visaljs 0.0.10 → 0.0.11

package/runtime/src/crypto_subtle.c

@@ -226,14 +226,15 @@ static int arg_enum(Call *c, JSValue v, const char *const *values, int count, co
                                     c->op, where, shown, type));
 }
 
-enum { FORMAT_RAW, FORMAT_SPKI, FORMAT_PKCS8, FORMAT_JWK };
-static const char *const FORMATS[] = { "raw", "spki", "pkcs8", "jwk" };
+/* the raw-* formats (Node 24's, from WebCrypto's Modern Algorithms draft) say which key raw is */
+enum { FORMAT_RAW, FORMAT_SPKI, FORMAT_PKCS8, FORMAT_JWK, FORMAT_RAW_PUBLIC, FORMAT_RAW_PRIVATE, FORMAT_RAW_SEED, FORMAT_RAW_SECRET };
+static const char *const FORMATS[] = { "raw", "spki", "pkcs8", "jwk", "raw-public", "raw-private", "raw-seed", "raw-secret" };
 static const char *const USAGES[] = { "encrypt", "decrypt", "sign", "verify", "deriveKey", "deriveBits", "wrapKey", "unwrapKey" };
 
 static int arg_format(Call *c, JSValue v, int i) {
     char where[32];
     snprintf(where, sizeof where, "%s argument", ORDINALS[i]);
-    return arg_enum(c, v, FORMATS, 4, "KeyFormat", where);
+    return arg_enum(c, v, FORMATS, 8, "KeyFormat", where);
 }
 
 /* sequence<KeyUsage>: a new array of the strings, in order (duplicates kept, as Node keeps them),
@@ -373,7 +374,7 @@ typedef enum Op {
 
 /* Parameter dictionaries, and their members (alphabetical, as WebIDL converts them) */
 typedef enum Dict {
-    DICT_NONE, DICT_HMAC_IMPORT, DICT_HMAC_KEYGEN, DICT_PBKDF2, DICT_HKDF, DICT_AES_CBC, DICT_AES_CTR, DICT_AES_GCM, DICT_AES_KEYGEN,
+    DICT_NONE, DICT_HMAC_IMPORT, DICT_HMAC_KEYGEN, DICT_PBKDF2, DICT_HKDF, DICT_AES_CBC, DICT_AES_CTR, DICT_AES_GCM, DICT_AEAD, DICT_AES_KEYGEN,
     DICT_AES_DERIVED, DICT_RSA_HASHED_IMPORT, DICT_RSA_HASHED_KEYGEN, DICT_RSA_PSS, DICT_RSA_OAEP, DICT_EC_IMPORT, DICT_EC_KEYGEN,
     DICT_ECDSA, DICT_ECDH_DERIVE,
 } Dict;
@@ -402,6 +403,7 @@ static const struct {
     [DICT_AES_CBC] = { "AesCbcParams", { M_IV, M_END }, 1, 0 },
     [DICT_AES_CTR] = { "AesCtrParams", { M_COUNTER, M_LENGTH, M_END }, 3, 255 },
     [DICT_AES_GCM] = { "AesGcmParams", { M_ADDITIONAL_DATA, M_IV, M_TAG_LENGTH, M_END }, 2, 0 },
+    [DICT_AEAD] = { "AeadParams", { M_ADDITIONAL_DATA, M_IV, M_TAG_LENGTH, M_END }, 2, 0 },
     [DICT_AES_KEYGEN] = { "AesKeyGenParams", { M_LENGTH, M_END }, 1, 65535 },
     [DICT_AES_DERIVED] = { "AesDerivedKeyParams", { M_LENGTH, M_END }, 1, 65535 },
     [DICT_RSA_HASHED_IMPORT] = { "RsaHashedImportParams", { M_HASH, M_END }, 1, 0 },
@@ -446,6 +448,8 @@ static const struct {
       { [OP_IMPORT_KEY] = DICT_EC_IMPORT, [OP_GENERATE_KEY] = DICT_EC_KEYGEN, [OP_DERIVE_BITS] = DICT_ECDH_DERIVE } },
     { "X25519", JS_WEB_X25519, KEY_OPS | BIT(OP_DERIVE_BITS), { [OP_DERIVE_BITS] = DICT_ECDH_DERIVE } },
     { "Ed25519", JS_WEB_ED25519, KEY_OPS | BIT(OP_SIGN) | BIT(OP_VERIFY), { 0 } },
+    { "ChaCha20-Poly1305", JS_WEB_CHACHA20_POLY1305, BIT(OP_IMPORT_KEY) | BIT(OP_GENERATE_KEY) | BIT(OP_ENCRYPT) | BIT(OP_DECRYPT),
+      { [OP_ENCRYPT] = DICT_AEAD, [OP_DECRYPT] = DICT_AEAD } },
 };
 
