@ai-ecoverse/slicc-kernel 1.148.0 → 1.149.0

package/dist/node.js

@@ -1697,6 +1697,9 @@ function link(a, b) {
   a.attach({ rx: ba, tx: ab });
   b.attach({ rx: ab, tx: ba });
 }
+var SERVE_CHUNK = 64 * 1024;
+var NEVER_ABORTED = new AbortController().signal;
+var EMPTY = new Uint8Array(0);
 var KernelSocket = class _KernelSocket {
   net;
   domain;
@@ -1894,6 +1897,54 @@ var KernelSocket = class _KernelSocket {
     if (this.state !== "open") throw new KernelError("EISCONN");
     return this.dial(addr, route2, secure2);
   }
+  serving;
+  served = false;
+  get loopbackLinked() {
+    return this.state === "connected" && !this.switch;
+  }
+  async secureLink(make, signal = NEVER_ABORTED) {
+    const raw2 = this.connection();
+    if (this.switch || this.served || this.writeShut || this.readShut)
+      throw new KernelError("EINVAL");
+    signal.throwIfAborted();
+    this.served = true;
+    let handshaking = true;
+    const view2 = {
+      localAddr: "",
+      remoteAddr: "",
+      read: async () => {
+        const bytes = await raw2.rx.read(SERVE_CHUNK, handshaking ? signal : void 0).catch(() => EMPTY);
+        return bytes.length > 0 ? bytes : null;
+      },
+      write: (bytes) => raw2.tx.write(bytes),
+      closeWrite: () => raw2.tx.closeWrite(),
+      close: () => {
+        raw2.rx.closeRead();
+        raw2.tx.closeWrite();
+      }
+    };
+    let made2;
+    const abandon = () => view2.close();
+    signal.addEventListener("abort", abandon, { once: true });
+    try {
+      made2 = await make(view2);
+    } catch (err) {
+      view2.close();
+      this.readShut = true;
+      this.writeShut = true;
+      this.changes.wake();
+      throw signal.aborted ? signal.reason : err;
+    } finally {
+      handshaking = false;
+      signal.removeEventListener("abort", abandon);
+    }
+    this.link = uplinkLink(made2.conn, (err) => {
+      this.reset = err instanceof KernelError && err.code === "EPROTO" ? err : new KernelError("ECONNRESET");
+      this.changes.wake();
+    });
+    this.changes.wake();
+    return made2.info;
+  }
   upgradeSecure(make) {
     if (this.state !== "connected") throw new KernelError("ENOTCONN");
     if (!this.switch) throw new KernelError("EOPNOTSUPP");
@@ -2025,6 +2076,8 @@ var KernelSocket = class _KernelSocket {
     }
     if (this.boundAt) this.net.release(this.boundAt, this, this.named);
     this.boundAt = void 0;
+    this.serving?.release();
+    this.serving = void 0;
     this.changes.wake();
   }
   static pair(net, domain, cred) {
@@ -3305,7 +3358,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.148.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.149.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -5982,7 +6035,7 @@ async function followLinks(fs, path) {
   return current;
 }
 var NOBODY = { ruid: -1, euid: -1, suid: -1, rgid: -1, egid: -1, sgid: -1, groups: [] };
-var EMPTY = new Uint8Array(0);
+var EMPTY2 = new Uint8Array(0);
 function quiet2(promise) {
   return promise.catch(() => void 0);
 }
@@ -6065,13 +6118,13 @@ function withCommandDirs(fs, names2, userDir = async () => void 0, owners = fals
     return target?.path;
   }
   const absent2 = (err) => {
-    if (missing(err)) return EMPTY;
+    if (missing(err)) return EMPTY2;
     throw err;
   };
   async function content(path, err) {
     if (!missing(err) || !(await linked2(path))?.isFile) throw err;
     const target = await redirected2(path);
-    return target === void 0 ? EMPTY : fs.readFileBuffer(target).catch(absent2);
