@ai-ecoverse/slicc-kernel 1.26.6 → 1.27.0

package/dist/node.js

@@ -1084,7 +1084,7 @@ function serveTransport(peer, transport) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 5];
+var PROTOCOL = [1, 6];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -4491,6 +4491,7 @@ async function hostSyscall(req, ctx) {
 
 // src/kernel/net/loopback-names.ts
 var HOST_LOOPBACK = "host.slicc.internal";
+var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
 var PAGE_LOOPBACK = "kernel.localhost";
 var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
 function toHostLoopback(href) {
@@ -5687,6 +5688,214 @@ var HttpHandles = class {
   }
 };
 
+// src/kernel/net/routes.ts
+var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
+function ipv4Bytes(text) {
+  const parts = text.split(".");
+  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const bytes = parts.map(Number);
+  return bytes.every((b) => b <= 255) ? bytes : void 0;
+}
+function ipv6Groups(text) {
+  if (!text.includes(":")) return void 0;
+  let canonical;
+  try {
+    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
+  } catch {
+    return void 0;
+  }
+  const [head, tail] = canonical.split("::");
+  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
+  const front = part(head);
+  const back = part(tail);
+  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+}
+function toBits(values, width) {
+  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
+}
+function addressBits(host) {
+  const v4 = ipv4Bytes(host);
+  if (v4) return { v6: false, bits: toBits(v4, 8) };
+  const v6 = ipv6Groups(host);
+  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
+}
+function parsePrefix(text) {
+  const parts = text.trim().split("/");
+  if (parts.length > 2) return void 0;
+  const [address = "", size] = parts;
+  const parsed = addressBits(address);
+  if (!parsed) return void 0;
+  const max = parsed.v6 ? 128 : 32;
+  const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
+  if (length2 < 0 || length2 > max) return void 0;
+  return { ...parsed, length: length2 };
+}
+function within3(prefix, addr) {
+  if (prefix.v6 !== addr.v6) return false;
+  const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
+  return addr.bits >> shift === prefix.bits >> shift;
+}
+var RESERVED = [
+  "0.0.0.0/8",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "::ffff:0:0/96",
+  "fe80::/10",
+  "ff00::/8"
+].map((p) => parsePrefix(p));
+var Routes = class {
+  table = [];
+  exit = false;
+  ipv6;
+  constructor(ipv62 = false) {
+    this.ipv6 = ipv62;
+  }
+  set(table) {
+    const parsed = (table.prefixes ?? []).map(parsePrefix);
+    const bad = (table.prefixes ?? []).find((_, i) => !parsed[i]);
+    if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
+    this.table = parsed;
+    this.exit = table.exit === true;
+  }
+  classify(host) {
+    const name2 = host.toLowerCase().replace(/\.$/, "");
+    if (name2 === "localhost" || name2.endsWith(".localhost") || name2 === "0.0.0.0") {
+      return "loopback";
+    }
+    if (name2 === HOST_LOOPBACK || name2 === HOST_ADDRESS) return "host";
+    const addr = addressBits(name2);
+    if (!addr) return "unreachable";
+    if (addr.v6 && addr.bits === 1n) return "loopback";
+    if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
+    if (RESERVED.some((p) => within3(p, addr))) return "reserved";
+    if (addr.v6 && !this.ipv6) return "unreachable";
+    if (this.exit || this.table.some((p) => within3(p, addr))) return "uplink";
+    return "unreachable";
+  }
+};
+
+// src/kernel/net/uplink.ts
+function answerOf(result) {
+  const answer = Array.isArray(result) ? { addresses: result } : result;
+  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
+  return {
+    addresses,
+    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
+  };
+}
+
+// src/kernel/net/resolver.ts
+var RESOLVE_TTL_MAX = 60;
+var RESOLVE_TIMEOUT_MS = 1e4;
+var RESOLVE_CACHE_MAX = 256;
+var LOOPBACK_NAMES2 = /* @__PURE__ */ new Set(["localhost", "localhost.localdomain", "ip6-localhost", "::1"]);
+function hostsEntry(name2) {
+  if (LOOPBACK_NAMES2.has(name2) || name2.endsWith(".localhost")) return "127.0.0.1";
+  if (name2 === HOST_LOOPBACK) return HOST_LOOPBACK_ADDRESS.join(".");
+  return ipv4Bytes(name2) ? name2 : void 0;
+}
+var Resolver = class {
+  uplink;
+  routes;
+  now;
+  timeoutMs;
+  log;
+  cache = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.uplink = options.uplink;
+    this.routes = options.routes;
+    this.now = options.now ?? Date.now;
