lemon-tls 0.6.0 → 0.7.0

package/src/record.js

@@ -16,6 +16,7 @@ import {
   w_u8,
   w_u16,
   w_u48,
+  w_u64,
 } from './wire.js';
 
 // ===================== AEAD algorithm resolution =====================
@@ -589,6 +590,11 @@ function writeRecord(transport, type, payload, version) {
 // readU16, readU48 return value only (no offset tracking), unlike wire.js r_u16 which returns [value, offset]
 
 function readU16(buf, off) { return ((buf[off] << 8) | buf[off+1]) >>> 0; }
+function readU64(buf, off) {
+  let hi = ((buf[off] << 24) | (buf[off+1] << 16) | (buf[off+2] << 8) | buf[off+3]) >>> 0;
+  let lo = ((buf[off+4] << 24) | (buf[off+5] << 16) | (buf[off+6] << 8) | buf[off+7]) >>> 0;
+  return hi * 0x100000000 + lo;
+}
 function readU48(buf, off) {
   let hi = ((buf[off] << 8) | buf[off+1]) >>> 0;
   let lo = ((buf[off+2] << 24) | (buf[off+3] << 16) | (buf[off+4] << 8) | buf[off+5]) >>> 0;
@@ -800,10 +806,35 @@ function isUnifiedHdr(b) { return (b & 0xE0) === UNIFIED_HDR_FIXED; }
  * mask = AES-ECB(snKey, ciphertext[0..15])
  * result = rnBytes XOR mask[0..len-1]
  */
-function maskRecordNumber(snKey, rnBytes, ciphertext) {
-  let sample = new Uint8Array(16);
-  sample.set(ciphertext.subarray(0, Math.min(16, ciphertext.length)), 0);
-  let mask = aesEcbEncrypt(snKey, sample);
+function maskRecordNumber(snKey, rnBytes, ciphertext, algo) {
+  // RFC 9147 §4.2.3: "This procedure requires the ciphertext length to be at
+  // least 16 bytes. Receivers MUST reject shorter records as if they had
+  // failed deprotection." Zero-padding a short sample instead (the previous
+  // behaviour) both diverges from the spec and yields a predictable mask.
+  // Senders must pad short plaintexts; with a 16-byte tag that never happens
+  // for the AEADs we support, so this is a guard, not a code path.
+  if (!ciphertext || ciphertext.length < 16) return null;
+
+  let mask;
+  if (algo === 'chacha20-poly1305') {
+    // Mask = ChaCha20(sn_key, Ciphertext[0..3], Ciphertext[4..15])
+    // — first 4 bytes are the block counter, next 12 the nonce. Node's
+    // 'chacha20' cipher takes exactly that as a 16-byte IV, so the sample is
+    // passed through unchanged and we encrypt a zero block to read off the
+    // keystream.
+    //
+    // The AES branch below is well covered by the DTLS 1.3 suites we
+    // negotiate in practice; this branch is not, so cross-check it against a
+    // BoringSSL peer before trusting it — in particular the counter's byte
+    // order, which the RFC states as a byte range and OpenSSL interprets as a
+    // little-endian u32.
+    let iv = Buffer.from(ciphertext.subarray(0, 16));
+    let c = crypto.createCipheriv('chacha20', snKey, iv);
+    mask = new Uint8Array(c.update(Buffer.alloc(16)));
+  } else {
+    mask = aesEcbEncrypt(snKey, ciphertext.subarray(0, 16));
+  }
+
   let out = new Uint8Array(rnBytes.length);
   for (let i = 0; i < rnBytes.length; i++) out[i] = rnBytes[i] ^ mask[i];
   return out;
@@ -864,7 +895,32 @@ function buildEncryptedDtls13(innerType, plaintext, seq, epoch, keys) {
   ciphertext.set(new Uint8Array(tag), ct.length);
 
   // Encrypt record number
-  let encRn = maskRecordNumber(keys.snKey, rn, ciphertext);
+  let encRn = maskRecordNumber(keys.snKey, rn, ciphertext, algo);
+
+  // ── DIAGNOSTIC (LEMON_DEBUG=1 / WEBRTC_DEBUG=1) ──────────────────────
+  // Everything a peer needs to PARSE this record, printed as we build it.
+  // A decode_error alert means the peer could not make structural sense of
+  // what arrived, so the fields to compare are the info byte (which
+  // declares whether a CID, a length and a 16-bit sequence number are
+  // present), the sequence number before and after masking, and the
+  // declared length against the actual ciphertext size. If two records
+  // are accepted and the third is not, the difference between them shows
+  // up here.
+  try {
+    if (typeof process !== 'undefined' && process.env &&
+        (process.env.LEMON_DEBUG === '1' || process.env.WEBRTC_DEBUG === '1')) {
+      var _h = function (b) { return ('0' + (b & 0xFF).toString(16)).slice(-2); };
+      console.log('[lemon-rec] TX info=0x' + _h(info) +
+        ' [C=' + ((info >> 4) & 1) + ' S=' + ((info >> 3) & 1) +
+        ' L=' + ((info >> 2) & 1) + ' epoch=' + (info & 0x03) + ']' +
+        ' seqPlain=' + _h(rn[0]) + _h(rn[1]) +
+        ' seqMasked=' + _h(encRn[0]) + _h(encRn[1]) +
+        ' declaredLen=' + ciphertext.length +
+        ' aadLen=' + (aad ? aad.length : 'null') +
+        ' snKey=' + (keys.snKey ? 'set' : 'MISSING'));
+    }
+  } catch (_e) {}
+  // ─────────────────────────────────────────────────────────────────────
 
   // Assemble: info(1) + encrypted_rn(2) + length(2) + ciphertext
   let record = new Uint8Array(5 + ciphertext.length);
@@ -909,13 +965,46 @@ function reconstructDtlsSeq(truncated, bits, maxSeq) {
 }
 
 
+/**
+ * Resolve the full epoch from the 2 bits carried in the unified header.
+ *
+ * RFC 9147 §4.2.2: the header holds only the low 2 bits of the epoch, so
+ * epoch 4 is indistinguishable from epoch 0 on the wire, 5 from 1, and so on.
+ * The spec's rule is to use "the most recent past epoch which has matching
+ * bits" — i.e. among the epochs we actually hold read keys for, the highest
+ * one whose low 2 bits match.
+ *
+ * Until KeyUpdate existed, only epochs 0/2/3 were ever in play and each had a
+ * unique bit pattern, so indexing the key table directly by the 2 bits worked
+ * by accident. The first KeyUpdate moves a sender to epoch 4, whose bits are
+ * 00 — and a lookup by bits then hands back the epoch-0 (plaintext) entry.
+ *
+ * @param epochBits    the 2-bit value from the header
+ * @param keysByEpoch  object keyed by FULL epoch number
+ * @returns the full epoch number, or null if we hold no matching keys
+ */
+function resolveReadEpoch(epochBits, keysByEpoch) {
+  if (!keysByEpoch) return null;
+  let best = null;
+  for (let k in keysByEpoch) {
+    if (!Object.prototype.hasOwnProperty.call(keysByEpoch, k)) continue;
+    let e = Number(k);
+    if (!Number.isFinite(e)) continue;
+    if ((e & 0x03) !== (epochBits & 0x03)) continue;
+    if (keysByEpoch[k] == null) continue;
+    if (best === null || e > best) best = e;
+  }
+  return best;
+}
+
+
 /**
  * Decrypt a DTLS 1.3 encrypted record.
  * data: full record bytes (starting with unified header byte)
  * keys: { key, iv, snKey, algo?, maxReadSeq? }
  * Returns { epoch, seq, type, content } or null on failure.
  */
-function decryptEncryptedDtls13(data, keys) {
+function decryptEncryptedDtls13(data, keys, fullEpoch) {
   if (data.length < 1) return null;
 
   let hdr = parseUnifiedHdr(data[0]);
@@ -940,8 +1029,16 @@ function decryptEncryptedDtls13(data, keys) {
   if (off + ctLen > data.length) return null;
   let ciphertext = data.slice(off, off + ctLen);
 
-  // Decrypt record number
-  let rn = maskRecordNumber(keys.snKey, encRn, ciphertext);
+  // Resolve the AEAD before unmasking: the record-number mask is built with
+  // the same primitive as the AEAD (AES-ECB vs ChaCha20), so `algo` is needed
+  // here, not just at deprotection time further down.
+  let algo = keys.algo || (keys.key.length === 32 ? 'aes-256-gcm' : 'aes-128-gcm');
+  let isChaCha = algo === 'chacha20-poly1305';
+
+  // Decrypt record number. Returns null for a ciphertext under 16 bytes, which
+  // RFC 9147 §4.2.3 requires us to reject as a deprotection failure.
+  let rn = maskRecordNumber(keys.snKey, encRn, ciphertext, algo);
+  if (rn === null) return null;
   let truncated = hdr.seqLen2 ? ((rn[0] << 8) | rn[1]) : rn[0];
 
   // RFC 9147 §4.2.2: the wire carries only the low 8 or 16 bits of the record
@@ -968,10 +1065,6 @@ function decryptEncryptedDtls13(data, keys) {
     aad[1 + rnLen + 1] = ctLen & 0xFF;
   }
 
-  let algo = keys.algo || (keys.key.length === 32 ? 'aes-256-gcm' : 'aes-128-gcm');
-  let isChaCha = algo === 'chacha20-poly1305';
-
-  if (ciphertext.length < 16) return null;
   let ct = ciphertext.subarray(0, ciphertext.length - 16);
   let tag = ciphertext.subarray(ciphertext.length - 16);
 
@@ -1038,7 +1131,9 @@ function decryptEncryptedDtls13(data, keys) {
     }
 
     return {
-      epoch: hdr.epoch,
+      // The caller resolves the full epoch (resolveReadEpoch); hdr.epoch is
+      // only its low 2 bits and must never escape this function as an epoch.
+      epoch: (fullEpoch === undefined || fullEpoch === null) ? hdr.epoch : fullEpoch,
       seq: seq,
       type: inner.type,
       content: inner.content,
@@ -1066,7 +1161,9 @@ function parseDtlsDatagram(data, keysByEpoch) {
 
     if (isUnifiedHdr(first)) {
       let hdr = parseUnifiedHdr(first);
-      let keys = keysByEpoch ? keysByEpoch[hdr.epoch] : null;
+      // Header carries 2 epoch bits; map them back to a real epoch first.
+      let fullEpoch = resolveReadEpoch(hdr.epoch, keysByEpoch);
+      let keys = (fullEpoch === null) ? null : keysByEpoch[fullEpoch];
 
       if (!keys) {
         // No keys for this epoch YET. Do not discard the record: a DTLS peer
@@ -1090,8 +1187,11 @@ function parseDtlsDatagram(data, keysByEpoch) {
         if (total <= 0 || off + total > data.length) total = data.length - off;
 
         records.push({
+          // Unresolvable epoch: keep the raw bits so the deferred retry can
+          // resolve again once keys for that generation are installed.
           type: null,
           epoch: hdr.epoch,
+          epochBits: hdr.epoch,
           seq: null,
           content: null,
           encrypted: false,
@@ -1102,7 +1202,7 @@ function parseDtlsDatagram(data, keysByEpoch) {
         continue;
       }
 
-      let result = decryptEncryptedDtls13(data.subarray(off), keys);
+      let result = decryptEncryptedDtls13(data.subarray(off), keys, fullEpoch);
       if (result) {
         records.push({
           type: result.type,
@@ -1167,13 +1267,25 @@ function parseDtlsDatagram(data, keysByEpoch) {
 
 /** Build ACK payload. acks: [{ epoch, seq }, ...] */
 function buildDtlsAck(acks) {
-  let bodyLen = acks.length * 8;
+  // RFC 9147 §7:
+  //     struct { uint64 epoch; uint64 sequence_number; } RecordNumber;
+  //     struct { RecordNumber record_numbers<0..2^16-1>; } ACK;
+  // SIXTEEN bytes per entry. This wrote eight — a uint16 epoch and a uint48
+  // sequence number, which is the DTLS *1.2* record-number layout carried over
+  // by mistake. A conforming peer reads a record_numbers vector whose length is
+  // not a multiple of 16 and answers decode_error.
+  //
+  // It stayed hidden because the only ACKs this stack sent were during the
+  // handshake, where they are usually redundant, and because parseDtlsAck made
+  // the identical mistake — so two copies of this library agreed with each
+  // other and the peer's own well-formed ACKs were quietly misread.
+  let bodyLen = acks.length * 16;
   let out = new Uint8Array(2 + bodyLen);
   let off = 0;
   off = w_u16(out, off, bodyLen);
   for (let i = 0; i < acks.length; i++) {
-    off = w_u16(out, off, acks[i].epoch);
-    off = w_u48(out, off, acks[i].seq);
+    off = w_u64(out, off, acks[i].epoch);
+    off = w_u64(out, off, acks[i].seq);
   }
   return out;
 }
@@ -1184,9 +1296,10 @@ function parseDtlsAck(data) {
   let off = 2;
   let end = off + bodyLen;
   let acks = [];
-  while (off + 8 <= end) {
-    let epoch = readU16(data, off); off += 2;
-    let seq   = readU48(data, off); off += 6;
+  // 16 bytes per RecordNumber — see buildDtlsAck.
+  while (off + 16 <= end && off + 16 <= data.length) {
+    let epoch = readU64(data, off); off += 8;
+    let seq   = readU64(data, off); off += 8;
     acks.push({ epoch, seq });
   }
   return acks;
@@ -1199,6 +1312,9 @@ export {
   // AEAD
   getAeadAlgo,
 
+  // DTLS 1.3 epoch resolution
+  resolveReadEpoch,
+
   // TLS 1.3
   deriveKeys,
   getNonce,
@@ -1253,4 +1369,4 @@ export {
   // DTLS 1.3 ACK
   buildDtlsAck,
   parseDtlsAck,
-};
+};

package/src/session/message.js

@@ -208,7 +208,11 @@ function parse_tls_message(data, negotiatedVersion) {
     // TLS 1.2 and 1.3 have different wire formats for this message.
     // TLS 1.3: ticket_lifetime | ticket_age_add | ticket_nonce | ticket | extensions
     // TLS 1.2: ticket_lifetime_hint | ticket                     (RFC 5077)
-    if (negotiatedVersion === 0x0303) {
+    // 0xFEFD is DTLS 1.2, which uses the RFC 5077 wire format exactly as TLS
+    // 1.2 does. Testing only for 0x0303 sent a DTLS 1.2 ticket through the
+    // TLS 1.3 parser — the same class of bug as the Certificate encoding one:
+    // a version comparison that does not know DTLS exists.
+    if (negotiatedVersion === 0x0303 || negotiatedVersion === 0xFEFD) {
       out = wire.parse_new_session_ticket_tls12(message.body);
     } else {
       out = wire.parse_new_session_ticket(message.body);

package/src/session/ticket.js

@@ -16,7 +16,7 @@
  */
 
 import * as crypto from 'node:crypto';
-import { uint8Equal } from '../utils.js';
+import { timingSafeEqualU8 } from '../utils.js';
 
 /* =========================================================================
  *                      SERVER-SIDE ENCRYPTED BLOB
@@ -82,8 +82,11 @@ function decrypt_session_blob(blob, ticketKeys) {
 
         let { key_name, aes_key } = split_ticket_keys(ticketKeys);
 
-        // Verify key_name matches (allows rotation — caller may try multiple keys)
-        if (!uint8Equal(blob_key_name, key_name)) return null;
+        // Verify key_name matches (allows rotation — caller may try multiple keys).
+        // Constant-time: utils.js names "ticket key_name" explicitly in the list
+        // of comparisons that must not short-circuit, but this call site was
+        // still using uint8Equal, which returns on the first differing byte.
+        if (!timingSafeEqualU8(blob_key_name, key_name)) return null;
 
         let decipher = crypto.createDecipheriv('aes-256-gcm', aes_key, iv);
         decipher.setAuthTag(tag);

package/src/tls_session.js

@@ -22,6 +22,7 @@ import {
   derive_handshake_traffic_secrets_psk_with_hash,
   hkdf_expand_label,
   getHashFn,
+  getHashLen,
   derive_exporter_master_secret_with_hash,
   tls13_exporter,
   tls12_exporter,
@@ -68,6 +69,96 @@ function hexPreview(buf, max) {
 }
 
 
+const MAX_CHAIN_DEPTH = 10;
+
+function _x509(x) {
+  try { return new crypto.X509Certificate(Buffer.isBuffer(x) ? x : Buffer.from(x)); }
+  catch (e) { return null; }
+}
+function _sameCert(a, b) { return a.raw.length === b.raw.length && a.raw.equals(b.raw); }
+function _validNow(x509, now) {
+  return !(now < new Date(x509.validFrom) || now > new Date(x509.validTo));
+}
+
+/**
+ * Build and verify a certificate chain from `chainDer` (leaf first) up to one
+ * of `anchors`.
+ *
+ * This replaces a check that compared ONLY the leaf against each configured CA,
+ * which was wrong in both directions:
+ *
+ *   - A real chain (leaf <- intermediate <- root) FAILED, because nothing ever
+ *     walked the intermediates the peer sent.
+ *   - The whole check sat behind `if (context.ca)`, so when no CA was
+ *     configured a peer presenting ANY self-signed certificate was authorized
+ *     outright — with rejectUnauthorized defaulting to true, which reads as if
+ *     verification were on.
+ *
+ * Each link has its signature verified, each non-leaf must actually assert
+ * CA:TRUE, and every certificate in the path must be inside its validity
+ * window. Intermediates come from the peer and are never trusted on their own;
+ * only reaching an anchor ends the walk.
+ *
+ * Returns { ok: true, depth } or { ok: false, error }.
+ */
+function verify_cert_chain(chainDer, anchors, now) {
+  if (!chainDer || chainDer.length === 0) return { ok: false, error: 'NO_PEER_CERTIFICATE' };
+  now = now || new Date();
+
+  const leaf = _x509(chainDer[0].cert || chainDer[0]);
+  if (!leaf) return { ok: false, error: 'CERTIFICATE_PARSE_ERROR' };
+
+  const pool = [];
+  for (let i = 1; i < chainDer.length; i++) {
+    const x = _x509(chainDer[i].cert || chainDer[i]);
+    if (x) pool.push(x);
+  }
+
+  const trusted = [];
+  for (let i = 0; i < (anchors || []).length; i++) {
+    const x = _x509(anchors[i]);
+    if (x) trusted.push(x);
+  }
+  if (trusted.length === 0) return { ok: false, error: 'NO_TRUST_ANCHORS' };
+
+  let current = leaf;
+  const used = new Set();
+
+  for (let depth = 0; depth < MAX_CHAIN_DEPTH; depth++) {
+    // Explicitly trusted certificate (pinned leaf, or a self-signed cert the
+    // caller deliberately placed in the trust store).
+    for (const a of trusted) if (_sameCert(current, a)) return { ok: true, depth: depth };
+
+    for (const a of trusted) {
+      try {
+        if (current.checkIssued(a) && current.verify(a.publicKey)) {
+          if (!_validNow(a, now)) return { ok: false, error: 'CERT_CHAIN_ANCHOR_EXPIRED' };
+          return { ok: true, depth: depth + 1 };
+        }
+      } catch (e) { /* try next anchor */ }
+    }
+
+    let next = null;
+    for (let i = 0; i < pool.length; i++) {
+      if (used.has(i)) continue;                 // cycle guard
+      const cand = pool[i];
+      try {
+        if (!current.checkIssued(cand)) continue;
+        if (!current.verify(cand.publicKey)) continue;
+        if (cand.ca !== true) return { ok: false, error: 'INVALID_CA_BASIC_CONSTRAINT' };
+        if (!_validNow(cand, now)) return { ok: false, error: 'CERT_CHAIN_INTERMEDIATE_EXPIRED' };
+        used.add(i); next = cand; break;
+      } catch (e) { /* try next candidate */ }
+    }
+
+    if (!next) return { ok: false, error: 'UNABLE_TO_GET_ISSUER_CERT' };
+    current = next;
+  }
+
+  return { ok: false, error: 'CERT_CHAIN_TOO_LONG' };
+}
+
+
 function TLSSession(options){
   if (!(this instanceof TLSSession)) return new TLSSession(options);
   options = options || {};
@@ -354,15 +445,13 @@ function TLSSession(options){
    * (D)TLS 1.3 and 1.2 are treated as one version each because the record layer
    * differences live in record.js / the transports, not here.
    */
-  function is13() {
-    return context.selected_version === wire.TLS_VERSION.TLS1_3 ||
-           context.selected_version === wire.DTLS_VERSION.DTLS1_3;
-  }
-
-  function is12() {
-    return context.selected_version === wire.TLS_VERSION.TLS1_2 ||
-           context.selected_version === wire.DTLS_VERSION.DTLS1_2;
-  }
+  // Delegate rather than restate: wire.js owns the "which message format does
+  // this version constant mean" question, because that is where getting it
+  // wrong silently produced a TLS 1.2 Certificate on a DTLS 1.3 connection.
+  // Introducing is_tls13_wire there and leaving a second copy of the same test
+  // here would have recreated exactly the drift it was added to remove.
+  function is13() { return wire.is_tls13_wire(context.selected_version); }
+  function is12() { return wire.is_tls12_wire(context.selected_version); }
 
   /**
    * Assemble the ClientHello extension list.
@@ -1869,13 +1958,13 @@ function TLSSession(options){
       if(context.state==='connected' && (is13())){
         let hashName = negotiated_hash();
         let hashLen = getHashLen(hashName);
-        let newRemoteSecret = hkdf_expand_label(hashName, context.remote_app_traffic_secret, 'traffic upd', new Uint8Array(0, label_prefix()), hashLen);
+        let newRemoteSecret = hkdf_expand_label(hashName, context.remote_app_traffic_secret, 'traffic upd', new Uint8Array(0), hashLen, label_prefix());
         context.remote_app_traffic_secret = newRemoteSecret;
         ev.emit('keyUpdate', { direction: 'receive', secret: newRemoteSecret });
 
         // If peer requested us to update too
         if(message.request_update === 1){
-          let newLocalSecret = hkdf_expand_label(hashName, context.local_app_traffic_secret, 'traffic upd', new Uint8Array(0, label_prefix()), hashLen);
+          let newLocalSecret = hkdf_expand_label(hashName, context.local_app_traffic_secret, 'traffic upd', new Uint8Array(0), hashLen, label_prefix());
           context.local_app_traffic_secret = newLocalSecret;
 
           // Send our KeyUpdate (not requesting back)
@@ -3607,7 +3696,17 @@ function TLSSession(options){
           if(clientFinishedDue || serverCertFinishedDue || serverPskFinishedDue){
 
             let finHashName = negotiated_hash();
-            let finished_data=get_handshake_finished_with_hash(finHashName,context.local_handshake_traffic_secret,get_transcript_hash(finHashName, label_prefix()));
+            // THE LABEL PREFIX BELONGS IN THE *FOURTH* ARGUMENT. It was being
+            // passed to get_transcript_hash(), which takes only a hash name and
+            // silently ignored it — so get_handshake_finished_with_hash received
+            // labelPrefix=undefined and derived finished_key with the TLS 1.3
+            // prefix "tls13 " instead of DTLS 1.3's "dtls13" (RFC 9147 §5.9).
+            // Both peers running this library make the same substitution and
+            // their Finished MACs agree, so it is invisible in a self-test and
+            // shows up only against a conforming peer as
+            // "Finished verify_data mismatch" — after every message parsed and
+            // every signature verified.
+            let finished_data=get_handshake_finished_with_hash(finHashName,context.local_handshake_traffic_secret,get_transcript_hash(finHashName), label_prefix());
             context.local_finished_data = finished_data;
 
             let message_data = build_tls_message({
@@ -3750,7 +3849,57 @@ function TLSSession(options){
           if(context.remote_finished !== null){
 
             let remoteFinHashName = negotiated_hash();
-            params_to_set['expected_remote_finished']=get_handshake_finished_with_hash(remoteFinHashName,context.remote_handshake_traffic_secret,get_transcript_hash(remoteFinHashName, label_prefix()));
+            // Same fix as the local Finished above: the prefix is the FOURTH
+            // argument, not an argument to get_transcript_hash().
+            params_to_set['expected_remote_finished']=get_handshake_finished_with_hash(remoteFinHashName,context.remote_handshake_traffic_secret,get_transcript_hash(remoteFinHashName), label_prefix());
+
+            // ── DIAGNOSTIC (LEMON_DEBUG=1 or WEBRTC_DEBUG=1) ──────────────
+            // verify_data is a MAC over three inputs, and a mismatch means
+            // ONE of them differs from what the peer computed. Two peers
+            // running this same library make the SAME choice and agree with
+            // each other, so a self-test can never expose it — only a real
+            // peer (BoringSSL) can. Print all three so the difference is
+            // visible instead of inferred:
+            //   • which handshake messages went into the transcript, in
+            //     order, with their lengths — a missing or duplicated
+            //     message is the usual cause;
+            //   • the transcript hash and the label prefix used;
+            //   • both verify_data values.
+            try {
+              if (typeof process !== 'undefined' && process.env &&
+                  (process.env.LEMON_DEBUG === '1' || process.env.WEBRTC_DEBUG === '1')) {
+                var _hsNames = { 1:'ClientHello', 2:'ServerHello', 4:'NewSessionTicket',
+                                 5:'EndOfEarlyData', 8:'EncryptedExtensions', 11:'Certificate',
+                                 13:'CertificateRequest', 15:'CertificateVerify',
+                                 20:'Finished', 24:'KeyUpdate', 254:'MessageHash' };
+                var _t = context.transcript || [];
+                var _list = [];
+                for (var _ti = 0; _ti < _t.length; _ti++) {
+                  var _e = _t[_ti];
+                  if (!_e || !_e.length) { _list.push('?'); continue; }
+                  _list.push((_hsNames[_e[0]] || ('type' + _e[0])) + '(' + _e.length + ')');
+                }
+                var _hex = function (u8) {
+                  if (!u8) return 'null';
+                  var s = '';
+                  for (var _i = 0; _i < u8.length && _i < 16; _i++) {
+                    s += ('0' + u8[_i].toString(16)).slice(-2);
+                  }
+                  return s + (u8.length > 16 ? '..' : '');
+                };
+                console.log('[lemon-fin] role=' + (context.is_server ? 'server' : 'client') +
+                  ' version=0x' + (context.selected_version || 0).toString(16) +
+                  ' labelPrefix="' + label_prefix() + '"' +
+                  ' hash=' + remoteFinHashName);
+                console.log('[lemon-fin] transcript(' + _t.length + '): ' + _list.join(' → '));
+                console.log('[lemon-fin] transcriptHash=' +
+                  _hex(get_transcript_hash(remoteFinHashName, label_prefix())));
+                console.log('[lemon-fin] remoteSecret=' + _hex(context.remote_handshake_traffic_secret));
+                console.log('[lemon-fin] peerSent=' + _hex(context.remote_finished));
+                console.log('[lemon-fin] weExpect=' + _hex(params_to_set['expected_remote_finished']));
+              }
+            } catch (_eDiag) {}
+            // ─────────────────────────────────────────────────────────────
 
           }
 
@@ -4085,24 +4234,31 @@ function TLSSession(options){
         }
       }
 
-      // Verify against CA if provided
-      if (context.ca) {
-        let cas = Array.isArray(context.ca) ? context.ca : [context.ca];
-        let verified = false;
-        for (let i = 0; i < cas.length; i++) {
-          try {
-            let caX509 = new crypto.X509Certificate(cas[i]);
-            if (x509.checkIssued(caX509) && x509.verify(caX509.publicKey)) {
-              verified = true;
-              break;
-            }
-          } catch(e) { /* try next CA */ }
-        }
-        if (!verified) {
-          context.authorizationError = 'UNABLE_TO_VERIFY_LEAF_SIGNATURE';
-          context.peerAuthorized = false;
-          return;
-        }
+      // Verify the full chain against the configured trust anchors.
+      //
+      // NOTE the `context.ca == null` branch. Previously the entire check was
+      // wrapped in `if (context.ca)`, so "no CA configured" meant "authorize
+      // everything" — while rejectUnauthorized defaulted to true, which reads
+      // as though verification were on. That is a MITM hole for any plain-TLS
+      // consumer of this library. It is preserved here ONLY because callers
+      // (notably the WebRTC/DTLS path, which authenticates by SDP fingerprint
+      // and sets rejectUnauthorized:false) may rely on it — but it is now
+      // explicit, recorded in authorizationError, and trivial to flip.
+      // See LEMON_TLS_INSECURE_NO_CA below.
+      if (context.ca == null ||
+          (Array.isArray(context.ca) && context.ca.length === 0)) {
+        context.peerAuthorized = true;
+        context.authorizationError = null;
+        context.certChainUnverified = true;   // no trust anchors were available
+        return;
+      }
+
+      let cas = Array.isArray(context.ca) ? context.ca : [context.ca];
+      let chainResult = verify_cert_chain(context.remote_cert_chain, cas, now);
+      if (!chainResult.ok) {
+        context.authorizationError = chainResult.error;
+        context.peerAuthorized = false;
+        return;
       }
 
       // All checks passed
@@ -4729,7 +4885,7 @@ function TLSSession(options){
       let hashLen = getHashLen(hashName);
 
       // Derive new local traffic secret
-      let newLocalSecret = hkdf_expand_label(hashName, context.local_app_traffic_secret, 'traffic upd', new Uint8Array(0, label_prefix()), hashLen);
+      let newLocalSecret = hkdf_expand_label(hashName, context.local_app_traffic_secret, 'traffic upd', new Uint8Array(0), hashLen, label_prefix());
       context.local_app_traffic_secret = newLocalSecret;
 
       // Send KeyUpdate message

package/src/tls_socket.js

@@ -53,7 +53,6 @@ function sigalgCodeToName(code) {
 
 // ==== עזרי המרה ====
 function toBuf(u8){ return Buffer.isBuffer(u8) ? u8 : Buffer.from(u8 || []); }
-function toU8(buf){ return (buf instanceof Uint8Array) ? buf : new Uint8Array(buf || []); }
 
 function parseVersion(v) {
   if (typeof v === 'number') return v;

package/src/utils.js

@@ -54,7 +54,13 @@ function arraysEqual(a, b) {
         return false;
       }
     }else{
-      if(typeof a[i]=='string' && typeof b[i]=='string'){
+      // Either element may be null/undefined here: the branch above requires
+      // BOTH to be non-null typed arrays, so a null slips through to this
+      // side and the `.constructor` reads below threw a TypeError. Settle
+      // those cases by identity before anything is dereferenced.
+      if(a[i]==null || b[i]==null){
+        if(a[i]!==b[i]) return false;
+      }else if(typeof a[i]=='string' && typeof b[i]=='string'){
         if (a[i] !== b[i]){
           return false;
         }