sandboxedjs 0.2.5 → 0.2.6

package/dist/index.cjs

@@ -21057,7 +21057,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.2.5"};
+  version: "0.2.6"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -22722,8 +22722,12 @@ function createHostAbiServer(proc) {
       }
       case Op.resolve: {
         const sockets = proc.sockets;
+        const name = r.string();
+        if (/^(\d{1,3}\.){3}\d{1,3}$/.test(name)) {
+          return { status: 0, payload: new Writer().string(name).finish() };
+        }
         if (!sockets?.outbound) throw new PosixError(Errno.ENOSYS);
-        const address = sockets.outbound.resolve(r.string());
+        const address = sockets.outbound.resolve(name);
         return { status: 0, payload: new Writer().string(address).finish() };
       }
       case Op.send: {
@@ -24850,6 +24854,77 @@ if os.environ.get("SBX_OUTBOUND_SOCKETS") == "1":
     sys.meta_path.insert(0, _SbxTruststoreHook())
 
 
+# Literal addresses are answered here rather than through the host.
+#
+# The container's resolver is a host call, and a container with no outbound
+# sockets configured has no resolver to call: it answers ENOSYS. That is the
+# right answer for a name, but the egress hop below dials 127.0.0.1, and
+# http.client calls getaddrinfo even for an address that needs no resolving --
+# so every request through the egress died with "Function not implemented"
+# before it reached the endpoint. A numeric address (and loopback by its usual
+# names) is now formed here, which is what a resolver would have returned.
+def _sbx_local_addresses():
+    import socket as _socket_module
+    import _socket as _socket_native
+
+    # The native entry point, not socket.getaddrinfo: the stdlib wrapper
+    # delegates to _socket, so wrapping the wrapper and replacing _socket with
+    # the wrapper makes the two call each other forever.
+    _real_getaddrinfo = _socket_native.getaddrinfo
+
+    _literals = {"localhost": "127.0.0.1", "localhost.localdomain": "127.0.0.1",
+                 "ip6-localhost": "127.0.0.1"}
+
+    def _literal(host):
+        """The address host already is, or None when it needs a resolver."""
+        if isinstance(host, (bytes, bytearray)):
+            host = bytes(host).decode("ascii", "replace")
+        if host is None:
+            return None
+        host = _literals.get(host.lower(), host)
+        parts = host.split(".")
+        if len(parts) != 4:
+            return None
+        for part in parts:
+            if not part.isdigit() or len(part) > 3 or int(part) > 255:
+                return None
+        return host
+
+    def getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
+        address = _literal(host)
+        if address is None:
+            return _real_getaddrinfo(host, port, family, type, proto, flags)
+        if isinstance(port, (bytes, bytearray)):
+            port = bytes(port).decode("ascii", "replace")
+        if isinstance(port, str):
+            port = int(port) if port.isdigit() else _socket_module.getservbyname(port)
+        if port is None:
+            port = 0
+        if family not in (0, _socket_module.AF_UNSPEC, _socket_module.AF_INET):
+            raise _socket_module.gaierror(
+                _socket_module.EAI_FAMILY, "only AF_INET is supported in this container"
+            )
+        kind = type or _socket_module.SOCK_STREAM
+        protocol = proto or (_socket_module.IPPROTO_TCP
+                             if kind == _socket_module.SOCK_STREAM else 0)
+        return [(_socket_module.AF_INET, kind, protocol, "", (address, int(port)))]
+
+    def gethostbyname(host):
+        return getaddrinfo(host, 0)[0][4][0]
+
+    def gethostbyname_ex(host):
+        return (host, [], [gethostbyname(host)])
+
+    _socket_module.getaddrinfo = getaddrinfo
+    _socket_module.gethostbyname = gethostbyname
+    _socket_module.gethostbyname_ex = gethostbyname_ex
+    _socket_native.getaddrinfo = getaddrinfo
+    _socket_native.gethostbyname = gethostbyname
+    _socket_native.gethostbyname_ex = gethostbyname_ex
+
+
+_sbx_local_addresses()
+
 _egress = None if os.environ.get("SBX_OUTBOUND_SOCKETS") == "1" else os.environ.get("SBX_HTTP_EGRESS")
 if _egress:
     import http.client

package/dist/index.js

@@ -21040,7 +21040,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.2.5"};
+  version: "0.2.6"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -22705,8 +22705,12 @@ function createHostAbiServer(proc) {
       }
       case Op.resolve: {
         const sockets = proc.sockets;
+        const name = r.string();
+        if (/^(\d{1,3}\.){3}\d{1,3}$/.test(name)) {
+          return { status: 0, payload: new Writer().string(name).finish() };
+        }
         if (!sockets?.outbound) throw new PosixError(Errno.ENOSYS);
-        const address = sockets.outbound.resolve(r.string());
+        const address = sockets.outbound.resolve(name);
         return { status: 0, payload: new Writer().string(address).finish() };
       }
       case Op.send: {
@@ -24833,6 +24837,77 @@ if os.environ.get("SBX_OUTBOUND_SOCKETS") == "1":
     sys.meta_path.insert(0, _SbxTruststoreHook())
 
