@ai-ecoverse/slicc-kernel 1.130.1 → 1.131.0

package/README.md

@@ -487,13 +487,13 @@ The module's default export (or its `main` export) is called with a context and
         - `AUTH PLAIN <blob>`, or the line after a bare `AUTH PLAIN`: the kernel decodes the blob, and asks the vault (`auth-plain`) only when the placeholders are in the **password field**. A placeholder in the user or authorization identity goes out as written. It substitutes there and re-encodes.
         - `AUTH LOGIN`: the password line (the second line, or the first after `AUTH LOGIN <user>`) is decoded, substituted (`auth-login`) and re-encoded; the user line goes out as written.
         - Every other line goes out as written. After the first `AUTH`, or once `MAIL`, `RCPT`, `DATA` or `BDAT` is seen, so is the rest of the session. A line still unfinished after 2 s, or longer than 4 KiB, is sent as written, and so is the rest.
+      - **pg:** a session that starts with a protocol 3 `StartupMessage` (after `sslmode`'s `SSLRequest` upgrade, or with direct TLS) is followed message by message. The only position is the **`PasswordMessage` answering `AuthenticationCleartextPassword` (`R` 3)**, as the program read it from the server. The password is substituted (`password-cleartext`) and the message is framed again. Anything else goes out as written: the startup, an MD5 (`R` 5) or SCRAM (`R` 10) answer, every later message, and a frame over 16 KiB. MD5 and SCRAM need the kernel to compute the answer from the password, so they aren't supported yet. A server whose `pg_hba` asks for them gets the placeholder, and refuses.
       - **What goes out:** the placeholders the vault answers with a value of at least 8 bytes go out as that value (`Basic` decoded, substituted and re-encoded). Everything else goes out as written:
         - the request line and the body;
         - other headers;
         - a head with placeholders in two header lines;
         - later requests on the same connection;
         - anything once the head passes 16 KiB, or once the program pauses for 2 s in the middle of it;
-        - pg, which comes next.
       - **What's read back:** once a process has had a value substituted for a host, everything its whole process tree reads from any A2 session to that host is scrubbed: the process itself, its ancestors and every descendant (forked, spawned or exec'd, before or after the substitution; a forked child's own new session included) with [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub), as S2 does: the value comes back as its placeholder, and a fragment or an encoded form (JSON, percent, HTML, base64, hex) as `[redacted:sealed]`. The scrub stays until the whole tree has ended. A process outside the tree isn't covered. A value shorter than 8 bytes is never substituted, as it couldn't be scrubbed.
       - **The bound:** the server the value goes to is the one the vault rule names, verified against the kernel's own roots. Substitution trusts that server not to reflect the value back in a form the scrub doesn't know (encrypted under a key the program chose, say). That's the same residual as A1's.
       - **Elsewhere:** a placeholder written into any other A2 session reaches the server as written. It isn't the secret, so nothing leaks.
