@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/network-nts.js

@@ -442,14 +442,17 @@ function querySingle(opts) {
     throw new NtsError("nts/no-cookies", "nts.querySingle: cookies array required");
   }
   return new Promise(function (resolve, reject) {
-    var sock = dgram.createSocket("udp4");
-    var settled = false;
-    function done(err, result) {
-      if (settled) return;
-      settled = true;
-      try { sock.close(); } catch (_e) { /* best-effort socket close */ }
-      if (err) reject(err); else resolve(result);
-    }
+    // Build the request BEFORE opening the socket. Encoding it can fail — an
+    // aeadId the encoder does not recognise is the reachable case, and
+    // refusing it is the point — and a socket opened first has nobody left to
+    // close it once that throw unwinds. Holding the acquisition until every
+    // step that can throw has succeeded is what makes the leak impossible,
+    // rather than something each new failure path has to remember to undo.
+    //
+    // Inside the executor, not above it: a throw here still reaches the
+    // caller as a REJECTION, so `querySingle(opts).catch(...)` keeps seeing
+    // the documented refusal. Hoisting this out would leak the throw
+    // synchronously past a caller that only attached a .catch.
     var unique = nodeCrypto.randomBytes(UNIQUE_ID_BYTES);
     var cookie = opts.cookies[0];
     var packet = Buffer.alloc(NTP_PACKET_BYTES);
@@ -468,6 +471,15 @@ function querySingle(opts) {
     encrypted.copy(authBody, 4 + nonceLen);
     var ext3 = _encodeExtensionField(EXTENSION_NTS_AUTHENTICATOR_AND_ENC, authBody);
     var fullPacket = Buffer.concat([packet, ext1, ext2, ext3]);
+
+    var sock = dgram.createSocket("udp4");
+    var settled = false;
+    function done(err, result) {
+      if (settled) return;
+      settled = true;
+      try { sock.close(); } catch (_e) { /* best-effort socket close */ }
+      if (err) reject(err); else resolve(result);
+    }
     var sendTimeMs = Date.now();
     var timer = setTimeout(function () {
       done(new NtsError("nts/timeout", "NTS query timed out after " + timeoutMs + "ms"));
@@ -553,12 +565,21 @@ function querySingle(opts) {
         done(new NtsError("nts/bad-reply", "NTS reply processing failed: " + e.message));
       }
     });
-    sock.send(fullPacket, 0, fullPacket.length, opts.port || NTPV4_DEFAULT_PORT, opts.host, function (err) {
-      if (err) {
-        clearTimeout(timer);
-        done(new NtsError("nts/send", "NTS send failed: " + err.message));
-      }
-    });
+    // send() rejects a malformed destination synchronously. Routing that
+    // throw through done() closes the socket; letting it escape the executor
+    // would reject the caller and strand the handle, which is the failure
+    // holding the request build above the acquisition.
+    try {
+      sock.send(fullPacket, 0, fullPacket.length, opts.port || NTPV4_DEFAULT_PORT, opts.host, function (err) {
+        if (err) {
+          clearTimeout(timer);
+          done(new NtsError("nts/send", "NTS send failed: " + err.message));
+        }
+      });
+    } catch (e) {
+      clearTimeout(timer);
+      done(new NtsError("nts/send", "NTS send failed: " + e.message));
+    }
   });
 }
 

