@amritk/nish-x86_64-linux 0.17.0 → 0.18.0

package/std/net/tls-tcp.ts

@@ -61,7 +61,7 @@
  */
 import { Secret } from "nish:secret"
 import { netClose, netRead, netWrite, tcpAccept } from "nish:net"
-import { TlsServer, TlsServerConfig, tlsSignEcdsaP256 } from "nish/net/tls"
+import { TlsP256Signer, TlsServer, TlsServerConfig } from "nish/net/tls"
 import { TLS_ALERT_INTERNAL_ERROR } from "nish/net/tls/codec"
 import { TLS_MAX_RECORD } from "nish/net/tls/record"
 import {
@@ -103,6 +103,8 @@ export class TlsTcpServer {
   scratch: u8[]
   /** The last accepted peer's address, in `nish:net`'s 18-byte form. */
   peer: u8[]
+  /** Signs every slot's CertificateVerify in `signP256`, one for the pool, keeping nothing per signature. */
+  signer: TlsP256Signer
   /**
    * Each slot's own copy of its connection's ephemeral key, so that wiping it
    * can never reach an array the program has refilled for the next one.
@@ -141,6 +143,7 @@ export class TlsTcpServer {
     }
     this.scratch = new Array<u8>(TLS_MAX_RECORD)
     this.peer = new Array<u8>(TLS_TCP_ADDRESS_SIZE)
+    this.signer = new TlsP256Signer()
   }
 
   /** How many slots the pool has. */
@@ -315,8 +318,9 @@ export class TlsTcpServer {
 
   /**
    * Signs `slot`'s CertificateVerify with the P-256 private key `key` and
-   * hands it over, as `sign` does. The key is borrowed: the caller made the
-   * `Secret`, and wipes it. A malformed key fails the connection with
+   * hands it over, as `sign` does, through the pool's `TlsP256Signer`, so a
+   * handshake's signature keeps nothing. The key is borrowed: the caller made
+   * the `Secret`, and wipes it. A malformed key fails the connection with
    * `internal_error`.
    */
   signP256(slot: i32, key: Secret<u8[]>): i32 {
@@ -324,7 +328,7 @@ export class TlsTcpServer {
     if (input === null) {
       return this.interest(slot)
     }
-    const signature: u8[] | null = tlsSignEcdsaP256(key, input)
+    const signature: u8[] | null = this.signer.sign(key, input)
     if (signature === null) {
       this.connections[slot].fail(TLS_ALERT_INTERNAL_ERROR)
       return this.flush(slot)

package/std/net/tls.ts

@@ -71,7 +71,7 @@ import { Secret, expose, secret, wipe } from "nish:secret"
 import { HkdfScratch, hkdfExtractSha256, hkdfExtractSha384 } from "nish/crypto/hkdf"
 import { SHA256_SIZE } from "nish/crypto/sha256"
 import { SHA384_SIZE } from "nish/crypto/sha512"
-import { p256SignSha256 } from "nish/crypto/p256"
+import { P256SignScratch, P256_SIGNATURE_SIZE, p256SignSha256, p256SignSha256Into } from "nish/crypto/p256"
 import { timingSafeEqual, timingSafeEqualAt } from "nish/crypto/ct"
 import { X25519_SIZE, x25519, x25519Base } from "nish/crypto/x25519"
 import {
@@ -238,29 +238,57 @@ const tlsBytesSpell = (data: u8[], at: i32, length: i32, text: string): boolean
   return true
 }
 
