@ai-ecoverse/slicc-kernel 1.148.1 → 1.149.1

package/dist/kernel-worker.js

@@ -5954,6 +5954,9 @@ function link(a, b) {
   a.attach({ rx: ba, tx: ab });
   b.attach({ rx: ab, tx: ba });
 }
+var SERVE_CHUNK = 64 * 1024;
+var NEVER_ABORTED = new AbortController().signal;
+var EMPTY = new Uint8Array(0);
 var KernelSocket = class _KernelSocket {
   net;
   domain;
@@ -6151,6 +6154,54 @@ var KernelSocket = class _KernelSocket {
     if (this.state !== "open") throw new KernelError("EISCONN");
     return this.dial(addr, route2, secure2);
   }
+  serving;
+  served = false;
+  get loopbackLinked() {
+    return this.state === "connected" && !this.switch;
+  }
+  async secureLink(make, signal = NEVER_ABORTED) {
+    const raw2 = this.connection();
+    if (this.switch || this.served || this.writeShut || this.readShut)
+      throw new KernelError("EINVAL");
+    signal.throwIfAborted();
+    this.served = true;
+    let handshaking = true;
+    const view2 = {
+      localAddr: "",
+      remoteAddr: "",
+      read: async () => {
+        const bytes = await raw2.rx.read(SERVE_CHUNK, handshaking ? signal : void 0).catch(() => EMPTY);
+        return bytes.length > 0 ? bytes : null;
+      },
+      write: (bytes) => raw2.tx.write(bytes),
+      closeWrite: () => raw2.tx.closeWrite(),
+      close: () => {
+        raw2.rx.closeRead();
+        raw2.tx.closeWrite();
+      }
+    };
+    let made2;
+    const abandon = () => view2.close();
+    signal.addEventListener("abort", abandon, { once: true });
+    try {
+      made2 = await make(view2);
+    } catch (err) {
+      view2.close();
+      this.readShut = true;
+      this.writeShut = true;
+      this.changes.wake();
+      throw signal.aborted ? signal.reason : err;
+    } finally {
+      handshaking = false;
+      signal.removeEventListener("abort", abandon);
+    }
+    this.link = uplinkLink(made2.conn, (err) => {
+      this.reset = err instanceof KernelError && err.code === "EPROTO" ? err : new KernelError("ECONNRESET");
+      this.changes.wake();
+    });
+    this.changes.wake();
+    return made2.info;
+  }
   upgradeSecure(make) {
     if (this.state !== "connected") throw new KernelError("ENOTCONN");
     if (!this.switch) throw new KernelError("EOPNOTSUPP");
@@ -6282,6 +6333,8 @@ var KernelSocket = class _KernelSocket {
     }
     if (this.boundAt) this.net.release(this.boundAt, this, this.named);
     this.boundAt = void 0;
+    this.serving?.release();
+    this.serving = void 0;
     this.changes.wake();
   }
   static pair(net, domain, cred) {
@@ -6784,6 +6837,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
     const flow = {
       inflight: 0,
       closing: false,
+      dropped: false,
       deadline: () => AbortSignal.timeout(closeWaitMs).addEventListener("abort", late, { once: true })
     };
     credit.set(nid, flow);
@@ -6795,7 +6849,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
         const next3 = await Promise.race([messages.next(), unanswered]);
         if (next3 === "late" || next3.done) break;
         const data = next3.value;
-        if (flow.closing) continue;
+        if (flow.dropped) continue;
         if (payloadSize(data) > MESSAGE_LIMIT) {
           oversize = true;
           break;
@@ -6849,6 +6903,8 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
   };
   const drop = (nid) => {
     sockets.get(nid)?.close(1e3, "cancelled");
+    const flow = credit.get(nid);
+    if (flow) flow.dropped = true;
     refill(nid, 0, true);
     const entry = open2.get(nid);
     open2.delete(nid);
@@ -7855,7 +7911,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.148.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.149.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -10354,7 +10410,7 @@ async function followLinks(fs, path) {
   return current;
 }
 var NOBODY = { ruid: -1, euid: -1, suid: -1, rgid: -1, egid: -1, sgid: -1, groups: [] };
-var EMPTY = new Uint8Array(0);
+var EMPTY2 = new Uint8Array(0);
 function quiet(promise) {
   return promise.catch(() => void 0);
 }
@@ -10437,13 +10493,13 @@ function withCommandDirs(fs, names2, userDir = async () => void 0, owners = fals
     return target?.path;
