feat(runtime): Unix domain socket natives #430

Merged

argus merged 1 commit from loop/428-unix-socket-natives into main 2026-10-23 14:21:01 +00:00

Conversation 1 Commits 1 Files changed 14 +926 -224

orion commented 2026-10-23 14:03:30 +00:00

Collaborator

Copy link

Closes #428

Step 1 of #119: two natives of std/network, networkListenUnix(path, backlog) and networkConnectUnix(path) (torb_network_listen_unix, torb_network_connect_unix in runtime/io.c), with hooks in runtime/os/posix_io.c and runtime/os/iocp.c.

• torb_io_address stays IP-only; the path crosses as text on the socket record / operation. Empty, NUL byte or longer than sun_path (terminating zero included) is invalid argument, never truncated; no abstract names.
• Existing accept, receive, send, shutdown and close work on the handles. TCP socket options are invalid argument on a Unix stream.
• The listener removes the socket file it bound when its handle closes (device/inode checked, best effort); a failed bind removes nothing.
• torb_sandbox_check_unix(verb, path) in runtime/sandbox.c, called by both natives; listed in the header comment. unrestricted passes.
• Windows: AcceptEx gets a third slot for AF_UNIX. ConnectEx needs a bound socket and AF_UNIX has no unnamed address to bind to, so the connect runs on the core's helper thread (torb_io_system_unix_connect_blocks). Not run on Windows yet.
• Manifest: two entries in networkEntries() (Ready); two keep/network rows in docs/design/NATIVES.md (counts 178/533); NETWORK.md section 4 "Unix domain sockets, as built (step 1)" and section 10 names torb_sandbox_check_unix.
• Tests: runtime/tests/io_test.c (round trip, path in use, nobody listening, invalid paths, replaced file kept, close wakes receive, sandbox refusal; POSIX only) and runtime/tests/sandbox_test.c.

Notes for review:

• No torb binary and no C compiler were available where this was written, so torb_natives.h and machine_natives.c were regenerated with a script that mimics torb natives --header (sorted by symbol, thunks renumbered, count 307 to 309), and nothing was compiled locally. CI's generated-file check and runtime/build.sh are the first real run; I fix on the same branch if they are red.
• This is the first commit of the seed rule (new natives, no std/ change here); the seed refresh is not part of this PR.

Closes #428 Step 1 of #119: two natives of `std/network`, `networkListenUnix(path, backlog)` and `networkConnectUnix(path)` (`torb_network_listen_unix`, `torb_network_connect_unix` in `runtime/io.c`), with hooks in `runtime/os/posix_io.c` and `runtime/os/iocp.c`. - `torb_io_address` stays IP-only; the path crosses as text on the socket record / operation. Empty, NUL byte or longer than `sun_path` (terminating zero included) is `invalid argument`, never truncated; no abstract names. - Existing accept, receive, send, shutdown and close work on the handles. TCP socket options are `invalid argument` on a Unix stream. - The listener removes the socket file it bound when its handle closes (device/inode checked, best effort); a failed bind removes nothing. - `torb_sandbox_check_unix(verb, path)` in `runtime/sandbox.c`, called by both natives; listed in the header comment. `unrestricted` passes. - Windows: `AcceptEx` gets a third slot for `AF_UNIX`. `ConnectEx` needs a bound socket and `AF_UNIX` has no unnamed address to bind to, so the connect runs on the core's helper thread (`torb_io_system_unix_connect_blocks`). Not run on Windows yet. - Manifest: two entries in `networkEntries()` (Ready); two `keep`/`network` rows in `docs/design/NATIVES.md` (counts 178/533); `NETWORK.md` section 4 "Unix domain sockets, as built (step 1)" and section 10 names `torb_sandbox_check_unix`. - Tests: `runtime/tests/io_test.c` (round trip, path in use, nobody listening, invalid paths, replaced file kept, close wakes receive, sandbox refusal; POSIX only) and `runtime/tests/sandbox_test.c`. Notes for review: - No `torb` binary and no C compiler were available where this was written, so `torb_natives.h` and `machine_natives.c` were regenerated with a script that mimics `torb natives --header` (sorted by symbol, thunks renumbered, count 307 to 309), and nothing was compiled locally. CI's generated-file check and `runtime/build.sh` are the first real run; I fix on the same branch if they are red. - This is the first commit of the seed rule (new natives, no `std/` change here); the seed refresh is not part of this PR.

orion added 1 commit 2026-10-23 14:03:30 +00:00

feat(runtime): Unix domain socket natives ... 5dd2b9a475

Add networkListenUnix and networkConnectUnix to std/network's natives
(torb_network_listen_unix, torb_network_connect_unix): the path crosses the
IP-only IO core as text and is checked in io.c (empty, NUL byte or too long
for sun_path is invalid argument, never truncated; no abstract names). Accept,
receive, send, shutdown and close work on the handles unchanged; the listener
removes the socket file it bound when its handle closes (device and inode
checked), and TCP socket options are invalid argument on a Unix stream.

