lemon-tls 0.5.0 → 0.6.0

package/src/dtls_socket.js

@@ -52,6 +52,7 @@ function DTLSSocket(udpSocket, options) {
     mtu: options.mtu,
     ticketKeys: options.ticketKeys,
     useCookies: options.useCookies,
+    srtpProfiles: options.srtpProfiles,
   });
 
   // Wire session → UDP
@@ -136,6 +137,11 @@ function DTLSSocket(udpSocket, options) {
     return session.exportKeyingMaterial(length, label, context_value);
   };
 
+  /** Negotiated DTLS-SRTP protection profile (RFC 5764), or null. */
+  self.getSelectedSrtpProfile = function() {
+    return session.getSelectedSrtpProfile();
+  };
+
   /** Peer hello extensions / single extension by numeric type. */
   self.getRemoteExtensions = function() { return session.getRemoteExtensions(); };
   self.getRemoteExtension = function(type) { return session.getRemoteExtension(type); };
@@ -190,6 +196,7 @@ function createDTLSServer(options, connectionListener) {
           mtu: options.mtu,
           ticketKeys: options.ticketKeys,
           useCookies: options.useCookies,
+          srtpProfiles: options.srtpProfiles,
         });
 
         connections[key] = socket;

package/src/record.js

@@ -33,12 +33,12 @@ function getAeadAlgo(cipherSuite) {
 // ===================== TLS 1.3 primitives =====================
 
 /** Derive write key + IV from a TLS 1.3 traffic secret. */
-function deriveKeys(trafficSecret, cipherSuite) {
+function deriveKeys(trafficSecret, cipherSuite, labelPrefix) {
   const empty = new Uint8Array(0);
   let cs = TLS_CIPHER_SUITES[cipherSuite];
   return {
-    key: hkdf_expand_label(cs.hash, trafficSecret, 'key', empty, cs.keylen),
-    iv:  hkdf_expand_label(cs.hash, trafficSecret, 'iv',  empty, 12)
+    key: hkdf_expand_label(cs.hash, trafficSecret, 'key', empty, cs.keylen, labelPrefix),
+    iv:  hkdf_expand_label(cs.hash, trafficSecret, 'iv',  empty, 12, labelPrefix)
   };
 }
 
@@ -956,7 +956,9 @@ function decryptEncryptedDtls13(data, keys) {
   let seq = reconstructDtlsSeq(truncated, hdr.seqLen2 ? 16 : 8,
                                (keys.maxReadSeq === undefined ? -1 : keys.maxReadSeq));
 
-  // Rebuild AAD with plaintext RN
+  // Rebuild AAD with plaintext RN. AAD depends only on the wire bytes (the
+  // decrypted record number + length), NOT on the reconstructed full seq —
+  // so it's computed once and reused across seq candidates below.
   let hdrLen = 1 + rnLen + (hdr.hasLength ? 2 : 0);
   let aad = new Uint8Array(hdrLen);
   aad[0] = data[0];
@@ -966,7 +968,6 @@ function decryptEncryptedDtls13(data, keys) {
     aad[1 + rnLen + 1] = ctLen & 0xFF;
   }
 
-  let nonce = getNonce(keys.iv, seq);
   let algo = keys.algo || (keys.key.length === 32 ? 'aes-256-gcm' : 'aes-128-gcm');
   let isChaCha = algo === 'chacha20-poly1305';
 
@@ -974,20 +975,66 @@ function decryptEncryptedDtls13(data, keys) {
   let ct = ciphertext.subarray(0, ciphertext.length - 16);
   let tag = ciphertext.subarray(ciphertext.length - 16);
 
