@blamejs/pki 0.8.49 → 0.8.51

package/lib/guard-intrinsic.js

@@ -68,6 +68,32 @@ var _promiseAny = Promise.any;
  *  present on the supported runtime floor. */
 var _promiseTry = Promise["try"];
 var _promiseWithResolvers = Promise.withResolvers;
+/** @internal The URL parser, captured for the reason the promise constructor is: what it returns names
+ *  the host a request is sent to. A replacement installed while a call is in flight answers with a
+ *  genuine URL of its own, and an endpoint built from that answer reaches a host the caller never
+ *  wrote while the url the caller passed is still the one the call reports. `canParse` is captured
+ *  beside it because a module that decides a form with it is deciding from the same binding. */
+var _URL = URL;
+var _urlCanParse = URL.canParse;
+/** @internal And its accessors, because capturing a constructor does not capture the prototype the
+ *  value it returns reads through. MEASURED: with the constructor captured, a header getter that
+ *  redefined `URL.prototype.href` had every request go to the host its own getter named while the url
+ *  the caller passed was still the one the call reported. The parts of a destination are read through
+ *  these, and the two that build an endpoint are written through the captured setters. */
+var _urlHref = getter(URL.prototype, "href", "URL.prototype");
+var _urlOrigin = getter(URL.prototype, "origin", "URL.prototype");
+var _urlProtocol = getter(URL.prototype, "protocol", "URL.prototype");
+var _urlPathname = getter(URL.prototype, "pathname", "URL.prototype");
+var _urlSearch = getter(URL.prototype, "search", "URL.prototype");
+var _urlHash = getter(URL.prototype, "hash", "URL.prototype");
+var _urlHostname = getter(URL.prototype, "hostname", "URL.prototype");
+var _urlPort = getter(URL.prototype, "port", "URL.prototype");
+var _urlUsername = getter(URL.prototype, "username", "URL.prototype");
+var _urlPassword = getter(URL.prototype, "password", "URL.prototype");
+var _urlSearchParams = getter(URL.prototype, "searchParams", "URL.prototype");
+var _urlSetPathname = setter(URL.prototype, "pathname", "URL.prototype");
+var _urlSetSearch = setter(URL.prototype, "search", "URL.prototype");
+var _urlSetHash = setter(URL.prototype, "hash", "URL.prototype");
 var _asyncIterator = Symbol.asyncIterator;
 
 var _arrForEach = uncurry(Array.prototype.forEach);
@@ -160,6 +186,18 @@ function getter(proto, name, who) {
   return uncurry(d.get);
 }
 
+/** @internal The write half of the same question: a replaced setter can drop the write and leave the
+ *  value it was given to change unchanged. */
+// @enforced-by behavioral -- reading a descriptor's `set` is not distinguishable from testing one
+function setter(proto, name, who) {
+  var d = _getOwnPropertyDescriptor(proto, name);
+  if (!d || typeof d.set !== "function") {
+    throw new TypeError("guard.intrinsic.setter: this runtime has no intrinsic " + who + "." +
+      name + " accessor, so the value's own would have to be invoked instead");
+  }
+  return uncurry(d.set);
+}
+
 var _taByteLength = getter(_getPrototypeOf(Uint8Array.prototype), "byteLength", "%TypedArray%.prototype");
 var _dvByteLength = getter(DataView.prototype, "byteLength", "DataView.prototype");
 
@@ -231,6 +269,23 @@ module.exports = Object.freeze({
   promiseAny: _promiseAny,
   promiseTry: _promiseTry,
   promiseWithResolvers: _promiseWithResolvers,
+  setter: setter,
+  URL: _URL,
+  urlCanParse: _urlCanParse,
+  urlHref: _urlHref,
+  urlOrigin: _urlOrigin,
+  urlProtocol: _urlProtocol,
+  urlPathname: _urlPathname,
+  urlSearch: _urlSearch,
+  urlHash: _urlHash,
+  urlHostname: _urlHostname,
+  urlPort: _urlPort,
+  urlUsername: _urlUsername,
+  urlPassword: _urlPassword,
+  urlSearchParams: _urlSearchParams,
+  urlSetPathname: _urlSetPathname,
+  urlSetSearch: _urlSetSearch,
+  urlSetHash: _urlSetHash,
   asyncIterator: _asyncIterator,
   forEach: _arrForEach,
   map: _arrMap,

package/lib/http-digest.js

@@ -7,6 +7,13 @@ var crypto = require("crypto");
 var constants = require("./constants");
 var intrinsic = require("./guard-intrinsic");
 var _hasOwn = intrinsic.hasOwn;
+/** @internal The URL parser, taken at load: the origin it reports is what a challenge is bound to.
+ *  Its accessors are taken with it, since the constructor's capture does not cover the prototype the
+ *  value reads its parts off and this origin is what a credential is scoped by. */
+var _URL = intrinsic.URL;
+var _urlOrigin = intrinsic.urlOrigin;
+var _urlPathname = intrinsic.urlPathname;
+var _urlSearch = intrinsic.urlSearch;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _fromCharCode = intrinsic.fromCharCode;
@@ -293,7 +300,7 @@ function answer(challenge, params, E) {
 function _domainEntry(d) {
   d = String(d == null ? "" : d);
   if (d.charAt(0) === "/") return { origin: null, full: d };
-  try { var u = new URL(d); return { origin: u.origin.toLowerCase(), full: (u.pathname || "/") + (u.search || "") }; }
+  try { var u = new _URL(d); return { origin: _urlOrigin(u).toLowerCase(), full: (_urlPathname(u) || "/") + (_urlSearch(u) || "") }; }
   catch (_e) { return null; }
 }
 

