The Inferno Internet Explorer Plug-in

Introduction

The plug-in enables a web page to utilise the full range of Inferno authentication and security mechanisms to provide mutual authentication, message authentication and message encryption when connecting to any kind of service on the Internet, not just to other web pages. A network conversation can be secured against modification alone or against both modification and snooping. To secure against modification, a secure MD5 hash or SHA hash can be appended to each message. To secure against snooping, encryption of the complete conversation can be performed using RC4, IDEA or DES with either DES chain block coding (DESCBC) or electronic code book (DESECB).

If you are not already familiar with Inferno and Limbo you can use the online manual pages at Vita Nuova's web site to provide some of the background. Printed and bound manuals which describe all of the function and system calls available to Dis modules and a collection of papers, including Dennis Ritchie's "Limbo Reference Manual", are also available from the same site.

The Inferno Internet Explorer plug-in allows a Limbo program to run inside a web page when displayed by Microsoft Internet Explorer 4 or 5. The plug-in executes Dis within a sandbox in the Inferno Dis virtual machine which provides the execution environment for all programs running under the Inferno Operating System. In this preliminary release, only unsigned modules are handled and so an application has no access to the network and no access to devices on the local machine. The filespace visible to a program run by the plugin is the contents of a read-only KFS filesystem combined with a writeable RAM filesystem for temporary storage. We are currently working on a the security issues and the consequent relaxation of these restrictions. The second release of the plug-in will allow network connections and controlled access to other devices with the introduction of signed Dis modules.

Plug-in applications are compiled into Dis bytecode and can either be interpreted by the Dis virtual machine or compiled on-the-fly into native machine code. The application can be developed and debugged on any system that currently runs Inferno (including Linux, Solaris, Plan 9, Windows or native Inferno systems and, now, also including Internet Explorer itself).

A web page references the Dis executable which is fetched on demand from the Internet and stored in Internet Explorer's cache. The next time the page is viewed, unless it has been purged, the file will be retrieved from the local cache. The plug-in contains several builtin modules, which provide a variety of functionality including: file access, basic I/O, namespace manipulation, formatted output, exception handling, basic character and string manipulation, basic graphics facilities, image and font handling, rectangular geometric operations, a complete Tk implementation based on Ousterhout's Tcl/Tk, elementary functions of applied mathematics, a floating point environment and authentication and security related operations. The entire plug-in including a minimal filesystem and the complete Inferno Dis virtual machine is contained in a download which occupies 719 Kbytes.

Examples

Click here to see a more interactive module. This is a port to Limbo of the Eliza and psychotherapist classic. The module runs an interactive session with the user in a text window on the web page. A scroll bar enables the browsing of earlier discussion.

Writing a Module

Install the free Inferno download

You can fetch a free copy of Inferno for Nt, Linux, Plan 9 or Solaris from the Vita Nuova website. The download contains a complete development environment that can be used to edit, compile, debug and check your module before placing it in a web page.

Write the module in Limbo

Create your Limbo program using any editor and save it to a file with a .b suffix. The download contains many examples of Limbo programs, a set of manual pages that document the functions in each of the builtin modules, and some editing tools including the Acme development environment.

Compile the module

Use the Limbo compiler to compile your Limbo program to a portable Dis module. Dis modules conventionally have a .dis suffix.

Add an <OBJECT> tag to your web page

Refer to the Dis module with an OBJECT tag that you include in the HTML on your web page. The tag contains information that the browser can use to find and run the module.

Place the web page and Dis module on your web site

The Dis module should be placed on the web site so that it can be delivered by your web server when requested by a browser.

Limbo

A Limbo program is a set of one or more modules that communicate to perform a task. Programs are type-checked at compile time and further when modules are loaded.

Limbo has the numeric types byte (unsigned, 8bits), int (signed, 32 bits), big (signed, 64 bits) and real (IEEE long float, 64 bits) with the size and signedness the same on every virtual machine. Character constants are expressed as in C using single quotes and can include the same set of escapes such as `\n` but the characters are themselves Unicode and have type int. Limbo also provides a Unicode string type, arrays of arbitrary types, lists of arbitrary types, tuples, abstract data types (adts, which are like a C struct but may contain function members as well as data members), reference types and typed channels (chans) for passing objects between processes.