 /* A normalized algorithm: its registry entry and the members its dictionary has. */
@@ -714,6 +718,7 @@ static bool is_aes(uint8_t alg) { return alg >= JS_WEB_AES_CTR && alg <= JS_WEB_
 /* A JWK's `alg` for a secret key: HS256, A128GCM, … */
 static void jwk_alg(uint8_t alg, const JSHashAlg *hash, uint32_t length, char *out, size_t cap) {
     if (alg == JS_WEB_HMAC) snprintf(out, cap, "HS%s", hash->web + 4);
+    else if (alg == JS_WEB_CHACHA20_POLY1305) snprintf(out, cap, "C20P");
     else snprintf(out, cap, "A%u%s", length, web_alg_name(alg) + 4);
 }
 
@@ -728,6 +733,14 @@ static JSValue aes_algorithm(JSContext *ctx, const char *name, uint32_t length)
     return o;
 }
 
+/* a secret key's algorithm object: { name, length } for AES; ChaCha20-Poly1305's, { name } */
+static JSValue secret_algorithm(JSContext *ctx, uint8_t alg, const char *name, uint32_t length) {
+    if (alg != JS_WEB_CHACHA20_POLY1305) return aes_algorithm(ctx, name, length);
+    JSValue a = js_new_object(ctx);
+    put(ctx, a, "name", str(ctx, name));
+    return a;
+}
+
 static JSValue import_aes(JSContext *ctx, int format, JSValue key_data, const JWK *jwk, Params *p, bool extractable, JSValue usages,
                           uint16_t mask) {
     uint8_t alg = params_alg(p);
@@ -750,7 +763,7 @@ static JSValue import_aes(JSContext *ctx, int format, JSValue key_data, const JW
         return dom_error(ctx, "NotSupportedError", m);
     }
     uint32_t length = (uint32_t)raw.n * 8;
-    if (length != 128 && length != 192 && length != 256) {
+    if (alg == JS_WEB_CHACHA20_POLY1305 ? length != 256 : length != 128 && length != 192 && length != 256) {
         bytes_free(&raw);
         return dom_error(ctx, "DataError", "Invalid key length");
     }
@@ -764,7 +777,7 @@ static JSValue import_aes(JSContext *ctx, int format, JSValue key_data, const JW
     }
     JSValue data = js_new_secret_key(ctx, raw.p, raw.n);
     bytes_free(&raw);
-    return js_new_crypto_key(ctx, data, alg, NULL, length, aes_algorithm(ctx, p->name, length), usages, mask, extractable);
+    return js_new_crypto_key(ctx, data, alg, NULL, length, secret_algorithm(ctx, alg, p->name, length), usages, mask, extractable);
 }
 
 /* ---- Asymmetric keys: RSA, EC, X25519 and Ed25519 ------------------------------------------------- */
@@ -1048,6 +1061,18 @@ static JSValue generate_asym(JSContext *ctx, Params *p, bool extractable, uint16
     return pair;
 }
 
