@encharm/cws 4.4.1 → 4.5.2

package/src/headers/24/crypto/crypto_ml_dsa.h

@@ -0,0 +1,21 @@
+#ifndef SRC_CRYPTO_CRYPTO_ML_DSA_H_
+#define SRC_CRYPTO_CRYPTO_ML_DSA_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "crypto/crypto_keys.h"
+#include "env.h"
+#include "v8.h"
+
+namespace node {
+namespace crypto {
+#if OPENSSL_WITH_PQC
+bool ExportJwkMlDsaKey(Environment* env,
+                       const KeyObjectData& key,
+                       v8::Local<v8::Object> target);
+#endif
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_ML_DSA_H_

package/src/headers/{18 → 24}/crypto/crypto_pbkdf2.h

@@ -30,7 +30,7 @@ struct PBKDF2Config final : public MemoryRetainer {
   ByteSource salt;
   int32_t iterations;
   int32_t length;
-  const EVP_MD* digest = nullptr;
+  ncrypto::Digest digest;
 
   PBKDF2Config() = default;
 
@@ -49,22 +49,20 @@ struct PBKDF2Traits final {
   static constexpr AsyncWrap::ProviderType Provider =
       AsyncWrap::PROVIDER_PBKDF2REQUEST;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int offset,
       PBKDF2Config* params);
 
-  static bool DeriveBits(
-      Environment* env,
-      const PBKDF2Config& params,
-      ByteSource* out);
+  static bool DeriveBits(Environment* env,
+                         const PBKDF2Config& params,
+                         ByteSource* out,
+                         CryptoJobMode mode);
 
-  static v8::Maybe<bool> EncodeOutput(
-      Environment* env,
-      const PBKDF2Config& params,
-      ByteSource* out,
-      v8::Local<v8::Value>* result);
+  static v8::MaybeLocal<v8::Value> EncodeOutput(Environment* env,
+                                                const PBKDF2Config& params,
+                                                ByteSource* out);
 };
 
 using PBKDF2Job = DeriveBitsJob<PBKDF2Traits>;

package/src/headers/{18 → 24}/crypto/crypto_random.h

@@ -26,30 +26,28 @@ struct RandomBytesTraits final {
   static constexpr AsyncWrap::ProviderType Provider =
       AsyncWrap::PROVIDER_RANDOMBYTESREQUEST;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int offset,
       RandomBytesConfig* params);
 
-  static bool DeriveBits(
-      Environment* env,
-      const RandomBytesConfig& params,
-      ByteSource* out_);
+  static bool DeriveBits(Environment* env,
+                         const RandomBytesConfig& params,
+                         ByteSource* out_,
+                         CryptoJobMode mode);
 
-  static v8::Maybe<bool> EncodeOutput(
-      Environment* env,
-      const RandomBytesConfig& params,
-      ByteSource* unused,
-      v8::Local<v8::Value>* result);
+  static v8::MaybeLocal<v8::Value> EncodeOutput(Environment* env,
+                                                const RandomBytesConfig& params,
+                                                ByteSource* unused);
 };
 
 using RandomBytesJob = DeriveBitsJob<RandomBytesTraits>;
 
 struct RandomPrimeConfig final : public MemoryRetainer {
-  BignumPointer prime;
-  BignumPointer rem;
-  BignumPointer add;
+  ncrypto::BignumPointer prime;
+  ncrypto::BignumPointer rem;
+  ncrypto::BignumPointer add;
   int bits;
   bool safe;
   void MemoryInfo(MemoryTracker* tracker) const override;
@@ -63,28 +61,26 @@ struct RandomPrimeTraits final {
   static constexpr AsyncWrap::ProviderType Provider =
       AsyncWrap::PROVIDER_RANDOMPRIMEREQUEST;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int offset,
       RandomPrimeConfig* params);
 
-  static bool DeriveBits(
-      Environment* env,
-      const RandomPrimeConfig& params,
-      ByteSource* out_);
+  static bool DeriveBits(Environment* env,
+                         const RandomPrimeConfig& params,
+                         ByteSource* out_,
+                         CryptoJobMode mode);
 