-  try {
-    let decipher = crypto.createDecipheriv(algo, keys.key, nonce,
-      isChaCha ? { authTagLength: 16 } : undefined);
-    decipher.setAAD(aad, isChaCha ? { plaintextLength: ct.length } : undefined);
-    decipher.setAuthTag(tag);
-    let pt = decipher.update(ct);
-    decipher.final();
+  // The wire carries only the low bits of the record seq. reconstructDtlsSeq
+  // returns the most-likely full value, but under large gaps or reordering
+  // the true seq can be one window away in either direction. Only the NONCE
+  // depends on the full seq (AAD does not), so try the neighbouring
+  // candidates on AEAD failure before giving up — this is what lets
+  // DTLS-Replay-TLS13 / -LargeGaps / -NonMonotonic deprotect instead of
+  // failing as "bad record MAC". Candidates are deduped and non-negative.
+  let window = hdr.seqLen2 ? 65536 : 256;
+  let candidates = [seq];
+  if (seq - window >= 0) candidates.push(seq - window);
+  candidates.push(seq + window);
+
+  let pt = null, acceptedSeq = -1;
+  for (let ci = 0; ci < candidates.length; ci++) {
+    let cand = candidates[ci];
+    let nonce = getNonce(keys.iv, cand);
+    try {
+      let decipher = crypto.createDecipheriv(algo, keys.key, nonce,
+        isChaCha ? { authTagLength: 16 } : undefined);
+      decipher.setAAD(aad, isChaCha ? { plaintextLength: ct.length } : undefined);
+      decipher.setAuthTag(tag);
+      let out = decipher.update(ct);
+      decipher.final();
+      pt = out; acceptedSeq = cand;
+      break;
+    } catch (e) {
+      // try next candidate
+    }
+  }
 
+  if (pt === null) return null;
+  seq = acceptedSeq;
+
+  {
     let inner = parseInnerPlaintext(new Uint8Array(pt));
 
-    // Advance the per-epoch high-water mark only after the tag verified, so a
-    // forged/replayed record number can't poison future reconstruction.
-    if (keys.maxReadSeq === undefined || seq > keys.maxReadSeq) {
+    // RFC 9147 §4.5.1 anti-replay: only AFTER the tag verifies do we consult
+    // and update the sliding window. Checking before deprotection would let a
+    // forged record number poison the window; checking after means only
+    // genuine records move it. The window lives on the per-epoch key object,
+    // next to maxReadSeq, because both are per-epoch receive state.
+    //   replayWindow: bitmask of the 64 seqs at or below maxReadSeq that have
+    //   been accepted. Bit 0 = maxReadSeq, bit k = maxReadSeq - k.
+    if (keys.maxReadSeq === undefined || keys.maxReadSeq < 0) {
+      // First accepted record in this epoch: seed the window with this seq as
+      // the high-water mark (bit 0 set), so an immediate replay of it is
+      // caught below rather than sailing through an unset window.
+      keys.maxReadSeq = seq;
+      keys.replayWindow = 1n;
+    } else if (seq > keys.maxReadSeq) {
+      // Advance: shift the window up by the gap, then set bit 0.
+      let shift = BigInt(seq - keys.maxReadSeq);
+      keys.replayWindow = shift >= 64n ? 1n : ((keys.replayWindow << shift) | 1n) & ((1n << 64n) - 1n);
       keys.maxReadSeq = seq;
+    } else {
+      let back = BigInt(keys.maxReadSeq - seq);
+      if (back >= 64n) return null;                // too old — outside window
+      let bit = 1n << back;
+      if (keys.replayWindow & bit) return null;     // already seen — replay
+      keys.replayWindow |= bit;
     }
 
     return {
@@ -997,8 +1044,6 @@ function decryptEncryptedDtls13(data, keys) {
       content: inner.content,
       total_length: off + ctLen,
     };
-  } catch (e) {
-    return null;
   }
 }
 
@@ -1024,15 +1069,36 @@ function parseDtlsDatagram(data, keysByEpoch) {
       let keys = keysByEpoch ? keysByEpoch[hdr.epoch] : null;
 
       if (!keys) {
-        // Can't decrypt — try to skip
+        // No keys for this epoch YET. Do not discard the record: a DTLS peer
+        // legitimately packs its whole flight into one datagram, so the very
+        // record that lets us derive these keys (the ServerHello) can sit
+        // ahead of records encrypted under them. Throwing the rest away meant
+        // the entire encrypted flight vanished and the handshake stalled until
+        // the peer retransmitted — or forever, if it does not.
+        //
+        // Keep the raw bytes and mark the record deferred; the caller retries
+        // it after processing each earlier record, once the keys exist. This
+        // generalises the CCS-only re-decrypt that DTLS 1.2 already had.
         let rnLen = hdr.seqLen2 ? 2 : 1;
         let skip = 1 + rnLen;
+        let total;
         if (hdr.hasLength && off + skip + 2 <= data.length) {
-          skip += 2 + readU16(data, off + skip);
+          total = skip + 2 + readU16(data, off + skip);
         } else {
-          skip = data.length - off;
+          total = data.length - off;
         }
-        off += skip;
+        if (total <= 0 || off + total > data.length) total = data.length - off;
+
+        records.push({
+          type: null,
+          epoch: hdr.epoch,
+          seq: null,
+          content: null,
+          encrypted: false,
+          deferred: true,
+          raw: data.subarray(off, off + total),
+        });
+        off += total;
         continue;
       }
 