Statements and control flow in Limbo are similar to those in C. A statement is an expression followed by a semicolon, or a sequence of statements enclosed in braces. The similar control flow statements are:

if (expr) statement
if (expr) statement else statement
while (expr) statement
for (expr; expr; expr) statement
do statement while (expr) ;
return expr ;
exit ;

Limbo provides most of the C operators, but not ? : or the 'comma' (sequential execution) operator. Arrays and strings may be sliced, and passed around as first class types and strings may be concatenated with the + and += operators. The operator := combines the declaration of a variable and the assignment of a value to it. The type of the variable on the left of the := is given by the type of the expression on the right.

New processes are created with the spawn statement which creates a separate process by calling a specified function. The process has its own stack but shares memory with the process that spawned it. Synchronisation between processes is handled by channels. A channel may be passed as an argument to the spawned function and used to provide communication and synchronisation between the two processes. The operator <-= writes an expression to a channel; the operator =<- reads from a channel and assignes to a variable. Channels are unbuffered and so a writing process will block until another process reads from the same channel this provides convenient synchronisation.

A good introduction to Limbo programming can be found in Brian Kernighan's A Descent into Limbo on the Vita Nuova web site. A more complete treatment of the language is available in Dennis Ritchie's reference manual The Limbo Programming Language at the same location.

A module can be developed and tested using the free Inferno download available from the Vita Nuova website on Linux, Windows, Plan 9, FreeBSD and Solaris. The download contains the Limbo compiler and the source code for many Limbo modules ranging from familiar Unix utilities through to more complex applications such as the Charon web-browser. Indeed, it is possible (although not necessarily very useful) to run the Charon web browser as a module inside a plug-in window in an Internet Explorer web page!

Embedding Modules in a Web Page

• an <OBJECT> tag that provides the class ID of the Inferno plug-in,
• an init <PARAM> tag containing the name of the module to run, and
• one or more file <PARAM> tags for each file the program needs to access from the internet.

<OBJECT
    classid="clsid:C0316421-4BE6-11d3-A893-004095E0A888"
    codebase="http://www.vitanuova.com/plugin/ieplugin.cab"
    width=500 height=80
>
<PARAM name="init" value="ticker.dis">
<PARAM name="file1" value="ticker.dis http://www.vitanuova.com/inferno/pi/ticker/ticker.dis">
</OBJECT>

To ensure that the Inferno plug-in is installed an <OBJECT> tag should also contain a codebase attribute:

codebase="http://www.vitanuova.com/plugin/ieplugin.cab"

codebase="http://www.vitanuova.com/plugin/ieplugin.cab#Version=1,0,0,1"

codebase="http://www.vitanuova.com/plugin/ieplugin.cab#Version=-1,-1,-1,-1"

In practice it is probably best to include the codebase attribute in each <OBJECT> tag without version information to ensure that the user has the plug-in, even if not necessarily the latest version.

Additionally, hspace and vspace attributes can be used to define a margin, in pixels, around the visible area and a title text string may be supplied that Internet Explorer will use to identify the space occupied by the browser when the cursor hovers above it:

<OBJECT
    classid="clsid:C0316421-4BE6-11d3-A893-004095E0A888"
    codebase="http://www.vitanuova.com/plugin/ieplugin.cab"
    width=500 height=80
    vspace=50 hspace=50
    title="Inferno Ticker"
>
<PARAM name="init" value="ticker.dis">
<PARAM name="file1" value="ticker.dis http://www.vitanuova.com/inferno/pi/ticker/ticker.dis">
</OBJECT>

How the Browser Initialises a Module

...\Program Files\Vita Nuova\Inferno\Plug-in

The startup code then binds the Inferno server registry into /chan, the prog filesystem into /prog and the console devices and graphics draw device into /dev before calling sys->pctl(Sys->NODEVS, nil) to ensure that a plug-in module has no further access to devices. This basic namespace is the sandbox in which a plug-in Dis module will run.

Once the namespace has been constructed, the files named for downloading in the HTML file are requested from the plug-in and are placed in the home directory (/usr/internet). The plug-in recognises <PARAM> tags with the consecutive names: file1, file2, ... filen. The first word of the value attribute of these tags determines the name the file will be given, once downloaded. The rest of the value attribute string is a URL giving the Internet location of the file to download.

