@encharm/cws 4.1.0 → 4.2.0

package/src/headers/18/crypto/crypto_cipher.h

@@ -0,0 +1,291 @@
+#ifndef SRC_CRYPTO_CRYPTO_CIPHER_H_
+#define SRC_CRYPTO_CRYPTO_CIPHER_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "crypto/crypto_keys.h"
+#include "crypto/crypto_util.h"
+#include "base_object.h"
+#include "env.h"
+#include "memory_tracker.h"
+#include "v8.h"
+
+#include <string>
+
+namespace node {
+namespace crypto {
+class CipherBase : public BaseObject {
+ public:
+  static void GetSSLCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(CipherBase)
+  SET_SELF_SIZE(CipherBase)
+
+ protected:
+  enum CipherKind {
+    kCipher,
+    kDecipher
+  };
+  enum UpdateResult {
+    kSuccess,
+    kErrorMessageSize,
+    kErrorState
+  };
+  enum AuthTagState {
+    kAuthTagUnknown,
+    kAuthTagKnown,
+    kAuthTagPassedToOpenSSL
+  };
+  static const unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
+
+  void CommonInit(const char* cipher_type,
+                  const EVP_CIPHER* cipher,
+                  const unsigned char* key,
+                  int key_len,
+                  const unsigned char* iv,
+                  int iv_len,
+                  unsigned int auth_tag_len);
+  void Init(const char* cipher_type,
+            const ArrayBufferOrViewContents<unsigned char>& key_buf,
+            unsigned int auth_tag_len);
+  void InitIv(const char* cipher_type,
+              const ByteSource& key_buf,
+              const ArrayBufferOrViewContents<unsigned char>& iv_buf,
+              unsigned int auth_tag_len);
+  bool InitAuthenticated(const char* cipher_type, int iv_len,
+                         unsigned int auth_tag_len);
+  bool CheckCCMMessageLength(int message_len);
+  UpdateResult Update(const char* data, size_t len,
+                      std::unique_ptr<v8::BackingStore>* out);
+  bool Final(std::unique_ptr<v8::BackingStore>* out);
+  bool SetAutoPadding(bool auto_padding);
+
+  bool IsAuthenticatedMode() const;
+  bool SetAAD(
+      const ArrayBufferOrViewContents<unsigned char>& data,
+      int plaintext_len);
+  bool MaybePassAuthTagToOpenSSL();
+
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Init(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void InitIv(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Update(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Final(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetAutoPadding(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  static void GetAuthTag(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetAuthTag(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetAAD(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  CipherBase(Environment* env, v8::Local<v8::Object> wrap, CipherKind kind);
+
+ private:
+  DeleteFnPtr<EVP_CIPHER_CTX, EVP_CIPHER_CTX_free> ctx_;
+  const CipherKind kind_;
+  AuthTagState auth_tag_state_;
+  unsigned int auth_tag_len_;
+  char auth_tag_[EVP_GCM_TLS_TAG_LEN];
+  bool pending_auth_failed_;
+  int max_message_size_;
+};
+
+class PublicKeyCipher {
+ public:
+  typedef int (*EVP_PKEY_cipher_init_t)(EVP_PKEY_CTX* ctx);
+  typedef int (*EVP_PKEY_cipher_t)(EVP_PKEY_CTX* ctx,
+                                   unsigned char* out, size_t* outlen,
+                                   const unsigned char* in, size_t inlen);
+
+  enum Operation {
+    kPublic,
+    kPrivate
+  };
+
+  template <Operation operation,
+            EVP_PKEY_cipher_init_t EVP_PKEY_cipher_init,
+            EVP_PKEY_cipher_t EVP_PKEY_cipher>
+  static bool Cipher(Environment* env,
+                     const ManagedEVPPKey& pkey,
+                     int padding,
+                     const EVP_MD* digest,
+                     const ArrayBufferOrViewContents<unsigned char>& oaep_label,
+                     const ArrayBufferOrViewContents<unsigned char>& data,
+                     std::unique_ptr<v8::BackingStore>* out);
+
+  template <Operation operation,
+            EVP_PKEY_cipher_init_t EVP_PKEY_cipher_init,
+            EVP_PKEY_cipher_t EVP_PKEY_cipher>
+  static void Cipher(const v8::FunctionCallbackInfo<v8::Value>& args);
+};
+
+enum WebCryptoCipherMode {
+  kWebCryptoCipherEncrypt,
+  kWebCryptoCipherDecrypt
+};
+
+enum class WebCryptoCipherStatus {
+  OK,
+  INVALID_KEY_TYPE,
+  FAILED
+};
+
+// CipherJob is a base implementation class for implementations of
+// one-shot sync and async ciphers. It has been added primarily to
+// support the AES and RSA ciphers underlying the WebCrypt API.
+//
+// See the crypto_aes and crypto_rsa headers for examples of how to
