@kungfu-tech/libnode-win32-x64 0.0.0-bootstrap.0 → 22.22.3-kf.1

package/dist/node/include/crypto/crypto_bio.h

@@ -0,0 +1,193 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+#ifndef SRC_CRYPTO_CRYPTO_BIO_H_
+#define SRC_CRYPTO_CRYPTO_BIO_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "node_crypto.h"
+#include "openssl/bio.h"
+#include "util.h"
+#include "v8.h"
+
+namespace node {
+
+class Environment;
+
+namespace crypto {
+// This class represents buffers for OpenSSL I/O, implemented as a singly-linked
+// list of chunks. It can be used either for writing data from Node to OpenSSL,
+// or for reading data back, but not both.
+// The structure is only accessed, and owned by, the OpenSSL BIOPointer
+// (a.k.a. std::unique_ptr<BIO>).
+class NodeBIO : public MemoryRetainer {
+ public:
+  ~NodeBIO() override;
+
+  static ncrypto::BIOPointer New(Environment* env = nullptr);
+
+  // NewFixed takes a copy of `len` bytes from `data` and returns a BIO that,
+  // when read from, returns those bytes followed by EOF.
+  static ncrypto::BIOPointer NewFixed(const char* data,
+                                      size_t len,
+                                      Environment* env = nullptr);
+
+  // Move read head to next buffer if needed
+  void TryMoveReadHead();
+
+  // Allocate new buffer for write if needed
+  void TryAllocateForWrite(size_t hint);
+
+  // Read `len` bytes maximum into `out`, return actual number of read bytes
+  size_t Read(char* out, size_t size);
+
+  // Memory optimization:
+  // Deallocate children of write head's child if they're empty
+  void FreeEmpty();
+
+  // Return pointer to internal data and amount of
+  // contiguous data available to read
+  char* Peek(size_t* size);
+
+  // Return pointers and sizes of multiple internal data chunks available for
+  // reading
+  size_t PeekMultiple(char** out, size_t* size, size_t* count);
+
+  // Find first appearance of `delim` in buffer or `limit` if `delim`
+  // wasn't found.
+  size_t IndexOf(char delim, size_t limit);
+
+  // Discard all available data
+  void Reset();
+
+  // Put `len` bytes from `data` into buffer
+  void Write(const char* data, size_t size);
+
+  // Return pointer to contiguous block of reserved data and the size available
+  // for future writes. Call Commit() once the write is complete.
+  char* PeekWritable(size_t* size);
+
+  // Specify how much data was written into the block returned by
+  // PeekWritable().
+  void Commit(size_t size);
+
+
+  // Return size of buffer in bytes
+  inline size_t Length() const {
+    return length_;
+  }
+
+  // Provide a hint about the size of the next pending set of writes. TLS
+  // writes records of a maximum length of 16k of data plus a 5-byte header,
+  // a MAC (up to 20 bytes for SSLv3, TLS 1.0, TLS 1.1, and up to 32 bytes
+  // for TLS 1.2), and padding if a block cipher is used.  If there is a
+  // large write this will result in potentially many buffers being
+  // allocated and gc'ed which can cause long pauses. By providing a
+  // guess about the amount of buffer space that will be needed in the
+  // next allocation this overhead is removed.
