lemon-tls 0.7.0 → 0.10.0

package/src/dtls_session.js

@@ -67,7 +67,7 @@ import {
 } from './record.js';
 
 import { timingSafeEqualU8 } from './utils.js';
-import { SUPPORTED_GROUPS as ECDH_SUPPORTED_GROUPS } from './session/ecdh.js';
+import { SUPPORTED_GROUPS as ECDH_SUPPORTED_GROUPS, SERVER_DEFAULT_GROUPS } from './session/ecdh.js';
 import { default_signature_schemes } from './session/signing.js';
 
 
@@ -194,6 +194,11 @@ function DTLSSession(options) {
     servername: options.servername,
     SNICallback: options.SNICallback,
     rejectUnauthorized: options.rejectUnauthorized,
+    checkServerIdentity: options.checkServerIdentity,
+    // DTLS peers in WebRTC present self-signed certificates by design and are
+    // authenticated by the SDP fingerprint, not by a CA chain. Falling back to
+    // the platform trust store here would mark every such peer unauthorized.
+    useDefaultCA: options.useDefaultCA === true,
     ca: options.ca,
     noTickets: options.noTickets,
     requestCert: options.requestCert,
@@ -286,6 +291,7 @@ function DTLSSession(options) {
     // the ACK arrives.
     pendingWriteEpoch: null,
     keyUpdateFlight: null,     // { payload, epoch, timer, attempts, timeout }
+    finalFlightPending: false, // DTLS 1.3 client: final flight not yet confirmed (see secureConnect)
 
     retransmitTimer: null,
     retransmitCount: 0,
@@ -331,6 +337,21 @@ function DTLSSession(options) {
   if (options.groups) tlsSetup.local_supported_groups = options.groups;
   if (options.alpnProtocols) tlsSetup.local_supported_alpns = options.alpnProtocols;
 
+  // Default key-exchange groups, BOTH roles. With DTLS 1.3 offered: the
+  // hybrid post-quantum group first (X25519MLKEM768, when node:crypto has
+  // ML-KEM — see ecdh.js), then the classical ones. In WebRTC either peer can
+  // end up the DTLS client, and harvest-now-decrypt-later applies to media
+  // too (Chrome rolls PQ DTLS out from 149). A client leading with the hybrid
+  // group sends a classical share beside it (tls_session), so a classical
+  // server costs nothing extra. DTLS 1.2 only: classical — a KEM does not fit
+  // its key exchange, and the server skips KEM groups there anyway.
+  if (!tlsSetup.local_supported_groups) {
+    // (ECDH_SUPPORTED_GROUPS leads with the hybrid too now; tls_session leaves
+    // a KEM group out of a hello that does not offer 1.3.)
+    tlsSetup.local_supported_groups = (versions.indexOf(DTLS_VERSION.DTLS1_3) >= 0
+      ? SERVER_DEFAULT_GROUPS : ECDH_SUPPORTED_GROUPS).slice();
+  }
+
   // Server defaults — TLSSession client auto-populates these, but server expects them set externally
   if (isServer) {
     if (!tlsSetup.local_supported_cipher_suites) {
@@ -340,16 +361,20 @@ function DTLSSession(options) {
         versions.indexOf(DTLS_VERSION.DTLS1_2) >= 0
       );
     }
-    if (!tlsSetup.local_supported_groups) {
-      tlsSetup.local_supported_groups = ECDH_SUPPORTED_GROUPS.slice(); // whatever ecdh.js implements
-    }
+    // (key-exchange groups: set above, for both roles)
     // signing.js owns the scheme list; DTLS spans 1.2+1.3 so include PKCS#1.
     tlsSetup.local_supported_signature_algorithms = default_signature_schemes();
   }
 
-  // Server cert/key
+  // Server cert/key.
+  //
+  // The whole options object goes in, not just key+cert: createSecureContext
+  // also reads passphrase, ca, ciphers, sigalgs, ecdhCurve, honorCipherOrder,
+  // pfx and ocsp, and picking out two fields silently dropped all of them —
+  // an encrypted private key could never be decrypted here no matter what the
+  // caller passed. Same defect the TLS paths carried.
   if (options.cert && options.key) {
-    let sctx = createSecureContext({ key: options.key, cert: options.cert });
+    let sctx = createSecureContext(options);
     tlsSetup.local_cert_chain = sctx.certificateChain;
     tlsSetup.cert_private_key = sctx.privateKey;
   }
@@ -726,9 +751,10 @@ function DTLSSession(options) {
     }
 
