lemon-tls 0.10.0 → 0.11.0

package/src/compat.js

@@ -6,15 +6,16 @@
  */
 
 import net from 'node:net';
-import nodeTls from 'node:tls';   // for the shipped CA bundle only
+import { getRootCertificates, setRootCertificates } from './ca_store.js';
 import crypto from 'node:crypto';
 import { EventEmitter } from 'node:events';
 import { TLS_CIPHER_SUITES } from './crypto.js';
 import TLSSession from './tls_session.js';
 import TLSSocket from './tls_socket.js';
 import createSecureContext from './secure_context.js';
-import { parseCiphers, parseEcdhCurve, parseSigalgs } from './node_options.js';
+import { parseCiphers, checkCipherSuites, checkSignatureAlgorithms, parseEcdhCurve, parseSigalgs } from './node_options.js';
 import { prepare_ech_server } from './session/ech.js';
+import { matches_host, matches_altnames } from './session/x509.js';
 
 // ===================== Constants =====================
 
@@ -49,27 +50,9 @@ function getCiphers() {
 
 /* ===================== Default CA store ===================== */
 
-/**
- * The trust anchors Node ships (Mozilla's CA bundle). Exposed under the same
- * name Node uses so `tls.rootCertificates` works unchanged, and so this
- * library has a real default to chain against.
- *
- * That default matters more than parity. Until now, "no `ca` configured" meant
- * "authorize every certificate", while `rejectUnauthorized` defaulted to true
- * — the connection reported itself verified without ever verifying anything.
- * Node never behaved that way: it falls back to this bundle.
- *
- * Parsing all ~144 certificates costs a few tens of milliseconds, so it is
- * done once, lazily, and only if something actually needs it.
- */
-let _rootPems = null;
-function getRootCertificates() {
-  if (_rootPems === null) {
-    try { _rootPems = nodeTls.rootCertificates.slice(); }
-    catch (e) { _rootPems = []; }   // a build without the bundle
-  }
-  return _rootPems;
-}
+// The trust anchors Node ships (Mozilla's CA bundle), under the name Node
+// uses, so `tls.rootCertificates` works unchanged. The store is ca_store.js:
+// every session given no `ca` chains against it, as Node's does.
 
 /** Node-compat: tls.getCACertificates([type]). 'default' and 'bundled' both
  *  resolve to the shipped bundle; 'extra' and 'system' are not sourced here
@@ -83,92 +66,42 @@ function getCACertificates(type) {
 /** Node-compat: tls.setDefaultCACertificates(certs). Replaces the bundle for
  *  every subsequent connection that does not pass its own `ca`. */
 function setDefaultCACertificates(certs) {
-  if (!Array.isArray(certs)) throw new TypeError('certs must be an array');
-  _rootPems = certs.slice();
+  setRootCertificates(certs);
 }
 
