@ai-ecoverse/slicc-kernel 1.150.1 → 1.151.0

package/README.md

@@ -508,8 +508,8 @@ The module's default export (or its `main` export) is called with a context and
     - **A TLS server** ([#1401](https://github.com/ai-ecoverse/slicc-kernel/issues/1401)), with the program's own certificate and key: `net.listen({ port, host, tls: { cert, key, passphrase, alpn, ca, requestCert, rejectUnauthorized } })` (and `sync.net.listen`) gives a listener whose connections are already secured, and `net.secure(conn, { server: true, cert, key, … })` secures one accepted connection. `net.secure(conn, tls)` without `server: true` is the client upgrade, as `connect({ socket })`.
       - `cert` and `key` take the same forms as a client certificate, and are refused the same way, at `listen` (or `secure`) before anything is accepted: a key for another certificate is `ERR_OSSL_X509_KEY_VALUES_MISMATCH`, a wrong passphrase `ERR_OSSL_BAD_DECRYPT`.
       - `alpn` is the server's list in order of preference; the first one the client also offers wins, and a client that offers ALPN but none of these fails the handshake.
-      - `requestCert` needs `ca` (the roots a client certificate must reach; else `EINVAL`). With it the handshake fails without a client certificate that verifies, unless `rejectUnauthorized: false`, which only asks for one and reports the verdict.
-      - A connection's `tls` is `{ path: 'kernel', protocol, alpnProtocol, servername (the SNI the client sent, or ''), authorized (whether a client certificate verified), authorizationError?, peerCertificates (the client's chain) }`.
+      - `requestCert` asks for a client certificate, checked against `ca` (the roots it must reach) or, without `ca`, the kernel's bundled roots, as Node's default store ([#1503](https://github.com/ai-ecoverse/slicc-kernel/issues/1503)). With it the handshake fails without a client certificate that verifies, unless `rejectUnauthorized: false`, which only asks for one and reports the verdict.
+      - A connection's `tls` is `{ path: 'kernel', protocol, cipher ({ name, standardName, version }, as a client's; [#1500](https://github.com/ai-ecoverse/slicc-kernel/issues/1500)), alpnProtocol, servername (the SNI the client sent, or ''), authorized (whether a client certificate verified), authorizationError?, peerCertificates (the client's chain) }`.
       - On a `listen({ tls })` listener, the kernel handshakes accepted connections concurrently, from the first `accept` on, and `accept` (and `for await`) yields each as its handshake finishes, so a client that connects and stays silent doesn't hold up the next. It holds at most `backlog` (up to 64) connections in a handshake or handshaken but not yet taken; beyond that it stops accepting, leaving the rest in the kernel's backlog, until one finishes or is taken. A connection whose handshake fails is closed and never yielded. `secure()` rejects instead.
       - `handshakeTimeout` (milliseconds, 120000 by default, as Node's) ends a handshake that hasn't finished with `ERR_TLS_HANDSHAKE_TIMEOUT`. A listener closes that connection. After `secure()` rejects, the connection stays open and is the program's to answer or close, as with Node's `tlsClientError` ([#1504](https://github.com/ai-ecoverse/slicc-kernel/issues/1504)).
       - A client that sends a plain HTTP request instead of a ClientHello fails the handshake with `ERR_SSL_HTTP_REQUEST`, as in Node. A handshake, server or loopback client, waits without holding the program's other calls, and an aborted `accept({ signal })` or `connect({ signal })` ends it. A signal delivered to the program doesn't interrupt a handshake, as with `SA_RESTART`.

package/dist/kernel-worker.js

@@ -7915,7 +7915,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.150.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.151.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -18924,8 +18924,10 @@ async function tlsServer(conn, session, clientCerts) {
     await serverHandshake(conn, session, inbox, () => first);
     const chain2 = session.peerChain();
     const code = clientCerts ? verifyCode(session.verifyResult) : void 0;
+    const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
     const info = {
-      protocol: session.version === 772 ? "TLSv1.3" : "TLSv1.2",
+      protocol,
+      cipher: cipherOf(session.ciphersuite, protocol),
       alpnProtocol: session.alpn ?? false,
       servername: session.sni,
       authorized: clientCerts && chain2.length > 0 && code === void 0,
@@ -22124,9 +22126,8 @@ function storeOf(engine, ca) {
     throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
   }
 }
-function flagsOf(req, store) {
+function flagsOf(req) {
   if (!req.requestCert) return 0;
-  if (!store) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: requestCert needs a ca");
   return req.rejectUnauthorized === false ? TLS_SERVER_REQUEST_CERT : TLS_SERVER_REQUIRE_CERT;
 }
 function timeoutOf(req) {
@@ -22162,10 +22163,11 @@ async function serverOf(proc, req) {
     throw err;
   }
   const leaf = leafOf(engine, cert);
-  let store;
+  let mine;
   try {
-    store = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
-    const flags2 = flagsOf(req, store);
+    mine = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
+    const flags2 = flagsOf(req);
+    const store = mine ?? (flags2 ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
     return {
       engine,
       leaf,
@@ -22175,12 +22177,12 @@ async function serverOf(proc, req) {
       timeoutMs: timeoutOf(req),
       release() {
         leaf.release();
-        store?.release();
+        mine?.release();
       }
     };
   } catch (err) {
     leaf.release();
-    store?.release();
+    mine?.release();
     throw err;
   }
 }
@@ -22209,7 +22211,8 @@ async function serveSecure(proc, socket, req) {
       servername: info.servername,
       authorized: info.authorized,
       ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
-      peerCertificates: info.peerCertificates.map(encode)
+      peerCertificates: info.peerCertificates.map(encode),
+      cipher: info.cipher
     };
   } finally {
     if (!shared) server.release();