     for (let i = 0; i < frags.length; i++) {
-      let record = buildRecord(dtlsEpoch, CT.HANDSHAKE, frags[i]);
       // The flight captures the fragment, not the record — see currentFlight.
-      ctx.currentFlight.push({ epoch: dtlsEpoch, contentType: CT.HANDSHAKE, payload: frags[i] });
+      let entry = { epoch: dtlsEpoch, contentType: CT.HANDSHAKE, payload: frags[i] };
+      let record = buildFlightRecord(entry);
+      ctx.currentFlight.push(entry);
       if (record) {
         _ldbgTx(record, 'L543'); ev.emit('packet', record);
       } else {
@@ -1020,6 +1046,20 @@ function DTLSSession(options) {
   }
 
   function processRecord(record) {
+    // A record in an epoch above 0 that did not decrypt is not the peer's
+    // (forged, corrupted, or a late packet from a previous session on the
+    // same address) — RFC 6347 §4.1.2.7 / RFC 9147 §4.5.2: discard it
+    // silently. Its content is still ciphertext: as an ALERT its second byte
+    // is random, which emitted 'error' and failed the whole connection; as
+    // APPLICATION_DATA it went up to SCTP as data.
+    if (record.epoch > 0 && !record.encrypted) return;
+    // Once connected, everything the peer sends is protected. A plaintext
+    // (epoch 0) alert or application data at that point is unauthenticated —
+    // anyone able to send a UDP packet from the peer's address could close
+    // the connection with a one-record close_notify, or inject data.
+    if (ctx.state === 'connected' && !record.encrypted &&
+        (record.type === CT.ALERT || record.type === CT.APPLICATION_DATA)) return;
+
     if (record.type === CT.HANDSHAKE) {
       // An epoch>0 record that could not be decrypted (keys not yet
       // installed, AEAD failure) must NOT be fed to the handshake
@@ -1036,6 +1076,9 @@ function DTLSSession(options) {
       processHandshakeRecord(record.content, record.epoch, record.encrypted);
     } else if (record.type === CT.APPLICATION_DATA) {
       if (ctx.state === 'connected') {
+        // Protected data from the peer means it completed the handshake,
+        // so it has our Finished.
+        if (ctx.finalFlightPending) finalFlightDone();
         ev.emit('data', record.content);
       }
     } else if (record.type === CT.CHANGE_CIPHER_SPEC) {
@@ -1536,17 +1579,31 @@ function DTLSSession(options) {
     // payload never came from the application at all.
     // RFC 9147 §5.8: retransmission is bounded by the handshake; after
     // it, ACKs are the mechanism, not a timer.
-    if (ctx.state === 'connected' || ctx.state === 'closed') {
+    if (ctx.state === 'closed' || (ctx.state === 'connected' && !ctx.finalFlightPending)) {
       cancelRetransmit();
       return;
     }
     for (let i = 0; i < ctx.currentFlight.length; i++) {
       let f = ctx.currentFlight[i];
-      let record = buildRecord(f.epoch, f.contentType, f.payload);
+      // DTLS 1.3 (RFC 9147 §7.1): records the peer has ACKed are not resent.
+      if (f.acked) continue;
+      let record = buildFlightRecord(f);
       if (record) { _ldbgTx(record, 'L1280'); ev.emit('packet', record); }
     }
   }
 
+  /**
+   * Build the record for a flight entry and remember its record number
+   * (epoch, sequence) — every transmission gets a fresh one, and a DTLS 1.3
+   * ACK names the records it covers by those numbers.
+   */
+  function buildFlightRecord(f) {
+    let seq = (f.epoch in ctx.writeSeq) ? ctx.writeSeq[f.epoch] : 0;
+    let record = buildRecord(f.epoch, f.contentType, f.payload);
+    if (record) (f.sent || (f.sent = [])).push(f.epoch * 0x1000000000000 + seq);
+    return record;
+  }
+
   function startRetransmitTimer() {
     cancelRetransmit();
     // ONE GATE, AT THE SOURCE. Four call sites arm this timer and only
@@ -1555,8 +1612,13 @@ function DTLSSession(options) {
     // flight into the application-data epoch. Refusing to arm once
     // connected (or closed) covers every caller, including any added
     // later, without each having to remember the rule.
-    if (ctx.state === 'connected' || ctx.state === 'closed') return;
+    if (ctx.state === 'closed' || (ctx.state === 'connected' && !ctx.finalFlightPending)) return;
     ctx.retransmitTimer = setTimeout(function() {
+      if (ctx.finalFlightPending && ctx.retransmitCount >= ctx.maxRetransmits) {
+        // The connection is up on our side; stop resending without failing it.
+        finalFlightDone();
+        return;
+      }
       if (ctx.retransmitCount >= ctx.maxRetransmits) {
         ev.emit('error', new Error('DTLS handshake timeout — max retransmits exceeded'));
         ctx.state = 'closed';
@@ -1575,6 +1637,13 @@ function DTLSSession(options) {
     if (ctx.retransmitTimer.unref) ctx.retransmitTimer.unref();
   }
 
