@kungfu-tech/libnode-win32-x64 0.0.0-bootstrap.0 → 22.22.3-kf.1

package/dist/node/include/quic/sessionticket.h

@@ -0,0 +1,108 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+
+#include <crypto/crypto_common.h>
+#include <env.h>
+#include <memory_tracker.h>
+#include <uv.h>
+#include <v8.h>
+#include "data.h"
+#include "defs.h"
+
+namespace node::quic {
+
+// A TLS 1.3 Session resumption ticket. Encapsulates both the TLS
+// ticket and the encoded QUIC transport parameters. The encoded
+// structure should be considered to be opaque for end users.
+// In JavaScript, the ticket will be represented as a Buffer
+// instance with opaque data. To resume a session, the user code
+// would pass that Buffer back into to client connection API.
+class SessionTicket final : public MemoryRetainer {
+ public:
+  static v8::Maybe<SessionTicket> FromV8Value(Environment* env,
+                                              v8::Local<v8::Value> value);
+
+  SessionTicket() = default;
+  SessionTicket(Store&& ticket, Store&& transport_params);
+
+  const uv_buf_t ticket() const;
+
+  const ngtcp2_vec transport_params() const;
+
+  v8::MaybeLocal<v8::Object> encode(Environment* env) const;
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(SessionTicket)
+  SET_SELF_SIZE(SessionTicket)
+
+  class AppData;
+
+  // The callback that OpenSSL will call when generating the session ticket
+  // and it needs to collect additional application specific data.
+  static int GenerateCallback(SSL* ssl, void* arg);
+
+  // The callback that OpenSSL will call when consuming the session ticket
+  // and it needs to pass embedded application data back into the app.
+  static SSL_TICKET_RETURN DecryptedCallback(SSL* ssl,
+                                             SSL_SESSION* session,
+                                             const unsigned char* keyname,
+                                             size_t keyname_len,
+                                             SSL_TICKET_STATUS status,
+                                             void* arg);
+
+ private:
+  Store ticket_;
+  Store transport_params_;
+};
+
+// SessionTicket::AppData is a utility class that is used only during the
+// generation or access of TLS stateless session tickets. It exists solely to
+// provide a easier way for Session::Application instances to set relevant
+// metadata in the session ticket when it is created, and the extract and
+// subsequently verify that data when a ticket is received and is being
+// validated. The app data is completely opaque to anything other than the
+// server-side of the Session::Application that sets it.
+class SessionTicket::AppData final {
+ public:
+  enum class Status {
+    TICKET_IGNORE = SSL_TICKET_RETURN_IGNORE,
+    TICKET_IGNORE_RENEW = SSL_TICKET_RETURN_IGNORE_RENEW,
+    TICKET_USE = SSL_TICKET_RETURN_USE,
+    TICKET_USE_RENEW = SSL_TICKET_RETURN_USE_RENEW,
+  };
+
+  explicit AppData(SSL* session);
+  DISALLOW_COPY_AND_MOVE(AppData)
+
+  bool Set(const uv_buf_t& data);
+  std::optional<const uv_buf_t> Get() const;
+
+  // A source of application data collected during the creation of the
+  // session ticket. This interface will be implemented by the QUIC
+  // Session.
+  class Source {
+   public:
+    enum class Flag { STATUS_NONE, STATUS_RENEW };
+
+    // Collect application data into the given AppData instance.
+    virtual void CollectSessionTicketAppData(AppData* app_data) const = 0;
+
+    // Extract application data from the given AppData instance.
