lemon-tls 0.9.0 → 0.11.0

package/src/tls_socket.js

@@ -3,26 +3,11 @@ import TLSSession from './tls_session.js';
 import crypto from 'node:crypto';
 import { Duplex } from 'node:stream';
 
-import { TLS_CIPHER_SUITES, default_cipher_suites } from './crypto.js';
-import { TLS_CONTENT_TYPE as CT, TLS_ALERT_LEVEL, TLS_ALERT, HANDSHAKE_MESSAGE_MAX } from './wire.js';
-import { SUPPORTED_GROUPS as ECDH_SUPPORTED_GROUPS, SERVER_DEFAULT_GROUPS, group_name as ecdh_group_name } from './session/ecdh.js';
-import { default_signature_schemes } from './session/signing.js';
+import { TLS_CIPHER_SUITES } from './crypto.js';
+import { TLS_CONTENT_TYPE as CT, TLS_ALERT_LEVEL, TLS_ALERT, peer_alert_error, read_peer_alert, MAX_WARNING_ALERTS, MAX_RECORD_PLAINTEXT, local_alert_error, version_name } from './wire.js';
+import { group_name as ecdh_group_name, dh_group_info } from './session/ecdh.js';
 import { certificateObject } from './utils.js';
-
-// The suite list a socket offers or accepts, from the defaults: ChaCha20
-// suites moved to the front when asked (prioritizeChaCha), then narrowed to an
-// allow-list. One function for the client and server paths, which each kept a
-// copy — and both copies knew ChaCha20 by two codes (0x1303, 0xCCA8), so
-// ECDHE_ECDSA_WITH_CHACHA20_POLY1305 (0xCCA9) was never moved forward. The
-// suite table says which suites are ChaCha20.
-function chooseCipherSuites(ciphers, prioritizeChaCha, allowed) {
-    if (prioritizeChaCha) {
-        let isChaCha = function (c) { return !!TLS_CIPHER_SUITES[c] && TLS_CIPHER_SUITES[c].cipher === 'CHACHA20_POLY1305'; };
-        ciphers = ciphers.filter(isChaCha).concat(ciphers.filter(function (c) { return !isChaCha(c); }));
-    }
-    if (allowed) ciphers = ciphers.filter(function (c) { return allowed.includes(c); });
-    return ciphers;
-}
+import { versionsInRange, localLists, pskOptions } from './node_options.js';
 
 import {
   getAeadAlgo,
@@ -46,8 +31,6 @@ import {
 // not for an upload — what does not fit goes after the handshake.
 const EARLY_DATA_MAX_TCP = 16384;
 
-// Handshake messages: refused on sight past HANDSHAKE_MESSAGE_MAX (wire.js) —
-// before their bytes are kept.
 
 // legacy_record_version (TLS 1.3 uses 0x0303 in record header)
 const REC_VERSION = 0x0303;
@@ -77,17 +60,7 @@ function sigalgCodeToName(code) {
 // ==== עזרי המרה ====
 function toBuf(u8){ return Buffer.isBuffer(u8) ? u8 : Buffer.from(u8 || []); }
 
-function parseVersion(v) {
-  if (typeof v === 'number') return v;
-  if (typeof v === 'string') {
-    let s = v.toUpperCase().replace(/[^0-9.]/g, '');
-    if (s === '1.3' || s === '13') return 0x0304;
-    if (s === '1.2' || s === '12') return 0x0303;
-    if (s === '1.1' || s === '11') return 0x0302;
-    if (s === '1.0' || s === '10') return 0x0301;
-  }
-  return null;
-}
+
 
 
 
@@ -103,6 +76,10 @@ function TLSSocket(duplex, options){
   if (!(this instanceof TLSSocket)) return new TLSSocket(duplex, options);
   options = options || {};
 
+  // The versions to offer (client) or take (server), newest first — checked
+  // here, at construction (node_options.js: one reading for TLS and DTLS).
+  const localVersions = versionsInRange(options.minVersion, options.maxVersion, false);
+
   // allowHalfOpen follows Node: false unless the caller asks otherwise, so
   // that when the peer stops writing our writable side ends too. This was
   // hardcoded true, which is the OPPOSITE of the documented default — code
@@ -160,8 +137,11 @@ function TLSSocket(duplex, options){
     // External transport (Duplex)
     transport: (duplex && typeof duplex.write === 'function') ? duplex : null,
 
-    // Internal TLSSession
-    session: new TLSSession({
+    // Internal TLSSession: every option goes on to it (as DTLSSession hands
+    // its own on), with what this socket settles itself over them. Picked one
+    // by one, an option the list did not name never reached the session —
+    // the class of bug that dropped DTLS's (r99) and record_size_limit here.
+    session: new TLSSession(Object.assign({}, options, {
         isServer: !!options.isServer,
         servername: options.servername,
         ALPNProtocols: options.ALPNProtocols || null,
@@ -183,21 +163,12 @@ function TLSSocket(duplex, options){
         ocspRequest: typeof options.ocspRequest === 'function' ? options.ocspRequest : null,
         requestOCSP: options.requestOCSP === true,
         session: options.session || null,
-        psk: options.psk || null,
+        // External PSK, as node:tls takes it (pskOptions).
+        ...pskOptions(options, self),
         rejectUnauthorized: options.rejectUnauthorized,
         checkServerIdentity: options.checkServerIdentity,
         ALPNCallback: options.ALPNCallback || null,
         ca: options.ca || _sc('ca') || null,
-        // The platform trust store, for when no `ca` is given. compat.js
-        // hands both to this socket (defaultCA: Node's root certificates);
-        // they were never passed on, so the session had no trust anchors at
-        // all, and with none it checks only the name in the certificate. A
-        // self-signed certificate for the right name — anyone can make one —
-        // was accepted as verified: every connection this library opened
-        // (quico.request, WebSocket over wss://) was open to a
-        // man-in-the-middle, with rejectUnauthorized true.
-        useDefaultCA: options.useDefaultCA,
-        defaultCA: options.defaultCA,
         sessionTickets: options.sessionTickets,
         maxHandshakeSize: options.maxHandshakeSize || 0,
         customExtensions: options.customExtensions || [],
@@ -218,7 +189,7 @@ function TLSSocket(duplex, options){
         earlyDataContext: options.earlyDataContext,
         maxEarlyData: typeof options.maxEarlyData === 'number' ? options.maxEarlyData : EARLY_DATA_MAX_TCP,
         endOfEarlyData: true,
-    }),
+    })),
     
     // Handshake write
     handshake_write_key: null,
@@ -274,6 +245,11 @@ function TLSSocket(duplex, options){
     // the records are counted — not in any one message handler.
     consecutive_empty_records: 0,
     consecutive_ccs_records: 0,
+    // Warning alerts with nothing else between them, and peer KeyUpdates
+    // with no application data between them: each is legal once, and each
+    // costs us work (a KeyUpdate a key derivation) while moving nothing.
+    consecutive_warning_alerts: 0,
+    consecutive_key_updates: 0,
 
     // Buffers and queues.
     //
@@ -306,7 +282,13 @@ function TLSSocket(duplex, options){
     // header. Without this, a record carrying EE+Cert+CV+Finished (as
     // OpenSSL/BoringSSL routinely pack) fed only its FIRST message to the
     // session and silently dropped the rest.
-    hsBuf: null,
+    // A handshake message in pieces (feedHandshakeBytes): its header so far
+    // (under 4 bytes), then its pieces and their total.
+    hsHdr: null,
+    hsParts: null,
+    hsFill: 0,
+    hsLen: 0,
+    hsBufState: null,      // the read state the pending bytes arrived under
 
     appWriteQueue: [],
 
@@ -329,11 +311,10 @@ function TLSSocket(duplex, options){
     ticketKeys: _ticketKeys,
 