+/* A raw-* format as raw for the algorithm it fits (raw-secret: a secret key's; raw-public: an EC,
+ * X25519 or Ed25519 public key's), other formats as they are; -1 where it doesn't fit (raw-private
+ * and raw-seed are ML-DSA's and ML-KEM's). */
+static int raw_alias(int alg, int format) {
+    if (format == FORMAT_RAW && alg == JS_WEB_CHACHA20_POLY1305) return -1;  /* Node: raw-secret only */
+    if (format < FORMAT_RAW_PUBLIC) return format;
+    bool secret = !is_asym_alg(alg);
+    if (format == FORMAT_RAW_SECRET && secret) return FORMAT_RAW;
+    if (format == FORMAT_RAW_PUBLIC && !secret && alg != JS_WEB_RSASSA && alg != JS_WEB_RSA_PSS && alg != JS_WEB_RSA_OAEP) return FORMAT_RAW;
+    return -1;
+}
+
 /* importKey's steps after the `this` check, for subtle.importKey and deriveKey. */
 static JSValue import_key(JSContext *ctx, uint32_t argc, const JSValue *argv) {
     Call c = { ctx, "importKey" };
@@ -1066,6 +1091,14 @@ static JSValue import_key(JSContext *ctx, uint32_t argc, const JSValue *argv) {
         params_free(&p);
         return JS_EXCEPTION;
     }
+    int raw = raw_alias(REGISTRY[p.entry].alg, format);
+    if (raw < 0) {
+        char m[96];
+        snprintf(m, sizeof m, "Unable to import %s using %s format", p.name, FORMATS[format]);
+        params_free(&p);
+        return dom_error(ctx, "NotSupportedError", m);
+    }
+    format = raw;
     JSValue key;
     switch (REGISTRY[p.entry].alg) {
     case JS_WEB_HMAC:
@@ -1075,6 +1108,7 @@ static JSValue import_key(JSContext *ctx, uint32_t argc, const JSValue *argv) {
     case JS_WEB_AES_CBC:
     case JS_WEB_AES_GCM:
     case JS_WEB_AES_KW:
+    case JS_WEB_CHACHA20_POLY1305:
         key = import_aes(ctx, format, argv[1], &jwk, &p, extractable, usages, mask);
         break;
     case JS_WEB_RSASSA:
@@ -1121,6 +1155,14 @@ static JSValue export_key(JSContext *ctx, uint32_t argc, const JSValue *argv) {
         return dom_error(ctx, "NotSupportedError", m);
     }
     if (!k->extractable) return dom_error(ctx, "InvalidAccessError", "key is not extractable");
+    int raw = raw_alias(k->alg, format);
+    if (raw < 0 || (format == FORMAT_RAW_PUBLIC && js_key_data(k->data)->type != JS_KEY_PUBLIC)) {
+        uint8_t type = js_key_data(k->data)->type;
+        snprintf(m, sizeof m, "Unable to export %s %s key using %s format", web_alg_name(k->alg),
+                 type == JS_KEY_SECRET ? "secret" : type == JS_KEY_PUBLIC ? "public" : "private", FORMATS[format]);
+        return dom_error(ctx, "NotSupportedError", m);
+    }
+    format = raw;
     if (is_asym_alg(k->alg)) return export_asym(ctx, format, k);
     JSKeyData *d = js_key_data(k->data);
     if (format == FORMAT_RAW) return array_buffer_of(ctx, d->bytes, d->len);
@@ -1229,6 +1271,9 @@ static JSValue generate_key(JSContext *ctx, uint32_t argc, const JSValue *argv)
         if (p.has_length && p.length == 0) return dom_error(ctx, "OperationError", "HmacKeyGenParams.length cannot be 0");
         length = p.has_length ? p.length : (uint32_t)p.hash->block_len * 8;
         if (has_any_not_in(mask, JS_USAGE_SIGN | JS_USAGE_VERIFY)) return dom_error(ctx, "SyntaxError", "Unsupported key usage for HMAC key");
+    } else if (alg == JS_WEB_CHACHA20_POLY1305) {
+        length = 256;
+        if (has_any_not_in(mask, aes_usages(alg))) return usage_error(ctx, p.name);
     } else {
         length = p.length;
         if (length != 128 && length != 192 && length != 256)
@@ -1245,7 +1290,7 @@ static JSValue generate_key(JSContext *ctx, uint32_t argc, const JSValue *argv)
     JSValue data = js_new_secret_key(ctx, bytes, n);
     free(bytes);
     if (js_array_length(js_as_object(usages)) == 0) return dom_error(ctx, "SyntaxError", "Usages cannot be empty when creating a key.");
-    JSValue algorithm = alg == JS_WEB_HMAC ? hmac_algorithm(ctx, p.hash, length) : aes_algorithm(ctx, p.name, length);
+    JSValue algorithm = alg == JS_WEB_HMAC ? hmac_algorithm(ctx, p.hash, length) : secret_algorithm(ctx, alg, p.name, length);
     return js_new_crypto_key(ctx, data, alg, p.hash, length, algorithm, usages, mask, extractable);
 }
 
