Source code
Revision control
Copy as Markdown
Other Tools
/*!
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
*
* The following bundle is from an external repository at github.com/mozilla/fxa-pairing-channel,
* it implements a shared library for two javascript environments to create an encrypted and authenticated
* communication channel by sharing a secret key and by relaying messages through a websocket server.
*
* It is used by the Firefox Accounts pairing flow, with one side of the channel being web
* content from https://accounts.firefox.com and the other side of the channel being chrome native code.
*
* This uses the event-target-shim node library published under the MIT license:
*
* Bundle generated from https://github.com/mozilla/fxa-pairing-channel.git. Hash:c8ec3119920b4ffa833b, Chunkhash:378a5f51445e7aa7630e.
*
*/
// This header provides a little bit of plumbing to use `FxAccountsPairingChannel`
// from Firefox browser code, hence the presence of these privileged browser APIs.
// If you're trying to use this from ordinary web content you're in for a bad time.
// We cannot use WebSocket from chrome code without a window,
const browser = Services.appShell.createWindowlessBrowser(true);
const {WebSocket} = browser.document.ownerGlobal;
export var FxAccountsPairingChannel =
/******/ (function(modules) { // webpackBootstrap
/******/ // The module cache
/******/ var installedModules = {};
/******/
/******/ // The require function
/******/ function __webpack_require__(moduleId) {
/******/
/******/ // Check if module is in cache
/******/ if(installedModules[moduleId]) {
/******/ return installedModules[moduleId].exports;
/******/ }
/******/ // Create a new module (and put it into the cache)
/******/ var module = installedModules[moduleId] = {
/******/ i: moduleId,
/******/ l: false,
/******/ exports: {}
/******/ };
/******/
/******/ // Execute the module function
/******/ modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
/******/
/******/ // Flag the module as loaded
/******/ module.l = true;
/******/
/******/ // Return the exports of the module
/******/ return module.exports;
/******/ }
/******/
/******/
/******/ // expose the modules object (__webpack_modules__)
/******/ __webpack_require__.m = modules;
/******/
/******/ // expose the module cache
/******/ __webpack_require__.c = installedModules;
/******/
/******/ // define getter function for harmony exports
/******/ __webpack_require__.d = function(exports, name, getter) {
/******/ if(!__webpack_require__.o(exports, name)) {
/******/ Object.defineProperty(exports, name, { enumerable: true, get: getter });
/******/ }
/******/ };
/******/
/******/ // define __esModule on exports
/******/ __webpack_require__.r = function(exports) {
/******/ if(typeof Symbol !== 'undefined' && Symbol.toStringTag) {
/******/ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
/******/ }
/******/ Object.defineProperty(exports, '__esModule', { value: true });
/******/ };
/******/
/******/ // create a fake namespace object
/******/ // mode & 1: value is a module id, require it
/******/ // mode & 2: merge all properties of value into the ns
/******/ // mode & 4: return value when already ns object
/******/ // mode & 8|1: behave like require
/******/ __webpack_require__.t = function(value, mode) {
/******/ if(mode & 1) value = __webpack_require__(value);
/******/ if(mode & 8) return value;
/******/ if((mode & 4) && typeof value === 'object' && value && value.__esModule) return value;
/******/ var ns = Object.create(null);
/******/ __webpack_require__.r(ns);
/******/ Object.defineProperty(ns, 'default', { enumerable: true, value: value });
/******/ if(mode & 2 && typeof value != 'string') for(var key in value) __webpack_require__.d(ns, key, function(key) { return value[key]; }.bind(null, key));
/******/ return ns;
/******/ };
/******/
/******/ // getDefaultExport function for compatibility with non-harmony modules
/******/ __webpack_require__.n = function(module) {
/******/ var getter = module && module.__esModule ?
/******/ function getDefault() { return module['default']; } :
/******/ function getModuleExports() { return module; };
/******/ __webpack_require__.d(getter, 'a', getter);
/******/ return getter;
/******/ };
/******/
/******/ // Object.prototype.hasOwnProperty.call
/******/ __webpack_require__.o = function(object, property) { return Object.prototype.hasOwnProperty.call(object, property); };
/******/
/******/ // __webpack_public_path__
/******/ __webpack_require__.p = "";
/******/
/******/
/******/ // Load entry module and return exports
/******/ return __webpack_require__(__webpack_require__.s = 0);
/******/ })
/************************************************************************/
/******/ ([
/* 0 */
/***/ (function(module, __webpack_exports__, __webpack_require__) {
"use strict";
// ESM COMPAT FLAG
__webpack_require__.r(__webpack_exports__);
// EXPORTS
__webpack_require__.d(__webpack_exports__, "PairingChannel", function() { return /* binding */ src_PairingChannel; });
__webpack_require__.d(__webpack_exports__, "base64urlToBytes", function() { return /* reexport */ base64urlToBytes; });
__webpack_require__.d(__webpack_exports__, "bytesToBase64url", function() { return /* reexport */ bytesToBase64url; });
__webpack_require__.d(__webpack_exports__, "bytesToHex", function() { return /* reexport */ bytesToHex; });
__webpack_require__.d(__webpack_exports__, "bytesToUtf8", function() { return /* reexport */ bytesToUtf8; });
__webpack_require__.d(__webpack_exports__, "hexToBytes", function() { return /* reexport */ hexToBytes; });
__webpack_require__.d(__webpack_exports__, "TLSCloseNotify", function() { return /* reexport */ TLSCloseNotify; });
__webpack_require__.d(__webpack_exports__, "TLSError", function() { return /* reexport */ TLSError; });
__webpack_require__.d(__webpack_exports__, "utf8ToBytes", function() { return /* reexport */ utf8ToBytes; });
__webpack_require__.d(__webpack_exports__, "_internals", function() { return /* binding */ _internals; });
// CONCATENATED MODULE: ./src/alerts.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
/* eslint-disable sorting/sort-object-props */
const ALERT_LEVEL = {
WARNING: 1,
FATAL: 2
};
const ALERT_DESCRIPTION = {
CLOSE_NOTIFY: 0,
UNEXPECTED_MESSAGE: 10,
BAD_RECORD_MAC: 20,
RECORD_OVERFLOW: 22,
HANDSHAKE_FAILURE: 40,
ILLEGAL_PARAMETER: 47,
DECODE_ERROR: 50,
DECRYPT_ERROR: 51,
PROTOCOL_VERSION: 70,
INTERNAL_ERROR: 80,
MISSING_EXTENSION: 109,
UNSUPPORTED_EXTENSION: 110,
UNKNOWN_PSK_IDENTITY: 115,
NO_APPLICATION_PROTOCOL: 120,
};
/* eslint-enable sorting/sort-object-props */
function alertTypeToName(type) {
for (const name in ALERT_DESCRIPTION) {
if (ALERT_DESCRIPTION[name] === type) {
return `${name} (${type})`;
}
}
return `UNKNOWN (${type})`;
}
class TLSAlert extends Error {
constructor(description, level) {
super(`TLS Alert: ${alertTypeToName(description)}`);
this.description = description;
this.level = level;
}
static fromBytes(bytes) {
if (bytes.byteLength !== 2) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
switch (bytes[1]) {
case ALERT_DESCRIPTION.CLOSE_NOTIFY:
if (bytes[0] !== ALERT_LEVEL.WARNING) {
// Close notifications should be fatal.
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
return new TLSCloseNotify();
default:
return new TLSError(bytes[1]);
}
}
toBytes() {
return new Uint8Array([this.level, this.description]);
}
}
class TLSCloseNotify extends TLSAlert {
constructor() {
super(ALERT_DESCRIPTION.CLOSE_NOTIFY, ALERT_LEVEL.WARNING);
}
}
class TLSError extends TLSAlert {
constructor(description = ALERT_DESCRIPTION.INTERNAL_ERROR) {
super(description, ALERT_LEVEL.FATAL);
}
}
// CONCATENATED MODULE: ./src/utils.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
//
// Various low-level utility functions.
//
// These are mostly conveniences for working with Uint8Arrays as
// the primitive "bytes" type.
//
const UTF8_ENCODER = new TextEncoder();
const UTF8_DECODER = new TextDecoder();
function noop() {}
function assert(cond, msg) {
if (! cond) {
throw new Error('assert failed: ' + msg);
}
}
function assertIsBytes(value, msg = 'value must be a Uint8Array') {
// Using `value instanceof Uint8Array` seems to fail in Firefox chrome code
// for inscrutable reasons, so we do a less direct check.
assert(ArrayBuffer.isView(value), msg);
assert(value.BYTES_PER_ELEMENT === 1, msg);
return value;
}
const EMPTY = new Uint8Array(0);
function zeros(n) {
return new Uint8Array(n);
}
function arrayToBytes(value) {
return new Uint8Array(value);
}
function bytesToHex(bytes) {
return Array.prototype.map.call(bytes, byte => {
let s = byte.toString(16);
if (s.length === 1) {
s = '0' + s;
}
return s;
}).join('');
}
function hexToBytes(hexstr) {
assert(hexstr.length % 2 === 0, 'hexstr.length must be even');
return new Uint8Array(Array.prototype.map.call(hexstr, (c, n) => {
if (n % 2 === 1) {
return hexstr[n - 1] + c;
} else {
return '';
}
}).filter(s => {
return !! s;
}).map(s => {
return parseInt(s, 16);
}));
}
function bytesToUtf8(bytes) {
return UTF8_DECODER.decode(bytes);
}
function utf8ToBytes(str) {
return UTF8_ENCODER.encode(str);
}
function bytesToBase64url(bytes) {
// XXX TODO: try to use something constant-time, in case calling code
// uses it to encode secrets?
const charCodes = String.fromCharCode.apply(String, bytes);
return btoa(charCodes).replace(/\+/g, '-').replace(/\//g, '_');
}
function base64urlToBytes(str) {
// XXX TODO: try to use something constant-time, in case calling code
// uses it to decode secrets?
str = atob(str.replace(/-/g, '+').replace(/_/g, '/'));
const bytes = new Uint8Array(str.length);
for (let i = 0; i < str.length; i++) {
bytes[i] = str.charCodeAt(i);
}
return bytes;
}
function bytesAreEqual(v1, v2) {
assertIsBytes(v1);
assertIsBytes(v2);
if (v1.length !== v2.length) {
return false;
}
for (let i = 0; i < v1.length; i++) {
if (v1[i] !== v2[i]) {
return false;
}
}
return true;
}
// The `BufferReader` and `BufferWriter` classes are helpers for dealing with the
// binary struct format that's used for various TLS message. Think of them as a
// buffer with a pointer to the "current position" and a bunch of helper methods
// to read/write structured data and advance said pointer.
class utils_BufferWithPointer {
constructor(buf) {
this._buffer = buf;
this._dataview = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
this._pos = 0;
}
length() {
return this._buffer.byteLength;
}
tell() {
return this._pos;
}
seek(pos) {
if (pos < 0) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
if (pos > this.length()) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
this._pos = pos;
}
incr(offset) {
this.seek(this._pos + offset);
}
}
// The `BufferReader` class helps you read structured data from a byte array.
// It offers methods for reading both primitive values, and the variable-length
//
// Such vectors are represented as a length followed by the concatenated
// bytes of each item, and the size of the length field is determined by
// the maximum allowed number of bytes in the vector. For example
// to read a vector that may contain up to 65535 bytes, use `readVector16`.
//
// To read a variable-length vector of between 1 and 100 uint16 values,
// defined in the RFC like this:
//
// uint16 items<2..200>;
//
// You would do something like this:
//
// const items = []
// buf.readVector8(buf => {
// items.push(buf.readUint16())
// })
//
// The various `read` will throw `DECODE_ERROR` if you attempt to read path
// the end of the buffer, or past the end of a variable-length list.
