nah_exec.h

Go to the documentation of this file.

/*
 * NAH Exec - Contract Execution for NAH
 *
 * This file provides low-level, unsandboxed process spawning for a
 * LaunchContract. Hosts that need isolation should execute the contract with
 * their own platform launcher instead.
 * Platform-specific implementations for Unix and Windows.
 *
 * SPDX-License-Identifier: MIT
 */
 
#ifndef NAH_EXEC_H
#define NAH_EXEC_H
 
#ifdef __cplusplus
 
#include "nah_core.h"
 
#include <algorithm>
#include <cstdlib>
#include <string>
#include <vector>
 
#ifdef _WIN32
#include <windows.h>
#include <process.h>
#else
#include <unistd.h>
#include <sys/wait.h>
#include <cstring>
#endif
 
namespace nah {
namespace exec {
 
// ============================================================================
// EXECUTION RESULT
// ============================================================================
 
struct ExecResult {
    bool ok = false;
    int exit_code = -1;
    std::string error;
};
 
inline std::string validate_contract(const core::LaunchContract& contract) {
    const auto contains_nul = [](const std::string& value) {
        return value.find('\0') != std::string::npos;
    };
    if (contract.execution.binary.empty()) return "execution binary is empty";
    if (contains_nul(contract.execution.binary)) return "execution binary contains NUL";
    if (contains_nul(contract.execution.cwd)) return "working directory contains NUL";
    for (const auto& argument : contract.execution.arguments) {
        if (contains_nul(argument)) return "execution argument contains NUL";
    }
    for (const auto& [key, value] : contract.environment) {
        if (key.empty() || key.find('=') != std::string::npos || contains_nul(key)) {
            return "invalid environment key";
        }
        if (contains_nul(value)) return "environment value contains NUL: " + key;
    }
    if (!contract.execution.library_paths.empty()) {
        const auto& key = contract.execution.library_path_env_key;
        if (key.empty() || key.find('=') != std::string::npos || contains_nul(key)) {
            return "invalid library path environment key";
        }
        for (const auto& path : contract.execution.library_paths) {
            if (contains_nul(path)) return "library path contains NUL";
        }
    }
    return {};
}
 
// ============================================================================
// ENVIRONMENT BUILDING
// ============================================================================
 
inline std::vector<std::string> build_environment(const core::LaunchContract& contract) {
    std::vector<std::string> env;
 
    // Add all contract environment variables
    for (const auto& [key, value] : contract.environment) {
        env.push_back(key + "=" + value);
    }
 
    // Build library path
    if (!contract.execution.library_paths.empty()) {
        std::string lib_path;
        char sep = core::get_path_separator();
 
        for (size_t i = 0; i < contract.execution.library_paths.size(); i++) {
            if (i > 0) lib_path += sep;
            lib_path += contract.execution.library_paths[i];
        }
 
        // Check if key already exists in environment
        std::string lib_key = contract.execution.library_path_env_key;
        bool found = false;
        for (auto& e : env) {
            if (e.find(lib_key + "=") == 0) {
                // Prepend to existing value
                std::string existing = e.substr(lib_key.size() + 1);
                e = lib_key + "=" + lib_path + sep + existing;
                found = true;
                break;
            }
        }
 
        if (!found) {
            env.push_back(lib_key + "=" + lib_path);
        }
    }
 
    std::sort(env.begin(), env.end());
    return env;
}
 
// ============================================================================
// COMMAND LINE BUILDING
// ============================================================================
 
inline std::vector<std::string> build_argv(const core::LaunchContract& contract) {
    std::vector<std::string> argv;
    argv.push_back(contract.execution.binary);
    for (const auto& arg : contract.execution.arguments) {
        argv.push_back(arg);
    }
    return argv;
}
 
// ============================================================================
// UNIX EXECUTION
// ============================================================================
 
#ifndef _WIN32
 
inline ExecResult execute_unix(const core::LaunchContract& contract) {
    ExecResult result;
 
    if (const auto error = validate_contract(contract); !error.empty()) {
        result.error = error;
        return result;
    }
 
    auto argv_strings = build_argv(contract);
    auto env_strings = build_environment(contract);
 
    // Build C-style arrays
    std::vector<char*> argv;
    for (auto& s : argv_strings) {
        argv.push_back(const_cast<char*>(s.c_str()));
    }
    argv.push_back(nullptr);
 
    std::vector<char*> envp;
    for (auto& s : env_strings) {
        envp.push_back(const_cast<char*>(s.c_str()));
    }
    envp.push_back(nullptr);
 
    pid_t pid = fork();
 
    if (pid == -1) {
        result.error = "fork failed: " + std::string(strerror(errno));
        return result;
    }
 
    if (pid == 0) {
        // Child process
 
        // Change directory
        if (!contract.execution.cwd.empty()) {
            if (chdir(contract.execution.cwd.c_str()) != 0) {
                _exit(127);
            }
        }
 
        // Execute
        execve(contract.execution.binary.c_str(), argv.data(), envp.data());
 