+// use CipherJob.
+template <typename CipherTraits>
+class CipherJob final : public CryptoJob<CipherTraits> {
+ public:
+  using AdditionalParams = typename CipherTraits::AdditionalParameters;
+
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args) {
+    Environment* env = Environment::GetCurrent(args);
+    CHECK(args.IsConstructCall());
+
+    CryptoJobMode mode = GetCryptoJobMode(args[0]);
+
+    CHECK(args[1]->IsUint32());  // Cipher Mode
+
+    uint32_t cmode = args[1].As<v8::Uint32>()->Value();
+    CHECK_LE(cmode, WebCryptoCipherMode::kWebCryptoCipherDecrypt);
+    WebCryptoCipherMode cipher_mode = static_cast<WebCryptoCipherMode>(cmode);
+
+    CHECK(args[2]->IsObject());  // KeyObject
+    KeyObjectHandle* key;
+    ASSIGN_OR_RETURN_UNWRAP(&key, args[2]);
+    CHECK_NOT_NULL(key);
+
+    ArrayBufferOrViewContents<char> data(args[3]);  // data to operate on
+    if (!data.CheckSizeInt32())
+      return THROW_ERR_OUT_OF_RANGE(env, "data is too large");
+
+    AdditionalParams params;
+    if (CipherTraits::AdditionalConfig(mode, args, 4, cipher_mode, &params)
+            .IsNothing()) {
+      // The CipherTraits::AdditionalConfig is responsible for
+      // calling an appropriate THROW_CRYPTO_* variant reporting
+      // whatever error caused initialization to fail.
+      return;
+    }
+
+    new CipherJob<CipherTraits>(
+        env,
+        args.This(),
+        mode,
+        key,
+        cipher_mode,
+        data,
+        std::move(params));
+  }
+
+  static void Initialize(
+      Environment* env,
+      v8::Local<v8::Object> target) {
+    CryptoJob<CipherTraits>::Initialize(New, env, target);
+  }
+
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+    CryptoJob<CipherTraits>::RegisterExternalReferences(New, registry);
+  }
+
+  CipherJob(
+      Environment* env,
+      v8::Local<v8::Object> object,
+      CryptoJobMode mode,
+      KeyObjectHandle* key,
+      WebCryptoCipherMode cipher_mode,
+      const ArrayBufferOrViewContents<char>& data,
+      AdditionalParams&& params)
+      : CryptoJob<CipherTraits>(
+            env,
+            object,
+            AsyncWrap::PROVIDER_CIPHERREQUEST,
+            mode,
+            std::move(params)),
+        key_(key->Data()),
+        cipher_mode_(cipher_mode),
+        in_(mode == kCryptoJobAsync
+            ? data.ToCopy()
+            : data.ToByteSource()) {}
+
+  std::shared_ptr<KeyObjectData> key() const { return key_; }
+
+  WebCryptoCipherMode cipher_mode() const { return cipher_mode_; }
+
+  void DoThreadPoolWork() override {
+    const WebCryptoCipherStatus status =
+        CipherTraits::DoCipher(
+            AsyncWrap::env(),
+            key(),
+            cipher_mode_,
+            *CryptoJob<CipherTraits>::params(),
+            in_,
+            &out_);
+    if (status == WebCryptoCipherStatus::OK) {
+      // Success!
+      return;
+    }
+    CryptoErrorStore* errors = CryptoJob<CipherTraits>::errors();
+    errors->Capture();
+    if (errors->Empty()) {
+      switch (status) {
+        case WebCryptoCipherStatus::OK:
+          UNREACHABLE();
+          break;
+        case WebCryptoCipherStatus::INVALID_KEY_TYPE:
+          errors->Insert(NodeCryptoError::INVALID_KEY_TYPE);
+          break;
+        case WebCryptoCipherStatus::FAILED:
+          errors->Insert(NodeCryptoError::CIPHER_JOB_FAILED);
+          break;
+      }
+    }
+  }
+
+  v8::Maybe<bool> ToResult(
+      v8::Local<v8::Value>* err,
+      v8::Local<v8::Value>* result) override {
+    Environment* env = AsyncWrap::env();
+    CryptoErrorStore* errors = CryptoJob<CipherTraits>::errors();
+
+    if (errors->Empty())
+      errors->Capture();
+
+    if (out_.size() > 0 || errors->Empty()) {
+      CHECK(errors->Empty());
+      *err = v8::Undefined(env->isolate());
+      *result = out_.ToArrayBuffer(env);
+      return v8::Just(!result->IsEmpty());
+    }
+
+    *result = v8::Undefined(env->isolate());
+    return v8::Just(errors->ToException(env).ToLocal(err));
+  }
+
+  SET_SELF_SIZE(CipherJob)
+  void MemoryInfo(MemoryTracker* tracker) const override {
+    if (CryptoJob<CipherTraits>::mode() == kCryptoJobAsync)
+      tracker->TrackFieldWithSize("in", in_.size());
+    tracker->TrackFieldWithSize("out", out_.size());
+    CryptoJob<CipherTraits>::MemoryInfo(tracker);
+  }
+
+ private:
+  std::shared_ptr<KeyObjectData> key_;
+  WebCryptoCipherMode cipher_mode_;
+  ByteSource in_;
+  ByteSource out_;
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_CIPHER_H_

