dckc/captoys
1
0 Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

capsite/toybox: egress through Flower-style switchboard handles

Browse Source 
The switchboard now serves a Cap'n Web Handle on each of its sockets:
public (no loopback or private addresses) and local. A socket's labels
are fixed in config, so holding the socket's fd is holding that handle;
constrain(labels) returns a narrower one, as Flower's Constrain returns
a narrower fd. Labels only accumulate: a missing key matches anything,
and a key both sides set must agree (labels.js, shared by both).

The switchboard enforces the labels; toybox's Egress no longer checks
URLs itself. It opens a session to its one switchboard socket, constrains
the handle to the vat's grant, and forwards through it; a WebSocket
crosses the session as a pair of message streams. A vat narrows its own
grant with env.egress.constrain().

Grants are now labels as JSON. One stored before, a bare host[:port],
reads as {host, port}.

pnpm start and the systemd units give toybox the public handle; the
switchboard unit binds the local one in its own 0700 runtime directory.
The tests give their toybox the local handle to reach an echo server,
and check that a toybox holding only the public one never reaches it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
dckcandClaude Opus 5.5 committed 2026-10-13 21:44:29 -05:00
1 parent 2820c015ee
commit f0557d29d6
14 files changed
+337 -92
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

toybox/test/vat.test.js
+77 -29
View File
@@ -1,4 +1,4 @@
/** @file toybox end to end: a real workerd, an admin socket, a public port, a switchboard. */
/** @file toybox end to end: a real workerd, an admin socket, a public port, a switchboard with two handles. */
import { spawn } from "node:child_process";
import { mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
import { createServer as createHttpServer, request } from "node:http";
@@ -31,9 +31,10 @@ const accepting = (opts) =>
/** @param {string} socketPath the admin socket; holding it is the authority to install */
const makeAdmin = (socketPath) => ({
install: (vat, src, egress) =>
install: (vat, src, labels) =>
new Promise((resolve, reject) => {
const path = egress ? `/${vat}?egress=${encodeURIComponent(egress)}` : `/${vat}`;
const grant = typeof labels === "string" ? labels : JSON.stringify(labels);
const path = labels ? `/${vat}?egress=${encodeURIComponent(grant)}` : `/${vat}`;
const req = request({ socketPath, path, method: "PUT", agent: false }, (res) => {
let body = "";
res.on("data", (c) => (body += c));
@@ -75,44 +76,57 @@ const startWorkerd = async (config, args, listening, stale = []) => {
throw new Error(`workerd did not start: ${log}`);
};
/** An HTTP server that answers GET with "plain ok" and echoes WebSocket messages. */
/** An HTTP server that answers GET with "plain ok", echoes WebSocket messages, and counts requests. */
const startEcho = async () => {
const server = createHttpServer((_req, res) => res.end("plain ok"));
let hits = 0;
const server = createHttpServer((_req, res) => (hits++, res.end("plain ok")));
const wss = new WebSocketServer({ server });
wss.on("connection", (ws) => ws.on("message", (m) => ws.send(String(m))));
await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
return {
host: `127.0.0.1:${server.address().port}`,
hits: () => hits,
stop: () => new Promise((resolve) => (wss.close(), server.closeAllConnections(), server.close(resolve))),
};
};
let dir, port, server, switchboard, echo, admin, pub;
let dir, port, server, switchboard, echo, echoLabels, admin, pub;
const startToybox = () =>
startWorkerd(
/**
* A toybox in `dir/<name>` that holds one switchboard handle.
*
* @param {string} name
* @param {number} port
* @param {"public" | "local"} handle which switchboard socket it gets
*/
const startToybox = async (name, port, handle) => {
const home = join(dir, name);
await mkdir(join(home, "state"), { recursive: true });
return startWorkerd(
"config.capnp",
[
"-s", `http=127.0.0.1:${port}`, "-s", `admin=unix:${join(dir, "admin.sock")}`,
"-d", `state=${join(dir, "state")}`, "-e", `switchboard=unix:${join(dir, "switchboard.sock")}`,
"-s", `http=127.0.0.1:${port}`, "-s", `admin=unix:${join(home, "admin.sock")}`,
"-d", `state=${join(home, "state")}`, "-e", `switchboard=unix:${join(dir, `sb-${handle}.sock`)}`,
],
{ port, host: "127.0.0.1" },
[join(dir, "admin.sock")],
[join(home, "admin.sock")],
);
};
before(async () => {
dir = await mkdtemp(join(tmpdir(), "toybox-"));
await mkdir(join(dir, "state"));
port = await freePort();
echo = await startEcho();
echoLabels = { host: "127.0.0.1", port: echo.host.split(":")[1] };
