[6a3a178] | 1 | declare module 'tls' {
|
---|
| 2 | import * as net from 'net';
|
---|
| 3 |
|
---|
| 4 | const CLIENT_RENEG_LIMIT: number;
|
---|
| 5 | const CLIENT_RENEG_WINDOW: number;
|
---|
| 6 |
|
---|
| 7 | interface Certificate {
|
---|
| 8 | /**
|
---|
| 9 | * Country code.
|
---|
| 10 | */
|
---|
| 11 | C: string;
|
---|
| 12 | /**
|
---|
| 13 | * Street.
|
---|
| 14 | */
|
---|
| 15 | ST: string;
|
---|
| 16 | /**
|
---|
| 17 | * Locality.
|
---|
| 18 | */
|
---|
| 19 | L: string;
|
---|
| 20 | /**
|
---|
| 21 | * Organization.
|
---|
| 22 | */
|
---|
| 23 | O: string;
|
---|
| 24 | /**
|
---|
| 25 | * Organizational unit.
|
---|
| 26 | */
|
---|
| 27 | OU: string;
|
---|
| 28 | /**
|
---|
| 29 | * Common name.
|
---|
| 30 | */
|
---|
| 31 | CN: string;
|
---|
| 32 | }
|
---|
| 33 |
|
---|
| 34 | interface PeerCertificate {
|
---|
| 35 | subject: Certificate;
|
---|
| 36 | issuer: Certificate;
|
---|
| 37 | subjectaltname: string;
|
---|
| 38 | infoAccess: { [index: string]: string[] | undefined };
|
---|
| 39 | modulus: string;
|
---|
| 40 | exponent: string;
|
---|
| 41 | valid_from: string;
|
---|
| 42 | valid_to: string;
|
---|
| 43 | fingerprint: string;
|
---|
| 44 | fingerprint256: string;
|
---|
| 45 | ext_key_usage: string[];
|
---|
| 46 | serialNumber: string;
|
---|
| 47 | raw: Buffer;
|
---|
| 48 | }
|
---|
| 49 |
|
---|
| 50 | interface DetailedPeerCertificate extends PeerCertificate {
|
---|
| 51 | issuerCertificate: DetailedPeerCertificate;
|
---|
| 52 | }
|
---|
| 53 |
|
---|
| 54 | interface CipherNameAndProtocol {
|
---|
| 55 | /**
|
---|
| 56 | * The cipher name.
|
---|
| 57 | */
|
---|
| 58 | name: string;
|
---|
| 59 | /**
|
---|
| 60 | * SSL/TLS protocol version.
|
---|
| 61 | */
|
---|
| 62 | version: string;
|
---|
| 63 | }
|
---|
| 64 |
|
---|
| 65 | interface EphemeralKeyInfo {
|
---|
| 66 | /**
|
---|
| 67 | * The supported types are 'DH' and 'ECDH'.
|
---|
| 68 | */
|
---|
| 69 | type: string;
|
---|
| 70 | /**
|
---|
| 71 | * The name property is available only when type is 'ECDH'.
|
---|
| 72 | */
|
---|
| 73 | name?: string | undefined;
|
---|
| 74 | /**
|
---|
| 75 | * The size of parameter of an ephemeral key exchange.
|
---|
| 76 | */
|
---|
| 77 | size: number;
|
---|
| 78 | }
|
---|
| 79 |
|
---|
| 80 | interface KeyObject {
|
---|
| 81 | /**
|
---|
| 82 | * Private keys in PEM format.
|
---|
| 83 | */
|
---|
| 84 | pem: string | Buffer;
|
---|
| 85 | /**
|
---|
| 86 | * Optional passphrase.
|
---|
| 87 | */
|
---|
| 88 | passphrase?: string | undefined;
|
---|
| 89 | }
|
---|
| 90 |
|
---|
| 91 | interface PxfObject {
|
---|
| 92 | /**
|
---|
| 93 | * PFX or PKCS12 encoded private key and certificate chain.
|
---|
| 94 | */
|
---|
| 95 | buf: string | Buffer;
|
---|
| 96 | /**
|
---|
| 97 | * Optional passphrase.
|
---|
| 98 | */
|
---|
| 99 | passphrase?: string | undefined;
|
---|
| 100 | }
|
---|
| 101 |
|
---|
| 102 | interface TLSSocketOptions extends SecureContextOptions, CommonConnectionOptions {
|
---|
| 103 | /**
|
---|
| 104 | * If true the TLS socket will be instantiated in server-mode.
|
---|
| 105 | * Defaults to false.
|
---|
| 106 | */
|
---|
| 107 | isServer?: boolean | undefined;
|
---|
| 108 | /**
|
---|
| 109 | * An optional net.Server instance.
|
---|
| 110 | */
|
---|
| 111 | server?: net.Server | undefined;
|
---|
| 112 |
|
---|
| 113 | /**
|
---|
| 114 | * An optional Buffer instance containing a TLS session.