+    virtual Status ExtractSessionTicketAppData(
+        const AppData& app_data, Flag flag = Flag::STATUS_NONE) = 0;
+  };
+
+  static void Collect(SSL* ssl);
+  static Status Extract(SSL* ssl);
+
+ private:
+  bool set_ = false;
+  SSL* ssl_;
+};
+
+}  // namespace node::quic
+
+#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS

package/dist/node/include/quic/streams.h

@@ -0,0 +1,232 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+
+#include <aliased_struct.h>
+#include <async_wrap.h>
+#include <base_object.h>
+#include <dataqueue/queue.h>
+#include <env.h>
+#include <memory_tracker.h>
+#include <node_blob.h>
+#include <node_bob.h>
+#include <node_http_common.h>
+#include "bindingdata.h"
+#include "data.h"
+
+namespace node::quic {
+
+class Session;
+
+using Ngtcp2Source = bob::SourceImpl<ngtcp2_vec>;
+
+// QUIC Stream's are simple data flows that may be:
+//
+// * Bidirectional (both sides can send) or Unidirectional (one side can send)
+// * Server or Client Initiated
+//
+// The flow direction and origin of the stream are important in determining the
+// write and read state (Open or Closed). Specifically:
+//
+// Bidirectional Stream States:
+// +--------+--------------+----------+----------+
+// |   ON   | Initiated By | Readable | Writable |
+// +--------+--------------+----------+----------+
+// | Server |   Server     |    Y     |    Y     |
+// +--------+--------------+----------+----------+
+// | Server |   Client     |    Y     |    Y     |
+// +--------+--------------+----------+----------+
+// | Client |   Server     |    Y     |    Y     |
+// +--------+--------------+----------+----------+
+// | Client |   Client     |    Y     |    Y     |
+// +--------+--------------+----------+----------+
+//
+// Unidirectional Stream States
+// +--------+--------------+----------+----------+
+// |   ON   | Initiated By | Readable | Writable |
+// +--------+--------------+----------+----------+
+// | Server |   Server     |    N     |    Y     |
+// +--------+--------------+----------+----------+
+// | Server |   Client     |    Y     |    N     |
+// +--------+--------------+----------+----------+
+// | Client |   Server     |    Y     |    N     |
+// +--------+--------------+----------+----------+
+// | Client |   Client     |    N     |    Y     |
+// +--------+--------------+----------+----------+
+//
+// All data sent via the Stream is buffered internally until either receipt is
+// acknowledged from the peer or attempts to send are abandoned. The fact that
+// data is buffered in memory makes it essential that the flow control for the
+// session and the stream are properly handled. For now, we are largely relying
+// on ngtcp2's default flow control mechanisms which generally should be doing
+// the right thing.
+//
+// A Stream may be in a fully closed state (No longer readable nor writable)
+// state but still have unacknowledged data in it's inbound and outbound
+// queues.
+//
+// A Stream is gracefully closed when (a) both read and write states are closed,
+// (b) all queued data has been acknowledged.
+//
+// The Stream may be forcefully closed immediately using destroy(err). This
+// causes all queued outbound data and pending JavaScript writes are abandoned,
+// and causes the Stream to be immediately closed at the ngtcp2 level without
+// waiting for any outstanding acknowledgements. Keep in mind, however, that the
+// peer is not notified that the stream is destroyed and may attempt to continue
+// sending data and acknowledgements.
+//
+// QUIC streams in general do not have headers. Some QUIC applications, however,
+// may associate headers with the stream (HTTP/3 for instance).
+class Stream : public AsyncWrap,
+               public Ngtcp2Source,
+               public DataQueue::BackpressureListener {
+ public:
+  using Header = NgHeaderBase<BindingData>;
+
+  static Stream* From(void* stream_user_data);
+
+  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  static BaseObjectPtr<Stream> Create(
+      Session* session,
+      int64_t id,
+      std::shared_ptr<DataQueue> source = nullptr);
+
+  // The constructor is only public to be visible by MakeDetachedBaseObject.
+  // Call Create to create new instances of Stream.
+  Stream(BaseObjectWeakPtr<Session> session,
+         v8::Local<v8::Object> obj,
+         int64_t id,
+         std::shared_ptr<DataQueue> source);
+  ~Stream() override;
+
+  int64_t id() const;
+  Side origin() const;
+  Direction direction() const;
+  Session& session() const;
+
+  bool is_destroyed() const;
+
+  // True if we've completely sent all outbound data for this stream.
+  bool is_eos() const;
+
+  bool is_readable() const;
+  bool is_writable() const;
+
+  // Called by the session/application to indicate that the specified number
+  // of bytes have been acknowledged by the peer.