//
class utils_BufferReader extends utils_BufferWithPointer {
hasMoreBytes() {
return this.tell() < this.length();
}
readBytes(length) {
// This avoids copies by returning a view onto the existing buffer.
const start = this._buffer.byteOffset + this.tell();
this.incr(length);
return new Uint8Array(this._buffer.buffer, start, length);
}
_rangeErrorToAlert(cb) {
try {
return cb(this);
} catch (err) {
if (err instanceof RangeError) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
throw err;
}
}
readUint8() {
return this._rangeErrorToAlert(() => {
const n = this._dataview.getUint8(this._pos);
this.incr(1);
return n;
});
}
readUint16() {
return this._rangeErrorToAlert(() => {
const n = this._dataview.getUint16(this._pos);
this.incr(2);
return n;
});
}
readUint24() {
return this._rangeErrorToAlert(() => {
let n = this._dataview.getUint16(this._pos);
n = (n << 8) | this._dataview.getUint8(this._pos + 2);
this.incr(3);
return n;
});
}
readUint32() {
return this._rangeErrorToAlert(() => {
const n = this._dataview.getUint32(this._pos);
this.incr(4);
return n;
});
}
_readVector(length, cb) {
const contentsBuf = new utils_BufferReader(this.readBytes(length));
const expectedEnd = this.tell();
// Keep calling the callback until we've consumed the expected number of bytes.
let n = 0;
while (contentsBuf.hasMoreBytes()) {
const prevPos = contentsBuf.tell();
cb(contentsBuf, n);
// Check that the callback made forward progress, otherwise we'll infinite loop.
if (contentsBuf.tell() <= prevPos) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
n += 1;
}
// Check that the callback correctly consumed the vector's entire contents.
if (this.tell() !== expectedEnd) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
}
readVector8(cb) {
const length = this.readUint8();
return this._readVector(length, cb);
}
readVector16(cb) {
const length = this.readUint16();
return this._readVector(length, cb);
}
readVector24(cb) {
const length = this.readUint24();
return this._readVector(length, cb);
}
readVectorBytes8() {
return this.readBytes(this.readUint8());
}
readVectorBytes16() {
return this.readBytes(this.readUint16());
}
readVectorBytes24() {
return this.readBytes(this.readUint24());
}
}
class utils_BufferWriter extends utils_BufferWithPointer {
constructor(size = 1024) {
super(new Uint8Array(size));
}
_maybeGrow(n) {
const curSize = this._buffer.byteLength;
const newPos = this._pos + n;
const shortfall = newPos - curSize;
if (shortfall > 0) {
// Classic grow-by-doubling, up to 4kB max increment.
// This formula was not arrived at by any particular science.
const incr = Math.min(curSize, 4 * 1024);
const newbuf = new Uint8Array(curSize + Math.ceil(shortfall / incr) * incr);
newbuf.set(this._buffer, 0);
this._buffer = newbuf;
this._dataview = new DataView(newbuf.buffer, newbuf.byteOffset, newbuf.byteLength);
}
}
slice(start = 0, end = this.tell()) {
if (end < 0) {
end = this.tell() + end;
}
if (start < 0) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
if (end < 0) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
if (end > this.length()) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
return this._buffer.slice(start, end);
}
flush() {
const slice = this.slice();
this.seek(0);
return slice;
}
writeBytes(data) {
this._maybeGrow(data.byteLength);
this._buffer.set(data, this.tell());
this.incr(data.byteLength);
}
writeUint8(n) {
this._maybeGrow(1);
this._dataview.setUint8(this._pos, n);
this.incr(1);
}
writeUint16(n) {
this._maybeGrow(2);
this._dataview.setUint16(this._pos, n);
this.incr(2);
}
writeUint24(n) {
this._maybeGrow(3);
this._dataview.setUint16(this._pos, n >> 8);
this._dataview.setUint8(this._pos + 2, n & 0xFF);
this.incr(3);
}
writeUint32(n) {
this._maybeGrow(4);
this._dataview.setUint32(this._pos, n);
this.incr(4);
}
// These are helpers for writing the variable-length vector structure
//
// Such vectors are represented as a length followed by the concatenated
// bytes of each item, and the size of the length field is determined by
// the maximum allowed size of the vector. For example to write a vector
// that may contain up to 65535 bytes, use `writeVector16`.
//
// To write a variable-length vector of between 1 and 100 uint16 values,
// defined in the RFC like this:
//
// uint16 items<2..200>;
//
// You would do something like this:
//
// buf.writeVector8(buf => {
// for (let item of items) {
// buf.writeUint16(item)
// }
// })
//
// The helper will automatically take care of writing the appropriate
// length field once the callback completes.
_writeVector(maxLength, writeLength, cb) {
// Initially, write the length field as zero.
const lengthPos = this.tell();
writeLength(0);
// Call the callback to write the vector items.
const bodyPos = this.tell();
cb(this);
const length = this.tell() - bodyPos;
if (length >= maxLength) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
// Backfill the actual length field.
this.seek(lengthPos);
writeLength(length);
this.incr(length);
return length;
}
writeVector8(cb) {
return this._writeVector(Math.pow(2, 8), len => this.writeUint8(len), cb);
}
writeVector16(cb) {
return this._writeVector(Math.pow(2, 16), len => this.writeUint16(len), cb);
}
writeVector24(cb) {
return this._writeVector(Math.pow(2, 24), len => this.writeUint24(len), cb);
}
writeVectorBytes8(bytes) {
return this.writeVector8(buf => {
buf.writeBytes(bytes);
});
}
writeVectorBytes16(bytes) {
return this.writeVector16(buf => {
buf.writeBytes(bytes);
});
}
writeVectorBytes24(bytes) {
return this.writeVector24(buf => {
buf.writeBytes(bytes);
});
}
}
// CONCATENATED MODULE: ./src/crypto.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
//
// Low-level crypto primitives.
//
// This file implements the AEAD encrypt/decrypt and hashing routines
// for the TLS_AES_128_GCM_SHA256 ciphersuite. They are (thankfully)
// fairly light-weight wrappers around what's available via the WebCrypto
// API.
//
const AEAD_SIZE_INFLATION = 16;
const KEY_LENGTH = 16;
const IV_LENGTH = 12;
const HASH_LENGTH = 32;
async function prepareKey(key, mode) {
return crypto.subtle.importKey('raw', key, { name: 'AES-GCM' }, false, [mode]);
}
async function encrypt(key, iv, plaintext, additionalData) {
const ciphertext = await crypto.subtle.encrypt({
additionalData,
iv,
name: 'AES-GCM',
tagLength: AEAD_SIZE_INFLATION * 8
}, key, plaintext);
return new Uint8Array(ciphertext);
}
async function decrypt(key, iv, ciphertext, additionalData) {
try {
const plaintext = await crypto.subtle.decrypt({
additionalData,
iv,
name: 'AES-GCM',
tagLength: AEAD_SIZE_INFLATION * 8
}, key, ciphertext);
return new Uint8Array(plaintext);
} catch (err) {
// Yes, we really do throw 'decrypt_error' when failing to verify a HMAC,
// and a 'bad_record_mac' error when failing to decrypt.
throw new TLSError(ALERT_DESCRIPTION.BAD_RECORD_MAC);
}
}
async function hash(message) {
return new Uint8Array(await crypto.subtle.digest({ name: 'SHA-256' }, message));
}
async function hmac(keyBytes, message) {
const key = await crypto.subtle.importKey('raw', keyBytes, {
hash: { name: 'SHA-256' },
name: 'HMAC',
}, false, ['sign']);
const sig = await crypto.subtle.sign({ name: 'HMAC' }, key, message);
return new Uint8Array(sig);
}
async function verifyHmac(keyBytes, signature, message) {
const key = await crypto.subtle.importKey('raw', keyBytes, {
hash: { name: 'SHA-256' },
name: 'HMAC',
}, false, ['verify']);
if (! (await crypto.subtle.verify({ name: 'HMAC' }, key, signature, message))) {
// Yes, we really do throw 'decrypt_error' when failing to verify a HMAC,
// and a 'bad_record_mac' error when failing to decrypt.
throw new TLSError(ALERT_DESCRIPTION.DECRYPT_ERROR);
}
}
async function hkdfExtract(salt, ikm) {
return await hmac(salt, ikm);
}
async function hkdfExpand(prk, info, length) {
const N = Math.ceil(length / HASH_LENGTH);
if (N <= 0) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
if (N >= 255) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
const input = new utils_BufferWriter();
const output = new utils_BufferWriter();
let T = new Uint8Array(0);
for (let i = 1; i <= N; i++) {
input.writeBytes(T);
input.writeBytes(info);
input.writeUint8(i);
T = await hmac(prk, input.flush());
output.writeBytes(T);
}
return output.slice(0, length);
}
async function hkdfExpandLabel(secret, label, context, length) {
// struct {
// uint16 length = Length;
// opaque label < 7..255 > = "tls13 " + Label;
// opaque context < 0..255 > = Context;
// } HkdfLabel;
const hkdfLabel = new utils_BufferWriter();
hkdfLabel.writeUint16(length);
hkdfLabel.writeVectorBytes8(utf8ToBytes('tls13 ' + label));
hkdfLabel.writeVectorBytes8(context);
return hkdfExpand(secret, hkdfLabel.flush(), length);
}
async function getRandomBytes(size) {
const bytes = new Uint8Array(size);
crypto.getRandomValues(bytes);
return bytes;
}
// CONCATENATED MODULE: ./src/extensions.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
//
// Extension parsing.
//
// This file contains some helpers for reading/writing the various kinds
// of Extension that might appear in a HandshakeMessage.
//
// "Extensions" are how TLS signals the presence of particular bits of optional
// functionality in the protocol. Lots of parts of TLS1.3 that don't seem like
// they're optional are implemented in terms of an extension, IIUC because that's
// what was needed for a clean deployment in amongst earlier versions of the protocol.
//
/* eslint-disable sorting/sort-object-props */
const EXTENSION_TYPE = {
PRE_SHARED_KEY: 41,
SUPPORTED_VERSIONS: 43,
PSK_KEY_EXCHANGE_MODES: 45,
};
/* eslint-enable sorting/sort-object-props */
// Base class for generic reading/writing of extensions,
// which are all uniformly formatted as:
//
// struct {
// ExtensionType extension_type;
// opaque extension_data<0..2^16-1>;
// } Extension;
//
// Extensions always appear inside of a handshake message,
// and their internal structure may differ based on the
// type of that message.
class extensions_Extension {
get TYPE_TAG() {
throw new Error('not implemented');
}
static read(messageType, buf) {
const type = buf.readUint16();
let ext = {
TYPE_TAG: type,
};
buf.readVector16(buf => {
switch (type) {
case EXTENSION_TYPE.PRE_SHARED_KEY:
ext = extensions_PreSharedKeyExtension._read(messageType, buf);
break;
case EXTENSION_TYPE.SUPPORTED_VERSIONS:
ext = extensions_SupportedVersionsExtension._read(messageType, buf);
break;
case EXTENSION_TYPE.PSK_KEY_EXCHANGE_MODES:
ext = extensions_PskKeyExchangeModesExtension._read(messageType, buf);
break;
default:
// Skip over unrecognised extensions.
buf.incr(buf.length());
}
if (buf.hasMoreBytes()) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
});
return ext;
}
write(messageType, buf) {
buf.writeUint16(this.TYPE_TAG);
buf.writeVector16(buf => {
this._write(messageType, buf);
});
}
static _read(messageType, buf) {
throw new Error('not implemented');
}
static _write(messageType, buf) {
throw new Error('not implemented');
}
}
// The PreSharedKey extension:
//
// struct {
// opaque identity<1..2^16-1>;
// uint32 obfuscated_ticket_age;
// } PskIdentity;
// opaque PskBinderEntry<32..255>;
// struct {
// PskIdentity identities<7..2^16-1>;
// PskBinderEntry binders<33..2^16-1>;
// } OfferedPsks;
// struct {
// select(Handshake.msg_type) {
// case client_hello: OfferedPsks;
// case server_hello: uint16 selected_identity;
// };
// } PreSharedKeyExtension;
class extensions_PreSharedKeyExtension extends extensions_Extension {
constructor(identities, binders, selectedIdentity) {
super();
this.identities = identities;
this.binders = binders;
this.selectedIdentity = selectedIdentity;
}
get TYPE_TAG() {
return EXTENSION_TYPE.PRE_SHARED_KEY;
}
static _read(messageType, buf) {
let identities = null, binders = null, selectedIdentity = null;
switch (messageType) {
case HANDSHAKE_TYPE.CLIENT_HELLO:
identities = []; binders = [];
buf.readVector16(buf => {
const identity = buf.readVectorBytes16();
buf.readBytes(4); // Skip over the ticket age.
identities.push(identity);
});
buf.readVector16(buf => {
const binder = buf.readVectorBytes8();
if (binder.byteLength < HASH_LENGTH) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
binders.push(binder);
});
if (identities.length !== binders.length) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
break;
case HANDSHAKE_TYPE.SERVER_HELLO:
selectedIdentity = buf.readUint16();
break;
default:
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
return new this(identities, binders, selectedIdentity);
}
_write(messageType, buf) {
switch (messageType) {
case HANDSHAKE_TYPE.CLIENT_HELLO:
buf.writeVector16(buf => {
this.identities.forEach(pskId => {
buf.writeVectorBytes16(pskId);
buf.writeUint32(0); // Zero for "tag age" field.
