tr-fetch 0.9.0

package/check.js

@@ -0,0 +1,205 @@
+'use strict';
+
+const { createHash } = require('node:crypto');
+const { parseCertificate, distributionPoints, parseCrl, validateCrl } = require('./crl');
+const { networkUrl, downloadCrl } = require('./download');
+const { TrFetchCrlError, TrFetchOcspError, applyPolicy } = require('./errors');
+const { checkOcspCertificate } = require('./ocsp');
+const CrlCache = require('./cache');
+const { debugUrl } = require('./debug');
+
+const cache = new CrlCache();
+
+function sourceLabel(value) {
+    try {
+        const url = new URL(value);
+        return JSON.stringify(url.origin + url.pathname);
+    } catch (_) {
+        return '(invalid URL)';
+    }
+}
+
+async function checkCertificate(peer, hostname, options, signal, override, debug) {
+    const details = { hostname, serialNumber: peer.serialNumber, fingerprint256: peer.fingerprint256 };
+    const certificateType = override ? 'server' : 'intermediate CA';
+    const label = `${certificateType} certificate ${peer.serialNumber} for ${JSON.stringify(hostname)}`;
+    function issue(key, message, cause, distributionPoint) {
+        debug?.('CRL condition detected', { policy: key, configuredAction: options.policy[key],
+                                            reason: message, source: (distributionPoint === undefined) ? undefined : debugUrl(distributionPoint) });
+        return new TrFetchCrlError(key, `${message} (${label})`, { ...details, distributionPoint }, cause);
+    }
+    let certificate, points;
+    const forcedCrl = override ? options.crl : undefined;
+    const forcedPoint = override ? options.distributionPoint : undefined;
+    try {
+        certificate = parseCertificate(peer.raw);
+        if (forcedCrl !== undefined) {
+            debug?.('CRL data override selected', { bytes: forcedCrl.length });
+            points = [ { urls: [] } ];
+        } else if (forcedPoint !== undefined) {
+            debug?.('CRL distribution point override selected', { source: debugUrl(forcedPoint) });
+            points = [ { urls: [ forcedPoint ] } ];
+        } else {
+            points = distributionPoints(certificate);
+            for (const point of points ?? []) {
+                debug?.('CRL distribution point detected in certificate', {
+                    sources: point.urls.map(debugUrl), unsupportedScope: point.unsupported
+                });
+            }
+        }
+    } catch (cause) {
+        applyPolicy(options.policy, issue('invalidCrl', `Cannot read certificate CRL information: ${cause.message}`, cause), debug);
+        return;
+    }
+    if (points === undefined) {
+        applyPolicy(options.policy, issue('missingCrlDistributionPoint', 'Missing CRL distribution point'), debug);
+        return;
+    }
+    let issuer;
+    try {
+        if (! peer.issuerCertificate?.raw) {
+            throw new Error('The verified TLS chain does not expose the issuer certificate');
+        }
+        issuer = parseCertificate(peer.issuerCertificate.raw);
+    } catch (cause) {
+        applyPolicy(options.policy, issue('invalidCrl', `Cannot authenticate CRL: ${cause.message}`, cause), debug);
+        return;
+    }
+    const issuerId = createHash('sha256').update(peer.issuerCertificate.raw).digest('hex');
+    const failures = [];
+    let attempts = 0;
+    for (const point of points) {
+        if (point.unsupported) {
+            failures.push(issue('invalidCrl', 'Reason-limited or indirect CRL distribution points are unsupported'));
+            continue;
+        }
+        const sources = (forcedCrl !== undefined) ? [ undefined ] : point.urls;
+        if (! sources.length) {