+  // The client's final flight is known to have arrived: stop resending it.
+  function finalFlightDone() {
+    ctx.finalFlightPending = false;
+    cancelRetransmit();
+    startNewFlight();
+  }
+
   function cancelRetransmit() {
     if (ctx.retransmitTimer !== null) {
       clearTimeout(ctx.retransmitTimer);
@@ -1608,10 +1677,37 @@ function DTLSSession(options) {
       return;
     }
 
-    // Everything else keeps the original behaviour verbatim. In particular the
-    // ACK for the client's final flight (which RFC 9147 §7.1 requires the peer
-    // to send explicitly, and which arrives at the application epoch) must
-    // still cancel that flight's retransmit timer.
+    // During the handshake an ACK may cover only PART of our flight (RFC 9147
+    // §7.1): the peer lists the records it received. Those are done; the
+    // rest stay under the retransmit timer and are what the next
+    // retransmission resends. Treating any ACK as acknowledging the whole
+    // flight cancelled the timer while a record was still missing — the
+    // peer, waiting for it, ACKed again and again, and the handshake hung
+    // (≈ half of all handshakes at 5% loss, when the lost record was inside
+    // the server's flight).
+    if ((ctx.state !== 'connected' || ctx.finalFlightPending) && ctx.currentFlight.length > 0) {
+      let got = new Set();
+      for (let i = 0; i < acks.length; i++) got.add(acks[i].epoch * 0x1000000000000 + acks[i].seq);
+      let remaining = 0;
+      for (let i = 0; i < ctx.currentFlight.length; i++) {
+        let f = ctx.currentFlight[i];
+        if (!f.acked && f.sent) {
+          for (let k = 0; k < f.sent.length; k++) {
+            if (got.has(f.sent[k])) { f.acked = true; break; }
+          }
+        }
+        // Plaintext epoch-0 records (ServerHello, CCS) are never ACKed — the
+        // peer acknowledges them implicitly by answering — so they do not
+        // keep the timer alive on their own.
+        if (!f.acked && f.epoch !== 0) remaining++;
+      }
+      if (remaining > 0) return;
+    }
+
+    // The whole flight is acknowledged — or, the ACK for the client's final
+    // flight (which RFC 9147 §7.1 requires the peer to send explicitly, and
+    // which arrives at the application epoch): cancel the retransmit timer.
+    ctx.finalFlightPending = false;
     cancelRetransmit();
     startNewFlight();
   }
@@ -1662,8 +1758,18 @@ function DTLSSession(options) {
     _ldbg('handshake complete — secureConnect (version=0x' +
       ((ctx.selectedVersion || tls.context.selected_version || 0).toString(16)) + ')');
     ctx.state = 'connected';
-    cancelRetransmit();
-    startNewFlight();
+    // DTLS 1.3 client (RFC 9147 §5.8.3, §7.1): our final flight (…Finished)
+    // is answered by nothing but an ACK, so it must stay under the
+    // retransmit timer until that ACK — or anything else from the peer at
+    // the application epoch — shows it arrived. Dropping it here meant one
+    // lost Finished left us "connected" and the peer waiting for good.
+    if (!isServer && ctx.selectedVersion === DTLS_VERSION.DTLS1_3 && ctx.currentFlight.length > 0) {
+      ctx.finalFlightPending = true;
+      startRetransmitTimer();
+    } else {
+      cancelRetransmit();
+      startNewFlight();
+    }
     ev.emit('connect');
   });
 