     // Advanced options
-    maxRecordSize: options.maxRecordSize || 16384,
+    maxRecordSize: Math.min(options.maxRecordSize || MAX_RECORD_PLAINTEXT, MAX_RECORD_PLAINTEXT),
     sessionTickets: options.sessionTickets !== false,
     pins: options.pins || null,              // ['sha256/AAAA...'] certificate pinning
     handshakeTimeout: options.handshakeTimeout || 0, // ms, 0 = no timeout
-    allowedCipherSuites: options.allowedCipherSuites || null, // [0x1301, ...] whitelist
     certificateCallback: options.certificateCallback || null, // (info, cb) => cb(null, ctx)
     handshakeTimer: null,
 
@@ -392,16 +373,17 @@ function TLSSocket(duplex, options){
         });
     }
 
-    const MAX_RECORD_PLAINTEXT = 16384; // TLS max record size (2^14)
 
     // writeAppData / writeAppDataSingle return the transport's backpressure signal:
     //   true  → transport is ready for more writes
     //   false → transport's internal buffer is full; caller should wait for 'drain'
     //           on context.transport before writing more. Propagated up to _write so
     //           user sock.write() returns false and Node's stream flow control kicks in.
+    // The most a record of ours may carry: 2^14, or the peer's
+    // record_size_limit (RFC 8449) when negotiated.
     function writeAppData(plain){
         const total = plain.length;
-        const maxSize = context.maxRecordSize || MAX_RECORD_PLAINTEXT;
+        const maxSize = Math.min(context.maxRecordSize || MAX_RECORD_PLAINTEXT, session.recordSendLimit());
         if (total > maxSize) {
             // Fragment across multiple records. Cork+uncork lets Node batch the
             // individual writes into a single TCP send (fewer syscalls, less overhead).
@@ -491,147 +473,239 @@ function TLSSocket(duplex, options){
         }
     }
 
-    // trial: early data not taken may come before the client's handshake
-    // flight (RFC 8446 §4.2.10): a record that the handshake key does not
-    // open is that, and is skipped (false) rather than fatal.
-    function processCiphertext(body, header, trial){
-        // Hot path — same optimizations as writeAppDataSingle:
-        //   - cached context.isTls13 instead of per-record session.getVersion()
-        //   - cached context.aeadAlgo instead of per-record getAeadAlgo()
-        //   - getTrafficSecrets() called once per key derivation (not per decrypt)
-        //   - For TLS 1.3 app-data: header view is used directly as AAD, avoiding
-        //     the 5-byte AAD allocation that decryptRecord would otherwise do
-        let out = null;
-        const isTls13 = context.isTls13 !== undefined
-            ? context.isTls13
-            : session.getVersion() === 0x0304; // early records (pre-secureConnect)
-
-        // AEAD decryption can throw on any forged/corrupted record (GCM/ChaCha
-        // tag mismatch surfaces as an exception from decipher.final()). Left
-        // unhandled, a single injected bad segment would throw out of the
-        // transport 'data' handler — an unhandled exception that tears down the
-        // connection or the process: a trivial remote DoS.
-        //
-        // RFC 8446 §5.2: in TLS (unlike DTLS, which silently drops), a record
-        // that fails to decrypt MUST be treated as a fatal error. So we catch,
-        // send a fatal bad_record_mac alert, destroy the connection, and stop.
-        // The read sequence number is intentionally NOT advanced on failure —
-        // the rejected record never counts.
-        try {
-        if (!isTls13 && context.remote_ccs_seen === true) {
-            // TLS 1.2: decrypt with key_block derived keys
-            if (context.app_read_key === null) {
-                const ts = session.getTrafficSecrets();
+    // ============================================================================
+    //  Reading records: one state, one set of rules
+    // ============================================================================
+    //
+    // What protects the next record from the peer is one of four states, and
+    // every rule about what a record may be follows from it — rather than from
+    // flags tested here and there (remote_ccs_seen, using_app_keys), which is
+    // how a plaintext Finished came to be read after the ServerHello, how a
+    // TLS 1.2 record's type came to be guessed instead of authenticated, and
+    // how application data came to be taken before the handshake was done.
+    //
+    //   'plain' — nothing yet: before the TLS 1.3 handshake keys (or before the
+    //             version is known); a TLS 1.2 handshake before the peer's
+    //             ChangeCipherSpec.
+    //   'hs13'  — TLS 1.3 under the handshake traffic keys: after the
+    //             ServerHello, until the peer's Finished.
+    //   'app13' — TLS 1.3 under the application traffic keys.
+    //   'tls12' — TLS 1.2 after the peer's ChangeCipherSpec: every record
+    //             protected, its type authenticated (it is in the AAD).
+    function negotiated13() {
+        if (context.isTls13 !== undefined) return context.isTls13;
+        const v = session.getVersion();
+        return v === 0x0304 ? true : v === 0x0303 ? false : undefined;
+    }
+    // The peer's Finished, verified: from here it writes under its
+    // application keys (TLS 1.3), and what it sends is application data it
+    // may send (both). Not using_app_keys, which flips at 'secureConnect' —
+    // later, for a server (its ticket goes first): a record in between was
+    // read under the wrong keys, and a CCS there passed as one before the
+    // Finished.
+    function peerFinished() {
+        return context.using_app_keys === true || (session.context && session.context.remote_finished_ok === true);
+    }
+    function readState() {
+        const v13 = negotiated13();
+        if (v13 === false) return context.remote_ccs_seen ? 'tls12' : 'plain';
+        if (v13 === true) {
+            if (peerFinished()) return 'app13';
+            const hs = session.getHandshakeSecrets();
+            if (hs && hs.remoteSecret) return 'hs13';
+        }
+        return 'plain';
+    }
+
+    // Every fatal condition of the record layer ends the same way: our alert,
+    // both layers inert, the transport ended after the alert has gone (end(),
+    // which also uncorks the flight the alert sits in — destroy() dropped it:
+    // 336 of 338 bad_record_mac alerts were never sent), then the report.
+    function abort(alert, message, code) {
+        if (context.destroyed) return;
+        const err = local_alert_error(alert, message, code);
+        try { session.sendAlert(2, alert); } catch (e) {}
+        markTransportDead();
+        closeAfterAlert();
+        self.emit('error', err);
+    }
 