});
});
buf.writeVector16(buf => {
this.binders.forEach(pskBinder => {
buf.writeVectorBytes8(pskBinder);
});
});
break;
case HANDSHAKE_TYPE.SERVER_HELLO:
buf.writeUint16(this.selectedIdentity);
break;
default:
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
}
}
// The SupportedVersions extension:
//
// struct {
// select(Handshake.msg_type) {
// case client_hello:
// ProtocolVersion versions < 2..254 >;
// case server_hello:
// ProtocolVersion selected_version;
// };
// } SupportedVersions;
class extensions_SupportedVersionsExtension extends extensions_Extension {
constructor(versions, selectedVersion) {
super();
this.versions = versions;
this.selectedVersion = selectedVersion;
}
get TYPE_TAG() {
return EXTENSION_TYPE.SUPPORTED_VERSIONS;
}
static _read(messageType, buf) {
let versions = null, selectedVersion = null;
switch (messageType) {
case HANDSHAKE_TYPE.CLIENT_HELLO:
versions = [];
buf.readVector8(buf => {
versions.push(buf.readUint16());
});
break;
case HANDSHAKE_TYPE.SERVER_HELLO:
selectedVersion = buf.readUint16();
break;
default:
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
return new this(versions, selectedVersion);
}
_write(messageType, buf) {
switch (messageType) {
case HANDSHAKE_TYPE.CLIENT_HELLO:
buf.writeVector8(buf => {
this.versions.forEach(version => {
buf.writeUint16(version);
});
});
break;
case HANDSHAKE_TYPE.SERVER_HELLO:
buf.writeUint16(this.selectedVersion);
break;
default:
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
}
}
class extensions_PskKeyExchangeModesExtension extends extensions_Extension {
constructor(modes) {
super();
this.modes = modes;
}
get TYPE_TAG() {
return EXTENSION_TYPE.PSK_KEY_EXCHANGE_MODES;
}
static _read(messageType, buf) {
const modes = [];
switch (messageType) {
case HANDSHAKE_TYPE.CLIENT_HELLO:
buf.readVector8(buf => {
modes.push(buf.readUint8());
});
break;
default:
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
return new this(modes);
}
_write(messageType, buf) {
switch (messageType) {
case HANDSHAKE_TYPE.CLIENT_HELLO:
buf.writeVector8(buf => {
this.modes.forEach(mode => {
buf.writeUint8(mode);
});
});
break;
default:
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
}
}
// CONCATENATED MODULE: ./src/constants.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
const VERSION_TLS_1_0 = 0x0301;
const VERSION_TLS_1_2 = 0x0303;
const VERSION_TLS_1_3 = 0x0304;
const TLS_AES_128_GCM_SHA256 = 0x1301;
const PSK_MODE_KE = 0;
// CONCATENATED MODULE: ./src/messages.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
//
// Message parsing.
//
// Herein we have code for reading and writing the various Handshake
// messages involved in the TLS protocol.
//
/* eslint-disable sorting/sort-object-props */
const HANDSHAKE_TYPE = {
CLIENT_HELLO: 1,
SERVER_HELLO: 2,
NEW_SESSION_TICKET: 4,
ENCRYPTED_EXTENSIONS: 8,
FINISHED: 20,
};
/* eslint-enable sorting/sort-object-props */
// Base class for generic reading/writing of handshake messages,
// which are all uniformly formatted as:
//
// struct {
// HandshakeType msg_type; /* handshake type */
// uint24 length; /* bytes in message */
// select(Handshake.msg_type) {
// ... type specific cases here ...
// };
// } Handshake;
class messages_HandshakeMessage {
get TYPE_TAG() {
throw new Error('not implemented');
}
static fromBytes(bytes) {
// Each handshake message has a type and length prefix, per
const buf = new utils_BufferReader(bytes);
const msg = this.read(buf);
if (buf.hasMoreBytes()) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
return msg;
}
toBytes() {
const buf = new utils_BufferWriter();
this.write(buf);
return buf.flush();
}
static read(buf) {
const type = buf.readUint8();
let msg = null;
buf.readVector24(buf => {
switch (type) {
case HANDSHAKE_TYPE.CLIENT_HELLO:
msg = messages_ClientHello._read(buf);
break;
case HANDSHAKE_TYPE.SERVER_HELLO:
msg = messages_ServerHello._read(buf);
break;
case HANDSHAKE_TYPE.NEW_SESSION_TICKET:
msg = messages_NewSessionTicket._read(buf);
break;
case HANDSHAKE_TYPE.ENCRYPTED_EXTENSIONS:
msg = EncryptedExtensions._read(buf);
break;
case HANDSHAKE_TYPE.FINISHED:
msg = messages_Finished._read(buf);
break;
}
if (buf.hasMoreBytes()) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
});
if (msg === null) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
return msg;
}
write(buf) {
buf.writeUint8(this.TYPE_TAG);
buf.writeVector24(buf => {
this._write(buf);
});
}
static _read(buf) {
throw new Error('not implemented');
}
_write(buf) {
throw new Error('not implemented');
}
// Some little helpers for reading a list of extensions,
// which is uniformly represented as:
//
// Extension extensions<8..2^16-1>;
//
// Recognized extensions are returned as a Map from extension type
// to extension data object, with a special `lastSeenExtension`
// property to make it easy to check which one came last.
static _readExtensions(messageType, buf) {
const extensions = new Map();
buf.readVector16(buf => {
const ext = extensions_Extension.read(messageType, buf);
if (extensions.has(ext.TYPE_TAG)) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
extensions.set(ext.TYPE_TAG, ext);
extensions.lastSeenExtension = ext.TYPE_TAG;
});
return extensions;
}
_writeExtensions(buf, extensions) {
buf.writeVector16(buf => {
extensions.forEach(ext => {
ext.write(this.TYPE_TAG, buf);
});
});
}
}
// The ClientHello message:
//
// struct {
// ProtocolVersion legacy_version = 0x0303;
// Random random;
// opaque legacy_session_id<0..32>;
// CipherSuite cipher_suites<2..2^16-2>;
// opaque legacy_compression_methods<1..2^8-1>;
// Extension extensions<8..2^16-1>;
// } ClientHello;
class messages_ClientHello extends messages_HandshakeMessage {
constructor(random, sessionId, extensions) {
super();
this.random = random;
this.sessionId = sessionId;
this.extensions = extensions;
}
get TYPE_TAG() {
return HANDSHAKE_TYPE.CLIENT_HELLO;
}
static _read(buf) {
// The legacy_version field may indicate an earlier version of TLS
// for backwards compatibility, but must not predate TLS 1.0!
if (buf.readUint16() < VERSION_TLS_1_0) {
throw new TLSError(ALERT_DESCRIPTION.PROTOCOL_VERSION);
}
// The random bytes provided by the peer.
const random = buf.readBytes(32);
// Read legacy_session_id, so the server can echo it.
const sessionId = buf.readVectorBytes8();
// We only support a single ciphersuite, but the peer may offer several.
// Scan the list to confirm that the one we want is present.
let found = false;
buf.readVector16(buf => {
const cipherSuite = buf.readUint16();
if (cipherSuite === TLS_AES_128_GCM_SHA256) {
found = true;
}
});
if (! found) {
throw new TLSError(ALERT_DESCRIPTION.HANDSHAKE_FAILURE);
}
// legacy_compression_methods must be a single zero byte for TLS1.3 ClientHellos.
// It can be non-zero in previous versions of TLS, but we're not going to
// make a successful handshake with such versions, so better to just bail out now.
const legacyCompressionMethods = buf.readVectorBytes8();
if (legacyCompressionMethods.byteLength !== 1) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
if (legacyCompressionMethods[0] !== 0x00) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
// Read and check the extensions.
const extensions = this._readExtensions(HANDSHAKE_TYPE.CLIENT_HELLO, buf);
if (! extensions.has(EXTENSION_TYPE.SUPPORTED_VERSIONS)) {
throw new TLSError(ALERT_DESCRIPTION.MISSING_EXTENSION);
}
if (extensions.get(EXTENSION_TYPE.SUPPORTED_VERSIONS).versions.indexOf(VERSION_TLS_1_3) === -1) {
throw new TLSError(ALERT_DESCRIPTION.PROTOCOL_VERSION);
}
// Was the PreSharedKey extension the last one?
if (extensions.has(EXTENSION_TYPE.PRE_SHARED_KEY)) {
if (extensions.lastSeenExtension !== EXTENSION_TYPE.PRE_SHARED_KEY) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
}
return new this(random, sessionId, extensions);
}
_write(buf) {
buf.writeUint16(VERSION_TLS_1_2);
buf.writeBytes(this.random);
buf.writeVectorBytes8(this.sessionId);
// Our single supported ciphersuite
buf.writeVector16(buf => {
buf.writeUint16(TLS_AES_128_GCM_SHA256);
});
// A single zero byte for legacy_compression_methods
buf.writeVectorBytes8(new Uint8Array(1));
this._writeExtensions(buf, this.extensions);
}
}
// The ServerHello message:
//
// struct {
// ProtocolVersion legacy_version = 0x0303; /* TLS v1.2 */
// Random random;
// opaque legacy_session_id_echo<0..32>;
// CipherSuite cipher_suite;
// uint8 legacy_compression_method = 0;
// Extension extensions < 6..2 ^ 16 - 1 >;
// } ServerHello;
class messages_ServerHello extends messages_HandshakeMessage {
constructor(random, sessionId, extensions) {
super();
this.random = random;
this.sessionId = sessionId;
this.extensions = extensions;
}
get TYPE_TAG() {
return HANDSHAKE_TYPE.SERVER_HELLO;
}
static _read(buf) {
// Fixed value for legacy_version.
if (buf.readUint16() !== VERSION_TLS_1_2) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
// Random bytes from the server.
const random = buf.readBytes(32);
// It should have echoed our vector for legacy_session_id.
const sessionId = buf.readVectorBytes8();
// It should have selected our single offered ciphersuite.
if (buf.readUint16() !== TLS_AES_128_GCM_SHA256) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
// legacy_compression_method must be zero.
if (buf.readUint8() !== 0) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
const extensions = this._readExtensions(HANDSHAKE_TYPE.SERVER_HELLO, buf);
if (! extensions.has(EXTENSION_TYPE.SUPPORTED_VERSIONS)) {
throw new TLSError(ALERT_DESCRIPTION.MISSING_EXTENSION);
}
if (extensions.get(EXTENSION_TYPE.SUPPORTED_VERSIONS).selectedVersion !== VERSION_TLS_1_3) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
return new this(random, sessionId, extensions);
}
_write(buf) {
buf.writeUint16(VERSION_TLS_1_2);
buf.writeBytes(this.random);
buf.writeVectorBytes8(this.sessionId);
// Our single supported ciphersuite
buf.writeUint16(TLS_AES_128_GCM_SHA256);
// A single zero byte for legacy_compression_method
buf.writeUint8(0);
this._writeExtensions(buf, this.extensions);
}
}
// The EncryptedExtensions message:
//
// struct {
// Extension extensions < 0..2 ^ 16 - 1 >;
// } EncryptedExtensions;
//
// We don't actually send any EncryptedExtensions,
// but still have to send an empty message.
class EncryptedExtensions extends messages_HandshakeMessage {
constructor(extensions) {
super();
this.extensions = extensions;
}
get TYPE_TAG() {
return HANDSHAKE_TYPE.ENCRYPTED_EXTENSIONS;
}
static _read(buf) {
const extensions = this._readExtensions(HANDSHAKE_TYPE.ENCRYPTED_EXTENSIONS, buf);
return new this(extensions);
}
_write(buf) {
this._writeExtensions(buf, this.extensions);
}
}
// The Finished message:
//
// struct {
// opaque verify_data[Hash.length];
// } Finished;
class messages_Finished extends messages_HandshakeMessage {
constructor(verifyData) {
super();
this.verifyData = verifyData;
}
get TYPE_TAG() {
return HANDSHAKE_TYPE.FINISHED;
}
static _read(buf) {
const verifyData = buf.readBytes(HASH_LENGTH);
return new this(verifyData);
}
_write(buf) {
buf.writeBytes(this.verifyData);
}
}
// The NewSessionTicket message:
//
// struct {
// uint32 ticket_lifetime;
// uint32 ticket_age_add;
// opaque ticket_nonce < 0..255 >;
// opaque ticket < 1..2 ^ 16 - 1 >;
// Extension extensions < 0..2 ^ 16 - 2 >;
// } NewSessionTicket;
//
// We don't actually make use of these, but we need to be able
// to accept them and do basic validation.
class messages_NewSessionTicket extends messages_HandshakeMessage {
constructor(ticketLifetime, ticketAgeAdd, ticketNonce, ticket, extensions) {
super();
this.ticketLifetime = ticketLifetime;
this.ticketAgeAdd = ticketAgeAdd;
this.ticketNonce = ticketNonce;
this.ticket = ticket;
this.extensions = extensions;
}
get TYPE_TAG() {
return HANDSHAKE_TYPE.NEW_SESSION_TICKET;
}
static _read(buf) {
const ticketLifetime = buf.readUint32();
const ticketAgeAdd = buf.readUint32();
const ticketNonce = buf.readVectorBytes8();
const ticket = buf.readVectorBytes16();
if (ticket.byteLength < 1) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
const extensions = this._readExtensions(HANDSHAKE_TYPE.NEW_SESSION_TICKET, buf);
return new this(ticketLifetime, ticketAgeAdd, ticketNonce, ticket, extensions);
}
_write(buf) {
buf.writeUint32(this.ticketLifetime);
buf.writeUint32(this.ticketAgeAdd);
buf.writeVectorBytes8(this.ticketNonce);
buf.writeVectorBytes16(this.ticket);
this._writeExtensions(buf, this.extensions);
}
}
// CONCATENATED MODULE: ./src/states.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
//
// State-machine for TLS Handshake Management.