@@ -1841,6 +1947,24 @@ function DTLSSession(options) {
 
     /** Peer certificate. */
     getPeerCertificate: function() { return tls.getPeerCertificate(); },
+
+    /** TLS fingerprints (see TLSSession): JA4, JA5 of the ClientHello, JA4S
+     *  of the ServerHello. The transport character resolves to 'd' on its
+     *  own — the inner TLSSession reads the 0xFE high byte off the hello's
+     *  legacy_version — so no `protocol` override is needed for plain DTLS. */
+    getJA4: function(opts) { return tls.getJA4(opts); },
+    getJA5: function(opts) { return tls.getJA5(opts); },
+    getJA4S: function(opts) { return tls.getJA4S(opts); },
+
+    /** Set the key and certificate for this connection (Node parity). */
+    setKeyCert: function(ctxOrOpts) { return tls.setKeyCert(ctxOrOpts); },
+
+    /** Finished verify_data, ours and the peer's (RFC 5929 channel binding). */
+    getFinished: function() { return tls.getFinished(); },
+    getPeerFinished: function() { return tls.getPeerFinished(); },
+
+    /** Whether this connection resumed an earlier session. */
+    isSessionReused: function() { return !!tls.isResumed; },
   };
 
   for (let k in api) {

package/src/dtls_socket.js

@@ -44,12 +44,14 @@ function DTLSSocket(udpSocket, options) {
     cert: options.cert,
     key: options.key,
     rejectUnauthorized: options.rejectUnauthorized,
+    checkServerIdentity: options.checkServerIdentity,
     requestCert: options.requestCert,
     ca: options.ca,
     alpnProtocols: options.alpnProtocols,
     minVersion: options.minVersion,
     maxVersion: options.maxVersion,
     mtu: options.mtu,
+    groups: options.groups,
     ticketKeys: options.ticketKeys,
     useCookies: options.useCookies,
     srtpProfiles: options.srtpProfiles,
@@ -130,6 +132,33 @@ function DTLSSocket(udpSocket, options) {
   self.getALPN = function() { return session.getALPN(); };
   self.getPeerCertificate = function() { return session.getPeerCertificate(); };
 
+  /** TLS fingerprints, { hash, raw } or null (see TLSSession): JA4 and JA5
+   *  of the ClientHello, JA4S of the ServerHello — in either role. */
+  self.getJA4 = function(opts) { return session.getJA4(opts); };
+  self.getJA5 = function(opts) { return session.getJA5(opts); };
+  self.getJA4S = function(opts) { return session.getJA4S(opts); };
+
+  /** Set the key and certificate for this connection (Node parity). */
+  self.setKeyCert = function(ctxOrOpts) {
+    if (session.setKeyCert) session.setKeyCert(ctxOrOpts);
+  };
+
+  /** Finished verify_data — the tls-unique channel binding of RFC 5929.
+   *  DTLS-SRTP callers use this alongside exportKeyingMaterial(). */
+  self.getFinished = function() {
+    let v = session.getFinished ? session.getFinished() : null;
+    return v == null ? undefined : v;
+  };
+  self.getPeerFinished = function() {
+    let v = session.getPeerFinished ? session.getPeerFinished() : null;
+    return v == null ? undefined : v;
+  };
+
+  /** Whether this connection resumed an earlier session. */
+  self.isSessionReused = function() {
+    return session.isSessionReused ? session.isSessionReused() : false;
+  };
+
   /** RFC 5705 / RFC 8446 §7.5 exporter (Node tls.TLSSocket parity).
    *  DTLS-SRTP: exportKeyingMaterial(len, 'EXTRACTOR-dtls_srtp') — no context.
    *  Returns Buffer, or null before secrets are available. */
@@ -194,6 +223,7 @@ function createDTLSServer(options, connectionListener) {
           minVersion: options.minVersion,
           maxVersion: options.maxVersion,
           mtu: options.mtu,
+          groups: options.groups,
           ticketKeys: options.ticketKeys,
           useCookies: options.useCookies,
           srtpProfiles: options.srtpProfiles,
@@ -270,12 +300,14 @@ function connectDTLS(options, callback) {
     remotePort: port,
     servername: options.servername || host,
     rejectUnauthorized: options.rejectUnauthorized,
+    checkServerIdentity: options.checkServerIdentity,
     requestCert: options.requestCert,
     ca: options.ca,
     alpnProtocols: options.alpnProtocols,
     minVersion: options.minVersion,
     maxVersion: options.maxVersion,
     mtu: options.mtu,
+    groups: options.groups,
   });
 
   if (callback) socket.on('connect', callback);