-                // Guard: if master_secret isn't derived yet, we can't compute keys.
-                if (!ts.masterSecret) {
-                    self.emit('error', new Error('Received encrypted record before master_secret derived'));
+    // A record's plaintext, by its content type — the decrypted one, or a
+    // cleartext record's own (`clear`). Content longer than a record carries
+    // is record_overflow (RFC 8446 §5.4, RFC 5246 §6.2.1); a handshake or
+    // alert fragment of zero bytes is not one (§5.1).
+    function dispatchContent(contentType, content, state, clear) {
+        if (content.length > MAX_RECORD_PLAINTEXT) {
+            abort(TLS_ALERT.RECORD_OVERFLOW, 'record of ' + content.length + ' bytes of plaintext, more than 2^14', 'ERR_SSL_RECORD_OVERFLOW');
+            return;
+        }
+        // Ours, once negotiated (RFC 8449 §4: "MUST generate a fatal
+        // record_overflow alert") — on protected records: "Unprotected
+        // messages are not subject to this limit" (a TLS 1.2 Certificate in
+        // the clear, in full records, was refused). As DTLS.
+        const rsl = clear ? null : session.getRecordSizeLimit();
+        if (rsl && content.length > rsl.receive) {
+            abort(TLS_ALERT.RECORD_OVERFLOW, 'record of ' + content.length + ' bytes of plaintext, more than our record_size_limit (' + rsl.receive + ')', 'ERR_SSL_RECORD_OVERFLOW');
+            return;
+        }
+        if (contentType === CT.APPLICATION_DATA) {
+            // Only once the handshake is done: under TLS 1.3's application
+            // keys; in TLS 1.2 after the peer's Finished.
+            // Before that, it was handed to the reader all the same.
+            if (state === 'app13' || (state === 'tls12' && peerFinished())) {
+                // In the middle of a handshake message (a post-handshake one
+                // in pieces): "MUST NOT be interleaved with other record
+                // types" (RFC 8446 §5.1).
+                if (hsPending()) {
+                    abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'application data inside a handshake message', 'ERR_SSL_UNEXPECTED_MESSAGE');
                     return;
                 }
-
-                const d12 = deriveKeys12(ts.masterSecret, ts.localRandom, ts.remoteRandom, ts.cipher, ts.isServer);
-                context.app_read_key = d12.readKey;
-                context.app_read_iv = d12.readIv;
-                context.app_write_key = d12.writeKey;
-                context.app_write_iv = d12.writeIv;
+                if (content.length > 0) {
+                    context.consecutive_key_updates = 0;
+                    context.consecutive_warning_alerts = 0;
+                    pushAppData(content);
+                }
+                return;
             }
-
-            const recordType = context.using_app_keys ? 0x17 : 0x16;
-            out = decrypt_tls12_fragment(body, context.app_read_key, context.app_read_iv, context.tls12_read_seq, recordType);
-
-        } else if (isTls13 && context.using_app_keys === true) {
-            // TLS 1.3: decrypt app data with app traffic secret
-            if (context.app_read_key === null) {
-                const ts = session.getTrafficSecrets();
-                if (ts.remoteAppSecret === null) return;
-                const d = tls_derive_from_tls_secrets(ts.remoteAppSecret, ts.cipher);
-                context.app_read_key = d.key;
-                context.app_read_iv = d.iv;
+            abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'application data before the handshake is complete', 'ERR_SSL_UNEXPECTED_MESSAGE');
+            return;
+        }
+        if (contentType === CT.HANDSHAKE) {
+            if (content.length === 0) { abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'empty handshake record', 'ERR_SSL_UNEXPECTED_MESSAGE'); return; }
+            context.consecutive_warning_alerts = 0;
+            // RFC 8446 §5.1: "Handshake messages MUST NOT span key changes"
+            // — a message begun under one read state and continued under
+            // another (RFC 5246's CCS has its own check, handleChangeCipherSpec).
+            if (hsPending() && context.hsBufState !== state) {
+                abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'a handshake message spans a key change', 'ERR_SSL_UNEXPECTED_MESSAGE');
+                return;
             }
+            context.hsBufState = state;
+            feedHandshakeBytes(content);
+            return;
+        }
+        if (contentType === CT.ALERT) { handleAlert(content); return; }
+        // Anything else — a ChangeCipherSpec inside protection (§5: "MUST
+        // abort"), content type 0, an unknown one: unexpected_message.
+        abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'unexpected content type ' + contentType + ' in a ' + state + ' record', 'ERR_SSL_UNEXPECTED_MESSAGE');
+    }
 
+    // TLS 1.3 protected record (outer type application_data), under the keys
+    // of `state`. trial: early data not taken may come before the client's
+    // handshake flight (RFC 8446 §4.2.10): a record the handshake key does not
+    // open is that, and is skipped (false) rather than fatal.
+    function openRecord13(body, header, state, trial) {
+        let out;
+        try {
             const algo = context.aeadAlgo || getAeadAlgo(session.getCipher());
-            // Use header-view AAD path when header is available (parseRecordsAndDispatch).
-            // Saves a 5-byte allocation per record — small individually but meaningful
-            // cumulatively on the Download hot path (many records per second).
-            // get_nonce_into also reuses context._nonceDecScratch to avoid alloc per record.
-            const nonce = get_nonce_into(context._nonceDecScratch, context.app_read_iv, context.app_read_seq);
-            if (header !== undefined) {
-                out = decrypt_tls_record_with_aad(header, body, context.app_read_key, nonce, algo);
+            if (state === 'app13') {
+                if (context.app_read_key === null) {
+                    const ts = session.getTrafficSecrets();
+                    if (ts.remoteAppSecret === null) throw new Error('no application read key');
+                    const d = tls_derive_from_tls_secrets(ts.remoteAppSecret, ts.cipher);
+                    context.app_read_key = d.key;
+                    context.app_read_iv = d.iv;
+                }
+                out = decrypt_tls_record_with_aad(header, body, context.app_read_key,
+                    get_nonce_into(context._nonceDecScratch, context.app_read_iv, context.app_read_seq), algo);
+                context.app_read_seq++;
             } else {
-                out = decrypt_tls_record(body, context.app_read_key, nonce, algo);
-            }
-            context.app_read_seq++;
-
-        } else if (isTls13) {
-            // TLS 1.3: decrypt handshake with handshake traffic secret
-            if (context.handshake_read_key === null) {
-                const hs = session.getHandshakeSecrets();
-                if (hs.remoteSecret === null || hs.cipher === null) return;
-                const d = tls_derive_from_tls_secrets(hs.remoteSecret, hs.cipher);
-                context.handshake_read_key = d.key;
-                context.handshake_read_iv = d.iv;
+                if (context.handshake_read_key === null) {
+                    const hs = session.getHandshakeSecrets();
+                    if (hs.remoteSecret === null || hs.cipher === null) throw new Error('no handshake read key');
+                    const d = tls_derive_from_tls_secrets(hs.remoteSecret, hs.cipher);
+                    context.handshake_read_key = d.key;
+                    context.handshake_read_iv = d.iv;
+                }
+                out = decrypt_tls_record_with_aad(header, body, context.handshake_read_key,
+                    get_nonce_into(context._nonceDecScratch, context.handshake_read_iv, context.handshake_read_seq), algo);
+                context.handshake_read_seq++;
             }
+        } catch (e) {
+            // RFC 8446 §5.2: a record that does not open is fatal. The read
+            // sequence is not advanced — the rejected record never counts.
+            if (trial) return false;
+            abort(TLS_ALERT.BAD_RECORD_MAC, 'TLS record decryption failed (bad_record_mac)', 'ERR_SSL_BAD_RECORD_MAC');
+            return false;
+        }
+        if (trial) context.early.trialDone = true;
+        // TLSInnerPlaintext — content, type and padding together — is at
+        // most 2^14 + 1 bytes (RFC 8446 §5.4: "MUST NOT exceed"). Checked on
+        // the whole, not on the content once the padding is gone: 2^14 − 8
+        // bytes with 9 of padding passed.
+        if (out.length > MAX_RECORD_PLAINTEXT + 1) {
+            abort(TLS_ALERT.RECORD_OVERFLOW, 'TLSInnerPlaintext of ' + out.length + ' bytes, more than 2^14 + 1', 'ERR_SSL_RECORD_OVERFLOW');
+            return true;
+        }
+        // TLSInnerPlaintext: content, the type, then zeros. All zeros: no
+        // type at all (§5.4: unexpected_message) — it was an 'error' event
+        // and a connection left open.
+        let j = out.length - 1;
+        while (j >= 0 && out[j] === 0) j--;
+        if (j < 0) {
+            abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'TLSInnerPlaintext with no content type', 'ERR_SSL_UNEXPECTED_MESSAGE');
+            return true;
+        }
+        dispatchContent(out[j], out.subarray(0, j), state);
+        return true;
+    }
 
-            const algo = context.aeadAlgo || getAeadAlgo(session.getCipher());
-            const nonce = get_nonce_into(context._nonceDecScratch, context.handshake_read_iv, context.handshake_read_seq);
-            if (header !== undefined) {
-                out = decrypt_tls_record_with_aad(header, body, context.handshake_read_key, nonce, algo);
-            } else {
-                out = decrypt_tls_record(body, context.handshake_read_key, nonce, algo);
+    // TLS 1.2 protected record: its type — the header's — is part of the AAD
+    // (RFC 5246 §6.2.3.3). It was guessed from the state (handshake until the
+    // handshake was done, application data after), so a record relabelled
+    // from one to the other on the way still opened; and an encrypted alert
+    // was read as a cleartext one.
+    function openRecord12(type, body) {
+        let out;
+        try {
+            if (context.app_read_key === null) {
+                const ts = session.getTrafficSecrets();
+                if (!ts.masterSecret) throw new Error('no master secret');
+                const d12 = deriveKeys12(ts.masterSecret, ts.localRandom, ts.remoteRandom, ts.cipher, ts.isServer);
+                context.app_read_key = d12.readKey;
+                context.app_read_iv = d12.readIv;
+                context.app_write_key = d12.writeKey;
+                context.app_write_iv = d12.writeIv;
             }
-            context.handshake_read_seq++;
-        }
+            out = decrypt_tls12_fragment(body, context.app_read_key, context.app_read_iv, context.tls12_read_seq, type);
+            context.tls12_read_seq++;
         } catch (e) {
-            if (trial) return false;
-            // Record failed authentication → fatal bad_record_mac (RFC 8446 §5.2).
-            try { session.sendAlert ? session.sendAlert(2, TLS_ALERT.BAD_RECORD_MAC) : null; } catch (_) {}
-            self.emit('error', new Error('TLS record decryption failed (bad_record_mac)'));
-            self.destroy();
+            abort(TLS_ALERT.BAD_RECORD_MAC, 'TLS record decryption failed (bad_record_mac)', 'ERR_SSL_BAD_RECORD_MAC');
             return;
         }
+        dispatchContent(type, out, 'tls12');
+    }
 