//
// Internally, we manage the TLS connection by explicitly modelling the
// client and server state-machines from RFC8446. You can think of
// these `State` objects as little plugins for the `Connection` class
// that provide different behaviours of `send` and `receive` depending
// on the state of the connection.
//
class states_State {
constructor(conn) {
this.conn = conn;
}
async initialize() {
// By default, nothing to do when entering the state.
}
async sendApplicationData(bytes) {
// By default, assume we're not ready to send yet and the caller
// should be blocking on the connection promise before reaching here.
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
async recvApplicationData(bytes) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
async recvHandshakeMessage(msg) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
async recvAlertMessage(alert) {
switch (alert.description) {
case ALERT_DESCRIPTION.CLOSE_NOTIFY:
this.conn._closeForRecv(alert);
throw alert;
default:
return await this.handleErrorAndRethrow(alert);
}
}
async recvChangeCipherSpec(bytes) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
async handleErrorAndRethrow(err) {
let alert = err;
if (! (alert instanceof TLSAlert)) {
alert = new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
// Try to send error alert to the peer, but we may not
// be able to if the outgoing connection was already closed.
try {
await this.conn._sendAlertMessage(alert);
} catch (_) { }
await this.conn._transition(ERROR, err);
throw err;
}
async close() {
const alert = new TLSCloseNotify();
await this.conn._sendAlertMessage(alert);
this.conn._closeForSend(alert);
}
}
// A special "guard" state to prevent us from using
// an improperly-initialized Connection.
class UNINITIALIZED extends states_State {
async initialize() {
throw new Error('uninitialized state');
}
async sendApplicationData(bytes) {
throw new Error('uninitialized state');
}
async recvApplicationData(bytes) {
throw new Error('uninitialized state');
}
async recvHandshakeMessage(msg) {
throw new Error('uninitialized state');
}
async recvChangeCipherSpec(bytes) {
throw new Error('uninitialized state');
}
async handleErrorAndRethrow(err) {
throw err;
}
async close() {
throw new Error('uninitialized state');
}
}
// A special "error" state for when something goes wrong.
// This state never transitions to another state, effectively
// terminating the connection.
class ERROR extends states_State {
async initialize(err) {
this.error = err;
this.conn._setConnectionFailure(err);
// Unceremoniously shut down the record layer on error.
this.conn._recordlayer.setSendError(err);
this.conn._recordlayer.setRecvError(err);
}
async sendApplicationData(bytes) {
throw this.error;
}
async recvApplicationData(bytes) {
throw this.error;
}
async recvHandshakeMessage(msg) {
throw this.error;
}
async recvAlertMessage(err) {
throw this.error;
}
async recvChangeCipherSpec(bytes) {
throw this.error;
}
async handleErrorAndRethrow(err) {
throw err;
}
async close() {
throw this.error;
}
}
// The "connected" state, for when the handshake is complete
// and we're ready to send application-level data.
// The logic for this is largely symmetric between client and server.
class states_CONNECTED extends states_State {
async initialize() {
this.conn._setConnectionSuccess();
}
async sendApplicationData(bytes) {
await this.conn._sendApplicationData(bytes);
}
async recvApplicationData(bytes) {
return bytes;
}
async recvChangeCipherSpec(bytes) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
}
// A base class for states that occur in the middle of the handshake
// (that is, between ClientHello and Finished). These states may receive
// CHANGE_CIPHER_SPEC records for b/w compat reasons, which must contain
// exactly a single 0x01 byte and must otherwise be ignored.
class states_MidHandshakeState extends states_State {
async recvChangeCipherSpec(bytes) {
if (this.conn._hasSeenChangeCipherSpec) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
if (bytes.byteLength !== 1 || bytes[0] !== 1) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
this.conn._hasSeenChangeCipherSpec = true;
}
}
// These states implement (part of) the client state-machine from
//
// Since we're only implementing a small subset of TLS1.3,
// we only need a small subset of the handshake. It basically goes:
//
// * send ClientHello
// * receive ServerHello
// * receive EncryptedExtensions
// * receive server Finished
// * send client Finished
//
// We include some unused states for completeness, so that it's easier
// to check the implementation against the diagrams in the RFC.
class states_CLIENT_START extends states_State {
async initialize() {
const keyschedule = this.conn._keyschedule;
await keyschedule.addPSK(this.conn.psk);
// Construct a ClientHello message with our single PSK.
// We can't know the PSK binder value yet, so we initially write zeros.
const clientHello = new messages_ClientHello(
// Client random salt.
await getRandomBytes(32),
// Random legacy_session_id; we *could* send an empty string here,
// but sending a random one makes it easier to be compatible with
// the data emitted by tlslite-ng for test-case generation.
await getRandomBytes(32),
[
new extensions_SupportedVersionsExtension([VERSION_TLS_1_3]),
new extensions_PskKeyExchangeModesExtension([PSK_MODE_KE]),
new extensions_PreSharedKeyExtension([this.conn.pskId], [zeros(HASH_LENGTH)]),
],
);
const buf = new utils_BufferWriter();
clientHello.write(buf);
// Now that we know what the ClientHello looks like,
// go back and calculate the appropriate PSK binder value.
// We only support a single PSK, so the length of the binders field is the
// length of the hash plus one for rendering it as a variable-length byte array,
// plus two for rendering the variable-length list of PSK binders.
const PSK_BINDERS_SIZE = HASH_LENGTH + 1 + 2;
const truncatedTranscript = buf.slice(0, buf.tell() - PSK_BINDERS_SIZE);
const pskBinder = await keyschedule.calculateFinishedMAC(keyschedule.extBinderKey, truncatedTranscript);
buf.incr(-HASH_LENGTH);
buf.writeBytes(pskBinder);
await this.conn._sendHandshakeMessageBytes(buf.flush());
await this.conn._transition(states_CLIENT_WAIT_SH, clientHello.sessionId);
}
}
class states_CLIENT_WAIT_SH extends states_State {
async initialize(sessionId) {
this._sessionId = sessionId;
}
async recvHandshakeMessage(msg) {
if (! (msg instanceof messages_ServerHello)) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
if (! bytesAreEqual(msg.sessionId, this._sessionId)) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
const pskExt = msg.extensions.get(EXTENSION_TYPE.PRE_SHARED_KEY);
if (! pskExt) {
throw new TLSError(ALERT_DESCRIPTION.MISSING_EXTENSION);
}
// We expect only the SUPPORTED_VERSIONS and PRE_SHARED_KEY extensions.
if (msg.extensions.size !== 2) {
throw new TLSError(ALERT_DESCRIPTION.UNSUPPORTED_EXTENSION);
}
if (pskExt.selectedIdentity !== 0) {
throw new TLSError(ALERT_DESCRIPTION.ILLEGAL_PARAMETER);
}
await this.conn._keyschedule.addECDHE(null);
await this.conn._setSendKey(this.conn._keyschedule.clientHandshakeTrafficSecret);
await this.conn._setRecvKey(this.conn._keyschedule.serverHandshakeTrafficSecret);
await this.conn._transition(states_CLIENT_WAIT_EE);
}
}
class states_CLIENT_WAIT_EE extends states_MidHandshakeState {
async recvHandshakeMessage(msg) {
// We don't make use of any encrypted extensions, but we still
// have to wait for the server to send the (empty) list of them.
if (! (msg instanceof EncryptedExtensions)) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
// We do not support any EncryptedExtensions.
if (msg.extensions.size !== 0) {
throw new TLSError(ALERT_DESCRIPTION.UNSUPPORTED_EXTENSION);
}
const keyschedule = this.conn._keyschedule;
const serverFinishedTranscript = keyschedule.getTranscript();
await this.conn._transition(states_CLIENT_WAIT_FINISHED, serverFinishedTranscript);
}
}
class states_CLIENT_WAIT_FINISHED extends states_State {
async initialize(serverFinishedTranscript) {
this._serverFinishedTranscript = serverFinishedTranscript;
}
async recvHandshakeMessage(msg) {
if (! (msg instanceof messages_Finished)) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
// Verify server Finished MAC.
const keyschedule = this.conn._keyschedule;
await keyschedule.verifyFinishedMAC(keyschedule.serverHandshakeTrafficSecret, msg.verifyData, this._serverFinishedTranscript);
// Send our own Finished message in return.
// This must be encrypted with the handshake traffic key,
// but must not appear in the transcript used to calculate the application keys.
const clientFinishedMAC = await keyschedule.calculateFinishedMAC(keyschedule.clientHandshakeTrafficSecret);
await keyschedule.finalize();
await this.conn._sendHandshakeMessage(new messages_Finished(clientFinishedMAC));
await this.conn._setSendKey(keyschedule.clientApplicationTrafficSecret);
await this.conn._setRecvKey(keyschedule.serverApplicationTrafficSecret);
await this.conn._transition(states_CLIENT_CONNECTED);
}
}
class states_CLIENT_CONNECTED extends states_CONNECTED {
async recvHandshakeMessage(msg) {
// A connected client must be prepared to accept NewSessionTicket
// messages. We never use them, but other server implementations
// might send them.
if (! (msg instanceof messages_NewSessionTicket)) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
}
}
// These states implement (part of) the server state-machine from
//
// Since we're only implementing a small subset of TLS1.3,
// we only need a small subset of the handshake. It basically goes:
//
// * receive ClientHello
// * send ServerHello
// * send empty EncryptedExtensions
// * send server Finished
// * receive client Finished
//
// We include some unused states for completeness, so that it's easier
// to check the implementation against the diagrams in the RFC.
class states_SERVER_START extends states_State {
async recvHandshakeMessage(msg) {
if (! (msg instanceof messages_ClientHello)) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
// In the spec, this is where we select connection parameters, and maybe
// tell the client to try again if we can't find a compatible set.
// Since we only support a fixed cipherset, the only thing to "negotiate"
// is whether they provided an acceptable PSK.
const pskExt = msg.extensions.get(EXTENSION_TYPE.PRE_SHARED_KEY);
const pskModesExt = msg.extensions.get(EXTENSION_TYPE.PSK_KEY_EXCHANGE_MODES);
if (! pskExt || ! pskModesExt) {
throw new TLSError(ALERT_DESCRIPTION.MISSING_EXTENSION);
}
if (pskModesExt.modes.indexOf(PSK_MODE_KE) === -1) {
throw new TLSError(ALERT_DESCRIPTION.HANDSHAKE_FAILURE);
}
const pskIndex = pskExt.identities.findIndex(pskId => bytesAreEqual(pskId, this.conn.pskId));
if (pskIndex === -1) {
throw new TLSError(ALERT_DESCRIPTION.UNKNOWN_PSK_IDENTITY);
}
await this.conn._keyschedule.addPSK(this.conn.psk);
// Validate the PSK binder.
const keyschedule = this.conn._keyschedule;
const transcript = keyschedule.getTranscript();
// Calculate size occupied by the PSK binders.
let pskBindersSize = 2; // Vector16 representation overhead.
for (const binder of pskExt.binders) {
pskBindersSize += binder.byteLength + 1; // Vector8 representation overhead.
