nlcurl 0.6.0 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +143 -140
- package/dist/cache/groups.d.ts +75 -0
- package/dist/cache/groups.d.ts.map +1 -0
- package/dist/cache/groups.js +118 -0
- package/dist/cache/groups.js.map +1 -0
- package/dist/cache/no-vary-search.d.ts +33 -0
- package/dist/cache/no-vary-search.d.ts.map +1 -0
- package/dist/cache/no-vary-search.js +148 -0
- package/dist/cache/no-vary-search.js.map +1 -0
- package/dist/cache/range.d.ts +120 -0
- package/dist/cache/range.d.ts.map +1 -0
- package/dist/cache/range.js +193 -0
- package/dist/cache/range.js.map +1 -0
- package/dist/cache/store.d.ts +111 -0
- package/dist/cache/store.d.ts.map +1 -0
- package/dist/cache/store.js +414 -0
- package/dist/cache/store.js.map +1 -0
- package/dist/cache/types.d.ts +69 -0
- package/dist/cache/types.d.ts.map +1 -0
- package/dist/cache/types.js +2 -0
- package/dist/cache/types.js.map +1 -0
- package/dist/cli/args.d.ts +4 -37
- package/dist/cli/args.d.ts.map +1 -1
- package/dist/cli/args.js +3 -4
- package/dist/cli/args.js.map +1 -1
- package/dist/cli/index.d.ts +0 -5
- package/dist/cli/index.d.ts.map +1 -1
- package/dist/cli/index.js +1 -6
- package/dist/cli/index.js.map +1 -1
- package/dist/cli/output.d.ts +14 -20
- package/dist/cli/output.d.ts.map +1 -1
- package/dist/cli/output.js +14 -20
- package/dist/cli/output.js.map +1 -1
- package/dist/cookies/jar.d.ts +33 -31
- package/dist/cookies/jar.d.ts.map +1 -1
- package/dist/cookies/jar.js +69 -33
- package/dist/cookies/jar.js.map +1 -1
- package/dist/cookies/parser.d.ts +14 -16
- package/dist/cookies/parser.d.ts.map +1 -1
- package/dist/cookies/parser.js +30 -13
- package/dist/cookies/parser.js.map +1 -1
- package/dist/cookies/psl-data.d.ts +1 -1
- package/dist/cookies/psl-data.js +1 -1
- package/dist/cookies/public-suffix.d.ts +5 -27
- package/dist/cookies/public-suffix.d.ts.map +1 -1
- package/dist/cookies/public-suffix.js +5 -37
- package/dist/cookies/public-suffix.js.map +1 -1
- package/dist/core/auth.d.ts +30 -0
- package/dist/core/auth.d.ts.map +1 -0
- package/dist/core/auth.js +34 -0
- package/dist/core/auth.js.map +1 -0
- package/dist/core/client.d.ts +28 -40
- package/dist/core/client.d.ts.map +1 -1
- package/dist/core/client.js +34 -41
- package/dist/core/client.js.map +1 -1
- package/dist/core/errors.d.ts +64 -88
- package/dist/core/errors.d.ts.map +1 -1
- package/dist/core/errors.js +64 -88
- package/dist/core/errors.js.map +1 -1
- package/dist/core/request.d.ts +63 -85
- package/dist/core/request.d.ts.map +1 -1
- package/dist/core/response.d.ts +64 -59
- package/dist/core/response.d.ts.map +1 -1
- package/dist/core/response.js +70 -52
- package/dist/core/response.js.map +1 -1
- package/dist/core/session.d.ts +81 -70
- package/dist/core/session.d.ts.map +1 -1
- package/dist/core/session.js +198 -71
- package/dist/core/session.js.map +1 -1
- package/dist/core/validation.d.ts +44 -42
- package/dist/core/validation.d.ts.map +1 -1
- package/dist/core/validation.js +47 -58
- package/dist/core/validation.js.map +1 -1
- package/dist/dns/cache.d.ts +59 -0
- package/dist/dns/cache.d.ts.map +1 -0
- package/dist/dns/cache.js +99 -0
- package/dist/dns/cache.js.map +1 -0
- package/dist/dns/codec.d.ts +39 -0
- package/dist/dns/codec.d.ts.map +1 -0
- package/dist/dns/codec.js +238 -0
- package/dist/dns/codec.js.map +1 -0
- package/dist/dns/doh-resolver.d.ts +38 -0
- package/dist/dns/doh-resolver.d.ts.map +1 -0
- package/dist/dns/doh-resolver.js +191 -0
- package/dist/dns/doh-resolver.js.map +1 -0
- package/dist/dns/dot-resolver.d.ts +89 -0
- package/dist/dns/dot-resolver.d.ts.map +1 -0
- package/dist/dns/dot-resolver.js +158 -0
- package/dist/dns/dot-resolver.js.map +1 -0
- package/dist/dns/https-rr.d.ts +40 -0
- package/dist/dns/https-rr.d.ts.map +1 -0
- package/dist/dns/https-rr.js +109 -0
- package/dist/dns/https-rr.js.map +1 -0
- package/dist/dns/types.d.ts +82 -0
- package/dist/dns/types.d.ts.map +1 -0
- package/dist/dns/types.js +23 -0
- package/dist/dns/types.js.map +1 -0
- package/dist/fingerprints/akamai.d.ts +3 -11
- package/dist/fingerprints/akamai.d.ts.map +1 -1
- package/dist/fingerprints/akamai.js +3 -11
- package/dist/fingerprints/akamai.js.map +1 -1
- package/dist/fingerprints/database.d.ts +6 -14
- package/dist/fingerprints/database.d.ts.map +1 -1
- package/dist/fingerprints/database.js +6 -14
- package/dist/fingerprints/database.js.map +1 -1
- package/dist/fingerprints/extensions.d.ts +56 -71
- package/dist/fingerprints/extensions.d.ts.map +1 -1
- package/dist/fingerprints/extensions.js +58 -71
- package/dist/fingerprints/extensions.js.map +1 -1
- package/dist/fingerprints/ja3.d.ts +12 -30
- package/dist/fingerprints/ja3.d.ts.map +1 -1
- package/dist/fingerprints/ja3.js +12 -30
- package/dist/fingerprints/ja3.js.map +1 -1
- package/dist/fingerprints/ja4.d.ts +18 -0
- package/dist/fingerprints/ja4.d.ts.map +1 -0
- package/dist/fingerprints/ja4.js +83 -0
- package/dist/fingerprints/ja4.js.map +1 -0
- package/dist/fingerprints/profiles/chrome.d.ts +18 -21
- package/dist/fingerprints/profiles/chrome.d.ts.map +1 -1
- package/dist/fingerprints/profiles/chrome.js +35 -31
- package/dist/fingerprints/profiles/chrome.js.map +1 -1
- package/dist/fingerprints/profiles/edge.d.ts +7 -10
- package/dist/fingerprints/profiles/edge.d.ts.map +1 -1
- package/dist/fingerprints/profiles/edge.js +7 -10
- package/dist/fingerprints/profiles/edge.js.map +1 -1
- package/dist/fingerprints/profiles/firefox.d.ts +8 -11
- package/dist/fingerprints/profiles/firefox.d.ts.map +1 -1
- package/dist/fingerprints/profiles/firefox.js +8 -11
- package/dist/fingerprints/profiles/firefox.js.map +1 -1
- package/dist/fingerprints/profiles/safari.d.ts +11 -14
