@ai-ecoverse/slicc-kernel 1.153.0 → 1.154.1

package/dist/kernel-worker.js

@@ -8049,7 +8049,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.153.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.154.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -11955,9 +11955,9 @@ var EmbedderChannel = class {
     const hook = this.broker.hookFor(this.caller.client);
     const body = new BodyPipe();
     this.body = body;
-    const caller = this.caller;
+    const prefix = this.caller.name;
     const progress = (line) => {
-      if (this.throttle.allow(Date.now())) caller.progress(lineOf2(line));
+      if (this.throttle.allow(Date.now())) this.caller.progress(`${prefix}: ${lineOf2(line)}`);
     };
     const asked = Promise.resolve().then(
       () => hook.handle({
@@ -17364,6 +17364,7 @@ var TLS_SERVER_REQUEST_CERT = 1;
 var TLS_SERVER_REQUIRE_CERT = 2;
 var TLS_SERVER_SELECT = 4;
 var TLS_HANDSHAKE_SELECT = 2;
+var TLS_KEYLOG = 8;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -17431,6 +17432,9 @@ var TlsEngine = class {
     if (!ptr) throw this.error(this.m._tls_last_error(), "server certificate");
     return new TlsLeaf(this, this.m, ptr);
   }
+  get keylogs() {
+    return typeof this.m._tls_keylog === "function";
+  }
   get serverSelect() {
     return typeof this.m._tls_server_select === "function";
   }
@@ -17461,9 +17465,11 @@ var TlsEngine = class {
       this.m._free(ptr);
     }
   }
-  intoScratch(fn) {
+  intoScratch(fn, secret = false) {
     const n = fn(this.scratch, SCRATCH);
-    return n > 0 ? this.taken(n) : n;
+    const out = n > 0 ? this.taken(n) : n;
+    if (secret && n > 0) this.m.HEAPU8.fill(0, this.scratch, this.scratch + n);
+    return out;
   }
   get sessionControls() {
     return typeof this.m._tls_client_cert === "function";
@@ -17674,6 +17680,14 @@ var TlsSession = class {
   get version() {
     return this.c._tls_version(this.ptr);
   }
+  keylog() {
+    const drain2 = this.m._tls_keylog;
+    const out = this.engine.intoScratch((p, max) => drain2(this.ptr, p, max), true);
+    if (!(out instanceof Uint8Array)) return [];
+    const text = new TextDecoder().decode(out);
+    out.fill(0);
+    return text.split("\n").filter((line) => line.length > 0);
+  }
   get sni() {
     const out = this.engine.intoScratch(
       (p, max) => this.m._tls_sni(this.ptr, p, max)
@@ -19310,7 +19324,7 @@ function isIP(name2) {
   return ipv4Bytes(name2) !== void 0 || name2.includes(":") && ipv6Groups(name2) !== void 0;
 }
 function clientFlags(o) {
-  return (o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0) | (o.sni === false ? TLS_CLIENT_NO_SNI : 0) | (o.checkHostname === false ? TLS_CLIENT_VERIFY_CHAIN_ONLY : 0);
+  return (o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0) | (o.sni === false ? TLS_CLIENT_NO_SNI : 0) | (o.checkHostname === false ? TLS_CLIENT_VERIFY_CHAIN_ONLY : 0) | (o.keylog ? TLS_KEYLOG : 0);
 }
 function openSession(o) {
   return o.engine.clientSession(o.store, o.servername, o.alpn, clientFlags(o));
@@ -19425,7 +19439,8 @@ async function infoOf(o, session) {
     peerCertificates: chain2,
     ...controlsOf(o, session, protocol, chain2, shape),
     verified: verdictOf(o, session),
-    handshakeAt: Date.now()
+    handshakeAt: Date.now(),
+    ...o.keylog ? { keylog: session.keylog() } : {}
   };
 }
 var FATAL_ALERT = -30592;
@@ -19545,7 +19560,7 @@ async function serverHandshake(conn, session, inbox, hooks) {
     }
   }
 }
-async function tlsServer(conn, session, clientCerts, select) {
+async function tlsServer(conn, session, clientCerts, select, keylog = false) {
   let first;
   const watched = {
     ...conn,
@@ -19568,7 +19583,8 @@ async function tlsServer(conn, session, clientCerts, select) {
       servername: session.sni,
       authorized: clientCerts && chain2.length > 0 && code === void 0,
       ...clientCerts && chain2.length > 0 && code ? { authorizationError: code } : {},
-      peerCertificates: chain2
+      peerCertificates: chain2,
+      ...keylog ? { keylog: session.keylog() } : {}
     };
     return { conn: plaintext(conn, session, inbox), info };
   } catch (err) {
@@ -22461,7 +22477,8 @@ function sessionOf(info, servername) {
     } : {},
     servername,
     peerCertificates: info.peerCertificates.map(encode),
-    ...controls(info)
+    ...controls(info),
+    ...info.keylog ? { keylog: info.keylog } : {}
   };
 }
 function controls(info) {
@@ -22603,11 +22620,14 @@ async function prepareWith(support, req, servername, cert) {
     insecure: req.insecure === true,
     ...req.sni === false ? { sni: false } : {},
     ...req.checkHostname === false ? { checkHostname: false } : {},
+    ...req.keylog === true ? { keylog: true } : {},
     clientCertificate: cert !== void 0,
     bundled: own === void 0
   };
   let session;
   try {
+    if (req.keylog === true && !engine.keylogs)
+      throw new KernelError("ENOTSUP", "the installed tls engine has no key log");
     const controls2 = req.sni === false || req.checkHostname === false || cert !== void 0;
