@wasm-oj/server 0.2.0

package/crates/runtime-core/src/bin/wasm-oj-runner.rs

@@ -0,0 +1,294 @@
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+use std::io::{self, Read};
+use std::path::PathBuf;
+use wasm_oj_runtime_core::{
+    DeterminismConfig, ExecutionMetrics, ExecutionTermination, InteractiveMetrics,
+    InteractiveProcessResult, InteractiveProgram, InteractiveRequest, InteractiveResponse,
+    InteractiveResult, ResourcePolicy, RunFailure, RunRequest, RunResponse, RunResult,
+    WASM_OJ_INTERACTIVE_REQUEST_SCHEMA, WASM_OJ_RUN_REQUEST_SCHEMA, interactive_response,
+    run_response,
+};
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+struct CliRunRequest {
+    #[serde(rename = "schema")]
+    _schema: String,
+    wasm_base64: String,
+    #[serde(default)]
+    args: Vec<String>,
+    #[serde(default)]
+    env: BTreeMap<String, String>,
+    #[serde(default)]
+    stdin_base64: String,
+    #[serde(default)]
+    files_base64: BTreeMap<String, String>,
+    #[serde(default)]
+    output_paths: Vec<String>,
+    cwd: Option<String>,
+    startup_entropy_bytes: u64,
+    determinism: DeterminismConfig,
+    resources: ResourcePolicy,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct CliRunResult {
+    code: i32,
+    stdout_base64: String,
+    stderr_base64: String,
+    files_base64: BTreeMap<String, String>,
+    termination: ExecutionTermination,
+    trap_message: Option<String>,
+    metrics: ExecutionMetrics,
+    determinism: DeterminismConfig,
+    resources: ResourcePolicy,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct CliRunResponse {
+    ok: bool,
+    result: Option<CliRunResult>,
+    error: Option<RunFailure>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+struct CliInteractiveRequest {
+    #[serde(rename = "schema")]
+    _schema: String,
+    contestant: CliInteractiveProgram,
+    interactor: CliInteractiveProgram,
+    determinism: DeterminismConfig,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+struct CliInteractiveProgram {
+    wasm_base64: String,
+    #[serde(default)]
+    args: Vec<String>,
+    #[serde(default)]
+    env: BTreeMap<String, String>,
+    #[serde(default)]
+    files_base64: BTreeMap<String, String>,
+    cwd: Option<String>,
+    startup_entropy_bytes: u64,
+    resources: ResourcePolicy,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct CliInteractiveProcessResult {
+    code: i32,
+    stderr_base64: String,
+    termination: ExecutionTermination,
+    metrics: InteractiveMetrics,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct CliInteractiveResult {
+    contestant: CliInteractiveProcessResult,
+    interactor: CliInteractiveProcessResult,
+    contestant_to_interactor_base64: String,
+    interactor_to_contestant_base64: String,
+    determinism: DeterminismConfig,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct CliInteractiveResponse {
+    ok: bool,
+    result: Option<CliInteractiveResult>,
+    error: Option<RunFailure>,
+}
+
+fn main() {
+    match execute() {
+        Ok(true) => {}
+        Ok(false) => std::process::exit(1),
+        Err(error) => {
+            eprintln!("wasm-oj-runner: {error}");
+            std::process::exit(2);
+        }
+    }
+}
+
+fn execute() -> Result<bool, String> {
+    let input = read_input()?;
+    let value: serde_json::Value =
+        serde_json::from_slice(&input).map_err(|error| format!("invalid request JSON: {error}"))?;
+    let schema = value
+        .get("schema")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(|| "request schema must be a string".to_string())?;
+    match schema {
+        WASM_OJ_RUN_REQUEST_SCHEMA => execute_run(value),
+        WASM_OJ_INTERACTIVE_REQUEST_SCHEMA => execute_interactive(value),
+        value => Err(format!("unsupported request schema '{value}'")),
+    }
+}
+
+fn execute_run(value: serde_json::Value) -> Result<bool, String> {
+    let encoded: CliRunRequest = serde_json::from_value(value)
+        .map_err(|error| format!("invalid run request JSON: {error}"))?;
+    let response = encode_response(run_response(decode_request(encoded)?));
+    serde_json::to_writer(io::stdout().lock(), &response)
+        .map_err(|error| format!("failed to serialize response: {error}"))?;
+    Ok(response.ok)
+}
+
+fn execute_interactive(value: serde_json::Value) -> Result<bool, String> {
+    let encoded: CliInteractiveRequest = serde_json::from_value(value)
+        .map_err(|error| format!("invalid interactive request JSON: {error}"))?;
+    let request = InteractiveRequest {
+        contestant: decode_interactive_program(encoded.contestant, "contestant")?,
+        interactor: decode_interactive_program(encoded.interactor, "interactor")?,
+        determinism: encoded.determinism,
+    };
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .map_err(|error| format!("failed to initialize interactive runtime: {error}"))?;
+    let response = encode_interactive_response(runtime.block_on(interactive_response(request)));
+    serde_json::to_writer(io::stdout().lock(), &response)