- package/dist/fingerprints/profiles/safari.d.ts.map +1 -1
- package/dist/fingerprints/profiles/safari.js +11 -14
- package/dist/fingerprints/profiles/safari.js.map +1 -1
- package/dist/fingerprints/profiles/tor.d.ts +5 -8
- package/dist/fingerprints/profiles/tor.d.ts.map +1 -1
- package/dist/fingerprints/profiles/tor.js +5 -8
- package/dist/fingerprints/profiles/tor.js.map +1 -1
- package/dist/fingerprints/types.d.ts +42 -73
- package/dist/fingerprints/types.d.ts.map +1 -1
- package/dist/hsts/store.d.ts +39 -0
- package/dist/hsts/store.d.ts.map +1 -0
- package/dist/hsts/store.js +163 -0
- package/dist/hsts/store.js.map +1 -0
- package/dist/hsts/types.d.ts +24 -0
- package/dist/hsts/types.d.ts.map +1 -0
- package/dist/hsts/types.js +2 -0
- package/dist/hsts/types.js.map +1 -0
- package/dist/http/alt-svc.d.ts +67 -0
- package/dist/http/alt-svc.d.ts.map +1 -0
- package/dist/http/alt-svc.js +186 -0
- package/dist/http/alt-svc.js.map +1 -0
- package/dist/http/early-hints.d.ts +23 -0
- package/dist/http/early-hints.d.ts.map +1 -0
- package/dist/http/early-hints.js +33 -0
- package/dist/http/early-hints.js.map +1 -0
- package/dist/http/form-data.d.ts +17 -35
- package/dist/http/form-data.d.ts.map +1 -1
- package/dist/http/form-data.js +12 -34
- package/dist/http/form-data.js.map +1 -1
- package/dist/http/h1/client.d.ts +14 -26
- package/dist/http/h1/client.d.ts.map +1 -1
- package/dist/http/h1/client.js +29 -22
- package/dist/http/h1/client.js.map +1 -1
- package/dist/http/h1/encoder.d.ts +10 -17
- package/dist/http/h1/encoder.d.ts.map +1 -1
- package/dist/http/h1/encoder.js +10 -17
- package/dist/http/h1/encoder.js.map +1 -1
- package/dist/http/h1/parser.d.ts +22 -59
- package/dist/http/h1/parser.d.ts.map +1 -1
- package/dist/http/h1/parser.js +15 -47
- package/dist/http/h1/parser.js.map +1 -1
- package/dist/http/h2/client.d.ts +18 -59
- package/dist/http/h2/client.d.ts.map +1 -1
- package/dist/http/h2/client.js +29 -64
- package/dist/http/h2/client.js.map +1 -1
- package/dist/http/h2/frames.d.ts +53 -84
- package/dist/http/h2/frames.d.ts.map +1 -1
- package/dist/http/h2/frames.js +48 -76
- package/dist/http/h2/frames.js.map +1 -1
- package/dist/http/h2/hpack.d.ts +16 -35
- package/dist/http/h2/hpack.d.ts.map +1 -1
- package/dist/http/h2/hpack.js +16 -35
- package/dist/http/h2/hpack.js.map +1 -1
- package/dist/http/h3/detection.d.ts +15 -0
- package/dist/http/h3/detection.d.ts.map +1 -0
- package/dist/http/h3/detection.js +41 -0
- package/dist/http/h3/detection.js.map +1 -0
- package/dist/http/negotiator.d.ts +43 -33
- package/dist/http/negotiator.d.ts.map +1 -1
- package/dist/http/negotiator.js +99 -41
- package/dist/http/negotiator.js.map +1 -1
- package/dist/http/pool.d.ts +34 -64
- package/dist/http/pool.d.ts.map +1 -1
- package/dist/http/pool.js +22 -41
- package/dist/http/pool.js.map +1 -1
- package/dist/http/resumable-upload.d.ts +76 -0
- package/dist/http/resumable-upload.d.ts.map +1 -0
- package/dist/http/resumable-upload.js +104 -0
- package/dist/http/resumable-upload.js.map +1 -0
- package/dist/http/trailers.d.ts +29 -0
- package/dist/http/trailers.d.ts.map +1 -0
- package/dist/http/trailers.js +57 -0
- package/dist/http/trailers.js.map +1 -0
- package/dist/index.d.ts +36 -8
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +32 -1
- package/dist/index.js.map +1 -1
- package/dist/middleware/interceptor.d.ts +13 -32
- package/dist/middleware/interceptor.d.ts.map +1 -1
- package/dist/middleware/interceptor.js +11 -16
- package/dist/middleware/interceptor.js.map +1 -1
- package/dist/middleware/rate-limiter.d.ts +8 -17
- package/dist/middleware/rate-limiter.d.ts.map +1 -1
- package/dist/middleware/rate-limiter.js +15 -12
- package/dist/middleware/rate-limiter.js.map +1 -1
- package/dist/middleware/retry-after.d.ts +15 -0
- package/dist/middleware/retry-after.d.ts.map +1 -0
- package/dist/middleware/retry-after.js +36 -0
- package/dist/middleware/retry-after.js.map +1 -0
- package/dist/middleware/retry.d.ts +9 -18
- package/dist/middleware/retry.d.ts.map +1 -1
- package/dist/middleware/retry.js +12 -9
- package/dist/middleware/retry.js.map +1 -1
- package/dist/proxy/auth.d.ts +73 -0
- package/dist/proxy/auth.d.ts.map +1 -0
- package/dist/proxy/auth.js +128 -0
- package/dist/proxy/auth.js.map +1 -0
- package/dist/proxy/env-proxy.d.ts +11 -0
- package/dist/proxy/env-proxy.d.ts.map +1 -0
- package/dist/proxy/env-proxy.js +56 -0
- package/dist/proxy/env-proxy.js.map +1 -0
- package/dist/proxy/http-proxy.d.ts +13 -18
- package/dist/proxy/http-proxy.d.ts.map +1 -1
- package/dist/proxy/http-proxy.js +24 -14
- package/dist/proxy/http-proxy.js.map +1 -1
- package/dist/proxy/socks.d.ts +13 -20
- package/dist/proxy/socks.d.ts.map +1 -1
- package/dist/proxy/socks.js +6 -9
- package/dist/proxy/socks.js.map +1 -1
- package/dist/sse/parser.d.ts +47 -0
- package/dist/sse/parser.d.ts.map +1 -0
- package/dist/sse/parser.js +139 -0
- package/dist/sse/parser.js.map +1 -0
- package/dist/tls/constants.d.ts +15 -74
- package/dist/tls/constants.d.ts.map +1 -1
- package/dist/tls/constants.js +15 -74
- package/dist/tls/constants.js.map +1 -1
- package/dist/tls/ct.d.ts +78 -0
- package/dist/tls/ct.d.ts.map +1 -0
- package/dist/tls/ct.js +175 -0
- package/dist/tls/ct.js.map +1 -0
- package/dist/tls/early-data.d.ts +45 -0
- package/dist/tls/early-data.d.ts.map +1 -0
- package/dist/tls/early-data.js +46 -0
- package/dist/tls/early-data.js.map +1 -0
- package/dist/tls/ech.d.ts +130 -0
- package/dist/tls/ech.d.ts.map +1 -0
- package/dist/tls/ech.js +353 -0
- package/dist/tls/ech.js.map +1 -0
- package/dist/tls/keylog.d.ts +34 -0
- package/dist/tls/keylog.d.ts.map +1 -0
- package/dist/tls/keylog.js +64 -0
- package/dist/tls/keylog.js.map +1 -0
- package/dist/tls/node-engine.d.ts +15 -14
- package/dist/tls/node-engine.d.ts.map +1 -1
- package/dist/tls/node-engine.js +54 -14
- package/dist/tls/node-engine.js.map +1 -1
- package/dist/tls/ocsp.d.ts +55 -0
- package/dist/tls/ocsp.d.ts.map +1 -0
- package/dist/tls/ocsp.js +131 -0
- package/dist/tls/ocsp.js.map +1 -0
- package/dist/tls/pin-verification.d.ts +10 -0
- package/dist/tls/pin-verification.d.ts.map +1 -0
- package/dist/tls/pin-verification.js +28 -0
- package/dist/tls/pin-verification.js.map +1 -0
- package/dist/tls/session-cache.d.ts +58 -0
- package/dist/tls/session-cache.d.ts.map +1 -0
- package/dist/tls/session-cache.js +76 -0
- package/dist/tls/session-cache.js.map +1 -0
- package/dist/tls/stealth/client-hello.d.ts +34 -32
- package/dist/tls/stealth/client-hello.d.ts.map +1 -1
- package/dist/tls/stealth/client-hello.js +116 -11
- package/dist/tls/stealth/client-hello.js.map +1 -1
- package/dist/tls/stealth/engine.d.ts +5 -15
- package/dist/tls/stealth/engine.d.ts.map +1 -1
- package/dist/tls/stealth/engine.js +163 -47
- package/dist/tls/stealth/engine.js.map +1 -1
- package/dist/tls/stealth/handshake.d.ts +23 -32
- package/dist/tls/stealth/handshake.d.ts.map +1 -1
- package/dist/tls/stealth/handshake.js +112 -27
- package/dist/tls/stealth/handshake.js.map +1 -1
- package/dist/tls/stealth/key-schedule.d.ts +59 -86
- package/dist/tls/stealth/key-schedule.d.ts.map +1 -1
- package/dist/tls/stealth/key-schedule.js +46 -58
- package/dist/tls/stealth/key-schedule.js.map +1 -1
- package/dist/tls/stealth/record-layer.d.ts +52 -75
- package/dist/tls/stealth/record-layer.d.ts.map +1 -1
- package/dist/tls/stealth/record-layer.js +47 -63
- package/dist/tls/stealth/record-layer.js.map +1 -1
- package/dist/tls/stealth/tls12-handshake.d.ts +30 -0
- package/dist/tls/stealth/tls12-handshake.d.ts.map +1 -0
- package/dist/tls/stealth/tls12-handshake.js +470 -0
- package/dist/tls/stealth/tls12-handshake.js.map +1 -0
- package/dist/tls/types.d.ts +46 -48
- package/dist/tls/types.d.ts.map +1 -1
- package/dist/utils/buffer-reader.d.ts +26 -81
- package/dist/utils/buffer-reader.d.ts.map +1 -1
- package/dist/utils/buffer-reader.js +26 -81
- package/dist/utils/buffer-reader.js.map +1 -1
- package/dist/utils/buffer-writer.d.ts +30 -66
- package/dist/utils/buffer-writer.d.ts.map +1 -1
- package/dist/utils/buffer-writer.js +30 -66
- package/dist/utils/buffer-writer.js.map +1 -1
- package/dist/utils/compression.d.ts +18 -0
- package/dist/utils/compression.d.ts.map +1 -0
- package/dist/utils/compression.js +34 -0
- package/dist/utils/compression.js.map +1 -0
- package/dist/utils/dictionary-transport.d.ts +97 -0
- package/dist/utils/dictionary-transport.d.ts.map +1 -0
- package/dist/utils/dictionary-transport.js +171 -0
- package/dist/utils/dictionary-transport.js.map +1 -0
- package/dist/utils/encoding.d.ts +12 -28
- package/dist/utils/encoding.d.ts.map +1 -1
- package/dist/utils/encoding.js +77 -40
- package/dist/utils/encoding.js.map +1 -1
- package/dist/utils/happy-eyeballs.d.ts +20 -7
- package/dist/utils/happy-eyeballs.d.ts.map +1 -1
- package/dist/utils/happy-eyeballs.js +57 -25
- package/dist/utils/happy-eyeballs.js.map +1 -1
- package/dist/utils/logger.d.ts +54 -81
- package/dist/utils/logger.d.ts.map +1 -1
- package/dist/utils/logger.js +92 -64
- package/dist/utils/logger.js.map +1 -1
- package/dist/utils/tcp-fast-open.d.ts +30 -0
- package/dist/utils/tcp-fast-open.d.ts.map +1 -0
- package/dist/utils/tcp-fast-open.js +36 -0
- package/dist/utils/tcp-fast-open.js.map +1 -0
- package/dist/utils/url.d.ts +18 -25
- package/dist/utils/url.d.ts.map +1 -1
- package/dist/utils/url.js +18 -25
- package/dist/utils/url.js.map +1 -1
- package/dist/ws/client.d.ts +35 -52
- package/dist/ws/client.d.ts.map +1 -1
- package/dist/ws/client.js +92 -37
- package/dist/ws/client.js.map +1 -1
- package/dist/ws/frame.d.ts +27 -42
- package/dist/ws/frame.d.ts.map +1 -1
- package/dist/ws/frame.js +25 -37
- package/dist/ws/frame.js.map +1 -1
- package/dist/ws/permessage-deflate.d.ts +53 -0
- package/dist/ws/permessage-deflate.d.ts.map +1 -0
- package/dist/ws/permessage-deflate.js +140 -0
- package/dist/ws/permessage-deflate.js.map +1 -0
- package/package.json +62 -62
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"node-engine.js","sourceRoot":"","sources":["../../src/tls/node-engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"node-engine.js","sourceRoot":"","sources":["../../src/tls/node-engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAIhC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,WAAW,GAAgC,IAAI,GAAG,CAAC;IACvD,CAAC,WAAW,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAC9D,CAAC,WAAW,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAC9D,CAAC,WAAW,CAAC,4BAA4B,EAAE,8BAA8B,CAAC;IAC1E,CAAC,WAAW,CAAC,uCAAuC,EAAE,+BAA+B,CAAC;IACtF,CAAC,WAAW,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;IAClF,CAAC,WAAW,CAAC,uCAAuC,EAAE,+BAA+B,CAAC;IACtF,CAAC,WAAW,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;IAClF,CAAC,WAAW,CAAC,6CAA6C,EAAE,+BAA+B,CAAC;IAC5F,CAAC,WAAW,CAAC,2CAA2C,EAAE,6BAA6B,CAAC;IACxF,CAAC,WAAW,CAAC,kCAAkC,EAAE,sBAAsB,CAAC;IACxE,CAAC,WAAW,CAAC,kCAAkC,EAAE,sBAAsB,CAAC;IACxE,CAAC,WAAW,CAAC,+BAA+B,EAAE,mBAAmB,CAAC;IAClE,CAAC,WAAW,CAAC,+BAA+B,EAAE,mBAAmB,CAAC;IAClE,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,oCAAoC,EAAE,wBAAwB,CAAC;IAC5E,CAAC,WAAW,CAAC,oCAAoC,EAAE,wBAAwB,CAAC;IAC5E,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,UAAU,GAAgC,IAAI,GAAG,CAAC;IACtD,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;IACzB,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;IACnC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAgC,IAAI,GAAG,CAAC;IACvD,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAC1D,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAC1D,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;CAC3D,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,MAAgB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAgB;IACtC,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,MAAM,OAAO,aAAa;IACP,YAAY,CAAkB;IAE/C;;;;OAIG;IACH,YAAY,YAA8B;QACxC,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,eAAe,EAAE,CAAC;IAC5D,CAAC;IAED,2DAA2D;IAC3D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,OAA0B,EAAE,OAAwB;QAChE,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,OAAO,GAA0B;gBACrC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI;gBAC9C,kBAAkB,EAAE,CAAC,OAAO,CAAC,QAAQ;gBACrC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;aACtB,CAAC;YAEF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAmC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YAClE,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,CAAC;YAED,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YAC1B,CAAC;YAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBACzB,OAAmC,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;YACvF,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9E,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;gBACzB,OAAmC,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;gBACpE,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAChE,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAChE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YACpD,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAClC,CAAC;YAED,IAAI,aAAa,EAAE,EAAE,CAAC;gBACnB,OAAmC,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;YAC9D,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YAClC,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;YAE5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEpC,IAAI,aAAa,EAAE,EAAE,CAAC;gBACpB,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;oBACnC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,KAAgD,CAAC;YAErD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,IAAI,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,GAAG,IAAI,CAAC;wBACf,IAAI,KAAK;4BAAE,YAAY,CAAC,KAAK,CAAC,CAAC;wBAC/B,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,IAAI,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;oBACjD,CAAC;gBACH,CAAC,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;gBAChC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAE/B,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;wBACjD,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;4BAC7B,qBAAqB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC/D,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBAC/D,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBAEnC,MAAM,cAAc,GAAsB;oBACxC,OAAO,EAAE,KAAK,IAAI,SAAS;oBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;oBACzC,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;oBACjC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE;iBAClC,CAAC;gBAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAe,EAAE,EAAE;oBACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,CAAC;gBACtF,CAAC,CAAC,CAAC;gBAEH,MAAM,SAAS,GAAc,MAAM,CAAC,MAAM,CAAC,MAA2B,EAAE;oBACtE,cAAc;oBACd,UAAU;wBACR,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,CAAC;iBACF,CAAc,CAAC;gBAEhB,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAClC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM,CAAC,GAAG,GAAkD,CAAC;gBAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC;gBACvG,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
/** OCSP response status codes (RFC 6960). */
|
|
2
|
+
export declare enum OCSPResponseStatus {
|
|
3
|
+
SUCCESSFUL = 0,
|
|
4
|
+
MALFORMED_REQUEST = 1,
|
|
5
|
+
INTERNAL_ERROR = 2,
|
|
6
|
+
TRY_LATER = 3,
|
|
7
|
+
SIG_REQUIRED = 5,
|
|
8
|
+
UNAUTHORIZED = 6
|
|
9
|
+
}
|
|
10
|
+
/** Certificate revocation status from an OCSP response. */
|
|
11
|
+
export declare enum OCSPCertStatus {
|
|
12
|
+
GOOD = 0,
|
|
13
|
+
REVOKED = 1,
|
|
14
|
+
UNKNOWN = 2
|
|
15
|
+
}
|
|
16
|
+
/** Parsed result of an OCSP response. */
|
|
17
|
+
export interface OCSPResult {
|
|
18
|
+
/** Overall OCSP response status. */
|
|
19
|
+
status: OCSPResponseStatus;
|
|
20
|
+
/** Revocation status of the queried certificate. */
|
|
21
|
+
certStatus?: OCSPCertStatus;
|
|
22
|
+
/** Start of the validity window for this response. */
|
|
23
|
+
thisUpdate?: Date;
|
|
24
|
+
/** End of the validity window for this response. */
|
|
25
|
+
nextUpdate?: Date;
|
|
26
|
+
/** Time when the OCSP responder produced this response. */
|
|
27
|
+
producedAt?: Date;
|
|
28
|
+
}
|
|
29
|
+
/**
|
|
30
|
+
* Parse a DER-encoded OCSP response.
|
|
31
|
+
*
|
|
32
|
+
* @param {Buffer} derResponse - Raw DER bytes.
|
|
33
|
+
* @returns {OCSPResult} Parsed OCSP result.
|
|
34
|
+
*/
|
|
35
|
+
export declare function parseOCSPResponse(derResponse: Buffer): OCSPResult;
|
|
36
|
+
/**
|
|
37
|
+
* Check whether an OCSP result indicates the certificate is valid.
|
|
38
|
+
*
|
|
39
|
+
* @param {OCSPResult} result - Parsed OCSP result.
|
|
40
|
+
* @returns {boolean} `false` only if the certificate is explicitly revoked.
|
|
41
|
+
*/
|
|
42
|
+
export declare function isOCSPValid(result: OCSPResult): boolean;
|
|
43
|
+
/**
|
|
44
|
+
* Validate OCSP stapling on a TLS socket.
|
|
45
|
+
*
|
|
46
|
+
* @param {{ once(event: string, handler: (...args: any[]) => void): void }} socket - Socket emitter that fires an `"OCSPResponse"` event.
|
|
47
|
+
* @param {{ timeout?: number }} [options] - Optional timeout configuration.
|
|
48
|
+
* @returns {Promise<OCSPResult|undefined>} Parsed OCSP result, or `undefined` if no stapled response.
