lemon-tls 0.3.0 → 0.4.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "lemon-tls",
-  "version": "0.3.0",
-  "description": "Zero-dependency TLS 1.3/1.2 implementation for Node.js - full control over cryptographic keys, record layer, and handshake. Drop-in replacement for node:tls with advanced options impossible in OpenSSL.",
+  "version": "0.4.1",
+  "description": "TLS 1.3/1.2 implementation for Node.js - full control over cryptographic keys, record layer, and handshake. Drop-in replacement for node:tls with advanced options impossible in OpenSSL.",
   "main": "index.js",
   "type": "module",
   "types": "index.d.ts",

package/src/dtls_socket.js

@@ -44,6 +44,7 @@ function DTLSSocket(udpSocket, options) {
     cert: options.cert,
     key: options.key,
     rejectUnauthorized: options.rejectUnauthorized,
+    requestCert: options.requestCert,
     ca: options.ca,
     alpnProtocols: options.alpnProtocols,
     minVersion: options.minVersion,
@@ -159,6 +160,7 @@ function createDTLSServer(options, connectionListener) {
           remotePort: rinfo.port,
           cert: options.cert,
           key: options.key,
+          requestCert: options.requestCert,
           SNICallback: options.SNICallback,
           alpnProtocols: options.alpnProtocols,
           minVersion: options.minVersion,
@@ -239,6 +241,7 @@ function connectDTLS(options, callback) {
     remotePort: port,
     servername: options.servername || host,
     rejectUnauthorized: options.rejectUnauthorized,
+    requestCert: options.requestCert,
     ca: options.ca,
     alpnProtocols: options.alpnProtocols,
     minVersion: options.minVersion,

package/src/session/message.js

@@ -29,7 +29,7 @@ function normalize_hello(hello) {
       } else if (name === 'KEY_SHARE') {
         if (!('key_groups' in out)) out.key_groups = [];
         if (!('supported_groups' in out)) out.supported_groups = [];
-        for (let i2 in value) {
+        for (let i2 = 0; i2 < value.length; i2++) {
           if (out.supported_groups.indexOf(value[i2].group) < 0) {
             out.supported_groups.push(value[i2].group);
           }

package/src/tls_session.js

@@ -504,20 +504,24 @@ function TLSSession(options){
             // - ALPN (same as CH1)
             // - custom extensions (QUIC transport params etc.)
             // - same cipher_suites, session_id, random as CH1
+            // CH2 MUST match CH1 exactly except key_share/cookie (RFC 8446
+            // §4.1.2) — so mirror CH1's conditional composition: same sigalg
+            // source (CH1 wrote its final list back to the context), and the
+            // same tls13Only rules for the legacy extensions and psk modes.
+            let tls13Only2 = context.local_supported_versions.length > 0 &&
+                             context.local_supported_versions.every(v => v === 0x0304);
             let extensions = [
               { type: 'SUPPORTED_VERSIONS', value: context.local_supported_versions },
               { type: 'SUPPORTED_GROUPS', value: context.local_supported_groups },
               { type: 'KEY_SHARE', value: [{ group: requestedGroup, key_exchange: newKeyGroup.public_key }] },
-              { type: 'SIGNATURE_ALGORITHMS', value: [
-                  // Must match CH1 exactly (RFC 8446 §4.1.2)
-                  0x0804, 0x0805, 0x0806,
-                  0x0403, 0x0503, 0x0603,
-                  0x0807, 0x0808,
-                  0x0401, 0x0501, 0x0601
-              ] },
-              { type: 'RENEGOTIATION_INFO', value: new Uint8Array(0) },
-              { type: 'EXTENDED_MASTER_SECRET', value: null },
+              { type: 'SIGNATURE_ALGORITHMS', value: context.local_supported_signature_algorithms },
             ];
+            if (!tls13Only2) {
+              extensions.push({ type: 'RENEGOTIATION_INFO', value: new Uint8Array(0) });
+              extensions.push({ type: 'EXTENDED_MASTER_SECRET', value: null });
+            } else {
+              extensions.push({ type: 'PSK_KEY_EXCHANGE_MODES', value: [1] });
+            }
 
