@ai-ecoverse/slicc-kernel 1.149.1 → 1.150.0

package/README.md

@@ -511,7 +511,8 @@ The module's default export (or its `main` export) is called with a context and
       - `requestCert` needs `ca` (the roots a client certificate must reach; else `EINVAL`). With it the handshake fails without a client certificate that verifies, unless `rejectUnauthorized: false`, which only asks for one and reports the verdict.
       - A connection's `tls` is `{ path: 'kernel', protocol, alpnProtocol, servername (the SNI the client sent, or ''), authorized (whether a client certificate verified), authorizationError?, peerCertificates (the client's chain) }`.
       - On a `listen({ tls })` listener, the kernel handshakes accepted connections concurrently, from the first `accept` on, and `accept` (and `for await`) yields each as its handshake finishes, so a client that connects and stays silent doesn't hold up the next. It holds at most `backlog` (up to 64) connections in a handshake or handshaken but not yet taken; beyond that it stops accepting, leaving the rest in the kernel's backlog, until one finishes or is taken. A connection whose handshake fails is closed and never yielded. `secure()` rejects instead.
-      - `handshakeTimeout` (milliseconds, 120000 by default, as Node's) ends a handshake that hasn't finished: the connection is closed with `ERR_TLS_HANDSHAKE_TIMEOUT`. A handshake, server or loopback client, waits without holding the program's other calls, and an aborted `accept({ signal })` or `connect({ signal })` ends it. A signal delivered to the program doesn't interrupt a handshake, as with `SA_RESTART`.
+      - `handshakeTimeout` (milliseconds, 120000 by default, as Node's) ends a handshake that hasn't finished with `ERR_TLS_HANDSHAKE_TIMEOUT`. A listener closes that connection. After `secure()` rejects, the connection stays open and is the program's to answer or close, as with Node's `tlsClientError` ([#1504](https://github.com/ai-ecoverse/slicc-kernel/issues/1504)).
+      - A client that sends a plain HTTP request instead of a ClientHello fails the handshake with `ERR_SSL_HTTP_REQUEST`, as in Node. A handshake, server or loopback client, waits without holding the program's other calls, and an aborted `accept({ signal })` or `connect({ signal })` ends it. A signal delivered to the program doesn't interrupt a handshake, as with `SA_RESTART`.
       - **The key:** the kernel hands it to the engine once per listener (once per `secure()` call) and wipes its own copies; the engine keeps its copy until the listener is closed, and not in errors, logs, `ps`, `/proc` or the page. A forked child that inherits the listener shares that one copy, and it's freed when the last process closes it. **The program's own `key` string or `Buffer` stays in its realm**: JavaScript strings can't be wiped, so the kernel can't erase what the program holds.
     - **Sealed values in an A2 session** ([#1090](https://github.com/ai-ecoverse/slicc-kernel/issues/1090)) are substituted only at a credential position, only in a session the kernel verified itself (by its bundled roots, or by a vault anchor), and only as the vault allows. `substitutes` means the session **may** substitute: a placeholder at a recognized position will be offered to the vault, and whether a value comes back is the vault's and the anchor check's decision. It's true when all of these hold:
       - `verified` is true, or the engine can verify a chain on its own (wasm-tls-engine 4.2.0-5's `tls_chain_verify`) and the server name isn't an IP literal, so a vault anchor may verify the session (below);

package/dist/kernel-worker.js

@@ -5100,12 +5100,12 @@ var KernelPipe = class {
       await this.changed(signal);
     }
     const out = new Uint8Array(Math.min(max, this.size));
-    let filled = 0;
+    let filled2 = 0;
     for (const chunk2 of this.chunks) {
-      if (filled === out.length) break;
-      const count2 = Math.min(chunk2.length, out.length - filled);
-      out.set(chunk2.subarray(0, count2), filled);
-      filled += count2;
+      if (filled2 === out.length) break;
+      const count2 = Math.min(chunk2.length, out.length - filled2);
+      out.set(chunk2.subarray(0, count2), filled2);
+      filled2 += count2;
     }
     return out;
   }
@@ -5133,12 +5133,12 @@ var KernelPipe = class {
   }
   take(n) {
     const out = new Uint8Array(n);
-    let filled = 0;
-    while (filled < n) {
+    let filled2 = 0;
+    while (filled2 < n) {
       const head = this.chunks[0];
-      const count2 = Math.min(head.length, n - filled);
-      out.set(head.subarray(0, count2), filled);
-      filled += count2;
+      const count2 = Math.min(head.length, n - filled2);
+      out.set(head.subarray(0, count2), filled2);
+      filled2 += count2;
       if (count2 === head.length) this.chunks.shift();
       else this.chunks[0] = head.subarray(count2);
     }
@@ -5903,8 +5903,8 @@ var DIAL_ERRORS = [
   "ETIMEDOUT",
   "ECONNRESET"
 ];
-function dialError(e, timedOut, closed) {
-  if (timedOut) return new KernelError("ETIMEDOUT");
+function dialError(e, timedOut2, closed) {
+  if (timedOut2) return new KernelError("ETIMEDOUT");
   if (closed) return new KernelError("ECONNABORTED");
   const code = e?.code;
   const known = DIAL_ERRORS.find((errno3) => errno3 === code);
@@ -6159,7 +6159,7 @@ var KernelSocket = class _KernelSocket {
   get loopbackLinked() {
     return this.state === "connected" && !this.switch;
   }
-  async secureLink(make, signal = NEVER_ABORTED) {
+  async secureLink(make, signal = NEVER_ABORTED, keeps = () => false) {
     const raw2 = this.connection();
     if (this.switch || this.served || this.writeShut || this.readShut)
       throw new KernelError("EINVAL");
@@ -6181,14 +6181,18 @@ var KernelSocket = class _KernelSocket {
       }
     };
     let made2;
-    const abandon = () => view2.close();
+    const abandon = () => {
+      if (!keeps(signal.reason)) view2.close();
+    };
     signal.addEventListener("abort", abandon, { once: true });
     try {
       made2 = await make(view2);
     } catch (err) {
-      view2.close();
-      this.readShut = true;
-      this.writeShut = true;
+      if (!(signal.aborted && keeps(signal.reason))) {
+        view2.close();
+        this.readShut = true;
+        this.writeShut = true;
+      }
       this.changes.wake();
       throw signal.aborted ? signal.reason : err;
     } finally {
@@ -6212,9 +6216,9 @@ var KernelSocket = class _KernelSocket {
     this.state = "connecting";
     const abort = new AbortController();
     this.dialing = abort;
-    let timedOut = false;
+    let timedOut2 = false;
     const timer = setTimeout(() => {
-      timedOut = true;
+      timedOut2 = true;
       abort.abort(new KernelError("ETIMEDOUT"));
     }, route2.timeoutMs ?? DIAL_TIMEOUT_MS);
     const abandoned = new Promise((_, reject) => {
@@ -6230,7 +6234,7 @@ var KernelSocket = class _KernelSocket {
     );
     return Promise.race([dialled, abandoned]).then(
       async (raw2) => {
-        if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut, true);
+        if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut2, true);
         const conn = new SwitchConn(raw2);
         if (secure2) {
           clearTimeout(timer);
@@ -6256,7 +6260,7 @@ var KernelSocket = class _KernelSocket {
         );
       },
       (e) => {
-        throw this.dialFailed(abort, dialError(e, timedOut, abort.signal.aborted));
+        throw this.dialFailed(abort, dialError(e, timedOut2, abort.signal.aborted));
       }
     ).finally(() => clearTimeout(timer));
   }
@@ -6841,7 +6845,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
       deadline: () => AbortSignal.timeout(closeWaitMs).addEventListener("abort", late, { once: true })
     };
     credit.set(nid, flow);
-    const timedOut = { code: 1006, reason: "the far end did not answer the close" };
+    const timedOut2 = { code: 1006, reason: "the far end did not answer the close" };
     let oversize = false;
     try {
       const messages = socket.messages[Symbol.asyncIterator]();
@@ -6867,7 +6871,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
         }
       }
       if (oversize) socket.close(1e3, "a message is too big");
-      ending = oversize ? { code: 1009, reason: `a message is over ${MESSAGE_LIMIT} bytes` } : await Promise.race([socket.closed, unanswered.then(() => timedOut)]);
+      ending = oversize ? { code: 1009, reason: `a message is over ${MESSAGE_LIMIT} bytes` } : await Promise.race([socket.closed, unanswered.then(() => timedOut2)]);
     } catch (e) {
       socket.close(1e3, "the relay failed");
       ending = { code: 1011, reason: e instanceof Error ? e.message : String(e) };
@@ -7911,7 +7915,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.149.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.150.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -17711,8 +17715,8 @@ var HttpHandles = class {
         else entry.left = next3.value;
       } catch (e) {
         entry.done = true;
-        const timedOut = e?.code === "ETIMEDOUT";
-        return { ok: false, errno: timedOut ? "ETIMEDOUT" : "EIO", message: message2(e) };
+        const timedOut2 = e?.code === "ETIMEDOUT";
+        return { ok: false, errno: timedOut2 ? "ETIMEDOUT" : "EIO", message: message2(e) };
       }
     }
     const bytes = entry.left.subarray(0, Math.max(0, max));
@@ -18878,15 +18882,22 @@ async function tlsClient(conn, o, taken = new Uint8Array(0)) {