+    this.timeoutMs = options.timeoutMs ?? RESOLVE_TIMEOUT_MS;
+    this.log = options.log ?? ((message2) => console.warn(message2));
+  }
+  async resolve(name2, family, blocking) {
+    const key = name2.toLowerCase().replace(/\.$/, "");
+    const local = hostsEntry(key);
+    if (ipv6Groups(key)) {
+      const v4 = family !== 6 && local ? [local] : [];
+      return family === 4 ? v4 : [...v4, key];
+    }
+    if (local) {
+      const six = LOOPBACK_NAMES2.has(key) || key.endsWith(".localhost") ? ["::1"] : [];
+      return family === 6 ? six : family === 4 ? [local] : [local, ...six];
+    }
+    if (!this.uplink || key === "") return [];
+    const asked = this.uplink.traits.ipv6 ? family : 4;
+    if (family === 6 && asked !== 6) return [];
+    const id = `${asked}:${key}`;
+    const hit = this.cache.get(id);
+    if (hit && hit.expires > this.now()) return hit.addresses;
+    const signal = blocking?.();
+    if (signal?.aborted) throw new KernelError("EINTR");
+    let lookup = this.pending.get(id);
+    if (!lookup) {
+      const abort = new AbortController();
+      lookup = { work: this.lookup(key, asked, id, abort.signal), abort, waiters: 0 };
+      this.pending.set(id, lookup);
+      void lookup.work.then(() => this.pending.delete(id));
+    }
+    return waitFor(lookup, signal);
+  }
+  async lookup(name2, family, id, abandoned) {
+    const uplink = this.uplink;
+    const timeout = AbortSignal.any([AbortSignal.timeout(this.timeoutMs), abandoned]);
+    let answer;
+    try {
+      answer = answerOf(
+        await Promise.race([
+          uplink.resolve(name2, family, timeout),
+          new Promise(
+            (_, reject) => timeout.addEventListener("abort", () => reject(timeout.reason), { once: true })
+          )
+        ])
+      );
+    } catch {
+      return [];
+    }
+    const addresses = answer.addresses.filter((a) => this.usable(name2, a, family));
+    if (addresses.length > 0) this.remember(id, addresses, answer.ttl);
+    return addresses;
+  }
+  usable(name2, address, family) {
+    const v4 = ipv4Bytes(address) !== void 0;
+    if (!v4 && (family === 4 || !ipv6Groups(address))) return false;
+    if (v4 && family === 6) return false;
+    const kind = this.routes.classify(address);
+    if (kind !== "loopback" && kind !== "host" && kind !== "reserved") return true;
+    this.log(`slicc-kernel: dropped the uplink's answer ${address} for ${name2}: it is ${kind}`);
+    return false;
+  }
+  remember(id, addresses, ttl) {
+    const seconds = Math.min(ttl ?? RESOLVE_TTL_MAX, RESOLVE_TTL_MAX);
+    if (seconds <= 0) return;
+    this.cache.delete(id);
+    this.cache.set(id, { addresses, expires: this.now() + seconds * 1e3 });
+    if (this.cache.size > RESOLVE_CACHE_MAX) {
+      this.cache.delete(this.cache.keys().next().value);
+    }
+  }
+};
+function waitFor(lookup, signal) {
+  lookup.waiters++;
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      if (--lookup.waiters === 0) lookup.abort.abort(new KernelError("EINTR"));
+      reject(new KernelError("EINTR"));
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    void lookup.work.then((value) => {
+      if (signal?.aborted) return;
+      lookup.waiters--;
+      signal?.removeEventListener("abort", abort);
+      resolve(value);
+    });
+  });
+}
+
 // src/kernel/tty.ts
 var ICRNL = 256;
 var IUTF8 = 16384;
@@ -6190,7 +6399,8 @@ var SOCKET_OPS = [
   "sock-shutdown",
   "sock-name",
   "sock-getopt",
-  "sock-setopt"
+  "sock-setopt",
+  "sock-resolve"
 ];
 function socketAt(fds, fd) {
   const file = fds.get(fd).file;
@@ -6239,6 +6449,11 @@ async function socketSyscall(req, proc) {
     case "sock-setopt":
       socketAt(fds, req.fd).setOption(req.level, req.name, req.value);
       return ok();
+    case "sock-resolve": {
+      const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
+      if (addresses.length === 0) throw new KernelError("ENOENT");
+      return ok(addresses);
+    }
   }
 }
 function unnamed(domain) {
@@ -6490,7 +6705,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within3(path, root) {
+function within4(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -6698,7 +6913,7 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within3(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within4(path, prefix)) return true;
     return false;
   }
   closed(node) {
@@ -6706,24 +6921,24 @@ var VfsNodes = class {