             // SNI (must be first)
             if (context.local_sni) extensions.unshift({ type: 'SERVER_NAME', value: context.local_sni });
@@ -533,7 +537,7 @@ function TLSSession(options){
             }
 
             // Custom extensions (e.g. QUIC transport params 0x39)
-            for (let ci in context.local_extensions) {
+            for (let ci = 0; ci < context.local_extensions.length; ci++) {
               extensions.push(context.local_extensions[ci]);
             }
 
@@ -543,6 +547,11 @@ function TLSSession(options){
               random: context.local_random,
               session_id: context.local_session_id,
               cookie: context.dtls_cookie,
+          // BUGFIX: `cipher_suites` (plural) is what wire.js's client_hello
+              // builder actually reads; the singular key was silently ignored and
+              // wire.js substituted its own hardcoded fallback list — the
+              // configured cipher suites never reached the wire. Both names passed.
+              cipher_suites: context.local_supported_cipher_suites,
               cipher_suite: context.local_supported_cipher_suites,
               extensions: extensions,
             });
@@ -999,7 +1008,7 @@ function TLSSession(options){
 
 
       if('add_local_key_groups' in options){
-        for(let i in options['add_local_key_groups']){
+        for(let i = 0; i < options['add_local_key_groups'].length; i++){
 
           let group=options['add_local_key_groups'][i].group;
           if(group in context.local_key_groups==false){
@@ -1029,7 +1038,7 @@ function TLSSession(options){
 
 
       if('add_remote_key_groups' in options){
-        for(let i in options['add_remote_key_groups']){
+        for(let i = 0; i < options['add_remote_key_groups'].length; i++){
 
           let group=options['add_remote_key_groups'][i].group;
           if(group in context.remote_key_groups==false){
@@ -1779,7 +1788,7 @@ function TLSSession(options){
           }
 
 
-          for(let i in context.local_extensions){
+          for(let i = 0; i < context.local_extensions.length; i++){
             extensions.push(context.local_extensions[i]);
           }
 
@@ -2105,6 +2114,41 @@ function TLSSession(options){
         }
       }
 
+      // TLS 1.2 / DTLS 1.2 server: send CertificateRequest if mutual auth was
+      // requested via { requestCert: true }. Per RFC 5246 §7.4.4 this message
+      // goes between ServerKeyExchange and ServerHelloDone. The TLS 1.3 path
+      // (line ~1805) sends CertificateRequest between EncryptedExtensions and
+      // Certificate and is handled separately — version branching matters
+      // because the wire formats differ (RFC 5246 §7.4.4 vs RFC 8446 §4.3.2).
+      //
+      // Without this block, a 1.2 server that sets requestCert never actually
+      // requests the client's certificate, the client never sends one (TLS
+      // clients only send a cert in response to CertificateRequest), and any
+      // application-layer fingerprint check on the server fails with "peer
+      // presented no certificate" — most notably breaking WebRTC, which
+      // mandates mutual authentication (RFC 8827 §6.5) and pins to DTLS 1.2.
+      if (context.isServer == true && context.requestCert == true &&
+          !context.certificateRequestSent &&
+          context.key_exchange_sent == true && !context.hello_done_sent &&
+          (context.selected_version === wire.TLS_VERSION.TLS1_2 ||
+           context.selected_version === wire.DTLS_VERSION.DTLS1_2)) {
+
+        let cr_body = wire.build_certificate_request({
+          version: wire.TLS_VERSION.TLS1_2,
+          // rsa_sign(1), ecdsa_sign(64) — accept both. WebRTC uses ECDSA,
+          // most other 1.2 deployments use RSA. The client picks whichever
+          // matches its certificate.
+          certificate_types: [1, 64],
+          signature_algorithms: context.local_supported_signature_algorithms || [],
+          certificate_authorities: [],  // empty: accept any CA
+        });
+        let cr_data = wire.build_message(wire.TLS_MESSAGE_TYPE.CERTIFICATE_REQUEST, cr_body);
+        pushTranscript(cr_data);
+        context.certificateRequestSent = true;
+        ev.emit('message', 0, context.message_sent_seq, 'certificate_request', cr_data);
+        context.message_sent_seq++;
+      }
+
       //server hello done - 1.2 only...
       if(context.isServer==true && (context.selected_version === wire.TLS_VERSION.TLS1_2 || context.selected_version === wire.DTLS_VERSION.DTLS1_2)){
         if(context.hello_done_sent==false && context.key_exchange_sent==true){
@@ -2655,9 +2699,22 @@ function TLSSession(options){
         context.local_session_id=new Uint8Array(crypto.randomBytes(32));
       }
 
