@ai-ecoverse/slicc-kernel 1.151.0 → 1.152.0

package/dist/kernel-worker.js

@@ -4155,14 +4155,14 @@ var WsReader = class {
   }
 };
 function switchingHead(accept2, protocol = "") {
-  const chosen2 = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
+  const chosen3 = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
 ` : "";
   return latin1Bytes(
     `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
 Connection: Upgrade\r
 Sec-WebSocket-Accept: ${accept2}\r
-${chosen2}\r
+${chosen3}\r
 `
   );
 }
@@ -6155,6 +6155,7 @@ var KernelSocket = class _KernelSocket {
     return this.dial(addr, route2, secure2);
   }
   serving;
+  pending;
   served = false;
   get loopbackLinked() {
     return this.state === "connected" && !this.switch;
@@ -6339,6 +6340,8 @@ var KernelSocket = class _KernelSocket {
     this.boundAt = void 0;
     this.serving?.release();
     this.serving = void 0;
+    this.pending?.();
+    this.pending = void 0;
     this.changes.wake();
   }
   static pair(net, domain, cred) {
@@ -7915,7 +7918,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.151.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.152.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -16779,6 +16782,8 @@ var TLS_CLIENT_NO_SNI = 2;
 var TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
 var TLS_SERVER_REQUEST_CERT = 1;
 var TLS_SERVER_REQUIRE_CERT = 2;
+var TLS_SERVER_SELECT = 4;
+var TLS_HANDSHAKE_SELECT = 2;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -16846,12 +16851,15 @@ var TlsEngine = class {
     if (!ptr) throw this.error(this.m._tls_last_error(), "server certificate");
     return new TlsLeaf(this, this.m, ptr);
   }
+  get serverSelect() {
+    return typeof this.m._tls_server_select === "function";
+  }
   serverSession(leaf, alpn, clientCa, flags2) {
     const open2 = this.m._tls_server_new;
     const wire = alpnWire(alpn);
     const ptr = this.withBytes(
       wire,
-      (p) => open2(leaf.ptr, wire.length > 0 ? p : 0, wire.length, clientCa?.ptr ?? 0, flags2)
+      (p) => open2(leaf?.ptr ?? 0, wire.length > 0 ? p : 0, wire.length, clientCa?.ptr ?? 0, flags2)
     );
     if (!ptr) throw this.error(this.m._tls_last_error(), "tls server");
     return new TlsSession(this, this.m, ptr);
@@ -17050,9 +17058,35 @@ var TlsSession = class {
     return this.m;
   }
   handshake() {
+    return this.step() === 1;
+  }
+  step() {
     const ret = this.c._tls_handshake(this.ptr);
     if (ret < 0) throw this.engine.error(ret, "tls handshake");
-    return ret === 1;
+    return ret;
+  }
+  clientAlpn() {
+    const list = this.m._tls_client_alpn;
+    const out = this.engine.intoScratch((p, max) => list(this.ptr, p, max));
+    if (!(out instanceof Uint8Array)) return [];
+    const names2 = [];
+    for (let at = 0; at < out.length; at += 1 + out[at]) {
+      names2.push(new TextDecoder().decode(out.subarray(at + 1, at + 1 + out[at])));
+    }
+    return names2;
+  }
+  select(leaf, alpn) {
+    const pick = this.m._tls_server_select;
+    const name2 = new TextEncoder().encode(alpn ?? "");
+    const ret = this.engine.withBytes(
+      name2,
+      (p) => pick(this.ptr, leaf?.ptr ?? 0, name2.length > 0 ? p : 0, name2.length)
+    );
+    if (ret !== 0) throw this.engine.error(ret, "tls select");
+  }
+  refuse(alert) {
+    const ret = this.m._tls_server_refuse(this.ptr, alert);
+    if (ret !== 0) throw this.engine.error(ret, "tls refuse");
   }
   get verifyResult() {
     return this.c._tls_verify_result(this.ptr);
@@ -18890,17 +18924,39 @@ function serverRefusal(err, session, first) {
   const text = err instanceof TlsError ? err.message : String(err);
   return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
 }
-async function serverHandshake(conn, session, inbox, first) {
+async function chosen(conn, session, select) {