package/lib/http-transport.js

@@ -79,6 +79,21 @@ var intrinsic = require("./guard-intrinsic");
  *  step rejected proceed, and `peerChain`'s refusal to tunnel through a proxy is one of those. Taken at
  *  load. */
 var _Promise = intrinsic.Promise;
+/** @internal The URL parser, taken at load: what it returns names the host the socket is opened to,
+ *  for the request itself and for a proxy it is tunneled through. The conversion it is handed is taken
+ *  with it, since a replacement answers with a host of its own. */
+var _URL = intrinsic.URL;
+var _stringOf = intrinsic.String;
+/** @internal The parts of that destination are read through the accessors captured at load, not off the
+ *  prototype the parsed value reads through: a replaced `URL.prototype.hostname` names the host this
+ *  module then opens a socket to. */
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlHostname = intrinsic.urlHostname;
+var _urlPort = intrinsic.urlPort;
+var _urlPathname = intrinsic.urlPathname;
+var _urlSearch = intrinsic.urlSearch;
+var _urlUsername = intrinsic.urlUsername;
+var _urlPassword = intrinsic.urlPassword;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var frameworkError = require("./framework-error");
@@ -331,7 +346,10 @@ function snapshotProxy(p) {
   }
 }
 
-function _validateProxy(request, defaults, E, C, url) {
+/** @internal `originHost`, `statedPort` and `scheme` are the values the request path already read off
+ *  the parsed origin; they are passed in rather than read again here, so the authority this builds for
+ *  the CONNECT target is the same authority the socket options were built from. */
+function _validateProxy(request, defaults, E, C, originHost, originStatedPort, originScheme) {
   var proxy = request.proxy !== undefined ? request.proxy : defaults.proxy;
   if (proxy === undefined || proxy === null) return null;
   guard.identifier.assertPlainRecord(proxy, E, C("bad-proxy"), "opts.proxy");
@@ -339,11 +357,12 @@ function _validateProxy(request, defaults, E, C, url) {
   guard.identifier.assertKnownKeys(proxy, PROXY_KEYS, E, C("bad-proxy"), "opts.proxy has an unknown option ");
   if (typeof proxy.url !== "string") throw E(C("bad-proxy"), "opts.proxy.url must be a string, got " + guard.text.showValue(proxy.url));
   var purl;
-  try { purl = new URL(proxy.url); }
+  try { purl = new _URL(proxy.url); }
   catch (e) { throw E(C("bad-proxy"), "opts.proxy.url did not parse: " + guard.text.showValue(proxy.url), e); }
-  if (purl.protocol !== "http:" && purl.protocol !== "https:") throw E(C("bad-proxy"), "opts.proxy.url must be an http or https URL, got " + purl.protocol);
-  if (purl.username || purl.password) throw E(C("bad-proxy"), "opts.proxy.url must not carry credentials in its userinfo; supply opts.proxy.auth over an https proxy");
-  var secure = purl.protocol === "https:";
+  var pscheme = _urlProtocol(purl);
+  if (pscheme !== "http:" && pscheme !== "https:") throw E(C("bad-proxy"), "opts.proxy.url must be an http or https URL, got " + pscheme);
+  if (_urlUsername(purl) || _urlPassword(purl)) throw E(C("bad-proxy"), "opts.proxy.url must not carry credentials in its userinfo; supply opts.proxy.auth over an https proxy");
+  var secure = pscheme === "https:";
   if (!secure && proxy.tls !== undefined && proxy.tls !== null) throw E(C("bad-proxy"), "opts.proxy.tls applies only to an https proxy; an http proxy connection is plaintext (a supplied tls policy would be silently ignored)");
 
   var auth = null;
@@ -396,14 +415,14 @@ function _validateProxy(request, defaults, E, C, url) {
     proxyTls = { ca: pCa.length ? pCa : undefined, minVersion: pMinVersion, servername: (ptls && ptls.servername) || null };
   }
 
-  var originHost = _stripIpv6Brackets(url.hostname);
   var originAuthHost = nodeNet.isIP(originHost) === 6 ? "[" + originHost + "]" : originHost;
-  var phost = _stripIpv6Brackets(purl.hostname);
+  var phost = _stripIpv6Brackets(_urlHostname(purl));
   /** @internal The CONNECT target is the origin's own authority, so an origin URL that states no
    * port takes the default for the origin's scheme, not the proxy's. Defaulting it to 443 opens
    * the tunnel to a port an `http:` origin does not listen on. */
-  var originPort = url.port || (url.protocol === "http:" ? 80 : 443);
-  return { secure: secure, host: phost, port: purl.port ? +purl.port : (secure ? 443 : 80), originHost: originHost, originAuthority: originAuthHost + ":" + originPort, auth: auth, proxyTls: proxyTls };
+  var originPort = originStatedPort || (originScheme === "http:" ? 80 : 443);
+  var pport = _urlPort(purl);
+  return { secure: secure, host: phost, port: pport ? +pport : (secure ? 443 : 80), originHost: originHost, originAuthority: originAuthHost + ":" + originPort, auth: auth, proxyTls: proxyTls };
 }
 
