lemon-tls 0.4.1 → 0.5.5

package/src/tls_socket.js

@@ -331,6 +331,18 @@ function TLSSocket(duplex, options){
             ? context.isTls13
             : session.getVersion() === 0x0304; // early records (pre-secureConnect)
 
+        // AEAD decryption can throw on any forged/corrupted record (GCM/ChaCha
+        // tag mismatch surfaces as an exception from decipher.final()). Left
+        // unhandled, a single injected bad segment would throw out of the
+        // transport 'data' handler — an unhandled exception that tears down the
+        // connection or the process: a trivial remote DoS.
+        //
+        // RFC 8446 §5.2: in TLS (unlike DTLS, which silently drops), a record
+        // that fails to decrypt MUST be treated as a fatal error. So we catch,
+        // send a fatal bad_record_mac alert, destroy the connection, and stop.
+        // The read sequence number is intentionally NOT advanced on failure —
+        // the rejected record never counts.
+        try {
         if (!isTls13 && context.remote_ccs_seen === true) {
             // TLS 1.2: decrypt with key_block derived keys
             if (context.app_read_key === null) {
@@ -394,7 +406,14 @@ function TLSSocket(duplex, options){
             }
             context.handshake_read_seq++;
         }
-        
+        } catch (e) {
+            // Record failed authentication → fatal bad_record_mac (RFC 8446 §5.2).
+            try { session.sendAlert ? session.sendAlert(2, TLS_ALERT.BAD_RECORD_MAC) : null; } catch (_) {}
+            self.emit('error', new Error('TLS record decryption failed (bad_record_mac)'));
+            self.destroy();
+            return;
+        }
+
 
         if (out !== null) {
             // Reuse cached isTls13 computed at the top of this function
@@ -1427,6 +1446,30 @@ function TLSSocket(duplex, options){
     /** Full negotiation result — all selected parameters in one object. */
     self.getNegotiationResult = function(){ return session.getNegotiationResult ? session.getNegotiationResult() : null; };
 
+    /**
+     * Export keying material (RFC 5705 for TLS 1.2, RFC 8446 §7.5 for
+     * TLS 1.3). Mirrors Node's tls.TLSSocket#exportKeyingMaterial —
+     * same argument order (length, label, context). One deliberate
+     * difference: Node THROWS before the handshake completes; we return
+     * null (matching this library's null-until-ready convention used by
+     * getTrafficSecrets etc.).
+     */
+    self.exportKeyingMaterial = function(length, label, context_value){
+        return session.exportKeyingMaterial
+          ? session.exportKeyingMaterial(length, label, context_value)
+          : null;
+    };
+
+    /** Peer hello extensions: [{ type, name, data, value }]. */
+    self.getRemoteExtensions = function(){
+        return session.getRemoteExtensions ? session.getRemoteExtensions() : [];
+    };
+
+    /** One peer extension by numeric type, or null. */
+    self.getRemoteExtension = function(type){
+        return session.getRemoteExtension ? session.getRemoteExtension(type) : null;
+    };
+
     /** Request Key Update — refresh outgoing encryption keys (TLS 1.3 only). */
     self.rekeySend = function(){ if (session.requestKeyUpdate) session.requestKeyUpdate(false); };
 

package/src/utils.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 
 function concatUint8Arrays(arrays) {
     let totalLength = 0;
@@ -93,9 +94,35 @@ function uint8Equal(a, b) {
 }
 
 
+/**
+ * Constant-time equality for two byte arrays.
+ *
+ * Unlike uint8Equal (which short-circuits on the first differing byte and
+ * therefore leaks — via timing — how many leading bytes matched), this always
+ * compares the full length. Use it wherever a mismatch would otherwise be
+ * exploitable as an oracle: Finished verify_data, PSK binders, ticket key_name,
+ * and any MAC/tag comparison.
+ *
+ * Returns false immediately (and safely) on length mismatch — that's public
+ * information, not a secret, so short-circuiting there is fine.
+ *
+ * Note: crypto.timingSafeEqual requires two equal-length Buffers. We wrap the
+ * inputs as Buffer views over the same memory (no copy) via byteOffset/length.
+ */
+function timingSafeEqualU8(a, b) {
+  if (a == null || b == null) return false;
+  if (a.length !== b.length) return false;
+  if (a.length === 0) return true;
+  let ba = Buffer.isBuffer(a) ? a : Buffer.from(a.buffer, a.byteOffset, a.length);
+  let bb = Buffer.isBuffer(b) ? b : Buffer.from(b.buffer, b.byteOffset, b.length);
+  return crypto.timingSafeEqual(ba, bb);
+}
+
+
 export {
   concatUint8Arrays,
   arraybufferEqual,
   arraysEqual,
-  uint8Equal
+  uint8Equal,
+  timingSafeEqualU8
 };