package/src/headers/{13/node_crypto_clienthello-inl.h → 18/crypto/crypto_clienthello-inl.h}

@@ -19,17 +19,16 @@
 // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-#ifndef SRC_NODE_CRYPTO_CLIENTHELLO_INL_H_
-#define SRC_NODE_CRYPTO_CLIENTHELLO_INL_H_
+#ifndef SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
+#define SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include "node_crypto_clienthello.h"
+#include "crypto/crypto_clienthello.h"
 #include "util.h"
 
 namespace node {
 namespace crypto {
-
 inline ClientHelloParser::ClientHelloParser()
     : state_(kEnded),
       onhello_cb_(nullptr),
@@ -88,4 +87,4 @@ inline bool ClientHelloParser::IsPaused() const {
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#endif  // SRC_NODE_CRYPTO_CLIENTHELLO_INL_H_
+#endif  // SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_

package/src/headers/{13/node_crypto_clienthello.h → 18/crypto/crypto_clienthello.h}

@@ -19,8 +19,8 @@
 // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-#ifndef SRC_NODE_CRYPTO_CLIENTHELLO_H_
-#define SRC_NODE_CRYPTO_CLIENTHELLO_H_
+#ifndef SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
+#define SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
@@ -29,7 +29,6 @@
 
 namespace node {
 namespace crypto {
-
 // Parse the client hello so we can do async session resumption. OpenSSL's
 // session resumption uses synchronous callbacks, see SSL_CTX_sess_set_get_cb
 // and get_session_cb.
@@ -129,4 +128,4 @@ class ClientHelloParser {
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#endif  // SRC_NODE_CRYPTO_CLIENTHELLO_H_
+#endif  // SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_

package/src/headers/{12/node_crypto_common.h → 18/crypto/crypto_common.h}

@@ -1,5 +1,5 @@
-#ifndef SRC_NODE_CRYPTO_COMMON_H_
-#define SRC_NODE_CRYPTO_COMMON_H_
+#ifndef SRC_CRYPTO_CRYPTO_COMMON_H_
+#define SRC_CRYPTO_CRYPTO_COMMON_H_
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
@@ -9,17 +9,10 @@
 #include <openssl/x509v3.h>
 
 #include <string>
-#include <unordered_map>
 
 namespace node {
 namespace crypto {
 
-// OPENSSL_free is a macro, so we need a wrapper function.
-struct OpenSSLBufferDeleter {
-  void operator()(char* pointer) const { OPENSSL_free(pointer); }
-};
-using OpenSSLBuffer = std::unique_ptr<char[], OpenSSLBufferDeleter>;
-
 struct StackOfX509Deleter {
   void operator()(STACK_OF(X509)* p) const { sk_X509_pop_free(p, X509_free); }
 };
@@ -32,7 +25,7 @@ struct StackOfXASN1Deleter {
 };
 using StackOfASN1 = std::unique_ptr<STACK_OF(ASN1_OBJECT), StackOfXASN1Deleter>;
 
-int SSL_CTX_get_issuer(SSL_CTX* ctx, X509* cert, X509** issuer);
+X509Pointer SSL_CTX_get_issuer(SSL_CTX* ctx, X509* cert);
 
 void LogSecret(
     const SSLPointer& ssl,
@@ -49,29 +42,17 @@ v8::MaybeLocal<v8::Value> GetSSLOCSPResponse(
     SSL* ssl,
     v8::Local<v8::Value> default_value);
 