switchboard = await startWorkerd(
"switchboard.capnp",
["-s", `http=unix:${join(dir, "switchboard.sock")}`],
{ path: join(dir, "switchboard.sock") },
[join(dir, "switchboard.sock")],
["-s", `public=unix:${join(dir, "sb-public.sock")}`, "-s", `local=unix:${join(dir, "sb-local.sock")}`],
{ path: join(dir, "sb-local.sock") },
[join(dir, "sb-public.sock"), join(dir, "sb-local.sock")],
);
server = await startToybox();
admin = makeAdmin(join(dir, "admin.sock"));
// the tests' echo server is on localhost, so this toybox holds the local handle
server = await startToybox("main", port, "local");
admin = makeAdmin(join(dir, "main", "admin.sock"));
pub = makePublic(`http://127.0.0.1:${port}`);
});
@@ -154,17 +168,21 @@ test("code and state survive a restart", async () => {
await admin.install("dave", await app("counter-v1.js"));
assert.equal(await pub.get("dave"), "v1 count 1\n");
await server.stop();
server = await startToybox();
server = await startToybox("main", port, "local");
assert.equal(await pub.get("dave"), "v1 count 2\n");
});
const probe = (vat, target, ws) =>
pub.get(`${vat}?url=${encodeURIComponent(`http://${target}/`)}${ws ? "&ws=1" : ""}`);
const probe = (vat, target, { ws, constrain } = {}) =>
pub.get(
`${vat}?url=${encodeURIComponent(`http://${target}/`)}` +
(ws ? "&ws=1" : "") +
(constrain ? `&constrain=${encodeURIComponent(JSON.stringify(constrain))}` : ""),
);
test("a vat granted a host reaches it through the switchboard: fetch and WebSocket", async () => {
await admin.install("erin", await app("egress-probe.js"), echo.host);
await admin.install("erin", await app("egress-probe.js"), echoLabels);
assert.equal(await probe("erin", echo.host), "got: plain ok\n");
assert.equal(await probe("erin", echo.host, true), "echo: hello\n");
assert.equal(await probe("erin", echo.host, { ws: true }), "echo: hello\n");
});
test("same code, no grant: no egress", async () => {
@@ -173,18 +191,48 @@ test("same code, no grant: no egress", async () => {
});
test("a grant is an object, not ambient: the global fetch still throws", async () => {
await admin.install("heidi", await app("try-fetch.js"), echo.host);
await admin.install("heidi", await app("try-fetch.js"), echoLabels);
assert.match(await pub.get("heidi"), /^fetch refused: This worker is not permitted to access the internet/);
});
test("a grant covers one host only", async () => {
await admin.install("grace", await app("egress-probe.js"), "127.0.0.1:1");
assert.equal(await probe("grace", echo.host), `got: egress to ${echo.host} not granted\n\n`);
assert.match(await probe("grace", echo.host, true), /^no websocket: 403 egress to .* not granted/);
test("the switchboard refuses what a grant doesn't cover", async () => {
await admin.install("grace", await app("egress-probe.js"), { host: "127.0.0.1", port: "1" });
assert.match(await probe("grace", echo.host), /^got: egress refused: .*egress to 127\.0\.0\.1 not granted/);
assert.match(await probe("grace", echo.host, { ws: true }), /^no websocket: 403 egress refused: .*not granted/);
});
test("a vat can narrow its grant, but not contradict it", async () => {
await admin.install("ivan", await app("egress-probe.js"), { scheme: "http" });
assert.equal(await probe("ivan", echo.host, { constrain: echoLabels }), "got: plain ok\n");
assert.match(
await probe("ivan", echo.host, { constrain: { scheme: "https" } }),
/^refused: label scheme is already set to a different value/,
);
});
test("a grant stored before labels, a bare host:port, still works", async () => {
await admin.install("kim", await app("egress-probe.js"), echo.host);
assert.equal(await probe("kim", echo.host), "got: plain ok\n");
});
test("a grant survives a restart", async () => {
await server.stop();
server = await startToybox();
assert.equal(await probe("erin", echo.host, true), "echo: hello\n");
server = await startToybox("main", port, "local");
assert.equal(await probe("erin", echo.host, { ws: true }), "echo: hello\n");
});
test("a toybox holding only the public handle can't reach localhost, whatever the grant", async () => {
const port2 = await freePort();
const other = await startToybox("public-only", port2, "public");
try {
const admin2 = makeAdmin(join(dir, "public-only", "admin.sock"));
await admin2.install("judy", await app("egress-probe.js"), echoLabels);
const before = echo.hits();
const got = await (await fetch(`http://127.0.0.1:${port2}/judy?url=${encodeURIComponent(`http://${echo.host}/`)}`)).text();
// workerd reports the public network's refusal (restrictPeers) to JS only as "internal error"
assert.match(got, /^got: egress refused: /);
assert.equal(echo.hits(), before);
} finally {
await other.stop();
}
});