package/lib/vendor/blamejs/lib/network-proxy.js

@@ -183,12 +183,16 @@ function _proxyAuthHeader(proxyUrl) {
 
 function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
   var proxyPort = proxyUrl.port || (proxyUrl.protocol === "https:" ? DEFAULT_HTTPS_PORT : DEFAULT_HTTP_PORT);
+  // Read ONCE, so the diagnosis below describes the handshake that happened.
+  // A preferredGroups.set(...) landing while this handshake is in flight would
+  // otherwise have the error handler read a posture this dial never offered.
+  var proxyPosture = proxyUrl.protocol === "https:" ? networkTls().outboundPosture() : null;
   var proxySocket = proxyUrl.protocol === "https:"
     ? nodeTls.connect(Object.assign({
       host:       proxyUrl.hostname,
       port:       proxyPort,
       servername: proxyUrl.hostname,
-    }, networkTls().outboundPosture()))
+    }, proxyPosture))
     : net.connect({ host: proxyUrl.hostname, port: proxyPort });
   var settled = false;
   var connectDeadline = null;
@@ -212,7 +216,25 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
     try { proxySocket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
   }, connectTimeoutMs);
   if (connectDeadline && typeof connectDeadline.unref === "function") connectDeadline.unref();
-  proxySocket.on("error", function (e) { done(e); });
+  proxySocket.on("error", function (e) {
+    // The handshake that failed here is with the PROXY, not the destination:
+    // no tunnel exists yet. This error travels out through the agent callback
+    // of the request to the destination, so it is claimed here, with the
+    // proxy's identity and the options this leg dialled with. Otherwise it
+    // would be reported as the destination refusing a connection nothing ever
+    // attempted, sending an operator to troubleshoot the wrong peer.
+    if (proxyPosture) {
+      networkTls().annotateOutboundFailure(e, {
+        host:    proxyUrl.hostname,
+        // `URL.port` is a string, and the explanation appends a port only when
+        // it is given a number — so an explicit `:8443` was dropped and the
+        // message named a host that may run several TLS listeners.
+        port:    Number(proxyPort),
+        tlsOpts: proxyPosture,
+      });
+    }
+    done(e);
+  });
   proxySocket.on(proxyUrl.protocol === "https:" ? "secureConnect" : "connect", function () {
     if (proxyUrl.protocol === "https:") {
       // The CONNECT-tunnel leg to an https proxy is itself a TLS handshake;
@@ -275,11 +297,17 @@ function agentFor(targetUrl) {
     agent.createConnection = function (options, cb) {
       _connectThroughTunnel(proxy, options.host, options.port, function (err, tunnel) {
         if (err) return cb(err);
+        // Read ONCE, and diagnose against what was read. The agent above
+        // snapshotted a posture when it was built and is then cached, so a
+        // later preferredGroups.set(...) leaves agent.options describing
+        // groups this dial did not offer — the caller reading them back would
+        // be told about a handshake that never happened.
+        var livePosture = networkTls().outboundPosture();
         var secure = nodeTls.connect(Object.assign({
           socket:     tunnel,
           servername: options.servername || options.host,
           ALPNProtocols: options.ALPNProtocols,
-        }, networkTls().outboundPosture()), function () {
+        }, livePosture), function () {
           // Audit a classical-group fallback on the upstream (target) handshake
           // reached through the proxy tunnel, so the "every outbound TLS path
           // emits tls.classical_downgrade" guarantee holds for proxied requests
@@ -291,7 +319,17 @@ function agentFor(targetUrl) {
           });
           cb(null, secure);
         });
-        secure.on("error", function (e) { cb(e); });
+        secure.on("error", function (e) {
+          // Annotated HERE, with the settings this leg actually used. The
+          // annotation is one-shot, so naming the destination leg first stops
+          // the outer handler describing it from the stale cached agent.
+          networkTls().annotateOutboundFailure(e, {
+            host:    options.servername || options.host,
+            port:    Number(options.port),
+            tlsOpts: livePosture,
+          });
+          cb(e);
+        });
       });
     };
   } else {

package/lib/vendor/blamejs/lib/network-smtp-policy.js

@@ -189,7 +189,7 @@ async function mtaStsFetch(domain, opts) {
       // this is a deliberate opportunistic fallback, not a silent swallow.
       return null;
     }
-    if (res.statusCode === 404) return null;                                     // HTTP 404
+    if (res.statusCode === C.HTTP.STATUS.NOT_FOUND) return null;                                     // HTTP 404
     if (res.statusCode < 200 || res.statusCode >= 300) {                         // HTTP 2xx range
       throw new SmtpPolicyError("smtp/mta-sts-fetch-failed",
         "MTA-STS fetch returned " + res.statusCode + " for " + url);

package/lib/vendor/blamejs/lib/network-tls.js

@@ -476,6 +476,79 @@ function detectBaselineDrift() {
   return { added: added, removed: removed, drifted: added.length > 0 || removed.length > 0 };
 }
 