@@ -1564,6 +1609,20 @@ static JSValue aes_cipher(JSContext *ctx, bool encrypt, JSCryptoKey *k, Params *
                                   data->p, data->n - tag_n, &out);
         break;
     }
+    case JS_WEB_CHACHA20_POLY1305: {
+        uint32_t tag_bits = p->has_tag_length ? p->tag_length : 128;
+        if (tag_bits != 128) {
+            char m[64];
+            snprintf(m, sizeof m, "%u is not a valid ChaCha20-Poly1305 tag length", tag_bits);
+            return dom_error(ctx, "OperationError", m);
+        }
+        if (p->iv.n != 12) return dom_error(ctx, "OperationError", "algorithm.iv must contain exactly 12 bytes");
+        if (!encrypt && data->n < 16) return op_failed(ctx);
+        const JSCipherAlg *alg = js_cipher_by_name("chacha20-poly1305");
+        ok = encrypt ? run_cipher(alg, true, d, p->iv.p, 12, 16, &p->additional_data, NULL, 0, data->p, data->n, &out)
+                     : run_cipher(alg, false, d, p->iv.p, 12, 16, &p->additional_data, data->p + data->n - 16, 16, data->p, data->n - 16, &out);
+        break;
+    }
     default: { /* AES-KW, with RFC 3394's default IV */
         static const uint8_t KW_IV[8] = { 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6 };
         ok = run_cipher(js_cipher_aes(JS_CIPHER_WRAP, d->len), encrypt, d, KW_IV, 8, -1, NULL, NULL, 0, data->p, data->n, &out);

package/runtime/src/crypto_tls.c

@@ -20,6 +20,7 @@
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/pem.h>
+#include <openssl/pkcs8.h>
 #include <openssl/ssl.h>
 #include <openssl/x509.h>
 
@@ -263,27 +264,33 @@ PRIMITIVE(js_tls_context_set_cert) {
     return js_int32(0);
 }
 
-/* tlsContextSetKey(context, key handle) → 0 | 1 a key TLS can't use | 2 not the certificate's key */
-PRIMITIVE(js_tls_context_set_key) {
-    UNUSED_ARGS;
-    TlsContextObject *o = context_arg(ARG(0));
-    JSKeyData *k = js_key_data(ARG(1));
-    if (!o || !k) return js_throw_type_error(ctx, "tlsContextSetKey: a context and a key expected");
-    if (k->type != JS_KEY_PRIVATE) return js_int32(1);
+/* A key (handle) as BoringSSL's, from its PKCS#8 or SPKI DER, or NULL for one BoringSSL can't use */
+static EVP_PKEY *pkey_of(const JSKeyData *k) {
+    bool private = k->type == JS_KEY_PRIVATE;
+    if (!private && k->type != JS_KEY_PUBLIC) return NULL;
     JSBytesOut der = { 0 };
-    if (js_key_export_der(k, JS_KEY_ENC_PKCS8, &der) != 0) {
+    if (js_key_export_der(k, private ? JS_KEY_ENC_PKCS8 : JS_KEY_ENC_SPKI, &der) != 0) {
         free(der.p);
-        return js_int32(1);
+        return NULL;
     }
     CBS cbs;
     CBS_init(&cbs, der.p, der.n);
-    EVP_PKEY *pkey = EVP_parse_private_key(&cbs);
+    EVP_PKEY *pkey = private ? EVP_parse_private_key(&cbs) : EVP_parse_public_key(&cbs);
     memset(der.p, 0, der.n);
     free(der.p);
-    if (!pkey) {
-        ERR_clear_error();
-        return js_int32(1);
-    }
+    ERR_clear_error();
+    return pkey;
+}
+
+/* tlsContextSetKey(context, key handle) → 0 | 1 a key TLS can't use | 2 not the certificate's key */
+PRIMITIVE(js_tls_context_set_key) {
+    UNUSED_ARGS;
+    TlsContextObject *o = context_arg(ARG(0));
+    JSKeyData *k = js_key_data(ARG(1));
+    if (!o || !k) return js_throw_type_error(ctx, "tlsContextSetKey: a context and a key expected");
+    if (k->type != JS_KEY_PRIVATE) return js_int32(1);
+    EVP_PKEY *pkey = pkey_of(k);
+    if (!pkey) return js_int32(1);
     int ok = SSL_CTX_use_PrivateKey(o->ctx, pkey);
     EVP_PKEY_free(pkey);
     ERR_clear_error();
@@ -291,6 +298,195 @@ PRIMITIVE(js_tls_context_set_key) {
     return js_int32(0);
 }
 