-bool SetTLSSession(
-    const SSLPointer& ssl,
-    const unsigned char* buf,
-    size_t length);
-
 bool SetTLSSession(
     const SSLPointer& ssl,
     const SSLSessionPointer& session);
 
-SSLSessionPointer GetTLSSession(v8::Local<v8::Value> val);
-
 SSLSessionPointer GetTLSSession(const unsigned char* buf, size_t length);
 
-std::unordered_multimap<std::string, std::string>
-GetCertificateAltNames(X509* cert);
-
-std::string GetCertificateCN(X509* cert);
-
 long VerifyPeerCertificate(  // NOLINT(runtime/int)
     const SSLPointer& ssl,
     long def = X509_V_ERR_UNSPECIFIED);  // NOLINT(runtime/int)
 
-int UseSNIContext(const SSLPointer& ssl, BaseObjectPtr<SecureContext> context);
+bool UseSNIContext(const SSLPointer& ssl, BaseObjectPtr<SecureContext> context);
 
 const char* GetClientHelloALPN(const SSLPointer& ssl);
 
@@ -93,18 +74,6 @@ v8::MaybeLocal<v8::Value> GetValidationErrorCode(Environment* env, int err);
 
 v8::MaybeLocal<v8::Value> GetCert(Environment* env, const SSLPointer& ssl);
 
-v8::MaybeLocal<v8::Value> GetCipherName(
-    Environment* env,
-    const SSLPointer& ssl);
-
-v8::MaybeLocal<v8::Value> GetCipherStandardName(
-    Environment* env,
-    const SSLPointer& ssl);
-
-v8::MaybeLocal<v8::Value> GetCipherVersion(
-    Environment* env,
-    const SSLPointer& ssl);
-
 v8::MaybeLocal<v8::Object> GetCipherInfo(
     Environment* env,
     const SSLPointer& ssl);
@@ -130,9 +99,53 @@ v8::MaybeLocal<v8::Object> X509ToObject(
     Environment* env,
     X509* cert);
 
+v8::MaybeLocal<v8::Value> GetValidTo(
+    Environment* env,
+    X509* cert,
+    const BIOPointer& bio);
+
+v8::MaybeLocal<v8::Value> GetValidFrom(
+    Environment* env,
+    X509* cert,
+    const BIOPointer& bio);
+
+v8::MaybeLocal<v8::Value> GetFingerprintDigest(
+    Environment* env,
+    const EVP_MD* method,
+    X509* cert);
+
+v8::MaybeLocal<v8::Value> GetKeyUsage(Environment* env, X509* cert);
+
+v8::MaybeLocal<v8::Value> GetSerialNumber(Environment* env, X509* cert);
+
+v8::MaybeLocal<v8::Object> GetRawDERCertificate(Environment* env, X509* cert);
+
+v8::Local<v8::Value> ToV8Value(Environment* env, const BIOPointer& bio);
+bool SafeX509SubjectAltNamePrint(const BIOPointer& out, X509_EXTENSION* ext);
+
+v8::MaybeLocal<v8::Value> GetSubject(
+    Environment* env,
+    const BIOPointer& bio,
+    X509* cert);
+
+v8::MaybeLocal<v8::Value> GetIssuerString(
+    Environment* env,
+    const BIOPointer& bio,
+    X509* cert);
+
+v8::MaybeLocal<v8::Value> GetSubjectAltNameString(
+    Environment* env,
+    const BIOPointer& bio,
+    X509* cert);
+
+v8::MaybeLocal<v8::Value> GetInfoAccessString(
+    Environment* env,
+    const BIOPointer& bio,
+    X509* cert);
+
 }  // namespace crypto
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#endif  // SRC_NODE_CRYPTO_COMMON_H_
+#endif  // SRC_CRYPTO_CRYPTO_COMMON_H_