The <PARAM> tag with name init has a value string that determines the Dis module to invoke at startup. The first word in the string is assumed to be the name of a Dis module to invoke, the remainder of the string is passed to the module as an argument list. A web page is likely to contain at least one <PARAM> tag to name the Dis file that needs to be downloaded and executed. In the ticker example the following tags were required:

<PARAM name="init" value="ticker.dis">
<PARAM name="file1" value="ticker.dis http://www.vitanuova.com/inferno/pi/ticker/ticker.dis">

Fetching Files

FONTPATH : con "/fonts/pelm/unicode.8.font";
...
font := Font.open(disp, FONTPATH);

sys = load Sys Sys->PATH;
draw = load Draw Draw->PATH;

/fonts/pelm/unicode.8.font
/fonts/lucidasans/unicode.8.font
/fonts/lucidasans/unicode.7.font

An example of a web page that uses the plug-in and downloads more than one file is the polyhedra example on the Vita Nuova web site. The polyhedra example downloads three files: the polyhedra Dis module, a polyhedra database and a shell script to manipulate the namespace before starting the polyhedra module. The polyhedra database is 361 Kbytes in size and may take a little while to download depending upon the speed of your Internet connection. The HTML page for the polyhedra example contains the following code:

<PARAM name="init" value="pi/wm sh polywrap">
<PARAM name="file1" value="tmp/polyhedra http://www.vitanuova.com/inferno/pi/polyhedra/polyhedra">
<PARAM name="file2" value="polywrap http://www.vitanuova.com/inferno/pi/polyhedra/polywrap">
<PARAM name="file3" value="polyhedra.dis http://www.vitanuova.com/inferno/pi/polyhedra/polyhedra.dis">

#!/dis/sh

# Wrapper for polyhedra, which looks for its data file in /lib

bind -a tmp /lib
polyhedra.dis

Starting the Module

If the HTML on the web page contains a compile <PARAM> tag with a value of 1:

<PARAM name="compile" value="1">

limbo -c module.b

limbo -C module.b

Builtin Modules

ref = load Mod Mod->PATH

sys = load Sys Sys->PATH;
math = load Math Math->PATH;
draw = load Draw Draw->PATH;

Sys

Inferno system calls are provided by the built-in module declared by sys.m. It contains the fundamental system data structures and interfaces. There are currently 39 calls, providing: file access; basic I/O; name space manipulation; formatted output for Limbo; exception handling; and basic character and string manipulation. See sys-intro(2).

Draw

The Draw module provides basic graphics facilities, defining drawing contexts, images, character fonts, and rectangular geometric operations. See the Tk module and Prefab module for higher level operations, such as windows and menu handling. See draw-intro(2).

Tk

The Tk module provides primitives for building user interfaces, based on Ousterhout's Tcl/TK. The interface to the toolkit itself is primarily the passing of strings to and from the elements of the toolkit using the cmd function; Section 9 of the Inferno manual contains information about the syntax of those strings. See also tk(2).

Prefab

The Prefab module contains components for building graphics objects suitable for Interactive Television (ITV) applications using infrared remote controls. Using the Draw module's operations for simple text and images the toolkit can group individual items, treat those groups as units, and then activate the items on command. See prefab-intro(2), prefab-compound(2), prefab-element(2), prefab-environ(2), prefab-style(2).

Math

Inferno's math(2) module and the Limbo compiler provide the fundamental floating point environment and ``elementary functions'' of applied mathematics.

Srv

The Srv module provides an interface to the the Internet name resolution services of the host operating system, in this case, Windows.

Keyring

This module contains a mixed set of functions that variously:

• perform infinite precision modular arithmetic; see keyring-ipint(2)
• form cryptographically secure digests; see keyring-sha(2)
• generate public/private key pairs and transform them to and from textual form; see keyring-gensk(2) and keyring-certtostr(2)
• create and verify cryptographic signatures using the public keys; see keyring-auth(2)
• authenticate the parties on a connection; see keyring-auth(2)
• read and write files containing the information needed to authenticate the parties on a connection; see keyring-auth(2)
• send Limbo byte arrays and strings across a connection; see keyring-getstring(2)

Environment Wrappers

The wrapper pi/text provides an environment that supports an Inferno Tk console application. A module running under this wrapper can read and write from standard input and output and is displayed in a window with a Tk scroll bar to allow the review of earlier interaction.

The wrapper pi/wm provides an environment that supports an Inferno Tk application that expects to run under the Inferno Wm window manager, and provides an implementation of wmlib(2), with certain default behaviours.

An application started with pi/wm will be given a window sized to match the plug-in area in the web page. It will not have a titlebar and so cannot be moved or minimised. If it needs the full functionality of Wm it should be started under the control of the program wm/wm which is included in the plugin.kfs KFS filesystem.