+/* tlsContextAddCredential(context, [der, …], key handle) → 0 | 1 a key TLS can't use | 2 not the
+ * certificate's key: one of a server's identities (a chain, leaf first, and its key), which
+ * BoringSSL chooses among by what the client accepts, as OpenSSL does by key type */
+PRIMITIVE(js_tls_context_add_credential) {
+    UNUSED_ARGS;
+    TlsContextObject *o = context_arg(ARG(0));
+    JSKeyData *k = js_key_data(ARG(2));
+    if (!o || !js_is_array(ARG(1)) || !k) return js_throw_type_error(ctx, "tlsContextAddCredential: a context, certificates and a key expected");
+    uint32_t n = js_array_length(js_as_object(ARG(1)));
+    if (n == 0 || n > 16) return js_throw_type_error(ctx, "tlsContextAddCredential: 1 to 16 certificates expected");
+    CRYPTO_BUFFER *certs[16] = { 0 };
+    int result = 0;
+    for (uint32_t i = 0; i < n && result == 0; i++) {
+        const uint8_t *p;
+        size_t len;
+        if (!bytes_arg(js_get_value(ctx, ARG(1), js_index_key(i)), &p, &len) || !(certs[i] = CRYPTO_BUFFER_new(p, len, NULL))) result = 1;
+    }
+    EVP_PKEY *pkey = result == 0 && k->type == JS_KEY_PRIVATE ? pkey_of(k) : NULL;
+    SSL_CREDENTIAL *cred = SSL_CREDENTIAL_new_x509();
+    if (result == 0 && (!pkey || !cred)) result = 1;
+    if (result == 0 && !SSL_CREDENTIAL_set1_cert_chain(cred, certs, n)) result = 1;
+    if (result == 0 && !SSL_CREDENTIAL_set1_private_key(cred, pkey)) result = 2;
+    if (result == 0 && !SSL_CTX_add1_credential(o->ctx, cred)) result = 1;
+    SSL_CREDENTIAL_free(cred);
+    EVP_PKEY_free(pkey);
+    for (uint32_t i = 0; i < n; i++) CRYPTO_BUFFER_free(certs[i]);
+    ERR_clear_error();
+    return js_int32(result);
+}
+
+/* tlsContextAllowPartialChain(context): a trusted intermediate ends a chain, as a root does
+ * (allowPartialTrustChain); on the context's parameters, as its store may be the shared roots' */
+PRIMITIVE(js_tls_context_allow_partial_chain) {
+    UNUSED_ARGS;
+    TlsContextObject *o = context_arg(ARG(0));
+    if (!o) return js_throw_type_error(ctx, "tlsContextAllowPartialChain: a context expected");
+    X509_VERIFY_PARAM_set_flags(SSL_CTX_get0_param(o->ctx), X509_V_FLAG_PARTIAL_CHAIN);
+    return JS_UNDEFINED;
+}
+
+/* tlsContextTicketKeys(context, keys | null) → the 48 bytes the context's session tickets are
+ * encrypted with (after setting them to `keys`) */
+PRIMITIVE(js_tls_context_ticket_keys) {
+    UNUSED_ARGS;
+    TlsContextObject *o = context_arg(ARG(0));
+    if (!o) return js_throw_type_error(ctx, "tlsContextTicketKeys: a context expected");
+    const uint8_t *p;
+    size_t n;
+    if (bytes_arg(ARG(1), &p, &n)) {
+        if (n != 48 || !SSL_CTX_set_tlsext_ticket_keys(o->ctx, p, n)) return js_throw_type_error(ctx, "tlsContextTicketKeys: 48 bytes expected");
+    }
+    uint8_t keys[48];
+    SSL_CTX_get_tlsext_ticket_keys(o->ctx, keys, sizeof keys);
+    return js_new_buffer_from_bytes(ctx, keys, sizeof keys);
+}
+
+/* tlsContextSetSessions(context, timeout | null, sessionIdContext | null): how long a session can
+ * be resumed (seconds), and the context its id is valid in */
+PRIMITIVE(js_tls_context_set_sessions) {
+    UNUSED_ARGS;
+    TlsContextObject *o = context_arg(ARG(0));
+    if (!o) return js_throw_type_error(ctx, "tlsContextSetSessions: a context expected");
+    if (js_is_number(ARG(1))) SSL_CTX_set_timeout(o->ctx, (uint32_t)js_as_number(ARG(1)));
+    char *sid = string_dup(ctx, ARG(2));
+    if (sid) {
+        /* OpenSSL's limit, which Node passes through */
+        size_t n = strlen(sid);
+        SSL_CTX_set_session_id_context(o->ctx, (const uint8_t *)sid, n > SSL_MAX_SID_CTX_LENGTH ? SSL_MAX_SID_CTX_LENGTH : n);
+        free(sid);
+    }
+    return JS_UNDEFINED;
+}
+
+/* tlsPkcs12(der, password | null) → [private key (PKCS#8 DER) | null, certificate (DER) | null,
+ * [the other certificates' DER, …]] | the reason it can't be read (OpenSSL's words) */
+PRIMITIVE(js_tls_pkcs12) {
+    UNUSED_ARGS;
+    const uint8_t *p;
+    size_t n;
+    if (!bytes_arg(ARG(0), &p, &n)) return js_throw_type_error(ctx, "tlsPkcs12: bytes expected");
+    char *password = string_dup(ctx, ARG(1));
+    PKCS12 *p12 = d2i_PKCS12(NULL, &p, (long)n);
+    EVP_PKEY *pkey = NULL;
+    X509 *cert = NULL;
+    STACK_OF(X509) *others = NULL;
+    bool ok = p12 && PKCS12_parse(p12, password, &pkey, &cert, &others);
+    if (password) {
+        memset(password, 0, strlen(password));
+        free(password);
+    }
+    PKCS12_free(p12);
+    if (!ok) {
+        const char *reason = ERR_reason_error_string(ERR_peek_last_error());
+        ERR_clear_error();
+        return js_new_string_cstr(ctx, reason ? reason : "Unknown error");
+    }
+    JSValue parts[3] = { JS_NULL, JS_NULL, JS_NULL };
+    if (pkey) {
+        CBB cbb;
+        uint8_t *der;
+        size_t len;
+        if (CBB_init(&cbb, 0) && EVP_marshal_private_key(&cbb, pkey) && CBB_finish(&cbb, &der, &len)) {
+            parts[0] = js_new_buffer_from_bytes(ctx, der, len);
+            OPENSSL_cleanse(der, len);
+            OPENSSL_free(der);
+        } else {
+            CBB_cleanup(&cbb);
+        }
+    }
+    uint8_t *der = NULL;
+    int len;
+    if (cert && (len = i2d_X509(cert, &der)) > 0) parts[1] = js_new_buffer_from_bytes(ctx, der, (size_t)len);
+    OPENSSL_free(der);
+    size_t count = others ? sk_X509_num(others) : 0;
+    parts[2] = js_new_array(ctx, 0);
+    for (size_t i = 0; i < count; i++) {
+        der = NULL;
+        if ((len = i2d_X509(sk_X509_value(others, i), &der)) > 0 &&
+            js_array_append(ctx, parts[2], js_new_buffer_from_bytes(ctx, der, (size_t)len)) < 0) {
+            OPENSSL_free(der);
+            parts[2] = JS_EXCEPTION;
+            break;
+        }
+        OPENSSL_free(der);
+    }
+    EVP_PKEY_free(pkey);
+    X509_free(cert);
+    sk_X509_pop_free(others, X509_free);
+    ERR_clear_error();
+    return js_is_exception(parts[2]) ? JS_EXCEPTION : js_new_array_from(ctx, parts, 3);
+}
+
+/* ---- Certificates (crypto.X509Certificate's checks, as OpenSSL's) ---------------------------------- */
+
+/* x509Check(der, kind, value, flags) → the name matched (kind 0: a host, 1: an email address,
+ * 2: an IP address) or undefined; flags are X509_CHECK_FLAG_*'s */
+PRIMITIVE(js_x509_check) {
+    UNUSED_ARGS;
+    X509 *x = x509_arg(ARG(0));
+    char *value = string_dup(ctx, ARG(2));
+    if (!x || !value || !js_is_number(ARG(1))) {
+        X509_free(x);
+        free(value);
+        ERR_clear_error();
+        return js_throw_type_error(ctx, "x509Check: a certificate, a kind and a value expected");
+    }
+    unsigned flags = js_is_number(ARG(3)) ? (unsigned)js_as_number(ARG(3)) : 0;
+    size_t n = strlen(value);
+    char *peer = NULL;
+    int r;
+    switch ((int)js_as_number(ARG(1))) {
+        case 0: r = X509_check_host(x, value, n, flags, &peer); break;
+        case 1: r = X509_check_email(x, value, n, flags); break;
+        default: r = X509_check_ip_asc(x, value, flags); break;
+    }
+    JSValue out = JS_UNDEFINED;
+    if (r == 1) out = js_new_string_utf8(ctx, peer ? peer : value, strlen(peer ? peer : value));
+    OPENSSL_free(peer);
+    free(value);
+    X509_free(x);
+    ERR_clear_error();
+    return out;
+}
+
+/* x509CheckIssued(der, issuerDer) → whether the issuer's name, key identifier and key usage fit (X509_check_issued) */
+PRIMITIVE(js_x509_check_issued) {
+    UNUSED_ARGS;
+    X509 *x = x509_arg(ARG(0)), *issuer = x509_arg(ARG(1));
+    bool ok = x && issuer && X509_check_issued(issuer, x) == X509_V_OK;
+    X509_free(x);
+    X509_free(issuer);
+    ERR_clear_error();
+    return js_bool(ok);
+}
+
+/* x509CheckKey(der, key handle) → for a public key, whether it signed the certificate; for a
+ * private one, whether it is the certificate's */
+PRIMITIVE(js_x509_check_key) {
+    UNUSED_ARGS;
+    X509 *x = x509_arg(ARG(0));
+    JSKeyData *k = js_key_data(ARG(1));
+    EVP_PKEY *pkey = k ? pkey_of(k) : NULL;
+    bool ok = x && pkey && (k->type == JS_KEY_PRIVATE ? X509_check_private_key(x, pkey) : X509_verify(x, pkey)) == 1;
+    EVP_PKEY_free(pkey);
+    X509_free(x);
+    ERR_clear_error();
+    return js_bool(ok);
+}
+
 /* ---- Connections -------------------------------------------------------------------------------- */
 