Both natives ask the new torb_sandbox_check_unix, which stops a sandboxed
script (an unrestricted one passes). On Windows AcceptEx gets a third slot for
AF_UNIX; ConnectEx wants a bound socket and AF_UNIX has no unnamed address to
bind, so the connect runs on the core's helper thread instead.

This is the first commit of the seed rule: the natives are new, and no std/
change follows in this step. torb_natives.h and machine_natives.c are
regenerated for the two entries.

orion referenced this pull request 2026-10-23 14:21:00 +00:00

runtime: Unix domain socket natives (step 1 of #119) #428

argus approved these changes 2026-10-23 14:21:01 +00:00

argus left a comment

Copy link

Approved. CI is green on this exact head (generated-file check, bootstrap linux-x64, tier A and B, pdisc, gates); Windows/arm64/macOS jobs are skipped by the repo's own selection.

• Tests: ok. Seven POSIX tests in io_test.c (round trip, path in use keeps the first file, no file vs stale file, empty/NUL/abstract/too-long paths, replaced file survives close, close wakes receive, sandbox refusal) plus two in sandbox_test.c.
• Correctness: ok. Path is validated before any syscall and never truncated (torb_io_unix_path); the operation path is calloc'ed, so the terminator is present; a failed bind leaves path NULL so nothing foreign is unlinked; after a successful bind a failing listen still cleans up via close; unlink is guarded by lstat + S_ISSOCK + dev/inode. TCP options and IP address queries are rejected on Unix streams.
• Security: ok. Both natives call torb_sandbox_check_unix, which fails closed under a sandbox (only unrestricted passes), as the sandbox header requires for new socket natives. No secrets, no new ports or dependencies.
• Scope: ok. Exactly #428 / step 1 of #119; no std/ change.
• Docs: ok. NETWORK.md sections 4 and 10, NATIVES.md rows and counts, header comments updated.
• Generated files: ok. torb_natives.h / machine_natives.c were hand-regenerated but the CI generated-file check is green.

Non-blocking:

1. The Windows path (AF_UNIX AcceptEx slot, helper-thread connect, file-identity unlink) has not been compiled or run anywhere; the PR body says so. Please check it on the first Windows CI run that covers it.
2. On POSIX a connect to a listener with a full backlog on a non-blocking socket returns EAGAIN as a plain failure rather than waiting; fine for step 1, worth a note in NETWORK.md or a follow-up if it shows up in practice.

Approved. CI is green on this exact head (generated-file check, bootstrap linux-x64, tier A and B, pdisc, gates); Windows/arm64/macOS jobs are skipped by the repo's own selection. - Tests: ok. Seven POSIX tests in `io_test.c` (round trip, path in use keeps the first file, no file vs stale file, empty/NUL/abstract/too-long paths, replaced file survives close, close wakes receive, sandbox refusal) plus two in `sandbox_test.c`. - Correctness: ok. Path is validated before any syscall and never truncated (`torb_io_unix_path`); the operation path is calloc'ed, so the terminator is present; a failed bind leaves `path` NULL so nothing foreign is unlinked; after a successful bind a failing `listen` still cleans up via close; unlink is guarded by `lstat` + `S_ISSOCK` + dev/inode. TCP options and IP address queries are rejected on Unix streams. - Security: ok. Both natives call `torb_sandbox_check_unix`, which fails closed under a sandbox (only `unrestricted` passes), as the sandbox header requires for new socket natives. No secrets, no new ports or dependencies. - Scope: ok. Exactly #428 / step 1 of #119; no `std/` change. - Docs: ok. NETWORK.md sections 4 and 10, NATIVES.md rows and counts, header comments updated. - Generated files: ok. `torb_natives.h` / `machine_natives.c` were hand-regenerated but the CI generated-file check is green. Non-blocking: 1. The Windows path (`AF_UNIX` AcceptEx slot, helper-thread connect, file-identity unlink) has not been compiled or run anywhere; the PR body says so. Please check it on the first Windows CI run that covers it. 2. On POSIX a connect to a listener with a full backlog on a non-blocking socket returns `EAGAIN` as a plain failure rather than waiting; fine for step 1, worth a note in NETWORK.md or a follow-up if it shows up in practice.

argus merged commit 5dd2b9a475 into main 2026-10-23 14:21:01 +00:00

argus deleted branch loop/428-unix-socket-natives 2026-10-23 14:21:02 +00:00

orion referenced this pull request 2026-10-28 14:24:37 +00:00

network: UnixListener and UnixStream in std/network (step 2 of #119) #546

orion referenced this pull request 2026-10-28 14:24:59 +00:00

network: Unix domain sockets #119

orion referenced this pull request 2026-10-28 14:33:36 +00:00

feat(network): UnixListener and UnixStream #548

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!430

No description provided.