-  static v8::Maybe<bool> EncodeOutput(
-      Environment* env,
-      const RandomPrimeConfig& params,
-      ByteSource* unused,
-      v8::Local<v8::Value>* result);
+  static v8::MaybeLocal<v8::Value> EncodeOutput(Environment* env,
+                                                const RandomPrimeConfig& params,
+                                                ByteSource* unused);
 };
 
 using RandomPrimeJob = DeriveBitsJob<RandomPrimeTraits>;
 
 struct CheckPrimeConfig final : public MemoryRetainer {
-  BignumPointer candidate;
+  ncrypto::BignumPointer candidate;
   int checks = 1;
 
   void MemoryInfo(MemoryTracker* tracker) const override;
@@ -99,22 +95,20 @@ struct CheckPrimeTraits final {
   static constexpr AsyncWrap::ProviderType Provider =
       AsyncWrap::PROVIDER_CHECKPRIMEREQUEST;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int offset,
       CheckPrimeConfig* params);
 
-  static bool DeriveBits(
-      Environment* env,
-      const CheckPrimeConfig& params,
-      ByteSource* out);
+  static bool DeriveBits(Environment* env,
+                         const CheckPrimeConfig& params,
+                         ByteSource* out,
+                         CryptoJobMode mode);
 
-  static v8::Maybe<bool> EncodeOutput(
-      Environment* env,
-      const CheckPrimeConfig& params,
-      ByteSource* out,
-      v8::Local<v8::Value>* result);
+  static v8::MaybeLocal<v8::Value> EncodeOutput(Environment* env,
+                                                const CheckPrimeConfig& params,
+                                                ByteSource* out);
 };
 
 using CheckPrimeJob = DeriveBitsJob<CheckPrimeTraits>;

package/src/headers/{18 → 24}/crypto/crypto_rsa.h

@@ -26,8 +26,8 @@ struct RsaKeyPairParams final : public MemoryRetainer {
 
   // The following options are used for RSA-PSS. If any of them are set, a
   // RSASSA-PSS-params sequence will be added to the key.
-  const EVP_MD* md = nullptr;
-  const EVP_MD* mgf1_md = nullptr;
+  ncrypto::Digest md = nullptr;
+  ncrypto::Digest mgf1_md = nullptr;
   int saltlen = -1;
 
   SET_NO_MEMORY_INFO()
@@ -41,9 +41,9 @@ struct RsaKeyGenTraits final {
   using AdditionalParameters = RsaKeyPairGenConfig;
   static constexpr const char* JobName = "RsaKeyPairGenJob";
 
-  static EVPKeyCtxPointer Setup(RsaKeyPairGenConfig* params);
+  static ncrypto::EVPKeyCtxPointer Setup(RsaKeyPairGenConfig* params);
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int* offset,
@@ -63,25 +63,24 @@ struct RSAKeyExportTraits final {
   static constexpr const char* JobName = "RSAKeyExportJob";
   using AdditionalParameters = RSAKeyExportConfig;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int offset,
       RSAKeyExportConfig* config);
 
-  static WebCryptoKeyExportStatus DoExport(
-      std::shared_ptr<KeyObjectData> key_data,
-      WebCryptoKeyFormat format,
-      const RSAKeyExportConfig& params,
-      ByteSource* out);
+  static WebCryptoKeyExportStatus DoExport(const KeyObjectData& key_data,
+                                           WebCryptoKeyFormat format,
+                                           const RSAKeyExportConfig& params,
+                                           ByteSource* out);
 };
 
 using RSAKeyExportJob = KeyExportJob<RSAKeyExportTraits>;
 
 struct RSACipherConfig final : public MemoryRetainer {
-  CryptoJobMode mode;
+  CryptoJobMode mode = kCryptoJobAsync;
   ByteSource label;
   int padding = 0;
-  const EVP_MD* digest = nullptr;
+  ncrypto::Digest digest;
 
   RSACipherConfig() = default;
 
@@ -96,39 +95,35 @@ struct RSACipherTraits final {
   static constexpr const char* JobName = "RSACipherJob";
   using AdditionalParameters = RSACipherConfig;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int offset,
       WebCryptoCipherMode cipher_mode,
       RSACipherConfig* config);
 
-  static WebCryptoCipherStatus DoCipher(
-      Environment* env,
-      std::shared_ptr<KeyObjectData> key_data,
-      WebCryptoCipherMode cipher_mode,
-      const RSACipherConfig& params,
-      const ByteSource& in,
-      ByteSource* out);
+  static WebCryptoCipherStatus DoCipher(Environment* env,
+                                        const KeyObjectData& key_data,
+                                        WebCryptoCipherMode cipher_mode,
+                                        const RSACipherConfig& params,
+                                        const ByteSource& in,
+                                        ByteSource* out);
 };
 
 using RSACipherJob = CipherJob<RSACipherTraits>;
 