+  inline void set_allocate_tls_hint(size_t size) {
+    constexpr size_t kThreshold = 16 * 1024;
+    if (size >= kThreshold) {
+      allocate_hint_ = (size / kThreshold + 1) * (kThreshold + 5 + 32);
+    }
+  }
+
+  inline void set_eof_return(int num) {
+    eof_return_ = num;
+  }
+
+  inline int eof_return() {
+    return eof_return_;
+  }
+
+  inline void set_initial(size_t initial) {
+    initial_ = initial;
+  }
+
+  static NodeBIO* FromBIO(BIO* bio);
+
+  void MemoryInfo(MemoryTracker* tracker) const override {
+    tracker->TrackFieldWithSize("buffer", length_, "NodeBIO::Buffer");
+  }
+
+  SET_MEMORY_INFO_NAME(NodeBIO)
+  SET_SELF_SIZE(NodeBIO)
+
+ private:
+  static int New(BIO* bio);
+  static int Free(BIO* bio);
+  static int Read(BIO* bio, char* out, int len);
+  static int Write(BIO* bio, const char* data, int len);
+  static int Puts(BIO* bio, const char* str);
+  static int Gets(BIO* bio, char* out, int size);
+  static long Ctrl(BIO* bio, int cmd, long num,  // NOLINT(runtime/int)
+                   void* ptr);
+
+  static const BIO_METHOD* GetMethod();
+
+  // Enough to handle the most of the client hellos
+  static const size_t kInitialBufferLength = 1024;
+  static const size_t kThroughputBufferLength = 16384;
+
+  class Buffer {
+   public:
+    Buffer(Environment* env, size_t len) : env_(env),
+                                           read_pos_(0),
+                                           write_pos_(0),
+                                           len_(len),
+                                           next_(nullptr) {
+      data_ = new char[len];
+      if (env_ != nullptr)
+        env_->isolate()->AdjustAmountOfExternalAllocatedMemory(len);
+    }
+
+    ~Buffer() {
+      delete[] data_;
+      if (env_ != nullptr) {
+        const int64_t len = static_cast<int64_t>(len_);
+        env_->isolate()->AdjustAmountOfExternalAllocatedMemory(-len);
+      }
+    }
+
+    Environment* env_;
+    size_t read_pos_;
+    size_t write_pos_;
+    size_t len_;
+    Buffer* next_;
+    char* data_;
+  };
+
+  Environment* env_ = nullptr;
+  size_t initial_ = kInitialBufferLength;
+  size_t length_ = 0;
+  size_t allocate_hint_ = 0;
+  int eof_return_ = -1;
+  Buffer* read_head_ = nullptr;
+  Buffer* write_head_ = nullptr;
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_CRYPTO_CRYPTO_BIO_H_

package/dist/node/include/crypto/crypto_cipher.h

@@ -0,0 +1,293 @@
+#ifndef SRC_CRYPTO_CRYPTO_CIPHER_H_
+#define SRC_CRYPTO_CRYPTO_CIPHER_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "crypto/crypto_keys.h"
+#include "crypto/crypto_util.h"
+#include "base_object.h"
+#include "env.h"
+#include "memory_tracker.h"
+#include "v8.h"
+
+#include <string>
+
+namespace node {
+namespace crypto {
+class CipherBase : public BaseObject {
+ public:
+  static void GetSSLCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(CipherBase)
+  SET_SELF_SIZE(CipherBase)
+
+ protected:
+  enum CipherKind {
+    kCipher,
+    kDecipher
+  };
+  enum UpdateResult {
+    kSuccess,
+    kErrorMessageSize,
+    kErrorState
+  };
+  enum AuthTagState {
+    kAuthTagUnknown,
+    kAuthTagKnown,
+    kAuthTagPassedToOpenSSL
+  };
+  static const unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
+
+  void CommonInit(const char* cipher_type,
+                  const ncrypto::Cipher& cipher,
+                  const unsigned char* key,
+                  int key_len,
+                  const unsigned char* iv,
+                  int iv_len,
+                  unsigned int auth_tag_len);
+  void Init(const char* cipher_type,
+            const ArrayBufferOrViewContents<unsigned char>& key_buf,
+            unsigned int auth_tag_len);
+  void InitIv(const char* cipher_type,
+              const ByteSource& key_buf,
+              const ArrayBufferOrViewContents<unsigned char>& iv_buf,
+              unsigned int auth_tag_len);
+  bool InitAuthenticated(const char* cipher_type, int iv_len,
+                         unsigned int auth_tag_len);
+  bool CheckCCMMessageLength(int message_len);
+  UpdateResult Update(const char* data, size_t len,