}
await keyschedule.verifyFinishedMAC(keyschedule.extBinderKey, pskExt.binders[pskIndex], transcript.slice(0, -pskBindersSize));
await this.conn._transition(states_SERVER_NEGOTIATED, msg.sessionId, pskIndex);
}
}
class states_SERVER_NEGOTIATED extends states_MidHandshakeState {
async initialize(sessionId, pskIndex) {
await this.conn._sendHandshakeMessage(new messages_ServerHello(
// Server random
await getRandomBytes(32),
sessionId,
[
new extensions_SupportedVersionsExtension(null, VERSION_TLS_1_3),
new extensions_PreSharedKeyExtension(null, null, pskIndex),
]
));
// If the client sent a non-empty sessionId, the server *must* send a change-cipher-spec for b/w compat.
if (sessionId.byteLength > 0) {
await this.conn._sendChangeCipherSpec();
}
// We can now transition to the encrypted part of the handshake.
const keyschedule = this.conn._keyschedule;
await keyschedule.addECDHE(null);
await this.conn._setSendKey(keyschedule.serverHandshakeTrafficSecret);
await this.conn._setRecvKey(keyschedule.clientHandshakeTrafficSecret);
// Send an empty EncryptedExtensions message.
await this.conn._sendHandshakeMessage(new EncryptedExtensions([]));
// Send the Finished message.
const serverFinishedMAC = await keyschedule.calculateFinishedMAC(keyschedule.serverHandshakeTrafficSecret);
await this.conn._sendHandshakeMessage(new messages_Finished(serverFinishedMAC));
// We can now *send* using the application traffic key,
// but have to wait to receive the client Finished before receiving under that key.
// We need to remember the handshake state from before the client Finished
// in order to successfully verify the client Finished.
const clientFinishedTranscript = await keyschedule.getTranscript();
const clientHandshakeTrafficSecret = keyschedule.clientHandshakeTrafficSecret;
await keyschedule.finalize();
await this.conn._setSendKey(keyschedule.serverApplicationTrafficSecret);
await this.conn._transition(states_SERVER_WAIT_FINISHED, clientHandshakeTrafficSecret, clientFinishedTranscript);
}
}
class states_SERVER_WAIT_FINISHED extends states_MidHandshakeState {
async initialize(clientHandshakeTrafficSecret, clientFinishedTranscript) {
this._clientHandshakeTrafficSecret = clientHandshakeTrafficSecret;
this._clientFinishedTranscript = clientFinishedTranscript;
}
async recvHandshakeMessage(msg) {
if (! (msg instanceof messages_Finished)) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
const keyschedule = this.conn._keyschedule;
await keyschedule.verifyFinishedMAC(this._clientHandshakeTrafficSecret, msg.verifyData, this._clientFinishedTranscript);
this._clientHandshakeTrafficSecret = this._clientFinishedTranscript = null;
await this.conn._setRecvKey(keyschedule.clientApplicationTrafficSecret);
await this.conn._transition(states_CONNECTED);
}
}
// CONCATENATED MODULE: ./src/keyschedule.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
// TLS1.3 Key Schedule.
//
// In this file we implement the "key schedule" from
// defines how to calculate various keys as the handshake
// state progresses.
// The `KeySchedule` class progresses through three stages corresponding
// to the three phases of the TLS1.3 key schedule:
//
// UNINITIALIZED
// |
// | addPSK()
// v
// EARLY_SECRET
// |
// | addECDHE()
// v
// HANDSHAKE_SECRET
// |
// | finalize()
// v
// MASTER_SECRET
//
// It will error out if the calling code attempts to add key material
// in the wrong order.
const STAGE_UNINITIALIZED = 0;
const STAGE_EARLY_SECRET = 1;
const STAGE_HANDSHAKE_SECRET = 2;
const STAGE_MASTER_SECRET = 3;
class keyschedule_KeySchedule {
constructor() {
this.stage = STAGE_UNINITIALIZED;
// WebCrypto doesn't support a rolling hash construct, so we have to
// keep the entire message transcript in memory.
this.transcript = new utils_BufferWriter();
// This tracks the main secret from with other keys are derived at each stage.
this.secret = null;
// And these are all the various keys we'll derive as the handshake progresses.
this.extBinderKey = null;
this.clientHandshakeTrafficSecret = null;
this.serverHandshakeTrafficSecret = null;
this.clientApplicationTrafficSecret = null;
this.serverApplicationTrafficSecret = null;
}
async addPSK(psk) {
// Use the selected PSK (if any) to calculate the "early secret".
if (psk === null) {
psk = zeros(HASH_LENGTH);
}
if (this.stage !== STAGE_UNINITIALIZED) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
this.stage = STAGE_EARLY_SECRET;
this.secret = await hkdfExtract(zeros(HASH_LENGTH), psk);
this.extBinderKey = await this.deriveSecret('ext binder', EMPTY);
this.secret = await this.deriveSecret('derived', EMPTY);
}
async addECDHE(ecdhe) {
// Mix in the ECDHE output (if any) to calculate the "handshake secret".
if (ecdhe === null) {
ecdhe = zeros(HASH_LENGTH);
}
if (this.stage !== STAGE_EARLY_SECRET) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
this.stage = STAGE_HANDSHAKE_SECRET;
this.extBinderKey = null;
this.secret = await hkdfExtract(this.secret, ecdhe);
this.clientHandshakeTrafficSecret = await this.deriveSecret('c hs traffic');
this.serverHandshakeTrafficSecret = await this.deriveSecret('s hs traffic');
this.secret = await this.deriveSecret('derived', EMPTY);
}
async finalize() {
if (this.stage !== STAGE_HANDSHAKE_SECRET) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
this.stage = STAGE_MASTER_SECRET;
this.clientHandshakeTrafficSecret = null;
this.serverHandshakeTrafficSecret = null;
this.secret = await hkdfExtract(this.secret, zeros(HASH_LENGTH));
this.clientApplicationTrafficSecret = await this.deriveSecret('c ap traffic');
this.serverApplicationTrafficSecret = await this.deriveSecret('s ap traffic');
this.secret = null;
}
addToTranscript(bytes) {
this.transcript.writeBytes(bytes);
}
getTranscript() {
return this.transcript.slice();
}
async deriveSecret(label, transcript = undefined) {
transcript = transcript || this.getTranscript();
return await hkdfExpandLabel(this.secret, label, await hash(transcript), HASH_LENGTH);
}
async calculateFinishedMAC(baseKey, transcript = undefined) {
transcript = transcript || this.getTranscript();
const finishedKey = await hkdfExpandLabel(baseKey, 'finished', EMPTY, HASH_LENGTH);
return await hmac(finishedKey, await hash(transcript));
}
async verifyFinishedMAC(baseKey, mac, transcript = undefined) {
transcript = transcript || this.getTranscript();
const finishedKey = await hkdfExpandLabel(baseKey, 'finished', EMPTY, HASH_LENGTH);
await verifyHmac(finishedKey, mac, await hash(transcript));
}
}
// CONCATENATED MODULE: ./src/recordlayer.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
//
// This file implements the "record layer" for TLS1.3, as defined in
//
// The record layer is responsible for encrypting/decrypting bytes to be
// sent over the wire, including stateful management of sequence numbers
// for the incoming and outgoing stream.
//
// The main interface is the RecordLayer class, which takes a callback function
// sending data and can be used like so:
//
// rl = new RecordLayer(async function send_encrypted_data(data) {
// // application-specific sending logic here.
// });
//
// // Records are sent and received in plaintext by default,
// // until you specify the key to use.
// await rl.setSendKey(key)
//
// // Send some data by specifying the record type and the bytes.
// // Where allowed by the record type, it will be buffered until
// // explicitly flushed, and then sent by calling the callback.
// await rl.send(RECORD_TYPE.HANDSHAKE, <bytes for a handshake message>)
// await rl.send(RECORD_TYPE.HANDSHAKE, <bytes for another handshake message>)
// await rl.flush()
//
// // Separate keys are used for sending and receiving.
// rl.setRecvKey(key);
//
// // When data is received, push it into the RecordLayer
// // and pass a callback that will be called with a [type, bytes]
// // pair for each message parsed from the data.
// rl.recv(dataReceivedFromPeer, async (type, bytes) => {
// switch (type) {
// case RECORD_TYPE.APPLICATION_DATA:
// // do something with application data
// case RECORD_TYPE.HANDSHAKE:
// // do something with a handshake message
// default:
// // etc...
// }
// });
//
/* eslint-disable sorting/sort-object-props */
const RECORD_TYPE = {
CHANGE_CIPHER_SPEC: 20,
ALERT: 21,
HANDSHAKE: 22,
APPLICATION_DATA: 23,
};
/* eslint-enable sorting/sort-object-props */
// Encrypting at most 2^24 records will force us to stay
// below data limits on AES-GCM encryption key use, and also
// means we can accurately represent the sequence number as
// a javascript double.
const MAX_SEQUENCE_NUMBER = Math.pow(2, 24);
const MAX_RECORD_SIZE = Math.pow(2, 14);
const MAX_ENCRYPTED_RECORD_SIZE = MAX_RECORD_SIZE + 256;
const RECORD_HEADER_SIZE = 5;
// These are some helper classes to manage the encryption/decryption state
// for a particular key.
class recordlayer_CipherState {
constructor(key, iv) {
this.key = key;
this.iv = iv;
this.seqnum = 0;
}
static async create(baseKey, mode) {
const key = await prepareKey(await hkdfExpandLabel(baseKey, 'key', EMPTY, KEY_LENGTH), mode);
const iv = await hkdfExpandLabel(baseKey, 'iv', EMPTY, IV_LENGTH);
return new this(key, iv);
}
nonce() {
// * left-pad the sequence number with zeros to IV_LENGTH
// * xor with the provided iv
// Our sequence numbers are always less than 2^24, so fit in a Uint32
// in the last 4 bytes of the nonce.
const nonce = this.iv.slice();
const dv = new DataView(nonce.buffer, nonce.byteLength - 4, 4);
dv.setUint32(0, dv.getUint32(0) ^ this.seqnum);
this.seqnum += 1;
if (this.seqnum > MAX_SEQUENCE_NUMBER) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
return nonce;
}
}
class recordlayer_EncryptionState extends recordlayer_CipherState {
static async create(key) {
return super.create(key, 'encrypt');
}
async encrypt(plaintext, additionalData) {
return await encrypt(this.key, this.nonce(), plaintext, additionalData);
}
}
class recordlayer_DecryptionState extends recordlayer_CipherState {
static async create(key) {
return super.create(key, 'decrypt');
}
async decrypt(ciphertext, additionalData) {
return await decrypt(this.key, this.nonce(), ciphertext, additionalData);
}
}
// The main RecordLayer class.
class recordlayer_RecordLayer {
constructor(sendCallback) {
this.sendCallback = sendCallback;
this._sendEncryptState = null;
this._sendError = null;
this._recvDecryptState = null;
this._recvError = null;
this._pendingRecordType = 0;
this._pendingRecordBuf = null;
}
async setSendKey(key) {
await this.flush();
this._sendEncryptState = await recordlayer_EncryptionState.create(key);
}
async setRecvKey(key) {
this._recvDecryptState = await recordlayer_DecryptionState.create(key);
}
async setSendError(err) {
this._sendError = err;
}
async setRecvError(err) {
this._recvError = err;
}
async send(type, data) {
if (this._sendError !== null) {
throw this._sendError;
}
// Forbid sending data that doesn't fit into a single record.
// We do not support fragmentation over multiple records.
if (data.byteLength > MAX_RECORD_SIZE) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
// Flush if we're switching to a different record type.
if (this._pendingRecordType && this._pendingRecordType !== type) {
await this.flush();
}
// Flush if we would overflow the max size of a record.
if (this._pendingRecordBuf !== null) {
if (this._pendingRecordBuf.tell() + data.byteLength > MAX_RECORD_SIZE) {
await this.flush();
}
}
// Start a new pending record if necessary.
// We reserve space at the start of the buffer for the record header,
// which is conveniently always a fixed size.
if (this._pendingRecordBuf === null) {
this._pendingRecordType = type;
this._pendingRecordBuf = new utils_BufferWriter();
this._pendingRecordBuf.incr(RECORD_HEADER_SIZE);
}
this._pendingRecordBuf.writeBytes(data);
}
async flush() {
// If there's nothing to flush, bail out early.
// Don't throw `_sendError` if we're not sending anything, because `flush()`
// can be called when we're trying to transition into an error state.
const buf = this._pendingRecordBuf;
let type = this._pendingRecordType;
if (! type) {
if (buf !== null) {
throw new TLSError(ALERT_DESCRIPTION.INTERNAL_ERROR);
}
return;
}
if (this._sendError !== null) {
throw this._sendError;
}
// If we're encrypting, turn the existing buffer contents into a `TLSInnerPlaintext` by
// appending the type. We don't do any zero-padding, although the spec allows it.
let inflation = 0, innerPlaintext = null;
if (this._sendEncryptState !== null) {
buf.writeUint8(type);
innerPlaintext = buf.slice(RECORD_HEADER_SIZE);
inflation = AEAD_SIZE_INFLATION;
type = RECORD_TYPE.APPLICATION_DATA;
}
// Write the common header for either `TLSPlaintext` or `TLSCiphertext` record.
const length = buf.tell() - RECORD_HEADER_SIZE + inflation;
buf.seek(0);
buf.writeUint8(type);
buf.writeUint16(VERSION_TLS_1_2);
buf.writeUint16(length);
// Followed by different payload depending on encryption status.
if (this._sendEncryptState !== null) {
const additionalData = buf.slice(0, RECORD_HEADER_SIZE);
const ciphertext = await this._sendEncryptState.encrypt(innerPlaintext, additionalData);
buf.writeBytes(ciphertext);
} else {
buf.incr(length);
}
this._pendingRecordBuf = null;
this._pendingRecordType = 0;
await this.sendCallback(buf.flush());
}
async recv(data) {
if (this._recvError !== null) {
throw this._recvError;
}
// For simplicity, we assume that the given data contains exactly one record.
// Peers using this library will send one record at a time over the websocket
// connection, and we can assume that the server-side websocket bridge will split
// up any traffic into individual records if we ever start interoperating with
// peers using a different TLS implementation.
// Similarly, we assume that handshake messages will not be fragmented across
// multiple records. This should be trivially true for the PSK-only mode used
// by this library, but we may want to relax it in future for interoperability
// with e.g. large ClientHello messages that contain lots of different options.
const buf = new utils_BufferReader(data);
// The data to read is either a TLSPlaintext or TLSCiphertext struct,
// depending on whether record protection has been enabled yet:
//
// struct {
// ContentType type;
// ProtocolVersion legacy_record_version;
// uint16 length;
// opaque fragment[TLSPlaintext.length];
// } TLSPlaintext;
//
// struct {
// ContentType opaque_type = application_data; /* 23 */
// ProtocolVersion legacy_record_version = 0x0303; /* TLS v1.2 */
// uint16 length;
// opaque encrypted_record[TLSCiphertext.length];
// } TLSCiphertext;
//
let type = buf.readUint8();
// The spec says legacy_record_version "MUST be ignored for all purposes",
// but we know TLS1.3 implementations will only ever emit two possible values,
// so it seems useful to bail out early if we receive anything else.
const version = buf.readUint16();
if (version !== VERSION_TLS_1_2) {
// TLS1.0 is only acceptable on initial plaintext records.
if (this._recvDecryptState !== null || version !== VERSION_TLS_1_0) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
}
const length = buf.readUint16();
let plaintext;
if (this._recvDecryptState === null || type === RECORD_TYPE.CHANGE_CIPHER_SPEC) {
[type, plaintext] = await this._readPlaintextRecord(type, length, buf);
} else {
[type, plaintext] = await this._readEncryptedRecord(type, length, buf);
}
// Sanity-check that we received exactly one record.
if (buf.hasMoreBytes()) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
return [type, plaintext];
}
// Helper to read an unencrypted `TLSPlaintext` struct
async _readPlaintextRecord(type, length, buf) {
if (length > MAX_RECORD_SIZE) {
throw new TLSError(ALERT_DESCRIPTION.RECORD_OVERFLOW);
}
return [type, buf.readBytes(length)];
}
// Helper to read an encrypted `TLSCiphertext` struct,
// decrypting it into plaintext.
async _readEncryptedRecord(type, length, buf) {
if (length > MAX_ENCRYPTED_RECORD_SIZE) {
throw new TLSError(ALERT_DESCRIPTION.RECORD_OVERFLOW);
}
// The outer type for encrypted records is always APPLICATION_DATA.
if (type !== RECORD_TYPE.APPLICATION_DATA) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
// Decrypt and decode the contained `TLSInnerPlaintext` struct:
//
// struct {
// opaque content[TLSPlaintext.length];
// ContentType type;
// uint8 zeros[length_of_padding];
// } TLSInnerPlaintext;
//
// The additional data for the decryption is the `TLSCiphertext` record
// header, which is a fixed size and immediately prior to current buffer position.
buf.incr(-RECORD_HEADER_SIZE);
const additionalData = buf.readBytes(RECORD_HEADER_SIZE);
const ciphertext = buf.readBytes(length);
const paddedPlaintext = await this._recvDecryptState.decrypt(ciphertext, additionalData);
// We have to scan backwards over the zero padding at the end of the struct
// in order to find the non-zero `type` byte.
let i;
for (i = paddedPlaintext.byteLength - 1; i >= 0; i--) {
if (paddedPlaintext[i] !== 0) {
break;
}
}
if (i < 0) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
type = paddedPlaintext[i];
// `change_cipher_spec` records must always be plaintext.
if (type === RECORD_TYPE.CHANGE_CIPHER_SPEC) {
throw new TLSError(ALERT_DESCRIPTION.DECODE_ERROR);
}
return [type, paddedPlaintext.slice(0, i)];
}
}
// CONCATENATED MODULE: ./src/tlsconnection.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
// The top-level APIs offered by this module are `ClientConnection` and
// `ServerConnection` classes, which provide authenticated and encrypted
// communication via the "externally-provisioned PSK" mode of TLS1.3.
// They each take a callback to be used for sending data to the remote peer,
// and operate like this:
//
// conn = await ClientConnection.create(psk, pskId, async function send_data_to_server(data) {
// // application-specific sending logic here.
// })
//
// // Send data to the server by calling `send`,
// // which will use the callback provided in the constructor.
// // A single `send()` by the application may result in multiple
// // invokations of the callback.
//
// await conn.send('application-level data')
//
// // When data is received from the server, push it into
// // the connection and let it return any decrypted app-level data.
// // There might not be any app-level data if it was a protocol control
// // message, and the receipt of the data might trigger additional calls
// // to the send callback for protocol control purposes.
//
// serverSocket.on('data', async encrypted_data => {
// const plaintext = await conn.recv(data)
// if (plaintext !== null) {
// do_something_with_app_level_data(plaintext)
// }
// })
//
// // It's good practice to explicitly close the connection
// // when finished. This will send a "closed" notification
// // to the server.
//
// await conn.close()
//
// // When the peer sends a "closed" notification it will show up
// // as a `TLSCloseNotify` exception from recv:
//
// try {
// data = await conn.recv(data);
// } catch (err) {
// if (! (err instanceof TLSCloseNotify) { throw err }
// do_something_to_cleanly_close_data_connection();
// }
//
// The `ServerConnection` API operates similarly; the distinction is mainly
// in which side is expected to send vs receieve during the protocol handshake.
class tlsconnection_Connection {
constructor(psk, pskId, sendCallback) {
this.psk = assertIsBytes(psk);
this.pskId = assertIsBytes(pskId);
this.connected = new Promise((resolve, reject) => {
this._onConnectionSuccess = resolve;
this._onConnectionFailure = reject;
});
this._state = new UNINITIALIZED(this);
this._handshakeRecvBuffer = null;
this._hasSeenChangeCipherSpec = false;
this._recordlayer = new recordlayer_RecordLayer(sendCallback);
this._keyschedule = new keyschedule_KeySchedule();
this._lastPromise = Promise.resolve();
}
// Subclasses will override this with some async initialization logic.
static async create(psk, pskId, sendCallback) {
return new this(psk, pskId, sendCallback);
}
// These are the three public API methods that consumers can use
// to send and receive data encrypted with TLS1.3.
async send(data) {
assertIsBytes(data);
await this.connected;
await this._synchronized(async () => {
await this._state.sendApplicationData(data);
});
}
async recv(data) {
assertIsBytes(data);
return await this._synchronized(async () => {
// Decrypt the data using the record layer.
// We expect to receive precisely one record at a time.
const [type, bytes] = await this._recordlayer.recv(data);
// Dispatch based on the type of the record.
switch (type) {
case RECORD_TYPE.CHANGE_CIPHER_SPEC:
await this._state.recvChangeCipherSpec(bytes);
return null;
case RECORD_TYPE.ALERT:
await this._state.recvAlertMessage(TLSAlert.fromBytes(bytes));
return null;
case RECORD_TYPE.APPLICATION_DATA:
return await this._state.recvApplicationData(bytes);
case RECORD_TYPE.HANDSHAKE:
// Multiple handshake messages may be coalesced into a single record.
// Store the in-progress record buffer on `this` so that we can guard
// against handshake messages that span a change in keys.
this._handshakeRecvBuffer = new utils_BufferReader(bytes);
if (! this._handshakeRecvBuffer.hasMoreBytes()) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
do {
// Each handshake messages has a type and length prefix, per
this._handshakeRecvBuffer.incr(1);
const mlength = this._handshakeRecvBuffer.readUint24();
this._handshakeRecvBuffer.incr(-4);
const messageBytes = this._handshakeRecvBuffer.readBytes(mlength + 4);
this._keyschedule.addToTranscript(messageBytes);
await this._state.recvHandshakeMessage(messages_HandshakeMessage.fromBytes(messageBytes));
} while (this._handshakeRecvBuffer.hasMoreBytes());
this._handshakeRecvBuffer = null;
return null;
default:
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
});
}
async close() {
await this._synchronized(async () => {
await this._state.close();
});
}
// Ensure that async functions execute one at a time,
// by waiting for the previous call to `_synchronized()` to complete
// before starting a new one. This helps ensure that we complete
// one state-machine transition before starting to do the next.
// It's also a convenient place to catch and alert on errors.
_synchronized(cb) {
const nextPromise = this._lastPromise.then(() => {
return cb();
}).catch(async err => {
if (err instanceof TLSCloseNotify) {
throw err;
}
await this._state.handleErrorAndRethrow(err);
});
// We don't want to hold on to the return value or error,
// just synchronize on the fact that it completed.
this._lastPromise = nextPromise.then(noop, noop);
return nextPromise;
}
// This drives internal transition of the state-machine,
// ensuring that the new state is properly initialized.
async _transition(State, ...args) {
this._state = new State(this);
await this._state.initialize(...args);
await this._recordlayer.flush();
}
// These are helpers to allow the State to manipulate the recordlayer
// and send out various types of data.
async _sendApplicationData(bytes) {
await this._recordlayer.send(RECORD_TYPE.APPLICATION_DATA, bytes);
await this._recordlayer.flush();
}
async _sendHandshakeMessage(msg) {
await this._sendHandshakeMessageBytes(msg.toBytes());
}
async _sendHandshakeMessageBytes(bytes) {
this._keyschedule.addToTranscript(bytes);
await this._recordlayer.send(RECORD_TYPE.HANDSHAKE, bytes);
// Don't flush after each handshake message, since we can probably
// coalesce multiple messages into a single record.
}
async _sendAlertMessage(err) {
await this._recordlayer.send(RECORD_TYPE.ALERT, err.toBytes());
await this._recordlayer.flush();
}
async _sendChangeCipherSpec() {
await this._recordlayer.send(RECORD_TYPE.CHANGE_CIPHER_SPEC, new Uint8Array([0x01]));
await this._recordlayer.flush();
}
async _setSendKey(key) {
return await this._recordlayer.setSendKey(key);
}
async _setRecvKey(key) {
// Handshake messages that change keys must be on a record boundary.
if (this._handshakeRecvBuffer && this._handshakeRecvBuffer.hasMoreBytes()) {
throw new TLSError(ALERT_DESCRIPTION.UNEXPECTED_MESSAGE);
}
return await this._recordlayer.setRecvKey(key);
}
_setConnectionSuccess() {
if (this._onConnectionSuccess !== null) {
this._onConnectionSuccess();
this._onConnectionSuccess = null;
this._onConnectionFailure = null;
}
}
_setConnectionFailure(err) {
if (this._onConnectionFailure !== null) {
this._onConnectionFailure(err);
this._onConnectionSuccess = null;
this._onConnectionFailure = null;
}
}
_closeForSend(alert) {
this._recordlayer.setSendError(alert);
}
_closeForRecv(alert) {
this._recordlayer.setRecvError(alert);
}
}
class tlsconnection_ClientConnection extends tlsconnection_Connection {
static async create(psk, pskId, sendCallback) {
const instance = await super.create(psk, pskId, sendCallback);
await instance._transition(states_CLIENT_START);
return instance;
}
}
class tlsconnection_ServerConnection extends tlsconnection_Connection {
static async create(psk, pskId, sendCallback) {
const instance = await super.create(psk, pskId, sendCallback);
await instance._transition(states_SERVER_START);
return instance;
}
}
// CONCATENATED MODULE: ./node_modules/event-target-shim/dist/event-target-shim.mjs
/**
* @copyright 2015 Toru Nagashima. All rights reserved.
* See LICENSE file in root directory for full license.
*/
/**
* @typedef {object} PrivateData
* @property {EventTarget} eventTarget The event target.
* @property {{type:string}} event The original event object.
* @property {number} eventPhase The current event phase.
* @property {EventTarget|null} currentTarget The current event target.
* @property {boolean} canceled The flag to prevent default.
* @property {boolean} stopped The flag to stop propagation.
* @property {boolean} immediateStopped The flag to stop propagation immediately.
* @property {Function|null} passiveListener The listener if the current listener is passive. Otherwise this is null.
* @property {number} timeStamp The unix time.
* @private
*/
/**
* Private data for event wrappers.
* @type {WeakMap<Event, PrivateData>}
* @private
*/
const privateData = new WeakMap();
/**
* Cache for wrapper classes.
* @type {WeakMap<Object, Function>}
* @private
*/
const wrappers = new WeakMap();
/**
* Get private data.
* @param {Event} event The event object to get private data.
* @returns {PrivateData} The private data of the event.
* @private
*/
function pd(event) {
const retv = privateData.get(event);
console.assert(
retv != null,
"'this' is expected an Event object, but got",
event
);
return retv
}
/**
* @param data {PrivateData} private data.
*/
function setCancelFlag(data) {
if (data.passiveListener != null) {
if (
typeof console !== "undefined" &&
typeof console.error === "function"
) {
console.error(
"Unable to preventDefault inside passive event listener invocation.",
data.passiveListener
);
}
return
}
if (!data.event.cancelable) {
return
}
data.canceled = true;
if (typeof data.event.preventDefault === "function") {
data.event.preventDefault();
}
}
/**
* @private
*/
/**
* The event wrapper.
* @constructor
* @param {EventTarget} eventTarget The event target of this dispatching.
* @param {Event|{type:string}} event The original event to wrap.
*/
function Event(eventTarget, event) {
privateData.set(this, {
eventTarget,
event,
eventPhase: 2,
currentTarget: eventTarget,
canceled: false,
stopped: false,
immediateStopped: false,
passiveListener: null,
timeStamp: event.timeStamp || Date.now(),
});
Object.defineProperty(this, "isTrusted", { value: false, enumerable: true });
// Define accessors
const keys = Object.keys(event);
for (let i = 0; i < keys.length; ++i) {
const key = keys[i];
if (!(key in this)) {
Object.defineProperty(this, key, defineRedirectDescriptor(key));
}
}
}
// Should be enumerable, but class methods are not enumerable.
Event.prototype = {
/**
* The type of this event.
* @type {string}
*/
get type() {
return pd(this).event.type
},
/**
* The target of this event.
* @type {EventTarget}
*/
get target() {
return pd(this).eventTarget
},
/**
* The target of this event.
* @type {EventTarget}
*/
get currentTarget() {
return pd(this).currentTarget
},
/**
* @returns {EventTarget[]} The composed path of this event.
*/
composedPath() {
const currentTarget = pd(this).currentTarget;
if (currentTarget == null) {
return []
}
return [currentTarget]
},
/**
* Constant of NONE.
* @type {number}
*/
get NONE() {
return 0
},
/**
* Constant of CAPTURING_PHASE.
* @type {number}
*/
get CAPTURING_PHASE() {
return 1
},
/**
* Constant of AT_TARGET.
* @type {number}
*/
get AT_TARGET() {
return 2
},
/**
* Constant of BUBBLING_PHASE.
* @type {number}
*/
get BUBBLING_PHASE() {
return 3
},
/**
* The target of this event.
* @type {number}
*/
get eventPhase() {
return pd(this).eventPhase
},
/**
* Stop event bubbling.
* @returns {void}
*/
stopPropagation() {
const data = pd(this);
data.stopped = true;
if (typeof data.event.stopPropagation === "function") {
data.event.stopPropagation();
}
},
/**
* Stop event bubbling.
* @returns {void}
*/
stopImmediatePropagation() {
const data = pd(this);
data.stopped = true;
data.immediateStopped = true;
if (typeof data.event.stopImmediatePropagation === "function") {
data.event.stopImmediatePropagation();
}
},
/**
* The flag to be bubbling.
* @type {boolean}
*/
get bubbles() {
return Boolean(pd(this).event.bubbles)
},
/**
* The flag to be cancelable.
* @type {boolean}
*/
get cancelable() {
return Boolean(pd(this).event.cancelable)
},
/**
* Cancel this event.
* @returns {void}
*/
preventDefault() {
setCancelFlag(pd(this));
},
/**
* The flag to indicate cancellation state.
* @type {boolean}
*/
get defaultPrevented() {
return pd(this).canceled
},
/**
* The flag to be composed.
* @type {boolean}
*/
get composed() {
return Boolean(pd(this).event.composed)
},
/**
* The unix time of this event.
* @type {number}
*/
get timeStamp() {
return pd(this).timeStamp
},
/**
* The target of this event.
* @type {EventTarget}
* @deprecated
*/
get srcElement() {
return pd(this).eventTarget
},
/**
* The flag to stop event bubbling.
* @type {boolean}
* @deprecated
*/
get cancelBubble() {
return pd(this).stopped
},
set cancelBubble(value) {
if (!value) {
return
}
const data = pd(this);
data.stopped = true;
if (typeof data.event.cancelBubble === "boolean") {
data.event.cancelBubble = true;
}
},
/**
* The flag to indicate cancellation state.
* @type {boolean}
* @deprecated
*/
get returnValue() {
return !pd(this).canceled
},
set returnValue(value) {
if (!value) {
setCancelFlag(pd(this));
}
},
/**
* Initialize this event object. But do nothing under event dispatching.
* @param {string} type The event type.
* @param {boolean} [bubbles=false] The flag to be possible to bubble up.
* @param {boolean} [cancelable=false] The flag to be possible to cancel.
* @deprecated
*/
initEvent() {
// Do nothing.
},
};
// `constructor` is not enumerable.
Object.defineProperty(Event.prototype, "constructor", {
value: Event,
configurable: true,
writable: true,
});
// Ensure `event instanceof window.Event` is `true`.
if (typeof window !== "undefined" && typeof window.Event !== "undefined") {
Object.setPrototypeOf(Event.prototype, window.Event.prototype);
// Make association for wrappers.
wrappers.set(window.Event.prototype, Event);
}
/**
* Get the property descriptor to redirect a given property.
* @param {string} key Property name to define property descriptor.
* @returns {PropertyDescriptor} The property descriptor to redirect the property.
* @private
*/
function defineRedirectDescriptor(key) {
return {
get() {
return pd(this).event[key]
},
set(value) {
pd(this).event[key] = value;
},
configurable: true,
enumerable: true,
}
}
/**
* Get the property descriptor to call a given method property.
* @param {string} key Property name to define property descriptor.
* @returns {PropertyDescriptor} The property descriptor to call the method property.
* @private
*/
function defineCallDescriptor(key) {
return {
value() {
const event = pd(this).event;
return event[key].apply(event, arguments)
},
configurable: true,
enumerable: true,
}
}
/**
* Define new wrapper class.
* @param {Function} BaseEvent The base wrapper class.
* @param {Object} proto The prototype of the original event.
* @returns {Function} The defined wrapper class.
* @private
*/
function defineWrapper(BaseEvent, proto) {
const keys = Object.keys(proto);
if (keys.length === 0) {
return BaseEvent
}
/** CustomEvent */
function CustomEvent(eventTarget, event) {
BaseEvent.call(this, eventTarget, event);
}
CustomEvent.prototype = Object.create(BaseEvent.prototype, {
constructor: { value: CustomEvent, configurable: true, writable: true },
});
// Define accessors.
for (let i = 0; i < keys.length; ++i) {
const key = keys[i];
if (!(key in BaseEvent.prototype)) {
const descriptor = Object.getOwnPropertyDescriptor(proto, key);
const isFunc = typeof descriptor.value === "function";
Object.defineProperty(
CustomEvent.prototype,
key,
isFunc
? defineCallDescriptor(key)
: defineRedirectDescriptor(key)
);
}
}
return CustomEvent
}
/**
* Get the wrapper class of a given prototype.
* @param {Object} proto The prototype of the original event to get its wrapper.
* @returns {Function} The wrapper class.
* @private
*/
function getWrapper(proto) {
if (proto == null || proto === Object.prototype) {
return Event
}
let wrapper = wrappers.get(proto);
if (wrapper == null) {
wrapper = defineWrapper(getWrapper(Object.getPrototypeOf(proto)), proto);
wrappers.set(proto, wrapper);
}
return wrapper
}
/**
* Wrap a given event to management a dispatching.
* @param {EventTarget} eventTarget The event target of this dispatching.
* @param {Object} event The event to wrap.
* @returns {Event} The wrapper instance.
* @private
*/
function wrapEvent(eventTarget, event) {
const Wrapper = getWrapper(Object.getPrototypeOf(event));
return new Wrapper(eventTarget, event)
}
/**
* Get the immediateStopped flag of a given event.
* @param {Event} event The event to get.
* @returns {boolean} The flag to stop propagation immediately.
* @private
*/
function isStopped(event) {
return pd(event).immediateStopped
}
/**
* Set the current event phase of a given event.
* @param {Event} event The event to set current target.
* @param {number} eventPhase New event phase.
* @returns {void}
* @private
*/
function setEventPhase(event, eventPhase) {
pd(event).eventPhase = eventPhase;
}
/**
* Set the current target of a given event.
* @param {Event} event The event to set current target.
* @param {EventTarget|null} currentTarget New current target.
* @returns {void}
* @private
*/
function setCurrentTarget(event, currentTarget) {
pd(event).currentTarget = currentTarget;
}
/**
* Set a passive listener of a given event.
* @param {Event} event The event to set current target.
* @param {Function|null} passiveListener New passive listener.
* @returns {void}
* @private
*/
function setPassiveListener(event, passiveListener) {
pd(event).passiveListener = passiveListener;
}
/**
* @typedef {object} ListenerNode
* @property {Function} listener
* @property {1|2|3} listenerType
* @property {boolean} passive
* @property {boolean} once
* @property {ListenerNode|null} next
* @private
*/
/**
* @type {WeakMap<object, Map<string, ListenerNode>>}
* @private
*/
const listenersMap = new WeakMap();
// Listener types
const CAPTURE = 1;
const BUBBLE = 2;
const ATTRIBUTE = 3;
/**
* Check whether a given value is an object or not.
* @param {any} x The value to check.
* @returns {boolean} `true` if the value is an object.
*/
function isObject(x) {
return x !== null && typeof x === "object" //eslint-disable-line no-restricted-syntax
}
/**
* Get listeners.
* @param {EventTarget} eventTarget The event target to get.
* @returns {Map<string, ListenerNode>} The listeners.
* @private
*/
function getListeners(eventTarget) {
const listeners = listenersMap.get(eventTarget);
if (listeners == null) {
throw new TypeError(
"'this' is expected an EventTarget object, but got another value."
)
}
return listeners
}
/**
* Get the property descriptor for the event attribute of a given event.
* @param {string} eventName The event name to get property descriptor.
* @returns {PropertyDescriptor} The property descriptor.
* @private
*/
function defineEventAttributeDescriptor(eventName) {
return {
get() {
const listeners = getListeners(this);
let node = listeners.get(eventName);
while (node != null) {
if (node.listenerType === ATTRIBUTE) {
return node.listener
}
node = node.next;
}
return null
},
set(listener) {
if (typeof listener !== "function" && !isObject(listener)) {
listener = null; // eslint-disable-line no-param-reassign
}
const listeners = getListeners(this);
// Traverse to the tail while removing old value.
let prev = null;
let node = listeners.get(eventName);
while (node != null) {
if (node.listenerType === ATTRIBUTE) {
// Remove old value.
if (prev !== null) {
prev.next = node.next;
} else if (node.next !== null) {
listeners.set(eventName, node.next);
} else {
listeners.delete(eventName);
}
} else {
prev = node;
}
node = node.next;
}
// Add new value.
if (listener !== null) {
const newNode = {
listener,
listenerType: ATTRIBUTE,
passive: false,
once: false,
next: null,
};
if (prev === null) {
listeners.set(eventName, newNode);
} else {
prev.next = newNode;
}
}
},
configurable: true,
enumerable: true,
}
}
/**
* Define an event attribute (e.g. `eventTarget.onclick`).
* @param {Object} eventTargetPrototype The event target prototype to define an event attrbite.
* @param {string} eventName The event name to define.
* @returns {void}
*/
function defineEventAttribute(eventTargetPrototype, eventName) {
Object.defineProperty(
eventTargetPrototype,
`on${eventName}`,
defineEventAttributeDescriptor(eventName)
);
}
/**
* Define a custom EventTarget with event attributes.
* @param {string[]} eventNames Event names for event attributes.
* @returns {EventTarget} The custom EventTarget.
* @private
*/
function defineCustomEventTarget(eventNames) {
/** CustomEventTarget */
function CustomEventTarget() {
EventTarget.call(this);
}
CustomEventTarget.prototype = Object.create(EventTarget.prototype, {
constructor: {
value: CustomEventTarget,
configurable: true,
writable: true,
},
});
for (let i = 0; i < eventNames.length; ++i) {
defineEventAttribute(CustomEventTarget.prototype, eventNames[i]);
}
return CustomEventTarget
}
/**
* EventTarget.
*
* - This is constructor if no arguments.
* - This is a function which returns a CustomEventTarget constructor if there are arguments.
*
* For example:
*
* class A extends EventTarget {}
* class B extends EventTarget("message") {}
* class C extends EventTarget("message", "error") {}
* class D extends EventTarget(["message", "error"]) {}
*/
function EventTarget() {
/*eslint-disable consistent-return */
if (this instanceof EventTarget) {
listenersMap.set(this, new Map());
return
}
if (arguments.length === 1 && Array.isArray(arguments[0])) {
return defineCustomEventTarget(arguments[0])
}
if (arguments.length > 0) {
const types = new Array(arguments.length);
for (let i = 0; i < arguments.length; ++i) {
types[i] = arguments[i];
}
return defineCustomEventTarget(types)
}
throw new TypeError("Cannot call a class as a function")
/*eslint-enable consistent-return */
}
// Should be enumerable, but class methods are not enumerable.
EventTarget.prototype = {
/**
* Add a given listener to this event target.
* @param {string} eventName The event name to add.
* @param {Function} listener The listener to add.
* @param {boolean|{capture?:boolean,passive?:boolean,once?:boolean}} [options] The options for this listener.
* @returns {void}
*/
addEventListener(eventName, listener, options) {
if (listener == null) {
return
}
if (typeof listener !== "function" && !isObject(listener)) {
throw new TypeError("'listener' should be a function or an object.")
}
const listeners = getListeners(this);
const optionsIsObj = isObject(options);
const capture = optionsIsObj
? Boolean(options.capture)
: Boolean(options);
const listenerType = capture ? CAPTURE : BUBBLE;
const newNode = {
listener,
listenerType,
passive: optionsIsObj && Boolean(options.passive),
once: optionsIsObj && Boolean(options.once),
next: null,
};
// Set it as the first node if the first node is null.
let node = listeners.get(eventName);
if (node === undefined) {
listeners.set(eventName, newNode);
return
}
// Traverse to the tail while checking duplication..
let prev = null;
while (node != null) {
if (
node.listener === listener &&
node.listenerType === listenerType
) {
// Should ignore duplication.
return
}
prev = node;
node = node.next;
}
// Add it.
prev.next = newNode;
},
/**
* Remove a given listener from this event target.
* @param {string} eventName The event name to remove.
* @param {Function} listener The listener to remove.
* @param {boolean|{capture?:boolean,passive?:boolean,once?:boolean}} [options] The options for this listener.
* @returns {void}
*/
removeEventListener(eventName, listener, options) {
if (listener == null) {
return
}
const listeners = getListeners(this);
const capture = isObject(options)
? Boolean(options.capture)
: Boolean(options);
const listenerType = capture ? CAPTURE : BUBBLE;
let prev = null;
let node = listeners.get(eventName);
while (node != null) {
if (
node.listener === listener &&
node.listenerType === listenerType
) {
if (prev !== null) {
prev.next = node.next;
} else if (node.next !== null) {
listeners.set(eventName, node.next);
} else {
listeners.delete(eventName);
}
return
}
prev = node;
node = node.next;
}
},
/**
* Dispatch a given event.
* @param {Event|{type:string}} event The event to dispatch.
* @returns {boolean} `false` if canceled.
*/
dispatchEvent(event) {
if (event == null || typeof event.type !== "string") {
throw new TypeError('"event.type" should be a string.')
}
// If listeners aren't registered, terminate.
const listeners = getListeners(this);
const eventName = event.type;
let node = listeners.get(eventName);
if (node == null) {
return true
}
// Since we cannot rewrite several properties, so wrap object.
const wrappedEvent = wrapEvent(this, event);
// This doesn't process capturing phase and bubbling phase.
// This isn't participating in a tree.
let prev = null;
while (node != null) {
// Remove this listener if it's once
if (node.once) {
if (prev !== null) {
prev.next = node.next;
} else if (node.next !== null) {
listeners.set(eventName, node.next);
} else {
listeners.delete(eventName);
}
} else {
prev = node;
}
// Call this listener
setPassiveListener(
wrappedEvent,
node.passive ? node.listener : null
);
if (typeof node.listener === "function") {
try {
node.listener.call(this, wrappedEvent);
} catch (err) {
if (
typeof console !== "undefined" &&
typeof console.error === "function"
) {
console.error(err);
}
}
} else if (
node.listenerType !== ATTRIBUTE &&
typeof node.listener.handleEvent === "function"
) {
node.listener.handleEvent(wrappedEvent);
}
// Break if `event.stopImmediatePropagation` was called.
if (isStopped(wrappedEvent)) {
break
}
node = node.next;
}
setPassiveListener(wrappedEvent, null);
setEventPhase(wrappedEvent, 0);
setCurrentTarget(wrappedEvent, null);
return !wrappedEvent.defaultPrevented
},
};
// `constructor` is not enumerable.
Object.defineProperty(EventTarget.prototype, "constructor", {
value: EventTarget,
configurable: true,
writable: true,
});
// Ensure `eventTarget instanceof window.EventTarget` is `true`.
if (
typeof window !== "undefined" &&
typeof window.EventTarget !== "undefined"
) {
Object.setPrototypeOf(EventTarget.prototype, window.EventTarget.prototype);
}
/* harmony default export */ var event_target_shim = (EventTarget);
// CONCATENATED MODULE: ./src/index.js
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
// A wrapper that combines a WebSocket to the channelserver
// with some client-side encryption for securing the channel.
//
// This code is responsible for the event handling and the consumer API.
// All the details of encrypting the messages are delegated to`./tlsconnection.js`.
const CLOSE_FLUSH_BUFFER_INTERVAL_MS = 200;
const CLOSE_FLUSH_BUFFER_MAX_TRIES = 5;
class src_PairingChannel extends EventTarget {
constructor(channelId, channelKey, socket, connection) {
super();
this._channelId = channelId;
this._channelKey = channelKey;
this._socket = socket;
this._connection = connection;
this._selfClosed = false;
this._peerClosed = false;
this._setupListeners();
}
/**
* Create a new pairing channel.
*
* This will open a channel on the channelserver, and generate a random client-side
* encryption key. When the promise resolves, `this.channelId` and `this.channelKey`
* can be transferred to another client to allow it to securely connect to the channel.
*
* @returns Promise<PairingChannel>
*/
static create(channelServerURI) {
const wsURI = new URL('/v1/ws/', channelServerURI).href;
const channelKey = crypto.getRandomValues(new Uint8Array(32));
// The one who creates the channel plays the role of 'server' in the underlying TLS exchange.
return this._makePairingChannel(wsURI, tlsconnection_ServerConnection, channelKey);
}
/**
* Connect to an existing pairing channel.
*
* This will connect to a channel on the channelserver previously established by
* another client calling `create`. The `channelId` and `channelKey` must have been
* obtained via some out-of-band mechanism (such as by scanning from a QR code).
*
* @returns Promise<PairingChannel>
*/
static connect(channelServerURI, channelId, channelKey) {
const wsURI = new URL(`/v1/ws/${channelId}`, channelServerURI).href;
// The one who connects to an existing channel plays the role of 'client'
// in the underlying TLS exchange.
return this._makePairingChannel(wsURI, tlsconnection_ClientConnection, channelKey);
}
static _makePairingChannel(wsUri, ConnectionClass, psk) {
const socket = new WebSocket(wsUri);
return new Promise((resolve, reject) => {
// eslint-disable-next-line prefer-const
let stopListening;
const onConnectionError = async () => {
stopListening();
reject(new Error('Error while creating the pairing channel'));
};
const onFirstMessage = async event => {
stopListening();
try {
// The channelserver echos back the channel id, and we use it as an
// additional input to the TLS handshake via the "psk id" field.
const {channelid: channelId} = JSON.parse(event.data);
const pskId = utf8ToBytes(channelId);
const connection = await ConnectionClass.create(psk, pskId, data => {
// Send data by forwarding it via the channelserver websocket.
// The TLS connection gives us `data` as raw bytes, but channelserver
// expects b64urlsafe strings, because it wraps them in a JSON object envelope.
socket.send(bytesToBase64url(data));
});
const instance = new this(channelId, psk, socket, connection);
resolve(instance);
} catch (err) {
reject(err);
}
};
stopListening = () => {
socket.removeEventListener('close', onConnectionError);
socket.removeEventListener('error', onConnectionError);
socket.removeEventListener('message', onFirstMessage);
};
socket.addEventListener('close', onConnectionError);
socket.addEventListener('error', onConnectionError);
socket.addEventListener('message', onFirstMessage);
});
}
_setupListeners() {
this._socket.addEventListener('message', async event => {
try {
// When we receive data from the channelserver, pump it through the TLS connection
// to decrypt it, then echo it back out to consumers as an event.
const channelServerEnvelope = JSON.parse(event.data);
const payload = await this._connection.recv(base64urlToBytes(channelServerEnvelope.message));
if (payload !== null) {
const data = JSON.parse(bytesToUtf8(payload));
this.dispatchEvent(new CustomEvent('message', {
detail: {
data,
sender: channelServerEnvelope.sender,
},
}));
}
} catch (error) {
let event;
// The underlying TLS connection will signal a clean shutdown of the channel
// by throwing a special error, because it doesn't really have a better
// signally mechanism available.
if (error instanceof TLSCloseNotify) {
this._peerClosed = true;
if (this._selfClosed) {
this._shutdown();
}
event = new CustomEvent('close');
} else {
event = new CustomEvent('error', {
detail: {
error,
}
});
}
this.dispatchEvent(event);
}
});
// Relay the WebSocket events.
this._socket.addEventListener('error', () => {
this._shutdown();
// The dispatched event that we receive has no useful information.
this.dispatchEvent(new CustomEvent('error', {
detail: {
error: new Error('WebSocket error.'),
},
}));
});
// In TLS, the peer has to explicitly send a close notification,
// which we dispatch above. Unexpected socket close is an error.
this._socket.addEventListener('close', () => {
this._shutdown();
if (! this._peerClosed) {
this.dispatchEvent(new CustomEvent('error', {
detail: {
error: new Error('WebSocket unexpectedly closed'),
}
}));
}
});
}
/**
* @param {Object} data
*/
async send(data) {
const payload = utf8ToBytes(JSON.stringify(data));
await this._connection.send(payload);
}
async close() {
this._selfClosed = true;
await this._connection.close();
try {
// Ensure all queued bytes have been sent before closing the connection.
let tries = 0;
while (this._socket.bufferedAmount > 0) {
if (++tries > CLOSE_FLUSH_BUFFER_MAX_TRIES) {
throw new Error('Could not flush the outgoing buffer in time.');
}
await new Promise(res => setTimeout(res, CLOSE_FLUSH_BUFFER_INTERVAL_MS));
}
} finally {
// If the peer hasn't closed, we might still receive some data.
if (this._peerClosed) {
this._shutdown();
}
}
}
_shutdown() {
if (this._socket) {
this._socket.close();
this._socket = null;
this._connection = null;
}
}
get closed() {
return (! this._socket) || (this._socket.readyState === 3);
}
get channelId() {
return this._channelId;
}
get channelKey() {
return this._channelKey;
}
}
// Re-export helpful utilities for calling code to use.
// For running tests using the built bundle,
// expose a bunch of implementation details.
const _internals = {
arrayToBytes: arrayToBytes,
BufferReader: utils_BufferReader,
BufferWriter: utils_BufferWriter,
bytesAreEqual: bytesAreEqual,
bytesToHex: bytesToHex,
bytesToUtf8: bytesToUtf8,
ClientConnection: tlsconnection_ClientConnection,
Connection: tlsconnection_Connection,
DecryptionState: recordlayer_DecryptionState,
EncryptedExtensions: EncryptedExtensions,
EncryptionState: recordlayer_EncryptionState,
Finished: messages_Finished,
HASH_LENGTH: HASH_LENGTH,
hexToBytes: hexToBytes,
hkdfExpand: hkdfExpand,
KeySchedule: keyschedule_KeySchedule,
NewSessionTicket: messages_NewSessionTicket,
RecordLayer: recordlayer_RecordLayer,
ServerConnection: tlsconnection_ServerConnection,
utf8ToBytes: utf8ToBytes,
zeros: zeros,
};
/***/ })
/******/ ])["PairingChannel"];