|
|
49
|
+
*/
|
|
50
|
+
export declare function validateOCSPStapling(socket: {
|
|
51
|
+
once(event: string, handler: (...args: any[]) => void): void;
|
|
52
|
+
}, options?: {
|
|
53
|
+
timeout?: number;
|
|
54
|
+
}): Promise<OCSPResult | undefined>;
|
|
55
|
+
//# sourceMappingURL=ocsp.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ocsp.d.ts","sourceRoot":"","sources":["../../src/tls/ocsp.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,oBAAY,kBAAkB;IAC5B,UAAU,IAAI;IACd,iBAAiB,IAAI;IACrB,cAAc,IAAI;IAClB,SAAS,IAAI;IACb,YAAY,IAAI;IAChB,YAAY,IAAI;CACjB;AAED,2DAA2D;AAC3D,oBAAY,cAAc;IACxB,IAAI,IAAI;IACR,OAAO,IAAI;IACX,OAAO,IAAI;CACZ;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,oCAAoC;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oDAAoD;IACpD,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,sDAAsD;IACtD,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,oDAAoD;IACpD,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAuCjE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAQvD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI,CAAA;CAAE,EAAE,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAoB9K"}
|
package/dist/tls/ocsp.js
ADDED
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
/** OCSP response status codes (RFC 6960). */
|
|
2
|
+
export var OCSPResponseStatus;
|
|
3
|
+
(function (OCSPResponseStatus) {
|
|
4
|
+
OCSPResponseStatus[OCSPResponseStatus["SUCCESSFUL"] = 0] = "SUCCESSFUL";
|
|
5
|
+
OCSPResponseStatus[OCSPResponseStatus["MALFORMED_REQUEST"] = 1] = "MALFORMED_REQUEST";
|
|
6
|
+
OCSPResponseStatus[OCSPResponseStatus["INTERNAL_ERROR"] = 2] = "INTERNAL_ERROR";
|
|
7
|
+
OCSPResponseStatus[OCSPResponseStatus["TRY_LATER"] = 3] = "TRY_LATER";
|
|
8
|
+
OCSPResponseStatus[OCSPResponseStatus["SIG_REQUIRED"] = 5] = "SIG_REQUIRED";
|
|
9
|
+
OCSPResponseStatus[OCSPResponseStatus["UNAUTHORIZED"] = 6] = "UNAUTHORIZED";
|
|
10
|
+
})(OCSPResponseStatus || (OCSPResponseStatus = {}));
|
|
11
|
+
/** Certificate revocation status from an OCSP response. */
|
|
12
|
+
export var OCSPCertStatus;
|
|
13
|
+
(function (OCSPCertStatus) {
|
|
14
|
+
OCSPCertStatus[OCSPCertStatus["GOOD"] = 0] = "GOOD";
|
|
15
|
+
OCSPCertStatus[OCSPCertStatus["REVOKED"] = 1] = "REVOKED";
|
|
16
|
+
OCSPCertStatus[OCSPCertStatus["UNKNOWN"] = 2] = "UNKNOWN";
|
|
17
|
+
})(OCSPCertStatus || (OCSPCertStatus = {}));
|
|
18
|
+
/**
|
|
19
|
+
* Parse a DER-encoded OCSP response.
|
|
20
|
+
*
|
|
21
|
+
* @param {Buffer} derResponse - Raw DER bytes.
|
|
22
|
+
* @returns {OCSPResult} Parsed OCSP result.
|
|
23
|
+
*/
|
|
24
|
+
export function parseOCSPResponse(derResponse) {
|
|
25
|
+
if (!derResponse || derResponse.length < 3) {
|
|
26
|
+
return { status: OCSPResponseStatus.MALFORMED_REQUEST };
|
|
27
|
+
}
|
|
28
|
+
let offset = 0;
|
|
29
|
+
if (derResponse[offset] !== 0x30) {
|
|
30
|
+
return { status: OCSPResponseStatus.MALFORMED_REQUEST };
|
|
31
|
+
}
|
|
32
|
+
offset++;
|
|
33
|
+
const { value: outerLen, bytesRead: outerLenBytes } = readASN1Length(derResponse, offset);
|
|
34
|
+
if (outerLen === -1)
|
|
35
|
+
return { status: OCSPResponseStatus.MALFORMED_REQUEST };
|
|
36
|
+
offset += outerLenBytes;
|
|
37
|
+
if (derResponse[offset] !== 0x0a) {
|
|
38
|
+
return { status: OCSPResponseStatus.MALFORMED_REQUEST };
|
|
39
|
+
}
|
|
40
|
+
offset++;
|
|
41
|
+
const statusLen = derResponse[offset];
|
|
42
|
+
offset++;
|
|
43
|
+
if (statusLen !== 1 || offset >= derResponse.length) {
|
|
44
|
+
return { status: OCSPResponseStatus.MALFORMED_REQUEST };
|
|
45
|
+
}
|
|
46
|
+
const responseStatus = derResponse[offset];
|
|
47
|
+
offset++;
|
|
48
|
+
if (responseStatus !== OCSPResponseStatus.SUCCESSFUL) {
|
|
49
|
+
return { status: responseStatus };
|
|
50
|
+
}
|
|
51
|
+
const result = { status: responseStatus };
|
|
52
|
+
const certStatusResult = findCertStatus(derResponse, offset);
|
|
53
|
+
if (certStatusResult !== undefined) {
|
|
54
|
+
result.certStatus = certStatusResult;
|
|
55
|
+
}
|
|
56
|
+
return result;
|
|
57
|
+
}
|
|
58
|
+
/**
|
|
59
|
+
* Check whether an OCSP result indicates the certificate is valid.
|
|
60
|
+
*
|
|
61
|
+
* @param {OCSPResult} result - Parsed OCSP result.
|
|
62
|
+
* @returns {boolean} `false` only if the certificate is explicitly revoked.
|
|
63
|
+
*/
|
|
64
|
+
export function isOCSPValid(result) {
|
|
65
|
+
if (result.status !== OCSPResponseStatus.SUCCESSFUL) {
|
|
66
|
+
return true;
|
|
67
|
+
}
|
|
68
|
+
if (result.certStatus === OCSPCertStatus.REVOKED) {
|
|
69
|
+
return false;
|
|
70
|
+
}
|
|
71
|
+
return true;
|
|
72
|
+
}
|
|
73
|
+
/**
|
|
74
|
+
* Validate OCSP stapling on a TLS socket.
|
|
75
|
+
*
|
|
76
|
+
* @param {{ once(event: string, handler: (...args: any[]) => void): void }} socket - Socket emitter that fires an `"OCSPResponse"` event.
|
|
77
|
+
* @param {{ timeout?: number }} [options] - Optional timeout configuration.
|
|
78
|
+
* @returns {Promise<OCSPResult|undefined>} Parsed OCSP result, or `undefined` if no stapled response.
