at `i32`, and `BigInt.asIntN(64, ...)` on
+// the BigInt an `i64` is here. Pure functions of their operands, so a program
+// that stays in range agrees with a native run.
+const wrapAt = (a, b, wide, narrow) => (typeof a === "bigint" ? BigInt.asIntN(64, wide(a, b)) : narrow(a, b));
+provide("uncheckedGet", (xs, i) => xs[i]);
+provide("uncheckedSet", (xs, i, v) => {
+  xs[i] = v;
+});
+provide("wrappingAdd", (a, b) =>
+  wrapAt(
+    a,
+    b,
+    (x, y) => x + y,
+    (x, y) => (x + y) | 0
+  )
+);
+provide("wrappingSub", (a, b) =>
+  wrapAt(
+    a,
+    b,
+    (x, y) => x - y,
+    (x, y) => (x - y) | 0
+  )
+);
+provide("wrappingMul", (a, b) =>
+  wrapAt(
+    a,
+    b,
+    (x, y) => x * y,
+    (x, y) => Math.imul(x, y)
+  )
+);
 
 // `Result`. Everything works but `orReturn`, which needs the caller's control
 // flow and therefore the rewriter; see the header.
@@ -200,15 +245,34 @@ provide("Arena", {
   reset: shim.arenaReset,
   used: shim.arenaUsed,
 });
+// `using a = arena()` releases nothing here either: what the block allocated
+// is the garbage collector's, and the disposal is a no-op.
+provide("arena", shim.arena);
 
 // The standard library. A program imports it as `nish/<module>`, which the
 // compiler resolves to `std/<module>.ts` beside itself; this does the same for
 // Node, relative to this file rather than to the program, so the same
 // specifier works from any directory. Only the `nish/` package is answered
 // here, and every other specifier goes to Node as it was written.
+//
+// `nish:secret` is answered here as well, because the standard library imports
+// it (`std/crypto/p256.ts` and its neighbours): its names are
+// `runtime/shim.mjs`'s, where a `Secret` is a plain wrapper and `wipe`
+// zero-fills it. `nish:unsafe` is answered by a module that hands back the
+// globals installed above: its functions are globals of this module either
+// way, and the import is what the compiler requires a program to write.
+const UNSAFE_EXPORTS = ["uncheckedGet", "uncheckedSet", "wrappingAdd", "wrappingSub", "wrappingMul"];
+const unsafeSource = UNSAFE_EXPORTS.map((name) => `export const ${name} = globalThis.${name};`).join("\n");
 registerHooks({
-  resolve: (specifier, context, next) =>
-    specifier.startsWith("nish/")
+  resolve: (specifier, context, next) => {
+    if (specifier === "nish:secret") {
+      return next(new URL("./shim.mjs", import.meta.url).href, context);
+    }
+    if (specifier === "nish:unsafe") {
+      return { url: `data:text/javascript,${encodeURIComponent(unsafeSource)}`, shortCircuit: true };
+    }
+    return specifier.startsWith("nish/")
       ? next(new URL(`../std/${specifier.slice("nish/".length)}.ts`, import.meta.url).href, context)
-      : next(specifier, context),
+      : next(specifier, context);
+  },
 });

package/runtime/runtime-host.c

@@ -1,7 +1,8 @@
 /* Nish runtime, the host half: the wall clock, entropy, a file's modification
  * time and a descriptor that becomes readable when SIGTERM or SIGINT arrives
  * (WP34 N3) — the four facts a program that runs for days asks of the machine
- * it runs on.
+ * it runs on — and who owns a path and whether it runs, which a driver asks
+ * before it trusts one.
  *
  * A translation unit of its own for the reason runtime-os.c is one: each file
  * carries its own measured `.text*` ceiling in tests/run.js. runtime-os.c had
@@ -33,6 +34,7 @@ typedef int nish_host_unused;
 #include <signal.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/stat.h>
 #include <time.h>
 #include <unistd.h>
@@ -98,7 +100,7 @@ void nish_random_fill(nish_array *bytes) {
    digits. `stat` follows a symbolic link, as `fs.statSync` does. */
 double nish_stat_mtime(const nish_str *path) {
   struct stat st;
-  if (stat(path->data, &st) != 0) return __builtin_nan("");
+  if (stat(nish_cpath(path), &st) != 0) return __builtin_nan("");
 #if defined(__APPLE__)
   struct timespec t = st.st_mtimespec;
 #else
@@ -107,6 +109,31 @@ double nish_stat_mtime(const nish_str *path) {
   return (double)t.tv_sec * 1e3 + (double)t.tv_nsec / 1e6;
 }
 