@@ -1174,6 +1240,7 @@ export {
   // DTLS 1.3 unified header
   buildUnifiedHdr,
   parseUnifiedHdr,
+  reconstructDtlsSeq,
   maskRecordNumber,
 
   // DTLS 1.3 encrypted records

package/src/session/ecdh.js

@@ -90,7 +90,131 @@ function p384_get_shared_secret(localPrivateRaw, remotePublicRaw) {
   return new Uint8Array(ecdh.computeSecret(Buffer.from(remotePublicRaw)));
 }
 
+/**
+ * Named groups this module actually implements, in preference order.
+ *
+ * SINGLE SOURCE OF TRUTH: consumers (TLSSession defaults, TLSSocket options,
+ * DTLSSession) must derive their advertised supported_groups from this list
+ * rather than hardcoding their own. Previously three call sites carried three
+ * different hardcoded lists — DTLS advertised P-384 while TLS did not, even
+ * though the code below has supported it all along, so a peer offering only
+ * P-384 got "no curve supported by both" from a stack that could do P-384.
+ *
+ * Adding a curve should be a change to THIS file only.
+ */
+const NAMED_GROUP = {
+  X25519:    0x001d,
+  SECP256R1: 0x0017,
+  SECP384R1: 0x0018,
+};
+
+const SUPPORTED_GROUPS = [
+  NAMED_GROUP.X25519,     // preferred: fastest, no point validation pitfalls
+  NAMED_GROUP.SECP256R1,
+  NAMED_GROUP.SECP384R1,
+];
+
+function is_supported_group(group) {
+  return SUPPORTED_GROUPS.indexOf(group) >= 0;
+}
+
+/**
+ * Generate a keypair for any supported group.
+ * Returns { private_key, public_key } or null for an unsupported group.
+ */
+function generate_keypair(group) {
+  if (group === NAMED_GROUP.X25519) {
+    let priv = new Uint8Array(crypto.randomBytes(32));
+    return { private_key: priv, public_key: x25519_get_public_key(priv) };
+  }
+  if (group === NAMED_GROUP.SECP256R1) return p256_generate_keypair();
+  if (group === NAMED_GROUP.SECP384R1) return p384_generate_keypair();
+  return null;
+}
+
+/**
+ * Validate a peer's key_exchange value for `group` and normalize it to the
+ * form the primitives below expect.
+ *
+ * Point-format knowledge belongs HERE, next to the curve implementations —
+ * not in the handshake state machine, which only needs to know "valid or not"
+ * so it can decide whether to abort. Throws on anything malformed; the caller
+ * converts that into an illegal_parameter alert.
+ */
+function normalize_peer_public_key(group, pub) {
+  if (!pub || pub.length === 0) throw new Error('empty key_exchange');
+
+  if (group === NAMED_GROUP.X25519) {
+    if (pub.length !== 32) {
+      throw new Error('X25519 key_exchange must be 32 bytes, got ' + pub.length);
+    }
+    return pub;
+  }
+
+  let coordLen = (group === NAMED_GROUP.SECP256R1) ? 32
+               : (group === NAMED_GROUP.SECP384R1) ? 48 : 0;
+  if (coordLen === 0) throw new Error('unsupported group 0x' + (group >>> 0).toString(16));
+
+  // RFC 8446 §4.2.8.2: for the secp*r1 groups the key_exchange is an
+  // UNCOMPRESSED point — 0x04 || X || Y — and nothing else. The length is
+  // therefore exact.
+  //
+  // This used to also accept a bare X || Y (no 0x04) and re-prefix it, as a
+  // tolerance for TLS 1.2 peers that strip the prefix. That tolerance is a
+  // security hole, not a kindness: truncating a valid 65-byte P-256 point by
+  // one byte yields exactly 64 bytes, which the tolerance then reinterpreted
+  // as a DIFFERENT, prefix-less point and happily fed to the ECDH. The same
+  // arithmetic applies to P-384 (97 → 96). Malformed input must be rejected,
+  // not silently reinterpreted.
+  let expected = 1 + 2 * coordLen;
+
+  if (pub.length !== expected) {
+    // Name the two shapes we know we are refusing, so the failure is
+    // diagnosable rather than just "bad length".
+    if (pub.length === 2 * coordLen) {
+      throw new Error('key_exchange is missing the 0x04 uncompressed-point prefix (got ' +
+        pub.length + ' bytes, expected ' + expected + ')');
+    }
+    if (pub.length === 1 + coordLen && (pub[0] === 0x02 || pub[0] === 0x03)) {
+      throw new Error('compressed points are not permitted; key_exchange must be uncompressed (RFC 8446 §4.2.8.2)');
+    }
+    throw new Error('key_exchange must be a ' + expected + '-byte uncompressed point, got ' + pub.length);
+  }
+
+  if (pub[0] !== 0x04) {
+    throw new Error('key_exchange must start with the 0x04 uncompressed-point marker, got 0x' +
+      pub[0].toString(16));
+  }
+
+  // Whether the point actually lies on the curve is checked by the ECDH
+  // primitive below (node throws ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY), which
+  // happens before any secret is produced — so an off-curve point can never
+  // yield key material.
+  return pub;
+}
+
+/**
+ * Compute the ECDHE shared secret for any supported group.
+ * Validates the peer's public key first; throws on invalid input (including
+ * the RFC 7748 §6.1 all-zero X25519 result and node's own on-curve checks).
+ */
+function get_shared_secret(group, localPrivateRaw, remotePublicRaw) {
+  let pub = normalize_peer_public_key(group, remotePublicRaw);
+
+  if (group === NAMED_GROUP.X25519)    return x25519_get_shared_secret(localPrivateRaw, pub);
+  if (group === NAMED_GROUP.SECP256R1) return p256_get_shared_secret(localPrivateRaw, pub);
+  if (group === NAMED_GROUP.SECP384R1) return p384_get_shared_secret(localPrivateRaw, pub);
+
+  throw new Error('unsupported group 0x' + (group >>> 0).toString(16));
+}
+
 export {
+  NAMED_GROUP,
+  SUPPORTED_GROUPS,
+  is_supported_group,
+  generate_keypair,
+  normalize_peer_public_key,
+  get_shared_secret,
   x25519_get_public_key,
   x25519_get_shared_secret,
   p256_generate_keypair,

