@ai-ecoverse/slicc-kernel 1.154.3 → 1.156.0

package/dist/node.js

@@ -1895,8 +1895,8 @@ function link(a, b) {
     pipe.openRead();
     pipe.openWrite();
   }
-  a.attach({ rx: ba, tx: ab });
-  b.attach({ rx: ab, tx: ba });
+  a.attach({ rx: ba, tx: ab, peer: b });
+  b.attach({ rx: ab, tx: ba, peer: a });
 }
 var SERVE_CHUNK = 64 * 1024;
 var NEVER_ABORTED = new AbortController().signal;
@@ -1908,6 +1908,8 @@ var KernelSocket = class _KernelSocket {
   dialing;
   failed;
   reset;
+  abortive = false;
+  refused;
   local;
   peer;
   peerCred;
@@ -1944,20 +1946,25 @@ var KernelSocket = class _KernelSocket {
   }
   async read(max, signal) {
     const { rx } = this.connection();
+    if (this.refused) throw this.refused;
     if (this.readShut || max <= 0) return new Uint8Array(0);
     const bytes = await pipeCall(() => rx.read(max, signal));
+    if (this.refused) throw this.refused;
     if (bytes.length === 0 && this.reset) throw this.reset;
     return bytes;
   }
   async peek(max, signal) {
     const { rx } = this.connection();
+    if (this.refused) throw this.refused;
     if (this.readShut || max <= 0) return new Uint8Array(0);
     const bytes = await pipeCall(() => rx.peek(max, signal));
+    if (this.refused) throw this.refused;
     if (bytes.length === 0 && this.reset) throw this.reset;
     return bytes;
   }
   async write(bytes, signal) {
     const { tx } = this.connection();
+    if (this.refused) throw this.refused;
     if (this.writeShut) throw new KernelError("EPIPE");
     if (this.reset?.code === "EPROTO") throw this.reset;
     return pipeCall(() => tx.write(bytes, signal));
@@ -2144,10 +2151,11 @@ var KernelSocket = class _KernelSocket {
       handshaking = false;
       signal.removeEventListener("abort", abandon);
     }
-    this.link = uplinkLink(made2.conn, (err) => {
+    const plain3 = uplinkLink(made2.conn, (err) => {
       this.reset = err instanceof KernelError && err.code === "EPROTO" ? err : new KernelError("ECONNRESET");
       this.changes.wake();
     });
+    this.link = { ...plain3, ...raw2.peer ? { peer: raw2.peer } : {} };
     this.changes.wake();
     return made2.info;
   }
@@ -2265,8 +2273,22 @@ var KernelSocket = class _KernelSocket {
   setOption(level, name2, value2) {
     this.options.set(`${level}:${name2}`, value2);
   }
+  resetOnClose() {
+    this.connection();
+    this.abortive = true;
+  }
+  abort() {
+    const link2 = this.link;
+    if (link2.peer) link2.peer.resetBy();
+    else link2.tx.closeRead();
+  }
+  resetBy() {
+    this.refused ??= new KernelError("ECONNRESET");
+    this.changes.wake();
+  }
   close() {
     const was = this.state;
+    if (this.abortive && was === "connected") this.abort();
     this.state = "closed";
     this.dialing?.abort(new KernelError("ECONNABORTED"));
     this.dialing = void 0;
@@ -3566,7 +3588,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.154.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.156.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -15361,6 +15383,7 @@ function openSession(o) {
 var Ciphertext = class {
   queue = [];
   ended = false;
+  opening = new Uint8Array(0);
   conn;
   session;
   constructor(conn, session) {
@@ -15369,11 +15392,19 @@ var Ciphertext = class {
   }
   hand(bytes) {
     if (bytes.length > 0) this.queue.push(bytes);
+    this.note(bytes);
+  }
+  note(bytes) {
+    if (this.opening.length >= OPENING) return;