+        .map_err(|error| format!("failed to serialize response: {error}"))?;
+    Ok(response.ok)
+}
+
+fn decode_request(encoded: CliRunRequest) -> Result<RunRequest, String> {
+    let mut files = BTreeMap::new();
+    for (path, contents) in encoded.files_base64 {
+        files.insert(
+            path.clone(),
+            serde_bytes::ByteBuf::from(
+                STANDARD
+                    .decode(contents)
+                    .map_err(|error| format!("invalid base64 for guest file '{path}': {error}"))?,
+            ),
+        );
+    }
+    Ok(RunRequest {
+        wasm: STANDARD
+            .decode(encoded.wasm_base64)
+            .map_err(|error| format!("invalid wasmBase64: {error}"))?,
+        args: encoded.args,
+        env: encoded.env,
+        stdin: STANDARD
+            .decode(encoded.stdin_base64)
+            .map_err(|error| format!("invalid stdinBase64: {error}"))?,
+        files,
+        output_paths: encoded.output_paths,
+        cwd: encoded.cwd,
+        startup_entropy_bytes: encoded.startup_entropy_bytes,
+        determinism: encoded.determinism,
+        resources: encoded.resources,
+    })
+}
+
+fn decode_interactive_program(
+    encoded: CliInteractiveProgram,
+    label: &str,
+) -> Result<InteractiveProgram, String> {
+    let mut files = BTreeMap::new();
+    for (path, contents) in encoded.files_base64 {
+        files.insert(
+            path.clone(),
+            serde_bytes::ByteBuf::from(STANDARD.decode(contents).map_err(|error| {
+                format!("invalid base64 for {label} guest file '{path}': {error}")
+            })?),
+        );
+    }
+    Ok(InteractiveProgram {
+        wasm: STANDARD
+            .decode(encoded.wasm_base64)
+            .map_err(|error| format!("invalid {label} wasmBase64: {error}"))?,
+        args: encoded.args,
+        env: encoded.env,
+        files,
+        cwd: encoded.cwd,
+        startup_entropy_bytes: encoded.startup_entropy_bytes,
+        resources: encoded.resources,
+    })
+}
+
+fn encode_response(response: RunResponse) -> CliRunResponse {
+    CliRunResponse {
+        ok: response.ok,
+        result: response.result.map(encode_result),
+        error: response.error,
+    }
+}
+
+fn encode_result(result: RunResult) -> CliRunResult {
+    CliRunResult {
+        code: result.code,
+        stdout_base64: STANDARD.encode(result.stdout),
+        stderr_base64: STANDARD.encode(result.stderr),
+        files_base64: result
+            .files
+            .into_iter()
+            .map(|(path, contents)| (path, STANDARD.encode(contents)))
+            .collect(),
+        termination: result.termination,
+        trap_message: result.trap_message,
+        metrics: result.metrics,
+        determinism: result.determinism,
+        resources: result.resources,
+    }
+}
+
+fn encode_interactive_response(response: InteractiveResponse) -> CliInteractiveResponse {
+    CliInteractiveResponse {
+        ok: response.ok,
+        result: response.result.map(encode_interactive_result),
+        error: response.error,
+    }
+}
+
+fn encode_interactive_result(result: InteractiveResult) -> CliInteractiveResult {
+    CliInteractiveResult {
+        contestant: encode_interactive_process(result.contestant),
+        interactor: encode_interactive_process(result.interactor),
+        contestant_to_interactor_base64: STANDARD.encode(result.contestant_to_interactor),
+        interactor_to_contestant_base64: STANDARD.encode(result.interactor_to_contestant),
+        determinism: result.determinism,
+    }
+}
+
+fn encode_interactive_process(result: InteractiveProcessResult) -> CliInteractiveProcessResult {
+    CliInteractiveProcessResult {
+        code: result.code,
+        stderr_base64: STANDARD.encode(result.stderr),
+        termination: result.termination,
+        metrics: result.metrics,
+    }
+}
+
+fn read_input() -> Result<Vec<u8>, String> {
+    let mut arguments = std::env::args_os();
+    let _program = arguments.next();
+    let first = arguments.next();
+    let second = arguments.next();
+    let trailing = arguments.next();
+    match (first, second, trailing) {
+        (None, None, None) => {
+            let mut input = Vec::new();
+            io::stdin()
+                .lock()
+                .read_to_end(&mut input)
+                .map_err(|error| format!("failed to read stdin: {error}"))?;
+            Ok(input)
+        }
+        (Some(flag), Some(path), None) if flag == "--request" => {
+            let path = PathBuf::from(path);
+            std::fs::read(&path)
+                .map_err(|error| format!("failed to read {}: {error}", path.display()))
+        }
+        _ => Err("usage: wasm-oj-runner [--request REQUEST.json]".to_string()),
+    }
+}

package/crates/runtime-core/src/capabilities.rs

@@ -0,0 +1,118 @@
+use wasmer::{AsStoreMut, ExternType, Function, Imports, Module, RuntimeError};
+
+/// Returns whether an import exposes host state that WASM-OJ deliberately keeps
+/// outside the deterministic judge contract.