+  void Acknowledge(size_t datalen);
+  void Commit(size_t datalen);
+  void EndWritable();
+  void EndReadable(std::optional<uint64_t> maybe_final_size = std::nullopt);
+  void EntryRead(size_t amount) override;
+
+  // Pulls data from the internal outbound DataQueue configured for this stream.
+  int DoPull(bob::Next<ngtcp2_vec> next,
+             int options,
+             ngtcp2_vec* data,
+             size_t count,
+             size_t max_count_hint) override;
+
+  // Forcefully close the stream immediately. All queued data and pending
+  // writes are abandoned, and the stream is immediately closed at the ngtcp2
+  // level without waiting for any outstanding acknowledgements.
+  void Destroy(QuicError error = QuicError());
+
+  struct ReceiveDataFlags final {
+    // Identifies the final chunk of data that the peer will send for the
+    // stream.
+    bool fin = false;
+    // Indicates that this chunk of data was received in a 0RTT packet before
+    // the TLS handshake completed, suggesting that is is not as secure and
+    // could be replayed by an attacker.
+    bool early = false;
+  };
+
+  void ReceiveData(const uint8_t* data, size_t len, ReceiveDataFlags flags);
+  void ReceiveStopSending(QuicError error);
+  void ReceiveStreamReset(uint64_t final_size, QuicError error);
+
+  void BeginHeaders(HeadersKind kind);
+  // Returns false if the header cannot be added. This will typically happen
+  // if the application does not support headers, a maximum number of headers
+  // have already been added, or the maximum total header length is reached.
+  bool AddHeader(const Header& header);
+  void set_headers_kind(HeadersKind kind);
+
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(Stream)
+  SET_SELF_SIZE(Stream)
+
+  struct State;
+  struct Stats;
+
+  // Notifies the JavaScript side that sending data on the stream has been
+  // blocked because of flow control restriction.
+  void EmitBlocked();
+
+  // Delivers the set of inbound headers that have been collected.
+  void EmitHeaders();
+
+ private:
+  struct Impl;
+  class Outbound;
+
+  // Gets a reader for the data received for this stream from the peer,
+  BaseObjectPtr<Blob::Reader> get_reader();
+
+  void set_final_size(uint64_t amount);
+  void set_outbound(std::shared_ptr<DataQueue> source);
+
+  // JavaScript callouts
+
+  // Notifies the JavaScript side that the stream has been destroyed.
+  void EmitClose(const QuicError& error);
+
+  // Notifies the JavaScript side that the stream has been reset.
+  void EmitReset(const QuicError& error);
+
+  // Notifies the JavaScript side that the application is ready to receive
+  // trailing headers.
+  void EmitWantTrailers();
+
+  AliasedStruct<Stats> stats_;
+  AliasedStruct<State> state_;
+  BaseObjectWeakPtr<Session> session_;
+  const Side origin_;
+  const Direction direction_;
+  std::unique_ptr<Outbound> outbound_;
+  std::shared_ptr<DataQueue> inbound_;
+
+  v8::LocalVector<v8::Value> headers_;
+  HeadersKind headers_kind_ = HeadersKind::INITIAL;
+  size_t headers_length_ = 0;
+
+  friend struct Impl;
+
+ public:
+  // The Queue/Schedule/Unschedule here are part of the mechanism used to
+  // determine which streams have data to send on the session. When a stream
+  // potentially has data available, it will be scheduled in the Queue. Then,
+  // when the Session::Application starts sending pending data, it will check
+  // the queue to see if there are streams waiting. If there are, it will grab
+  // one and check to see if there is data to send. When a stream does not have
+  // data to send (such as when it is initially created or is using an async
+  // source that is still waiting for data to be pushed) it will not appear in
+  // the queue.