 function _basicProxyHeader(auth) {
@@ -484,11 +503,14 @@ function httpsTransport(defaults) {
   var E = typeof defaults.E === "function" ? defaults.E : defaultE;
   var prefix = defaults.errPrefix || "transport";
   function C(name) { return prefix + "/" + name; }
-  var tlsDefaults = defaults.tls || {};
+  /** @internal No prototype where no TLS was bound: an empty object literal inherits from
+   *  `Object.prototype`, so a value installed there would answer for a setting nobody set, and one of
+   *  the settings read from this record is the opt-in that turns away an unpinned server. */
+  var tlsDefaults = defaults.tls != null ? defaults.tls : intrinsic.create(null);
 
   function _prepare(request) {
     var url;
-    try { url = new URL(String(request.url)); }
+    try { url = new _URL(_stringOf(request.url)); }
     catch (e) { throw E(C("bad-url"), "the request URL did not parse: " + String(request.url), e); }
     /** @internal https is the floor, and `request.allowPlaintextHttp` is the one thing that moves
      * it, per request and never as a default. It exists for the two objects whose integrity does
@@ -499,11 +521,16 @@ function httpsTransport(defaults) {
      * timeout, and the refusal to follow a redirect, which is what would otherwise turn one
      * plaintext hop into a downgrade of the next. */
     var plaintextAllowed = request.allowPlaintextHttp === true;
-    if (url.protocol !== "https:" && !(plaintextAllowed && url.protocol === "http:")) {
-      throw E(C("insecure-url"), "transport requires https (RFC 7030 sec. 3.3), got " + url.protocol);
+    /** @internal Read ONCE, through the captured accessor, and every decision below made from that
+     *  string. The scheme decides whether the request is allowed at all, whether an anchor is
+     *  required and which port it defaults to, so a prototype whose getter answers each read
+     *  differently would have those three agree on nothing. */
+    var scheme = _urlProtocol(url);
+    if (scheme !== "https:" && !(plaintextAllowed && scheme === "http:")) {
+      throw E(C("insecure-url"), "transport requires https (RFC 7030 sec. 3.3), got " + scheme);
     }
 
-    var reqTls = request.tls || {};
+    var reqTls = request.tls != null ? request.tls : intrinsic.create(null);
     var anchors = reqTls.anchors !== undefined ? reqTls.anchors : tlsDefaults.anchors;
     var useSystem = (reqTls.useSystemStore !== undefined ? reqTls.useSystemStore : tlsDefaults.useSystemStore) === true;
     var hasAnchors = anchors !== undefined && anchors !== null && !(Array.isArray(anchors) && anchors.length === 0);
@@ -511,7 +538,7 @@ function httpsTransport(defaults) {
      * neither an anchor nor the system store is refused rather than left unpinned. A plaintext hop
      * negotiates no certificate, so there is nothing for an anchor to pin; what protects the object
      * fetched over one is its own signature, checked after the fetch by the verb that asked. */
-    if (url.protocol === "https:" && !hasAnchors && !useSystem) {
+    if (scheme === "https:" && !hasAnchors && !useSystem) {
       throw E(C("no-trust-anchors"), "no explicit trust anchor and useSystemStore not set -- refusing an unpinned server (RFC 7030 sec. 3.6)");
     }
 
@@ -534,13 +561,14 @@ function httpsTransport(defaults) {
       reqHeaders["Content-Length"] = Buffer.byteLength(body);
     }
 
-    var host = _stripIpv6Brackets(url.hostname);
-    var plaintext = url.protocol === "http:";
+    var host = _stripIpv6Brackets(_urlHostname(url));
+    var plaintext = scheme === "http:";
+    var statedPort = _urlPort(url);
     var options = {
       method: request.method || "GET",
       hostname: host,
-      port: url.port || (plaintext ? 80 : 443),
-      path: url.pathname + url.search,
+      port: statedPort || (plaintext ? 80 : 443),
+      path: _urlPathname(url) + _urlSearch(url),
       headers: reqHeaders,
       minVersion: minVersion,
       rejectUnauthorized: true,
@@ -566,7 +594,7 @@ function httpsTransport(defaults) {
       };
     }
     var proxyInfo;
-    try { proxyInfo = _validateProxy(request, defaults, E, C, url); }
+    try { proxyInfo = _validateProxy(request, defaults, E, C, host, statedPort, scheme); }
     catch (e) {
       var typedProxyError = false;
       try {

package/lib/inspect.js

@@ -449,8 +449,9 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
     }
     return akiLines.length ? akiLines.join("\n") : inner + "keyid:(none)";
   },
-  /** @internal RFC 7633 sec. 6 carries TLS ExtensionType values, so each is named from the registry
-   *  where the toolkit knows it and printed as its number where it does not. */
+  /** @internal RFC 7633 sec. 4.1 binds these values to the IANA TLS Extensions registry, so each is
+   *  named from the registry where the toolkit knows it and printed as its number where it does not.
+   *  sec. 6 is IANA Considerations and registers the extension's own OID; it carries no value. */
   tlsFeature: function (decoded, inner) {
     return (decoded.features || []).map(function (f) {
       var text = String(f);

package/lib/lint.js

@@ -303,9 +303,16 @@ var OID_CPS = oid.byName("cps");
 /** @internal The extensions RFC 5280 says a conforming CA SHOULD mark non-critical, keyed by OID
  *  with the clause; the MUSTs live in the shared CERT_FIXED_CRITICALITY table. The subjectAltName
  *  and extKeyUsage recommendations are conditional and have their own rules. */
+/** @internal The per-extension citation travels with the finding, so a row here may come from a
+ *  document other than RFC 5280: RFC 7633 sec. 4 states the same shape of recommendation for the TLS
+ *  feature extension, and its clause closes by naming the case where critical is what the caller
+ *  wants, so this grades it rather than refusing it. Adding a row here grades the extension in the
+ *  DEFAULT set, which a named profile would not; it does not feed `_isUnknownExtension`, so the
+ *  unknown-critical verdict a critical one draws is unaffected. */
 var CERT_RECOMMENDED_NON_CRITICAL = Object.create(null);
 CERT_RECOMMENDED_NON_CRITICAL[oid.byName("issuerAltName")] = "RFC 5280 sec. 4.2.1.7";
 CERT_RECOMMENDED_NON_CRITICAL[oid.byName("cRLDistributionPoints")] = "RFC 5280 sec. 4.2.1.13";
+CERT_RECOMMENDED_NON_CRITICAL[oid.byName("tlsFeature")] = "RFC 7633 sec. 4";
 var _T_BMP = asn1.TAGS.BMP_STRING, _T_VISIBLE = asn1.TAGS.VISIBLE_STRING, _T_UTF8 = asn1.TAGS.UTF8_STRING;
 function _hasControlChar(str) {
   for (var i = 0; i < str.length; i++) {
@@ -488,7 +495,7 @@ var RFC5280_RULES = [
   _criticalityRule("keyUsage", "lint/rfc5280/key-usage-not-critical", "warn",
     "RFC 5280 4.2.1.3", "the keyUsage extension should be marked critical"),
   {
-    id: "lint/rfc5280/recommended-criticality", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.7 / 4.2.1.13",
+    id: "lint/rfc5280/recommended-criticality", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.7 / 4.2.1.13, RFC 7633 sec. 4",
     message: "an extension a conforming CA should mark non-critical is marked critical",
     check: function (cert) {
       var rows = [];
@@ -4056,6 +4063,96 @@ var RFC9763_RULES = [
   },
 ];
 
