cannam@135: # Copyright (c) 2014 Sandstorm Development Group, Inc. and contributors
cannam@135: # Licensed under the MIT License:
cannam@135: #
cannam@135: # Permission is hereby granted, free of charge, to any person obtaining a copy
cannam@135: # of this software and associated documentation files (the "Software"), to deal
cannam@135: # in the Software without restriction, including without limitation the rights
cannam@135: # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
cannam@135: # copies of the Software, and to permit persons to whom the Software is
cannam@135: # furnished to do so, subject to the following conditions:
cannam@135: #
cannam@135: # The above copyright notice and this permission notice shall be included in
cannam@135: # all copies or substantial portions of the Software.
cannam@135: #
cannam@135: # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
cannam@135: # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
cannam@135: # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
cannam@135: # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
cannam@135: # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
cannam@135: # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
cannam@135: # THE SOFTWARE.
cannam@135: 
cannam@135: @0xb8630836983feed7;
cannam@135: 
cannam@135: $import "/capnp/c++.capnp".namespace("capnp");
cannam@135: 
cannam@135: interface Persistent@0xc8cb212fcd9f5691(SturdyRef, Owner) {
cannam@135:   # Interface implemented by capabilities that outlive a single connection. A client may save()
cannam@135:   # the capability, producing a SturdyRef. The SturdyRef can be stored to disk, then later used to
cannam@135:   # obtain a new reference to the capability on a future connection.
cannam@135:   #
cannam@135:   # The exact format of SturdyRef depends on the "realm" in which the SturdyRef appears. A "realm"
cannam@135:   # is an abstract space in which all SturdyRefs have the same format and refer to the same set of
cannam@135:   # resources. Every vat is in exactly one realm. All capability clients within that vat must
cannam@135:   # produce SturdyRefs of the format appropriate for the realm.
cannam@135:   #
cannam@135:   # Similarly, every VatNetwork also resides in a particular realm. Usually, a vat's "realm"
cannam@135:   # corresponds to the realm of its main VatNetwork. However, a Vat can in fact communicate over
cannam@135:   # a VatNetwork in a different realm -- in this case, all SturdyRefs need to be transformed when
cannam@135:   # coming or going through said VatNetwork. The RPC system has hooks for registering
cannam@135:   # transformation callbacks for this purpose.
cannam@135:   #
cannam@135:   # Since the format of SturdyRef is realm-dependent, it is not defined here. An application should
cannam@135:   # choose an appropriate realm for itself as part of its design. Note that under Sandstorm, every
cannam@135:   # application exists in its own realm and is therefore free to define its own SturdyRef format;
cannam@135:   # the Sandstorm platform handles translating between realms.
cannam@135:   #
cannam@135:   # Note that whether a capability is persistent is often orthogonal to its type. In these cases,
cannam@135:   # the capability's interface should NOT inherit `Persistent`; instead, just perform a cast at
cannam@135:   # runtime. It's not type-safe, but trying to be type-safe in these cases will likely lead to
cannam@135:   # tears. In cases where a particular interface only makes sense on persistent capabilities, it
cannam@135:   # still should not explicitly inherit Persistent because the `SturdyRef` and `Owner` types will
cannam@135:   # vary between realms (they may even be different at the call site than they are on the
cannam@135:   # implementation). Instead, mark persistent interfaces with the $persistent annotation (defined
cannam@135:   # below).
cannam@135:   #
cannam@135:   # Sealing
cannam@135:   # -------
cannam@135:   #
cannam@135:   # As an added security measure, SturdyRefs may be "sealed" to a particular owner, such that
cannam@135:   # if the SturdyRef itself leaks to a third party, that party cannot actually restore it because
cannam@135:   # they are not the owner. To restore a sealed capability, you must first prove to its host that
cannam@135:   # you are the rightful owner. The precise mechanism for this authentication is defined by the
cannam@135:   # realm.
cannam@135:   #
cannam@135:   # Sealing is a defense-in-depth mechanism meant to mitigate damage in the case of catastrophic
cannam@135:   # attacks. For example, say an attacker temporarily gains read access to a database full of
cannam@135:   # SturdyRefs: it would be unfortunate if it were then necessary to revoke every single reference
cannam@135:   # in the database to prevent the attacker from using them.