+            failures.push(issue('unreachableCrlDistributionPoint', 'CRL distribution point has no fetchable HTTP(S) URI'));
+        }
+        for (const source of sources) {
+            signal?.throwIfAborted();
+            if (++attempts > 32) {
+                failures.push(issue('unreachableCrlDistributionPoint', 'CRL distribution point lookup limit (32) exceeded'));
+                break;
+            }
+            let crl, key, bytes;
+            const fetchedAt = Date.now();
+            if (forcedCrl !== undefined) {
+                bytes = forcedCrl;
+            } else {
+                try {
+                    const url = networkUrl(source);
+                    key = issuerId + ':' + url.href;
+                    crl = cache.get(key, options.cacheSize, options.cacheTTL, Date.now(), debug);
+                    if (! crl) {
+                        bytes = await downloadCrl(url, signal, debug);
+                    }
+                } catch (cause) {
+                    signal?.throwIfAborted();
+                    failures.push(issue('unreachableCrlDistributionPoint',
+                                        `Unreachable CRL distribution point ${sourceLabel(source)}: ${cause.message}`, cause, source));
+                    continue;
+                }
+            }
+            let result;
+            try {
+                if (! crl) {
+                    crl = parseCrl(bytes);
+                    debug?.('CRL parsed', { source: (source === undefined) ? 'trFetchCrlOverride' : debugUrl(source),
+                                            revokedEntries: crl.revokedCertificates?.length ?? 0 });
+                }
+                result = await validateCrl(crl, certificate, issuer, point.urls);
+            } catch (cause) {
+                failures.push(issue('invalidCrl',
+                                    `Invalid CRL from ${(source === undefined) ? 'trFetchCrlOverride' : sourceLabel(source)}: ${cause.message}`, cause, source));
+                continue;
+            }
+            if ((key !== undefined) && (bytes !== undefined)) {
+                cache.set(key, crl, result.nextUpdate, fetchedAt, options.cacheSize, options.cacheTTL, Date.now(), debug);
+            }
+            debug?.('CRL serial lookup completed', { source: (source === undefined) ? 'trFetchCrlOverride' : debugUrl(source),
+                                                     result: result.revoked ? 'revoked' : 'not listed', authenticated: true,
+                                                     policy: 'revokedCertificate', configuredAction: options.policy.revokedCertificate,
+                                                     action: result.revoked ? options.policy.revokedCertificate : 'continue', nextUpdate: result.nextUpdate });
+            if (result.revoked) {
+                applyPolicy(options.policy, issue('revokedCertificate', `Revoked ${certificateType} certificate: serial number is listed in the authenticated CRL`, undefined, source), debug);
+            }
+            return result.nextUpdate;
+        }
+        if (attempts > 32) {
+            break;
+        }
+    }
+    for (const failure of failures) {
+        applyPolicy(options.policy, failure, debug);
+    }
+}
+
+async function checkChain(peer, hostname, options, signal) {
+    const debug = options.debug;
+    debug?.('TLS verified; starting revocation checks', { hostname });
+    const crlDepth = options.policy.disabled ? -1 : options.checkDepth;
+    const ocspDepth = options.ocspPolicy.disabled ? -1 : options.ocspCheckDepth;
+    const maxDepth = Math.max(crlDepth, ocspDepth);
+    if (maxDepth < 0) {
+        return;
+    }
+    const chainError = (message) => (crlDepth >= 0) ?
