@encharm/cws 4.5.1 → 4.5.3

package/src/headers/24/packet.h

@@ -0,0 +1,155 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+
+#include <base_object.h>
+#include <env.h>
+#include <ngtcp2/ngtcp2.h>
+#include <node_external_reference.h>
+#include <node_sockaddr.h>
+#include <req_wrap.h>
+#include <uv.h>
+#include <v8.h>
+#include <string>
+#include "bindingdata.h"
+#include "cid.h"
+#include "data.h"
+#include "defs.h"
+#include "tokens.h"
+
+namespace node::quic {
+
+struct PathDescriptor {
+  uint32_t version;
+  const CID& dcid;
+  const CID& scid;
+  const SocketAddress& local_address;
+  const SocketAddress& remote_address;
+  std::string ToString() const;
+};
+
+// A Packet encapsulates serialized outbound QUIC data.
+// Packets must never be larger than the path MTU. The
+// default QUIC packet maximum length is 1200 bytes,
+// which we assume by default. The packet storage will
+// be stack allocated up to this size.
+//
+// Packets are maintained in a freelist held by the
+// BindingData instance. When using Create() to create
+// a Packet, we'll check to see if there is a free
+// packet in the freelist and use it instead of starting
+// fresh with a new packet. The freelist can store at
+// most kMaxFreeList packets
+//
+// Packets are always encrypted so their content should
+// be considered opaque to us. We leave it entirely up
+// to ngtcp2 how to encode QUIC frames into the packet.
+class Packet final : public ReqWrap<uv_udp_send_t> {
+ private:
+  struct Data;
+
+ public:
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+
+  class Listener {
+   public:
+    virtual void PacketDone(int status) = 0;
+  };
+
+  // Do not use the Packet constructors directly to create
+  // them. These are public only to support MakeBaseObject.
+  // Use the Create, or Create variants to create or
+  // acquire packet instances.
+
+  Packet(Environment* env,
+         Listener* listener,
+         v8::Local<v8::Object> object,
+         const SocketAddress& destination,
+         size_t length,
+         const char* diagnostic_label = "<unknown>");
+
+  Packet(Environment* env,
+         Listener* listener,
+         v8::Local<v8::Object> object,
+         const SocketAddress& destination,
+         std::shared_ptr<Data> data);
+
+  DISALLOW_COPY_AND_MOVE(Packet)
+
+  const SocketAddress& destination() const;
+  size_t length() const;
+  operator uv_buf_t() const;
+  operator ngtcp2_vec() const;
+
+  // Modify the size of the packet after ngtcp2 has written
+  // to it. len must be <= length(). We call this after we've
+  // asked ngtcp2 to encode frames into the packet and ngtcp2
+  // tells us how many of the packets bytes were used.
+  void Truncate(size_t len);
+
+  static BaseObjectPtr<Packet> Create(
+      Environment* env,
+      Listener* listener,
+      const SocketAddress& destination,
+      size_t length = kDefaultMaxPacketLength,
+      const char* diagnostic_label = "<unknown>");
+
+  BaseObjectPtr<Packet> Clone() const;
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(Packet)
+  SET_SELF_SIZE(Packet)
+
+  std::string ToString() const;
+
+  static BaseObjectPtr<Packet> CreateRetryPacket(
+      Environment* env,
+      Listener* listener,
+      const PathDescriptor& path_descriptor,
+      const TokenSecret& token_secret);
+
+  static BaseObjectPtr<Packet> CreateConnectionClosePacket(
+      Environment* env,
+      Listener* listener,
+      const SocketAddress& destination,
+      ngtcp2_conn* conn,
+      const QuicError& error);
+
+  static BaseObjectPtr<Packet> CreateImmediateConnectionClosePacket(
+      Environment* env,
+      Listener* listener,
+      const PathDescriptor& path_descriptor,
+      const QuicError& reason);
+
+  static BaseObjectPtr<Packet> CreateStatelessResetPacket(
+      Environment* env,
+      Listener* listener,
+      const PathDescriptor& path_descriptor,
+      const TokenSecret& token_secret,
+      size_t source_len);
+
+  static BaseObjectPtr<Packet> CreateVersionNegotiationPacket(
+      Environment* env,
+      Listener* listener,
+      const PathDescriptor& path_descriptor);
+
+  // Called when the packet is done being sent.
+  void Done(int status);
+
+ private:
+  static BaseObjectPtr<Packet> FromFreeList(Environment* env,
+                                            std::shared_ptr<Data> data,
+                                            Listener* listener,
+                                            const SocketAddress& destination);
+
+  Listener* listener_;
+  SocketAddress destination_;
+  std::shared_ptr<Data> data_;
+};
+
+}  // namespace node::quic
+
+#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS

package/src/headers/24/path.h

@@ -0,0 +1,33 @@
+#ifndef SRC_PATH_H_
+#define SRC_PATH_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <string>
+#include <vector>
+#include "node_options-inl.h"
+#include "util-inl.h"
+
+namespace node {
+
+constexpr bool IsPathSeparator(const char c) noexcept;
+
+std::string NormalizeString(const std::string_view path,
+                            bool allowAboveRoot,
+                            const std::string_view separator);
+
+std::string PathResolve(Environment* env,
+                        const std::vector<std::string_view>& paths);
+
+#ifdef _WIN32
+constexpr bool IsWindowsDeviceRoot(const char c) noexcept;
+#endif  // _WIN32
+
+void ToNamespacedPath(Environment* env, BufferValue* path);
+void FromNamespacedPath(std::string* path);
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_PATH_H_

package/src/headers/24/permission/addon_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_ADDON_PERMISSION_H_
+#define SRC_PERMISSION_ADDON_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <string>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class AddonPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_ADDON_PERMISSION_H_

package/src/headers/24/permission/child_process_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_CHILD_PROCESS_PERMISSION_H_
+#define SRC_PERMISSION_CHILD_PROCESS_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <vector>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class ChildProcessPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_CHILD_PROCESS_PERMISSION_H_

package/src/headers/24/permission/fs_permission.h

@@ -0,0 +1,167 @@
+#ifndef SRC_PERMISSION_FS_PERMISSION_H_
+#define SRC_PERMISSION_FS_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "v8.h"
+
+#include <unordered_map>
+#include "permission/permission_base.h"
+#include "util.h"
+
+namespace node {
+
+namespace permission {
+
+class FSPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param) const override;
+
+  struct RadixTree {
+    struct Node {
+      std::string prefix;
+      std::unordered_map<char, Node*> children;
+      Node* wildcard_child;
+      bool is_leaf;
+
+      explicit Node(const std::string& pre)
+          : prefix(pre), wildcard_child(nullptr), is_leaf(false) {}
+
+      Node() : wildcard_child(nullptr), is_leaf(false) {}
+
+      Node* CreateChild(const std::string& path_prefix) {
+        if (path_prefix.empty() && !is_leaf) {
+          is_leaf = true;
+          return this;
+        }
+
+        CHECK(!path_prefix.empty());
+        char label = path_prefix[0];
+
+        Node* child = children[label];
+        if (child == nullptr) {
+          children[label] = new Node(path_prefix);
+          return children[label];
+        }
+
+        // swap prefix
+        size_t i = 0;
+        size_t prefix_len = path_prefix.length();
+        for (; i < child->prefix.length(); ++i) {
+          if (i > prefix_len || path_prefix[i] != child->prefix[i]) {
+            std::string parent_prefix = child->prefix.substr(0, i);
+            std::string child_prefix = child->prefix.substr(i);
+
+            child->prefix = child_prefix;
+            Node* split_child = new Node(parent_prefix);
+            split_child->children[child_prefix[0]] = child;
+            children[parent_prefix[0]] = split_child;
+
+            return split_child->CreateChild(path_prefix.substr(i));
+          }
+        }
+        child->is_leaf = true;
+        return child->CreateChild(path_prefix.substr(i));
+      }
+
+      Node* CreateWildcardChild() {
+        if (wildcard_child != nullptr) {
+          return wildcard_child;
+        }
+        wildcard_child = new Node();
+        return wildcard_child;
+      }
+
+      Node* NextNode(const std::string& path, size_t idx) const {
+        if (idx >= path.length()) {
+          return nullptr;
+        }
+
+        // wildcard node takes precedence
+        if (children.size() > 1) {
+          auto it = children.find('*');
+          if (it != children.end()) {
+            return it->second;
+          }
+        }
+
+        auto it = children.find(path[idx]);
+        if (it == children.end()) {
+          return nullptr;
+        }
+        auto child = it->second;
+        // match prefix
+        size_t prefix_len = child->prefix.length();
+        for (size_t i = 0; i < path.length(); ++i) {
+          if (i >= prefix_len || child->prefix[i] == '*') {
+            return child;
+          }
+
+          // Handle optional trailing
+          // path = /home/subdirectory
+          // child = subdirectory/*
+          if (idx >= path.length() &&
+              child->prefix[i] == node::kPathSeparator) {
+            continue;
+          }
+
+          if (path[idx++] != child->prefix[i]) {
+            return nullptr;
+          }
+        }
+        return child;
+      }
+
+      // A node can be a *end* node and have children
+      // E.g: */slower*, */slown* are inserted:
+      // /slow
+      // ---> er
+      // ---> n
+      // If */slow* is inserted right after, it will create an
+      // empty node
+      // /slow
+      // ---> '\000' ASCII (0) || \0
+      // ---> er
+      // ---> n
+      bool IsEndNode() const {
+        if (children.empty()) {
+          return true;
+        }
+        return is_leaf;
+      }
+    };
+
+    RadixTree();
+    ~RadixTree();
+    void Insert(const std::string& s);
+    bool Lookup(const std::string_view& s) const { return Lookup(s, false); }
+    bool Lookup(const std::string_view& s, bool when_empty_return) const;
+
+   private:
+    Node* root_node_;
+  };
+
+ private:
+  void GrantAccess(PermissionScope scope, const std::string& param);
+  // fs granted on startup
+  RadixTree granted_in_fs_;
+  RadixTree granted_out_fs_;
+
+  bool deny_all_in_ = true;
+  bool deny_all_out_ = true;
+
+  bool allow_all_in_ = false;
+  bool allow_all_out_ = false;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_FS_PERMISSION_H_

package/src/headers/24/permission/inspector_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_INSPECTOR_PERMISSION_H_
+#define SRC_PERMISSION_INSPECTOR_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <string>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class InspectorPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_INSPECTOR_PERMISSION_H_

package/src/headers/24/permission/permission.h

@@ -0,0 +1,100 @@
+#ifndef SRC_PERMISSION_PERMISSION_H_
+#define SRC_PERMISSION_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "debug_utils.h"
+#include "node_options.h"
+#include "permission/addon_permission.h"
+#include "permission/child_process_permission.h"
+#include "permission/fs_permission.h"
+#include "permission/inspector_permission.h"
+#include "permission/permission_base.h"
+#include "permission/wasi_permission.h"
+#include "permission/worker_permission.h"
+#include "v8.h"
+
+#include <string_view>
+#include <unordered_map>
+
+namespace node {
+
+class Environment;
+
+namespace fs {
+class FSReqBase;
+}
+
+namespace permission {
+
+#define THROW_IF_INSUFFICIENT_PERMISSIONS(env, perm_, resource_, ...)          \
+  do {                                                                         \
+    if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] {  \
+      node::permission::Permission::ThrowAccessDenied(                         \
+          (env), perm_, resource_);                                            \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+#define ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS(                               \
+    env, wrap, perm_, resource_, ...)                                          \
+  do {                                                                         \
+    if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] {  \
+      node::permission::Permission::AsyncThrowAccessDenied(                    \
+          (env), wrap, perm_, resource_);                                      \
+      return __VA_ARGS__;                                                      \
+    }                                                                          \
+  } while (0)
+
+class Permission {
+ public:
+  Permission();
+
+  FORCE_INLINE bool is_granted(Environment* env,
+                               const PermissionScope permission,
+                               const std::string_view& res = "") const {
+    if (!enabled_) [[likely]] {
+      return true;
+    }
+    return is_scope_granted(env, permission, res);
+  }
+
+  FORCE_INLINE bool enabled() const { return enabled_; }
+
+  static PermissionScope StringToPermission(const std::string& perm);
+  static const char* PermissionToString(PermissionScope perm);
+  static void ThrowAccessDenied(Environment* env,
+                                PermissionScope perm,
+                                const std::string_view& res);
+  static void AsyncThrowAccessDenied(Environment* env,
+                                     fs::FSReqBase* req_wrap,
+                                     PermissionScope perm,
+                                     const std::string_view& res);
+
+  // CLI Call
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope);
+  void EnablePermissions();
+
+ private:
+  COLD_NOINLINE bool is_scope_granted(Environment* env,
+                                      const PermissionScope permission,
+                                      const std::string_view& res = "") const {
+    auto perm_node = nodes_.find(permission);
+    if (perm_node != nodes_.end()) {
+      return perm_node->second->is_granted(env, permission, res);
+    }
+    return false;
+  }
+
+  std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
+  bool enabled_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_H_

package/src/headers/24/permission/permission_base.h

@@ -0,0 +1,65 @@
+#ifndef SRC_PERMISSION_PERMISSION_BASE_H_
+#define SRC_PERMISSION_PERMISSION_BASE_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <map>
+#include <string>
+#include <string_view>
+#include "v8.h"
+
+namespace node {
+
+class Environment;
+
+namespace permission {
+
+#define FILESYSTEM_PERMISSIONS(V)                                              \
+  V(FileSystem, "fs", PermissionsRoot, "")                                     \
+  V(FileSystemRead, "fs.read", FileSystem, "--allow-fs-read")                  \
+  V(FileSystemWrite, "fs.write", FileSystem, "--allow-fs-write")
+
+#define CHILD_PROCESS_PERMISSIONS(V)                                           \
+  V(ChildProcess, "child", PermissionsRoot, "--allow-child-process")
+
+#define WASI_PERMISSIONS(V) V(WASI, "wasi", PermissionsRoot, "--allow-wasi")
+
+#define WORKER_THREADS_PERMISSIONS(V)                                          \
+  V(WorkerThreads, "worker", PermissionsRoot, "--allow-worker")
+
+#define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot, "")
+
+#define ADDON_PERMISSIONS(V)                                                   \
+  V(Addon, "addon", PermissionsRoot, "--allow-addons")
+
+#define PERMISSIONS(V)                                                         \
+  FILESYSTEM_PERMISSIONS(V)                                                    \
+  CHILD_PROCESS_PERMISSIONS(V)                                                 \
+  WASI_PERMISSIONS(V)                                                          \
+  WORKER_THREADS_PERMISSIONS(V)                                                \
+  INSPECTOR_PERMISSIONS(V)                                                     \
+  ADDON_PERMISSIONS(V)
+
+#define V(name, _, __, ___) k##name,
+enum class PermissionScope {
+  kPermissionsRoot = -1,
+  PERMISSIONS(V) kPermissionsCount
+};
+#undef V
+
+class PermissionBase {
+ public:
+  virtual void Apply(Environment* env,
+                     const std::vector<std::string>& allow,
+                     PermissionScope scope) = 0;
+  virtual bool is_granted(Environment* env,
+                          PermissionScope perm,
+                          const std::string_view& param = "") const = 0;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_PERMISSION_BASE_H_

package/src/headers/24/permission/wasi_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_WASI_PERMISSION_H_
+#define SRC_PERMISSION_WASI_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <vector>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class WASIPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_WASI_PERMISSION_H_

package/src/headers/24/permission/worker_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_WORKER_PERMISSION_H_
+#define SRC_PERMISSION_WORKER_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <vector>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class WorkerPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_WORKER_PERMISSION_H_