     if (controls2 && !engine.sessionControls) {
       throw new KernelError("ENOTSUP", "the installed tls engine has no client certificates");
@@ -22655,7 +22675,7 @@ function secure(prepared, seal) {
     try {
       const made2 = await tlsClient(raw2, prepared.options);
       const engine = prepared.options.engine;
-      const session = sealing({ ...seal, engine }, raw2, made2.info, prepared.options.servername);
+      const session = prepared.options.keylog ? void 0 : sealing({ ...seal, engine }, raw2, made2.info, prepared.options.servername);
       if (!session) return made2;
       made2.info.substitutes = substitutes(session);
       if (made2.info.substitutes && session.verified)
@@ -22768,25 +22788,31 @@ function certFlags(req) {
   if (!req.requestCert) return 0;
   return req.rejectUnauthorized === false ? TLS_SERVER_REQUEST_CERT : TLS_SERVER_REQUIRE_CERT;
 }
-function flagsOf(req) {
-  if (!req.select) return certFlags(req);
+var CERT_FLAGS = TLS_SERVER_REQUEST_CERT | TLS_SERVER_REQUIRE_CERT;
+function selectFlag(req) {
+  if (!req.select) return 0;
   if (req.alpn && req.alpn.length > 0)
     throw new KernelError("EINVAL", "ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS: alpn with select");
-  return certFlags(req) | TLS_SERVER_SELECT;
+  return TLS_SERVER_SELECT;
 }
-async function engineOf(proc, select) {
+function flagsOf(req) {
+  return certFlags(req) | selectFlag(req) | (req.keylog ? TLS_KEYLOG : 0);
+}
+async function engineOf(proc, { select, keylog }) {
   const engine = await supportOf(proc.net).engine();
   if (!engine.serverSessions)
     throw new KernelError("ENOTSUP", "the installed tls engine has no server sessions");
+  if (keylog && !engine.keylogs)
+    throw new KernelError("ENOTSUP", "the installed tls engine has no key log");
   if (select && !engine.serverSelect)
     throw new KernelError("ENOTSUP", "the installed tls engine has no server selection");
   return engine;
 }
-async function importedLeaf(proc, own, select) {
+async function importedLeaf(proc, own, needs = {}) {
   const cert = certBytes(own);
   let engine;
   try {
-    engine = await engineOf(proc, select);
+    engine = await engineOf(proc, needs);
   } catch (err) {
     wipe(cert);
     throw err;
@@ -22816,12 +22842,12 @@ async function serverOf(proc, req) {
   delete req.cert;
   if (!own && !req.select)
     throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
-  const { engine, leaf } = own ? await importedLeaf(proc, own, req.select) : { engine: await engineOf(proc, true), leaf: void 0 };
+  const { engine, leaf } = own ? await importedLeaf(proc, own, req) : { engine: await engineOf(proc, { ...req, select: true }), leaf: void 0 };
   let mine;
   try {
     mine = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
     const flags2 = flagsOf(req);
-    const store = mine ?? (flags2 & ~TLS_SERVER_SELECT ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
+    const store = mine ?? (flags2 & CERT_FLAGS ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
     return {
       engine,
       leaf,
@@ -22855,7 +22881,8 @@ function servedOf(info) {
     authorized: info.authorized,
     ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
     peerCertificates: info.peerCertificates.map(encode),
-    cipher: info.cipher
+    cipher: info.cipher,
+    ...info.keylog ? { keylog: info.keylog } : {}
   };
 }
 var selections = /* @__PURE__ */ new WeakMap();
@@ -22878,13 +22905,14 @@ async function serveSecure(proc, socket, req) {
   const { engine, leaf, alpn, store, flags: flags2 } = server;
   const limit = handshakeSignal(proc, server.timeoutMs);
   const { pausedAt, select } = pausing(limit.signal);
-  const certs = (flags2 & ~TLS_SERVER_SELECT) !== 0;
+  const certs = (flags2 & CERT_FLAGS) !== 0;
   const run2 = socket.secureLink(
     (raw2) => tlsServer(
       raw2,
       engine.serverSession(leaf, alpn, store, flags2),
       certs,
-      flags2 & TLS_SERVER_SELECT ? select : void 0
+      flags2 & TLS_SERVER_SELECT ? select : void 0,
+      (flags2 & TLS_KEYLOG) !== 0
     ),
     limit.signal,
     (reason) => !shared && reason === timedOut
@@ -23354,7 +23382,7 @@ var NOT_HTTP_PORTS = /* @__PURE__ */ new Set([
 ]);
 var HOST_NAME = /^[A-Za-z0-9.-]+$|^\[?[0-9A-Fa-f:.]+\]?$/;
 function sessionControls(req) {
-  return req.sni === false || req.checkHostname === false || req.clientCert !== void 0;
+  return req.sni === false || req.checkHostname === false || req.clientCert !== void 0 || req.keylog === true;
 }
 function wantsKernel(req) {
   if (req.path === "kernel") return true;
@@ -25040,7 +25068,8 @@ var WasmProcess = class {
       sessionUid: session.uid,
       client: session.client,
       tags: this.options.embedder?.tagsOf(this.pid),
-      progress: (line) => void this.complainLine(`${name2}: ${line}`),
+      name: name2,
+      progress: (line) => void this.complainLine(line),
       closing: () => AbortSignal.any([this.interrupt.signal, this.gone.signal])
     };
   }