+          new TrFetchCrlError('invalidCrl', message, { hostname }) :
+          new TrFetchOcspError('rejectedCertificate', message, { hostname, ocspStatus: 'invalid-response' });
+    if (! peer?.raw) {
+        throw chainError('TLS connection did not expose a peer certificate');
+    }
+    const seen = new Set();
+    let nextUpdate = Infinity;
+    let ocspNextUpdate = Infinity;
+    for (let depth = 0; peer; depth++) {
+        if (depth > maxDepth) {
+            break;
+        }
+        signal?.throwIfAborted();
+        const fingerprint = peer.raw.toString('base64');
+        if ((depth >= 32) || seen.has(fingerprint)) {
+            throw chainError('Invalid or excessively long TLS certificate chain');
+        }
+        seen.add(fingerprint);
+        const issuer = peer.issuerCertificate;
+        const terminal = ! issuer?.raw || peer.raw.equals(issuer.raw);
+        if ((depth > 0) && terminal) {
+            debug?.('Trust anchor excluded from revocation checks', { hostname, depth, serial: peer.serialNumber });
+            break;
+        }
+        const certificateDebug = debug ? (event, details) => debug(event, {
+            hostname, certificate: (depth === 0) ? 'leaf' : 'intermediate CA', depth, serial: peer.serialNumber, ...details
+        }) : undefined;
+        if (depth <= crlDepth) {
+            certificateDebug?.('CRL check started');
+            const expires = await checkCertificate(peer, hostname, options, signal, depth === 0, certificateDebug);
+            nextUpdate = Math.min(nextUpdate, expires ?? Infinity);
+        } else {
+            certificateDebug?.('CRL check skipped', { reason: options.policy.disabled ? 'disabled' : 'beyond configured depth' });
+        }
+        if (depth <= ocspDepth) {
+            certificateDebug?.('OCSP check started');
+            const expires = await checkOcspCertificate(peer, hostname, options, signal, depth === 0, certificateDebug);
+            ocspNextUpdate = Math.min(ocspNextUpdate, expires ?? Infinity);
+        } else {
+            certificateDebug?.('OCSP check skipped', { reason: options.ocspPolicy.disabled ? 'disabled' : 'beyond configured depth' });
+        }
+        if (terminal) {
+            break;
+        }
+        peer = issuer;
+    }
+    if (Date.now() >= nextUpdate) {
+        applyPolicy(options.policy, new TrFetchCrlError('invalidCrl', 'CRL expired while checking the certificate chain', { hostname }), debug);
+    }
+    if (Date.now() >= ocspNextUpdate) {
+        applyPolicy(options.ocspPolicy, new TrFetchOcspError('rejectedCertificate',
+                                                             'OCSP response expired while checking the certificate chain', { hostname, ocspStatus: 'invalid-response' }), debug);
+    }
+    debug?.('Revocation checks completed; connection allowed', { hostname });
+}
+
+module.exports = { checkChain };

package/crl.js

@@ -0,0 +1,164 @@
+'use strict';
+
+const asn1 = require('asn1js');
+const pki = require('pkijs');
+const { cryptoEngine, parseDer, extensionsById, extensionValue, parseCertificate } = require('./pkiutils');
+
+const MAX_CRL_BYTES = 16 * 1024 * 1024;
+
+function distributionPoints(certificate) {
+    const extension = extensionsById(certificate.extensions).get('2.5.29.31');
+    if (! extension) {
+        return undefined;
+    }
+    const points = extensionValue(extension, pki.CRLDistributionPoints).distributionPoints;
+    if (! points.length) {
+        throw new Error('Empty CRL distribution points extension');
+    }
+    return points.map(function(point) {
+        return {
+            urls: Array.isArray(point.distributionPoint) ?
+                point.distributionPoint.filter(x => x.type === 6).map(x => x.value) : [],
+            unsupported: (point.reasons !== undefined) || (point.cRLIssuer !== undefined)
+        };
+    });
+}
+