-
-        if (out !== null) {
-            // Reuse cached isTls13 computed at the top of this function
-            if (isTls13) {
-                // Inlined parseInnerPlaintext — parse_tls_inner_plaintext would
-                // allocate a {type, content} object per record. With 640 records
-                // per 10MB download, that's 640 short-lived objects just for
-                // destructuring — enough GC pressure to matter. We do the scan
-                // and dispatch directly here.
-                let j = out.length - 1;
-                while (j >= 0 && out[j] === 0) j--;
-                if (j < 0) {
-                    self.emit('error', new Error('Malformed TLSInnerPlaintext'));
-                    return;
-                }
-                const content_type = out[j];
-
-                if (content_type === CT.APPLICATION_DATA) {
-                    // zero-copy view into the decrypted plaintext
-                    pushAppData(out.subarray(0, j));
-                } else if (content_type === CT.HANDSHAKE) {
-                    feedHandshakeBytes(out.subarray(0, j));
-                } else if (content_type === CT.ALERT) {
-                    // TLS 1.3 alerts after ServerHello are encrypted — a client
-                    // refusing our certificate always sends its alert this way.
-                    // They were decrypted and dropped here.
-                    handleAlert(out.subarray(0, j));
-                }
-            } else {
-                // TLS 1.2: no inner plaintext wrapping — `out` is the Buffer from decrypt12
-                if (context.using_app_keys === true) {
-                    pushAppData(out);
-                } else {
-                    feedHandshakeBytes(out);
-                }
+    // ChangeCipherSpec: one byte, 1 (RFC 8446 §5, RFC 5246 §7.1).
+    //   TLS 1.2: once, when the peer's keys exist (the master secret is
+    //     derived) and no handshake message is cut by it (§5.1 of 8446 holds
+    //     the same for 1.2: messages do not straddle a key change).
+    //   TLS 1.3: a middlebox-compatibility record, dropped — "at any time
+    //     after the first ClientHello ... and before the peer's Finished"
+    //     (§5); not before the version is known, not after the Finished.
+    // Anything else: unexpected_message. A CCS of two bytes, or one after the
+    // Finished, used to be passed over in silence.
+    function handleChangeCipherSpec(body, state) {
+        if (body.length !== 1 || body[0] !== 0x01) {
+            abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'malformed ChangeCipherSpec (' + body.length + ' bytes)', 'ERR_SSL_UNEXPECTED_MESSAGE');
+            return;
+        }
+        const v13 = negotiated13();
+        if (v13 === true) {
+            if (state === 'app13') abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'ChangeCipherSpec after the Finished', 'ERR_SSL_UNEXPECTED_MESSAGE');
+            return;   // compatibility record: dropped, no sequence advanced
+        }
+        if (v13 === false && state === 'plain') {
+            const ts = session.getTrafficSecrets();
+            if (ts && ts.masterSecret && !hsPending()) {
+                context.tls12_read_seq = 0;
+                context.remote_ccs_seen = true;
+                return;
             }
         }
-        if (trial && out !== null) context.early.trialDone = true;
-        return out !== null;
+        abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'unexpected ChangeCipherSpec', 'ERR_SSL_UNEXPECTED_MESSAGE');
     }
 
-
     // ============================================================================
     //  Early data (0-RTT over TCP, RFC 8446 §4.2.10, §4.5)
     // ============================================================================
@@ -670,10 +744,7 @@ function TLSSocket(duplex, options){
     }
 
     function earlyTooMuch() {
-        try { session.sendAlert(2, TLS_ALERT.UNEXPECTED_MESSAGE); } catch (e) {}
-        self.emit('error', new Error('More early data than max_early_data_size'));
-        markTransportDead();
-        closeAfterAlert();
+        abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'More early data than max_early_data_size', 'ERR_SSL_UNEXPECTED_MESSAGE');
     }
 
     // A record of early data not taken: skipped, counted (its plaintext at
@@ -690,24 +761,23 @@ function TLSSocket(duplex, options){
         try {
             out = decrypt_tls_record_with_aad(header, body, r.key, get_nonce_into(context._nonceDecScratch, r.iv, r.seq), r.algo);
         } catch (e) {
-            try { session.sendAlert(2, TLS_ALERT.BAD_RECORD_MAC); } catch (_) {}
-            self.emit('error', new Error('TLS early data record decryption failed (bad_record_mac)'));
-            self.destroy();
+            abort(TLS_ALERT.BAD_RECORD_MAC, 'TLS early data record decryption failed (bad_record_mac)', 'ERR_SSL_BAD_RECORD_MAC');
             return;
         }
         r.seq++;
         let j = out.length - 1;
         while (j >= 0 && out[j] === 0) j--;
-        if (j < 0) { self.emit('error', new Error('Malformed TLSInnerPlaintext')); return; }
+        if (j < 0) { abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'TLSInnerPlaintext with no content type', 'ERR_SSL_UNEXPECTED_MESSAGE'); return; }
         const ct = out[j];
         if (ct === CT.APPLICATION_DATA) {
+            if (j > MAX_RECORD_PLAINTEXT) { abort(TLS_ALERT.RECORD_OVERFLOW, 'early data record of ' + j + ' bytes, more than 2^14', 'ERR_SSL_RECORD_OVERFLOW'); return; }
             context.early.recv += j;
             if (context.early.recv > earlyLimit()) { earlyTooMuch(); return; }
             if (j > 0) pushAppData(out.subarray(0, j));
-        } else if (ct === CT.HANDSHAKE) {
-            feedHandshakeBytes(out.subarray(0, j));      // EndOfEarlyData, and nothing else (the session checks)
-        } else if (ct === CT.ALERT) {
-            handleAlert(out.subarray(0, j));
+        } else {
+            // EndOfEarlyData (the session checks it is that), an alert, or
+            // anything else — the same rules as any other record.
+            dispatchContent(ct, out.subarray(0, j), 'hs13');
         }
     }
 
@@ -830,6 +900,35 @@ function TLSSocket(duplex, options){
         context.readEnd = needed;
     }
 