-/** The minimal DER INTEGER for an unsigned big-endian magnitude: leading zeros dropped, one added when the top bit is set. */
-const tlsDerInteger = (magnitude: u8[]): u8[] => {
-  const body: u8[] = []
-  let leading: boolean = true
-  for (const b of magnitude) {
-    if (leading && toI32(b) === 0) {
-      continue
-    }
-    if (leading && toI32(b) >= 0x80) {
-      body.push(toU8(0))
-    }
-    leading = false
-    body.push(b)
+/** The shortest and longest DER `ECDSA-Sig-Value` of a P-256 signature: a SEQUENCE of two INTEGERs of 1 to 33 bytes. */
+const TLS_P256_DER_MIN: i32 = 8
+const TLS_P256_DER_MAX: i32 = 72
+
+/**
+ * The body length of the minimal DER INTEGER for the unsigned big-endian
+ * magnitude `rs[at .. at + 32)`: leading zeros dropped, one added when the top
+ * bit is set, and zero one zero octet rather than an empty integer (X.690
+ * §8.3.1).
+ */
+const tlsDerIntegerLength = (rs: u8[], at: i32): i32 => {
+  let first: i32 = 0
+  while (first < 31 && at + first >= 0 && at + first < toI32(rs.length) && toI32(rs[at + first]) === 0) {
+    first++
   }
-  // Zero is one zero octet, not an empty integer (X.690 §8.3.1).
-  if (toI32(body.length) === 0) {
-    body.push(toU8(0))
+  const top: boolean = at + first >= 0 && at + first < toI32(rs.length) && toI32(rs[at + first]) >= 0x80
+  return 32 - first + (top ? 1 : 0)
+}
+
+/** That INTEGER, of body length `length`, written at `out[to ..)`; answers where it ends. */
+const tlsDerIntegerInto = (out: u8[], to: i32, rs: u8[], at: i32, length: i32): i32 => {
+  const end: i32 = to + 2 + length
+  if (to < 0 || end > toI32(out.length)) {
+    return end
   }
-  const out: u8[] = [toU8(0x02), toU8(toI32(body.length))]
-  for (const b of body) {
-    out.push(b)
+  out[to] = toU8(0x02)
+  out[to + 1] = toU8(length)
+  for (let k: i32 = 0; k < length; k++) {
+    // The body's last `length` bytes are the magnitude's, a zero first when it is 33.
+    const from: i32 = at + 32 - length + k
+    const j: i32 = to + 2 + k
+    if (j >= 0 && j < toI32(out.length)) {
+      out[j] = from >= at && from >= 0 && from < toI32(rs.length) ? rs[from] : toU8(0)
+    }
   }
-  return out
+  return end
+}
+
+/** The length of `rs`'s DER `ECDSA-Sig-Value`: the SEQUENCE's two bytes and two INTEGERs. */
+const tlsEcdsaDerLength = (rs: u8[]): i32 =>
+  6 + tlsDerIntegerLength(rs, TLS_FROM) + tlsDerIntegerLength(rs, 32)
+
+/** `rs`'s DER `ECDSA-Sig-Value` into all of `der`, which is `tlsEcdsaDerLength(rs)` bytes. At most 72, so the length is one short-form byte. */
+const tlsEcdsaDerInto = (der: u8[], rs: u8[]): void => {
+  if (toI32(der.length) < 2) {
+    return
+  }
+  der[0] = toU8(0x30)
+  der[1] = toU8(toI32(der.length) - 2)
+  const r: i32 = tlsDerIntegerLength(rs, TLS_FROM)
+  tlsDerIntegerInto(der, tlsDerIntegerInto(der, 2, rs, TLS_FROM, r), rs, 32, tlsDerIntegerLength(rs, 32))
 }
 
 /**
@@ -272,25 +300,9 @@ export const tlsEcdsaDerSignature = (rs: u8[]): u8[] | null => {
   if (toI32(rs.length) !== 64) {
     return null
   }
-  const r: u8[] = []
-  const s: u8[] = []
-  for (let k: i32 = 0; k < toI32(rs.length); k++) {
-    if (k < 32) {
-      r.push(rs[k])
-    } else {
-      s.push(rs[k])
-    }
-  }
-  const body: u8[] = tlsDerInteger(r)
-  for (const b of tlsDerInteger(s)) {
-    body.push(b)
-  }
-  // At most 2 * (2 + 33) = 70 bytes, so the length is one short-form byte.
-  const out: u8[] = [toU8(0x30), toU8(toI32(body.length))]
-  for (const b of body) {
-    out.push(b)
-  }
-  return out
+  const der: u8[] = new Array<u8>(tlsEcdsaDerLength(rs))
+  tlsEcdsaDerInto(der, rs)
+  return der
 }
 
 /**
@@ -308,6 +320,55 @@ export const tlsSignEcdsaP256 = (priv: Secret<u8[]>, content: u8[]): u8[] | null
   return tlsEcdsaDerSignature(rs)
 }
 