+/** @internal RFC 7633. The criticality recommendation lives in the always-on table above, because
+ * sec. 4 states it for every certificate carrying the extension. These rows read the VALUE, which
+ * RFC 7633 leaves open in three ways and another document speaks to in a fourth:
+ *
+ * sec. 4 writes `Features ::= SEQUENCE OF INTEGER` with no range, no ordering rule and no prohibition
+ * on repeats, so none of those is a conformance failure and none is refused by the encoder. What
+ * sec. 4.1 does say is that the values are "TLS extension identifiers ... as specified in the IANA
+ * Transport Layer Security (TLS) Extensions registry", and that registry is 16 bits wide, so a value
+ * outside 0..65535 names nothing in it. That is a `warn`, not an `error`: the finding rests on a
+ * reference to a registry rather than on a syntax rule, and at `error` in a named profile it would
+ * make `pki.x509.sign` refuse to emit the certificate.
+ *
+ * The transparency_info row is RFC 9162 sec. 7.2, read directly: "A certification authority SHOULD
+ * NOT issue any certificate that identifies the transparency_info TLS extension in a TLS feature
+ * extension [RFC7633], because TLS servers are not required to support the transparency_info TLS
+ * extension in order to participate in CT". That is the only clause outside RFC 7633 that constrains
+ * this field.
+ *
+ * There is NO deprecation row for status_request_v2, and the absence is deliberate. The IANA registry
+ * still lists `17 status_request_v2 [RFC 6961]` as Recommended and marks it neither obsolete nor
+ * deprecated; RFC 9846 contains no occurrence of "status_request_v2" and none of "7633", so no
+ * document states a deprecation to cite. What is true is narrower: RFC 9846 obsoletes RFC 6961, which
+ * defined the extension, and the ExtensionType enum at its sec. 4.3 does not list 17 at all, so a
+ * certificate naming feature 17 asks a TLS 1.3 server for something that version does not define
+ * while a TLS 1.2 deployment can still satisfy it. That is reported at `notice`, with the clause that
+ * supports it and nothing more. */
+var RFC7633_RULES = [
+  {
+    id: "lint/rfc7633/feature-outside-registry-width", severity: "warn", source: "rfc7633", citation: "RFC 7633 4.1",
+    message: "a TLS feature value lies outside the 16-bit width of the IANA TLS ExtensionType registry sec. 4.1 points at, so it names no extension in it",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("tlsFeature"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("tlsFeature");
+      var features = (d && d.value && d.value.features) || [];
+      var rows = [];
+      for (var i = 0; i < features.length; i++) {
+        var f = features[i];
+        if (f < 0n || f > 65535n) rows.push({ context: { feature: String(f), width: "0..65535" } });
+      }
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc7633/feature-repeated", severity: "notice", source: "rfc7633", citation: "RFC 7633 4",
+    message: "a TLS feature value appears more than once; the syntax permits it and the set it names is the same, so the repeat carries no meaning",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("tlsFeature"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("tlsFeature");
+      var features = (d && d.value && d.value.features) || [];
+      /** @internal One pass with a set of what has been seen, not a rescan of every preceding value.
+       *  This rule is in the default set and a certificate reaching it is unauthenticated, so the
+       *  pairwise form is work the input chooses: MEASURED, 20000 distinct features in an 80 KiB
+       *  certificate took 355 ms against 5 ms for 50 of them. A set compares the bigint values. */
+      var seen = new Set();
+      var rows = [];
+      for (var i = 0; i < features.length; i++) {
+        if (seen.has(features[i])) rows.push({ context: { feature: String(features[i]) } });
+        else seen.add(features[i]);
+      }
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc7633/transparency-info-feature", severity: "warn", source: "rfc7633", citation: "RFC 9162 7.2",
+    message: "a certification authority should not issue a certificate naming the transparency_info TLS extension (52) in a TLS feature extension, because a TLS server need not support it to participate in certificate transparency",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("tlsFeature"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("tlsFeature");
+      var features = (d && d.value && d.value.features) || [];
+      for (var i = 0; i < features.length; i++) {
+        if (features[i] === 52n) return { context: { feature: "52", name: "transparency_info" } };
+      }
+      return null;
+    },
+  },
+  {
+    id: "lint/rfc7633/feature-undefined-in-tls13", severity: "notice", source: "rfc7633", citation: "RFC 9846 4.3",
+    message: "a TLS feature value names status_request_v2 (17), which RFC 9846 does not list in its ExtensionType enum and whose defining document RFC 6961 it obsoletes, so a TLS 1.3 server cannot satisfy it",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("tlsFeature"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("tlsFeature");
+      var features = (d && d.value && d.value.features) || [];
+      for (var i = 0; i < features.length; i++) {
+        if (features[i] === 17n) return { context: { feature: "17", name: "status_request_v2", obsoletedBy: "RFC 9846" } };
+      }
+      return null;
+    },
+  },
+];
+
 /** @internal RFC 5280 sec. 5 states the criticality of each CRL extension it profiles, and sec. 5.3
  * does the same for the entry extensions. certificateIssuer is critical (sec. 5.3.3) because a
  * consumer that ignores it attributes an entry to the wrong issuer. */
@@ -6413,6 +6510,7 @@ var PROFILES = Object.assign(Object.create(null), {
   "rfc9909": RFC9909_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "rfc9935": RFC9935_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "rfc9763": RFC9763_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc7633": RFC7633_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "x509-altsig": X509_ALTSIG_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-tls": CABF_TLS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-smime": CABF_SMIME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
@@ -6436,7 +6534,7 @@ var PROFILES = Object.assign(Object.create(null), {
     .concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
-  .concat(RFC9763_RULES).concat(X509_ALTSIG_RULES)
+  .concat(RFC9763_RULES).concat(RFC7633_RULES).concat(X509_ALTSIG_RULES)
   .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES).concat(CABF_CS_RULES).concat(ETSI_QC_RULES)
   /** @internal The root-program rows are in the registry so `rules()` enumerates them, and stay
    * inert under the default set because each one asks whether the caller named the profile. */
@@ -6725,6 +6823,11 @@ function _applyThreshold(report, severity) {
  *                  id-kp-serverAuth and is not a CA. `"nist-pqc-transition"` and `"cnsa-2.0"` are
  *                  named the same way: which algorithm policy a certificate is held to is the
  *                  caller's assertion, so neither is detected and both are inert until named.
+ *                  `"rfc7633"` adds the rows that read a TLS Feature extension's VALUES: a feature
+ *                  outside the 16-bit width of the registry sec. 4.1 points at, a repeated feature,
+ *                  the transparency_info feature RFC 9162 sec. 7.2 asks a CA not to issue, and the
+ *                  status_request_v2 feature RFC 9846 leaves out of its ExtensionType enum. The
+ *                  criticality of that extension is graded by default and needs no profile.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and
  *                  `worst` always reflect the complete, unfiltered result.
  * @example

package/lib/ocsp.js

@@ -32,6 +32,8 @@ var _ocspIntrinsic = require("./guard-intrinsic");
  *  the construction to whatever that binding holds, and one settling without awaiting its argument runs
  *  the continuation before the check has finished. */
 var _Promise = _ocspIntrinsic.Promise;
+/** @internal The URL parser, taken at load: the href it reports is the responder a request is sent to. */
+var _URL = _ocspIntrinsic.URL;
 var _promiseResolve = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseResolve);
 /** @internal A refusal returned as a REJECTED promise is a verdict too: read from the global binding, a
  *  replacement whose `reject` resolves instead turns each `ocsp/bad-input` below into a pass. */
@@ -921,7 +923,7 @@ function httpRequest(der, responderUrl, opts) {
    * the string the sec. 5 size bound has to be measured on. The appended segment is base64 under
    * the sec. 2.3 unreserved set, which holds no `.`, so it cannot become a dot segment itself. */
   var normalized;
-  try { normalized = new URL(responderUrl).href; }
+  try { normalized = new _URL(responderUrl).href; }
   catch (e) { throw E("ocsp/bad-input", "httpRequest: the responder URL does not parse as a URL: " + guard.text.describeThrown(e), e); }
   var base = normalized.charAt(normalized.length - 1) === "/"
     ? normalized : normalized + "/";

package/lib/path-validate.js

@@ -67,6 +67,15 @@ var _reject = intrinsic.uncurry(intrinsic.promiseReject);
  * whatever the binding holds: a descriptor failure answering `false` through a replaced constructor is
  * not a refusal, and this module's verdicts are what a caller acts on. */
 var _Promise = intrinsic.Promise;
+/** @internal The URL parser, taken at load: the host it reports from an access descriptor is the host a
+ *  revocation fetch would be directed to. Its accessors are taken with it, because the constructor's
+ *  capture does not cover the prototype the value reads its parts off, and the host read here is the
+ *  one the address filter is applied to. */
+var _URL = intrinsic.URL;
+var _urlHref = intrinsic.urlHref;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlHostname = intrinsic.urlHostname;
+var _urlSetHash = intrinsic.urlSetHash;
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -122,6 +131,7 @@ var OID = intrinsic.assign(intrinsic.create(null), {
   anyExtendedKeyUsage: oid.byName("anyExtendedKeyUsage"),
   cRLDistributionPoints: oid.byName("cRLDistributionPoints"),
   subjectKeyIdentifier: oid.byName("subjectKeyIdentifier"),
+  tlsFeature: oid.byName("tlsFeature"),
   authorityKeyIdentifier: oid.byName("authorityKeyIdentifier"),
   authorityInfoAccess: oid.byName("authorityInfoAccess"),
   caIssuers: oid.byName("caIssuers"),
@@ -297,6 +307,66 @@ function _isCaCert(cert) {
   return !!(bc && bc.value && bc.value.cA === true);
 }
 
+/** @internal RFC 7633 sec. 4.2.2, the one requirement in that document decidable from certificate
+ * bytes: "a certificate that is signed by a Certificate Signing Certificate that contains a TLS
+ * feature extension MUST contain a TLS feature extension that offers the same set or a superset of
+ * the features advertised in the signing certificate." The clause's own gate is the issuer's key
+ * usage, "Certification Authority certificate with the key usage extension value set to
+ * keyCertSign", which is a different question from its basicConstraints cA bit, so this asks
+ * keyUsage. A subject carrying NO extension under an issuer that advertises fails, because the
+ * clause says the subject MUST contain one; an issuer carrying none constrains nothing, so the
+ * constraint is one-directional.
+ *
+ * Set semantics. SEQUENCE OF fixes no order and forbids no repeat, so neither side's order nor its
+ * multiplicity may be read as meaning, and the comparison cannot stop at a first match.
+ *
+ * Returns null when there is nothing to check, so a boundary that was not checked reports no row
+ * rather than a passing one.
+ *
+ * The anchor is not read. `anchorFromCert` keeps the name, key and algorithm and drops the
+ * certificate's extensions, so a trust anchor's own advertised features cannot reach this and the
+ * rule is applied from the first certificate in the path downward. An anchor that advertises
+ * features constrains nothing here, which is stated rather than implied. */
+function tlsFeatureChainCheck(issuerCert, cert) {
+  if (!issuerCert) return null;
+  var issuerKu;
+  try { issuerKu = decodeExt(issuerCert, OID.keyUsage); }
+  // allow:swallow-unverified a keyUsage that cannot be read is refused by its own check on that certificate
+  catch (_e) { return null; }
+  if (!(issuerKu && issuerKu.value && issuerKu.value.keyCertSign === true)) return null;
+  var issuerFeatures;
+  try { issuerFeatures = decodeExt(issuerCert, OID.tlsFeature); }
+  catch (e) { return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-tls-feature") }); }
+  if (!issuerFeatures) return null;
+  /** @internal The subject's extension is read BEFORE the issuer's set is looked at, because the
+   * clause is two requirements and the first one does not mention the set: a certificate signed by a
+   * signing certificate that CONTAINS the extension MUST CONTAIN one, and what it contains must then
+   * cover the issuer's features. Testing the set first read an issuer whose Features list is EMPTY as
+   * nothing to require and returned success for a subject that carried no extension at all, which the
+   * MUST CONTAIN half forbids; it also meant a malformed subject value under such an issuer was never
+   * decoded. An empty SEQUENCE is a conforming Features, the syntax carrying no SIZE constraint. */
+  var offeredExt;
+  try { offeredExt = decodeExt(cert, OID.tlsFeature); }
+  catch (e) { return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-tls-feature") }); }
+  if (!offeredExt) return guard.verdict.of({ ok: false, code: "path/tls-feature-not-offered" });
+  var required = (issuerFeatures.value && issuerFeatures.value.features) || [];
+  if (!required.length) return guard.verdict.of({ ok: true });
+  var offered = (offeredExt.value && offeredExt.value.features) || [];
+  /** @internal Membership through a set rather than a scan of the offered list per required value.
+   * Both lists come off untrusted certificates and the syntax bounds neither, so the pairwise form is
+   * work an issuer and a subject choose together: MEASURED, 20000 values on each side is 4 x 10^8
+   * comparisons, synchronous, on a path whose signatures may already have failed. A set makes it
+   * linear in the two lengths, and the values are bigints, which a set compares by value. */
+  var offeredSet = new intrinsic.Set();
+  for (var j = 0; j < offered.length; j++) intrinsic.setAdd(offeredSet, offered[j]);
+  for (var i = 0; i < required.length; i++) {
+    if (!intrinsic.setHas(offeredSet, required[i])) {
+      return guard.verdict.of({ ok: false, code: "path/tls-feature-not-offered" });
+    }
+  }
+  return guard.verdict.of({ ok: true });
+}
+
 function statefulHbsKeyUsageCheck(cert, isCa) {
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
@@ -1549,6 +1619,16 @@ async function _validate(path, opts, run, scope) {
     guard.list.append(checks,{ name: "nameChaining", ok: chainOk === true, code: chainOk === true ? undefined : "path/name-chaining" });
     if (chainOk !== true) failed = true;
 