+    return target === void 0 ? EMPTY2 : fs.readFileBuffer(target).catch(absent2);
   }
   const ranged2 = rangedOps(fs);
   async function stat(path, real) {
@@ -12704,6 +12757,8 @@ function realmCa(owner, store) {
 var TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
 var TLS_CLIENT_NO_SNI = 2;
 var TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
+var TLS_SERVER_REQUEST_CERT = 1;
+var TLS_SERVER_REQUIRE_CERT = 2;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -12752,6 +12807,35 @@ var TlsEngine = class {
       this.m._free(name2);
     }
   }
+  get serverSessions() {
+    return typeof this.m._tls_server_new === "function";
+  }
+  importLeaf(chain2, key, pass2) {
+    const leafImport = this.m._tls_leaf_import;
+    const keyLen = key[0] === 45 ? key.length + 1 : key.length;
+    const ptr = this.withBytes(
+      chain2,
+      (c) => this.withSecret(
+        key,
+        (k) => this.withSecret(
+          pass2,
+          (p) => leafImport(c, chain2.length, k, keyLen, pass2.length > 0 ? p : 0, pass2.length)
+        )
+      )
+    );
+    if (!ptr) throw this.error(this.m._tls_last_error(), "server certificate");
+    return new TlsLeaf(this, this.m, ptr);
+  }
+  serverSession(leaf, alpn, clientCa, flags2) {
+    const open = this.m._tls_server_new;
+    const wire = alpnWire(alpn);
+    const ptr = this.withBytes(
+      wire,
+      (p) => open(leaf.ptr, wire.length > 0 ? p : 0, wire.length, clientCa?.ptr ?? 0, flags2)
+    );
+    if (!ptr) throw this.error(this.m._tls_last_error(), "tls server");
+    return new TlsSession(this, this.m, ptr);
+  }
   withBytes(bytes, fn) {
     const ptr = this.put(bytes);
     try {
@@ -12956,6 +13040,12 @@ var TlsSession = class {
   get version() {
     return this.c._tls_version(this.ptr);
   }
+  get sni() {
+    const out = this.engine.intoScratch(
+      (p, max) => this.m._tls_sni(this.ptr, p, max)
+    );
+    return out instanceof Uint8Array ? new TextDecoder().decode(out) : "";
+  }
   get alpn() {
     const out = this.engine.intoScratch((p, max) => this.c._tls_alpn(this.ptr, p, max));
     return out instanceof Uint8Array ? new TextDecoder().decode(out) : void 0;
@@ -13454,7 +13544,7 @@ var Upload = class {
     }
   }
 };
-var EMPTY2 = new Uint8Array(0);
+var EMPTY3 = new Uint8Array(0);
 function message2(e) {
   return e instanceof Error ? e.message : String(e);
 }
@@ -13529,8 +13619,8 @@ var HttpHandles = class {
     const entry = {
       abort,
       head: Promise.resolve({ ok: true, kind: "void" }),
-      body: once(EMPTY2),
-      left: EMPTY2,
+      body: once(EMPTY3),
+      left: EMPTY3,
       done: false,
       reading: Promise.resolve(),
       cancel: async () => void 0,
@@ -14656,6 +14746,46 @@ async function tlsClient(conn, o, taken = new Uint8Array(0)) {
     throw err;
   }
 }
+async function serverHandshake(conn, session, inbox) {
+  for (; ; ) {
+    let done4;
+    try {
+      done4 = session.handshake();
+    } catch (err) {
+      await send(conn, session).catch(() => void 0);
+      const text = err instanceof TlsError ? err.message : String(err);
+      throw new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
+    }
+    await send(conn, session);
+    if (done4) return;
+    if (!await inbox.more()) {
+      throw new KernelError(
+        "ECONNRESET",
+        "the client closed the connection during the TLS handshake"
+      );
+    }
+  }
+}
+async function tlsServer(conn, session, clientCerts) {
+  const inbox = new Ciphertext(conn, session);
+  try {
+    await serverHandshake(conn, session, inbox);
+    const chain2 = session.peerChain();
+    const code = clientCerts ? verifyCode(session.verifyResult) : void 0;
+    const info = {
+      protocol: session.version === 772 ? "TLSv1.3" : "TLSv1.2",
+      alpnProtocol: session.alpn ?? false,
+      servername: session.sni,
+      authorized: clientCerts && chain2.length > 0 && code === void 0,
+      ...clientCerts && chain2.length > 0 && code ? { authorizationError: code } : {},
+      peerCertificates: chain2
+    };
+    return { conn: plaintext(conn, session, inbox), info };
+  } catch (err) {
+    session.free();
+    throw err;
+  }
+}
 
 // src/kernel/net/tls-chain.ts
 var CN_MISMATCH = 4;
@@ -15108,7 +15238,7 @@ var RANK = {
 };
 var CR2 = 13;
 var LF2 = 10;
-var EMPTY3 = new Uint8Array(0);
+var EMPTY4 = new Uint8Array(0);
 function register(automaton, sources, ids, bytes, source) {
   const key = Array.from(bytes).join(",");
   let id2 = ids.get(key);
@@ -15288,12 +15418,12 @@ function compile(secrets, options = {}) {
       return { text: decoder4.decode(bytes), hits };
     },
     stream() {
-      let pending = EMPTY3;
+      let pending = EMPTY4;
       const hits = /* @__PURE__ */ new Map();
       const run2 = (final) => {
         if (c.secrets.length === 0 || pending.length === 0) {
           const out = pending;
-          pending = EMPTY3;
+          pending = EMPTY4;
           return out;
         }
         const result = pass(c, pending, final);
@@ -15307,7 +15437,7 @@ function compile(secrets, options = {}) {
           return run2(false);
         },
         idle() {
-          return pending.length < FRAGMENT ? run2(true) : EMPTY3;
+          return pending.length < FRAGMENT ? run2(true) : EMPTY4;
         },
         end() {
           return run2(true);
@@ -17469,6 +17599,7 @@ function sealedConn(conn, s) {
 }
 
 // src/kernel/net/tls-uplink.ts
+var handshakeAbort = (proc) => proc.cancelled ?? proc.blocking();
 var isIP2 = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
 var LABEL2 = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)$/;
 function serverName(name2) {
@@ -17589,6 +17720,9 @@ function takeCert(req) {
   const cert = req.clientCert;
   if (!cert) return void 0;
   delete req.clientCert;
+  return certBytes(cert);
+}
+function certBytes(cert) {
   if (!Array.isArray(cert.chain) || cert.chain.length === 0 || typeof cert.key !== "string")
     throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: cert and key go together");
   let ders;
@@ -17764,8 +17898,32 @@ async function connectSecure(proc, socket, host, port, req) {
   }
   return sessionOf(info, servername);
 }
+async function loopbackSecure(proc, socket, servername, req) {
+  const prepared = await prepare2(supportOf(proc.net), req, servername);
+  let ran = false;
+  try {
+    const info = await socket.secureLink(async (raw2) => {
+      ran = true;
+      try {
+        return await tlsClient(raw2, prepared.options);
+      } finally {
+        prepared.own?.release();
+      }
+    }, handshakeAbort(proc));
+    return sessionOf({ ...info, substitutes: false }, servername);
+  } finally {
+    if (!ran) {
+      prepared.options.session.free();
+      prepared.own?.release();
+    }
+  }
+}
 async function upgradeSecure(proc, socket, req) {
   const peer = socket.peer;
+  if (socket.loopbackLinked) {
+    const host2 = req.servername || (peer?.family === "inet" ? peer.host : "localhost");
+    return loopbackSecure(proc, socket, serverName(host2), req);
+  }
   const host = req.servername || (peer?.family === "inet" ? peer.host : "");
   const servername = serverName(host);
   const port = peer?.family === "inet" ? peer.port : 0;
@@ -17780,6 +17938,120 @@ async function upgradeSecure(proc, socket, req) {
   }
 }
 
+// src/kernel/net/tls-server.ts
+var HANDSHAKE_TIMEOUT_MS = 12e4;
+function leafOf(engine, cert) {
+  try {
+    return engine.importLeaf(cert.chain, cert.key, cert.pass);
+  } catch (err) {
+    throw keyRefused(err, cert.pass.length > 0 && encryptedKey(cert.key));
+  } finally {
+    wipe(cert);
+  }
+}
+function storeOf(engine, ca) {
+  const store = engine.store();
+  try {
+    for (const der2 of ca) store.add(base64Der(der2));
+    return store;
+  } catch (err) {
+    store.release();
+    throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
+  }
+}
+function flagsOf(req, store) {
+  if (!req.requestCert) return 0;
+  if (!store) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: requestCert needs a ca");
+  return req.rejectUnauthorized === false ? TLS_SERVER_REQUEST_CERT : TLS_SERVER_REQUIRE_CERT;
+}
+function timeoutOf(req) {
+  const ms = req.handshakeTimeout ?? HANDSHAKE_TIMEOUT_MS;
+  if (!Number.isInteger(ms) || ms <= 0)
+    throw new KernelError(
+      "EINVAL",
+      "ERR_OUT_OF_RANGE: handshakeTimeout must be a positive integer"
+    );
+  return ms;
+}
+function handshakeSignal(proc, ms) {
+  const timer = new AbortController();
+  const id2 = setTimeout(
+    () => timer.abort(new KernelError("EPROTO", "ERR_TLS_HANDSHAKE_TIMEOUT: TLS handshake timeout")),
+    ms
+  );
+  return {
+    signal: AbortSignal.any([handshakeAbort(proc), timer.signal]),
+    done: () => clearTimeout(id2)
+  };
+}
+async function serverOf(proc, req) {
+  const own = req.cert;
+  delete req.cert;
+  if (!own) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
+  const cert = certBytes(own);
+  let engine;
+  try {
+    engine = await supportOf(proc.net).engine();
+    if (!engine.serverSessions)
+      throw new KernelError("ENOTSUP", "the installed tls engine has no server sessions");
+  } catch (err) {
+    wipe(cert);
+    throw err;
+  }
+  const leaf = leafOf(engine, cert);
+  let store;
+  try {
+    store = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
+    const flags2 = flagsOf(req, store);
+    return {
+      engine,
+      leaf,
+      store,
+      alpn: req.alpn ?? [],
+      flags: flags2,
+      timeoutMs: timeoutOf(req),
+      release() {
+        leaf.release();
+        store?.release();
+      }
+    };
+  } catch (err) {
+    leaf.release();
+    store?.release();
+    throw err;
+  }
+}
+async function listenSecure(proc, socket, req) {
+  if (!socket.listening) throw new KernelError("EINVAL", "not a listening socket");
+  const server = await serverOf(proc, req);
+  socket.serving?.release();
+  socket.serving = server;
+}
+async function serveSecure(proc, socket, req) {
+  const shared = req.listener?.serving;
+  if (req.listener && !shared) throw new KernelError("EINVAL", "the listener has no tls");
+  const server = shared ?? await serverOf(proc, req);
+  try {
+    const { engine, leaf, alpn, store, flags: flags2 } = server;
+    const limit = handshakeSignal(proc, server.timeoutMs);
+    const info = await socket.secureLink(
+      (raw2) => tlsServer(raw2, engine.serverSession(leaf, alpn, store, flags2), flags2 !== 0),
+      limit.signal
+    ).finally(limit.done);
+    return {
+      path: "kernel",
+      protocol: info.protocol,
+      alpnProtocol: info.alpnProtocol,
+      servername: info.servername,
+      authorized: info.authorized,
+      ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
+      peerCertificates: info.peerCertificates.map(encode)
+    };
+  } finally {
+    if (!shared) server.release();
+  }
+}
+
 // src/kernel/unix-dgram.ts
 var SOL_SOCKET3 = 1;
 var SO_TYPE3 = 3;
@@ -17942,7 +18214,9 @@ var SOCKET_OPS = [
   "sock-sendto",
   "sock-recvfrom",
   "sock-tls",
-  "sock-tls-upgrade"
+  "sock-tls-upgrade",
+  "sock-tls-serve",
+  "sock-tls-listen"
 ];
 function socketAt(fds, fd) {
   const file = anySocketAt(fds, fd);
@@ -18018,6 +18292,14 @@ async function socketSyscall(req, proc) {
       return ok3(await secureConnect(req, proc));
     case "sock-tls-upgrade":
       return ok3(await upgradeSecure(proc, socketAt(fds, req.fd), req));
+    case "sock-tls-serve": {
+      const { from, ...rest2 } = req;
+      const listener = from === void 0 ? {} : { listener: socketAt(fds, from) };
+      return ok3(await serveSecure(proc, socketAt(fds, req.fd), { ...rest2, ...listener }));
+    }
+    case "sock-tls-listen":
+      await listenSecure(proc, socketAt(fds, req.fd), req);
+      return ok3({});
     default:
       return datagram(req, proc);
   }
@@ -20449,6 +20731,7 @@ var WasmProcess = class {
       fds: this.fds,
       net: this.net,
       blocking: () => this.blockingSignal(cancelled),
+      cancelled,
       resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking),
       cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid }),
       stamp: () => this.connectorStamp(),
@@ -21791,6 +22074,9 @@ var RemoteWatch = class {
       await new Promise((resolve2) => setTimeout(resolve2, ANNOUNCE_POLL_MS));
     }
   }
+  legacy() {
+    return [...this.peers].filter((peer) => !this.ackers.has(peer));
+  }
   crowded() {
     return !this.settled || this.peers.size > 0;
   }
@@ -21798,7 +22084,7 @@ var RemoteWatch = class {
     return `${this.name}:${tab}`;
   }
   receive(data) {
-    const sender = data.hello ?? data.here;
+    const sender = data.hello ?? data.here ?? (data.paths !== void 0 ? data.tab : void 0);
     if (sender !== void 0 && data.renames) this.ackers.add(sender);
     if (data.hello !== void 0) this.greeted(data.hello);
     if (data.renaming !== void 0 && data.tab !== void 0) this.heard(data);
@@ -21905,7 +22191,7 @@ var RemoteWatch = class {
   announce(paths) {
     this.mine = [...paths];
     const seq2 = ++this.seq;
-    this.channel.postMessage({ tab: this.tab, paths: this.mine, seq: seq2 });
+    this.channel.postMessage({ tab: this.tab, paths: this.mine, seq: seq2, renames: true });
     return this.acks(seq2, this.peers);
   }
   renamingTree(rename, cap = RENAME_ACK_MAX_MS) {
@@ -24837,6 +25123,17 @@ var OpfsFs = class {
   }
   async admitted(locks, lock, from, to, place, hooks) {
     const remote = this.remote;
+    const older = remote?.legacy() ?? [];
+    if (older.length > 0) {
+      this.ackBusy++;
+      if (!this.warnedLegacy) {
+        this.warnedLegacy = true;
+        console.warn(
+          `slicc-kernel: renaming ${from} to ${to} gave up (EBUSY): a tab running an older slicc-kernel shares this root and can't be waited for; reload it to rename directories (#1309)`
+        );
+      }
+      throw fsError("EBUSY", from);
+    }
     if (remote && !this.shared() && !await remote.joinedAll(RENAME_ACK_MAX_MS)) {
       this.ackBusy++;
       console.warn(
@@ -24887,6 +25184,7 @@ var OpfsFs = class {
     await run2;
   }
   renameAcks = 0;
+  warnedLegacy = false;
   ackBusy = 0;
   ackMs = [];
   ownLocks = /* @__PURE__ */ new Set();