@@ -986,7 +986,7 @@ The kernel then asks the hook `{ v: 1, op: 'materializeConsume', ticket, stamp,
 **The child's output is scrubbed (S2).** The kernel compiles a [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub) scrubber (1.0.0, bundled; the published package has no runtime dependency) over exactly the values it swapped in, and gives the child new open file descriptions for fd 1 and fd 2, for every other descriptor it holds on the same descriptions (a `dup` of them), and for every descriptor on a terminal (fd 0 of a terminal session is one), that pass every write through it into the originals (one wrapper per original description, so `2>&1` keeps its order). A value appears as its placeholder, and a fragment or encoded form of it (JSON, percent, HTML, base64, hex, wrapped) as `[redacted:NAME]`. Bytes go through at once unless they may still be the start of a match; such a tail is let out after 50 ms without a write when it's shorter than 16 bytes, and otherwise at the next write or at close. The child's descendants inherit the scrubbed descriptions through fork, spawn, exec and `dup`, and a descendant that opens its controlling terminal (`/dev/tty`, or a terminal by name) gets one scrubbed too, as does a pseudo-terminal slave (`/dev/pts/N`) or [`/dev/clipboard`](#devclipboard) it opens, and a `/dev/clipboard` descriptor it inherited is wrapped at the redeem like fd 1 and 2, so the page's clipboard gets placeholders, never the values. Files, sockets and pipes the child or a descendant opens itself are not scrubbed, so `printf %s "$T" > f` writes the value. A scrubbed fd 1 or 2 is a stream: it doesn't seek. Under `O_NONBLOCK` it gives `EAGAIN` when the pipe or terminal under it would. A write that finds room returns at once, taking at most 64 KiB, and the scrubbed bytes the file couldn't take yet go out before anything written later. Until they have, `poll` reports it unwritable and a nonblocking write gets `EAGAIN`, taking nothing. A blocking write that waits for them, or for room, ends with `EINTR` at a signal, taking nothing; one interrupted after it began writing returns its whole count, and the rest follows. A descendant that redeems a ticket of its own adds its values: its output is scrubbed for both sets. A value under 8 bytes is swapped but can't be scrubbed. The scrubber goes when the last process and description holding it do.
 
 **A2 sessions (`sessionMaterialize`, [#1090](https://github.com/ai-ecoverse/slicc-kernel/issues/1090)).** For a kernel-terminated TLS session (see **Sealed values in an A2 session** under JS programs' `ctx.net`), the kernel asks the hook `{ v: 1, op: 'sessionMaterialize', caller, stamp, session, host, port, protocol, position, verified, handshakeAt, exit, placeholders, head? }` (slicc-vault 1.10.0, Sessions), once per session:
-- `stamp` (also `caller`) is the stamp of the process that owns the socket; `session` the kernel's id for it (16 to 128 of `A-Za-z0-9_-`); `host` the name the leaf was verified against, lower-cased without a trailing dot; `handshakeAt` when the handshake finished (epoch ms); `exit` the exit the session leaves by, as the uplink reported it (`tailscale` or `device:<id>`, the id of `[A-Za-z0-9._-]`);
+- `stamp` (also `caller`) is the stamp of the process that owns the socket; `session` the kernel's id for it (16 to 128 of `A-Za-z0-9_-`); `host` the name the leaf was verified against, lower-cased without a trailing dot; `handshakeAt` when the handshake finished (epoch ms); `exit` the exit the session leaves by, as the uplink reported it (`tailscale` or `device:<id>`, the id of `[A-Za-z0-9._:-]`);
 - `protocol` is `http1`, `smtp` or `pg`, and `position` one of its own: `header:<lower-cased name>`, `auth-plain` or `auth-login`, or `password-cleartext`; `head` (`{ method, path }`) is there for `http1` only, and required there;
 - `placeholders` are the 1 to 16 distinct `fnox_proxy_<24 hex>` placeholders found at that position.
