harn-vm 0.10.180

Async bytecode virtual machine for the Harn programming language
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

use crate::orchestration::{CapabilityPolicy, ProcessNetworkProxy};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub(super) enum ProcessNetworkGrant {
    Denied,
    Loopback { proxy: Option<ProcessNetworkProxy> },
    Public { proxy: Option<ProcessNetworkProxy> },
}

impl ProcessNetworkGrant {
    pub(super) fn for_policy(policy: &CapabilityPolicy) -> Self {
        // An explicit child loopback grant is narrower than the host tool ceiling.
        if policy.process_sandbox.allow_tcp_loopback {
            Self::Loopback {
                proxy: policy.process_network_proxy,
            }
        } else if allows_network(policy) {
            Self::Public {
                proxy: policy.process_network_proxy,
            }
        } else {
            Self::Denied
        }
    }

    pub(super) fn direct_network(self) -> bool {
        matches!(self, Self::Public { proxy: None })
    }

    pub(super) fn tcp_loopback(self) -> bool {
        matches!(self, Self::Loopback { .. } | Self::Public { proxy: None })
    }

    pub(super) fn managed_proxy(self) -> bool {
        matches!(
            self,
            Self::Loopback { proxy: Some(_) } | Self::Public { proxy: Some(_) }
        )
    }

    #[cfg(target_os = "linux")]
    pub(super) fn loopback_only(self) -> bool {
        matches!(self, Self::Loopback { .. })
    }
}

pub(crate) fn allows_network(policy: &CapabilityPolicy) -> bool {
    policy.allows_network()
}