   }
   const absent2 = (err) => {
-    if (missing3(err)) return EMPTY;
+    if (missing3(err)) return EMPTY2;
     throw err;
   };
   async function content(path, err) {
     if (!missing3(err) || !(await linked2(path))?.isFile) throw err;
     const target = await redirected2(path);
-    return target === void 0 ? EMPTY : fs.readFileBuffer(target).catch(absent2);
+    return target === void 0 ? EMPTY2 : fs.readFileBuffer(target).catch(absent2);
   }
   const ranged2 = rangedOps(fs);
   async function stat(path, real) {
@@ -16717,6 +16773,8 @@ function realmCa(owner, store) {
 var TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
 var TLS_CLIENT_NO_SNI = 2;
 var TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
+var TLS_SERVER_REQUEST_CERT = 1;
+var TLS_SERVER_REQUIRE_CERT = 2;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -16765,6 +16823,35 @@ var TlsEngine = class {
       this.m._free(name2);
     }
   }
+  get serverSessions() {
+    return typeof this.m._tls_server_new === "function";
+  }
+  importLeaf(chain2, key, pass2) {
+    const leafImport = this.m._tls_leaf_import;
+    const keyLen = key[0] === 45 ? key.length + 1 : key.length;
+    const ptr = this.withBytes(
+      chain2,
+      (c) => this.withSecret(
+        key,
+        (k) => this.withSecret(
+          pass2,
+          (p) => leafImport(c, chain2.length, k, keyLen, pass2.length > 0 ? p : 0, pass2.length)
+        )
+      )
+    );
+    if (!ptr) throw this.error(this.m._tls_last_error(), "server certificate");
+    return new TlsLeaf(this, this.m, ptr);
+  }
+  serverSession(leaf, alpn, clientCa, flags2) {
+    const open2 = this.m._tls_server_new;
+    const wire = alpnWire(alpn);
+    const ptr = this.withBytes(
+      wire,
+      (p) => open2(leaf.ptr, wire.length > 0 ? p : 0, wire.length, clientCa?.ptr ?? 0, flags2)
+    );
+    if (!ptr) throw this.error(this.m._tls_last_error(), "tls server");
+    return new TlsSession(this, this.m, ptr);
+  }
   withBytes(bytes, fn) {
     const ptr = this.put(bytes);
     try {
@@ -16969,6 +17056,12 @@ var TlsSession = class {
   get version() {
     return this.c._tls_version(this.ptr);
   }
+  get sni() {
+    const out = this.engine.intoScratch(
+      (p, max) => this.m._tls_sni(this.ptr, p, max)
+    );
+    return out instanceof Uint8Array ? new TextDecoder().decode(out) : "";
+  }
   get alpn() {
     const out = this.engine.intoScratch((p, max) => this.c._tls_alpn(this.ptr, p, max));
     return out instanceof Uint8Array ? new TextDecoder().decode(out) : void 0;
@@ -17471,7 +17564,7 @@ var Upload = class {
     }
   }
 };
-var EMPTY2 = new Uint8Array(0);
+var EMPTY3 = new Uint8Array(0);
 function message2(e) {
   return e instanceof Error ? e.message : String(e);
 }
@@ -17546,8 +17639,8 @@ var HttpHandles = class {
     const entry = {
       abort,
       head: Promise.resolve({ ok: true, kind: "void" }),
-      body: once(EMPTY2),
-      left: EMPTY2,
+      body: once(EMPTY3),
+      left: EMPTY3,
       done: false,
       reading: Promise.resolve(),
       cancel: async () => void 0,
@@ -18785,6 +18878,46 @@ async function tlsClient(conn, o, taken = new Uint8Array(0)) {
     throw err;
   }
 }
+async function serverHandshake(conn, session, inbox) {
+  for (; ; ) {
+    let done5;
+    try {
+      done5 = session.handshake();
+    } catch (err) {
+      await send(conn, session).catch(() => void 0);
+      const text = err instanceof TlsError ? err.message : String(err);
+      throw new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
+    }
+    await send(conn, session);
+    if (done5) return;
+    if (!await inbox.more()) {
+      throw new KernelError(
+        "ECONNRESET",
+        "the client closed the connection during the TLS handshake"
+      );
+    }
+  }
+}
+async function tlsServer(conn, session, clientCerts) {
+  const inbox = new Ciphertext(conn, session);
+  try {
+    await serverHandshake(conn, session, inbox);
+    const chain2 = session.peerChain();
+    const code = clientCerts ? verifyCode(session.verifyResult) : void 0;
+    const info = {
+      protocol: session.version === 772 ? "TLSv1.3" : "TLSv1.2",