 

package/dist/kernel-worker.js

@@ -7022,7 +7022,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.130.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.131.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -17746,7 +17746,7 @@ var TOKEN5 = "[!#$%&'*+.^_`|~0-9a-z-]+";
 var HEADER = new RegExp(`^header:${TOKEN5}$`);
 var METHOD = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var TARGET = /^[\x21-\x7e]+$/;
-var SESSION_EXIT = /^(tailscale|device:[A-Za-z0-9._-]+)$/;
+var SESSION_EXIT = /^(tailscale|device:[A-Za-z0-9._:-]+)$/;
 var HOST = /^[a-z0-9.:-]+$/;
 var UNSAFE = /[\r\n\0]/;
 var POSITIONS = {
@@ -18495,6 +18495,90 @@ async function substituteHead(head, ask) {
 `, values };
 }
 
+// src/kernel/net/sealed-pg.ts
+var PG_MESSAGE_MAX = 16 * 1024;
+var PROTOCOL_3 = 196608;
+var CLEARTEXT = 3;
+function int32(bytes, at) {
+  return bytes[at] << 24 | bytes[at + 1] << 16 | bytes[at + 2] << 8 | bytes[at + 3];
+}
+function sniffPg(start2) {
+  const bytes = Uint8Array.from(start2, (c) => c.charCodeAt(0));
+  if (bytes.length === 0 || bytes[0] !== 0) return bytes.length === 0 ? "more" : "no";
+  if (bytes.length < 8) return "more";
+  const length2 = int32(bytes, 0);
+  return length2 >= 8 && length2 <= PG_MESSAGE_MAX && int32(bytes, 4) === PROTOCOL_3 ? "yes" : "no";
+}
+var PgServer = class {
+  buffer = new Uint8Array(0);
+  skip = 0;
+  lost = false;
+  cleartext = false;
+  feed(bytes) {
+    if (this.lost) return;
+    const data = new Uint8Array(this.buffer.length + bytes.length);
+    data.set(this.buffer);
+    data.set(bytes, this.buffer.length);
+    let at = 0;
+    for (; ; ) {
+      const left = data.length - at;
+      if (this.skip > 0) {
+        const n = Math.min(this.skip, left);
+        this.skip -= n;
+        at += n;
+        if (this.skip > 0) break;
+        continue;
+      }
+      if (left < 5) break;
+      const type = data[at];
+      const whole = 1 + int32(data, at + 1);
+      if (whole < 5 || type === 82 && whole > PG_MESSAGE_MAX) {
+        this.lost = true;
+        this.cleartext = false;
+        this.buffer = new Uint8Array(0);
+        return;
+      }
+      if (type !== 82) {
+        this.skip = whole;
+        continue;
+      }
+      if (left < whole) break;
+      this.cleartext = whole === 9 && int32(data, at + 5) === CLEARTEXT;
+      at += whole;
+    }
+    this.buffer = data.slice(at);
+  }
+};
+function frame3(type, body) {
+  const out = new Uint8Array(5 + body.length);
+  out[0] = type;
+  const length2 = 4 + body.length;
+  out.set([length2 >>> 24 & 255, length2 >>> 16 & 255, length2 >>> 8 & 255, length2 & 255], 1);
+  for (let i = 0; i < body.length; i++) out[5 + i] = body.charCodeAt(i);
+  return out;
+}
+function pgLength(bytes, started) {
+  const header3 = started ? 5 : 4;
+  if (bytes.length < header3) return void 0;
+  const length2 = int32(bytes, started ? 1 : 0);
+  return started ? 1 + length2 : length2;
+}
+async function pgPassword(message3, server, ask) {
+  if (message3[0] !== 112 || !server.cleartext) return { bytes: message3, done: true };
+  server.cleartext = false;
+  let body = "";
+  for (const b of message3.subarray(5)) body += String.fromCharCode(b);
+  if (!body.endsWith("\0") || body.indexOf("\0") !== body.length - 1)
+    return { bytes: message3, done: true };
+  const password = body.slice(0, -1);
+  const placeholders = placeholdersIn(password);
+  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS)
+    return { bytes: message3, done: true };
+  const values = usable(await ask(placeholders));
+  if (Object.keys(values).length === 0) return { bytes: message3, done: true };
+  return { bytes: frame3(112, `${replaced(password, values)}\0`), values, done: true };
+}
+
 // src/kernel/net/sealed-smtp.ts
 var SMTP_LINE_MAX = 4096;