|
|
79
|
+
*/
|
|
80
|
+
export function validateOCSPStapling(socket, options) {
|
|
81
|
+
return new Promise((resolve) => {
|
|
82
|
+
const timeout = options?.timeout ?? 5000;
|
|
83
|
+
let timer;
|
|
84
|
+
const onResponse = (response) => {
|
|
85
|
+
if (timer)
|
|
86
|
+
clearTimeout(timer);
|
|
87
|
+
if (!response || response.length === 0) {
|
|
88
|
+
resolve(undefined);
|
|
89
|
+
return;
|
|
90
|
+
}
|
|
91
|
+
resolve(parseOCSPResponse(response));
|
|
92
|
+
};
|
|
93
|
+
socket.once("OCSPResponse", onResponse);
|
|
94
|
+
timer = setTimeout(() => {
|
|
95
|
+
resolve(undefined);
|
|
96
|
+
}, timeout);
|
|
97
|
+
});
|
|
98
|
+
}
|
|
99
|
+
function readASN1Length(buf, offset) {
|
|
100
|
+
if (offset >= buf.length)
|
|
101
|
+
return { value: -1, bytesRead: 0 };
|
|
102
|
+
const first = buf[offset];
|
|
103
|
+
if (first < 0x80) {
|
|
104
|
+
return { value: first, bytesRead: 1 };
|
|
105
|
+
}
|
|
106
|
+
const numBytes = first & 0x7f;
|
|
107
|
+
if (numBytes === 0 || numBytes > 4 || offset + numBytes >= buf.length) {
|
|
108
|
+
return { value: -1, bytesRead: 0 };
|
|
109
|
+
}
|
|
110
|
+
let value = 0;
|
|
111
|
+
for (let i = 0; i < numBytes; i++) {
|
|
112
|
+
value = (value << 8) | buf[offset + 1 + i];
|
|
113
|
+
}
|
|
114
|
+
return { value, bytesRead: 1 + numBytes };
|
|
115
|
+
}
|
|
116
|
+
function findCertStatus(buf, startOffset) {
|
|
117
|
+
for (let i = startOffset; i < buf.length - 2; i++) {
|
|
118
|
+
const tag = buf[i];
|
|
119
|
+
if (tag === 0x80 && buf[i + 1] === 0x00) {
|
|
120
|
+
return OCSPCertStatus.GOOD;
|
|
121
|
+
}
|
|
122
|
+
if (tag === 0xa1) {
|
|
123
|
+
return OCSPCertStatus.REVOKED;
|
|
124
|
+
}
|
|
125
|
+
if (tag === 0x82 && buf[i + 1] === 0x00) {
|
|
126
|
+
return OCSPCertStatus.UNKNOWN;
|
|
127
|
+
}
|
|
128
|
+
}
|
|
129
|
+
return undefined;
|
|
130
|
+
}
|
|
131
|
+
//# sourceMappingURL=ocsp.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ocsp.js","sourceRoot":"","sources":["../../src/tls/ocsp.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,uEAAc,CAAA;IACd,qFAAqB,CAAA;IACrB,+EAAkB,CAAA;IAClB,qEAAa,CAAA;IACb,2EAAgB,CAAA;IAChB,2EAAgB,CAAA;AAClB,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED,2DAA2D;AAC3D,MAAM,CAAN,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,mDAAQ,CAAA;IACR,yDAAW,CAAA;IACX,yDAAW,CAAA;AACb,CAAC,EAJW,cAAc,KAAd,cAAc,QAIzB;AAgBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1F,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;IAC7E,MAAM,IAAI,aAAa,CAAC;IAExB,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,CAAC;IACT,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAE,CAAC;IACvC,MAAM,EAAE,CAAC;IACT,IAAI,SAAS,KAAK,CAAC,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAwB,CAAC;IAClE,MAAM,EAAE,CAAC;IAET,IAAI,cAAc,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;QACrD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAAe,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAEtD,MAAM,gBAAgB,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,UAAU,GAAG,gBAAgB,CAAC;IACvC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc,CAAC,OAAO,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAwE,EAAE,OAA8B;IAC3I,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;QACzC,IAAI,KAAgD,CAAC;QAErD,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE;YACtC,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAExC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,MAAc;IACjD,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC;IAC9B,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,MAAM,GAAG,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACtE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,WAAmB;IACtD,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,cAAc,CAAC,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC,OAAO,CAAC;QAChC,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,cAAc,CAAC,OAAO,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Verify that a certificate's SPKI hash matches at least one expected pin.
|
|
3
|
+
*
|
|
4
|
+
* Throws a {@link TLSError} if no pin matches.
|
|
5
|
+
*
|
|
6
|
+
* @param {Buffer} certDer - DER-encoded X.509 certificate.
|
|
7
|
+
* @param {string|string[]} pins - One or more `sha256//` base64-encoded SPKI pins.
|
|
8
|
+
*/
|
|
9
|
+
export declare function verifyPinnedPublicKey(certDer: Buffer, pins: string | string[]): void;
|
|
10
|
+
//# sourceMappingURL=pin-verification.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"pin-verification.d.ts","sourceRoot":"","sources":["../../src/tls/pin-verification.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAiBpF"}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import { createHash, X509Certificate } from "node:crypto";
|
|
2
|
+
import { TLSError } from "../core/errors.js";
|
|
3
|
+
/**
|
|
4
|
+
* Verify that a certificate's SPKI hash matches at least one expected pin.
|
|
5
|
+
*
|
|
6
|
+
* Throws a {@link TLSError} if no pin matches.
|
|
7
|
+
*
|
|
8
|
+
* @param {Buffer} certDer - DER-encoded X.509 certificate.
|
|
9
|
+
* @param {string|string[]} pins - One or more `sha256//` base64-encoded SPKI pins.
|
|
10
|
+
*/
|
|
11
|
+
export function verifyPinnedPublicKey(certDer, pins) {
|
|
12
|
+
const pinArray = typeof pins === "string" ? [pins] : pins;
|
|
13
|
+
if (pinArray.length === 0)
|
|
14
|
+
return;
|
|
15
|
+
const x509 = new X509Certificate(certDer);
|
|
16
|
+
const spki = Buffer.from(x509.publicKey.export({ type: "spki", format: "der" }));
|
|
17
|
+
const hash = createHash("sha256").update(spki).digest("base64");
|
|
18
|
+
const certPin = `sha256//${hash}`;
|
|
19
|
+
const matches = pinArray.some((pin) => {
|
|
20
|
+
if (!pin.startsWith("sha256//"))
|
|
21
|
+
return false;
|
|
22
|
+
return pin === certPin;
|
|
23
|
+
});
|
|
24
|
+
if (!matches) {
|
|
25
|
+
throw new TLSError(`Certificate public key pin mismatch. Server pin: ${certPin}`);
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
//# sourceMappingURL=pin-verification.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"pin-verification.js","sourceRoot":"","sources":["../../src/tls/pin-verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,IAAuB;IAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,IAAI,EAAE,CAAC;IAElC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACpC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,GAAG,KAAK,OAAO,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oDAAoD,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
/** Cached TLS session ticket with expiry and ALPN metadata. */
|
|
2
|
+
export interface SessionTicketEntry {
|
|
3
|
+
/** Serialized session ticket bytes. */
|
|
4
|
+
ticket: Buffer;
|
|
5
|
+
/** Timestamp (ms since epoch) when this entry expires. */
|
|
6
|
+
expiresAt: number;
|
|
7
|
+
/** ALPN protocol negotiated during the original handshake. */
|
|
8
|
+
alpn?: string;
|
|
9
|
+
}
|
|
10
|
+
/** Configuration for the TLS session ticket cache. */
|
|
11
|
+
export interface SessionCacheOptions {
|
|
12
|
+
/** Maximum number of cached entries. */
|
|
13
|
+
maxEntries?: number;
|
|
14
|
+
/** Default ticket lifetime in milliseconds. */
|
|
15
|
+
defaultLifetimeMs?: number;
|
|
16
|
+
}
|
|
17
|
+
/** LRU cache for TLS session tickets enabling session resumption. */
|
|
18
|
+
export declare class TLSSessionCache {
|
|
19
|
+
private readonly maxEntries;
|
|
20
|
+
private readonly defaultLifetimeMs;
|
|
21
|
+
private readonly entries;
|
|
22
|
+
/**
|
|
23
|
+
* Create a new session cache.