-v8::Maybe<bool> ExportJWKRsaKey(
-    Environment* env,
-    std::shared_ptr<KeyObjectData> key,
-    v8::Local<v8::Object> target);
-
-std::shared_ptr<KeyObjectData> ImportJWKRsaKey(
-    Environment* env,
-    v8::Local<v8::Object> jwk,
-    const v8::FunctionCallbackInfo<v8::Value>& args,
-    unsigned int offset);
-
-v8::Maybe<bool> GetRsaKeyDetail(
-    Environment* env,
-    std::shared_ptr<KeyObjectData> key,
-    v8::Local<v8::Object> target);
+bool ExportJWKRsaKey(Environment* env,
+                     const KeyObjectData& key,
+                     v8::Local<v8::Object> target);
+
+KeyObjectData ImportJWKRsaKey(Environment* env,
+                              v8::Local<v8::Object> jwk,
+                              const v8::FunctionCallbackInfo<v8::Value>& args,
+                              unsigned int offset);
+
+bool GetRsaKeyDetail(Environment* env,
+                     const KeyObjectData& key,
+                     v8::Local<v8::Object> target);
 
 namespace RSAAlg {
 void Initialize(Environment* env, v8::Local<v8::Object> target);

package/src/headers/{18 → 24}/crypto/crypto_scrypt.h

@@ -51,22 +51,20 @@ struct ScryptTraits final {
   static constexpr AsyncWrap::ProviderType Provider =
       AsyncWrap::PROVIDER_SCRYPTREQUEST;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int offset,
       ScryptConfig* params);
 
-  static bool DeriveBits(
-      Environment* env,
-      const ScryptConfig& params,
-      ByteSource* out);
+  static bool DeriveBits(Environment* env,
+                         const ScryptConfig& params,
+                         ByteSource* out,
+                         CryptoJobMode mode);
 
-  static v8::Maybe<bool> EncodeOutput(
-      Environment* env,
-      const ScryptConfig& params,
-      ByteSource* out,
-      v8::Local<v8::Value>* result);
+  static v8::MaybeLocal<v8::Value> EncodeOutput(Environment* env,
+                                                const ScryptConfig& params,
+                                                ByteSource* out);
 };
 
 using ScryptJob = DeriveBitsJob<ScryptTraits>;

package/src/headers/{18 → 24}/crypto/crypto_sig.h

@@ -13,27 +13,24 @@ namespace node {
 namespace crypto {
 static const unsigned int kNoDsaSignature = static_cast<unsigned int>(-1);
 
-enum DSASigEnc {
-  kSigEncDER,
-  kSigEncP1363
-};
+enum class DSASigEnc { DER, P1363, Invalid };
 
 class SignBase : public BaseObject {
  public:
-  typedef enum {
-    kSignOk,
-    kSignUnknownDigest,
-    kSignInit,
-    kSignNotInitialised,
-    kSignUpdate,
-    kSignPrivateKey,
-    kSignPublicKey,
-    kSignMalformedSignature
-  } Error;
+  enum class Error {
+    Ok,
+    UnknownDigest,
+    Init,
+    NotInitialised,
+    Update,
+    PrivateKey,
+    PublicKey,
+    MalformedSignature
+  };
 
   SignBase(Environment* env, v8::Local<v8::Object> wrap);
 
-  Error Init(const char* sign_type);
+  Error Init(const char* digest);
   Error Update(const char* data, size_t len);
 
   // TODO(joyeecheung): track the memory used by OpenSSL types
@@ -42,10 +39,10 @@ class SignBase : public BaseObject {
   SET_SELF_SIZE(SignBase)
 
  protected:
-  EVPMDPointer mdctx_;
+  ncrypto::EVPMDCtxPointer mdctx_;
 };
 
-class Sign : public SignBase {
+class Sign final : public SignBase {
  public:
   static void Initialize(Environment* env, v8::Local<v8::Object> target);
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
@@ -54,17 +51,15 @@ class Sign : public SignBase {
     Error error;
     std::unique_ptr<v8::BackingStore> signature;
 
-    explicit SignResult(
-        Error err,
-        std::unique_ptr<v8::BackingStore>&& sig = nullptr)
-      : error(err), signature(std::move(sig)) {}
+    inline explicit SignResult(
+        Error err, std::unique_ptr<v8::BackingStore>&& sig = nullptr)
+        : error(err), signature(std::move(sig)) {}
   };
 
-  SignResult SignFinal(
-      const ManagedEVPPKey& pkey,
-      int padding,
-      const v8::Maybe<int>& saltlen,
-      DSASigEnc dsa_sig_enc);
+  SignResult SignFinal(const ncrypto::EVPKeyPointer& pkey,
+                       int padding,
+                       std::optional<int> saltlen,
+                       DSASigEnc dsa_sig_enc);
 
   static void SignSync(const v8::FunctionCallbackInfo<v8::Value>& args);
 