+    // A handshake message, protected: in its records (handshakeFragments),
+    // each sealed and framed in one step (as writeAppDataSingle) under the
+    // keys named — TLS 1.3's (handshake or application) or 1.2's.
+    function writeProtectedHandshake(buf, v13, keyField, ivField, seqField) {
+        const algo = v13 ? (context.aeadAlgo || getAeadAlgo(session.getCipher())) : null;
+        for (const part of handshakeFragments(buf)) {
+            const rec = v13
+                ? encryptCompleteRecord13(CT.HANDSHAKE, part, context[keyField],
+                    get_nonce_into(context._nonceEncScratch, context[ivField], context[seqField]), algo, context.rec_version)
+                : encryptCompleteRecord12(part, context[keyField], context[ivField], context[seqField], CT.HANDSHAKE, context.rec_version);
+            context[seqField]++;
+            if (canWrite()) context.transport.write(rec);
+        }
+    }
+
+    // A handshake message, in records of at most 2^14 bytes (RFC 8446 §5.1,
+    // RFC 5246 §6.2.1: "MUST NOT exceed 2^14 bytes") — and of at most the
+    // peer's record_size_limit, once it is known. It went in one record
+    // however long: a chain over 16 KB was refused by OpenSSL (record
+    // overflow), and over 64 KB the record's 16-bit length wrapped — the
+    // stream after it unreadable. Post-quantum (ML-DSA) chains reach both.
+    function handshakeFragments(buf) {
+        const max = session.recordSendLimit();
+        if (buf.length <= max) return [buf];
+        let out = [];
+        for (let o = 0; o < buf.length; o += max) out.push(buf.subarray(o, Math.min(o + max, buf.length)));
+        return out;
+    }
+
     /**
      * Handshake message reassembly (RFC 8446 §5.1).
      *
@@ -842,38 +941,63 @@ function TLSSocket(duplex, options){
      *
      * Note on memory: session.message() stashes views of the fed bytes into
      * its transcript, so every message handed over must be backed by memory
-     * we never overwrite. Buffer.from()/Buffer.concat() below always copy out
-     * of the (reused) record buffers; the carve-out subarrays then alias the
-     * fresh copy, which nothing mutates.
+     * we never overwrite: each is copied out of the (reused) record buffers.
+     *
+     * Linear in the message: its pieces are kept as they come and joined
+     * once, when the last arrives. The buffer was joined anew with every
+     * record — a 128 KB ClientHello in 1-byte records cost 1.9 s of CPU and
+     * 200 MB, before anything about it was checked.
      */
+    function hsPending() { return context.hsHdr !== null || context.hsParts !== null; }
+    function hsReset() { context.hsHdr = null; context.hsParts = null; context.hsFill = 0; context.hsLen = 0; }
     function feedHandshakeBytes(bytes){
-        if (context.hsBuf === null || context.hsBuf.length === 0) {
-            context.hsBuf = Buffer.from(bytes);
-        } else {
-            context.hsBuf = Buffer.concat([context.hsBuf, Buffer.from(bytes)]);
-        }
-
-        while (context.hsBuf.length >= 4) {
-            const len = (context.hsBuf[1] << 16) | (context.hsBuf[2] << 8) | context.hsBuf[3];
-            const maxMsg = options.maxHandshakeSize > 0 ? Math.min(options.maxHandshakeSize, HANDSHAKE_MESSAGE_MAX) : HANDSHAKE_MESSAGE_MAX;
-            if (len > maxMsg) {
-                // OpenSSL's answer to an excessive message: illegal_parameter.
-                context.hsBuf = null;
-                try { session.sendAlert(2, TLS_ALERT.ILLEGAL_PARAMETER); } catch (_) {}
-                self.emit('error', new Error('TLS handshake message of ' + len + ' bytes, more than ' + maxMsg));
-                self.destroy();
-                return;
+        let p = 0;
+        while (p < bytes.length) {
+            if (context.hsParts === null) {
+                // The header: 4 bytes, maybe across records.
+                let have = context.hsHdr === null ? 0 : context.hsHdr.length;
+                let take = Math.min(4 - have, bytes.length - p);
+                let hdr = have === 0 ? Buffer.from(bytes.subarray(p, p + take))
+                                     : Buffer.concat([context.hsHdr, Buffer.from(bytes.subarray(p, p + take))]);
+                p += take;
+                if (hdr.length < 4) { context.hsHdr = hdr; return; }
+                context.hsHdr = null;
+                const len = (hdr[1] << 16) | (hdr[2] << 8) | hdr[3];
+                const maxMsg = session.handshakeMessageLimit();
+                if (len > maxMsg) {
+                    // OpenSSL's answer to an excessive message: illegal_parameter.
+                    hsReset();
+                    abort(TLS_ALERT.ILLEGAL_PARAMETER, 'TLS handshake message of ' + len + ' bytes, more than ' + maxMsg);
+                    return;
+                }
+                context.hsParts = [hdr]; context.hsFill = 4; context.hsLen = 4 + len;
+            }
+            let take = Math.min(context.hsLen - context.hsFill, bytes.length - p);
+            if (take > 0) {
+                context.hsParts.push(Buffer.from(bytes.subarray(p, p + take)));
+                context.hsFill += take; p += take;
             }
-            if (context.hsBuf.length < 4 + len) break; // partial message — wait for more records
+            if (context.hsFill < context.hsLen) return;   // partial message — wait for more records
 
-            const msg = context.hsBuf.subarray(0, 4 + len);
-            context.hsBuf = context.hsBuf.subarray(4 + len);
+            const msg = context.hsParts.length === 1 ? context.hsParts[0] : Buffer.concat(context.hsParts, context.hsLen);
+            hsReset();
 
             session.message(msg);
 
             // A message may have fatally ended the session (alert sent,
             // transport torn down). Don't keep feeding a corpse.
             if (context.destroyed) return;
+
+            // The message changed the read keys (a ServerHello, a Finished, a
+            // KeyUpdate): what follows it in the same record was protected
+            // under the old ones, and is no message of the new state (RFC
+            // 8446 §5.1: "MUST align with a record boundary"). A KeyUpdate
+            // leaves the read state's name as it was ('app13'), so it is
+            // named here: two in one record were taken.
+            if (p < bytes.length && (readState() !== context.hsBufState || msg[0] === 24)) {
+                abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'handshake data after a key change, in the record before it', 'ERR_SSL_UNEXPECTED_MESSAGE');
+                return;
+            }
         }
     }
 
@@ -923,25 +1047,25 @@ function TLSSocket(duplex, options){
             // in silence; OpenSSL rejects on the header ("wrong version
             // number"), and so does this now, with node:tls's codes.
             //   RFC 8446 §5.1: legacy_record_version is 0x03xx, ContentType
-            //   one of the four; §5.2: no record beyond 2^14 + 256 bytes of
-            //   ciphertext (2^14 + 2048 in TLS 1.2, RFC 5246 §6.2.3).
+            //   one of the four. The length, by the state the record is read
+            //   in: a cleartext record carries at most 2^14 bytes; a TLS 1.3
+            //   protected one 2^14 + 256 (§5.2) — early data, still before
+            //   the handshake keys, is one; a TLS 1.2 one 2^14 + 2048
+            //   (RFC 5246 §6.2.3). It was 2^14 + 2048 for all.
+            const state = readState();
             {
                 const recVer = (rb[off + 1] << 8) | rb[off + 2];
-                let bad = null, alert = 0;
+                const maxLen = state === 'tls12' ? MAX_RECORD_PLAINTEXT + 2048
+                             : (state === 'hs13' || state === 'app13' || type === CT.APPLICATION_DATA) ? MAX_RECORD_PLAINTEXT + 256
+                             : MAX_RECORD_PLAINTEXT;
                 if ((recVer >>> 8) !== 0x03 || type < CT.CHANGE_CIPHER_SPEC || type > CT.APPLICATION_DATA) {
-                    bad = new Error('wrong version number: not a TLS record (type 0x' + type.toString(16) + ', version 0x' + recVer.toString(16) + ')');
-                    bad.code = 'ERR_SSL_WRONG_VERSION_NUMBER';
-                    alert = (recVer >>> 8) !== 0x03 ? TLS_ALERT.PROTOCOL_VERSION : TLS_ALERT.UNEXPECTED_MESSAGE;
-                } else if (len > 16384 + 2048) {
-                    bad = new Error('record overflow: ' + len + ' bytes');
-                    bad.code = 'ERR_SSL_RECORD_OVERFLOW';
-                    alert = TLS_ALERT.RECORD_OVERFLOW;
+                    abort((recVer >>> 8) !== 0x03 ? TLS_ALERT.PROTOCOL_VERSION : TLS_ALERT.UNEXPECTED_MESSAGE,
+                        'wrong version number: not a TLS record (type 0x' + type.toString(16) + ', version 0x' + recVer.toString(16) + ')',
+                        'ERR_SSL_WRONG_VERSION_NUMBER');
+                    return;
                 }
-                if (bad) {
-                    try { session.sendAlert(2, alert); } catch (e) {}
-                    self.emit('error', bad);
-                    markTransportDead();
-                    closeAfterAlert();
+                if (len > maxLen) {
+                    abort(TLS_ALERT.RECORD_OVERFLOW, 'record overflow: ' + len + ' bytes, more than ' + maxLen, 'ERR_SSL_RECORD_OVERFLOW');
                     return;
                 }
             }
@@ -959,86 +1083,57 @@ function TLSSocket(duplex, options){
             // CPU (BoGo: TooManyEmptyFragments / TooManyChangeCipherSpec).
             if (len === 0) {
                 if (++context.consecutive_empty_records > 32) {
-                    try { session.sendAlert(2, TLS_ALERT.UNEXPECTED_MESSAGE); } catch (e) {}
-                    self.emit('error', new Error('Too many consecutive empty records'));
-                    markTransportDead();
-                    closeAfterAlert();
+                    abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'Too many consecutive empty records');
                     return;
                 }
             } else {
                 context.consecutive_empty_records = 0;
             }
-
             if (type === CT.CHANGE_CIPHER_SPEC) {
                 if (++context.consecutive_ccs_records > 8) {
-                    try { session.sendAlert(2, TLS_ALERT.UNEXPECTED_MESSAGE); } catch (e) {}
-                    self.emit('error', new Error('Too many consecutive ChangeCipherSpec records'));
-                    markTransportDead();
-                    closeAfterAlert();
+                    abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'Too many consecutive ChangeCipherSpec records');
                     return;
                 }
             } else {
                 context.consecutive_ccs_records = 0;
             }
 