     throw err;
   }
 }
-async function serverHandshake(conn, session, inbox) {
+var HTTP_REQUEST = /^[A-Z]{3,10} [!-~]/;
+function serverRefusal(err, session, first) {
+  const opening2 = first ? new TextDecoder("latin1").decode(first.subarray(0, 16)) : "";
+  if (HTTP_REQUEST.test(opening2))
+    return new KernelError("EPROTO", "ERR_SSL_HTTP_REQUEST: http request");
+  const text = err instanceof TlsError ? err.message : String(err);
+  return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
+}
+async function serverHandshake(conn, session, inbox, first) {
   for (; ; ) {
     let done5;
     try {
       done5 = session.handshake();
     } catch (err) {
       await send(conn, session).catch(() => void 0);
-      const text = err instanceof TlsError ? err.message : String(err);
-      throw new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
+      throw serverRefusal(err, session, first());
     }
     await send(conn, session);
     if (done5) return;
@@ -18899,9 +18910,18 @@ async function serverHandshake(conn, session, inbox) {
   }
 }
 async function tlsServer(conn, session, clientCerts) {
-  const inbox = new Ciphertext(conn, session);
+  let first;
+  const watched = {
+    ...conn,
+    read: async () => {
+      const bytes = await conn.read();
+      first ??= bytes ?? void 0;
+      return bytes;
+    }
+  };
+  const inbox = new Ciphertext(watched, session);
   try {
-    await serverHandshake(conn, session, inbox);
+    await serverHandshake(conn, session, inbox, () => first);
     const chain2 = session.peerChain();
     const code = clientCerts ? verifyCode(session.verifyResult) : void 0;
     const info = {
@@ -19371,6 +19391,7 @@ var RANK = {
 var CR2 = 13;
 var LF2 = 10;
 var EMPTY4 = new Uint8Array(0);
+var FILLER = 42;
 function register(automaton, sources, ids, bytes, source) {
   const key = Array.from(bytes).join(",");
   let id2 = ids.get(key);
@@ -19381,7 +19402,7 @@ function register(automaton, sources, ids, bytes, source) {
   }
   sources[id2].push(source);
 }
-function prepare(secrets) {
+function prepare(secrets, sameLength) {
   const main = new Automaton();
   const wrap = new Automaton();
   const sources = [];
@@ -19405,7 +19426,19 @@ function prepare(secrets) {
     utf82(secret.placeholder),
     utf82(`[redacted:${secret.name}]`)
   ]);
-  return { secrets, values, main, wrap, sources, wrapSources, replacements };
+  return { secrets, values, main, wrap, sources, wrapSources, replacements, sameLength };
+}
+function filled(input, start2, end) {
+  const out = new Uint8Array(end - start2);
+  for (let i = start2; i < end; i++) {
+    const byte = input[i];
+    out[i - start2] = byte === CR2 || byte === LF2 ? byte : FILLER;
+  }
+  return out;
+}
+function replacement(c, input, candidate) {
+  if (c.sameLength) return filled(input, candidate.start, candidate.end);
+  return c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1];
 }
 function better(a, b) {
   if (!b) return true;
@@ -19514,10 +19547,7 @@ function pass(c, input, final) {
       break;
     }
     const candidate = best.get(next3);
-    parts2.push(
-      input.subarray(pos, next3),
-      c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1]
-    );
+    parts2.push(input.subarray(pos, next3), replacement(c, input, candidate));
     count(c, hits, candidate);
     pos = candidate.end;
   }
@@ -19532,7 +19562,10 @@ function merge(into, from) {
   }
 }
 function compile(secrets, options = {}) {
-  const c = prepare(secrets.map((secret) => ({ ...secret })));
+  const c = prepare(
+    secrets.map((secret) => ({ ...secret })),
+    options.sameLength === true
+  );
   const decoder4 = new TextDecoder();
   const idleMs = options.idleMs ?? 250;
   const scrubBytes = (input) => {
@@ -22105,12 +22138,10 @@ function timeoutOf(req) {
     );
   return ms;
 }
+var timedOut = new KernelError("EPROTO", "ERR_TLS_HANDSHAKE_TIMEOUT: TLS handshake timeout");
 function handshakeSignal(proc, ms) {
   const timer = new AbortController();
-  const id2 = setTimeout(
-    () => timer.abort(new KernelError("EPROTO", "ERR_TLS_HANDSHAKE_TIMEOUT: TLS handshake timeout")),
-    ms
-  );
+  const id2 = setTimeout(() => timer.abort(timedOut), ms);
   return {
     signal: AbortSignal.any([handshakeAbort(proc), timer.signal]),
     done: () => clearTimeout(id2)
@@ -22168,7 +22199,8 @@ async function serveSecure(proc, socket, req) {
     const limit = handshakeSignal(proc, server.timeoutMs);
     const info = await socket.secureLink(
       (raw2) => tlsServer(raw2, engine.serverSession(leaf, alpn, store, flags2), flags2 !== 0),
-      limit.signal
+      limit.signal,
+      (reason) => !shared && reason === timedOut
     ).finally(limit.done);
     return {
       path: "kernel",