@@ -77,15 +72,15 @@ class Sign : public SignBase {
   Sign(Environment* env, v8::Local<v8::Object> wrap);
 };
 
-class Verify : public SignBase {
+class Verify final : public SignBase {
  public:
   static void Initialize(Environment* env, v8::Local<v8::Object> target);
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 
-  Error VerifyFinal(const ManagedEVPPKey& key,
+  Error VerifyFinal(const ncrypto::EVPKeyPointer& key,
                     const ByteSource& sig,
                     int padding,
-                    const v8::Maybe<int>& saltlen,
+                    std::optional<int> saltlen,
                     bool* verify_result);
 
   static void VerifySync(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -100,10 +95,7 @@ class Verify : public SignBase {
 };
 
 struct SignConfiguration final : public MemoryRetainer {
-  enum Mode {
-    kSign,
-    kVerify
-  };
+  enum class Mode { Sign, Verify };
   enum Flags {
     kHasNone = 0,
     kHasSaltLength = 1,
@@ -112,14 +104,14 @@ struct SignConfiguration final : public MemoryRetainer {
 
   CryptoJobMode job_mode;
   Mode mode;
-  ManagedEVPPKey key;
+  KeyObjectData key;
   ByteSource data;
   ByteSource signature;
-  const EVP_MD* digest = nullptr;
+  ncrypto::Digest digest;
   int flags = SignConfiguration::kHasNone;
   int padding = 0;
   int salt_length = 0;
-  DSASigEnc dsa_encoding = kSigEncDER;
+  DSASigEnc dsa_encoding = DSASigEnc::DER;
 
   SignConfiguration() = default;
 
@@ -136,27 +128,23 @@ struct SignTraits final {
   using AdditionalParameters = SignConfiguration;
   static constexpr const char* JobName = "SignJob";
 
-// TODO(@jasnell): Sign request vs. Verify request
-
   static constexpr AsyncWrap::ProviderType Provider =
       AsyncWrap::PROVIDER_SIGNREQUEST;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int offset,
       SignConfiguration* params);
 
-  static bool DeriveBits(
-      Environment* env,
-      const SignConfiguration& params,
-      ByteSource* out);
+  static bool DeriveBits(Environment* env,
+                         const SignConfiguration& params,
+                         ByteSource* out,
+                         CryptoJobMode mode);
 
-  static v8::Maybe<bool> EncodeOutput(
-      Environment* env,
-      const SignConfiguration& params,
-      ByteSource* out,
-      v8::Local<v8::Value>* result);
+  static v8::MaybeLocal<v8::Value> EncodeOutput(Environment* env,
+                                                const SignConfiguration& params,
+                                                ByteSource* out);
 };
 
 using SignJob = DeriveBitsJob<SignTraits>;

package/src/headers/{16 → 24}/crypto/crypto_tls.h

@@ -27,7 +27,6 @@
 #include "crypto/crypto_context.h"
 #include "crypto/crypto_clienthello.h"
 
-#include "allocated_buffer.h"
 #include "async_wrap.h"
 #include "stream_wrap.h"
 #include "v8.h"
@@ -35,6 +34,7 @@
 #include <openssl/ssl.h>
 
 #include <string>
+#include <vector>
 
 namespace node {
 namespace crypto {
@@ -48,22 +48,27 @@ class TLSWrap : public AsyncWrap,
     kServer
   };
 
+  enum class UnderlyingStreamWriteStatus { kHasActive, kVacancy };
+
   static void Initialize(v8::Local<v8::Object> target,
                          v8::Local<v8::Value> unused,
                          v8::Local<v8::Context> context,
                          void* priv);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 
   ~TLSWrap() override;
 
-  bool is_cert_cb_running() const { return cert_cb_running_; }
-  bool is_waiting_cert_cb() const { return cert_cb_ != nullptr; }
-  bool has_session_callbacks() const { return session_callbacks_; }
-  void set_cert_cb_running(bool on = true) { cert_cb_running_ = on; }
-  void set_awaiting_new_session(bool on = true) { awaiting_new_session_ = on; }
-  void enable_session_callbacks() { session_callbacks_ = true; }
-  bool is_server() const { return kind_ == Kind::kServer; }
-  bool is_client() const { return kind_ == Kind::kClient; }
-  bool is_awaiting_new_session() const { return awaiting_new_session_; }
+  inline bool is_cert_cb_running() const { return cert_cb_running_; }
+  inline bool is_waiting_cert_cb() const { return cert_cb_ != nullptr; }
+  inline bool has_session_callbacks() const { return session_callbacks_; }
+  inline void set_cert_cb_running(bool on = true) { cert_cb_running_ = on; }
+  inline void set_awaiting_new_session(bool on = true) {
+    awaiting_new_session_ = on;
+  }
+  inline void enable_session_callbacks() { session_callbacks_ = true; }
+  inline bool is_server() const { return kind_ == Kind::kServer; }
+  inline bool is_client() const { return kind_ == Kind::kClient; }
+  inline bool is_awaiting_new_session() const { return awaiting_new_session_; }
 