     if (node.opens === 0 && this.byPath.get(node.path) === node) this.byPath.delete(node.path);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within3(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within4(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within3(held, path)) continue;
+      if (!within4(held, path)) continue;
       await node.serial(async () => void await Promise.all([node.keep(), node.limit()]));
     }
   }
   revoke(prefix) {
     for (const [path, node] of this.byPath) {
-      if (!within3(path, prefix)) continue;
+      if (!within4(path, prefix)) continue;
       node.revoke();
       this.byPath.delete(path);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within3(held, path)) continue;
+      if (!within4(held, path)) continue;
       node.orphaned = true;
       this.byPath.delete(held);
     }
@@ -6732,8 +6947,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of this.byPath) {
-      if (within3(p, from)) moved2.push(node);
-      else if (within3(p, to)) {
+      if (within4(p, from)) moved2.push(node);
+      else if (within4(p, to)) {
         node.orphaned = true;
         this.byPath.delete(p);
       }
@@ -6987,6 +7202,7 @@ function isWasmSyscall(req) {
   return typeof op === "string" && SYSCALL_OPS.has(op);
 }
 var MAX_READ = 1024 * 1024;
+var HOSTS_ONLY = new Resolver({ routes: new Routes() });
 var WasmProcess = class {
   exited = false;
   children;
@@ -7378,10 +7594,12 @@ var WasmProcess = class {
   }
   socketSyscall(req) {
     this.net ??= this.options.net ?? new LoopbackNet();
+    const resolver = this.options.resolver ?? HOSTS_ONLY;
     return socketSyscall(req, {
       fds: this.fds,
       net: this.net,
-      blocking: () => this.blockingSignal()
+      blocking: () => this.blockingSignal(),
+      resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking)
     });
   }
   tty(fd) {
@@ -7576,6 +7794,7 @@ function spawnWasmProcess(opts) {
     http: opts.http,
     locks: opts.locks,
     onReap: opts.onReap,
+    resolver: opts.resolver,
     onPending: (sig) => void Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig)),
     onTimer: (which) => void Atomics.or(header3, SAB_I_TIMERS, 1 << which),
     hasPending: () => Atomics.load(header3, SAB_I_SIGNALS) !== 0 || Atomics.load(header3, SAB_I_TIMERS) !== 0,
@@ -9124,6 +9343,9 @@ var Launcher = class {
   cdp;
   ca;
   transport;
+  uplink;
+  routes;
+  resolver;
   watchers = new FsWatchers();
   pnpmHome;
   mounts;
@@ -9163,6 +9385,10 @@ var Launcher = class {
     this.env = { ...networkEnv(), SLICC_CDP_URL: this.cdp.url, ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
     this.transport = options.transport ?? missingTransport();
+    this.uplink = options.uplink;
+    this.routes = new Routes(options.uplink?.traits.ipv6 === true);
+    if (options.uplink?.routes) this.routes.set(options.uplink.routes);
+    this.resolver = new Resolver({ uplink: options.uplink, routes: this.routes });
     enableNetwork(this.net, {
       transport: this.transport,
       engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
@@ -9177,6 +9403,9 @@ var Launcher = class {
       this.catalog = void 0;
     });
   }
+  setRoutes(table) {
+    this.routes.set(table);
+  }
   commands() {
     this.catalog ??= this.roots().then((roots) => scanCommands(this.base, roots));
     return this.catalog;
@@ -9356,6 +9585,7 @@ var Launcher = class {
       net: this.net,
       http: new HttpHandles(this.transport),
       locks: this.locks,
+      resolver: this.resolver,
       onReap: (child) => this.reaped(child),
       ...req.fork ? { fork: req.fork } : {},
       ...this.shownIds(req)
@@ -10705,6 +10935,7 @@ async function createNodeKernel(options = {}) {
     ...options.modules ? { modules: options.modules } : {},
     ...options.env ? { env: options.env } : {},
     ...transport ? { transport } : {},
+    ...options.network?.uplink ? { uplink: options.network.uplink } : {},
     ...options.processMounts !== void 0 ? { processMounts: options.processMounts } : {},
     ...options.fstabRetries ? { fstabRetries: options.fstabRetries } : {},
     ...options.hostfs ? { hostfs: options.hostfs } : {},
@@ -10772,6 +11003,7 @@ async function createNodeKernel(options = {}) {
     mount: (spec) => guard(() => launcher.mount(spec)),
     umount: (target) => guard(async () => launcher.umount(target)),
     mounts: async () => launcher.mounts.list(),
+    setRoutes: (routes) => guard(async () => launcher.setRoutes(routes)),
     async connect() {
       if (terminated) throw new Error(TERMINATED);
       const { port1, port2 } = new MessageChannel2();