package/src/session/message.js

@@ -193,6 +193,10 @@ function parse_tls_message(data, negotiatedVersion) {
     out.type = 'certificate';
 
   } else if (message.type == wire.TLS_MESSAGE_TYPE.CERTIFICATE_VERIFY) {
+    // Decode scheme + signature so the session can actually VERIFY it.
+    // Previously only the raw body was handed up and no caller ever checked
+    // the signature — every peer signature was accepted unconditionally.
+    out = wire.parse_certificate_verify(message.body);
     out.type = 'certificate_verify';
     out.body = message.body;
 
@@ -218,6 +222,37 @@ function parse_tls_message(data, negotiatedVersion) {
   } else if (message.type == wire.TLS_MESSAGE_TYPE.CERTIFICATE_REQUEST) {
     out = wire.parse_certificate_request(message.body);
     out.type = 'certificate_request';
+
+    // Surface the requested signature algorithms as a plain field.
+    //
+    // In TLS 1.3 they arrive inside the extensions vector (RFC 8446 §4.3.2);
+    // in TLS 1.2 the decoder already returns them as `signature_algorithms`
+    // (RFC 5246 §7.4.4). The session asks for one name, so normalise here —
+    // exactly what normalize_hello does for the hello messages. Without this
+    // the 1.3 list was silently undefined and the client fell back to signing
+    // with its OWN preference, ignoring what the server actually asked for;
+    // a server that requested a specific algorithm then rejects the signature
+    // as an unsupported one.
+    if (out.signature_algorithms === undefined && Array.isArray(out.extensions)) {
+      for (let i = 0; i < out.extensions.length; i++) {
+        let e = out.extensions[i];
+        if (e && e.type === wire.TLS_EXT.SIGNATURE_ALGORITHMS && Array.isArray(e.value)) {
+          out.signature_algorithms = e.value;
+          break;
+        }
+      }
+    }
+
+  } else {
+    // No silent fall-through. Returning a typeless object here made every
+    // unrecognized handshake type vanish: the session's dispatch chain matched
+    // nothing and simply returned, so a peer could stream unknown (or
+    // version-illegal, e.g. HelloRequest in TLS 1.3) messages indefinitely with
+    // no alert and no state change. Name the message instead and let the
+    // session decide — which it can only do if it is told.
+    out.type = 'unknown_handshake';
+    out.handshake_type = message.type;
+    out.body = message.body;
   }
 
   return out;