+/* ---- Who owns a path, and whether it runs (docs/security/runtime.md, RT-9)
+ *
+ * The primitives a driver needs before it trusts a directory or a program it
+ * found on its own. `nish_lstat_owner_mode` answers for the path itself, a
+ * symbolic link included, rather than for what it names: the owner's uid in
+ * the high 32 bits and `st_mode` in the low 32, or exactly -1 when the path
+ * does not resolve or holds a NUL. `nish_euid` is the user to compare the
+ * owner with, and `nish_is_executable` is `access(X_OK)`: whether the real
+ * user may run the file, which is what tells an executable `PATH` entry from
+ * one that is only readable. Nothing in the language reaches them yet: `src/` may call
+ * a runtime function only once the last release declares it, so they are here
+ * for the change after the next release (docs/security/cli.md, CLI-7 and
+ * CLI-9). */
+int64_t nish_lstat_owner_mode(const nish_str *path) {
+  struct stat st;
+  if (lstat(nish_cpath(path), &st) != 0) return -1;
+  return (int64_t)((uint64_t)(uint32_t)st.st_uid << 32 | (uint32_t)st.st_mode);
+}
+
+int64_t nish_euid(void) { return (int64_t)geteuid(); }
+
+_Bool nish_is_executable(const nish_str *path) {
+  return access(nish_cpath(path), X_OK) == 0;
+}
+
 /* ---- Signals: `signalFd()` and `readSignal(fd)`
  *
  * A descriptor rather than a handler in the language, because a handler would
@@ -129,46 +156,65 @@ double nish_stat_mtime(const nish_str *path) {
  * async-signal-safe. The write end is non-blocking, so a thousand unread
  * signals lose the newest rather than wedge the handler, and `errno` is put
  * back for the code the signal interrupted. The descriptor is made once and
- * every later `signalFd()` answers the same one. */
-static int nish_signal_read_end = -1;
-static int nish_signal_write_end = -1;
+ * every later `signalFd()` answers the same one.
+ *
+ * Both ends live in one word, the read end in the high half and the write end
+ * in the low, -1 until the pipe exists, so that publishing them is a single
+ * compare-and-swap (docs/security/runtime.md, RT-10). Two threads whose first
+ * calls overlap can each make a pipe; one swap wins, the other caller closes
+ * its own pipe and answers the winner's read end. With two separate words the
+ * call that finished last answered its own pipe while the handler wrote to
+ * the other, so one caller never heard a signal and a pipe leaked. Each first
+ * caller installs the handler itself before it returns, so neither can hand
+ * back a descriptor before a signal reaches it. */
+static int64_t nish_signal_pipe = -1;
 
 static void nish_on_signal(int sig) {
   int saved = errno;
   unsigned char b = (unsigned char)sig;
-  (void)!write(nish_signal_write_end, &b, 1);
+  /* The low half: the write end. */
+  (void)!write((int)__atomic_load_n(&nish_signal_pipe, __ATOMIC_RELAXED), &b, 1);
   errno = saved;
 }
 
 int32_t nish_signal_fd(void) {
-  if (nish_signal_read_end >= 0) return nish_signal_read_end;
-  int p[2];
+  int64_t cur = __atomic_load_n(&nish_signal_pipe, __ATOMIC_ACQUIRE);
+  if (cur < 0) {
+    int p[2];
 #if defined(__linux__)
-  /* Both ends close-on-exec from the moment they exist, so a child a sibling
-     thread spawns meanwhile cannot inherit either. */
-  if (pipe2(p, O_CLOEXEC) != 0) return -1;
+    /* Both ends close-on-exec from the moment they exist, so a child a sibling
+       thread spawns meanwhile cannot inherit either. */
+    if (pipe2(p, O_CLOEXEC) != 0) return -1;
 #else
-  /* Darwin has no `pipe2`, so there is a window between `pipe` and the two
-     `fcntl`s in which a child spawned by another thread inherits the ends. */
-  if (pipe(p) != 0) return -1;
-  fcntl(p[0], F_SETFD, FD_CLOEXEC);
-  fcntl(p[1], F_SETFD, FD_CLOEXEC);
+    /* Darwin has no `pipe2`, so there is a window between `pipe` and the two
+       `fcntl`s in which a child spawned by another thread inherits the ends. */
+    if (pipe(p) != 0) return -1;
+    fcntl(p[0], F_SETFD, FD_CLOEXEC);
+    fcntl(p[1], F_SETFD, FD_CLOEXEC);
 #endif
-  fcntl(p[1], F_SETFL, O_NONBLOCK);
-  nish_signal_write_end = p[1];
-  struct sigaction sa;
-  sa.sa_handler = nish_on_signal;
-  sa.sa_flags = SA_RESTART;
-  sigemptyset(&sa.sa_mask);
-  sigaction(SIGINT, &sa, 0);
-  sigaction(SIGTERM, &sa, 0);
-  return nish_signal_read_end = p[0];
+    fcntl(p[1], F_SETFL, O_NONBLOCK);
+    int64_t mine = (int64_t)p[0] << 32 | (uint32_t)p[1];
+    /* A failed swap leaves the winner's pair in `cur`. */
+    if (__atomic_compare_exchange_n(&nish_signal_pipe, &cur, mine, 0, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE)) {
+      cur = mine;
+    } else {
+      close(p[0]);
+      close(p[1]);
+    }
+    struct sigaction sa;
+    sa.sa_handler = nish_on_signal;
+    sa.sa_flags = SA_RESTART;
+    sigemptyset(&sa.sa_mask);
+    sigaction(SIGINT, &sa, 0);
+    sigaction(SIGTERM, &sa, 0);
+  }
+  return (int32_t)(cur >> 32);
 }
 
 /* Block until a signal's byte arrives and answer it: 15 or 2, or -1 for any
    `fd` that is not the signal descriptor and for a read that fails. */
 int32_t nish_read_signal(int32_t fd) {
-  if (fd != nish_signal_read_end) return -1;
+  if (fd != (int32_t)(__atomic_load_n(&nish_signal_pipe, __ATOMIC_ACQUIRE) >> 32)) return -1;
   unsigned char b;
   ssize_t n;
   do n = read(fd, &b, 1);