+                      std::unique_ptr<v8::BackingStore>* out);
+  bool Final(std::unique_ptr<v8::BackingStore>* out);
+  bool SetAutoPadding(bool auto_padding);
+
+  bool IsAuthenticatedMode() const;
+  bool SetAAD(
+      const ArrayBufferOrViewContents<unsigned char>& data,
+      int plaintext_len);
+  bool MaybePassAuthTagToOpenSSL();
+
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Init(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void InitIv(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Update(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Final(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetAutoPadding(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  static void GetAuthTag(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetAuthTag(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetAAD(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  CipherBase(Environment* env, v8::Local<v8::Object> wrap, CipherKind kind);
+
+ private:
+  ncrypto::CipherCtxPointer ctx_;
+  const CipherKind kind_;
+  AuthTagState auth_tag_state_;
+  unsigned int auth_tag_len_;
+  char auth_tag_[EVP_GCM_TLS_TAG_LEN];
+  bool pending_auth_failed_;
+  int max_message_size_;
+};
+
+class PublicKeyCipher {
+ public:
+  typedef int (*EVP_PKEY_cipher_init_t)(EVP_PKEY_CTX* ctx);
+  typedef int (*EVP_PKEY_cipher_t)(EVP_PKEY_CTX* ctx,
+                                   unsigned char* out, size_t* outlen,
+                                   const unsigned char* in, size_t inlen);
+
+  enum Operation {
+    kPublic,
+    kPrivate
+  };
+
+  template <Operation operation,
+            EVP_PKEY_cipher_init_t EVP_PKEY_cipher_init,
+            EVP_PKEY_cipher_t EVP_PKEY_cipher>
+  static bool Cipher(Environment* env,
+                     const ncrypto::EVPKeyPointer& pkey,
+                     int padding,
+                     const EVP_MD* digest,
+                     const ArrayBufferOrViewContents<unsigned char>& oaep_label,
+                     const ArrayBufferOrViewContents<unsigned char>& data,
+                     std::unique_ptr<v8::BackingStore>* out);
+
+  template <Operation operation,
+            EVP_PKEY_cipher_init_t EVP_PKEY_cipher_init,
+            EVP_PKEY_cipher_t EVP_PKEY_cipher>
+  static void Cipher(const v8::FunctionCallbackInfo<v8::Value>& args);
+};
+
+enum WebCryptoCipherMode {
+  kWebCryptoCipherEncrypt,
+  kWebCryptoCipherDecrypt
+};
+
+enum class WebCryptoCipherStatus {
+  OK,
+  INVALID_KEY_TYPE,
+  FAILED
+};
+
+// CipherJob is a base implementation class for implementations of
+// one-shot sync and async ciphers. It has been added primarily to
+// support the AES and RSA ciphers underlying the WebCrypt API.
+//
+// See the crypto_aes and crypto_rsa headers for examples of how to
+// use CipherJob.
+template <typename CipherTraits>
+class CipherJob final : public CryptoJob<CipherTraits> {
+ public:
+  using AdditionalParams = typename CipherTraits::AdditionalParameters;
+
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args) {
+    Environment* env = Environment::GetCurrent(args);
+    CHECK(args.IsConstructCall());
+
+    CryptoJobMode mode = GetCryptoJobMode(args[0]);
+
+    CHECK(args[1]->IsUint32());  // Cipher Mode
+
+    uint32_t cmode = args[1].As<v8::Uint32>()->Value();
+    CHECK_LE(cmode, WebCryptoCipherMode::kWebCryptoCipherDecrypt);
+    WebCryptoCipherMode cipher_mode = static_cast<WebCryptoCipherMode>(cmode);
+
+    CHECK(args[2]->IsObject());  // KeyObject
+    KeyObjectHandle* key;
+    ASSIGN_OR_RETURN_UNWRAP(&key, args[2]);
+    CHECK_NOT_NULL(key);
+
+    ArrayBufferOrViewContents<char> data(args[3]);  // data to operate on
+    if (!data.CheckSizeInt32())
+      return THROW_ERR_OUT_OF_RANGE(env, "data is too large");
+
+    AdditionalParams params;
+    if (CipherTraits::AdditionalConfig(mode, args, 4, cipher_mode, &params)
+            .IsNothing()) {
+      // The CipherTraits::AdditionalConfig is responsible for
+      // calling an appropriate THROW_CRYPTO_* variant reporting
+      // whatever error caused initialization to fail.
+      return;
+    }
+
+    new CipherJob<CipherTraits>(
+        env,
+        args.This(),
+        mode,
+        key,
+        cipher_mode,
+        data,
+        std::move(params));
+  }
+
+  static void Initialize(
+      Environment* env,
+      v8::Local<v8::Object> target) {
+    CryptoJob<CipherTraits>::Initialize(New, env, target);
+  }
+
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+    CryptoJob<CipherTraits>::RegisterExternalReferences(New, registry);
+  }
+
+  CipherJob(Environment* env,
+            v8::Local<v8::Object> object,
+            CryptoJobMode mode,
+            KeyObjectHandle* key,
+            WebCryptoCipherMode cipher_mode,
+            const ArrayBufferOrViewContents<char>& data,
+            AdditionalParams&& params)
+      : CryptoJob<CipherTraits>(env,
+                                object,
+                                AsyncWrap::PROVIDER_CIPHERREQUEST,
+                                mode,
+                                std::move(params)),
+        key_(key->Data().addRef()),
+        cipher_mode_(cipher_mode),
+        in_(mode == kCryptoJobAsync ? data.ToCopy() : data.ToByteSource()) {}
+
+  const KeyObjectData& key() const { return key_; }
+
+  WebCryptoCipherMode cipher_mode() const { return cipher_mode_; }
+
+  void DoThreadPoolWork() override {
+    const WebCryptoCipherStatus status =
+        CipherTraits::DoCipher(
+            AsyncWrap::env(),
+            key(),
+            cipher_mode_,
+            *CryptoJob<CipherTraits>::params(),
+            in_,
+            &out_);
+    if (status == WebCryptoCipherStatus::OK) {
+      // Success!
+      return;
+    }
+    CryptoErrorStore* errors = CryptoJob<CipherTraits>::errors();
+    errors->Capture();
+    if (errors->Empty()) {
+      switch (status) {
+        case WebCryptoCipherStatus::OK:
+          UNREACHABLE();
+          break;
+        case WebCryptoCipherStatus::INVALID_KEY_TYPE:
+          errors->Insert(NodeCryptoError::INVALID_KEY_TYPE);
+          break;
+        case WebCryptoCipherStatus::FAILED:
+          errors->Insert(NodeCryptoError::CIPHER_JOB_FAILED);
+          break;
+      }
+    }
+  }
+
+  v8::Maybe<void> ToResult(v8::Local<v8::Value>* err,
+                           v8::Local<v8::Value>* result) override {
+    Environment* env = AsyncWrap::env();
+    CryptoErrorStore* errors = CryptoJob<CipherTraits>::errors();
+
+    if (errors->Empty())
+      errors->Capture();
+
+    if (out_.size() > 0 || errors->Empty()) {
+      CHECK(errors->Empty());
+      *err = v8::Undefined(env->isolate());
+      *result = out_.ToArrayBuffer(env);
+      if (result->IsEmpty()) {
+        return v8::Nothing<void>();
+      }
+    } else {
+      *result = v8::Undefined(env->isolate());
+      if (!errors->ToException(env).ToLocal(err)) {
+        return v8::Nothing<void>();
+      }
+    }
+    CHECK(!result->IsEmpty());
+    CHECK(!err->IsEmpty());
+    return v8::JustVoid();
+  }
+
+  SET_SELF_SIZE(CipherJob)
+  void MemoryInfo(MemoryTracker* tracker) const override {
+    if (CryptoJob<CipherTraits>::mode() == kCryptoJobAsync)
+      tracker->TrackFieldWithSize("in", in_.size());
+    tracker->TrackFieldWithSize("out", out_.size());
+    CryptoJob<CipherTraits>::MemoryInfo(tracker);
+  }
+
+ private:
+  KeyObjectData key_;
+  WebCryptoCipherMode cipher_mode_;
+  ByteSource in_;
+  ByteSource out_;
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_CIPHER_H_

package/dist/node/include/crypto/crypto_clienthello-inl.h

@@ -0,0 +1,90 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+#ifndef SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
+#define SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "crypto/crypto_clienthello.h"
+#include "util.h"
+
+namespace node {
+namespace crypto {
+inline ClientHelloParser::ClientHelloParser()
+    : state_(kEnded),
+      onhello_cb_(nullptr),
+      onend_cb_(nullptr),
+      cb_arg_(nullptr) {
+  Reset();
+}
+
+inline void ClientHelloParser::Reset() {
+  frame_len_ = 0;
+  body_offset_ = 0;
+  extension_offset_ = 0;
+  session_size_ = 0;
+  session_id_ = nullptr;
+  tls_ticket_size_ = -1;
+  tls_ticket_ = nullptr;
+  servername_size_ = 0;
+  servername_ = nullptr;
+}
+
+inline void ClientHelloParser::Start(ClientHelloParser::OnHelloCb onhello_cb,
+                                     ClientHelloParser::OnEndCb onend_cb,
+                                     void* cb_arg) {
+  if (!IsEnded())
+    return;
+  Reset();
+
+  CHECK_NOT_NULL(onhello_cb);
+
+  state_ = kWaiting;
+  onhello_cb_ = onhello_cb;
+  onend_cb_ = onend_cb;
+  cb_arg_ = cb_arg;
+}
+
+inline void ClientHelloParser::End() {
+  if (state_ == kEnded)
+    return;
+  state_ = kEnded;
+  if (onend_cb_ != nullptr) {
+    onend_cb_(cb_arg_);
+    onend_cb_ = nullptr;
+  }
+}
+
+inline bool ClientHelloParser::IsEnded() const {
+  return state_ == kEnded;
+}
+
+inline bool ClientHelloParser::IsPaused() const {
+  return state_ == kPaused;
+}
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_

package/dist/node/include/crypto/crypto_clienthello.h

@@ -0,0 +1,131 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+#ifndef SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
+#define SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <cstddef>  // size_t
+#include <cstdint>
+
+namespace node {
+namespace crypto {
+// Parse the client hello so we can do async session resumption. OpenSSL's
+// session resumption uses synchronous callbacks, see SSL_CTX_sess_set_get_cb
+// and get_session_cb.