+  ListNode<Stream> stream_queue_;
+  using Queue = ListHead<Stream, &Stream::stream_queue_>;
+
+  void Schedule(Queue* queue);
+  void Unschedule();
+};
+
+}  // namespace node::quic
+
+#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS

package/dist/node/include/quic/tlscontext.h

@@ -0,0 +1,227 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+
+#include <base_object.h>
+#include <crypto/crypto_context.h>
+#include <crypto/crypto_keys.h>
+#include <memory_tracker.h>
+#include <ncrypto.h>
+#include <ngtcp2/ngtcp2_crypto.h>
+#include "bindingdata.h"
+#include "data.h"
+#include "defs.h"
+#include "sessionticket.h"
+
+namespace node::quic {
+
+class Session;
+class TLSContext;
+
+// Every QUIC Session has exactly one TLSSession that maintains the state
+// of the TLS handshake and negotiated keys after the handshake has been
+// completed. It is separated out from the main Session class only as a
+// convenience to help make the code more maintainable and understandable.
+// A TLSSession is created from a TLSContext and maintains a reference to
+// the context.
+class TLSSession final : public MemoryRetainer {
+ public:
+  static const TLSSession& From(const SSL* ssl);
+
+  // The constructor is public in order to satisfy the call to std::make_unique
+  // in TLSContext::NewSession. It should not be called directly.
+  TLSSession(Session* session,
+             std::shared_ptr<TLSContext> context,
+             const std::optional<SessionTicket>& maybeSessionTicket);
+  DISALLOW_COPY_AND_MOVE(TLSSession)
+
+  inline operator bool() const { return ssl_ != nullptr; }
+  inline Session& session() const { return *session_; }
+  inline TLSContext& context() const { return *context_; }
+
+  // Returns true if the handshake has been completed and early data was
+  // accepted by the TLS session. This will assert if the handshake has
+  // not been completed.
+  bool early_data_was_accepted() const;
+
+  v8::MaybeLocal<v8::Object> cert(Environment* env) const;
+  v8::MaybeLocal<v8::Object> peer_cert(Environment* env) const;
+  v8::MaybeLocal<v8::Object> ephemeral_key(Environment* env) const;
+  v8::MaybeLocal<v8::Value> cipher_name(Environment* env) const;
+  v8::MaybeLocal<v8::Value> cipher_version(Environment* env) const;
+
+  // The SNI (server name) negotiated for the session
+  const std::string_view servername() const;
+
+  // The ALPN (protocol name) negotiated for the session
+  const std::string_view alpn() const;
+
+  // Triggers key update to begin. This will fail and return false if either a
+  // previous key update is in progress or if the initial handshake has not yet
+  // been confirmed.
+  bool InitiateKeyUpdate();
+
+  struct PeerIdentityValidationError {
+    v8::MaybeLocal<v8::Value> reason;
+    v8::MaybeLocal<v8::Value> code;
+  };
+
+  // Checks the peer identity against the configured CA and CRL. If the peer
+  // certificate is valid, std::nullopt is returned. Otherwise a
+  // PeerIdentityValidationError is returned with the reason and code for the
+  // failure.
+  std::optional<PeerIdentityValidationError> VerifyPeerIdentity(
+      Environment* env);
+
+  inline const std::string_view validation_error() const {
+    return validation_error_;
+  }
+
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(TLSSession)
+  SET_SELF_SIZE(TLSSession)
+
+ private:
+  operator SSL*() const;
+  ncrypto::SSLPointer Initialize(
+      const std::optional<SessionTicket>& maybeSessionTicket);
+
+  static ngtcp2_conn* connection(ngtcp2_crypto_conn_ref* ref);
+
+  ngtcp2_crypto_conn_ref ref_;
+  std::shared_ptr<TLSContext> context_;
+  Session* session_;
+  ncrypto::SSLPointer ssl_;
+  ncrypto::BIOPointer bio_trace_;
+  std::string validation_error_ = "";
+  bool in_key_update_ = false;
+};
+
+// The TLSContext is used to create a TLSSession. For the client, there is
+// typically only a single TLSContext for each TLSSession. For the server,
+// there is a single TLSContext for the server and a TLSSession for every
+// QUIC session created by that server.
+class TLSContext final : public MemoryRetainer,
+                         public std::enable_shared_from_this<TLSContext> {
+ public:
+  static constexpr auto DEFAULT_CIPHERS = "TLS_AES_128_GCM_SHA256:"
+                                          "TLS_AES_256_GCM_SHA384:"
+                                          "TLS_CHACHA20_POLY1305_"
+                                          "SHA256:TLS_AES_128_CCM_SHA256";
+  static constexpr auto DEFAULT_GROUPS = "X25519:P-256:P-384:P-521";
+
+  struct Options final : public MemoryRetainer {
+    // The SNI servername to use for this session. This option is only used by
+    // the client.