+function parseCrl(bytes) {
+    if (bytes.length > MAX_CRL_BYTES) {
+        throw new Error('CRL exceeds the 16 MiB size limit');
+    }
+    if (bytes.toString('ascii', 0, 32).trimStart().startsWith('-----BEGIN')) {
+        const match = /^\s*-----BEGIN X509 CRL-----\s*([A-Za-z0-9+/=\r\n\t ]+)\s*-----END X509 CRL-----\s*$/.exec(bytes.toString('ascii'));
+        if (! match) {
+            throw new Error('Malformed PEM CRL; expected one X509 CRL block');
+        }
+        const encoded = match[1].replace(/\s/g, '');
+        bytes = Buffer.from(encoded, 'base64');
+        if (bytes.toString('base64') !== encoded) {
+            throw new Error('Malformed base64 in PEM CRL');
+        }
+    }
+    return parseDer(bytes, pki.CertificateRevocationList);
+}
+
+function checkValidity(crl, now = Date.now()) {
+    const start = crl.thisUpdate.value.getTime();
+    const end = crl.nextUpdate?.value.getTime();
+    if (! Number.isFinite(start) || ! Number.isFinite(end) || (end <= start)) {
+        throw new Error('CRL must have a valid thisUpdate and a later nextUpdate');
+    }
+    if (start > now) {
+        throw new Error('CRL is not yet valid (thisUpdate is in the future)');
+    }
+    if (end <= now) {
+        throw new Error('CRL has expired (nextUpdate has passed)');
+    }
+    return end;
+}
+
+function checkScope(crl, certificate, urls) {
+    if (! [ 0, 1 ].includes(crl.version)) {
+        throw new Error('Unsupported CRL version');
+    }
+    const extensions = extensionsById(crl.crlExtensions?.extensions);
+    for (const extension of extensions.values()) {
+        if (extension.extnID === '2.5.29.27') {
+            throw new Error('Delta CRLs are unsupported; a complete CRL is required');
+        }
+        if (extension.critical && ! [ '2.5.29.28', '2.5.29.35', '2.5.29.20' ].includes(extension.extnID)) {
+            throw new Error(`Unsupported critical CRL extension ${extension.extnID}`);
+        }
+    }
+    const idpExtension = extensions.get('2.5.29.28');
+    if (idpExtension) {
+        const idp = extensionValue(idpExtension, pki.IssuingDistributionPoint);
+        if (idp.indirectCRL || (idp.onlySomeReasons !== undefined) || idp.onlyContainsAttributeCerts) {
+            throw new Error('Indirect, reason-limited and attribute-certificate CRLs are unsupported');
+        }
+        const basic = extensionsById(certificate.extensions).get('2.5.29.19');
+        const isCA = basic ? extensionValue(basic, pki.BasicConstraints).cA : false;
+        if ((idp.onlyContainsUserCerts && isCA) || (idp.onlyContainsCACerts && ! isCA)) {
+            throw new Error('CRL scope does not cover this certificate type');
+        }
+        if (idp.distributionPoint !== undefined) {
+            if (! Array.isArray(idp.distributionPoint) ||
+                ! idp.distributionPoint.some(x => (x.type === 6) && urls.includes(x.value))) {
+                throw new Error('CRL issuing distribution point does not match the effective distribution point');
+            }
+        }
+    }
+    return extensions;
+}
+
+async function validateCrl(crl, certificate, issuer, urls, now = Date.now()) {
+    const nextUpdate = checkValidity(crl, now);
+    const extensions = checkScope(crl, certificate, urls);
+    if (! crl.issuer.isEqual(certificate.issuer) || ! crl.issuer.isEqual(issuer.subject)) {
+        throw new Error('CRL issuer does not match the certificate issuer');
+    }
+    if (! await certificate.verify(issuer, cryptoEngine)) {
+        throw new Error('CRL signing certificate did not issue the checked certificate');
+    }
+    if (! Buffer.from(crl.signature.toSchema().toBER()).equals(Buffer.from(crl.signatureAlgorithm.toSchema().toBER()))) {
+        throw new Error('CRL signature algorithm identifiers disagree');
+    }
+    const hash = await cryptoEngine.getHashAlgorithm(crl.signatureAlgorithm);