 // ===================== tls.checkServerIdentity() =====================
 
 /**
- * Verifies that the peer certificate matches the hostname per RFC 6125.
- * Returns undefined on success, or an Error on mismatch.
+ * node:tls's tls.checkServerIdentity(hostname, cert): undefined when the
+ * certificate is for the host, an Error (code ERR_TLS_CERT_ALTNAME_INVALID,
+ * reason, host, cert) when it is not. The handshake's own check —
+ * session/x509.js matches_host, one implementation: the subjectAltName only
+ * (no common-name fallback, RFC 9525 §6.3), wildcards a whole leftmost
+ * label. Node still falls back to the common name of a certificate without
+ * a DNS name; this does not, as browsers do not — and as the handshake does
+ * not, which this used to disagree with.
  *
- * This is the default identity check Node uses when `rejectUnauthorized: true`
- * (the default for tls.connect). Apps can override via the `checkServerIdentity`
- * option in tls.connect to supply their own check.
- *
- * Matching rules:
- *   1. If the cert has Subject Alternative Name (SAN) entries:
- *      - For DNS SANs: compare against hostname (supports leftmost-label wildcards
- *        like *.example.com). IP address in hostname only matches IP SAN, not DNS SAN.
- *      - For IP SANs: compare against hostname as IP.
- *      - CN is IGNORED (per RFC 6125 and modern browsers).
- *   2. If no SAN entries exist, fall back to the cert's CN (common name)
- *      with the same matching rules — legacy path, deprecated by RFC 6125
- *      but still accepted by Node and common CAs.
- *
- * cert: the object returned by tlsSocket.getPeerCertificate() — must have
- *       `subject` (with `CN`) and `subjectaltname` (OpenSSL-formatted string).
+ * cert: what getPeerCertificate() returns — its `raw` DER is what is read.
  */
 function checkServerIdentity(hostname, cert) {
-  if (!cert) return new Error('checkServerIdentity: no certificate');
-  const host = String(hostname || '').toLowerCase();
-  if (!host) return new Error('checkServerIdentity: hostname required');
-
-  const isIp = /^(\d{1,3}\.){3}\d{1,3}$|^\[?[0-9a-fA-F:]+\]?$/.test(host);
-
-  // Parse subjectaltname (OpenSSL format: "DNS:a.com, DNS:*.b.com, IP Address:1.2.3.4")
-  const altnames = [];
-  if (cert.subjectaltname && typeof cert.subjectaltname === 'string') {
-    const parts = cert.subjectaltname.split(',');
-    for (let p of parts) {
-      p = p.trim();
-      if (p.startsWith('DNS:')) altnames.push({ type: 'DNS', value: p.slice(4).toLowerCase() });
-      else if (p.startsWith('IP Address:')) altnames.push({ type: 'IP', value: p.slice(11).trim() });
-      else if (p.startsWith('IP:')) altnames.push({ type: 'IP', value: p.slice(3).trim() });
-      // Other SAN types (URI, email, etc.) ignored
-    }
+  const host = String(hostname || '');
+  let err = null;
+  if (!cert) err = new Error('checkServerIdentity: no certificate to check');
+  else if (!host) err = new Error('checkServerIdentity: hostname required');
+  else {
+    // By the DER when the object has it (getPeerCertificate()'s does), or
+    // by its subjectaltname string, as Node reads it.
+    let ok = false;
+    try { ok = cert.raw ? matches_host(cert.raw, host.toLowerCase()) : matches_altnames(cert.subjectaltname, host); } catch (e) { ok = false; }
+    if (ok) return undefined;
+    err = new Error("Hostname/IP does not match certificate's altnames: Host: " + host + ". is not in the cert's altnames: " +
+                    (cert.subjectaltname || '(none)'));
   }
-
-  // DNS wildcard matcher: the wildcard must be the leftmost label only.
-  //   *.example.com  matches foo.example.com, NOT foo.bar.example.com, NOT example.com.
-  function dnsMatches(pattern, name) {
-    if (pattern === name) return true;
-    if (!pattern.startsWith('*.')) return false;
-    const dot = name.indexOf('.');
-    if (dot < 0) return false;
-    return pattern.slice(2) === name.slice(dot + 1);
-  }
-
-  // IP match: string-equal for IPv4; normalize brackets/case for IPv6.
-  function ipMatches(pattern, name) {
-    return pattern.replace(/^\[|\]$/g, '').toLowerCase()
-         === name.replace(/^\[|\]$/g, '').toLowerCase();
-  }
-
-  // RFC 6125: if SANs are present, do NOT fall back to CN.
-  if (altnames.length > 0) {
-    for (const s of altnames) {
-      if (isIp && s.type === 'IP' && ipMatches(s.value, host)) return undefined;
-      if (!isIp && s.type === 'DNS' && dnsMatches(s.value, host)) return undefined;
-    }
-    const details = altnames.map(s => `${s.type}:${s.value}`).join(', ');
-    return new Error(`Hostname/IP does not match certificate's altnames: Host: ${hostname}. is not in the cert's altnames: ${details}`);
-  }
-
-  // Legacy CN fallback (only when no SAN present)
-  const cn = cert.subject && cert.subject.CN;
-  if (cn) {
-    const cnLower = String(cn).toLowerCase();
-    if (isIp) {
-      if (ipMatches(cnLower, host)) return undefined;
-    } else {
-      if (dnsMatches(cnLower, host)) return undefined;
-    }
-    return new Error(`Hostname/IP does not match certificate's CN: Host: ${hostname}. is not cert's CN: ${cn}`);
-  }
-
-  return new Error(`Hostname/IP does not match any certificate identity`);
+  err.code = 'ERR_TLS_CERT_ALTNAME_INVALID';
+  err.reason = err.message;
+  err.host = host;
+  err.cert = cert;
+  return err;
 }
 
