Sockets: running actors get TCP, UDP, and DNS through wasi:sockets; candidates get no network

cli/src/broker.rs

@@ -176,7 +176,7 @@ impl Broker {
 
     /// What an instance of `id` gets (see PROTOCOL.md). A candidate runs in
     /// `scratch`, which holds a copy of the actor's `data/` and `public/`,
-    /// and has no HTTP.
+    /// and has no network.
     pub fn instance_config(&self, id: &str, version: u64, scratch: Option<&Path>) -> InstanceConfig {
         let own = scratch.map_or_else(|| self.world.actor_dir(id), Path::to_path_buf);
         let mut env = vec![("SAUSAGE_ACTOR".into(), id.to_string()), ("SAUSAGE_VERSION".into(), version.to_string())];
@@ -189,7 +189,7 @@ impl Broker {
                 Mount { guest: "/public".into(), host: own.join("public"), writable: true },
                 Mount { guest: "/data".into(), host: own.join("data"), writable: true },
             ],
-            allow_http: scratch.is_none(),
+            network: scratch.is_none(),
             stderr_log: own.join("stderr.log"),
             env,
         }

cli/src/candidate.rs

@@ -18,7 +18,7 @@
 //! also go to that recipient.
 //!
 //! Each file runs in a fresh instance on a copy of the actor's `/data` and
-//! `/public` (empty folders for a new actor), without HTTP. A version
+//! `/public` (empty folders for a new actor), without network. A version
 //! without test files passes.
 
 use std::path::Path;
@@ -90,7 +90,7 @@ pub async fn test(broker: &Broker, id: &str, version: u64, component: &Component
 }
 
 impl Candidate<'_> {
-    /// Start an instance on a fresh copy of the state, without HTTP.
+    /// Start an instance on a fresh copy of the state, without network.
     fn start(&self) -> Result<(Instance, Scratch)> {
         static N: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
         let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);

cli/src/runtime.rs

@@ -126,7 +126,8 @@ impl std::fmt::Display for Exit {
 
 pub struct InstanceConfig {
     pub mounts: Vec<Mount>,
-    pub allow_http: bool,
+    /// Outgoing HTTP, and TCP, UDP, and DNS through `wasi:sockets`.
+    pub network: bool,
     pub stderr_log: PathBuf,
     pub env: Vec<(String, String)>,
 }
@@ -277,6 +278,9 @@ impl Runtime {
             .with_context(|| format!("open {}", cfg.stderr_log.display()))?;
 
         let mut b = WasiCtx::builder();
+        if cfg.network {
+            b.inherit_network().allow_tcp(true).allow_udp(true).allow_ip_name_lookup(true);
+        }
         b.stdin(AsyncStdinStream::new(guest_in));
         b.stdout(AsyncStdoutStream::new(8192, guest_out));
         b.stderr(AsyncStdoutStream::new(8192, tokio::fs::File::from_std(stderr)));
@@ -293,7 +297,7 @@ impl Runtime {
             wasi: WasiPart { ctx: b.build(), table: ResourceTable::new() },
             fsx: FsExt::new(cfg.mounts),
             http: WasiHttpCtx::new(),
-            hooks: HttpHooks { allow: cfg.allow_http },
+            hooks: HttpHooks { allow: cfg.network },
         };
 
         let (line_tx, line_rx) = mpsc::channel(1024);