+    if (! [ 'SHA-256', 'SHA-384', 'SHA-512' ].includes(hash)) {
+        throw new Error(`Unsupported or weak CRL signature algorithm: ${crl.signatureAlgorithm.algorithmId}`);
+    }
+    const issuerExtensions = extensionsById(issuer.extensions);
+    const keyUsage = issuerExtensions.get('2.5.29.15');
+    if (keyUsage) {
+        const bits = extensionValue(keyUsage);
+        if (! (bits instanceof asn1.BitString) || ! (bits.valueBlock.valueHexView[0] & 0x02)) {
+            throw new Error('Issuer certificate key usage does not permit CRL signing');
+        }
+    }
+    const authority = extensions.get('2.5.29.35');
+    if (authority) {
+        const aki = extensionValue(authority, pki.AuthorityKeyIdentifier);
+        const ski = issuerExtensions.get('2.5.29.14');
+        if (aki.keyIdentifier && ski &&
+            ! Buffer.from(aki.keyIdentifier.valueBlock.valueHexView).equals(Buffer.from(extensionValue(ski).valueBlock.valueHexView))) {
+            throw new Error('CRL authority key identifier does not match its issuer');
+        }
+        if (aki.authorityCertSerialNumber && ! aki.authorityCertSerialNumber.isEqual(issuer.serialNumber)) {
+            throw new Error('CRL authority certificate serial number does not match its issuer');
+        }
+        if (aki.authorityCertIssuer && ! aki.authorityCertIssuer.some(x => (x.type === 4) && x.value.isEqual(issuer.issuer))) {
+            throw new Error('CRL authority certificate issuer does not match its issuer certificate');
+        }
+    }
+    const crlNumber = extensions.get('2.5.29.20');
+    if (crlNumber && ! (extensionValue(crlNumber) instanceof asn1.Integer)) {
+        throw new Error('Malformed CRL number');
+    }
+    if (! await crl.verify({ issuerCertificate: issuer }, cryptoEngine)) {
+        throw new Error('CRL signature verification failed');
+    }
+    let revoked = false;
+    for (const entry of crl.revokedCertificates ?? []) {
+        for (const extension of extensionsById(entry.crlEntryExtensions?.extensions).values()) {
+            if (extension.extnID === '2.5.29.29') {
+                throw new Error('Indirect CRL certificateIssuer entries are unsupported');
+            }
+            if (extension.critical) {
+                throw new Error(`Unsupported critical CRL entry extension ${extension.extnID}`);
+            }
+            if (extension.extnID === '2.5.29.21') {
+                const reason = extensionValue(extension);
+                if (! (reason instanceof asn1.Enumerated) || (reason.valueBlock.valueDec === 8)) {
+                    throw new Error('Invalid revocation reason in a complete CRL');
+                }
+            }
+        }
+        if (entry.userCertificate.isEqual(certificate.serialNumber)) {
+            revoked = true;
+        }
+    }
+    checkValidity(crl);
+    return { revoked, nextUpdate };
+}
+
+module.exports = { MAX_CRL_BYTES, parseCertificate, distributionPoints, parseCrl, validateCrl };

package/debug.js

@@ -0,0 +1,33 @@
+'use strict';
+
+let nextId = 0;
+
+function debugUrl(value) {
+    try {
+        const url = new URL(value);
+        if (! [ 'http:', 'https:' ].includes(url.protocol)) {
+            return url.protocol + '[unsupported]';
+        }
+        return url.origin + url.pathname;
+    } catch (_) {
+        return '[invalid URL]';
+    }
+}
+
+function createDebug(enabled) {
+    if (! enabled) {
+        return undefined;
+    }
+    const id = ++nextId;
+    return function(event, details = {}) {
+        // One escaped line per event, with a per-fetch ID for concurrent calls.
+        // Never include request headers, bodies or raw certificate/CRL data.
+        try {
+            process.stderr.write(`[trFetch debug #${id}] ${event} ${JSON.stringify(details)}\n`);
+        } catch (_) {
+            // Diagnostics must not change the verification outcome.