+/**
+ * Signs CertificateVerify inputs for `ecdsa_secp256r1_sha256` with nothing
+ * kept per signature: `tlsSignEcdsaP256`'s answer, made in a
+ * `P256SignScratch` and handed back in one of this signer's own arrays, one
+ * per DER length (8 to 72 bytes), since `TlsServer.sign` takes the
+ * signature's length from its array and stores what it computes, so a
+ * signature it is handed cannot be a temporary. A carrier keeps one signer,
+ * not one per slot: signing is synchronous, and the array it answers is read
+ * by `sign` before the next signature replaces it.
+ */
+export class TlsP256Signer {
+  /** The P-256 signer's scratch. */
+  scratch: P256SignScratch
+  /** `r || s` as `p256SignSha256Into` writes it. */
+  rs: u8[]
+  /** The DER signatures, index `length - TLS_P256_DER_MIN`. */
+  ders: u8[][]
+
+  constructor() {
+    this.scratch = new P256SignScratch()
+    this.rs = new Array<u8>(P256_SIGNATURE_SIZE)
+    this.ders = []
+    for (let length: i32 = TLS_P256_DER_MIN; length <= TLS_P256_DER_MAX; length++) {
+      this.ders.push(new Array<u8>(length))
+    }
+  }
+
+  /**
+   * `tlsSignEcdsaP256(priv, content)`, byte for byte, in the array of this
+   * signer's that has its length; `null` for a malformed key. It keeps
+   * nothing: the P-256 signature releases what it allocated, and the DER is
+   * written in place. The key is borrowed.
+   */
+  sign(priv: Secret<u8[]>, content: u8[]): u8[] | null {
+    if (
+      !p256SignSha256Into(this.scratch, priv, content, TLS_FROM, toI32(content.length), this.rs, TLS_FROM)
+    ) {
+      return null
+    }
+    const at: i32 = tlsEcdsaDerLength(this.rs) - TLS_P256_DER_MIN
+    if (at < 0 || at >= toI32(this.ders.length)) {
+      return null
+    }
+    const der: u8[] = this.ders[at]
+    tlsEcdsaDerInto(der, this.rs)
+    return der
+  }
+}
+
 /** Whether an x25519 shared secret is all zeros, reading every byte (run inside `expose`). */
 const tlsIsZeroSecret = (shared: u8[]): boolean => timingSafeEqual(shared, new Array<u8>(X25519_SIZE))
 
@@ -543,8 +604,9 @@ const tlsFlightCapacity = (config: TlsServerConfig): i32 => {
  * to the largest message when a ClientHello does not fit (once per slot);
  * the Handshake-level output, when a signature is longer than an ECDSA one;
  * the `serverName` string, made when the client's host name differs from the
- * last one this server held; and, over QUIC only, a copy of the client's
- * transport parameters (TLS-3).
+ * last one this server held; and, over QUIC only, the array the client's
+ * transport parameters are copied into, which grows only when a client's
+ * are longer than any before (TLS-3).
  */
 export class TlsServer {
   config: TlsServerConfig
@@ -558,6 +620,8 @@ export class TlsServer {
   lastServerName: string = ""
   /** The client's `quic_transport_parameters`, opaque; empty unless the carrier is QUIC. */
   clientTransportParameters: u8[]
+  /** The array `clientTransportParameters` points at once read, kept across `restart` and refilled in the room it has. */
+  clientParameters: u8[]
   transcript: TlsTranscript
   /** The bytes received at the current level and not yet a whole message: `input[0 .. inputLength)`. */
   input: u8[]
@@ -617,6 +681,7 @@ export class TlsServer {
     this.ephemeralPrivate = ephemeralPrivate
     this.none = []
     this.clientTransportParameters = this.none
+    this.clientParameters = []
     this.transcript = new TlsTranscript(0)
     this.configFits = tlsConfigFits(config)
     this.input = new Array<u8>(TLS_INPUT_START)
@@ -1013,13 +1078,17 @@ export class TlsServer {
     }
     this.takeServerName(hello)
     if (this.config.quic) {
-      const parameters: u8[] = new Array<u8>(hello.quicLength)
+      // Refilled in place, so a slot's handshakes keep nothing for it (QUIC-3).
+      const parameters: u8[] = this.clientParameters
+      while (parameters.length > 0) {
+        parameters.pop()
+      }
       for (
         let k: i32 = 0;
-        k < toI32(parameters.length) && hello.quicAt + k >= 0 && hello.quicAt + k < toI32(data.length);
+        k < hello.quicLength && hello.quicAt + k >= 0 && hello.quicAt + k < toI32(data.length);
         k++
       ) {
-        parameters[k] = data[hello.quicAt + k]
+        parameters.push(data[hello.quicAt + k])
       }
       this.clientTransportParameters = parameters
     }