-            if (type === CT.APPLICATION_DATA && session.isServer && !context.using_app_keys && context.isTls13 !== false) {
+            // Early data, at a TLS 1.3 server that has not yet the client's
+            // Finished: its own rules (see "Early data").
+            if (type === CT.APPLICATION_DATA && session.isServer && state !== 'app13' && state !== 'tls12' && negotiated13() !== false) {
                 const em = serverEarlyMode();
                 if (em === 'pending') { off -= 5 + len; break; }   // the decision first; this record waits
                 if (em === 'skip') { if (!skipEarly(len)) return; continue; }
                 if (em === 'accepted') { processEarlyRecord(body, header); if (context.destroyed) return; continue; }
-                if (em === 'trial') { if (!processCiphertext(body, header, true) && !skipEarly(len)) return; continue; }
+                if (em === 'trial' && state === 'hs13') { if (!openRecord13(body, header, state, true) && !skipEarly(len)) return; continue; }
             }
-            if (type === CT.APPLICATION_DATA) {
-                processCiphertext(body, header);
-                context.tls12_read_seq++;
-            } else if (type === CT.HANDSHAKE) {
-                if (context.remote_ccs_seen === true) {
-                    // Encrypted handshake (TLS 1.2 Finished post-CCS). decrypt output is
-                    // a FRESH Buffer per record — safe to pass views of it downstream.
-                    processCiphertext(body, header);
+
+            if (type === CT.CHANGE_CIPHER_SPEC) {
+                handleChangeCipherSpec(body, state);
+            } else if (state === 'tls12') {
+                // Everything after the peer's CCS is protected, its type
+                // authenticated with it.
+                openRecord12(type, body);
+            } else if (state === 'hs13' || state === 'app13') {
+                if (type === CT.APPLICATION_DATA) {
+                    openRecord13(body, header, state, false);
+                } else if (type === CT.ALERT && state === 'hs13') {
+                    // A peer that cannot yet protect its alert — a client
+                    // refusing the ServerHello before it has the keys.
+                    dispatchContent(CT.ALERT, body, state, true);
                 } else {
-                    // Plaintext handshake (ClientHello, ServerHello, Certificate, ...).
-                    // `body` is a zero-copy view into readBuffer. session.message()
-                    // stashes the raw bytes into the handshake transcript (used later
-                    // for Finished MAC verification and TLS 1.3 key derivation), and
-                    // also extracts fields like remote_random as subarray views.
-                    //
-                    // When the NEXT incoming chunk triggers readBuffer compact/reuse,
-                    // those stashed views would point to overwritten bytes — causing
-                    // bad key derivations and GCM tag failures much later. We must hand
-                    // the session an owned Buffer so its transcript survives.
-                    feedHandshakeBytes(body);
+                    // A cleartext handshake record — or alert — where only
+                    // protected records may be (RFC 8446 §5: unexpected_message).
+                    // A cleartext Finished was taken here, and a KeyUpdate
+                    // injected on the path was acted on.
+                    abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'unprotected record (type ' + type + ') after the handshake keys', 'ERR_SSL_UNEXPECTED_MESSAGE');
                 }
-                context.tls12_read_seq++;
-            } else if (type === CT.CHANGE_CIPHER_SPEC) {
-                // Version-dependent meaning:
-                //  - TLS 1.2: a real protocol event — the peer's next records
-                //    are encrypted. Flip remote_ccs_seen so type-22 records are
-                //    routed to the decrypt path.
-                //  - TLS 1.3: a middlebox-compat artifact (RFC 8446 §D.4)
-                //    carrying no meaning; cipher state is driven by the key
-                //    schedule. It MUST be ignored and MUST NOT advance any
-                //    read sequence.
-                //
-                // The test is "do we POSITIVELY know this is TLS 1.2", not
-                // "is it not 1.3", and that is the correct test on its own
-                // merits: a CCS carries no meaning unless we have actually
-                // negotiated 1.2, so an unknown version must not be treated as
-                // a cipher change. (It also used to be load-bearing for a
-                // second reason — the HelloRetryRequest path did not record
-                // selected_version, so mid-HRR the version was simply unknown.
-                // That gap is fixed at its source now, but the rule stands.)
-                const ccsVersion = (context.isTls13 !== undefined)
-                    ? (context.isTls13 ? 0x0304 : 0x0303)
-                    : session.getVersion();
-                if (ccsVersion === 0x0303) {
-                    context.tls12_read_seq = 0;
-                    context.remote_ccs_seen = true;
-                }
-                // TLS 1.3, or version not yet negotiated: swallow silently.
-            } else if (type === CT.ALERT) {
-                handleAlert(body);
+            } else {
+                // 'plain': handshake and alerts in the clear; application data
+                // has no place before the keys.
+                dispatchContent(type, body, state, true);
             }
+            if (context.destroyed) return;
         }
 
         // Reset offsets when buffer is fully drained (enables fast path on next chunk)
@@ -1108,10 +1203,16 @@ function TLSSocket(duplex, options){
     // certificate") — without it the socket just closed and nothing learned
     // why: a server could not see that clients were refusing its certificate.
     function handleAlert(body) {
-        if (!body || body.length < 2) return;
-        const level = body[0];
-        const desc  = body[1];
-        self.emit('alert', { level: level, description: desc });
+        const a = read_peer_alert(body, negotiated13() === true);
+        if (a.error) { abort(a.error.alert, a.error.message); return; }
+        const desc = a.desc;
+        const level = a.fatal ? TLS_ALERT_LEVEL.FATAL : TLS_ALERT_LEVEL.WARNING;
+        self.emit('alert', { level: a.level, description: desc });
+        // A run of warnings, nothing else between them.
+        if (!a.fatal && desc !== TLS_ALERT.CLOSE_NOTIFY && ++context.consecutive_warning_alerts > MAX_WARNING_ALERTS) {
+            abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'too many consecutive warning alerts', 'ERR_SSL_UNEXPECTED_MESSAGE');
+            return;
+        }
         if (desc === TLS_ALERT.CLOSE_NOTIFY) {
             // The peer is done sending: end our readable side, so 'end' is
             // emitted once what came before it is read.
@@ -1135,12 +1236,7 @@ function TLSSocket(duplex, options){
             // reacting to it finds the session already over.
             markTransportDead();
             if (desc !== TLS_ALERT.CLOSE_NOTIFY) {
-                let name = null;
-                for (const k in TLS_ALERT) if (TLS_ALERT[k] === desc) { name = k.toLowerCase(); break; }
-                const err = new Error('peer sent fatal alert: ' + (name || 'alert') + ' (' + desc + ')');
-                err.code = 'ERR_TLS_ALERT_RECEIVED';
-                err.alert = desc;
-                self.emit('error', err);
+                self.emit('error', peer_alert_error(desc));
             }
             // Nothing of ours to flush: the peer has ended the connection.
             if (context.transport && typeof context.transport.destroy === 'function') context.transport.destroy();
@@ -1242,11 +1338,8 @@ function TLSSocket(duplex, options){
         const buf = toBuf(data || []);
         coalesceFlight();
 