+  if (!select) throw new KernelError("EPROTO", "ERR_SSL_HANDSHAKE_FAILURE: no selection");
+  const choice = await select({ servername: session.sni, protocols: session.clientAlpn() });
+  if (choice.refuse === void 0) {
+    try {
+      session.select(choice.leaf, choice.alpn);
+    } finally {
+      choice.done?.();
+    }
+    return;
+  }
+  session.refuse(choice.refuse);
+  await send(conn, session).catch(() => void 0);
+  throw new KernelError(
+    "EPROTO",
+    `ERR_SSL_HANDSHAKE_FAILURE: the program refused the handshake (alert ${choice.refuse})`
+  );
+}
+async function serverHandshake(conn, session, inbox, hooks) {
   for (; ; ) {
-    let done5;
+    let step2;
     try {
-      done5 = session.handshake();
+      step2 = session.step();
     } catch (err) {
       await send(conn, session).catch(() => void 0);
-      throw serverRefusal(err, session, first());
+      throw serverRefusal(err, session, hooks.first());
+    }
+    if (step2 === TLS_HANDSHAKE_SELECT) {
+      await chosen(conn, session, hooks.select);
+      continue;
     }
     await send(conn, session);
-    if (done5) return;
+    if (step2 === 1) return;
     if (!await inbox.more()) {
       throw new KernelError(
         "ECONNRESET",
@@ -18909,7 +18965,7 @@ async function serverHandshake(conn, session, inbox, first) {
     }
   }
 }
-async function tlsServer(conn, session, clientCerts) {
+async function tlsServer(conn, session, clientCerts, select) {
   let first;
   const watched = {
     ...conn,
@@ -18921,7 +18977,7 @@ async function tlsServer(conn, session, clientCerts) {
   };
   const inbox = new Ciphertext(watched, session);
   try {
-    await serverHandshake(conn, session, inbox, () => first);
+    await serverHandshake(conn, session, inbox, { first: () => first, select });
     const chain2 = session.peerChain();
     const code = clientCerts ? verifyCode(session.verifyResult) : void 0;
     const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
@@ -22126,10 +22182,35 @@ function storeOf(engine, ca) {
     throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
   }
 }
-function flagsOf(req) {
+function certFlags(req) {
   if (!req.requestCert) return 0;
   return req.rejectUnauthorized === false ? TLS_SERVER_REQUEST_CERT : TLS_SERVER_REQUIRE_CERT;
 }
+function flagsOf(req) {
+  if (!req.select) return certFlags(req);
+  if (req.alpn && req.alpn.length > 0)
+    throw new KernelError("EINVAL", "ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS: alpn with select");
+  return certFlags(req) | TLS_SERVER_SELECT;
+}
+async function engineOf(proc, select) {
+  const engine = await supportOf(proc.net).engine();
+  if (!engine.serverSessions)
+    throw new KernelError("ENOTSUP", "the installed tls engine has no server sessions");
+  if (select && !engine.serverSelect)
+    throw new KernelError("ENOTSUP", "the installed tls engine has no server selection");
+  return engine;
+}
+async function importedLeaf(proc, own, select) {
+  const cert = certBytes(own);
+  let engine;
+  try {
+    engine = await engineOf(proc, select);
+  } catch (err) {
+    wipe(cert);
+    throw err;
+  }
+  return { engine, leaf: leafOf(engine, cert) };
+}
 function timeoutOf(req) {
   const ms = req.handshakeTimeout ?? HANDSHAKE_TIMEOUT_MS;
   if (!Number.isInteger(ms) || ms <= 0)
@@ -22151,23 +22232,14 @@ function handshakeSignal(proc, ms) {
 async function serverOf(proc, req) {
   const own = req.cert;
   delete req.cert;
-  if (!own) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
-  const cert = certBytes(own);
-  let engine;
-  try {
-    engine = await supportOf(proc.net).engine();
-    if (!engine.serverSessions)
-      throw new KernelError("ENOTSUP", "the installed tls engine has no server sessions");
-  } catch (err) {
-    wipe(cert);
-    throw err;
-  }