+        }
+    };
+}
+
+module.exports = { createDebug, debugUrl };

package/download.js

@@ -0,0 +1,100 @@
+'use strict';
+
+const { assertVerifiedResponse, createAgent } = require('./transport');
+const { MAX_CRL_BYTES } = require('./crl');
+const { debugUrl } = require('./debug');
+
+function networkUrl(value, kind = 'CRL distribution point') {
+    let url;
+    try {
+        url = new URL(value);
+    } catch (_) {
+        throw new Error(`${kind} is not an absolute network URL`);
+    }
+    if (! [ 'http:', 'https:' ].includes(url.protocol)) {
+        throw new Error(`Unsupported ${kind} scheme ${url.protocol}; only HTTP and HTTPS are allowed`);
+    }
+    if (url.username || url.password) {
+        throw new Error(`${kind} URLs must not contain credentials`);
+    }
+    url.hash = '';
+    return url;
+}
+
+async function download(value, signal, body, debug) {
+    const kind = (body === undefined) ? 'CRL' : 'OCSP';
+    const maxBytes = (body === undefined) ? MAX_CRL_BYTES : 1024 * 1024;
+    let url = networkUrl(value, kind);
+    const timeout = AbortSignal.timeout(10000);
+    const downloadSignal = signal ? AbortSignal.any([ signal, timeout ]) : timeout;
+    const agent = createAgent(undefined, downloadSignal);
+    try {
+        for (let redirects = 0; redirects <= 5; redirects++) {
+            debug?.(`${kind} download started`, { source: debugUrl(url), method: (body === undefined) ? 'GET' : 'POST' });
+            const response = await globalThis.fetch(url, {
+                dispatcher: agent,
+                signal: downloadSignal,
+                redirect: 'manual',
+                credentials: 'omit',
+                referrerPolicy: 'no-referrer',
+                method: (body === undefined) ? 'GET' : 'POST',
+                body,
+                headers: (body === undefined) ? undefined : {
+                    'content-type': 'application/ocsp-request',
+                    accept: 'application/ocsp-response'
+                }
+            });
+            try {
+                assertVerifiedResponse(agent, url.href, response);
+            } catch (error) {
+                void response.body?.cancel().catch(() => {});
+                throw error;
+            }
+            debug?.(`${kind} HTTP response`, { source: debugUrl(url), status: response.status });
+            if ([ 301, 302, 303, 307, 308 ].includes(response.status)) {
+                await response.body?.cancel();
+                if ((body !== undefined) && ! [ 307, 308 ].includes(response.status)) {
+                    throw new Error(`OCSP POST redirect HTTP ${response.status} is unsupported; expected 307 or 308`);
+                }
+                const location = response.headers.get('location');
+                if (! location) {
+                    throw new Error(`${kind} redirect has no Location header`);
+                }
+                const target = networkUrl(new URL(location, url).href, kind);
+                debug?.(`${kind} redirect`, { source: debugUrl(url), target: debugUrl(target), status: response.status });
+                url = target;
+                continue;
+            }
+            if (response.status !== 200) {
+                await response.body?.cancel();
+                throw new Error(`${kind} download returned HTTP ${response.status}`);
+            }
+            const chunks = [];
+            let length = 0;
+            if (response.body) {
+                for await (const chunk of response.body) {
+                    length += chunk.byteLength;
+                    if (length > maxBytes) {
+                        throw new Error(`${kind} download exceeds the ${maxBytes / (1024 * 1024)} MiB size limit`);
+                    }
+                    chunks.push(chunk);
+                }
+            }
+            debug?.((kind === 'CRL') ? 'CRL fetched' : 'OCSP response fetched', { source: debugUrl(url), bytes: length });
+            return Buffer.concat(chunks, length);
+        }
+        throw new Error(`${kind} download exceeded the five-redirect limit`);
+    } finally {
+        await agent.destroy();
+    }
+}
+
+function downloadCrl(value, signal, debug) {
+    return download(value, signal, undefined, debug);
+}
+
+function downloadOcsp(value, request, signal, debug) {
+    return download(value, signal, request, debug);