cannam@135:   #
cannam@135:   # In general, an "owner" is a course-grained identity. Because capability-based security is still
cannam@135:   # the primary mechanism of security, it is not necessary nor desirable to have a separate "owner"
cannam@135:   # identity for every single process or object; that is exactly what capabilities are supposed to
cannam@135:   # avoid! Instead, it makes sense for an "owner" to literally identify the owner of the machines
cannam@135:   # where the capability is stored. If untrusted third parties are able to run arbitrary code on
cannam@135:   # said machines, then the sandbox for that code should be designed using Distributed Confinement
cannam@135:   # such that the third-party code never sees the bits of the SturdyRefs and cannot directly
cannam@135:   # exercise the owner's power to restore refs. See:
cannam@135:   #
cannam@135:   #     http://www.erights.org/elib/capability/dist-confine.html
cannam@135:   #
cannam@135:   # Resist the urge to represent an Owner as a simple public key. The whole point of sealing is to
cannam@135:   # defend against leaked-storage attacks. Such attacks can easily result in the owner's private
cannam@135:   # key being stolen as well. A better solution is for `Owner` to contain a simple globally unique
cannam@135:   # identifier for the owner, and for everyone to separately maintain a mapping of owner IDs to
cannam@135:   # public keys. If an owner's private key is compromised, then humans will need to communicate
cannam@135:   # and agree on a replacement public key, then update the mapping.
cannam@135:   #
cannam@135:   # As a concrete example, an `Owner` could simply contain a domain name, and restoring a SturdyRef
cannam@135:   # would require signing a request using the domain's private key. Authenticating this key could
cannam@135:   # be accomplished through certificate authorities or web-of-trust techniques.
cannam@135: 
cannam@135:   save @0 SaveParams -> SaveResults;
cannam@135:   # Save a capability persistently so that it can be restored by a future connection.  Not all
cannam@135:   # capabilities can be saved -- application interfaces should define which capabilities support
cannam@135:   # this and which do not.
cannam@135: 
cannam@135:   struct SaveParams {
cannam@135:     sealFor @0 :Owner;
cannam@135:     # Seal the SturdyRef so that it can only be restored by the specified Owner. This is meant
cannam@135:     # to mitigate damage when a SturdyRef is leaked. See comments above.
cannam@135:     #
cannam@135:     # Leaving this value null may or may not be allowed; it is up to the realm to decide. If a
cannam@135:     # realm does allow a null owner, this should indicate that anyone is allowed to restore the
cannam@135:     # ref.
cannam@135:   }
cannam@135:   struct SaveResults {
cannam@135:     sturdyRef @0 :SturdyRef;
cannam@135:   }
cannam@135: }
cannam@135: 
cannam@135: interface RealmGateway(InternalRef, ExternalRef, InternalOwner, ExternalOwner) {
cannam@135:   # Interface invoked when a SturdyRef is about to cross realms. The RPC system supports providing
cannam@135:   # a RealmGateway as a callback hook when setting up RPC over some VatNetwork.
cannam@135: 
cannam@135:   import @0 (cap :Persistent(ExternalRef, ExternalOwner),
cannam@135:              params :Persistent(InternalRef, InternalOwner).SaveParams)
cannam@135:          -> Persistent(InternalRef, InternalOwner).SaveResults;
cannam@135:   # Given an external capability, save it and return an internal reference. Used when someone
cannam@135:   # inside the realm tries to save a capability from outside the realm.
cannam@135: 
cannam@135:   export @1 (cap :Persistent(InternalRef, InternalOwner),
cannam@135:              params :Persistent(ExternalRef, ExternalOwner).SaveParams)
cannam@135:          -> Persistent(ExternalRef, ExternalOwner).SaveResults;
cannam@135:   # Given an internal capability, save it and return an external reference. Used when someone
cannam@135:   # outside the realm tries to save a capability from inside the realm.
cannam@135: }
cannam@135: 
cannam@135: annotation persistent(interface, field) :Void;
cannam@135: # Apply this annotation to interfaces for objects that will always be persistent, instead of
cannam@135: # extending the Persistent capability, since the correct type parameters to Persistent depend on
cannam@135: # the realm, which is orthogonal to the interface type and therefore should not be defined
cannam@135: # along-side it.
cannam@135: #
cannam@135: # You may also apply this annotation to a capability-typed field which will always contain a
cannam@135: # persistent capability, but where the capability's interface itself is not already marked
cannam@135: # persistent.
cannam@135: #
cannam@135: # Note that absence of the $persistent annotation doesn't mean a capability of that type isn't
cannam@135: # persistent; it just means not *all* such capabilities are persistent.