package/src/node_options.js

@@ -0,0 +1,138 @@
+// ============================================================
+//  node:tls option strings → the codes lemon-tls works with
+// ============================================================
+//
+// node:tls takes `ciphers`, `ecdhCurve` and `sigalgs` as OpenSSL strings,
+// colon-separated; lemon-tls works with code points (allowedCipherSuites,
+// groups, signatureAlgorithms). compat.js promised Node's API and never read
+// the three — a server given `ciphers` or `ecdhCurve` ran with the defaults
+// and said nothing. These turn them into the lists, once, where an option is
+// taken (compat.js, and QUICO for both TCP and QUIC), and refuse what cannot
+// be honoured, as Node does ("no cipher match", "Failed to set ECDH curve").
+//
+// What is understood:
+//   ciphers    suite names — OpenSSL's for TLS 1.2 (ECDHE-RSA-AES128-GCM-SHA256)
+//              and the standard ones (TLS_AES_128_GCM_SHA256, or for 1.2
+//              TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256), in the order given;
+//              `!name` / `-name` take one out; DEFAULT, HIGH and ALL stand for
+//              every suite this library implements — it implements no weak
+//              ones. Other OpenSSL keywords (aNULL, MD5, …) select nothing
+//              here and are skipped: what remains must name something.
+//   ecdhCurve  'auto' (the default list) or names: X25519, P-256
+//              (prime256v1, secp256r1), P-384 (secp384r1), and post-quantum:
+//              X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024,
+//              MLKEM512, MLKEM768, MLKEM1024 (OpenSSL's names; case ignored).
+//   sigalgs    scheme names (ecdsa_secp256r1_sha256, rsa_pss_rsae_sha256,
+//              ed25519, …) or OpenSSL's SIG+HASH form (ECDSA+SHA256,
+//              RSA-PSS+SHA256, RSA+SHA256).
+
+import { TLS_CIPHER_SUITES, DEFAULT_CIPHER_SUITES_TLS13, DEFAULT_CIPHER_SUITES_TLS12 } from './crypto.js';
+import { SERVER_DEFAULT_GROUPS } from './session/ecdh.js';
+import { MLDSA_AVAILABLE } from './session/signing.js';
+
+function splitList(s) {
+  return String(s).split(/[:,\s]+/).filter(function (x) { return x !== ''; });
+}
+
+var cipherByName = null;
+function cipherTable() {
+  if (cipherByName) return cipherByName;
+  cipherByName = {};
+  for (var code in TLS_CIPHER_SUITES) {
+    var info = TLS_CIPHER_SUITES[code];
+    if (info.name) cipherByName[info.name.toUpperCase()] = Number(code);
+    if (info.standardName) cipherByName[info.standardName.toUpperCase()] = Number(code);
+  }
+  return cipherByName;
+}
+
+/** `ciphers` → [code, …] in the order given. Throws when nothing is left. */
+function parseCiphers(str) {
+  if (str === undefined || str === null) return null;
+  if (typeof str !== 'string') throw new TypeError('ciphers must be a string, got ' + typeof str);
+  var table = cipherTable(), all = DEFAULT_CIPHER_SUITES_TLS13.concat(DEFAULT_CIPHER_SUITES_TLS12);
+  var out = [], removed = [];
+  var tokens = splitList(str);
+  for (var i = 0; i < tokens.length; i++) {
+    var t = tokens[i], neg = t[0] === '!' || t[0] === '-';
+    if (neg || t[0] === '+') t = t.slice(1);
+    var u = t.toUpperCase(), codes;
+    if (u === 'DEFAULT' || u === 'HIGH' || u === 'ALL') codes = all;
+    else if (u in table) codes = [table[u]];
+    else continue;                                   // a keyword this library has nothing for
+    for (var j = 0; j < codes.length; j++) {
+      if (neg) { removed.push(codes[j]); var k = out.indexOf(codes[j]); if (k >= 0) out.splice(k, 1); }