 
+# Literal addresses are answered here rather than through the host.
+#
+# The container's resolver is a host call, and a container with no outbound
+# sockets configured has no resolver to call: it answers ENOSYS. That is the
+# right answer for a name, but the egress hop below dials 127.0.0.1, and
+# http.client calls getaddrinfo even for an address that needs no resolving --
+# so every request through the egress died with "Function not implemented"
+# before it reached the endpoint. A numeric address (and loopback by its usual
+# names) is now formed here, which is what a resolver would have returned.
+def _sbx_local_addresses():
+    import socket as _socket_module
+    import _socket as _socket_native
+
+    # The native entry point, not socket.getaddrinfo: the stdlib wrapper
+    # delegates to _socket, so wrapping the wrapper and replacing _socket with
+    # the wrapper makes the two call each other forever.
+    _real_getaddrinfo = _socket_native.getaddrinfo
+
+    _literals = {"localhost": "127.0.0.1", "localhost.localdomain": "127.0.0.1",
+                 "ip6-localhost": "127.0.0.1"}
+
+    def _literal(host):
+        """The address host already is, or None when it needs a resolver."""
+        if isinstance(host, (bytes, bytearray)):
+            host = bytes(host).decode("ascii", "replace")
+        if host is None:
+            return None
+        host = _literals.get(host.lower(), host)
+        parts = host.split(".")
+        if len(parts) != 4:
+            return None
+        for part in parts:
+            if not part.isdigit() or len(part) > 3 or int(part) > 255:
+                return None
+        return host
+
+    def getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
+        address = _literal(host)
+        if address is None:
+            return _real_getaddrinfo(host, port, family, type, proto, flags)
+        if isinstance(port, (bytes, bytearray)):
+            port = bytes(port).decode("ascii", "replace")
+        if isinstance(port, str):
+            port = int(port) if port.isdigit() else _socket_module.getservbyname(port)
+        if port is None:
+            port = 0
+        if family not in (0, _socket_module.AF_UNSPEC, _socket_module.AF_INET):
+            raise _socket_module.gaierror(
+                _socket_module.EAI_FAMILY, "only AF_INET is supported in this container"
+            )
+        kind = type or _socket_module.SOCK_STREAM
+        protocol = proto or (_socket_module.IPPROTO_TCP
+                             if kind == _socket_module.SOCK_STREAM else 0)
+        return [(_socket_module.AF_INET, kind, protocol, "", (address, int(port)))]
+
+    def gethostbyname(host):
+        return getaddrinfo(host, 0)[0][4][0]
+
+    def gethostbyname_ex(host):
+        return (host, [], [gethostbyname(host)])
+
+    _socket_module.getaddrinfo = getaddrinfo
+    _socket_module.gethostbyname = gethostbyname
+    _socket_module.gethostbyname_ex = gethostbyname_ex
+    _socket_native.getaddrinfo = getaddrinfo
+    _socket_native.gethostbyname = gethostbyname
+    _socket_native.gethostbyname_ex = gethostbyname_ex
+
+
+_sbx_local_addresses()
+
 _egress = None if os.environ.get("SBX_OUTBOUND_SOCKETS") == "1" else os.environ.get("SBX_HTTP_EGRESS")
 if _egress:
     import http.client

package/dist/python-abi.cjs

@@ -1653,8 +1653,12 @@ function createHostAbiServer(proc) {
       }
       case Op.resolve: {
         const sockets = proc.sockets;
+        const name = r.string();
+        if (/^(\d{1,3}\.){3}\d{1,3}$/.test(name)) {
+          return { status: 0, payload: new Writer().string(name).finish() };
+        }
         if (!sockets?.outbound) throw new PosixError(Errno.ENOSYS);
-        const address = sockets.outbound.resolve(r.string());
+        const address = sockets.outbound.resolve(name);
         return { status: 0, payload: new Writer().string(address).finish() };
       }
       case Op.send: {

package/dist/python-abi.js

@@ -1651,8 +1651,12 @@ function createHostAbiServer(proc) {
       }
       case Op.resolve: {
         const sockets = proc.sockets;
+        const name = r.string();
+        if (/^(\d{1,3}\.){3}\d{1,3}$/.test(name)) {
+          return { status: 0, payload: new Writer().string(name).finish() };
+        }
         if (!sockets?.outbound) throw new PosixError(Errno.ENOSYS);
-        const address = sockets.outbound.resolve(r.string());
+        const address = sockets.outbound.resolve(name);
         return { status: 0, payload: new Writer().string(address).finish() };
       }
       case Op.send: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandboxedjs",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "A Linux-like container that runs entirely inside Node.js — POSIX shell, ~140 coreutils, Node.js and Python runtimes, virtual filesystem and networking. No Docker, no VM, no native modules.",
   "type": "module",
   "license": "MIT",