|
---|
| 115 | */
|
---|
| 116 | session?: Buffer | undefined;
|
---|
| 117 | /**
|
---|
| 118 | * If true, specifies that the OCSP status request extension will be
|
---|
| 119 | * added to the client hello and an 'OCSPResponse' event will be
|
---|
| 120 | * emitted on the socket before establishing a secure communication
|
---|
| 121 | */
|
---|
| 122 | requestOCSP?: boolean | undefined;
|
---|
| 123 | }
|
---|
| 124 |
|
---|
| 125 | class TLSSocket extends net.Socket {
|
---|
| 126 | /**
|
---|
| 127 | * Construct a new tls.TLSSocket object from an existing TCP socket.
|
---|
| 128 | */
|
---|
| 129 | constructor(socket: net.Socket, options?: TLSSocketOptions);
|
---|
| 130 |
|
---|
| 131 | /**
|
---|
| 132 | * A boolean that is true if the peer certificate was signed by one of the specified CAs, otherwise false.
|
---|
| 133 | */
|
---|
| 134 | authorized: boolean;
|
---|
| 135 | /**
|
---|
| 136 | * The reason why the peer's certificate has not been verified.
|
---|
| 137 | * This property becomes available only when tlsSocket.authorized === false.
|
---|
| 138 | */
|
---|
| 139 | authorizationError: Error;
|
---|
| 140 | /**
|
---|
| 141 | * Static boolean value, always true.
|
---|
| 142 | * May be used to distinguish TLS sockets from regular ones.
|
---|
| 143 | */
|
---|
| 144 | encrypted: boolean;
|
---|
| 145 |
|
---|
| 146 | /**
|
---|
| 147 | * String containing the selected ALPN protocol.
|
---|
| 148 | * Before a handshake has completed, this value is always null.
|
---|
| 149 | * When a handshake is completed but not ALPN protocol was selected, tlsSocket.alpnProtocol equals false.
|
---|
| 150 | */
|
---|
| 151 | alpnProtocol: string | false | null;
|
---|
| 152 |
|
---|
| 153 | /**
|
---|
| 154 | * Returns an object representing the local certificate. The returned
|
---|
| 155 | * object has some properties corresponding to the fields of the
|
---|
| 156 | * certificate.
|
---|
| 157 | *
|
---|
| 158 | * See tls.TLSSocket.getPeerCertificate() for an example of the
|
---|
| 159 | * certificate structure.
|
---|
| 160 | *
|
---|
| 161 | * If there is no local certificate, an empty object will be returned.
|
---|
| 162 | * If the socket has been destroyed, null will be returned.
|
---|
| 163 | */
|
---|
| 164 | getCertificate(): PeerCertificate | object | null;
|
---|
| 165 | /**
|
---|
| 166 | * Returns an object representing the cipher name and the SSL/TLS protocol version of the current connection.
|
---|
| 167 | * @returns Returns an object representing the cipher name
|
---|
| 168 | * and the SSL/TLS protocol version of the current connection.
|
---|
| 169 | */
|
---|
| 170 | getCipher(): CipherNameAndProtocol;
|
---|
| 171 | /**
|
---|
| 172 | * Returns an object representing the type, name, and size of parameter
|
---|
| 173 | * of an ephemeral key exchange in Perfect Forward Secrecy on a client
|
---|
| 174 | * connection. It returns an empty object when the key exchange is not
|
---|
| 175 | * ephemeral. As this is only supported on a client socket; null is
|
---|
| 176 | * returned if called on a server socket. The supported types are 'DH'
|
---|
| 177 | * and 'ECDH'. The name property is available only when type is 'ECDH'.
|
---|
| 178 | *
|
---|
| 179 | * For example: { type: 'ECDH', name: 'prime256v1', size: 256 }.
|
---|
| 180 | */
|
---|
| 181 | getEphemeralKeyInfo(): EphemeralKeyInfo | object | null;
|
---|
| 182 | /**
|
---|
| 183 | * Returns the latest Finished message that has
|
---|
| 184 | * been sent to the socket as part of a SSL/TLS handshake, or undefined
|
---|
| 185 | * if no Finished message has been sent yet.
|
---|
| 186 | *
|
---|
| 187 | * As the Finished messages are message digests of the complete
|
---|
| 188 | * handshake (with a total of 192 bits for TLS 1.0 and more for SSL
|
---|
| 189 | * 3.0), they can be used for external authentication procedures when
|
---|
| 190 | * the authentication provided by SSL/TLS is not desired or is not
|
---|
| 191 | * enough.
|
---|
| 192 | *
|
---|
| 193 | * Corresponds to the SSL_get_finished routine in OpenSSL and may be
|
---|
| 194 | * used to implement the tls-unique channel binding from RFC 5929.
|
---|
| 195 | */
|
---|
| 196 | getFinished(): Buffer | undefined;
|
---|
| 197 | /**
|
---|
| 198 | * Returns an object representing the peer's certificate.
|
---|
| 199 | * The returned object has some properties corresponding to the field of the certificate.
|
---|
| 200 | * If detailed argument is true the full chain with issuer property will be returned,
|
---|
| 201 | * if false only the top certificate without issuer property.