 var GREETING = ["EHLO ", "HELO "];
@@ -18616,11 +18700,14 @@ function headEnd2(bytes) {
   return -1;
 }
 function modeOf(start2) {
-  const http = sniffHttp1(start2);
-  const smtp = sniffSmtp(start2);
-  if (http === "yes") return "http1";
-  if (smtp === "yes") return "smtp";
-  return http === "no" && smtp === "no" ? "pass" : void 0;
+  const sniffs = [
+    ["http1", sniffHttp1(start2)],
+    ["smtp", sniffSmtp(start2)],
+    ["pg", sniffPg(start2)]
+  ];
+  const hit = sniffs.find(([, v]) => v === "yes");
+  if (hit) return hit[0];
+  return sniffs.every(([, v]) => v === "no") ? "pass" : void 0;
 }
 function crlf(bytes) {
   for (let i = 0; i + 1 < bytes.length; i++) if (bytes[i] === 13 && bytes[i + 1] === 10) return i;
@@ -18634,12 +18721,15 @@ var SessionWriter = class {
   failed;
   session = sessionId();
   smtp;
+  pgStarted = false;
   conn;
   s;
+  pg;
   scope;
-  constructor(conn, s, scope) {
+  constructor(conn, s, pg, scope) {
     this.conn = conn;
     this.s = s;
+    this.pg = pg;
     this.scope = scope;
     this.smtp = new SmtpClient(
       (position, placeholders) => this.ask("smtp", position, placeholders)
@@ -18688,6 +18778,7 @@ var SessionWriter = class {
     if (this.mode === "pass") await this.release();
     else if (this.mode === "http1") await this.http1();
     else if (this.mode === "smtp") await this.lines();
+    else if (this.mode === "pg") await this.messages();
     if (this.mode !== "pass" && this.buffer.length > 0)
       this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
     return bytes.length;
@@ -18718,6 +18809,33 @@ var SessionWriter = class {
     }
     if (this.buffer.length > SMTP_LINE_MAX) await this.release();
   }
+  async messages() {
+    for (; ; ) {
+      const whole = pgLength(this.buffer, this.pgStarted);
+      if (whole === void 0 || whole < 4 || whole > PG_MESSAGE_MAX) {
+        if (whole !== void 0) await this.release();
+        return;
+      }
+      if (this.buffer.length < whole) return;
+      const message3 = this.buffer.slice(0, whole);
+      this.buffer = this.buffer.slice(whole);
+      const started = this.pgStarted;
+      this.pgStarted = true;
+      const out = started ? await pgPassword(
+        message3,
+        this.pg,
+        (placeholders) => this.ask("pg", "password-cleartext", placeholders)
+      ).catch(() => ({ bytes: message3, done: true })) : { bytes: message3, done: false };
+      if ("values" in out && out.values) this.remember(out.values);
+      try {
+        await writeAll4(this.conn, out.bytes);
+      } finally {
+        out.bytes.fill(0);
+        message3.fill(0);
+      }
+      if (out.done) return this.release();
+    }
+  }
   idle() {
     this.chain = this.chain.then(() => this.release()).catch((err) => {
       this.failed ??= err;
@@ -18831,9 +18949,18 @@ function idle() {
   return new Promise((resolve2) => setTimeout(() => resolve2(IDLE2), SCRUB_IDLE_MS));
 }
 function sealedConn(conn, s) {
+  const pg = new PgServer();
   const scope = s.broker.sessions.scope(s.pid, s.host);
-  const writer = substitutes(s) ? new SessionWriter(conn, s, scope) : void 0;
-  const reader = new ScrubReader(conn, scope);
+  const writer = substitutes(s) ? new SessionWriter(conn, s, pg, scope) : void 0;
+  const observed = {
+    ...conn,
+    read: async () => {
+      const bytes = await conn.read();
+      if (bytes) pg.feed(bytes);
+      return bytes;
+    }
+  };
+  const reader = new ScrubReader(writer ? observed : conn, scope);
   return {
     localAddr: conn.localAddr,
     remoteAddr: conn.remoteAddr,
@@ -24091,6 +24218,7 @@ var SETUP_OPS = /* @__PURE__ */ new Set([
   "proc-identity",
   "fd-info",
   "sig-mask",
+  "sig-inherited",
   "proc-setpgid",
   "tty-pgrp-set",
   "proc-exec",