+      else if (out.indexOf(codes[j]) < 0 && removed.indexOf(codes[j]) < 0) out.push(codes[j]);
+    }
+  }
+  if (out.length === 0) throw new Error('ciphers: no cipher match in "' + str + '"');
+  return out;
+}
+
+var GROUPS = {
+  'X25519': 0x001d,
+  'P-256': 0x0017, 'PRIME256V1': 0x0017, 'SECP256R1': 0x0017,
+  'P-384': 0x0018, 'SECP384R1': 0x0018,
+  'X25519MLKEM768': 0x11ec,
+  'SECP256R1MLKEM768': 0x11eb, 'SECP384R1MLKEM1024': 0x11ed,
+  'MLKEM512': 0x0200, 'MLKEM768': 0x0201, 'MLKEM1024': 0x0202,
+};
+
+/** `ecdhCurve` → [group, …]; 'auto' → null, the role's own default list
+ *  (a server's has the hybrid first, a client's does not offer it unasked).
+ *  Throws on a name it does not implement. */
+function parseEcdhCurve(str) {
+  if (str === undefined || str === null) return null;
+  if (typeof str !== 'string') throw new TypeError('ecdhCurve must be a string, got ' + typeof str);
+  if (str.trim().toLowerCase() === 'auto') return null;
+  var out = [], tokens = splitList(str);
+  for (var i = 0; i < tokens.length; i++) {
+    var g = GROUPS[tokens[i].toUpperCase()];
+    if (g === undefined) throw new Error('ecdhCurve: unsupported curve "' + tokens[i] + '"');
+    // The hybrid group only where node:crypto has ML-KEM (session/ecdh.js).
+    if (SERVER_DEFAULT_GROUPS.indexOf(g) < 0) throw new Error('ecdhCurve: "' + tokens[i] + '" is not available in this Node.js');
+    if (out.indexOf(g) < 0) out.push(g);
+  }
+  if (out.length === 0) throw new Error('ecdhCurve: no curve in "' + str + '"');
+  return out;
+}
+
+var SCHEMES = {
+  'RSA_PKCS1_SHA256': 0x0401, 'RSA_PKCS1_SHA384': 0x0501, 'RSA_PKCS1_SHA512': 0x0601,
+  'ECDSA_SECP256R1_SHA256': 0x0403, 'ECDSA_SECP384R1_SHA384': 0x0503, 'ECDSA_SECP521R1_SHA512': 0x0603,
+  'RSA_PSS_RSAE_SHA256': 0x0804, 'RSA_PSS_RSAE_SHA384': 0x0805, 'RSA_PSS_RSAE_SHA512': 0x0806,
+  'ED25519': 0x0807, 'ED448': 0x0808,
+  'RSA_PSS_PSS_SHA256': 0x0809, 'RSA_PSS_PSS_SHA384': 0x080a, 'RSA_PSS_PSS_SHA512': 0x080b,
+  // ML-DSA (FIPS 204), as OpenSSL names it.
+  'MLDSA44': 0x0904, 'MLDSA65': 0x0905, 'MLDSA87': 0x0906,
+  // OpenSSL's SIG+HASH spelling.
+  'ECDSA+SHA256': 0x0403, 'ECDSA+SHA384': 0x0503, 'ECDSA+SHA512': 0x0603,
+  'RSA-PSS+SHA256': 0x0804, 'RSA-PSS+SHA384': 0x0805, 'RSA-PSS+SHA512': 0x0806,
+  'RSA+SHA256': 0x0401, 'RSA+SHA384': 0x0501, 'RSA+SHA512': 0x0601,
+};
+
+/** `sigalgs` → [scheme, …]. Throws on a name it does not know. */
+function parseSigalgs(str) {
+  if (str === undefined || str === null) return null;
+  if (typeof str !== 'string') throw new TypeError('sigalgs must be a string, got ' + typeof str);
+  var out = [], tokens = splitList(str);
+  for (var i = 0; i < tokens.length; i++) {
+    var s = SCHEMES[tokens[i].toUpperCase()];
+    if (s === undefined) throw new Error('sigalgs: unsupported signature algorithm "' + tokens[i] + '"');
+    // ML-DSA only where node:crypto has it (session/signing.js).
+    if (s >= 0x0904 && s <= 0x0906 && !MLDSA_AVAILABLE) throw new Error('sigalgs: "' + tokens[i] + '" is not available in this Node.js');
+    if (out.indexOf(s) < 0) out.push(s);
+  }
+  if (out.length === 0) throw new Error('sigalgs: none in "' + str + '"');
+  return out;
+}
+
+/** 'TLSv1.2' / 'TLSv1.3' → 0x0303 / 0x0304, as node:tls names them. */
+function parseTlsVersion(v, name) {
+  if (v === undefined || v === null) return null;
+  if (v === 'TLSv1.3') return 0x0304;
+  if (v === 'TLSv1.2') return 0x0303;
+  throw new Error(name + ': "' + v + '" is not supported (TLSv1.2 or TLSv1.3)');
+}
+
+export { parseCiphers, parseEcdhCurve, parseSigalgs, parseTlsVersion };