package/src/headers/18/crypto/crypto_context.h

@@ -0,0 +1,147 @@
+#ifndef SRC_CRYPTO_CRYPTO_CONTEXT_H_
+#define SRC_CRYPTO_CRYPTO_CONTEXT_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "crypto/crypto_util.h"
+#include "base_object.h"
+#include "env.h"
+#include "memory_tracker.h"
+#include "v8.h"
+
+namespace node {
+namespace crypto {
+// A maxVersion of 0 means "any", but OpenSSL may support TLS versions that
+// Node.js doesn't, so pin the max to what we do support.
+constexpr int kMaxSupportedVersion = TLS1_3_VERSION;
+
+void GetRootCertificates(
+    const v8::FunctionCallbackInfo<v8::Value>& args);
+
+void IsExtraRootCertsFileLoaded(
+    const v8::FunctionCallbackInfo<v8::Value>& args);
+
+X509_STORE* NewRootCertStore();
+
+BIOPointer LoadBIO(Environment* env, v8::Local<v8::Value> v);
+
+class SecureContext final : public BaseObject {
+ public:
+  using GetSessionCb = SSL_SESSION* (*)(SSL*, const unsigned char*, int, int*);
+  using KeylogCb = void (*)(const SSL*, const char*);
+  using NewSessionCb = int (*)(SSL*, SSL_SESSION*);
+  using SelectSNIContextCb = int (*)(SSL*, int*, void*);
+
+  ~SecureContext() override;
+
+  static bool HasInstance(Environment* env, const v8::Local<v8::Value>& value);
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+  static SecureContext* Create(Environment* env);
+
+  const SSLCtxPointer& ctx() const { return ctx_; }
+
+  SSLPointer CreateSSL();
+
+  void SetGetSessionCallback(GetSessionCb cb);
+  void SetKeylogCallback(KeylogCb cb);
+  void SetNewSessionCallback(NewSessionCb cb);
+  void SetSelectSNIContextCallback(SelectSNIContextCb cb);
+
+  // TODO(joyeecheung): track the memory used by OpenSSL types
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(SecureContext)
+  SET_SELF_SIZE(SecureContext)
+
+  static const int kMaxSessionSize = 10 * 1024;
+
+  // See TicketKeyCallback
+  static const int kTicketKeyReturnIndex = 0;
+  static const int kTicketKeyHMACIndex = 1;
+  static const int kTicketKeyAESIndex = 2;
+  static const int kTicketKeyNameIndex = 3;
+  static const int kTicketKeyIVIndex = 4;
+
+ protected:
+  // OpenSSL structures are opaque. This is sizeof(SSL_CTX) for OpenSSL 1.1.1b:
+  static const int64_t kExternalSize = 1024;
+
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Init(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetKey(const v8::FunctionCallbackInfo<v8::Value>& args);
+#ifndef OPENSSL_NO_ENGINE
+  static void SetEngineKey(const v8::FunctionCallbackInfo<v8::Value>& args);
+#endif  // !OPENSSL_NO_ENGINE
+  static void SetCert(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void AddCACert(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void AddCRL(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void AddRootCerts(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetCipherSuites(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetSigalgs(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetECDHCurve(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetDHParam(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetOptions(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetSessionIdContext(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetSessionTimeout(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetMinProto(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetMaxProto(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMinProto(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMaxProto(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Close(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void LoadPKCS12(const v8::FunctionCallbackInfo<v8::Value>& args);
+#ifndef OPENSSL_NO_ENGINE
+  static void SetClientCertEngine(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+#endif  // !OPENSSL_NO_ENGINE
+  static void GetTicketKeys(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetTicketKeys(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetFreeListLength(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void EnableTicketKeyCallback(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void CtxGetter(const v8::FunctionCallbackInfo<v8::Value>& info);
+
+  template <bool primary>
+  static void GetCertificate(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  static int TicketKeyCallback(SSL* ssl,
+                               unsigned char* name,
+                               unsigned char* iv,
+                               EVP_CIPHER_CTX* ectx,
+                               HMAC_CTX* hctx,
+                               int enc);
+
+  static int TicketCompatibilityCallback(SSL* ssl,
+                                         unsigned char* name,
+                                         unsigned char* iv,
+                                         EVP_CIPHER_CTX* ectx,
+                                         HMAC_CTX* hctx,
+                                         int enc);
+
+  SecureContext(Environment* env, v8::Local<v8::Object> wrap);
+  void Reset();
+
+ private:
+  SSLCtxPointer ctx_;
+  X509Pointer cert_;
+  X509Pointer issuer_;
+#ifndef OPENSSL_NO_ENGINE
+  bool client_cert_engine_provided_ = false;
+  EnginePointer private_key_engine_;
+#endif  // !OPENSSL_NO_ENGINE
+
+  unsigned char ticket_key_name_[16];
+  unsigned char ticket_key_aes_[16];
+  unsigned char ticket_key_hmac_[16];
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_CONTEXT_H_