|
|
24
|
+
*
|
|
25
|
+
* @param {SessionCacheOptions} [options] - Cache size and lifetime configuration.
|
|
26
|
+
*/
|
|
27
|
+
constructor(options?: SessionCacheOptions);
|
|
28
|
+
/**
|
|
29
|
+
* Store a session ticket for the given origin.
|
|
30
|
+
*
|
|
31
|
+
* @param {string} origin - Origin key (e.g. `"example.com:443"`).
|
|
32
|
+
* @param {Buffer} ticket - Serialized session ticket.
|
|
33
|
+
* @param {number} [lifetimeMs] - Optional custom lifetime in milliseconds.
|
|
34
|
+
* @param {string} [alpn] - Negotiated ALPN protocol.
|
|
35
|
+
*/
|
|
36
|
+
set(origin: string, ticket: Buffer, lifetimeMs?: number, alpn?: string): void;
|
|
37
|
+
/**
|
|
38
|
+
* Retrieve a cached session ticket.
|
|
39
|
+
*
|
|
40
|
+
* Expired entries are evicted automatically.
|
|
41
|
+
*
|
|
42
|
+
* @param {string} origin - Origin key.
|
|
43
|
+
* @returns {SessionTicketEntry|undefined} Cached entry, or `undefined` if not found or expired.
|
|
44
|
+
*/
|
|
45
|
+
get(origin: string): SessionTicketEntry | undefined;
|
|
46
|
+
/**
|
|
47
|
+
* Remove a cached entry by origin.
|
|
48
|
+
*
|
|
49
|
+
* @param {string} origin - Origin key.
|
|
50
|
+
* @returns {boolean} `true` if an entry was removed.
|
|
51
|
+
*/
|
|
52
|
+
delete(origin: string): boolean;
|
|
53
|
+
/** Remove all cached session tickets. */
|
|
54
|
+
clear(): void;
|
|
55
|
+
/** Number of entries currently in the cache. */
|
|
56
|
+
get size(): number;
|
|
57
|
+
}
|
|
58
|
+
//# sourceMappingURL=session-cache.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"session-cache.d.ts","sourceRoot":"","sources":["../../src/tls/session-cache.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qEAAqE;AACrE,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IAEjE;;;;OAIG;gBACS,OAAO,GAAE,mBAAwB;IAK7C;;;;;;;OAOG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;IAc7E;;;;;;;OAOG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAcnD;;;;;OAKG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI/B,yCAAyC;IACzC,KAAK,IAAI,IAAI;IAIb,gDAAgD;IAChD,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
const DEFAULT_MAX_ENTRIES = 256;
|
|
2
|
+
const DEFAULT_LIFETIME_MS = 7200_000;
|
|
3
|
+
/** LRU cache for TLS session tickets enabling session resumption. */
|
|
4
|
+
export class TLSSessionCache {
|
|
5
|
+
maxEntries;
|
|
6
|
+
defaultLifetimeMs;
|
|
7
|
+
entries = new Map();
|
|
8
|
+
/**
|
|
9
|
+
* Create a new session cache.
|
|
10
|
+
*
|
|
11
|
+
* @param {SessionCacheOptions} [options] - Cache size and lifetime configuration.
|
|
12
|
+
*/
|
|
13
|
+
constructor(options = {}) {
|
|
14
|
+
this.maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
|
|
15
|
+
this.defaultLifetimeMs = options.defaultLifetimeMs ?? DEFAULT_LIFETIME_MS;
|
|
16
|
+
}
|
|
17
|
+
/**
|
|
18
|
+
* Store a session ticket for the given origin.
|
|
19
|
+
*
|
|
20
|
+
* @param {string} origin - Origin key (e.g. `"example.com:443"`).
|
|
21
|
+
* @param {Buffer} ticket - Serialized session ticket.
|
|
22
|
+
* @param {number} [lifetimeMs] - Optional custom lifetime in milliseconds.
|
|
23
|
+
* @param {string} [alpn] - Negotiated ALPN protocol.
|
|
24
|
+
*/
|
|
25
|
+
set(origin, ticket, lifetimeMs, alpn) {
|
|
26
|
+
if (this.entries.size >= this.maxEntries) {
|
|
27
|
+
const oldest = this.entries.keys().next().value;
|
|
28
|
+
if (oldest !== undefined)
|
|
29
|
+
this.entries.delete(oldest);
|
|
30
|
+
}
|
|
31
|
+
this.entries.delete(origin);
|
|
32
|
+
this.entries.set(origin, {
|
|
33
|
+
ticket,
|
|
34
|
+
expiresAt: Date.now() + (lifetimeMs ?? this.defaultLifetimeMs),
|
|
35
|
+
alpn,
|
|
36
|
+
});
|
|
37
|
+
}
|
|
38
|
+
/**
|
|
39
|
+
* Retrieve a cached session ticket.
|
|
40
|
+
*
|
|
41
|
+
* Expired entries are evicted automatically.
|
|
42
|
+
*
|
|
43
|
+
* @param {string} origin - Origin key.
|
|
44
|
+
* @returns {SessionTicketEntry|undefined} Cached entry, or `undefined` if not found or expired.
|
|
45
|
+
*/
|
|
46
|
+
get(origin) {
|
|
47
|
+
const entry = this.entries.get(origin);
|
|
48
|
+
if (!entry)
|
|
49
|
+
return undefined;
|
|
50
|
+
if (Date.now() >= entry.expiresAt) {
|
|
51
|
+
this.entries.delete(origin);
|
|
52
|
+
return undefined;
|
|
53
|
+
}
|
|
54
|
+
this.entries.delete(origin);
|
|
55
|
+
this.entries.set(origin, entry);
|
|
56
|
+
return entry;
|
|
57
|
+
}
|
|
58
|
+
/**
|
|
59
|
+
* Remove a cached entry by origin.
|
|
60
|
+
*
|
|
61
|
+
* @param {string} origin - Origin key.
|
|
62
|
+
* @returns {boolean} `true` if an entry was removed.