+///
+/// Denied imports that are part of an admitted ABI remain valid at module
+/// validation time. WASM-OJ resolves each declared function with its exact
+/// signature and replaces the Wasmer implementation with a fail-closed trap,
+/// so no forbidden host implementation is reachable.
+pub(crate) fn is_denied_capability(namespace: &str, name: &str) -> bool {
+    match namespace {
+        "wasi" => name == "thread-spawn",
+        "wasi_snapshot_preview1" => name == "thread-spawn" || name.starts_with("sock_"),
+        "wasix_32v1" | "wasix_64v1" => {
+            matches!(
+                name,
+                "thread_spawn"
+                    | "thread_spawn_v2"
+                    | "thread_signal"
+                    | "thread_join"
+                    | "thread_exit"
+                    | "futex_wait"
+            ) || name.starts_with("sock_")
+                || name.starts_with("port_")
+                || name.starts_with("bus_")
+                || name.starts_with("http_")
+                || name.starts_with("net_")
+                || matches!(name, "resolve" | "clock_time_set")
+                || (name.starts_with("proc_")
+                    && !matches!(name, "proc_exit" | "proc_id" | "proc_parent"))
+        }
+        _ => false,
+    }
+}
+
+/// Replaces every denied WASI/WASIX function with a signature-preserving host
+/// trap. This must run after Wasmer builds the normal WASI import object and
+/// before instantiation so no forbidden implementation is ever reachable.
+pub(crate) fn attach_capability_denials(
+    store: &mut impl AsStoreMut,
+    module: &Module,
+    imports: &mut Imports,
+) -> Result<(), String> {
+    let denied = module
+        .imports()
+        .filter(|import| is_denied_capability(import.module(), import.name()))
+        .map(|import| {
+            let ExternType::Function(function_type) = import.ty() else {
+                return Err(format!(
+                    "denied capability import {}.{} must be a function",
+                    import.module(),
+                    import.name()
+                ));
+            };
+            Ok((
+                import.module().to_string(),
+                import.name().to_string(),
+                function_type.clone(),
+            ))
+        })
+        .collect::<Result<Vec<_>, String>>()?;
+
+    for (namespace, name, function_type) in denied {
+        let capability = format!("{namespace}.{name}");
+        let error_message = format!("WASM-OJ denied nondeterministic capability {capability}");
+        let denial = Function::new(store, function_type, move |_| {
+            Err(RuntimeError::new(error_message.clone()))
+        });
+        imports.define(&namespace, &name, denial);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::is_denied_capability;
+
+    #[test]
+    fn denies_declared_thread_process_and_network_capabilities() {
+        for (namespace, name) in [
+            ("wasi", "thread-spawn"),
+            ("wasi_snapshot_preview1", "sock_recv"),
+            ("wasix_32v1", "thread_spawn"),
+            ("wasix_32v1", "futex_wait"),
+            ("wasix_32v1", "proc_fork"),
+            ("wasix_32v1", "proc_exec"),
+            ("wasix_32v1", "sock_open"),
+            ("wasix_32v1", "resolve"),
+            ("wasix_64v1", "port_bridge"),
+        ] {
+            assert!(
+                is_denied_capability(namespace, name),
+                "{namespace}.{name} must be denied"
+            );
+        }
+    }
+
+    #[test]
+    fn preserves_deterministic_language_runtime_capabilities() {
+        for (namespace, name) in [
+            ("wasi_snapshot_preview1", "fd_write"),
+            ("wasi_snapshot_preview1", "clock_time_get"),
+            ("wasi_snapshot_preview1", "random_get"),
+            ("wasix_32v1", "getcwd"),
+            ("wasix_32v1", "callback_signal"),
+            ("wasix_32v1", "futex_wake"),
+            ("wasix_32v1", "thread_id"),
+            ("wasix_32v1", "thread_parallelism"),
+            ("wasix_32v1", "proc_id"),
+            ("wasix_32v1", "proc_parent"),
+        ] {
+            assert!(
+                !is_denied_capability(namespace, name),
+                "{namespace}.{name} must remain available"
+            );
+        }
+    }
+}