+      alpnProtocol: session.alpn ?? false,
+      servername: session.sni,
+      authorized: clientCerts && chain2.length > 0 && code === void 0,
+      ...clientCerts && chain2.length > 0 && code ? { authorizationError: code } : {},
+      peerCertificates: chain2
+    };
+    return { conn: plaintext(conn, session, inbox), info };
+  } catch (err) {
+    session.free();
+    throw err;
+  }
+}
 
 // src/kernel/net/tls-chain.ts
 var CN_MISMATCH = 4;
@@ -19237,7 +19370,7 @@ var RANK = {
 };
 var CR2 = 13;
 var LF2 = 10;
-var EMPTY3 = new Uint8Array(0);
+var EMPTY4 = new Uint8Array(0);
 function register(automaton, sources, ids, bytes, source) {
   const key = Array.from(bytes).join(",");
   let id2 = ids.get(key);
@@ -19417,12 +19550,12 @@ function compile(secrets, options = {}) {
       return { text: decoder4.decode(bytes), hits };
     },
     stream() {
-      let pending = EMPTY3;
+      let pending = EMPTY4;
       const hits = /* @__PURE__ */ new Map();
       const run2 = (final) => {
         if (c.secrets.length === 0 || pending.length === 0) {
           const out = pending;
-          pending = EMPTY3;
+          pending = EMPTY4;
           return out;
         }
         const result = pass(c, pending, final);
@@ -19436,7 +19569,7 @@ function compile(secrets, options = {}) {
           return run2(false);
         },
         idle() {
-          return pending.length < FRAGMENT ? run2(true) : EMPTY3;
+          return pending.length < FRAGMENT ? run2(true) : EMPTY4;
         },
         end() {
           return run2(true);
@@ -21598,6 +21731,7 @@ function sealedConn(conn, s) {
 }
 
 // src/kernel/net/tls-uplink.ts
+var handshakeAbort = (proc) => proc.cancelled ?? proc.blocking();
 var isIP2 = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
 var LABEL2 = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)$/;
 function serverName(name2) {
@@ -21718,6 +21852,9 @@ function takeCert(req) {
   const cert = req.clientCert;
   if (!cert) return void 0;
   delete req.clientCert;
+  return certBytes(cert);
+}
+function certBytes(cert) {
   if (!Array.isArray(cert.chain) || cert.chain.length === 0 || typeof cert.key !== "string")
     throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: cert and key go together");
   let ders;
@@ -21893,8 +22030,32 @@ async function connectSecure(proc, socket, host, port, req) {
   }
   return sessionOf(info, servername);
 }
+async function loopbackSecure(proc, socket, servername, req) {
+  const prepared = await prepare2(supportOf(proc.net), req, servername);
+  let ran = false;
+  try {
+    const info = await socket.secureLink(async (raw2) => {
+      ran = true;
+      try {
+        return await tlsClient(raw2, prepared.options);
+      } finally {
+        prepared.own?.release();
+      }
+    }, handshakeAbort(proc));
+    return sessionOf({ ...info, substitutes: false }, servername);
+  } finally {
+    if (!ran) {
+      prepared.options.session.free();
+      prepared.own?.release();
+    }
+  }
+}
 async function upgradeSecure(proc, socket, req) {
   const peer = socket.peer;
+  if (socket.loopbackLinked) {
+    const host2 = req.servername || (peer?.family === "inet" ? peer.host : "localhost");
+    return loopbackSecure(proc, socket, serverName(host2), req);
+  }
   const host = req.servername || (peer?.family === "inet" ? peer.host : "");
   const servername = serverName(host);
   const port = peer?.family === "inet" ? peer.port : 0;
@@ -21909,6 +22070,120 @@ async function upgradeSecure(proc, socket, req) {
   }
 }
 
+// src/kernel/net/tls-server.ts
+var HANDSHAKE_TIMEOUT_MS = 12e4;
+function leafOf(engine, cert) {
+  try {
+    return engine.importLeaf(cert.chain, cert.key, cert.pass);
+  } catch (err) {
+    throw keyRefused(err, cert.pass.length > 0 && encryptedKey(cert.key));
+  } finally {
+    wipe(cert);
+  }
+}
+function storeOf(engine, ca) {
+  const store = engine.store();
+  try {
+    for (const der2 of ca) store.add(base64Der(der2));
+    return store;
+  } catch (err) {
+    store.release();
+    throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
+  }
+}
+function flagsOf(req, store) {
+  if (!req.requestCert) return 0;
+  if (!store) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: requestCert needs a ca");
+  return req.rejectUnauthorized === false ? TLS_SERVER_REQUEST_CERT : TLS_SERVER_REQUIRE_CERT;
+}
+function timeoutOf(req) {
+  const ms = req.handshakeTimeout ?? HANDSHAKE_TIMEOUT_MS;
+  if (!Number.isInteger(ms) || ms <= 0)
+    throw new KernelError(
+      "EINVAL",
+      "ERR_OUT_OF_RANGE: handshakeTimeout must be a positive integer"
+    );
+  return ms;
+}
+function handshakeSignal(proc, ms) {
+  const timer = new AbortController();
+  const id2 = setTimeout(
+    () => timer.abort(new KernelError("EPROTO", "ERR_TLS_HANDSHAKE_TIMEOUT: TLS handshake timeout")),
+    ms
+  );
+  return {
+    signal: AbortSignal.any([handshakeAbort(proc), timer.signal]),
+    done: () => clearTimeout(id2)
+  };
+}
+async function serverOf(proc, req) {
+  const own = req.cert;
+  delete req.cert;
+  if (!own) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
+  const cert = certBytes(own);
+  let engine;
+  try {
+    engine = await supportOf(proc.net).engine();
+    if (!engine.serverSessions)
+      throw new KernelError("ENOTSUP", "the installed tls engine has no server sessions");
+  } catch (err) {
+    wipe(cert);
+    throw err;
+  }
+  const leaf = leafOf(engine, cert);
+  let store;
+  try {
+    store = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
+    const flags2 = flagsOf(req, store);
+    return {
+      engine,
+      leaf,
+      store,
+      alpn: req.alpn ?? [],
+      flags: flags2,
+      timeoutMs: timeoutOf(req),
+      release() {
+        leaf.release();
+        store?.release();
+      }
+    };
+  } catch (err) {
+    leaf.release();
+    store?.release();
+    throw err;
+  }
+}
+async function listenSecure(proc, socket, req) {
+  if (!socket.listening) throw new KernelError("EINVAL", "not a listening socket");
+  const server = await serverOf(proc, req);
+  socket.serving?.release();
+  socket.serving = server;
+}
+async function serveSecure(proc, socket, req) {
+  const shared = req.listener?.serving;
+  if (req.listener && !shared) throw new KernelError("EINVAL", "the listener has no tls");
+  const server = shared ?? await serverOf(proc, req);
+  try {
+    const { engine, leaf, alpn, store, flags: flags2 } = server;
+    const limit = handshakeSignal(proc, server.timeoutMs);
+    const info = await socket.secureLink(
+      (raw2) => tlsServer(raw2, engine.serverSession(leaf, alpn, store, flags2), flags2 !== 0),
+      limit.signal
+    ).finally(limit.done);
+    return {
+      path: "kernel",
+      protocol: info.protocol,
+      alpnProtocol: info.alpnProtocol,
+      servername: info.servername,
+      authorized: info.authorized,
+      ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
+      peerCertificates: info.peerCertificates.map(encode)
+    };
+  } finally {
+    if (!shared) server.release();
+  }
+}
+
 // src/kernel/unix-dgram.ts
 var SOL_SOCKET3 = 1;
 var SO_TYPE3 = 3;
@@ -22071,7 +22346,9 @@ var SOCKET_OPS = [
   "sock-sendto",
   "sock-recvfrom",
   "sock-tls",
-  "sock-tls-upgrade"
+  "sock-tls-upgrade",
+  "sock-tls-serve",
+  "sock-tls-listen"
 ];
 function socketAt(fds, fd) {
   const file = anySocketAt(fds, fd);
@@ -22147,6 +22424,14 @@ async function socketSyscall(req, proc) {
       return ok3(await secureConnect(req, proc));
     case "sock-tls-upgrade":
       return ok3(await upgradeSecure(proc, socketAt(fds, req.fd), req));
+    case "sock-tls-serve": {
+      const { from, ...rest2 } = req;
+      const listener = from === void 0 ? {} : { listener: socketAt(fds, from) };
+      return ok3(await serveSecure(proc, socketAt(fds, req.fd), { ...rest2, ...listener }));
+    }
+    case "sock-tls-listen":
+      await listenSecure(proc, socketAt(fds, req.fd), req);
+      return ok3({});
     default:
       return datagram(req, proc);
   }
@@ -24578,6 +24863,7 @@ var WasmProcess = class {
       fds: this.fds,
       net: this.net,
       blocking: () => this.blockingSignal(cancelled),
+      cancelled,
       resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking),
       cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid }),
       stamp: () => this.connectorStamp(),