+//
+// TLS1.3 handshakes masquerade as TLS1.2 session resumption, and to do this,
+// they always include a session_id in the ClientHello, making up a bogus value
+// if necessary. The parser can't know if its a bogus id, and will cause a
+// 'newSession' event to be emitted. This should do no harm, the id won't be
+// found, and the handshake will continue.
+class ClientHelloParser {
+ public:
+  inline ClientHelloParser();
+
+  class ClientHello {
+   public:
+    inline uint8_t session_size() const { return session_size_; }
+    inline const uint8_t* session_id() const { return session_id_; }
+    inline bool has_ticket() const { return has_ticket_; }
+    inline uint8_t servername_size() const { return servername_size_; }
+    inline const uint8_t* servername() const { return servername_; }
+
+   private:
+    uint8_t session_size_;
+    const uint8_t* session_id_;
+    bool has_ticket_;
+    uint8_t servername_size_;
+    const uint8_t* servername_;
+
+    friend class ClientHelloParser;
+  };
+
+  typedef void (*OnHelloCb)(void* arg, const ClientHello& hello);
+  typedef void (*OnEndCb)(void* arg);
+
+  void Parse(const uint8_t* data, size_t avail);
+
+  inline void Reset();
+  inline void Start(OnHelloCb onhello_cb, OnEndCb onend_cb, void* cb_arg);
+  inline void End();
+  inline bool IsPaused() const;
+  inline bool IsEnded() const;
+
+ private:
+  static const size_t kMaxTLSFrameLen = 16 * 1024 + 5;
+  static const size_t kMaxSSLExFrameLen = 32 * 1024;
+  static const uint8_t kServernameHostname = 0;
+  static const size_t kMinStatusRequestSize = 5;
+
+  enum ParseState {
+    kWaiting,
+    kTLSHeader,
+    kPaused,
+    kEnded
+  };
+
+  enum FrameType {
+    kChangeCipherSpec = 20,
+    kAlert = 21,
+    kHandshake = 22,
+    kApplicationData = 23,
+    kOther = 255
+  };
+
+  enum HandshakeType {
+    kClientHello = 1
+  };
+
+  enum ExtensionType {
+    kServerName = 0,
+    kTLSSessionTicket = 35
+  };
+
+  bool ParseRecordHeader(const uint8_t* data, size_t avail);
+  void ParseHeader(const uint8_t* data, size_t avail);
+  void ParseExtension(const uint16_t type,
+                      const uint8_t* data,
+                      size_t len);
+  bool ParseTLSClientHello(const uint8_t* data, size_t avail);
+
+  ParseState state_;
+  OnHelloCb onhello_cb_;
+  OnEndCb onend_cb_;
+  void* cb_arg_;
+  size_t frame_len_ = 0;
+  size_t body_offset_ = 0;
+  size_t extension_offset_ = 0;
+  uint8_t session_size_ = 0;
+  const uint8_t* session_id_ = nullptr;
+  uint16_t servername_size_ = 0;
+  const uint8_t* servername_ = nullptr;
+  uint16_t tls_ticket_size_ = -1;
+  const uint8_t* tls_ticket_ = nullptr;
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_