+    /** @internal In the loop body, so it runs at EVERY issuer-to-subject boundary rather than only at
+     * the target: RFC 7633 sec. 4.2.2 constrains each certificate against the one that signed it. The
+     * issuer is the previous entry, which is `null` for the first certificate because the anchor's
+     * extensions are not part of the path. */
+    var tfRes = tlsFeatureChainCheck(idx > 0 ? certs[idx - 1] : null, cert);
+    if (tfRes) {
+      guard.list.append(checks, { name: "tlsFeatureChain", ok: tfRes.ok, code: tfRes.ok ? undefined : tfRes.code });
+      if (!tfRes.ok) failed = true;
+    }
+
     if (!(selfIssued(cert) && i !== n)) {
       var ncRes;
       try { ncRes = checkNameConstraints(state, cert); }
@@ -3146,16 +3226,20 @@ async function _fetchAiaIssuers(current, aia) {
     if (ad.accessMethod !== OID.caIssuers) continue;
     if (!ad.accessLocation || ad.accessLocation.tag !== 6) continue;
     var u;
-    try { u = new URL(ad.accessLocation.value); }
+    try { u = new _URL(ad.accessLocation.value); }
     catch (_e) { continue; }
-    if (u.protocol !== "https:") continue;
-    if (_isBlockedAiaHost(u.hostname)) continue;
-    if (net.isIP(_stripBrackets(u.hostname)) === 0 && !aia.transportGuardsAddresses) continue;
-    u.hash = "";
-    if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;
+    if (_urlProtocol(u) !== "https:") continue;
+    /** @internal The host read ONCE and both address tests applied to that one string: the blocklist
+     * and the literal-versus-name question have to be answered about the same host. */
+    var uHost = _urlHostname(u);
+    if (_isBlockedAiaHost(uHost)) continue;
+    if (net.isIP(_stripBrackets(uHost)) === 0 && !aia.transportGuardsAddresses) continue;
+    _urlSetHash(u, "");
+    var uHref = _urlHref(u);
+    if (intrinsic.setHas(aia.fetchedUrls, uHref) || intrinsic.setHas(seenThisCert, uHref)) continue;
     if (seenThisCert.size >= aia.maxPerCert) break;
-    intrinsic.setAdd(seenThisCert, u.href);
-    guard.list.append(uris, u.href);
+    intrinsic.setAdd(seenThisCert, uHref);
+    guard.list.append(uris, uHref);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {
@@ -3348,7 +3432,7 @@ async function build(leaf, opts) {
        * hostname taken from a certificate would be opened on that promise.
        * @guard-via guard.identifier.declaresOwn */
       transportGuardsAddresses: guard.identifier.declaresOwn(aiaTransport, "blocksPrivateAddresses"),
-      tls: opts.tls || {},
+      tls: opts.tls != null ? opts.tls : intrinsic.create(null),
       timeout: opts.aiaTimeout,
       maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "build: opts.maxResponseBytes", constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES, { E: E, code: "path/bad-input", min: 1, max: constants.LIMITS.PATH_AIA_MAX_RESPONSE_BYTES }),
       maxPerCert: guard.limits.cap(opts.maxAiaPerCert, "build: opts.maxAiaPerCert", constants.LIMITS.PATH_AIA_MAX_PER_CERT, { E: E, code: "path/bad-input", min: 0 }),