+      // TLS 1.3-only mode (QUIC and any client that offers no other version):
+      // the ClientHello must not carry TLS 1.2 baggage. QUIC mandates TLS 1.3
+      // (RFC 9001), and strict 1.3-only stacks reject hellos with legacy
+      // artifacts. Detected from the configured versions, so plain TLS over
+      // TCP (which offers 1.3+1.2) keeps the full compatibility behavior.
+      let tls13Only = context.local_supported_versions.length > 0 &&
+                      context.local_supported_versions.every(v => v === 0x0304);
+
       // Support both TLS 1.3 and 1.2 (server picks the best)
       if(context.local_supported_cipher_suites.length<=0){
-        context.local_supported_cipher_suites=[
+        context.local_supported_cipher_suites = tls13Only ? [
+          // TLS 1.3 only — no ECDHE 1.2 suites in a QUIC hello
+          0x1301, // TLS_AES_128_GCM_SHA256
+          0x1302, // TLS_AES_256_GCM_SHA384
+          0x1303, // TLS_CHACHA20_POLY1305_SHA256
+        ] : [
           // TLS 1.3
           0x1301, // TLS_AES_128_GCM_SHA256
           0x1302, // TLS_AES_256_GCM_SHA384
@@ -2687,6 +2744,23 @@ function TLSSession(options){
         private_key: private_key
       };
 
+      // Honor the configured signature algorithms; the hardcoded list is only
+      // the default when none were set (previously the configured list was
+      // ignored here — while the HRR CH2 hardcoded its own, so CH1 and CH2
+      // could differ, violating RFC 8446 §4.1.2's exact-match requirement).
+      let ch_sigalgs = (context.local_supported_signature_algorithms &&
+                        context.local_supported_signature_algorithms.length > 0)
+        ? context.local_supported_signature_algorithms
+        : [
+            // TLS 1.3 (PSS + ECDSA + EdDSA)
+            0x0804, 0x0805, 0x0806,
+            0x0403, 0x0503, 0x0603,
+            0x0807, 0x0808,
+            // TLS 1.2 (PKCS1)
+            0x0401, 0x0501, 0x0601
+          ];
+      context.local_supported_signature_algorithms = ch_sigalgs; // for CH2 reuse
+
       let extensions = [
         { 
           type: 'SUPPORTED_VERSIONS', 
@@ -2705,19 +2779,20 @@ function TLSSession(options){
         },
         {
           type: 'SIGNATURE_ALGORITHMS', 
-          value: [
-            // TLS 1.3 (PSS + ECDSA)
-            0x0804, 0x0805, 0x0806,
-            0x0403, 0x0503, 0x0603,
-            0x0807, 0x0808,
-            // TLS 1.2 (PKCS1)
-            0x0401, 0x0501, 0x0601
-          ]
-        },
-        // TLS 1.2 compatibility
-        { type: 'RENEGOTIATION_INFO', value: new Uint8Array(0) },
-        { type: 'EXTENDED_MASTER_SECRET', value: null }
+          value: ch_sigalgs
+        }
       ];
+      if (!tls13Only) {
+        // TLS 1.2 compatibility — meaningless (and suspicious to strict
+        // stacks) in a 1.3-only/QUIC hello
+        extensions.push({ type: 'RENEGOTIATION_INFO', value: new Uint8Array(0) });
+        extensions.push({ type: 'EXTENDED_MASTER_SECRET', value: null });
+      } else {
+        // psk_key_exchange_modes: every mainstream 1.3 client sends it, and a
+        // server MUST NOT send NewSessionTicket to a client that omitted it
+        // (RFC 8446 §4.2.9) — required for future 0-RTT/resumption anyway.
+        extensions.push({ type: 'PSK_KEY_EXCHANGE_MODES', value: [1] });
+      }
 