-        // Resolve TLS version: use cached isTls13 if set (post-secureConnect); otherwise query.
-        // During handshake we may not yet have context.isTls13 set — only after secureConnect.
-        const isTls13 = context.isTls13 !== undefined
-            ? context.isTls13
-            : session.getVersion() === 0x0304;
+        noteNegotiated();
+        const isTls13 = context.isTls13 === true;
 
         // Alert messages — encrypt based on current epoch (0=plaintext, 1=handshake, 2=app)
         if (type === 'alert') {
@@ -1418,21 +1511,8 @@ function TLSSocket(duplex, options){
                     context.handshake_write_iv = d.iv;
                 }
 
-                const algo = context.aeadAlgo || getAeadAlgo(session.getCipher());
                 try {
-                    // Fused encrypt+frame — produces a complete TLS record buffer
-                    // ready for transport.write. Same optimization as writeAppDataSingle.
-                    const rec = encryptCompleteRecord13(
-                        CT.HANDSHAKE, buf,
-                        context.handshake_write_key,
-                        get_nonce_into(context._nonceEncScratch, context.handshake_write_iv, context.handshake_write_seq),
-                        algo,
-                        context.rec_version
-                    );
-                    context.handshake_write_seq++;
-                    if (canWrite()) {
-                        context.transport.write(rec);
-                    }
+                    writeProtectedHandshake(buf, true, 'handshake_write_key', 'handshake_write_iv', 'handshake_write_seq');
                     if (session.isServer && type === 'finished' && context.early.status === 'accepted' && !context.early.srvWrite) {
                         context.early.srvWrite = true;
                         process.nextTick(flushServerEarlyWrites);
@@ -1459,14 +1539,7 @@ function TLSSocket(duplex, options){
                 }
 
                 try {
-                    const rec = encryptCompleteRecord12(
-                        buf, context.app_write_key, context.app_write_iv,
-                        context.app_write_seq, CT.HANDSHAKE, context.rec_version
-                    );
-                    context.app_write_seq++;
-                    if (canWrite()) {
-                        context.transport.write(rec);
-                    }
+                    writeProtectedHandshake(buf, false, 'app_write_key', 'app_write_iv', 'app_write_seq');
                 } catch(e) {
                     self.emit('error', e);
                 }
@@ -1484,19 +1557,8 @@ function TLSSocket(duplex, options){
                 }
             }
             if (context.app_write_key) {
-                const algo = context.aeadAlgo || getAeadAlgo(session.getCipher());
                 try {
-                    const rec = encryptCompleteRecord13(
-                        CT.HANDSHAKE, buf,
-                        context.app_write_key,
-                        get_nonce_into(context._nonceEncScratch, context.app_write_iv, context.app_write_seq),
-                        algo,
-                        context.rec_version
-                    );
-                    context.app_write_seq++;
-                    if (canWrite()) {
-                        context.transport.write(rec);
-                    }
+                    writeProtectedHandshake(buf, true, 'app_write_key', 'app_write_iv', 'app_write_seq');
                 } catch(e) {
                     self.emit('error', e);
                 }
@@ -1506,54 +1568,23 @@ function TLSSocket(duplex, options){
     });
 
 
+    // The version and AEAD, cached for the hot paths once negotiated: a
+    // client's at its ServerHello ('hello'), a server's when it answers —
+    // after its 'hello', which comes first (the application may still
+    // configure the session there): its ServerHello's 'message'. Read at
+    // 'hello' alone, a server had neither, and its 0.5-RTT data went out
+    // as TLS 1.2.
+    function noteNegotiated() {
+        if (context.isTls13 !== undefined) return;
+        const v = session.getVersion();
+        if (!v) return;
+        context.isTls13 = v === 0x0304;
+        if (session.getCipher()) context.aeadAlgo = getAeadAlgo(session.getCipher());
+    }
+
     session.on('hello', function(){
         context.rec_version = 0x0303; // legacy record version (both 1.2 and 1.3)
-
-        // Client already sent its preferences in ClientHello — don't override
-        if (!session.isServer) return;
-
-        // Parse version range from options
-        let maxVer = parseVersion(options.maxVersion) || 0x0304;
-        let minVer = parseVersion(options.minVersion) || 0x0303;
-
-        let versions = [];
-        if (maxVer >= 0x0304 && minVer <= 0x0304) versions.push(0x0304);
-        if (maxVer >= 0x0303 && minVer <= 0x0303) versions.push(0x0303);
-        if (versions.length === 0) versions.push(0x0303); // fallback
-
-        // Cipher suites based on supported versions
-        // crypto.js owns the default suite list (see default_cipher_suites).
-        let ciphers = default_cipher_suites(versions.includes(0x0304), versions.includes(0x0303));
-
-        // Signature algorithms: override or default
-        // signing.js owns the scheme list (see default_signature_schemes):
-        // the PKCS#1 set is only added when TLS 1.2 is actually in range.
-        let sigalgs = options.signatureAlgorithms
-            || default_signature_schemes();
-
-        // Groups: override or default
-        // A server's default: post-quantum hybrid first (ecdh.js). A client that
-        // offers it gets it; any other gets the classical group it asked for.
-        let groups = options.groups || SERVER_DEFAULT_GROUPS.slice();
-
-        ciphers = chooseCipherSuites(ciphers, options.prioritizeChaCha, context.allowedCipherSuites);
-
-        // ALPN from options
-        let alpns = Array.isArray(options.ALPNProtocols) ? options.ALPNProtocols : [];
-
-        session.set_context({
-            local_supported_versions: versions,
-            local_supported_alpns: alpns,
-            local_supported_groups: groups,
-            local_supported_cipher_suites: ciphers,
-            local_supported_signature_algorithms: sigalgs,
-        });
-
-        // Resolve AEAD algorithm + isTls13 flag once cipher/version are negotiated.
-        // For client, both are known after receiving ServerHello (this event fires after).
-        // For server, these are cached again at secureConnect as a fallback.
-        if (session.getCipher()) context.aeadAlgo = getAeadAlgo(session.getCipher());
-        if (session.getVersion()) context.isTls13 = (session.getVersion() === 0x0304);
+        noteNegotiated();
     });
 
     session.on('secureConnect', function(){
@@ -1561,12 +1592,10 @@ function TLSSocket(duplex, options){
         // and the flight ending in Finished must end EXACTLY there. Leftover
         // bytes in the message stream at completion are trailing garbage the
         // peer packed after its Finished — a framing violation, not padding.
-        if (context.hsBuf !== null && context.hsBuf.length > 0) {
-            context.hsBuf = null;
-            markTransportDead();
-            self.emit('error', new Error('Trailing data after handshake completion (decode_error)'));
-            const t = context.transport;
-            if (t && typeof t.destroy === 'function' && !t.destroyed) t.destroy();
+        if (hsPending()) {
+            hsReset();
+            // An alert this time: the peer learns why.
+            abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'Trailing data after handshake completion', 'ERR_SSL_UNEXPECTED_MESSAGE');
             return;
         }
 
@@ -1579,19 +1608,20 @@ function TLSSocket(duplex, options){
         // Clear handshake timeout
         if (context.handshakeTimer) { clearTimeout(context.handshakeTimer); context.handshakeTimer = null; }
 