package/std/text.ts

@@ -191,3 +191,80 @@ export const firstDifference = (left: string[], right: string[]): i32 => {
   }
   return leftLength === rightLength ? -1 : i
 }
+
+/** The most bytes `indexOfAny` takes in its set: what one 16-byte vector of the runtime kernel compares. */
+const INDEX_OF_ANY_MAX_SET: i32 = 16
+
+/** The first byte that is not ASCII; `indexOfAny`'s set must stay below it. */
+const NON_ASCII: i32 = 128
+
+/**
+ * The first index at or after `from` whose byte is one of `bytes`, or -1.
+ *
+ * `bytes` is a set of 1 to 16 ASCII bytes, and anything else panics: an empty
+ * set matches nothing, more than 16 is more than one vector of the runtime
+ * kernel compares, and an ASCII set is what keeps the answer the same under Node,
+ * where `charCodeAt` reads a UTF-16 unit rather than a byte. An ASCII byte
+ * never occurs inside a multi-byte UTF-8 sequence, so a non-ASCII `text`
+ * passes through and only its ASCII bytes can match — as in `splitLines`, the
+ * index is a byte offset natively. `from` is clamped to `[0, text.length]`,
+ * as `substring` clamps, so a negative `from` searches from the start and one
+ * past the end answers -1.
+ *
+ * Natively the search is the runtime's `nish_str_index_of_any`, which reads
+ * 16 or 32 bytes at a time (docs/LANGUAGE.md, "Byte search"). It is
+ * **variable-time**: how long it takes says where the first match is, so it is
+ * never for secret data.
+ */
+export const indexOfAny = (text: string, bytes: string, from: i32): i32 => {
+  const count: i32 = toI32(bytes.length)
+  if (count < 1 || count > INDEX_OF_ANY_MAX_SET) {
+    panic("indexOfAny: the set must hold 1 to 16 bytes")
+  }
+  let j: i32 = 0
+  while (j < count) {
+    if (toI32(bytes.charCodeAt(j)) >= NON_ASCII) {
+      panic("indexOfAny: every byte of the set must be ASCII")
+    }
+    j += 1
+  }
+  const length: i32 = toI32(text.length)
+  let start: i32 = from
+  if (start < 0) {
+    start = 0
+  }
+  if (start > length) {
+    start = length
+  }
+  return indexOfAnyFrom(text, bytes, start)
+}
+
+/**
+ * `indexOfAny`'s walk, once its arguments are checked: the first index at or
+ * after `from` whose byte is in `bytes`, or -1.
+ *
+ * This loop is what runs under Node. Natively the compiler recognises the one
+ * call `indexOfAny` makes to it and calls the runtime kernel instead
+ * (`src/kernels.ts`), so the loop is the kernel's meaning written in the
+ * language rather than its implementation. The name is long for the reason
+ * `isTextBlankByte`'s is.
+ */
+const indexOfAnyFrom = (text: string, bytes: string, from: i32): i32 => {
+  const length: i32 = toI32(text.length)
+  const count: i32 = toI32(bytes.length)
+  let i: i32 = from
+  // `from` is never negative, because `indexOfAny` clamped it; the test is
+  // written because it is what proves `i` within `text`, as in `splitLines`.
+  while (i >= 0 && i < length) {
+    const code: i32 = toI32(text.charCodeAt(i))
+    let j: i32 = 0
+    while (j < count) {
+      if (toI32(bytes.charCodeAt(j)) === code) {
+        return i
+      }
+      j += 1
+    }
+    i += 1
+  }
+  return -1
+}