       // Add SNI if servername was provided
       if (context.local_sni) {
@@ -2730,7 +2805,7 @@ function TLSSession(options){
       }
 
       // Add custom extensions (e.g. QUIC transport params 0x39)
-      for (let i in context.local_extensions) {
+      for (let i = 0; i < context.local_extensions.length; i++) {
         extensions.push(context.local_extensions[i]);
       }
 
@@ -2787,6 +2862,11 @@ function TLSSession(options){
           random: context.local_random,
           session_id: context.local_session_id,
           cookie: context.dtls_cookie,
+          // BUGFIX: `cipher_suites` (plural) is what wire.js's client_hello
+          // builder actually reads; the singular key was silently ignored and
+          // wire.js substituted its own hardcoded fallback list — the
+          // configured cipher suites never reached the wire. Both names passed.
+          cipher_suites: context.local_supported_cipher_suites,
           cipher_suite: context.local_supported_cipher_suites,
           extensions: extensions
         };
@@ -2842,6 +2922,11 @@ function TLSSession(options){
           random: context.local_random,
           session_id: sid,
           cookie: context.dtls_cookie,
+          // BUGFIX: `cipher_suites` (plural) is what wire.js's client_hello
+          // builder actually reads; the singular key was silently ignored and
+          // wire.js substituted its own hardcoded fallback list — the
+          // configured cipher suites never reached the wire. Both names passed.
+          cipher_suites: context.local_supported_cipher_suites,
           cipher_suite: context.local_supported_cipher_suites,
           extensions: extensions
         };
@@ -2852,7 +2937,9 @@ function TLSSession(options){
         // Skip for DTLS (DTLS clients/servers often don't implement RFC 5077 fully,
         // and adding it caused interop issues with openssl s_server -dtls1_2).
         let isDtls = context.local_supported_versions && context.local_supported_versions.some(v => (v & 0xFF00) === 0xFE00);
-        if (!isDtls && context.sessionTickets) {
+        if (!isDtls && !tls13Only && context.sessionTickets) {
+          // RFC 5077 SessionTicket is a TLS 1.2 mechanism; 1.3 resumption uses
+          // NewSessionTicket/PSK. Never advertise it in a 1.3-only/QUIC hello.
           extensions.push({ type: 'SESSION_TICKET', value: new Uint8Array(0) });
         }
 
@@ -2863,6 +2950,11 @@ function TLSSession(options){
           random: context.local_random,
           session_id: context.local_session_id,
           cookie: context.dtls_cookie,
+          // BUGFIX: `cipher_suites` (plural) is what wire.js's client_hello
+          // builder actually reads; the singular key was silently ignored and
+          // wire.js substituted its own hardcoded fallback list — the
+          // configured cipher suites never reached the wire. Both names passed.
+          cipher_suites: context.local_supported_cipher_suites,
           cipher_suite: context.local_supported_cipher_suites,
           extensions: extensions
         };
@@ -3073,5 +3165,4 @@ function TLSSession(options){
   return this;
 }
 
-export default TLSSession;
-
+export default TLSSession;