 typedef struct TlsConnData {
@@ -301,10 +497,13 @@ typedef struct TlsConnData {
     uint32_t     handshakes;
     bool         in_handshake;
     SSL_SESSION *new_session;       /* the last session (or ticket) the peer gave: tlsRun reports it once */
+    SSL_SESSION *offered_session;   /* a client's, to resume */
     bool         session_reported;
     uint8_t     *alpn;              /* a server's protocols, in the wire format */
     size_t       alpn_len;
     bool         alpn_strict;
+    bool         keylog_on;
+    JSBytesOut   keylog;            /* NSS key log lines since tlsRun last reported them */
 } TlsConnData;
 
 typedef struct TlsConnObject {
@@ -346,7 +545,9 @@ static void conn_finalize(JSRuntime *rt, JSCell *cell) {
     if (!d) return;
     SSL_free(d->ssl);  /* and its BIOs */
     SSL_SESSION_free(d->new_session);
+    SSL_SESSION_free(d->offered_session);
     free(d->alpn);
+    free(d->keylog.p);
     free(d);
 }
 
@@ -419,7 +620,7 @@ PRIMITIVE(js_tls_new) {
         if (bytes_arg(ARG(4), &sp, &spn)) {
             SSL_SESSION *s = SSL_SESSION_from_bytes(sp, spn, cx->ctx);
             if (s) SSL_set_session(d->ssl, s);
-            SSL_SESSION_free(s);
+            d->offered_session = s;  /* the reference from_bytes gave */
         }
     }
     ERR_clear_error();
@@ -437,7 +638,8 @@ static bool fatal(int e) {
 
 /* tlsRun(connection, records | null, data | null) → [records out | null, data received | null,
  * bytes of `data` taken, state (1 established, 2 failed, 4 the peer's close_notify, 8 a new
- * session to report), error ([library, reason, name] | 0), handshakes finished]: feeds the
+ * session to report), error ([library, reason, name] | 0), handshakes finished, key log lines |
+ * null]: feeds the
  * engine what it was given and runs it until it can't go on. `data` is taken once the handshake
  * is done (and not during a renegotiation); what isn't is given again later. */
 PRIMITIVE(js_tls_run) {
@@ -515,16 +717,18 @@ PRIMITIVE(js_tls_run) {
         d->session_reported = true;
         state |= TLS_NEW_SESSION;
     }
+    JSValue keylog = bytes_or_null(ctx, &d->keylog);
+    d->keylog = (JSBytesOut){ 0 };
     JSBytesOut out = { 0 };
     const uint8_t *p;
     size_t n;
     if (BIO_mem_contents(d->out, &p, &n) && n) out_append(&out, p, n);
     BIO_reset(d->out);
     ERR_clear_error();
-    JSValue items[6] = { JS_NULL, JS_NULL, js_number((double)taken), js_int32(state), err, js_number(d->handshakes) };
+    JSValue items[7] = { JS_NULL, JS_NULL, js_number((double)taken), js_int32(state), err, js_number(d->handshakes), keylog };
     items[0] = bytes_or_null(ctx, &out);
     items[1] = bytes_or_null(ctx, &app);
-    return js_new_array_from(ctx, items, 6);
+    return js_new_array_from(ctx, items, 7);
 }
 