-  const leaf = leafOf(engine, cert);
+  if (!own && !req.select)
+    throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
+  const { engine, leaf } = own ? await importedLeaf(proc, own, req.select) : { engine: await engineOf(proc, true), leaf: void 0 };
   let mine;
   try {
     mine = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
     const flags2 = flagsOf(req);
-    const store = mine ?? (flags2 ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
+    const store = mine ?? (flags2 & ~TLS_SERVER_SELECT ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
     return {
       engine,
       leaf,
@@ -22176,12 +22248,12 @@ async function serverOf(proc, req) {
       flags: flags2,
       timeoutMs: timeoutOf(req),
       release() {
-        leaf.release();
+        leaf?.release();
         mine?.release();
       }
     };
   } catch (err) {
-    leaf.release();
+    leaf?.release();
     mine?.release();
     throw err;
   }
@@ -22192,30 +22264,133 @@ async function listenSecure(proc, socket, req) {
   socket.serving?.release();
   socket.serving = server;
 }
+function servedOf(info) {
+  return {
+    path: "kernel",
+    protocol: info.protocol,
+    alpnProtocol: info.alpnProtocol,
+    servername: info.servername,
+    authorized: info.authorized,
+    ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
+    peerCertificates: info.peerCertificates.map(encode),
+    cipher: info.cipher
+  };
+}
+var selections = /* @__PURE__ */ new WeakMap();
+function pausing(signal) {
+  let paused;
+  const pausedAt = new Promise((resolve2) => {
+    paused = resolve2;
+  });
+  const select = (offer) => new Promise((choose, fail2) => {
+    if (signal.aborted) fail2(signal.reason);
+    signal.addEventListener("abort", () => fail2(signal.reason), { once: true });
+    paused({ offer, choose, fail: fail2 });
+  });
+  return { pausedAt, select };
+}
 async function serveSecure(proc, socket, req) {
   const shared = req.listener?.serving;
   if (req.listener && !shared) throw new KernelError("EINVAL", "the listener has no tls");
   const server = shared ?? await serverOf(proc, req);
+  const { engine, leaf, alpn, store, flags: flags2 } = server;
+  const limit = handshakeSignal(proc, server.timeoutMs);
+  const { pausedAt, select } = pausing(limit.signal);
+  const certs = (flags2 & ~TLS_SERVER_SELECT) !== 0;
+  const run2 = socket.secureLink(
+    (raw2) => tlsServer(
+      raw2,
+      engine.serverSession(leaf, alpn, store, flags2),
+      certs,
+      flags2 & TLS_SERVER_SELECT ? select : void 0
+    ),
+    limit.signal,
+    (reason) => !shared && reason === timedOut
+  ).finally(() => {
+    limit.done();
+    selections.delete(socket);
+    socket.pending = void 0;
+    if (!shared) server.release();
+  });
+  run2.catch(() => void 0);
+  const first = await Promise.race([run2, pausedAt.then((pause2) => ({ pause: pause2 }))]);
+  if (!("pause" in first)) return servedOf(first);
+  selections.set(socket, { pause: first.pause, run: run2 });
+  socket.pending = () => first.pause.fail(new KernelError("ECONNRESET"));
+  return { select: first.pause.offer };
+}
+var REFUSALS = /* @__PURE__ */ new Set([112, 120, 40, 49, 80]);
+var TlsContext = class {
+  leaf;
+  constructor(leaf) {
+    this.leaf = leaf;
+  }
+  close() {
+    this.leaf.release();
+  }
+};
+var TLS_CONTEXTS_MAX = 64;
+async function contextSecure(proc, cert) {
+  if (!cert) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a context needs cert and key");
+  const held = proc.fds.numbers().filter((fd) => proc.fds.get(fd).file instanceof TlsContext);
+  if (held.length >= TLS_CONTEXTS_MAX) {
+    wipe(certBytes(cert));
+    throw new KernelError("EMFILE", `at most ${TLS_CONTEXTS_MAX} tls contexts per process`);
+  }
+  const { leaf } = await importedLeaf(proc, cert);
+  const file = new OpenFile(new TlsContext(leaf));