 // ===================== tls.connect() =====================
@@ -216,7 +149,11 @@ function connect(/* ...args */) {
 
   options = options || {};
 
-  let socket = new TLSSocket(null, {
+  // Every option goes on to the socket (and from it to the session), with
+  // what connect() settles itself over them — the lists that picked options
+  // one by one dropped a documented option time and again (pins, ech,
+  // customExtensions, recordSizeLimit …).
+  let socket = new TLSSocket(null, Object.assign({}, options, {
     isServer: false,
     servername: options.servername || host,
     rejectUnauthorized: options.rejectUnauthorized,
@@ -228,20 +165,18 @@ function connect(/* ...args */) {
     secureContext: options.secureContext,
     passphrase: options.passphrase,
     ca: options.ca,
-    useDefaultCA: options.useDefaultCA,
-    defaultCA: getRootCertificates,
     session: options.session,
     ALPNProtocols: options.ALPNProtocols,
     minVersion: options.minVersion,
     maxVersion: options.maxVersion,
     // node:tls's own strings (ciphers, ecdhCurve, sigalgs) — taken by
     // nothing until now — or lemon-tls's code lists, which win.
-    signatureAlgorithms: options.signatureAlgorithms || parseSigalgs(options.sigalgs),
+    signatureAlgorithms: checkSignatureAlgorithms(options.signatureAlgorithms) || parseSigalgs(options.sigalgs),
     groups: options.groups || parseEcdhCurve(options.ecdhCurve),
     prioritizeChaCha: options.prioritizeChaCha,
     // Forwarded on the server side but dropped here, so a client could not
     // narrow the suites it offers.
-    allowedCipherSuites: options.allowedCipherSuites || parseCiphers(options.ciphers),
+    allowedCipherSuites: checkCipherSuites(options.allowedCipherSuites, 'allowedCipherSuites') || parseCiphers(options.ciphers),
     maxRecordSize: options.maxRecordSize,
     sessionTickets: options.sessionTickets,
     ticketLifetime: options.ticketLifetime,
@@ -260,10 +195,18 @@ function connect(/* ...args */) {
     // here: neither reached the socket.
     grease: options.grease,
     permuteExtensions: options.permuteExtensions,
+    // Four more documented options (index.d.ts) this list left behind, so
+    // connect() ignored them without a word: certificate pins — a client
+    // that set them was not pinned at all — the handshake timeout, raw
+    // extensions, and noTickets (the older spelling of sessionTickets: false).
+    pins: options.pins,
+    handshakeTimeout: options.handshakeTimeout,
+    customExtensions: options.customExtensions,
+    ...(options.sessionTickets === undefined && options.noTickets === true ? { sessionTickets: false } : {}),
     // 0-RTT: with `session` whose ticket allows it, what is written before
     // 'secureConnect' goes in the first flight ('earlyData' says if taken).
     earlyData: options.earlyData === true,
-  });
+  }));
 
   addCompatMethods(socket);
 