package/runtime/runtime-net.c

@@ -12,13 +12,15 @@
  * scripts/build.sh pairs this file with runtime.c like the other halves, so a
  * link line still names one runtime.
  *
- * The error convention is the one `signalFd` set: an `i32`, `>= 0` for
- * success (a descriptor, a byte count, 0), and a negative errno otherwise.
- * The codes a loop branches on are Linux's numbers on every platform (-11
+ * Errors take the shape `signalFd` set, an `i32` that is `>= 0` for success
+ * (a descriptor, a byte count, 0) and negative for a failure, and add the
+ * errno to it: where `signalFd` and `readSignal` answer a plain -1, a call
+ * here answers the failure's errno, negated. The codes a loop branches on are Linux's numbers on every platform (-11
  * would block, -95 unsupported, -32 the peer is gone, -104 reset, -98 the
- * address is in use, -22 a bad argument), so `nish_net_err` translates
- * Darwin's; any other failure is the host's own `-errno`. Nothing here
- * allocates: the addresses a call reads or writes are the caller's `u8[]`.
+ * address is in use, -111 refused, -110 timed out, -22 a bad argument), so
+ * `nish_net_err` translates Darwin's; any other failure is the host's own
+ * `-errno`. Nothing here allocates: the addresses a call reads or writes are
+ * the caller's `u8[]`.
  *
  * An address is 18 bytes of that array: the 16 bytes of an IPv6 address, an
  * IPv4 one as `::ffff:a.b.c.d`, then the port, big-endian. An IPv4 address is
@@ -33,7 +35,10 @@
  * both, never SIGPIPE), the errno numbers, UDP's segmentation offload
  * (`UDP_SEGMENT`, `UDP_GRO`) and ECN marks, which Linux has and for which
  * Darwin answers -95, and the readiness loop, which is epoll on Linux and
- * kqueue on Darwin. The Darwin branch is compiled by CI's Darwin bootstrap
+ * kqueue on Darwin. Only the sending side and the GRO bind say -95 there: a
+ * receive leaves `meta` at 0, 0, and a `meta[1]` of 0 is also what a real
+ * Not-ECT datagram reads as, so a program learns that Darwin has no ECN from
+ * the send, never from the receive. The Darwin branch is compiled by CI's Darwin bootstrap
  * rows and run by nothing. A WASI build has none of this (the checker refuses
  * every `nish:net` call under a wasm target), so there the file is empty.
  */
@@ -91,6 +96,8 @@ static int32_t nish_net_err(int e) {
   if (e == EOPNOTSUPP || e == ENOTSUP) return -95;
   if (e == ECONNRESET) return -104;
   if (e == EADDRINUSE) return -98;
+  if (e == ECONNREFUSED) return -111;
+  if (e == ETIMEDOUT) return -110;
 #endif
   return -e;
 }
@@ -111,8 +118,11 @@ static int nish_net_parse(const nish_str *s, unsigned char a[16]) {
   return inet_pton(AF_INET6, host, a) == 1;
 }
 
-/* `a` and `port` as a socket address of the family `v4` names. */
-static socklen_t nish_net_sockaddr(nish_sockaddr *s, const unsigned char a[16], int32_t port, int v4) {
+/* `a` and `port` as a socket address of the family `v4` names. `noinline`:
+   three calls share one body, which inlined into each was 42 bytes more of
+   `.text` than the calls cost. */
+__attribute__((noinline)) static socklen_t nish_net_sockaddr(nish_sockaddr *s, const unsigned char a[16],
+                                                             int32_t port, int v4) {
   memset(s, 0, sizeof *s);
   if (v4) {
     s->v4.sin_family = AF_INET;
@@ -229,18 +239,24 @@ int32_t nish_tcp_listen(const nish_str *host, int32_t port, int32_t backlog) {
   return nish_net_bound(host, port, SOCK_STREAM, backlog);
 }
 
-/* A socket address into the caller's 18-byte form. An IPv4 peer is written
-   mapped, and the port is already in network order, which is the form's
-   big-endian. */
-static void nish_net_put(nish_array *out, const nish_sockaddr *s) {
+/* A socket address of `n` bytes into the caller's 18-byte form. An IPv4 peer
+   is written mapped, and the port is already in network order, which is the
+   form's big-endian. Anything else -- no address at all, which is what
+   `recvmsg` reports on a connected or Unix socket, or a family that is not
+   IP -- is eighteen zeros: those bytes of `s` were never written, and copying
+   them handed the caller whatever the stack held (docs/security/runtime.md,
+   RT-6). */
+static void nish_net_put(nish_array *out, const nish_sockaddr *s, socklen_t n) {
   unsigned char *p = (unsigned char *)out->data;
-  uint16_t port = s->v6.sin6_port;
-  if (s->sa.sa_family == AF_INET) {
+  uint16_t port = 0;
+  memset(p, 0, NISH_ADDR_BYTES);
+  if (n >= sizeof s->v4 && s->sa.sa_family == AF_INET) {
     memcpy(p, nish_mapped_prefix, 12);
     memcpy(p + 12, &s->v4.sin_addr, 4);
     port = s->v4.sin_port;
-  } else {
+  } else if (n >= sizeof s->v6 && s->sa.sa_family == AF_INET6) {
     memcpy(p, &s->v6.sin6_addr, 16);
+    port = s->v6.sin6_port;
   }
   memcpy(p + 16, &port, 2);
 }
@@ -259,10 +275,45 @@ int32_t nish_tcp_accept(int32_t fd, nish_array *peer) {
   int c = nish_net_setup(accept(fd, &s.sa, &n));
 #endif
   if (c < 0) return nish_net_fail();
-  nish_net_put(peer, &s);
+  nish_net_put(peer, &s, n);
   return c;
 }
 