   try {
-    const { engine, leaf, alpn, store, flags: flags2 } = server;
-    const limit = handshakeSignal(proc, server.timeoutMs);
-    const info = await socket.secureLink(
-      (raw2) => tlsServer(raw2, engine.serverSession(leaf, alpn, store, flags2), flags2 !== 0),
-      limit.signal,
-      (reason) => !shared && reason === timedOut
-    ).finally(limit.done);
-    return {
-      path: "kernel",
-      protocol: info.protocol,
-      alpnProtocol: info.alpnProtocol,
-      servername: info.servername,
-      authorized: info.authorized,
-      ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
-      peerCertificates: info.peerCertificates.map(encode),
-      cipher: info.cipher
-    };
+    const fd = proc.fds.install(file, 3);
+    proc.fds.setCloseOnExec(fd);
+    return fd;
+  } catch (err) {
+    leaf.release();
+    throw err;
+  }
+}
+function contextAt(fds, fd) {
+  const open2 = fds.get(fd);
+  const file = open2.file;
+  if (!(file instanceof TlsContext)) throw new KernelError("EBADF", "not a tls context");
+  const held = open2.retain();
+  let released2 = false;
+  return {
+    leaf: file.leaf,
+    done: () => {
+      if (released2) return;
+      released2 = true;
+      void held.release();
+    }
+  };
+}
+function choiceOf(fds, pause2, req) {
+  if (req.refuse !== void 0) {
+    if (!REFUSALS.has(req.refuse)) throw new KernelError("EINVAL", "not a refusal alert");
+    return { refuse: req.refuse };
+  }
+  if (req.alpn !== void 0 && !pause2.offer.protocols.includes(req.alpn))
+    throw new KernelError("EINVAL", "ERR_TLS_ALPN_CALLBACK_INVALID_RESULT: not offered");
+  return {
+    ...req.context === void 0 ? {} : contextAt(fds, req.context),
+    ...req.alpn === void 0 ? {} : { alpn: req.alpn }
+  };
+}
+async function selectSecure(fds, socket, req) {
+  const selecting = selections.get(socket);
+  if (!selecting) throw new KernelError("EINVAL", "no handshake waits for a selection");
+  selections.delete(socket);
+  let choice;
+  try {
+    choice = choiceOf(fds, selecting.pause, req);
+  } catch (err) {
+    selecting.pause.choose({ refuse: 40 });
+    throw err;
+  }
+  selecting.pause.choose(choice);
+  try {
+    return servedOf(await selecting.run);
   } finally {
-    if (!shared) server.release();
+    choice.done?.();
   }
 }
 
@@ -22383,7 +22558,9 @@ var SOCKET_OPS = [
   "sock-tls",
   "sock-tls-upgrade",
   "sock-tls-serve",
-  "sock-tls-listen"
+  "sock-tls-listen",
+  "sock-tls-context",
+  "sock-tls-select"
 ];
 function socketAt(fds, fd) {
   const file = anySocketAt(fds, fd);
@@ -22464,6 +22641,12 @@ async function socketSyscall(req, proc) {
       const listener = from === void 0 ? {} : { listener: socketAt(fds, from) };
       return ok3(await serveSecure(proc, socketAt(fds, req.fd), { ...rest2, ...listener }));
     }
+    case "sock-tls-context":
+      return ok3(await contextSecure(proc, req.cert));
+    case "sock-tls-select": {
+      const { fd, ...choice } = req;
+      return ok3(await selectSecure(fds, socketAt(fds, fd), choice));
+    }
     case "sock-tls-listen":
       await listenSecure(proc, socketAt(fds, req.fd), req);
       return ok3({});
@@ -29428,7 +29611,7 @@ function targetOf(command) {
     ...command.variants ? { variants: command.variants } : {}
   };
 }
-function chosen(planned, env) {
+function chosen2(planned, env) {
   const { target } = planned;
   const wasm = variantFor(target.variants, env);
   if (wasm === void 0) return planned;
@@ -30587,7 +30770,7 @@ var Launcher = class {
     delete env[TICKET_ENV];
     const own = env.HOSTNAME;
     if (asked.target.abi === "wasi") env.HOSTNAME = this.hostname;
-    const planned = chosen(asked, env);
+    const planned = chosen2(asked, env);
     const { target, args } = planned;
     let program;
     let exeId;