Struct SubprocessEvaluator 

pub struct SubprocessEvaluator { /* private fields */ }

Available on crate features pac-subprocess and pac only.

PacEvaluator that runs each evaluation in a fresh worker process and kills it at the deadline.

worker is the absolute path of a proxy-watch-pac-worker binary from this same release (built with the pac-subprocess and pac-quickjs features). A relative path is refused with Error::Io at evaluation: a bare name would be looked up on the PATH, and whoever controls the lookup would choose the program that sees every script and URL.

Of PacPolicy’s settings, the timeout covers the whole evaluation (starting the worker, running the script, and every name lookup it asks for) and a worker still running at the deadline is killed. DNS and the internal-address filter are applied here in the parent. myIpAddress, the clock and the UTC offset are handed to the worker. The worker runs QuickJS with a 64 MiB heap, and on Windows and Linux the process has an OS memory limit as well.

Each running worker holds one of the process-wide evaluation slots QuickJS uses too, so Error::PacSaturated bounds worker processes as it bounds threads. A name lookup still running at the deadline keeps its slot until it returns.

The worker starts with an empty environment (Windows keeps SystemRoot) and its own directory as the working directory, and its standard error is discarded.

On Linux (x86-64 and AArch64) the worker runs the script under a seccomp filter that leaves it no system call to open a file, a socket or a process. The parent knows this only from the worker’s own report, so the guarantee is the worker binary’s. On other platforms, or where the kernel refuses the filter, the worker is unconfined, and evaluation fails with Error::Io (io::ErrorKind::PermissionDenied) before the script is sent, unless allow_unsandboxed was called. A worker the filter kills fails the evaluation with Error::PacEvaluation.

Implementations

impl SubprocessEvaluator

pub fn new(worker: impl Into<PathBuf>, policy: PacPolicy) -> Self

An evaluator that starts worker for each evaluation and runs scripts under policy.

pub fn allow_unsandboxed(self) -> Self

Also run scripts in a worker that could not confine itself: everywhere but Linux on x86-64 and AArch64, any worker. The worker keeps the memory limit and the deadline, but one a memory-safety bug has taken over can reach the network and the files of the user it runs as.

pub fn worker(&self) -> &Path

The worker binary this evaluator starts.

pub fn policy(&self) -> &PacPolicy

The policy this evaluator applies.

Trait Implementations

impl Clone for SubprocessEvaluator

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SubprocessEvaluator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PacEvaluator for SubprocessEvaluator

fn evaluate( &self, script: &PacScript, url: &Url, host: &str, ) -> Result<Vec<ProxyStep>, Error>

Run FindProxyForURL(url, host) and parse the result.