@@ -346,9 +289,9 @@ function Server(options, connectionListener) {
 
   // node:tls's strings, read once (node_options.js) — a bad one throws here,
   // as Node's createServer does, not on the first connection.
-  let nodeSuites = options.allowedCipherSuites || parseCiphers(options.ciphers);
+  let nodeSuites = checkCipherSuites(options.allowedCipherSuites, 'allowedCipherSuites') || parseCiphers(options.ciphers);
   let nodeGroups = options.groups || parseEcdhCurve(options.ecdhCurve);
-  let nodeSigalgs = options.signatureAlgorithms || parseSigalgs(options.sigalgs);
+  let nodeSigalgs = checkSignatureAlgorithms(options.signatureAlgorithms) || parseSigalgs(options.sigalgs);
 
   // sessionTimeout: seconds to cache a TLS 1.2 Session ID (Node default: 300)
   let sessionTimeoutSec = (typeof options.sessionTimeout === 'number' && options.sessionTimeout > 0)
@@ -401,7 +344,11 @@ function Server(options, connectionListener) {
   }
 
   function buildSocketOpts() {
-    let socketOpts = {
+    // Every server option goes on to each socket, with what the server
+    // settles over them. Not the key and certificate themselves: they are in
+    // the secure context (defaultCtx) — with several pairs, its alternates.
+    let socketOpts = Object.assign({}, options, {
+      key: undefined, cert: undefined, pfx: undefined, passphrase: undefined, SNICallback: undefined,
       isServer: true,
       ticketKeys: self._ticketKeys,
       // node:tls's sessionTimeout is how long a session stays good — a
@@ -463,7 +410,7 @@ function Server(options, connectionListener) {
       // never handed to the socket, so a client sending no server_name got
       // the callback asked with null instead of this certificate, as in Node.
       secureContext: defaultCtx || undefined,
-    };
+    });
 
     if (options.SNICallback) {
       // An explicit callback wins outright — it may do things the registry
@@ -528,7 +475,9 @@ function Server(options, connectionListener) {
     });
 
     // 'secureConnection' fires AFTER handshake completes (Node.js semantics)
+    let established = false;
     socket.on('secureConnect', function() {
+      established = true;
       if (connectionListener) connectionListener(socket);
       self.emit('secureConnection', socket);
     });
@@ -538,9 +487,12 @@ function Server(options, connectionListener) {
       self.emit('keylog', line, socket);
     });
 
-    // Surface pre-handshake errors as 'tlsClientError' (Node.js semantics)
+    // Surface pre-handshake errors as 'tlsClientError' (Node.js semantics) —
+    // those only. It read socket.secureEstablished, which no socket has: every
+    // error, after the handshake too (a reset, a bad record), was a
+    // tlsClientError as well.
     socket.on('error', function(err) {
-      if (!socket.secureEstablished) {
+      if (!established) {
         self.emit('tlsClientError', err, socket);
       }
     });

package/src/crypto.js

@@ -128,101 +128,6 @@ const TLS_CIPHER_SUITES = {
     ivlen:        12,
     hash:         'sha256'
   },
-  0xCCAA: { // TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
-    name: 'DHE-RSA-CHACHA20-POLY1305', standardName: 'TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256',
-    tls:          12,
-    kex:          'DHE_RSA',
-    sig:          'RSA',
-    cipher:       'CHACHA20_POLY1305',
-    aead:         true,
-    keylen:       32,
-    fixed_ivlen:  12,  // RFC 7905: ChaCha20 uses a full 12-byte IV, no explicit nonce
-    record_ivlen: 0,
-    ivlen:        12,
-    hash:         'sha256'
-  },
-  0x009C: { // TLS_RSA_WITH_AES_128_GCM_SHA256
-    name: 'AES128-GCM-SHA256', standardName: 'TLS_RSA_WITH_AES_128_GCM_SHA256',
-    tls:          12,
-    kex:          'RSA',
-    sig:          'RSA',
-    cipher:       'AES_128_GCM',
-    aead:         true,
-    keylen:       16,
-    fixed_ivlen:  4,
-    record_ivlen: 8,
-    ivlen:        12,
-    hash:         'sha256'
-  },
-  0x009D: { // TLS_RSA_WITH_AES_256_GCM_SHA384
-    name: 'AES256-GCM-SHA384', standardName: 'TLS_RSA_WITH_AES_256_GCM_SHA384',
-    tls:          12,
-    kex:          'RSA',
-    sig:          'RSA',
-    cipher:       'AES_256_GCM',
-    aead:         true,
-    keylen:       32,
-    fixed_ivlen:  4,
-    record_ivlen: 8,
-    ivlen:        12,
-    hash:         'sha384'
-  },
-
-  // ----------------------
-  // TLS 1.2 CBC (Legacy)
-  // ----------------------
-  0xC013: { // TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
-    name: 'ECDHE-RSA-AES128-SHA', standardName: 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA',
-    tls:    12,
-    kex:    'ECDHE_RSA',
-    sig:    'RSA',
-    cipher: 'AES_128_CBC',
-    aead:   false,
-    keylen: 16,
-    ivlen:  16,
-    mac:    'sha1',
-    maclen: 20,
-    hash:   'sha256'
-  },
-  0xC014: { // TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
-    name: 'ECDHE-RSA-AES256-SHA', standardName: 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA',
-    tls:    12,
-    kex:    'ECDHE_RSA',
-    sig:    'RSA',
-    cipher: 'AES_256_CBC',
-    aead:   false,
-    keylen: 32,
-    ivlen:  16,
-    mac:    'sha1',
-    maclen: 20,
-    hash:   'sha256'
-  },
-  0x003C: { // TLS_RSA_WITH_AES_128_CBC_SHA256
-    name: 'AES128-SHA256', standardName: 'TLS_RSA_WITH_AES_128_CBC_SHA256',
-    tls:    12,
-    kex:    'RSA',
-    sig:    'RSA',
-    cipher: 'AES_128_CBC',
-    aead:   false,
-    keylen: 16,
-    ivlen:  16,
-    mac:    'sha256',
-    maclen: 32,
-    hash:   'sha256'
-  },
-  0x003D: { // TLS_RSA_WITH_AES_256_CBC_SHA256
-    name: 'AES256-SHA256', standardName: 'TLS_RSA_WITH_AES_256_CBC_SHA256',
-    tls:    12,
-    kex:    'RSA',
-    sig:    'RSA',
-    cipher: 'AES_256_CBC',
-    aead:   false,
-    keylen: 32,
-    ivlen:  16,
-    mac:    'sha256',
-    maclen: 32,
-    hash:   'sha256'
-  }
 };
 
 
@@ -282,6 +187,11 @@ function hkdf_extract(hashName, saltU8, ikmU8) {
 function hkdf_expand(hashName, prkU8, infoU8, length) {
   let hashLen = getHashLen(hashName);
   let N = Math.ceil(length / hashLen);
+  // RFC 5869 §2.3: L <= 255*HashLen. The one-byte counter wrapped past it,
+  // and the output repeated its own blocks (Wycheproof).
+  if (!Number.isInteger(length) || length < 0 || N > 255) {
+    throw new RangeError('HKDF-Expand: length ' + length + ' is more than 255 × ' + hashLen);
+  }
   // allocUnsafe is safe here: every byte is overwritten by prev.copy() below.
   let output = Buffer.allocUnsafe(N * hashLen);
   let prev = Buffer.alloc(0);
@@ -607,10 +517,13 @@ function tls_derive_from_master_secret_tls12(master_secret, server_random, clien
   let p = TLS_CIPHER_SUITES[cipher_suite];
   if (!p || p.tls !== 12) throw new Error('cipher suite not TLS 1.2 or not mapped');
 
+  // AEAD suites only (is_usable_cipher_suite): no MAC keys in the block —
+  // client_write_key, server_write_key, then the implicit IVs (RFC 5246 §6.3,
+  // RFC 5288 §3, RFC 7905 §2).
+  if (!p.aead) throw new Error('cipher suite 0x' + cipher_suite.toString(16) + ' is not an AEAD suite');
   let hashName = p.hash;
-  let macLen       = p.aead ? 0 : (p.maclen || 0);
-  let ivFromKbLen  = p.aead ? (p.fixed_ivlen || 0) : 0;
-  let need = (2 * macLen) + (2 * p.keylen) + (2 * ivFromKbLen);
+  let ivFromKbLen  = p.fixed_ivlen || 0;
+  let need = (2 * p.keylen) + (2 * ivFromKbLen);
 
   let key_block = tls12_prf(
     master_secret,
@@ -621,13 +534,6 @@ function tls_derive_from_master_secret_tls12(master_secret, server_random, clien
   );
 
   let off = 0;
-  let c_mac = null, s_mac = null;
-
-  if (!p.aead && macLen > 0) {
-    c_mac = key_block.slice(off, off + macLen); off += macLen;
-    s_mac = key_block.slice(off, off + macLen); off += macLen;
-  }
-
   let c_key = key_block.slice(off, off + p.keylen); off += p.keylen;
   let s_key = key_block.slice(off, off + p.keylen); off += p.keylen;
 
@@ -635,8 +541,6 @@ function tls_derive_from_master_secret_tls12(master_secret, server_random, clien
   let s_iv_salt = ivFromKbLen ? key_block.slice(off, off + ivFromKbLen) : null; off += ivFromKbLen;
 
   return {
-    client_mac: c_mac,
-    server_mac: s_mac,
     client_key: c_key,
     server_key: s_key,
     client_iv: c_iv_salt,
@@ -646,7 +550,7 @@ function tls_derive_from_master_secret_tls12(master_secret, server_random, clien
     prf_hash:    hashName,
     key_len:     p.keylen,
     fixed_ivlen: ivFromKbLen,
-    record_ivlen: p.aead ? (p.record_ivlen || 0) : 16
+    record_ivlen: p.record_ivlen || 0
   };
 }
 
@@ -844,11 +748,9 @@ const DEFAULT_CIPHER_SUITES_TLS12 = [
 /**
  * Can the record layer actually protect traffic with this cipher suite?
  *
- * TLS_CIPHER_SUITES describes suites the code can NAME — including CBC ones
- * kept for parsing peer offers and for reporting — but record.js implements
- * AEAD only. A suite that is merely described is not a capability: selecting
- * one produces a handshake that agrees on parameters and then cannot encrypt a
- * single record.
+ * TLS_CIPHER_SUITES describes the suites the code can name. A suite that is
+ * merely described is not a capability: selecting one produces a handshake
+ * that agrees on parameters and then cannot go on.
  *
  * This mirrors ecdh.js's is_supported_group, and exists for the same reason: a
  * configured list is not an implementation. Selection asks this, never the
@@ -856,7 +758,12 @@ const DEFAULT_CIPHER_SUITES_TLS12 = [
  */
 function is_usable_cipher_suite(id) {
   let m = TLS_CIPHER_SUITES[id];
-  return !!(m && m.aead === true);
+  // An AEAD suite whose key exchange this library does: TLS 1.3's, or
+  // TLS 1.2 ECDHE. (RSA key transport, DHE and CBC suites were listed and
+  // never worked — a server that picked one stalled after its Certificate.
+  // They are gone: insecure as they are (Marvin, Lucky13), no current
+  // client needs them.)
+  return !!(m && m.aead === true && (m.tls === 13 || (typeof m.kex === 'string' && m.kex.indexOf('ECDHE_') === 0)));
 }
 
 /**