        // If execve returns, it failed
        _exit(127);
    }
 
    int status;
    if (waitpid(pid, &status, 0) == -1) {
        result.error = "waitpid failed: " + std::string(strerror(errno));
        return result;
    }
 
    if (WIFEXITED(status)) {
        result.exit_code = WEXITSTATUS(status);
        result.ok = true;
    } else if (WIFSIGNALED(status)) {
        result.exit_code = 128 + WTERMSIG(status);
        result.ok = true;
    } else {
        result.error = "process terminated abnormally";
    }
 
    return result;
}
 
inline ExecResult exec_replace_unix(const core::LaunchContract& contract) {
    ExecResult result;
 
    if (const auto error = validate_contract(contract); !error.empty()) {
        result.error = error;
        return result;
    }
 
    auto argv_strings = build_argv(contract);
    auto env_strings = build_environment(contract);
 
    std::vector<char*> argv;
    for (auto& s : argv_strings) {
        argv.push_back(const_cast<char*>(s.c_str()));
    }
    argv.push_back(nullptr);
 
    std::vector<char*> envp;
    for (auto& s : env_strings) {
        envp.push_back(const_cast<char*>(s.c_str()));
    }
    envp.push_back(nullptr);
 
    // Change directory
    if (!contract.execution.cwd.empty()) {
        if (chdir(contract.execution.cwd.c_str()) != 0) {
            result.error = "chdir failed: " + std::string(strerror(errno));
            return result;
        }
    }
 
    // Replace process
    execve(contract.execution.binary.c_str(), argv.data(), envp.data());
 
    // If we get here, execve failed
    result.error = "execve failed: " + std::string(strerror(errno));
    return result;
}
 
#endif // !_WIN32
 
// ============================================================================
// WINDOWS EXECUTION
// ============================================================================
 
#ifdef _WIN32
 
inline std::string build_command_line(const std::vector<std::string>& argv) {
    std::string cmd;
    for (size_t i = 0; i < argv.size(); i++) {
        if (i > 0) cmd += " ";
        const auto& argument = argv[i];
        const bool quote = argument.empty() || argument.find_first_of(" \t\"") != std::string::npos;
        if (!quote) { cmd += argument; continue; }
        cmd += '"';
        std::size_t backslashes = 0;
        for (const char character : argument) {
            if (character == '\\') { ++backslashes; continue; }
            if (character == '"') {
                cmd.append(backslashes * 2 + 1, '\\');
                cmd += '"';
            } else {
                cmd.append(backslashes, '\\');
                cmd += character;
            }
            backslashes = 0;
        }
        cmd.append(backslashes * 2, '\\');
        cmd += '"';
    }
    return cmd;
}
 
inline std::string build_environment_block(const std::vector<std::string>& env) {
    std::string block;
    for (const auto& e : env) {
        block += e;
        block += '\0';
    }
    block += '\0';  // Double null terminator
    return block;
}
 
namespace detail {
inline ExecResult spawn_windows(const core::LaunchContract& contract, bool wait_for_exit) {
    ExecResult result;
 
    if (const auto error = validate_contract(contract); !error.empty()) {
        result.error = error;
        return result;
    }
 
    auto argv = build_argv(contract);
    auto env = build_environment(contract);
 
    std::string cmd_line = build_command_line(argv);
    std::string env_block = build_environment_block(env);
 
    STARTUPINFOA si = {0};
    si.cb = sizeof(si);
 
    PROCESS_INFORMATION pi = {0};
 
    BOOL success = CreateProcessA(
        contract.execution.binary.c_str(),
        cmd_line.data(),
        nullptr,  // Process security attributes
        nullptr,  // Thread security attributes
        FALSE,    // Inherit handles
        0,        // Creation flags
        env_block.data(),
        contract.execution.cwd.empty() ? nullptr : contract.execution.cwd.c_str(),
        &si,
        &pi
    );
 
    if (!success) {
        result.error = "CreateProcess failed: " + std::to_string(GetLastError());
        return result;
    }
 
    if (wait_for_exit) {
        if (WaitForSingleObject(pi.hProcess, INFINITE) == WAIT_FAILED) {
            result.error = "WaitForSingleObject failed: " + std::to_string(GetLastError());
            CloseHandle(pi.hProcess);
            CloseHandle(pi.hThread);
            return result;
        }
 
        DWORD exit_code;
        if (GetExitCodeProcess(pi.hProcess, &exit_code)) {
            result.exit_code = static_cast<int>(exit_code);
            result.ok = true;
        } else {
            result.error = "GetExitCodeProcess failed";
        }
    } else {
        result.ok = true;
        result.exit_code = 0;
    }
 
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
 
    return result;
}
} // namespace detail
 
#endif // _WIN32
 
// ============================================================================
// CROSS-PLATFORM API
// ============================================================================
 
inline ExecResult execute(const core::LaunchContract& contract) {
#ifdef _WIN32
    return detail::spawn_windows(contract, true);
#else
    return execute_unix(contract);
#endif
}
 
inline ExecResult exec_replace(const core::LaunchContract& contract) {
#ifdef _WIN32
    auto result = detail::spawn_windows(contract, false);
    if (result.ok) {
        ExitProcess(0);
    }
    return result;
#else
    return exec_replace_unix(contract);
#endif
}
 
} // namespace exec
} // namespace nah
 
#endif // __cplusplus
 
#endif // NAH_EXEC_H