+/* `tcpConnect(addr)`: a new socket, non-blocking and close-on-exec, connecting
+   to the address in `addr`; an IPv4 one is an `AF_INET` socket, any other
+   `AF_INET6`. A non-blocking `connect` seldom finishes at once (on Linux not
+   even over loopback), and its `EINPROGRESS` (-115) is not a failure: the
+   descriptor is answered all the same, and the connection is made once the
+   loop reports it writable, when `connectResult` says how it went. Any other
+   failure closes the socket and is answered instead of it. An `addr` shorter
+   than 18 bytes is -22 before any socket exists. */
+int32_t nish_tcp_connect(const nish_array *addr) {
+  if (addr->len < NISH_ADDR_BYTES) return -22;
+  const unsigned char *p = (const unsigned char *)addr->data;
+  int v4 = memcmp(p, nish_mapped_prefix, 12) == 0;
+  int fd = nish_net_socket(v4 ? AF_INET : AF_INET6, SOCK_STREAM);
+  if (fd < 0) return nish_net_fail();
+  nish_sockaddr s;
+  socklen_t n = nish_net_sockaddr(&s, p, (p[16] << 8) | p[17], v4);
+  if (connect(fd, &s.sa, n) != 0 && errno != EINPROGRESS) {
+    int e = errno;
+    close(fd);
+    return nish_net_err(e);
+  }
+  return fd;
+}
+
+/* `connectResult(fd)`: how the connection `tcpConnect` started went, once the
+   descriptor is writable: 0 when it is made, or its failure (-111 refused,
+   -110 timed out) from `SO_ERROR`. The kernel clears `SO_ERROR` as it is
+   read, so a failure is answered once. */
+int32_t nish_connect_result(int32_t fd) {
+  int e = 0;
+  socklen_t n = sizeof e;
+  if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &e, &n) != 0) return nish_net_fail();
+  return e != 0 ? nish_net_err(e) : 0;
+}
+
 /* `netRead(fd, buf, off, len)`: at most `len` bytes into `buf` from `off`.
    The compiled call has already checked `0 <= off <= off + len <=
    buf.length`, unless the program was built with `--unchecked-indexing`. */
@@ -384,7 +435,9 @@ int32_t nish_udp_recv_from(int32_t fd, nish_array *buf, int64_t off, int64_t len
       .msg_name = &s, .msg_namelen = sizeof s, .msg_iov = &iov, .msg_iovlen = 1, .msg_control = c.b, .msg_controllen = sizeof c};
   ssize_t got = recvmsg(fd, &m, 0);
   if (got < 0) return nish_net_fail();
-  /* Darwin sets neither option, so both stay 0 there. */
+  /* Darwin sets neither option, so both stay 0 there: a `meta[1]` that reads
+     as Not-ECT whatever arrived, which is why the -95 of a marked send, not
+     this, is how a program learns ECN is unsupported. */
   int32_t info[2] = {0, 0};
 #if defined(__linux__)
   for (struct cmsghdr *h = CMSG_FIRSTHDR(&m); h != NULL; h = CMSG_NXTHDR(&m, h)) {
@@ -399,7 +452,7 @@ int32_t nish_udp_recv_from(int32_t fd, nish_array *buf, int64_t off, int64_t len
   }
 #endif
   memcpy(meta->data, info, sizeof info);
-  nish_net_put(from, &s);
+  nish_net_put(from, &s, m.msg_namelen);
   return (int32_t)got;
 }