+// Normalise an operator-supplied named-group preference to the colon-separated
+// string node:tls reads. Accepts a non-empty string or a non-empty array of
+// non-empty strings; anything else is a config-time mistake and throws, so it
+// surfaces at boot rather than as a handshake that negotiated something other
+// than what was configured.
+function _groupPreferenceString(value, where) {
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      throw new TlsTrustError("tls/bad-group-preference",
+        where + ": group preference must name at least one group");
+    }
+    for (var i = 0; i < value.length; i++) {
+      if (typeof value[i] !== "string" || value[i].length === 0) {
+        throw new TlsTrustError("tls/bad-group-preference",
+          where + "[" + i + "]: group preference entries must be non-empty strings, got " +
+          (typeof value[i] === "string" ? "empty string" : typeof value[i]));
+      }
+    }
+    return value.join(":");
+  }
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TlsTrustError("tls/bad-group-preference",
+      where + ": group preference must be a non-empty string or array of group " +
+      "names, got " + (typeof value === "string" ? "empty string" : typeof value));
+  }
+  return value;
+}
+
+// A dial or context built from these options can reach TLS 1.3 unless the
+// caller capped it below — through `maxVersion`, or a `secureProtocol` method
+// that pins one version. Two things turn on the answer and both used to get
+// it wrong: RFC 8879 certificate compression is a TLS 1.3 extension that Node
+// refuses outright when the range excludes 1.3, and a handshake explanation
+// must not send an operator after a TLS 1.3 cipher list their connection
+// never offered. One predicate answers for both.
+// The OpenSSL methods that pin one version. SSLv23_method is the trap: it
+// reads as the version-flexible one and is not — Node maps it to TLS_method
+// with the ceiling held at TLS 1.2. Matching whole names rather than a prefix
+// keeps a hypothetical TLSv1_3_method out of the set, which a prefix on
+// `TLSv1_` would swallow.
+var VERSION_PINNED_METHOD_RE =
+  /^(?:SSLv2|SSLv23|SSLv3|TLSv1|TLSv1_1|TLSv1_2)_(?:client_|server_)?method$/;
+var MAX_METHOD_NAME = 32;
+
+function _reachesTls13(opts) {
+  if (opts === null || typeof opts !== "object") return true;
+  var cap = opts.maxVersion;
+  if (cap !== undefined && cap !== null && cap !== "TLSv1.3") return false;
+  // An OpenSSL method name is a short fixed identifier — the longest Node
+  // accepts is `TLSv1_2_client_method` — so bound the input before matching
+  // rather than scanning whatever a caller put there. Anything longer is not
+  // a method name and pins no version.
+  var method = opts.secureProtocol;
+  if (typeof method !== "string" || method.length > MAX_METHOD_NAME) return true;
+  return !VERSION_PINNED_METHOD_RE.test(method);
+}
+
+// Drop the certificate-compression advertisement the framework contributed
+// when the merged options cannot reach TLS 1.3. Without this, capping a
+// connection — a documented override on the WebSocket client and the mail
+// sender — turns into ERR_INVALID_ARG_VALUE before any bytes move, over an
+// option the caller never asked for. A caller who asked for it themselves
+// keeps it, and keeps the error: they named two settings that contradict each
+// other, and quietly dropping one would hide the contradiction.
+function _stripUnreachableCertCompression(merged, caller) {
+  if (!merged || typeof merged !== "object") return merged;
+  if (_reachesTls13(merged)) return merged;
+  if (caller && typeof caller === "object" &&
+      caller.certificateCompression !== undefined) return merged;
+  delete merged.certificateCompression;
+  return merged;
+}
+
 function applyToContext(opts) {
   opts = opts || {};
   validateOpts(opts, ["base"], "tls.applyToContext");
@@ -492,18 +565,38 @@ function applyToContext(opts) {