package/lib/pki-build.js

@@ -851,6 +851,39 @@ function makeBuilder(ctx) {
   }
   /** @internal InhibitAnyPolicy (RFC 5280 sec. 4.2.1.14): a bare SkipCerts INTEGER. */
   function extInhibitAnyPolicy(v) { return b.integer(skipCount(v, "inhibitAnyPolicy")); }
+  /** @internal Features (RFC 7633 sec. 4): `SEQUENCE OF INTEGER`, each a TLS ExtensionType value.
+   *  sec. 4.1 binds those values to the IANA TLS Extensions registry, so the registry names this
+   *  build knows are accepted beside the numbers, resolved through the one table `C.NAMES.TLS_FEATURE`
+   *  that `pki.inspect` prints them from rather than a second copy of it. The type states no range and
+   *  no ordering, so a value outside the registry's 16-bit width and a repeat both encode, and the
+   *  linter is what grades them: an encoder that dropped or sorted them would hide what it emitted
+   *  from the rule that reads it. An EMPTY list is refused here although the decoder accepts one on
+   *  the wire, because an empty Features advertises nothing and makes the extension inert, which is a
+   *  caller's typo rather than a document to read. */
+  function extTlsFeature(list) {
+    if (!_isArray(list) || !list.length) {
+      throw E("bad-input", "tlsFeature must name at least one TLS ExtensionType value (RFC 7633 sec. 4.1); " +
+        "an empty Features advertises nothing, so the extension it would emit is inert");
+    }
+    var dense = reqDenseArray(list, "tlsFeature");
+    return b.sequence(_mapIntrinsic(dense, function (f, i) {
+      return b.integer(tlsFeatureValue(f, "tlsFeature entry " + i));
+    }));
+  }
+  /** @internal A registry name resolved off the printing table, so the two directions cannot drift. */
+  function tlsFeatureValue(f, who) {
+    if (typeof f !== "string") {
+      return guard.range.authoredInteger(f, rawErr, ctx.prefix + "/bad-input", who);
+    }
+    var table = C.NAMES.TLS_FEATURE;
+    var keys = intrinsic.keys(table);
+    for (var i = 0; i < keys.length; i++) {
+      if (table[keys[i]] === f) return intrinsic.BigInt(keys[i]);
+    }
+    throw E("bad-input", who + " names no TLS ExtensionType this build knows: " + _stringify(f) +
+      " (accepted names: " + intrinsic.join(_mapIntrinsic(keys, function (k) { return table[k]; }), ", ") +
+      "; any other value is given as its number)");
+  }
   /** @internal PolicyMappings (RFC 5280 sec. 4.2.1.5): SEQUENCE SIZE (1..MAX) OF
    *  { issuerDomainPolicy, subjectDomainPolicy }. The clause forbids mapping either to or from
    *  anyPolicy, so neither side may name it. */
@@ -1282,6 +1315,7 @@ function makeBuilder(ctx) {
     nameConstraints: 1, authorityInfoAccess: 1, cRLDistributionPoints: 1, freshestCRL: 1,
     policyConstraints: 1, inhibitAnyPolicy: 1, policyMappings: 1, policyMappingsCritical: 1,
     issuerAltName: 1, qcStatements: 1, qcStatementsCritical: 1,
+    tlsFeature: 1, tlsFeatureCritical: 1,
     msCertificateTemplate: 1, msEnrollCertType: 1, msApplicationPolicies: 1,
     subjectInfoAccess: 1, subjectDirectoryAttributes: 1,
   };
@@ -1336,6 +1370,11 @@ function makeBuilder(ctx) {
     if (extSpec.policyMappings != null) guard.list.append(out, ext(O("policyMappings"), !!extSpec.policyMappingsCritical, extPolicyMappings(extSpec.policyMappings)));
     if (extSpec.issuerAltName != null) guard.list.append(out, ext(O("issuerAltName"), false, encodeGeneralNames(reqDenseArray(extSpec.issuerAltName, "issuerAltName"))));
     if (extSpec.qcStatements != null) guard.list.append(out, ext(O("qcStatements"), !!extSpec.qcStatementsCritical, extQcStatements(extSpec.qcStatements)));
+    /** @internal RFC 7633 sec. 4.2.1 lets a request state the features the server supports, and
+     *  sec. 4.3.2 asks a server to generate it, so a feature declaration is the requester's wish and
+     *  belongs in this table. The criticality knob is here too, because a request carries the
+     *  Extension shape whole and the CA decides what it issues. */
+    if (extSpec.tlsFeature != null) guard.list.append(out, ext(O("tlsFeature"), !!extSpec.tlsFeatureCritical, extTlsFeature(extSpec.tlsFeature)));
     if (extSpec.msCertificateTemplate != null) guard.list.append(out, ext(O("msCertificateTemplate"), false, extMsCertificateTemplate(extSpec.msCertificateTemplate)));
     if (extSpec.msEnrollCertType != null) guard.list.append(out, ext(O("msEnrollCertType"), false, extMsEnrollCertType(extSpec.msEnrollCertType)));
     if (extSpec.msApplicationPolicies != null) guard.list.append(out, ext(O("msApplicationPolicies"), false, extCertPolicies(extSpec.msApplicationPolicies)));
@@ -1395,6 +1434,7 @@ function makeBuilder(ctx) {
     extNameConstraints: extNameConstraints, extAuthorityInfoAccess: extAuthorityInfoAccess,
     extCrlDistributionPoints: extCrlDistributionPoints, extPolicyConstraints: extPolicyConstraints,
     extInhibitAnyPolicy: extInhibitAnyPolicy, extPolicyMappings: extPolicyMappings,
+    extTlsFeature: extTlsFeature,
     extQcStatements: extQcStatements,
     encodeGeneralNames: encodeGeneralNames, serialInteger: serialInteger, timeDer: timeDer,
     requestedExtensions: requestedExtensions,