+}
+
+module.exports = { networkUrl, downloadCrl, downloadOcsp };

package/errors.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const CODES = {
+    missingCrlDistributionPoint: 'TR_FETCH_CRL_MISSING_DISTRIBUTION_POINT',
+    unreachableCrlDistributionPoint: 'TR_FETCH_CRL_UNREACHABLE_DISTRIBUTION_POINT',
+    invalidCrl: 'TR_FETCH_CRL_INVALID',
+    revokedCertificate: 'TR_FETCH_CERTIFICATE_REVOKED',
+    missingOcspUri: 'TR_FETCH_OCSP_MISSING_URI',
+    unreachableOcspUri: 'TR_FETCH_OCSP_UNREACHABLE_URI',
+    rejectedCertificate: 'TR_FETCH_OCSP_CERTIFICATE_REJECTED'
+};
+
+class TrFetchRevocationError extends Error {
+    constructor(policyKey, message, details = {}, cause) {
+        super(`trFetch: ${message}`, (cause === undefined) ? undefined : { cause });
+        this.name = new.target.name;
+        this.code = CODES[policyKey];
+        this.policyKey = policyKey;
+        Object.assign(this, details);
+    }
+}
+
+class TrFetchCrlError extends TrFetchRevocationError {}
+class TrFetchOcspError extends TrFetchRevocationError {}
+
+function applyPolicy(policy, error, debug) {
+    const action = policy[error.policyKey];
+    debug?.((error instanceof TrFetchOcspError) ? 'OCSP policy applied' : 'CRL policy applied', {
+        policy: error.policyKey, action, code: error.code, reason: error.message
+    });
+    if (action === 'reject') {
+        throw error;
+    }
+    if (action === 'warn') {
+        const warning = new error.constructor(error.policyKey, error.message.slice(9), {}, error.cause);
+        Object.assign(warning, error);
+        warning.name = error.name.replace(/Error$/, 'Warning');
+        process.emitWarning(warning);
+    }
+}
+
+module.exports = { TrFetchCrlError, TrFetchOcspError, applyPolicy };

package/index.js

@@ -0,0 +1,57 @@
+'use strict';
+
+const { splitOptions } = require('./options');
+const { assertDefaultDispatcher, assertVerifiedResponse, createAgent } = require('./transport');
+const { checkChain } = require('./check');
+const { TrFetchCrlError, TrFetchOcspError } = require('./errors');
+const { createDebug, debugUrl } = require('./debug');
+
+async function trFetch(input, options) {
+    const config = splitOptions(options);
+    const debug = createDebug(config.debugEnabled);
+    config.debug = debug;
+    assertDefaultDispatcher();
+    const request = new Request(input, config.fetchOptions);
+    const signal = request.signal;
+    signal.throwIfAborted();
+    debug?.('Verification configured', {
+        url: debugUrl(request.url),
+        crl: config.policy.disabled ? 'disabled' : 'enabled',
+        crlDepth: (config.checkDepth === Infinity) ? 'full-chain' : config.checkDepth,
+        ocsp: config.ocspPolicy.disabled ? 'disabled' : 'enabled',
+        ocspDepth: (config.ocspCheckDepth === Infinity) ? 'full-chain' : config.ocspCheckDepth
+    });
+    const check = (config.policy.disabled && config.ocspPolicy.disabled) ? undefined :
+          (peer, hostname) => checkChain(peer, hostname, config, signal);
+    const agent = createAgent(check, signal);
+    try {
+        const response = await globalThis.fetch(request, { dispatcher: agent });
+        try {
+            assertVerifiedResponse(agent, request.url, response);
+        } catch (error) {
+            void response.body?.cancel().catch(() => {});
+            throw error;
+        }
+        debug?.('Fetch response received', { url: debugUrl(response.url || request.url), status: response.status });
+        // close() waits for body consumption; do not await it before returning
+        // the response, or streaming responses would deadlock.
+        void agent.close().catch(() => {});
+        return response;
+    } catch (error) {
+        debug?.('Fetch failed', { aborted: signal.aborted, code: error.cause?.code ?? error.code ?? 'FETCH_FAILED' });
+        await agent.destroy();
+        if (signal.aborted) {
+            throw signal.reason;
+        }
+        for (let cause = error; cause; cause = cause.cause) {
+            if ((cause instanceof TrFetchCrlError) || (cause instanceof TrFetchOcspError)) {
+                throw cause;
+            }
+        }
+        throw error;
+    }
+}
+
+module.exports = trFetch;
+module.exports.TrFetchCrlError = TrFetchCrlError;
+module.exports.TrFetchOcspError = TrFetchOcspError;