-        // Certificate pinning
-        if (context.pins && context.pins.length > 0) {
-            try {
-                let cert = session.getPeerCertificate();
-                if (cert && cert.raw) {
-                    let hash = 'sha256/' + crypto.createHash('sha256').update(cert.raw).digest('base64');
-                    if (!context.pins.includes(hash)) {
-                        self.emit('error', new Error('Certificate pin mismatch: ' + hash));
-                        self.destroy();
-                        return;
-                    }
-                }
-            } catch(e) { /* pinning is best-effort if no raw cert */ }
+        // Certificate pinning: the leaf's DER, 'sha256/' + base64 of its
+        // SHA-256. The chain is a list of { cert } entries — this check once
+        // read `.raw` off the list itself, found nothing, and let every
+        // certificate through behind a "best-effort" catch. A pin fails closed:
+        // no certificate to hash is a mismatch too. A client's option (the
+        // server's certificate), as documented.
+        if (!context.isServer && context.pins && context.pins.length > 0) {
+            let chain = session.getPeerCertificate();
+            let leaf = chain && chain.length > 0 ? chain[0].cert : null;
+            let hash = leaf ? 'sha256/' + crypto.createHash('sha256').update(leaf).digest('base64') : null;
+            if (hash === null || !context.pins.includes(hash)) {
+                abort(TLS_ALERT.BAD_CERTIFICATE, 'Certificate pin mismatch: ' + (hash || 'no peer certificate'), 'ERR_TLS_CERT_PIN_MISMATCH');
+                return;
+            }
         }
 
         // Emit keylog lines (SSLKEYLOGFILE compatible)
@@ -1731,6 +1761,13 @@ function TLSSocket(duplex, options){
             context.app_write_iv = d.iv;
             context.app_write_seq = 0;
         } else if (info.direction === 'receive') {
+            // A run of KeyUpdates with no data between them (BoGo:
+            // TooManyKeyUpdates) — 32, BoringSSL's limit. The peer's answers
+            // to ours aside (info.answer): those we asked for.
+            if (!info.answer && ++context.consecutive_key_updates > 32) {
+                abort(TLS_ALERT.UNEXPECTED_MESSAGE, 'too many KeyUpdates without application data', 'ERR_SSL_UNEXPECTED_MESSAGE');
+                return;
+            }
             // Peer updated their send secret → derive new read keys, reset seq
             let d = tls_derive_from_tls_secrets(info.secret, session.getCipher());
             context.app_read_key = d.key;
@@ -1798,45 +1835,12 @@ function TLSSocket(duplex, options){
      * The other four are applied for the same reason — each is documented as a
      * per-connection option, and each was being dropped on the client side.
      */
-    function applyClientContext() {
-        if (session.isServer) return;
-
-        let update = {};
-
-        if (Array.isArray(options.ALPNProtocols) && options.ALPNProtocols.length > 0) {
-            update.local_supported_alpns = options.ALPNProtocols.map(function (p) {
-                return Buffer.isBuffer(p) ? p.toString('latin1') : String(p);
-            });
-        }
-
-        let maxVer = parseVersion(options.maxVersion);
-        let minVer = parseVersion(options.minVersion);
-        if (maxVer || minVer) {
-            maxVer = maxVer || 0x0304;
-            minVer = minVer || 0x0303;
-            let versions = [];
-            if (maxVer >= 0x0304 && minVer <= 0x0304) versions.push(0x0304);
-            if (maxVer >= 0x0303 && minVer <= 0x0303) versions.push(0x0303);
-            if (versions.length === 0) versions.push(0x0303);
-            update.local_supported_versions = versions;
-        }
-
-        if (options.groups) update.local_supported_groups = options.groups;
-        if (options.signatureAlgorithms) {
-            update.local_supported_signature_algorithms = options.signatureAlgorithms;
-        }
-
-        if (options.allowedCipherSuites || options.prioritizeChaCha) {
-            let vers = update.local_supported_versions || [0x0304, 0x0303];
-            let ciphers = default_cipher_suites(vers.indexOf(0x0304) >= 0,
-                                                vers.indexOf(0x0303) >= 0);
-            update.local_supported_cipher_suites = chooseCipherSuites(ciphers, options.prioritizeChaCha, options.allowedCipherSuites);
-        }
-
-        if (Object.keys(update).length > 0) session.set_context(update);
-    }
-
-    applyClientContext();
+    // What the options say about the lists the session negotiates with
+    // (node_options.js localLists — the versions, and suites, groups,
+    // signature schemes and ALPN where given); TLSSession fills the rest by
+    // its role. For a server this was done on its 'hello', a client's
+    // separately, each its own way.
+    session.set_context(localLists(options, localVersions));
 
     // If duplex was passed in constructor, start reading
     if (context.transport) {
@@ -2030,7 +2034,7 @@ function TLSSocket(duplex, options){
             sendCompatCCS();
         }
 
-        writeRecord(CT.HANDSHAKE, buf);
+        for (const part of handshakeFragments(buf)) writeRecord(CT.HANDSHAKE, part);
 
         // Offering early data: the compatibility CCS right after this
         // first hello (§D.4), then the early data.
@@ -2040,9 +2044,11 @@ function TLSSocket(duplex, options){
             flushEarly();
         }
 
+        // A HelloRetryRequest is TLS 1.3 by definition — the version need not
+        // be recorded yet, and was not: the CCS went after the second
+        // ServerHello instead of right after the HRR.
         if (session.isServer &&
-            (type === 'hello' || type === 'hello_retry_request') &&
-            session.getVersion() === 0x0304) {
+            (type === 'hello_retry_request' || (type === 'hello' && session.getVersion() === 0x0304))) {
             sendCompatCCS();
         }
     }
@@ -2136,12 +2142,7 @@ function TLSSocket(duplex, options){
 
     /** Returns negotiated protocol string: 'TLSv1.3', 'TLSv1.2', etc. */
     self.getProtocol = function(){
-        let v = session.getVersion();
-        if (v === 0x0304) return 'TLSv1.3';
-        if (v === 0x0303) return 'TLSv1.2';
-        if (v === 0x0302) return 'TLSv1.1';
-        if (v === 0x0301) return 'TLSv1';
-        return null;
+        return version_name(session.getVersion());
     };
 
     /** Returns cipher info: { name, standardName, version }. */
@@ -2161,6 +2162,11 @@ function TLSSocket(duplex, options){
     // Encrypted Client Hello (server): null (not offered) | 'accepted' | 'rejected'.
     Object.defineProperty(self, 'echStatus', { get: function(){ return session.getEchStatus(); } });
     Object.defineProperty(self, 'echAccepted', { get: function(){ return session.getEchStatus() === 'accepted'; } });
+    // Server, split mode: ECH accepted by the client-facing server in front of this one.
+    Object.defineProperty(self, 'echBackend', { get: function(){ return session.isEchBackend(); } });
+    /** External PSK: the identity this connection was authenticated with
+     *  (a Buffer), or null. */
+    self.getPskIdentity = function(){ let id = session.getPskIdentity(); return id ? Buffer.from(id) : null; };
     Object.defineProperty(self, 'alpnProtocol', {
         get: function(){ return session.getALPN() || false; },
         enumerable: true
@@ -2294,7 +2300,7 @@ function TLSSocket(duplex, options){
      *  encrypt path chunk on this boundary; values outside the range throw. */
     self.setMaxSendFragment = function(size){
         size = Number(size);
-        if (!Number.isInteger(size) || size < 512 || size > 16384) {
+        if (!Number.isInteger(size) || size < 512 || size > MAX_RECORD_PLAINTEXT) {
             throw new RangeError('setMaxSendFragment: size must be an integer in [512, 16384]');
         }
         self._maxSendFragment = size;
@@ -2455,14 +2461,7 @@ function TLSSocket(duplex, options){
       if (session.context && session.context.isServer) return null;
       let g = session.context ? session.context.selected_group : null;
       if (g == null) return {};
-      let known = {
-        0x0017: { name: 'prime256v1', size: 256 },
-        0x0018: { name: 'secp384r1',  size: 384 },
-        0x0019: { name: 'secp521r1',  size: 521 },
-        0x001d: { name: 'x25519',     size: 253 },
-        0x001e: { name: 'x448',       size: 448 }
-      };
-      let k = known[g];
+      let k = dh_group_info(g);
       // Not an ECDH curve, so not in that table, but a group with a name.
       if (!k && ecdh_group_name(g)) return { type: 'TLSGroup', name: ecdh_group_name(g) };
       // Anything outside that table is still a negotiated TLS group — report