   // (the framework default is the three ML-KEM hybrids plus the classical
   // X25519 fallback) so https.Server / https.Agent
   // negotiate the hybrid KEM with peers that support it and fall back
-  // to classical X25519 with peers that don't. Operators who explicitly
-  // pass `groups` in their base config keep the override.
-  if (base.groups === undefined && STATE.tlsKeyShares.length > 0) {
-    base.groups = STATE.tlsKeyShares.join(":");
-  }
+  // to classical X25519 with peers that don't.
+  //
+  // node:tls reads that preference as `ecdhCurve`. A `groups` key is accepted
+  // and silently ignored — an unimplemented option is not an error there,
+  // whereas a malformed `ecdhCurve` throws — so the list has to land under
+  // the name the TLS layer actually reads. A base config naming a preference
+  // under either spelling keeps its override; `groups` is carried over rather
+  // than dropped, since that is the name this function asked operators for.
+  //
+  // An override that is PRESENT but not a usable list is refused rather than
+  // replaced. node:tls rejects a non-string ecdhCurve, so before the
+  // preference was translated to that key a malformed one stopped the server
+  // at createSecureContext; quietly substituting the framework default here
+  // would instead start a listener on groups the operator did not choose,
+  // with nothing said. Only a genuinely absent override takes the default.
+  var overrideKey = base.ecdhCurve !== undefined ? "ecdhCurve"
+                  : base.groups    !== undefined ? "groups"
+                  : null;
+  if (overrideKey !== null) {
+    base.ecdhCurve = _groupPreferenceString(base[overrideKey],
+                                            "tls.applyToContext: base." + overrideKey);
+  } else if (STATE.tlsKeyShares.length > 0) {
+    base.ecdhCurve = STATE.tlsKeyShares.join(":");
+  }
+  if (base.groups !== undefined) delete base.groups;
   // RFC 8879 certificate compression — advertise what this runtime can
   // decompress so a peer may send its Certificate message compressed. The
   // framework's own leaf certificates are ML-DSA-87, so the Certificate
   // message is the largest thing on the wire during a handshake. Operators
   // who set `certificateCompression` in their base config keep the override,
   // including `[]` to advertise none.
-  if (base.certificateCompression === undefined) {
+  if (base.certificateCompression === undefined && _reachesTls13(base)) {
     var certAlgs = C.TLS_CERT_COMPRESSION();
     if (certAlgs.length > 0) base.certificateCompression = certAlgs.slice();
   }
@@ -636,9 +729,14 @@ function getCaPems() {
 //
 //   buildOptions({ ecdhCurve, groups, cert, key, ca, minVersion, sni,
 //                  certificateCompression })
-//     returns { minVersion, ecdhCurve, groups, cert, key, ca, servername,
+//     returns { minVersion, ecdhCurve, cert, key, ca, servername,
 //               certificateCompression }
 //
+// `groups` is accepted as a spelling of the preference and is NOT returned:
+// node:tls reads the list as `ecdhCurve` and silently ignores `groups`, so
+// emitting both would put the operator's preference under a name the TLS
+// layer never looks at beside the one it does.
+//
 // `ca` accepts a PEM string OR Buffer OR Array<string|Buffer>; arrays
 // are concatenated with `\n` so Node's TLS layer parses every block.
 function _normalizeCaInput(ca) {
@@ -726,9 +824,11 @@ function buildOptions(opts) {
     }
     resolved = requested;
   }
-  var resolvedStr = resolved.join(":");
-  out.ecdhCurve = resolvedStr;
-  out.groups    = resolvedStr;
+  // Emitted only as `ecdhCurve` — the one name node:tls reads. Returning a
+  // matching `groups` key looked like a second, equivalent handle on the
+  // preference and was inert, which is the shape that let a group list ship
+  // for several releases without ever reaching a handshake.
+  out.ecdhCurve = resolved.join(":");
 
   // cert / key — pass-through with light shape check. Both are
   // typically PEM strings or Buffers; arrays are valid for cert
@@ -885,6 +985,233 @@ function outboundPosture() {
   return posture;
 }
 
+/**
+ * @primitive  b.network.tls.explainOutboundFailure
+ * @signature  b.network.tls.explainOutboundFailure(err, ctx?)
+ * @since      0.18.18
+ * @status     stable
+ * @related    b.network.tls.outboundPosture
+ *
+ * Turn a refused outbound handshake into a sentence naming the likely cause.
+ *
+ * OpenSSL reports a rejected ClientHello as a bare alert — `tlsv1 alert
+ * protocol version` — which names neither the peer nor anything an operator
+ * can act on, and reads as a problem with the request rather than with the
+ * posture the client applied to it. Two of those alerts are routinely the
+ * posture doing its job:
+ *
+ * A `protocol_version` alert against a client pinning `minVersion: "TLSv1.3"`
+ * means the peer offers no TLS 1.3. That is a version refusal and has nothing
+ * to do with the key-exchange groups, which is worth stating plainly: the
+ * post-quantum posture is the framework's most visible property, so it draws
+ * the blame for handshake failures it did not cause.
+ *
+ * A `handshake_failure` alert against a narrowed group list means the peer
+ * shares none of the offered groups. Under the shipped preference this cannot
+ * happen — the list ends in classical X25519, so a peer with no post-quantum
+ * hybrid negotiates that — so it points at a list an operator has narrowed
+ * past what the peer can do.
+ *
+ * Neither alert is exclusive to these causes, so the wording is hedged and
+ * the original error text is carried through rather than replaced. Returns
+ * null when the error is not one this can speak to, which callers use to fall
+ * back to the original message.
+ *
+ * Pass `tlsOpts` — the options object the dial was made with — rather than
+ * copying settings out of it. Handing the object over names every setting it
+ * could carry, so the explanation stays right as the diagnosis learns to read
+ * settings a caller was not thinking about when the error handler was written.
+ *
+ * @opts
+ *   host:           string,   // peer named in the message; default: omitted
+ *   port:           number,   // appended to host when both are present
+ *   tlsOpts:        object,   // the options the dial used; each setting below is read from it
+ *   minVersion:     string,   // the floor that was applied; default: the live posture
+ *   maxVersion:     string,   // the ceiling that was applied, when a caller capped the dial below TLS 1.3
+ *   secureProtocol: string,   // an OpenSSL method name, when a caller pinned one version that way
+ *   ecdhCurve:      string,   // the group list that was offered; default: the live posture
+ *
+ * @example
+ *   var why = b.network.tls.explainOutboundFailure(err, { host: "registry.example.com", port: 443 });
+ *   // -> "TLS handshake refused by registry.example.com:443 - the peer most
+ *   //     likely does not offer TLS 1.3, ..."
+ */
+var EXPLAIN_PREFIX = "TLS handshake refused";
+var DIAGNOSED = "_blamejsTlsDiagnosed";
+
+function _hasOwn(obj, key) {
+  return Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+// Resolve one setting of the dial being diagnosed. A caller either names the
+// setting or hands over `tlsOpts` — the options object the dial was made with.
+// Handing that object over names every setting it could carry, so a value
+// missing from it means "not pinned for this dial", exactly as a named-but-
+// undefined field does. Copying fields out of it one at a time is how a
+// setting the explanation needs goes missing at a call site nobody remembered
+// to update, which is what kept every capped dial reading as a TLS 1.3 one;
+// the framework's own callers pass the object.
+function _dialSetting(ctx, key, fallback) {
+  if (_hasOwn(ctx, key)) return ctx[key];
+  var dialed = ctx.tlsOpts;
+  if (dialed !== null && typeof dialed === "object") return dialed[key];
+  return fallback;
+}
+
+// A port the caller had as text is still a port. `URL.port` is a string, so
+// requiring a number here silently dropped the endpoint from the message for
+// any caller that passed one through — and a host running several TLS
+// listeners is exactly where the operator needs to know which one refused.
+function _portSuffix(port) {
+  var n = typeof port === "string" && port !== "" ? Number(port) : port;
+  if (typeof n !== "number" || !isFinite(n)) return "";
+  return ":" + n;
+}
+
+function explainOutboundFailure(err, ctx) {
+  if (!err || typeof err !== "object") return null;
+  ctx = ctx || {};
+  var code = typeof err.code === "string" ? err.code : "";
+  var text = typeof err.message === "string" ? err.message : "";
+  // A caller that names a setting is reporting what THIS dial actually used,
+  // and an absent value there means "not pinned for this dial" rather than
+  // "ask the shared posture" -- a request handed a caller-supplied agent, or a
+  // dial whose own TLS options overrode the posture, negotiates on settings
+  // the shared object does not describe. Diagnosing those against the shared
+  // posture can invert the answer: an agent capped at TLS 1.2 talking to a
+  // 1.3-only peer would be reported as the peer lacking 1.3. Only a caller
+  // that names nothing at all falls back to the live posture.
+  var posture = outboundPosture();
+  var minVersion = _dialSetting(ctx, "minVersion", posture.minVersion);
+  var offered = _dialSetting(ctx, "ecdhCurve", posture.ecdhCurve);
+
+  var peer = "";
+  if (typeof ctx.host === "string" && ctx.host.length > 0) {
+    peer = " by " + ctx.host +
+      _portSuffix(ctx.port);
+  }
+
+  // Alert 70 (protocol_version) and the local equivalents Node raises when the
+  // floor cannot be met. Matched on code first; the text is the fallback for
+  // builds that surface the alert without a distinct code.
+  var isVersion = code === "ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION" ||
+                  code === "ERR_SSL_UNSUPPORTED_PROTOCOL" ||
+                  code === "ERR_SSL_VERSION_TOO_LOW" ||
+                  /alert protocol version|unsupported protocol|version too low/i.test(text);
+  if (isVersion && minVersion === "TLSv1.3") {
+    return EXPLAIN_PREFIX + peer + " - the peer most likely does not " +
+      "offer TLS 1.3, which this client requires (minVersion TLSv1.3). This is " +
+      "a protocol-version refusal and is unrelated to the post-quantum group " +
+      "preference. Underlying error: " + text;
+  }
+
+  var list = typeof offered === "string" && offered.length > 0 ? offered.split(":") : [];
+  if (list.length === 0) return null;
+
+  var hasClassicalFallback = false;
+  for (var i = 0; i < list.length; i += 1) {
+    if (list[i].length > 0 && list[i].indexOf("MLKEM") === -1) hasClassicalFallback = true;
+  }
+  // Only the hybrids are on offer, so a peer without one has nothing left --
+  // worth saying wherever the group list is in the frame.
+  var hybridOnlyNote = hasClassicalFallback ? ""
+    : " The list names only post-quantum hybrids, so a peer without one has " +
+      "nothing left to negotiate.";
+
+  // Codes that mean the group specifically. Carrying a classical group is NOT
+  // proof the peer can pick one -- a TLS 1.3 peer restricted to secp256r1
+  // shares nothing with the hybrids plus X25519 -- so a fallback in the list
+  // does not suppress this.
+  if (code === "ERR_SSL_NO_SHARED_GROUP" || code === "ERR_SSL_WRONG_CURVE" ||
+      /no shared group|wrong curve/i.test(text)) {
+    return EXPLAIN_PREFIX + peer + " - the peer supports none of the " +
+      "key-exchange groups this client offers (" + offered + ")." + hybridOnlyNote +
+      " Underlying error: " + text;
+  }
+
+  // Alert 40 is generic: the peer says it could not proceed without saying
+  // what it objected to. A disjoint TLS 1.3 cipher list produces exactly this
+  // code with a group both sides support, so naming the group list as the
+  // cause would send an operator after the wrong setting. Report what was
+  // pinned and let them narrow it down.
+  if (code === "ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE" ||
+      /alert handshake failure/i.test(text)) {
+    // Name TLS 1.3 only when this dial could have reached it. An operator who
+    // capped the connection lower — through a WebSocket tlsOpts override,
+    // their own agent, or a version-pinned secureProtocol — never attempted
+    // 1.3, so pointing at its cipher list sends them after a setting that had
+    // no part in the failure.
+    var reached13 = _reachesTls13({
+      maxVersion:     _dialSetting(ctx, "maxVersion", undefined),
+      secureProtocol: _dialSetting(ctx, "secureProtocol", undefined),
+    });
+    return EXPLAIN_PREFIX + peer + " - the peer rejected the handshake with a " +
+      "generic failure alert, which does not say what it objected to. With " +
+      "this client's posture the usual candidates are no mutually supported " +
+      "key-exchange group (it offers " + offered + "), " +
+      (reached13 ? "no shared TLS 1.3 cipher suite" : "no shared cipher suite") +
+      ", and certificate selection." + hybridOnlyNote +
+      " Underlying error: " + text;
+  }
+  return null;
+}
+
+/**
+ * @primitive  b.network.tls.annotateOutboundFailure
+ * @signature  b.network.tls.annotateOutboundFailure(err, ctx?)
+ * @since      0.18.18
+ * @status     stable
+ * @related    b.network.tls.explainOutboundFailure
+ *
+ * Rewrite a refused handshake's message in place to name the likely cause,
+ * and hand the same error back.
+ *
+ * The error object is kept rather than replaced so `err.code`, the error
+ * class and anything a caller already branches on survive untouched; only the
+ * message changes, and only when there is something to say. The stack's
+ * leading line is refreshed alongside it, since it embeds a copy of the
+ * message captured at construction.
+ *
+ * Diagnosis never fails a request: any error raised while working out the
+ * explanation is swallowed and the original message stands.
+ *
+ * @opts
+ *   host:    string,   // peer named in the message
+ *   port:    number,   // appended to host when both are present
+ *   tlsOpts: object,   // the options the dial used; see explainOutboundFailure for the settings read from it
+ *
+ * @example
+ *   socket.on("error", function (err) {
+ *     b.network.tls.annotateOutboundFailure(err, { host: host, port: port });
+ *     handle(err);
+ *   });
+ */
+function annotateOutboundFailure(err, ctx) {
+  try {
+    // An error can reach more than one handler on its way out: an h2 session
+    // error retried on h1, or a proxy-leg failure surfacing through the agent
+    // callback of the request to the destination. Whichever leg owns the peer
+    // the handshake was with annotates first and claims the error, because a
+    // later handler would attach a different peer's name to it -- reporting
+    // that the destination refused a handshake that never reached it. The
+    // claim is recorded even when there was nothing to say, since silence
+    // from the owning leg does not make an outer leg's guess correct.
+    if (!err || typeof err !== "object") return err;
+    if (err[DIAGNOSED] === true) return err;
+    Object.defineProperty(err, DIAGNOSED, {
+      value: true, enumerable: false, writable: true, configurable: true,
+    });
+    var why = explainOutboundFailure(err, ctx);
+    if (typeof why !== "string" || why.length === 0) return err;
+    var previous = err.message;
+    err.message = why;
+    if (typeof err.stack === "string" && previous && err.stack.indexOf(previous) !== -1) {
+      err.stack = err.stack.replace(previous, why);
+    }
+  } catch (_e) { /* best-effort: an unexplained error beats a masked one */ }
+  return err;
+}
+
 function _emitAuditAdd(metaList, opts) {
   if (opts.audit === false) return;
   var sink;
@@ -1707,7 +2034,7 @@ async function fetchOcspResponse(opts) {
     throw new TlsTrustError("tls/ocsp-fetch-failed",
       "ocsp.fetch: responder request to " + responderUrl + " failed: " + ((e && e.message) || String(e)));
   }
-  if (res.status !== 200 || !Buffer.isBuffer(res.body) || res.body.length === 0) {
+  if (res.status !== C.HTTP.STATUS.OK || !Buffer.isBuffer(res.body) || res.body.length === 0) {
     throw new TlsTrustError("tls/ocsp-fetch-bad-status",
       "ocsp.fetch: responder returned status " + res.status + " with an empty/non-buffer body");
   }
@@ -3707,6 +4034,8 @@ module.exports = {
   auditInsecureTls:    auditInsecureTls,
   certificateCompressionAlgorithms: certificateCompressionAlgorithms,
   outboundPosture:     outboundPosture,
+  explainOutboundFailure: explainOutboundFailure,
+  annotateOutboundFailure: annotateOutboundFailure,
   postureGeneration:   postureGeneration,
   addCa:               addCa,
   addCaBundle:         addCaBundle,
@@ -3736,6 +4065,7 @@ module.exports = {
   TlsTrustError:       TlsTrustError,
   NetworkTlsError:     NetworkTlsError,
   _resetForTest:       _resetForTest,
+  _stripUnreachableCertCompression: _stripUnreachableCertCompression,
   _checkServerIdentityStrict: _checkServerIdentityStrict,
   _stripSctExtensionFromCert: _stripSctExtensionFromCert,
   _buildSctSignedEntry: _buildSctSignedEntry,

package/lib/vendor/blamejs/lib/nist-crosswalk.js

@@ -29,10 +29,10 @@
  *   evidence-of-control at the SSP / ATO level.
  */
 
-var framework_error = require("./framework-error");
+var frameworkError = require("./framework-error");
 var validateOpts    = require("./validate-opts");
 
-var NistCrosswalkError = framework_error.defineClass(
+var NistCrosswalkError = frameworkError.defineClass(
   "NistCrosswalkError",
   "nist-crosswalk"
 );

package/lib/vendor/blamejs/lib/ntp-check.js

@@ -181,6 +181,23 @@ function querySingle(server, opts) {
   var timeoutMs = opts.timeoutMs || DEFAULT_TIMEOUT_MS;
 
   return new Promise(function (resolve, reject) {
+    // SNTPv4 client request: NTP_PACKET_BYTES buffer, byte 0 = 0b00_100_011 = 0x23
+    //   LI=0 (no warning), VN=4, Mode=3 (client). Other bytes zero.
+    //
+    // Built before the socket is opened, and inside this executor: entropy for
+    // the nonce can fail, a socket acquired first would have nobody left to
+    // close it, and a throw out here still reaches the caller as a rejection.
+    var req = Buffer.alloc(NTP_PACKET_BYTES);
+    req[0] = 0x23;
+    // RFC 5905 §8 client-cookie: put a random 64-bit nonce in the request's
+    // Transmit Timestamp (bytes 40-47). A conformant server copies it verbatim
+    // into the reply's Originate Timestamp (bytes 24-31). Verifying that echo
+    // rejects an off-path spoofed reply — without it ANY 48-byte UDP datagram
+    // reaching our ephemeral port becomes the authoritative time, letting a
+    // spoofer force a fatal-drift refuse-to-boot under BLAMEJS_NTP_STRICT.
+    var originCookie = nodeCrypto.randomBytes(8);
+    originCookie.copy(req, 40);
+
     // udp6 for IPv6 literals (`::1`, `fd00::…`), udp4 otherwise. Without
     // this branch a query to an IPv6 NTP host fails with EINVAL because
     // you can't send IPv6 packets through a udp4 socket.
@@ -199,19 +216,6 @@ function querySingle(server, opts) {
       done({ code: "ntp/timeout", message: "no reply from " + server + " within " + timeoutMs + "ms" });
     }, timeoutMs);
     timer.unref();
-
-    // SNTPv4 client request: NTP_PACKET_BYTES buffer, byte 0 = 0b00_100_011 = 0x23
-    //   LI=0 (no warning), VN=4, Mode=3 (client). Other bytes zero.
-    var req = Buffer.alloc(NTP_PACKET_BYTES);
-    req[0] = 0x23;
-    // RFC 5905 §8 client-cookie: put a random 64-bit nonce in the request's
-    // Transmit Timestamp (bytes 40-47). A conformant server copies it verbatim
-    // into the reply's Originate Timestamp (bytes 24-31). Verifying that echo
-    // rejects an off-path spoofed reply — without it ANY 48-byte UDP datagram
-    // reaching our ephemeral port becomes the authoritative time, letting a
-    // spoofer force a fatal-drift refuse-to-boot under BLAMEJS_NTP_STRICT.
-    var originCookie = nodeCrypto.randomBytes(8);
-    originCookie.copy(req, 40);
     var sendTimeMs = Date.now();
 
     socket.on("error", function (e) {
@@ -270,12 +274,19 @@ function querySingle(server, opts) {
       done(null, { driftMs: driftMs, serverTimeMs: serverTimeMs, server: server });
     });
 
-    socket.send(req, 0, req.length, port, server, function (err) {
-      if (err) {
-        clearTimeout(timer);
-        done({ code: "ntp/refused", message: "send to " + server + ": " + err.message });
-      }
-    });
+    // send() rejects a malformed destination synchronously; routing that
+    // through done() closes the socket rather than stranding it.
+    try {
+      socket.send(req, 0, req.length, port, server, function (err) {
+        if (err) {
+          clearTimeout(timer);
+          done({ code: "ntp/refused", message: "send to " + server + ": " + err.message });
+        }
+      });
+    } catch (e) {
+      clearTimeout(timer);
+      done({ code: "ntp/refused", message: "send to " + server + ": " + e.message });
+    }
   });
 }