+    std::string sni = "localhost";
+
+    // The ALPN (protocol name) to use for this session. This option is only
+    // used by the client.
+    std::string alpn = NGHTTP3_ALPN_H3;
+
+    // The list of TLS ciphers to use for this session.
+    std::string ciphers = DEFAULT_CIPHERS;
+
+    // The list of TLS groups to use for this session.
+    std::string groups = DEFAULT_GROUPS;
+
+    // When true, enables keylog output for the session.
+    bool keylog = false;
+
+    // When true, the peer certificate is verified against the list of supplied
+    // CA. If verification fails, the connection will be refused. When set,
+    // instructs the server session to request a client auth certificate. This
+    // option is only used by the server side.
+    bool verify_client = false;
+
+    // When true, enables TLS tracing for the session. This should only be used
+    // for debugging.
+    // JavaScript option name "tlsTrace".
+    bool enable_tls_trace = false;
+
+    // When true, causes the private key passed in for the session to be
+    // verified.
+    // JavaScript option name "verifyPrivateKey"
+    bool verify_private_key = false;
+
+    // The TLS private key(s) to use for this session.
+    // JavaScript option name "keys"
+    std::vector<crypto::KeyObjectData> keys;
+
+    // Collection of certificates to use for this session.
+    // JavaScript option name "certs"
+    std::vector<Store> certs;
+
+    // Optional certificate authority overrides to use.
+    // JavaScript option name "ca"
+    std::vector<Store> ca;
+
+    // Optional certificate revocation lists to use.
+    // JavaScript option name "crl"
+    std::vector<Store> crl;
+
+    void MemoryInfo(MemoryTracker* tracker) const override;
+    SET_MEMORY_INFO_NAME(TLSContext::Options)
+    SET_SELF_SIZE(Options)
+
+    // The default TLS configuration.
+    static const Options kDefault;
+
+    static v8::Maybe<Options> From(Environment* env,
+                                   v8::Local<v8::Value> value);
+
+    std::string ToString() const;
+  };
+
+  static std::shared_ptr<TLSContext> CreateClient(const Options& options);
+  static std::shared_ptr<TLSContext> CreateServer(const Options& options);
+
+  TLSContext(Side side, const Options& options);
+  DISALLOW_COPY_AND_MOVE(TLSContext)
+
+  // Each QUIC Session has exactly one TLSSession. Each TLSSession maintains
+  // a reference to the TLSContext used to create it.
+  std::unique_ptr<TLSSession> NewSession(
+      Session* session, const std::optional<SessionTicket>& maybeSessionTicket);
+
+  inline Side side() const { return side_; }
+  inline const Options& options() const { return options_; }
+  inline operator bool() const { return ctx_ != nullptr; }
+
+  inline const std::string_view validation_error() const {
+    return validation_error_;
+  }
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(TLSContext)
+  SET_SELF_SIZE(TLSContext)
+
+ private:
+  ncrypto::SSLCtxPointer Initialize();
+  operator SSL_CTX*() const;
+
+  static void OnKeylog(const SSL* ssl, const char* line);
+  static int OnNewSession(SSL* ssl, SSL_SESSION* session);
+  static int OnSelectAlpn(SSL* ssl,
+                          const unsigned char** out,
+                          unsigned char* outlen,
+                          const unsigned char* in,
+                          unsigned int inlen,
+                          void* arg);
+  static int OnVerifyClientCertificate(int preverify_ok, X509_STORE_CTX* ctx);
+
+  Side side_;
+  Options options_;
+  ncrypto::X509Pointer cert_;
+  ncrypto::X509Pointer issuer_;
+  ncrypto::SSLCtxPointer ctx_;
+  std::string validation_error_ = "";
+
+  friend class TLSSession;
+};
+
+}  // namespace node::quic
+
+#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS