lemon-tls 0.6.0 → 0.9.0

package/src/compat.js

@@ -6,12 +6,15 @@
  */
 
 import net from 'node:net';
+import nodeTls from 'node:tls';   // for the shipped CA bundle only
 import crypto from 'node:crypto';
 import { EventEmitter } from 'node:events';
 import { TLS_CIPHER_SUITES } from './crypto.js';
 import TLSSession from './tls_session.js';
 import TLSSocket from './tls_socket.js';
 import createSecureContext from './secure_context.js';
+import { parseCiphers, parseEcdhCurve, parseSigalgs } from './node_options.js';
+import { prepare_ech_server } from './session/ech.js';
 
 // ===================== Constants =====================
 
@@ -44,6 +47,46 @@ function getCiphers() {
   return out;
 }
 
+/* ===================== Default CA store ===================== */
+
+/**
+ * The trust anchors Node ships (Mozilla's CA bundle). Exposed under the same
+ * name Node uses so `tls.rootCertificates` works unchanged, and so this
+ * library has a real default to chain against.
+ *
+ * That default matters more than parity. Until now, "no `ca` configured" meant
+ * "authorize every certificate", while `rejectUnauthorized` defaulted to true
+ * — the connection reported itself verified without ever verifying anything.
+ * Node never behaved that way: it falls back to this bundle.
+ *
+ * Parsing all ~144 certificates costs a few tens of milliseconds, so it is
+ * done once, lazily, and only if something actually needs it.
+ */
+let _rootPems = null;
+function getRootCertificates() {
+  if (_rootPems === null) {
+    try { _rootPems = nodeTls.rootCertificates.slice(); }
+    catch (e) { _rootPems = []; }   // a build without the bundle
+  }
+  return _rootPems;
+}
+
+/** Node-compat: tls.getCACertificates([type]). 'default' and 'bundled' both
+ *  resolve to the shipped bundle; 'extra' and 'system' are not sourced here
+ *  and return empty rather than pretending. */
+function getCACertificates(type) {
+  let t = type || 'default';
+  if (t === 'default' || t === 'bundled') return getRootCertificates().slice();
+  return [];
+}
+
+/** Node-compat: tls.setDefaultCACertificates(certs). Replaces the bundle for
+ *  every subsequent connection that does not pass its own `ca`. */
+function setDefaultCACertificates(certs) {
+  if (!Array.isArray(certs)) throw new TypeError('certs must be an array');
+  _rootPems = certs.slice();
+}
+
 // ===================== tls.checkServerIdentity() =====================
 
 /**
@@ -177,20 +220,49 @@ function connect(/* ...args */) {
     isServer: false,
     servername: options.servername || host,
     rejectUnauthorized: options.rejectUnauthorized,
+    checkServerIdentity: options.checkServerIdentity,
+    // Stream-shape options Node forwards to the socket. Both were dropped
+    // here, so allowHalfOpen could not be set through connect() at all.
+    allowHalfOpen: options.allowHalfOpen,
+    highWaterMark: options.highWaterMark,
+    secureContext: options.secureContext,
+    passphrase: options.passphrase,
     ca: options.ca,
+    useDefaultCA: options.useDefaultCA,
+    defaultCA: getRootCertificates,
     session: options.session,
     ALPNProtocols: options.ALPNProtocols,
     minVersion: options.minVersion,
     maxVersion: options.maxVersion,
-    signatureAlgorithms: options.signatureAlgorithms,
-    groups: options.groups,
+    // node:tls's own strings (ciphers, ecdhCurve, sigalgs) — taken by
+    // nothing until now — or lemon-tls's code lists, which win.
+    signatureAlgorithms: options.signatureAlgorithms || parseSigalgs(options.sigalgs),
+    groups: options.groups || parseEcdhCurve(options.ecdhCurve),
     prioritizeChaCha: options.prioritizeChaCha,
+    // Forwarded on the server side but dropped here, so a client could not
+    // narrow the suites it offers.
+    allowedCipherSuites: options.allowedCipherSuites || parseCiphers(options.ciphers),
     maxRecordSize: options.maxRecordSize,
     sessionTickets: options.sessionTickets,
     ticketLifetime: options.ticketLifetime,
+    // RFC 8879: algorithms to offer for the server's certificate chain.
+    certificateCompression: options.certificateCompression,
+    // node:tls: ask the server for a stapled OCSP response ('OCSPResponse').
+    requestOCSP: options.requestOCSP === true,
     cert: options.cert,
     key: options.key,
     maxHandshakeSize: options.maxHandshakeSize,
+    // Encrypted Client Hello (RFC 9849): the server's ECHConfigList (bytes or
+    // base64 — the `ech=` of its HTTPS record), or GREASE ECH without one.
+    ech: options.ech,
+    echGrease: options.echGrease === true,
+    // ClientHello shaping, documented as connect() options and dropped
+    // here: neither reached the socket.
+    grease: options.grease,
+    permuteExtensions: options.permuteExtensions,
+    // 0-RTT: with `session` whose ticket allows it, what is written before
+    // 'secureConnect' goes in the first flight ('earlyData' says if taken).
+    earlyData: options.earlyData === true,
   });
 
   addCompatMethods(socket);
@@ -199,9 +271,32 @@ function connect(/* ...args */) {
     socket.on('secureConnect', connectListener);
   }
 
-  let tcp = net.connect(port, host, function() {
+  let tcp = null;
+
+  if (options.socket) {
+    // Node: "Establish secure connection on a given socket rather than
+    // creating a new socket... If this option is specified, path, host, and
+    // port are ignored, except for certificate validation." Crucially it also
+    // says connection and teardown of that socket remain the caller's job and
+    // that tls.connect() will not call net.connect() at all — so we attach and
+    // nothing else. This is what STARTTLS needs: the caller speaks cleartext
+    // first (SMTP, IMAP, PostgreSQL), then upgrades the same connection.
+    //
+    // The socket is usually already connected, but it need not be; the
+    // handshake simply starts once it is writable.
+    tcp = options.socket;
     socket.setSocket(tcp);
-  });
+  } else {
+    // The rest of the options go to net.connect, as node:tls does ("any
+    // socket.connect() option not already listed"): noDelay, keepAlive,
+    // keepAliveInitialDelay, localAddress, localPort, family, lookup, timeout.
+    // Dropped here, none of them could be set through connect() at all.
+    let netOptions = Object.assign({}, options, { port: port, host: host });
+    delete netOptions.socket;
+    tcp = net.connect(netOptions, function() {
+      socket.setSocket(tcp);
+    });
+  }
 
   tcp.on('error', function(e) {
     socket.emit('error', e);
@@ -224,6 +319,7 @@ function connect(/* ...args */) {
  * Provides:
  *   - listen(), close(), address(), getConnections()
  *   - getTicketKeys(), setTicketKeys(), setSecureContext()
+ *   - getEchKeys(), setEchKeys() — Encrypted Client Hello keys (RFC 9849)
  */
 function Server(options, connectionListener) {
   if (!(this instanceof Server)) return new Server(options, connectionListener);
@@ -232,9 +328,28 @@ function Server(options, connectionListener) {
   let self = this;
   options = options || {};
 
+  // Node throws on this combination rather than picking one, and so do we: the
+  // two answer the same question by different means, and silently preferring
+  // either would leave a server running a policy its author did not write.
+  if (options.ALPNProtocols && options.ALPNCallback) {
+    throw new TypeError(
+      'The ALPNProtocols and ALPNCallback options are mutually exclusive');
+  }
+
   // Shared ticketKeys across all connections
   self._ticketKeys = options.ticketKeys ? Buffer.from(options.ticketKeys) : crypto.randomBytes(48);
 
+  // Encrypted Client Hello keys, checked here — a key that does not match
+  // its config throws now, not as every client's handshake failing.
+  prepare_ech_server(options.ech);
+  self._ech = options.ech || null;
+
+  // node:tls's strings, read once (node_options.js) — a bad one throws here,
+  // as Node's createServer does, not on the first connection.
+  let nodeSuites = options.allowedCipherSuites || parseCiphers(options.ciphers);
+  let nodeGroups = options.groups || parseEcdhCurve(options.ecdhCurve);
+  let nodeSigalgs = options.signatureAlgorithms || parseSigalgs(options.sigalgs);
+
   // sessionTimeout: seconds to cache a TLS 1.2 Session ID (Node default: 300)
   let sessionTimeoutSec = (typeof options.sessionTimeout === 'number' && options.sessionTimeout > 0)
     ? (options.sessionTimeout >>> 0)
@@ -251,10 +366,28 @@ function Server(options, connectionListener) {
     sessionIdContextHex = sidCtxBuf.toString('hex');
   }
 
-  // Pre-compiled default SecureContext if key+cert provided directly (no SNICallback)
+  // Pre-compiled default SecureContext.
+  //
+  // Node parity: a caller may hand us a context they built once with
+  // tls.createSecureContext() and reuse across servers, instead of paying to
+  // re-parse the same PEM on every construction. An explicit `secureContext`
+  // wins over key/cert — same precedence Node uses.
+  // SNI contexts registered through addContext(). Each is compiled ONCE here
+  // and handed out by reference, which is the whole point: a hand-written
+  // SNICallback that calls createSecureContext() per connection re-parses the
+  // same PEM every time, and if it reads the files inside the callback it also
+  // does disk I/O on the handshake path.
+  //
+  // Node's matching rule: last registration wins on a tie, and an exact
+  // hostname beats a wildcard. Insertion order is preserved, so a later
+  // addContext() for the same pattern replaces the earlier one in place.
+  let sniContexts = [];   // [{ pattern, re, ctx }]
+
   let defaultCtx = null;
-  if (options.key && options.cert) {
-    defaultCtx = createSecureContext({ key: options.key, cert: options.cert });
+  if (options.secureContext) {
+    defaultCtx = options.secureContext;
+  } else if (options.key && options.cert) {
+    defaultCtx = createSecureContext(options);
   }
 
   // In-memory fallback session store for TLS 1.2 Session IDs.
@@ -271,12 +404,40 @@ function Server(options, connectionListener) {
     let socketOpts = {
       isServer: true,
       ticketKeys: self._ticketKeys,
-      ticketLifetime: options.ticketLifetime,
+      // node:tls's sessionTimeout is how long a session stays good — a
+      // ticket's lifetime as much as a cached Session ID's. It set the cache
+      // alone, and tickets went out with the default 7200 s whatever it said.
+      // ticketLifetime, lemon-tls's own name, where given.
+      ticketLifetime: options.ticketLifetime != null ? options.ticketLifetime
+                    : (typeof options.sessionTimeout === 'number' ? options.sessionTimeout : undefined),
+      ticketData: options.ticketData,
+      // RFC 8879: compress the chain for a client that offers it (all
+      // algorithms unless set; false: never).
+      certificateCompression: options.certificateCompression,
+      // node:tls: the cipher suite by the server's order (default: the client's).
+      honorCipherOrder: options.honorCipherOrder === true,
+      // Encrypted Client Hello (RFC 9849): { keys: [{ config, privateKey, retry }] }.
+      ech: self._ech,
+      // node:tls's 'OCSPRequest': (certificate, issuer, callback) when a
+      // client asks for a stapled OCSP response. Without a listener nothing
+      // is stapled — and nothing waits.
+      ocspRequest: function (certificate, issuer, callback) {
+        if (self.listenerCount('OCSPRequest') === 0) return callback(null, null);
+        self.emit('OCSPRequest', Buffer.from(certificate), issuer ? Buffer.from(issuer) : null, callback);
+      },
       ALPNProtocols: options.ALPNProtocols,
+      ALPNCallback: options.ALPNCallback,
+      // 0-RTT (off unless asked for): tickets that allow it, and taking it
+      // under the session's checks — read on each socket as it comes
+      // (socket.isEarlyData), before 'secureConnection'.
+      earlyData: options.earlyData === true,
+      earlyDataMaxAge: options.earlyDataMaxAge,
+      earlyDataReplay: options.earlyDataReplay,
+      maxEarlyData: options.maxEarlyData,
       minVersion: options.minVersion || DEFAULT_MIN_VERSION,
       maxVersion: options.maxVersion || DEFAULT_MAX_VERSION,
-      signatureAlgorithms: options.signatureAlgorithms,
-      groups: options.groups,
+      signatureAlgorithms: nodeSigalgs,
+      groups: nodeGroups,
       prioritizeChaCha: options.prioritizeChaCha,
       maxRecordSize: options.maxRecordSize,
       sessionTickets: options.sessionTickets,
@@ -292,22 +453,37 @@ function Server(options, connectionListener) {
       rejectUnauthorized: options.rejectUnauthorized,
       ca: options.ca,
       maxHandshakeSize: options.maxHandshakeSize,
-      allowedCipherSuites: options.allowedCipherSuites,
-      handshakeTimeout: options.handshakeTimeout,
+      allowedCipherSuites: nodeSuites,
+      // node:tls's default for a server, 120 s. TLSSocket's own is none
+      // (it is also the client's, where Node has none either), and a server
+      // left at it let a client that sent half a ClientHello hold its socket
+      // for as long as it liked.
+      handshakeTimeout: options.handshakeTimeout != null ? options.handshakeTimeout : 120000,
+      // The server's default certificate. With an explicit SNICallback it was
+      // never handed to the socket, so a client sending no server_name got
+      // the callback asked with null instead of this certificate, as in Node.
+      secureContext: defaultCtx || undefined,
     };
 
     if (options.SNICallback) {
+      // An explicit callback wins outright — it may do things the registry
+      // cannot, such as fetching a certificate on demand.
       socketOpts.SNICallback = options.SNICallback;
-    } else if (defaultCtx) {
+    } else if (defaultCtx || sniContexts.length > 0) {
       socketOpts.SNICallback = function(servername, cb) {
-        cb(null, defaultCtx);
+        cb(null, contextForServername(servername));
       };
     }
 
     return socketOpts;
   }
 
-  self._tcpServer = net.createServer(function(tcp) {
+  function acceptConnection(tcp) {
+    // Node: "emitted when a new TCP stream is established, before the TLS
+    // handshake begins... can also be explicitly emitted by users to inject
+    // connections into the TLS server. In that case, any Duplex stream can be
+    // passed." Emitting first is what makes that injection path work.
+    self.emit('connection', tcp);
     let socket;
     try {
       socket = new TLSSocket(tcp, buildSocketOpts());
@@ -368,8 +544,48 @@ function Server(options, connectionListener) {
         self.emit('tlsClientError', err, socket);
       }
     });
+  }
+
+  // node:tls's Server IS a net.Server, built from the same options object, so
+  // the TCP ones apply to every connection it accepts. Only those: the stream
+  // shape of the raw socket (allowHalfOpen, pauseOnConnect) is this layer's
+  // to manage, and the TLS socket takes allowHalfOpen itself.
+  self._tcpServer = net.createServer({
+    noDelay: options.noDelay === true,
+    keepAlive: options.keepAlive === true,
+    keepAliveInitialDelay: options.keepAliveInitialDelay || 0,
+  }, acceptConnection);
+
+  // The net.Server's own events, re-emitted: node:tls's Server IS a net.Server
+  // and emits these itself, and code written for it listens for them here.
+  // Without this, 'listening' never fired, and a failed bind (EADDRINUSE,
+  // EACCES) was emitted on an inner object nobody could reach — an uncaught
+  // exception that took the whole process down.
+  ['listening', 'error', 'close', 'drop'].forEach(function (name) {
+    self._tcpServer.on(name, function () {
+      if (name === 'error' && self.listenerCount('error') === 0) {
+        // Same as node:tls when nobody listens: it throws. Preserved, rather
+        // than swallowed — but from the Server a caller can now listen on.
+        throw arguments[0];
+      }
+      self.emit.apply(self, [name].concat(Array.prototype.slice.call(arguments)));
+    });
   });
 
+  /**
+   * Node documents 'connection' as injectable: emitting it by hand feeds an
+   * arbitrary Duplex into the TLS server. That cannot be done by listening for
+   * our own event — acceptConnection emits it, so the listener would re-enter
+   * on every real connection and loop. A method is the honest shape.
+   */
+  self.injectConnection = function(stream) {
+    if (!stream || typeof stream.write !== 'function') {
+      throw new TypeError('injectConnection requires a Duplex stream');
+    }
+    acceptConnection(stream);
+    return self;
+  };
+
   // Delegate net.Server methods
   self.listen = function() {
     return self._tcpServer.listen.apply(self._tcpServer, arguments);
@@ -402,13 +618,86 @@ function Server(options, connectionListener) {
     self._ticketKeys = Buffer.from(keys);
   };
 
+  // ECH keys. Rotation without a restart: publish the new config in DNS,
+  // then setEchKeys with the new key first (retry: true) and the old one
+  // kept (retry: false) until the old DNS record's TTL has run out — clients
+  // still holding it can then connect. New connections use the new set.
+  self.getEchKeys = function() {
+    return self._ech;
+  };
+
+  self.setEchKeys = function(ech) {
+    prepare_ech_server(ech);          // throws on a bad key, keeping the old set
+    self._ech = ech || null;
+  };
+
   // setSecureContext — replace cert/key without restart (Node.js compat)
   self.setSecureContext = function(opts) {
-    if (opts && opts.key && opts.cert) {
-      defaultCtx = createSecureContext({ key: opts.key, cert: opts.cert });
+    if (!opts) return;
+    if (opts.secureContext) { defaultCtx = opts.secureContext; return; }
+    if (opts.key && opts.cert) defaultCtx = createSecureContext(opts);
+  };
+
+  /**
+   * Node-compat: addContext(hostname, context)
+   *
+   * Register a certificate for an SNI host name or wildcard. `context` is
+   * either a compiled context from createSecureContext() or the plain
+   * { key, cert, ... } options to compile from — Node accepts both.
+   *
+   * The declarative alternative to writing an SNICallback by hand. It matters
+   * for more than tidiness: the common hand-rolled callback compiles a context
+   * per connection, and often reads the cert off disk inside it. Here every
+   * context is compiled once at registration and served by reference.
+   */
+  self.addContext = function(hostname, context) {
+    if (!hostname) throw new TypeError('addContext requires a hostname');
+    let ctx = context;
+    if (!ctx || (!ctx.certificateChain && !ctx.privateKey)) {
+      if (!context || !context.key || !context.cert) {
+        throw new TypeError('addContext requires a SecureContext or { key, cert }');
+      }
+      ctx = createSecureContext(context);
     }
+    let pattern = String(hostname).toLowerCase();
+    let entry = { pattern: pattern, re: sniPatternToRegExp(pattern), ctx: ctx };
+
+    // Replace in place rather than appending a duplicate, so re-registering a
+    // host swaps its certificate without leaving the old one shadowing it.
+    let i = sniContexts.findIndex(function(e){ return e.pattern === pattern; });
+    if (i >= 0) sniContexts[i] = entry;
+    else sniContexts.push(entry);
+    return self;
   };
 
+  /**
+   * Wildcards match ONE label and only as the leftmost one, per RFC 6125:
+   * `*.example.com` covers `a.example.com` but neither `a.b.example.com` nor
+   * the bare `example.com`. A bare `*` matches any single-or-multi label name
+   * and is the documented catch-all.
+   */
+  function sniPatternToRegExp(pattern) {
+    if (pattern === '*') return /^.+$/;
+    let esc = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp('^' + esc.replace(/\*/g, '[^.]+') + '$');
+  }
+
+  /**
+   * Resolve a servername to a context. Exact matches beat wildcards; among
+   * equals the most recently added wins, which is what Node documents.
+   */
+  function contextForServername(servername) {
+    if (!servername) return defaultCtx;
+    let name = String(servername).toLowerCase();
+    for (let i = sniContexts.length - 1; i >= 0; i--) {
+      if (sniContexts[i].pattern === name) return sniContexts[i].ctx;
+    }
+    for (let i = sniContexts.length - 1; i >= 0; i--) {
+      if (sniContexts[i].re.test(name)) return sniContexts[i].ctx;
+    }
+    return defaultCtx;
+  }
+
   return self;
 }
 
@@ -453,20 +742,14 @@ function addCompatMethods(socket) {
     if (typeof socket[name] !== 'function') socket[name] = fn;
   }
 
-  /** Node.js compat: isSessionReused() — method form (same as isResumed getter) */
-  def('isSessionReused', function() {
-    return socket.isResumed;
-  });
-
-  /** Node.js compat: getFinished() */
-  def('getFinished', function() {
-    return session.getFinished ? session.getFinished() : null;
-  });
-
-  /** Node.js compat: getPeerFinished() */
-  def('getPeerFinished', function() {
-    return session.getPeerFinished ? session.getPeerFinished() : null;
-  });
+  // isSessionReused, getFinished, getPeerFinished, getEphemeralKeyInfo and
+  // address now ship natively on TLSSocket, so their shims here were dead code
+  // that def() would never install — and they had drifted from Node in ways
+  // the native versions fix: getFinished returned null where Node documents
+  // undefined, and getEphemeralKeyInfo reported type 'X25519', which is not
+  // one of the three types Node defines ('DH', 'ECDH', 'TLSGroup'), and never
+  // returned null on a server socket. Two divergent implementations of one
+  // method is the duplication this layer exists to avoid, so they are gone.
 
   /** Node.js compat: exportKeyingMaterial(length, label, context).
    *  TLSSocket now ships this natively (RFC 5705 / RFC 8446 §7.5 via the
@@ -476,15 +759,6 @@ function addCompatMethods(socket) {
     return session.exportKeyingMaterial ? session.exportKeyingMaterial(length, label, context) : null;
   });
 
-  /** Node.js compat: getEphemeralKeyInfo() */
-  def('getEphemeralKeyInfo', function() {
-    let group = session.context.selected_group;
-    if (group === 0x001d) return { type: 'X25519', size: 253 };
-    if (group === 0x0017) return { type: 'ECDH', name: 'prime256v1', size: 256 };
-    if (group === 0x0018) return { type: 'ECDH', name: 'secp384r1', size: 384 };
-    return {};
-  });
-
   /** Node.js compat: setServername(name) */
   def('setServername', function(name) {
     session.set_context({ local_sni: name });
@@ -493,11 +767,6 @@ function addCompatMethods(socket) {
   /** Node.js compat: disableRenegotiation() — no-op (renegotiation not supported) */
   def('disableRenegotiation', function() {});
 
-  /** Node.js compat: address() — delegates to underlying transport */
-  def('address', function() {
-    try { return session.context && session.context.transport ? session.context.transport.address() : {}; }
-    catch(e) { return {}; }
-  });
 }
 
 // ===================== Exports =====================
@@ -510,6 +779,8 @@ export {
   getCiphers,
   checkServerIdentity,
   addCompatMethods,
+  getCACertificates,
+  setDefaultCACertificates,
   DEFAULT_MIN_VERSION,
   DEFAULT_MAX_VERSION,
   DEFAULT_CIPHERS,

package/src/crypto.js

@@ -1,4 +1,3 @@
-
 import {
   concatUint8Arrays
 } from './utils.js';
@@ -130,6 +129,7 @@ const TLS_CIPHER_SUITES = {
     hash:         'sha256'
   },
   0xCCAA: { // TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
+    name: 'DHE-RSA-CHACHA20-POLY1305', standardName: 'TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256',
     tls:          12,
     kex:          'DHE_RSA',
     sig:          'RSA',
@@ -172,6 +172,7 @@ const TLS_CIPHER_SUITES = {
   // TLS 1.2 CBC (Legacy)
   // ----------------------
   0xC013: { // TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+    name: 'ECDHE-RSA-AES128-SHA', standardName: 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA',
     tls:    12,
     kex:    'ECDHE_RSA',
     sig:    'RSA',
@@ -184,6 +185,7 @@ const TLS_CIPHER_SUITES = {
     hash:   'sha256'
   },
   0xC014: { // TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+    name: 'ECDHE-RSA-AES256-SHA', standardName: 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA',
     tls:    12,
     kex:    'ECDHE_RSA',
     sig:    'RSA',
@@ -196,6 +198,7 @@ const TLS_CIPHER_SUITES = {
     hash:   'sha256'
   },
   0x003C: { // TLS_RSA_WITH_AES_128_CBC_SHA256
+    name: 'AES128-SHA256', standardName: 'TLS_RSA_WITH_AES_128_CBC_SHA256',
     tls:    12,
     kex:    'RSA',
     sig:    'RSA',
@@ -208,6 +211,7 @@ const TLS_CIPHER_SUITES = {
     hash:   'sha256'
   },
   0x003D: { // TLS_RSA_WITH_AES_256_CBC_SHA256
+    name: 'AES256-SHA256', standardName: 'TLS_RSA_WITH_AES_256_CBC_SHA256',
     tls:    12,
     kex:    'RSA',
     sig:    'RSA',
@@ -237,10 +241,12 @@ function makeHashFn(algorithm, outputLen) {
 
 let sha256 = makeHashFn('sha256', 32);
 let sha384 = makeHashFn('sha384', 48);
+let sha512 = makeHashFn('sha512', 64);   // HPKE: HKDF-SHA512, DHKEM(P-521 / X448)
 
 function getHashFn(hashName) {
   if (hashName === 'sha256') return sha256;
   if (hashName === 'sha384') return sha384;
+  if (hashName === 'sha512') return sha512;
   throw new Error('Unsupported hash: ' + hashName);
 }
 
@@ -535,6 +541,17 @@ function derive_handshake_traffic_secrets_psk(hashName, psk, shared_secret, tran
   };
 }
 
+/**
+ * client_early_traffic_secret (RFC 8446 §7.1): Derive-Secret(Early Secret,
+ * "c e traffic", ClientHello) — the 0-RTT key's secret, from the PSK and the
+ * hash of the ClientHello alone.
+ */
+function derive_client_early_traffic_secret(hashName, psk, clienthello_hash, labelPrefix) {
+  let hashLen = getHashFn(hashName).outputLen | 0;
+  let early_secret = hkdf_extract(hashName, new Uint8Array(0), psk);
+  return hkdf_expand_label(hashName, early_secret, 'c e traffic', clienthello_hash, hashLen, labelPrefix);
+}
+
 /**
  * Like derive_handshake_traffic_secrets_psk but accepts a pre-computed transcript hash.
  */
@@ -735,7 +752,19 @@ function tls13_exporter(hashName, exporter_master_secret, label, context_value,
   let h_empty = hashFn(new Uint8Array(0));
   let derived = hkdf_expand_label(hashName, exporter_master_secret, label, h_empty, hashLen, labelPrefix);
   let h_ctx   = hashFn(context_value || new Uint8Array(0));
-  return hkdf_expand(hashName, derived, build_hkdf_label('exporter', h_ctx, length), length);
+  // BOTH expansions carry the prefix. RFC 8446 §7.5 defines the exporter
+  // as two HKDF-Expand-Label steps, and in DTLS 1.3 both use "dtls13"
+  // (RFC 9147 §5.9) — this second one was omitting it and falling back
+  // to "tls13 ", so the exported key differed from a conforming peer's.
+  // For WebRTC that key IS the DTLS-SRTP keying material: the handshake
+  // completes, SRTP reports ready, packets flow in both directions, and
+  // NOTHING decrypts. Two peers running this library derive the same
+  // wrong key and interoperate perfectly with each other, which is why
+  // it only appears against Chrome — and appears as "media does not
+  // flow" rather than as a crypto error, since a failed unprotect is
+  // just a dropped packet.
+  return hkdf_expand(hashName, derived,
+    build_hkdf_label('exporter', h_ctx, length, labelPrefix), length);
 }
 
 /**
@@ -888,6 +917,7 @@ export {
   compute_psk_binder,
   derive_handshake_traffic_secrets_psk,
   derive_handshake_traffic_secrets_psk_with_hash,
+  derive_client_early_traffic_secret,
   build_cert_verify_tbs,
   build_cert_verify_tbs_with_hash,
   get_handshake_finished,
@@ -896,4 +926,4 @@ export {
   derive_exporter_master_secret_with_hash,
   tls13_exporter,
   tls12_exporter,
-};
+};