   // Implement StreamBase:
   bool IsAlive() override;
@@ -102,6 +107,7 @@ class TLSWrap : public AsyncWrap,
 
   std::string diagnostic_name() const override;
 
+ private:
   // OpenSSL structures are opaque. Estimate SSL memory size for OpenSSL 1.1.1b:
   //   SSL: 6224
   //   SSL->SSL3_STATE: 1040
@@ -124,7 +130,7 @@ class TLSWrap : public AsyncWrap,
 
   // Alternative to StreamListener::stream(), that returns a StreamBase instead
   // of a StreamResource.
-  StreamBase* underlying_stream() const {
+  inline StreamBase* underlying_stream() const {
     return static_cast<StreamBase*>(stream());
   }
 
@@ -134,7 +140,8 @@ class TLSWrap : public AsyncWrap,
           v8::Local<v8::Object> obj,
           Kind kind,
           StreamBase* stream,
-          SecureContext* sc);
+          SecureContext* sc,
+          UnderlyingStreamWriteStatus under_stream_ws);
 
   static void SSLInfoCallback(const SSL* ssl_, int where, int ret);
   void InitSSL();
@@ -165,13 +172,12 @@ class TLSWrap : public AsyncWrap,
 
   int SetCACerts(SecureContext* sc);
 
-  v8::MaybeLocal<v8::Value> GetSSLError(int status, int* err, std::string* msg);
-
   static int SelectSNIContextCallback(SSL* s, int* ad, void* arg);
 
   static void CertCbDone(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void DestroySSL(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableCertCb(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void EnableALPNCb(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableKeylogCallback(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableSessionCallbacks(
@@ -209,6 +215,7 @@ class TLSWrap : public AsyncWrap,
   static void Renegotiate(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void RequestOCSP(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetALPNProtocols(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetKeyCert(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetOCSPResponse(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetSession(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -216,6 +223,8 @@ class TLSWrap : public AsyncWrap,
   static void Start(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void VerifyError(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Wrap(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void WritesIssuedByPrevListenerDone(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
 
 #ifdef SSL_set_max_send_fragment
   static void SetMaxSendFragment(
@@ -241,8 +250,10 @@ class TLSWrap : public AsyncWrap,
 
   Environment* const env_;
   Kind kind_;
-  SSLSessionPointer next_sess_;
-  SSLPointer ssl_;
+  ncrypto::SSLSessionPointer next_sess_;
+public:
+  ncrypto::SSLPointer ssl_;
+private:
   ClientHelloParser hello_parser_;
   v8::Global<v8::ArrayBufferView> ocsp_response_;
   BaseObjectPtr<SecureContext> sni_context_;
@@ -252,7 +263,7 @@ class TLSWrap : public AsyncWrap,
   BIO* enc_in_ = nullptr;   // StreamListener fills this for SSL_read().
   BIO* enc_out_ = nullptr;  // SSL_write()/handshake fills this for EncOut().
   // Waiting for ClearIn() to pass to SSL_write().
-  AllocatedBuffer pending_cleartext_input_;
+  std::unique_ptr<v8::BackingStore> pending_cleartext_input_;
   size_t write_size_ = 0;
   BaseObjectPtr<AsyncWrap> current_write_;
   BaseObjectPtr<AsyncWrap> current_empty_write_;
@@ -281,7 +292,13 @@ class TLSWrap : public AsyncWrap,
   CertCb cert_cb_ = nullptr;
   void* cert_cb_arg_ = nullptr;
 
-  BIOPointer bio_trace_;
+  ncrypto::BIOPointer bio_trace_;
+
+  bool has_active_write_issued_by_prev_listener_ = false;
+
+ public:
+  std::vector<unsigned char> alpn_protos_;  // Accessed by SelectALPNCallback.
+  bool alpn_callback_enabled_ = false;      // Accessed by SelectALPNCallback.
 };
 
 }  // namespace crypto