Hello World Examples

Drawing to the Display

implement Hello;

include "sys.m";
include "draw.m";
 
Hello: module
{
	init: fn(ctxt: ref Draw->Context, argv: list of string);
};

init(nil: ref Draw->Context, nil: list of string)
{
	draw := load Draw Draw->PATH;
	Display, Font, Image, Black: import draw;
	disp := draw->Display.allocate(nil);
	image := disp.image;
	hue := disp.color(Black);
	font := Font.open(disp, "*default*");
	image.text((5,5), hue, (0,0), font, "Hello World");
	<- chan of int; # wait forever
}

limbo hellod.b

<OBJECT
	classid="clsid:C0316421-4BE6-11d3-A893-004095E0A888"
	codebase="http://www.vitanuova.com/plugin/ieplugin.cab"
	width=500 height=80
>
<PARAM name="init" value="hellod.dis">
<PARAM name="file1" value="hellod.dis http://www.vitanuova.com/inferno/pidoc/intro/hellod.dis">
</OBJECT>

Writing to Standard Output

implement Hello;

include "sys.m";
include "draw.m";
 
Hello: module
{
	init: fn(ctxt: ref Draw->Context, argv: list of string);
};

init(nil: ref Draw->Context, nil: list of string)
{
	sys := load Sys Sys->PATH;
	sys->print("Hello World\n");
	<- chan of int;
}

limbo helloc.b

<OBJECT
	classid="clsid:C0316421-4BE6-11d3-A893-004095E0A888"
	codebase="http://www.vitanuova.com/plugin/ieplugin.cab"
	width=500 height=80
>
<PARAM name="init" value="pi/text helloc.dis">
<PARAM name="file1" value="helloc.dis http://www.vitanuova.com/inferno/pidoc/intro/helloc.dis">
</OBJECT>

Using Limbo/Tk

implement Hello;

include "sys.m";
include "draw.m";
include "tk.m";
include "wmlib.m";
 
Hello: module
{
	init: fn(ctxt: ref Draw->Context, argv: list of string);
};

init(ctxt: ref Draw->Context, nil: list of string)
{
	wmlib := load Wmlib Wmlib->PATH;
	wmlib->init();
	(top, nil) := wmlib->titlebar(ctxt.screen, nil, nil, 0);
	cmds := array[] of {
		"button .b -text {Hello World}",
		"pack .b",
		"update"
	};
	wmlib->tkcmds(top, cmds);
	<- chan of int;
}

limbo hellow.b

<OBJECT
	classid="clsid:C0316421-4BE6-11d3-A893-004095E0A888"
	codebase="http://www.vitanuova.com/plugin/ieplugin.cab"
	width=200 height=50
>
<PARAM name="init" value="pi/wm hellow.dis">
<PARAM name="file1" value="hellow.dis http://www.vitanuova.com/inferno/pidoc/intro/hellow.dis">
</OBJECT>

Using Echo

<OBJECT
	classid="clsid:C0316421-4BE6-11d3-A893-004095E0A888"
	codebase="http://www.vitanuova.com/plugin/ieplugin.cab"
	width=500 height=80
>
<PARAM name="init" value="pi/text echo hello world">
</OBJECT>

Using the Inferno Shell

<OBJECT
	classid="clsid:C0316421-4BE6-11d3-A893-004095E0A888"
	codebase="http://www.vitanuova.com/plugin/ieplugin.cab"
	width=500 height=80
>
<PARAM name="init" value="pi/wm sh -c '
load tk
winid=${tk window Hello}
tk $winid button .b -text {Hello World}
tk $winid pack .b
tk $winid update
sleep 10
'  ">
</OBJECT>

A second example illustrates the use of shell flow control and pipes in a web page script.

<OBJECT
	classid="clsid:C0316421-4BE6-11d3-A893-004095E0A888"
	codebase="http://www.vitanuova.com/plugin/ieplugin.cab"
	width=500 height=80
>
<PARAM name="init" value="pi/text sh -c '
	{
		for i in (H e l l o) { echo -n $i}
		echo '' World''
	} | xd -c
	cat
'  ">
</OBJECT>

The examples give some idea of the various ways that code can be executed from a web page inside the Inferno sandbox. Other examples can be found on the Vita Nuova web site

Security

The initial namespace consists of the contents of the read-only filesystem that it mounts from the file plugin.kfs and the initially empty RAM file system that is mounted in the modules home directory (/usr/internet) and in the temporary directory, /tmp.

The next release of the plug-in will support signed modules.

Limitations

We are aware of some unwanted control characters in the output and some unusual interpretation of control and movement keys when using the text wrapper with Internet Explorer version 5, particularly annoying is the operation of the backspace key - we are working on this problem.

Debugging

Finally

support@vitanuova.com