@ai-ecoverse/slicc-kernel 1.115.0 → 1.116.0

package/dist/kernel-worker.js

@@ -2305,6 +2305,12 @@ var Incoming = class {
     this.buf = this.buf.subarray(n);
     return out;
   }
+  async firstLine(max, signal) {
+    while (this.buf.length < max && !this.buf.includes(10) && await this.fill(signal)) ;
+    const end = this.buf.indexOf(10);
+    const bytes = this.buf.subarray(0, end >= 0 ? end + 1 : Math.min(max, this.buf.length));
+    return String.fromCharCode(...bytes);
+  }
   async peek(signal) {
     if (this.buf.length === 0) await this.fill(signal);
     return this.buf[0];
@@ -4708,6 +4714,14 @@ var LoopbackNet = class {
   facades = /* @__PURE__ */ new Map();
   nextEphemeral = EPHEMERAL_FIRST;
   route;
+  origins;
+  useOrigins(serve) {
+    this.origins = serve;
+  }
+  serveOrigin(conn, origin) {
+    if (!this.origins) throw new KernelError("ENETUNREACH");
+    void this.origins(conn, origin).catch(() => conn.close());
+  }
   useUplink(route) {
     this.route = route;
   }
@@ -6227,7 +6241,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.115.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.116.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -7587,6 +7601,9 @@ var TLS_HANDSHAKE = 22;
 var TOKEN2 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var NO_WEBSOCKET2 = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var REALM_PROXY_PORT = 3128;
+var REQUEST_LINE_MAX = 8192;
+var REQUEST_LINE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+ \S+ HTTP\/1\.[01]\r?\n$/;
+var NOT_HTTP = "not HTTP/1.1: TLS through the transport carries only HTTP/1.1 and WebSocket";
 var DEFAULT_LIMITS = {
   maxConnections: 64,
   maxHead: 64 * 1024,
@@ -7875,6 +7892,26 @@ var RealmProxy = class {
       conn.close();
     }
   }
+  async serveOrigin(conn, origin) {
+    if (this.stop.signal.aborted) {
+      conn.close();
+      return;
+    }
+    this.connections.add(conn);
+    const idle = { ms: this.limits.idleMs };
+    const incoming = new Incoming(timedSource(conn, idle, this.stop.signal));
+    try {
+      const line = await incoming.firstLine(REQUEST_LINE_MAX).catch(() => "");
+      if (line !== "" && !REQUEST_LINE.test(line)) {
+        await this.refuse(conn, new HttpError(400, NOT_HTTP));
+        return;
+      }
+      await this.requests({ sink: conn, incoming, origin, socket: conn, idle });
+    } finally {
+      this.connections.delete(conn);
+      conn.close();
+    }
+  }
   async requests(ctx) {
     try {
       for (; ; ) {
@@ -14373,7 +14410,7 @@ async function writeCaFile(fs, ca, locks = globalThis.navigator?.locks) {
 function enableNetwork(net, options) {
   let proxy;
   const transport = options.transport ?? missingTransport();
-  net.activate({ family: "inet", host: "127.0.0.1", port: REALM_PROXY_PORT }, () => {
+  const start2 = () => {
     const tls = new TlsTerminator({
       ca: options.ca,
       engine: options.engine,
@@ -14392,6 +14429,11 @@ function enableNetwork(net, options) {
       if (proxy === started) proxy = void 0;
       await tls.close();
     });
+  };
+  net.activate({ family: "inet", host: "127.0.0.1", port: REALM_PROXY_PORT }, start2);
+  net.useOrigins((conn, origin) => {
+    if (!proxy) start2();
+    return proxy.serveOrigin(conn, origin);
   });
   return () => proxy;
 }
@@ -16307,7 +16349,8 @@ var SOCKET_OPS = [
   "sock-setopt",
   "sock-resolve",
   "sock-sendto",
-  "sock-recvfrom"
+  "sock-recvfrom",
+  "sock-tls"
 ];
 function socketAt(fds, fd) {
   const file = anySocketAt(fds, fd);
@@ -16379,6 +16422,8 @@ async function socketSyscall(req, proc) {
       if (addresses.length === 0) throw new KernelError("ENOENT");
       return ok3(addresses);
     }
+    case "sock-tls":
+      return ok3(tlsOverTransport(req, proc));
     default:
       return datagram(req, proc);
   }
@@ -16482,6 +16527,48 @@ async function accept(proc, fd, nonblock) {
   const socket = await listener.accept(waits ? proc.blocking() : void 0, nonblock);
   return { fd: proc.fds.install(new OpenFile(socket), 3), peer: socket.peer };
 }
+var NOT_HTTP_PORTS = /* @__PURE__ */ new Set([
+  465,
+  563,
+  585,
+  636,
+  853,
+  989,
+  990,
+  992,
+  993,
+  994,
+  995,
+  5061,
+  5671,
+  6697,
+  8883
+]);
+var HOST_NAME = /^[A-Za-z0-9.-]+$|^\[?[0-9A-Fa-f:.]+\]?$/;
+function tlsOverTransport(req, proc) {
+  if (req.ca) throw new KernelError("ENOTSUP");
+  if (req.alpn && req.alpn.length > 0 && !req.alpn.includes("http/1.1")) {
+    throw new KernelError("EPROTONOSUPPORT");
+  }
+  if (!Number.isInteger(req.port) || req.port < 1 || req.port > 65535)
+    throw new KernelError("EINVAL");
+  if (NOT_HTTP_PORTS.has(req.port)) throw new KernelError("EPROTONOSUPPORT");
+  const servername = req.servername || req.host;
+  if (!HOST_NAME.test(servername)) throw new KernelError("EINVAL");
+  if (isLoopbackHost(servername) || isLoopbackHost(req.host)) throw new KernelError("ENOTSUP");
+  const host = servername.includes(":") && !servername.startsWith("[") ? `[${servername}]` : servername;
+  const origin = req.port === 443 ? `https://${host}` : `https://${host}:${req.port}`;
+  const [mine, theirs] = KernelSocket.pair(proc.net, "inet", proc.cred?.());
+  mine.peer = { family: "inet", host: req.host, port: req.port };
+  try {
+    proc.net.serveOrigin(theirs, origin);
+  } catch (err) {
+    mine.close();
+    theirs.close();
+    throw err;
+  }
+  return { fd: proc.fds.install(new OpenFile(mine), 3), alpnProtocol: "http/1.1", servername };
+}
 
 // src/kernel/vfs-file.ts
 var O_ACCMODE = 3;