+    const next3 = new Uint8Array(Math.min(OPENING, this.opening.length + bytes.length));
+    next3.set(this.opening);
+    next3.set(bytes.subarray(0, next3.length - this.opening.length), this.opening.length);
+    this.opening = next3;
   }
   async more() {
     if (this.queue.length === 0 && !this.ended) {
       const bytes = await this.conn.read();
-      if (bytes) this.queue.push(bytes);
+      if (bytes) this.hand(bytes);
       else this.ended = true;
     }
     if (this.queue.length === 0) {
@@ -15403,11 +15434,38 @@ async function send(conn, session) {
     }
   }
 }
-function refused2(engine, session, err) {
+var OPENING = 6;
+var PLAIN_MAX = 16384;
+var ENCRYPTED_MAX = PLAIN_MAX + 320;
+var HTTP_METHODS = ["GET ", "POST ", "HEAD ", "PUT ", "PATCH", "OPTIO", "DELET", "TRACE"];
+function headerClass(head) {
+  const [type, major, minor, hi, lo] = head;
+  if (major === 0 && minor === 2) return ["ERR_SSL_WRONG_VERSION_NUMBER", "wrong version number"];
+  const length2 = hi << 8 | lo;
+  if (length2 > ENCRYPTED_MAX) return ["ERR_SSL_PACKET_LENGTH_TOO_LONG", "packet length too long"];
+  if (major !== 3) {
+    const text = new TextDecoder("latin1").decode(head.subarray(0, 5));
+    if (HTTP_METHODS.some((m) => text.startsWith(m)))
+      return ["ERR_SSL_HTTP_REQUEST", "http request"];
+    return ["ERR_SSL_WRONG_VERSION_NUMBER", "wrong version number"];
+  }
+  if (length2 > PLAIN_MAX) return ["ERR_SSL_DATA_LENGTH_TOO_LONG", "data length too long"];
+  if (type === 22 && head.length > 5 && head[5] !== 2)
+    return ["ERR_SSL_UNEXPECTED_MESSAGE", "unexpected message"];
+  return void 0;
+}
+function recordRefusal(opening2) {
+  if (opening2.length < 5) return void 0;
+  const found = headerClass(opening2);
+  return found && new KernelError("EPROTO", `${found[0]}: ${found[1]}`);
+}
+function refused2(engine, session, err, opening2) {
   const flags2 = session.verifyResult;
   const code = verifyCode(flags2);
   if (code && flags2 !== -1)
     return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
+  const record2 = recordRefusal(opening2);
+  if (record2) return record2;
   const text = err instanceof TlsError ? err.message : String(err);
   return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
 }
@@ -15422,15 +15480,12 @@ async function handshake(conn, o, session, inbox) {
       done4 = session.handshake();
     } catch (err) {
       await send(conn, session).catch(() => void 0);
-      throw refused2(o.engine, session, err);
+      throw refused2(o.engine, session, err, inbox.opening);
     }
     await send(conn, session);
     if (done4) return;
     if (!await inbox.more()) {
-      throw new KernelError(
-        "ECONNRESET",
-        "the server closed the connection during the TLS handshake"
-      );
+      throw recordRefusal(inbox.opening) ?? new KernelError("ECONNRESET", "the server closed the connection during the TLS handshake");
     }
   }
 }
@@ -19188,6 +19243,7 @@ var SOCKET_OPS = [
   "sock-accept",
   "sock-connect",
   "sock-shutdown",
+  "sock-reset",
   "sock-name",
   "sock-getopt",
   "sock-setopt",
@@ -19255,6 +19311,9 @@ async function socketSyscall(req, proc) {
     case "sock-shutdown":
       anySocketAt(fds, req.fd).shutdown(req.how);
       return ok3();
+    case "sock-reset":
+      socketAt(fds, req.fd).resetOnClose();
+      return ok3();
     case "sock-name": {
       const socket = anySocketAt(fds, req.fd);
       const addr = req.peer ? socket.peer : socket.local;