|
|
63
|
+
*/
|
|
64
|
+
delete(origin) {
|
|
65
|
+
return this.entries.delete(origin);
|
|
66
|
+
}
|
|
67
|
+
/** Remove all cached session tickets. */
|
|
68
|
+
clear() {
|
|
69
|
+
this.entries.clear();
|
|
70
|
+
}
|
|
71
|
+
/** Number of entries currently in the cache. */
|
|
72
|
+
get size() {
|
|
73
|
+
return this.entries.size;
|
|
74
|
+
}
|
|
75
|
+
}
|
|
76
|
+
//# sourceMappingURL=session-cache.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"session-cache.js","sourceRoot":"","sources":["../../src/tls/session-cache.ts"],"names":[],"mappings":"AAUA,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAUrC,qEAAqE;AACrE,MAAM,OAAO,eAAe;IACT,UAAU,CAAS;IACnB,iBAAiB,CAAS;IAC1B,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEjE;;;;OAIG;IACH,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC5D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,mBAAmB,CAAC;IAC5E,CAAC;IAED;;;;;;;OAOG;IACH,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,UAAmB,EAAE,IAAa;QACpE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;YACvB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,iBAAiB,CAAC;YAC9D,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,GAAG,CAAC,MAAc;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,yCAAyC;IACzC,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,gDAAgD;IAChD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF"}
|
|
@@ -1,54 +1,56 @@
|
|
|
1
1
|
import type { BrowserProfile } from "../../fingerprints/types.js";
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
* TLS 1.3 key exchange. Contains both the public key to advertise in the
|
|
5
|
-
* ClientHello and the private key required to compute the shared secret.
|
|
6
|
-
*
|
|
7
|
-
* @typedef {Object} KeyShareEntry
|
|
8
|
-
* @property {number} group - Named group code (e.g. `NamedGroup.X25519`).
|
|
9
|
-
* @property {Buffer} publicKey - Raw public key bytes to include in the key_share extension.
|
|
10
|
-
* @property {Buffer} privateKey - Raw private key bytes used for ECDH computation.
|
|
11
|
-
*/
|
|
2
|
+
import type { ECHEncryptionParams } from "../ech.js";
|
|
3
|
+
/** Key exchange entry containing the group identifier and key material. */
|
|
12
4
|
export interface KeyShareEntry {
|
|
5
|
+
/** Named group identifier. */
|
|
13
6
|
group: number;
|
|
7
|
+
/** Public key bytes. */
|
|
14
8
|
publicKey: Buffer;
|
|
9
|
+
/** Private key bytes. */
|
|
15
10
|
privateKey: Buffer;
|
|
16
11
|
}
|
|
17
12
|
/**
|
|
18
|
-
*
|
|
19
|
-
* X25519, SECP256R1, SECP384R1, and SECP521R1.
|
|
13
|
+
* Generate a key pair for the specified TLS named group.
|
|
20
14
|
*
|
|
21
|
-
* @param {number} group - Named group
|
|
22
|
-
* @returns {KeyShareEntry}
|
|
23
|
-
* @throws {Error} If the specified group is not supported.
|
|
15
|
+
* @param {number} group - Named group identifier (e.g. X25519, SECP256R1).
|
|
16
|
+
* @returns {KeyShareEntry} Key share entry with public and private key material.
|
|
24
17
|
*/
|
|
25
18
|
export declare function generateKeyShare(group: number): KeyShareEntry;
|
|
26
|
-
/**
|
|
27
|
-
* Carries the outputs of {@link buildClientHello} that must be retained
|
|
28
|
-
* for subsequent handshake processing.
|
|
29
|
-
*
|
|
30
|
-
* @typedef {Object} ClientHelloResult
|
|
31
|
-
* @property {Buffer} record - The complete TLS record containing the ClientHello.
|
|
32
|
-
* @property {KeyShareEntry[]} keyShares - Generated key shares (private keys needed for key derivation).
|
|
33
|
-
* @property {Buffer} clientRandom - 32-byte client random included in the ClientHello body.
|
|
34
|
-
* @property {Buffer} sessionId - Legacy session ID bytes (may be empty).
|
|
35
|
-
* @property {Buffer} handshakeMessage - The raw handshake message body (used for transcript hashing).
|
|
36
|
-
*/
|
|
19
|
+
/** Result of building a TLS ClientHello message. */
|
|
37
20
|
export interface ClientHelloResult {
|
|
21
|
+
/** Complete TLS record containing the ClientHello. */
|
|
38
22
|
record: Buffer;
|
|
23
|
+
/** Generated key share entries. */
|
|
39
24
|
keyShares: KeyShareEntry[];
|
|
25
|
+
/** Client random bytes. */
|
|
40
26
|
clientRandom: Buffer;
|
|
27
|
+
/** Session ID bytes (may be empty). */
|
|
41
28
|
sessionId: Buffer;
|
|
29
|
+
/** Raw handshake message (without record layer). */
|
|
42
30
|
handshakeMessage: Buffer;
|
|
43
31
|
}
|
|
44
32
|
/**
|
|
45
|
-
*
|
|
46
|
-
* structure produced by the given browser profile, including GREASE injection,
|
|
47
|
-
* key share generation, and extension ordering.
|
|
33
|
+
* Build a TLS ClientHello record matching a browser fingerprint profile.
|
|
48
34
|
*
|
|
49
|
-
* @param {BrowserProfile} profile
|
|
50
|
-
* @param {string}
|
|
51
|
-
* @returns {ClientHelloResult}
|
|
35
|
+
* @param {BrowserProfile} profile - Browser profile with TLS extension ordering and cipher suites.
|
|
36
|
+
* @param {string} hostname - Server hostname for SNI.
|
|
37
|
+
* @returns {ClientHelloResult} ClientHello result with record bytes and key material.
|
|
52
38
|
*/
|
|
53
39
|
export declare function buildClientHello(profile: BrowserProfile, hostname: string): ClientHelloResult;
|
|
40
|
+
/** Extended ClientHello result with Encrypted Client Hello inner message. */
|
|
41
|
+
export interface ClientHelloECHResult extends ClientHelloResult {
|
|
42
|
+
/** Raw inner ClientHello handshake message before encryption. */
|
|
43
|
+
innerHandshakeMessage: Buffer;
|
|
44
|
+
/** Client random used in the inner ClientHello. */
|
|
45
|
+
innerRandom: Buffer;
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Build a TLS ClientHello with Encrypted Client Hello (ECH) wrapping.
|
|
49
|
+
*
|
|
50
|
+
* @param {BrowserProfile} profile - Browser fingerprint profile.
|
|
51
|
+
* @param {string} hostname - True server hostname (encrypted in the inner ClientHello).
|
|
52
|
+
* @param {ECHEncryptionParams} echParams - ECH encryption parameters.
|
|
53
|
+
* @returns {ClientHelloECHResult} Extended result with both outer and inner handshake data.
|
|
54
|
+
*/
|
|
55
|
+
export declare function buildClientHelloWithECH(profile: BrowserProfile, hostname: string, echParams: ECHEncryptionParams): ClientHelloECHResult;
|
|
54
56
|
//# sourceMappingURL=client-hello.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client-hello.d.ts","sourceRoot":"","sources":["../../../src/tls/stealth/client-hello.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,6BAA6B,CAAC;
|
|
1
|
+
{"version":3,"file":"client-hello.d.ts","sourceRoot":"","sources":["../../../src/tls/stealth/client-hello.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAOrD,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CA8B7D;AAiBD,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CA2E7F;AA6CD,6EAA6E;AAC7E,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,iEAAiE;IACjE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,GAAG,oBAAoB,CA8DvI"}
|