 /* tlsShutdown(connection) → the records to send | null: our close_notify; reading goes on until
@@ -605,8 +809,9 @@ PRIMITIVE(js_tls_session) {
     UNUSED_ARGS;
     TlsConnData *d = conn_arg(ARG(0));
     if (!d || !d->established) return JS_UNDEFINED;
+    /* OpenSSL's, which Node returns: a TLS 1.3 session before its tickets too (it won't resume) */
     SSL_SESSION *s = d->new_session ? d->new_session : SSL_get_session(d->ssl);
-    if (!s || !SSL_SESSION_is_resumable(s)) return JS_UNDEFINED;
+    if (!s) return JS_UNDEFINED;
     uint8_t *p;
     size_t n;
     if (!SSL_SESSION_to_bytes(s, &p, &n)) {
@@ -618,6 +823,21 @@ PRIMITIVE(js_tls_session) {
     return v;
 }
 
+/* tlsTicket(connection) → Buffer | undefined: the session ticket a client was given */
+PRIMITIVE(js_tls_ticket) {
+    UNUSED_ARGS;
+    TlsConnData *d = conn_arg(ARG(0));
+    if (!d) return JS_UNDEFINED;
+    /* resumed, a TLS 1.3 session is a copy without the ticket: the one offered had it */
+    SSL_SESSION *s = d->new_session ? d->new_session
+                   : SSL_session_reused(d->ssl) && d->offered_session ? d->offered_session : SSL_get_session(d->ssl);
+    const uint8_t *p;
+    size_t n;
+    if (!s || !SSL_SESSION_has_ticket(s)) return JS_UNDEFINED;
+    SSL_SESSION_get0_ticket(s, &p, &n);
+    return js_new_buffer_from_bytes(ctx, p, n);
+}
+
 /* tlsExportKeyingMaterial(connection, length, label, context | undefined) → Buffer | null (RFC 5705) */
 PRIMITIVE(js_tls_export_keying_material) {
     UNUSED_ARGS;
@@ -670,9 +890,35 @@ PRIMITIVE(js_tls_ciphers) {
 
 /* tlsSetNoRenegotiation(connection): a server's requests to renegotiate are refused (BoringSSL
  * renegotiates only as a client, when a server asks; it never starts one) */
+static void on_keylog(const SSL *ssl, const char *line) {
+    TlsConnData *d = SSL_get_app_data(ssl);
+    if (!d || !d->keylog_on) return;
+    out_append(&d->keylog, line, strlen(line));
+    out_append(&d->keylog, "\n", 1);
+}
+
+/* tlsEnableKeylog(connection): its key log lines come with tlsRun's results (the 'keylog' event) */
+PRIMITIVE(js_tls_enable_keylog) {
+    UNUSED_ARGS;
+    TlsConnData *d = conn_arg(ARG(0));
+    if (!d) return JS_UNDEFINED;
+    d->keylog_on = true;
+    /* the context's: BoringSSL forms the lines only for a context that has a callback */
+    SSL_CTX_set_keylog_callback(SSL_get_SSL_CTX(d->ssl), on_keylog);
+    return JS_UNDEFINED;
+}
+
 PRIMITIVE(js_tls_set_no_renegotiation) {
     UNUSED_ARGS;
     TlsConnData *d = conn_arg(ARG(0));
     if (d && !d->server) SSL_set_renegotiate_mode(d->ssl, ssl_renegotiate_never);
     return JS_UNDEFINED;
 }
+
+/* tlsSetMaxSendFragment(connection, size): the largest record's plaintext (512 to 16384) */
+PRIMITIVE(js_tls_set_max_send_fragment) {
+    UNUSED_ARGS;
+    TlsConnData *d = conn_arg(ARG(0));
+    if (d && js_is_number(ARG(1))) SSL_set_max_send_fragment(d->ssl, (size_t)js_as_number(ARG(1)));
+    return JS_UNDEFINED;
+}