|
---|
| 202 | * If the peer does not provide a certificate, it returns null or an empty object.
|
---|
| 203 | * @param detailed - If true; the full chain with issuer property will be returned.
|
---|
| 204 | * @returns An object representing the peer's certificate.
|
---|
| 205 | */
|
---|
| 206 | getPeerCertificate(detailed: true): DetailedPeerCertificate;
|
---|
| 207 | getPeerCertificate(detailed?: false): PeerCertificate;
|
---|
| 208 | getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate;
|
---|
| 209 | /**
|
---|
| 210 | * Returns the latest Finished message that is expected or has actually
|
---|
| 211 | * been received from the socket as part of a SSL/TLS handshake, or
|
---|
| 212 | * undefined if there is no Finished message so far.
|
---|
| 213 | *
|
---|
| 214 | * As the Finished messages are message digests of the complete
|
---|
| 215 | * handshake (with a total of 192 bits for TLS 1.0 and more for SSL
|
---|
| 216 | * 3.0), they can be used for external authentication procedures when
|
---|
| 217 | * the authentication provided by SSL/TLS is not desired or is not
|
---|
| 218 | * enough.
|
---|
| 219 | *
|
---|
| 220 | * Corresponds to the SSL_get_peer_finished routine in OpenSSL and may
|
---|
| 221 | * be used to implement the tls-unique channel binding from RFC 5929.
|
---|
| 222 | */
|
---|
| 223 | getPeerFinished(): Buffer | undefined;
|
---|
| 224 | /**
|
---|
| 225 | * Returns a string containing the negotiated SSL/TLS protocol version of the current connection.
|
---|
| 226 | * The value `'unknown'` will be returned for connected sockets that have not completed the handshaking process.
|
---|
| 227 | * The value `null` will be returned for server sockets or disconnected client sockets.
|
---|
| 228 | * See https://www.openssl.org/docs/man1.0.2/ssl/SSL_get_version.html for more information.
|
---|
| 229 | * @returns negotiated SSL/TLS protocol version of the current connection
|
---|
| 230 | */
|
---|
| 231 | getProtocol(): string | null;
|
---|
| 232 | /**
|
---|
| 233 | * Could be used to speed up handshake establishment when reconnecting to the server.
|
---|
| 234 | * @returns ASN.1 encoded TLS session or undefined if none was negotiated.
|
---|
| 235 | */
|
---|
| 236 | getSession(): Buffer | undefined;
|
---|
| 237 | /**
|
---|
| 238 | * Returns a list of signature algorithms shared between the server and
|
---|
| 239 | * the client in the order of decreasing preference.
|
---|
| 240 | */
|
---|
| 241 | getSharedSigalgs(): string[];
|
---|
| 242 | /**
|
---|
| 243 | * NOTE: Works only with client TLS sockets.
|
---|
| 244 | * Useful only for debugging, for session reuse provide session option to tls.connect().
|
---|
| 245 | * @returns TLS session ticket or undefined if none was negotiated.
|
---|
| 246 | */
|
---|
| 247 | getTLSTicket(): Buffer | undefined;
|
---|
| 248 | /**
|
---|
| 249 | * Returns true if the session was reused, false otherwise.
|
---|
| 250 | */
|
---|
| 251 | isSessionReused(): boolean;
|
---|
| 252 | /**
|
---|
| 253 | * Initiate TLS renegotiation process.
|
---|
| 254 | *
|
---|
| 255 | * NOTE: Can be used to request peer's certificate after the secure connection has been established.
|
---|
| 256 | * ANOTHER NOTE: When running as the server, socket will be destroyed with an error after handshakeTimeout timeout.
|
---|
| 257 | * @param options - The options may contain the following fields: rejectUnauthorized,
|
---|
| 258 | * requestCert (See tls.createServer() for details).
|
---|
| 259 | * @param callback - callback(err) will be executed with null as err, once the renegotiation
|
---|
| 260 | * is successfully completed.
|
---|
| 261 | * @return `undefined` when socket is destroy, `false` if negotiaion can't be initiated.
|
---|
| 262 | */
|
---|
| 263 | renegotiate(options: { rejectUnauthorized?: boolean | undefined, requestCert?: boolean | undefined }, callback: (err: Error | null) => void): undefined | boolean;
|
---|
| 264 | /**
|
---|
| 265 | * Set maximum TLS fragment size (default and maximum value is: 16384, minimum is: 512).
|
---|
| 266 | * Smaller fragment size decreases buffering latency on the client: large fragments are buffered by
|
---|
| 267 | * the TLS layer until the entire fragment is received and its integrity is verified;
|
---|
| 268 | * large fragments can span multiple roundtrips, and their processing can be delayed due to packet
|
---|
| 269 | * loss or reordering. However, smaller fragments add extra TLS framing bytes and CPU overhead,
|
---|
| 270 | * which may decrease overall server throughput.
|
---|
| 271 | * @param size - TLS fragment size (default and maximum value is: 16384, minimum is: 512).
|
---|
| 272 | * @returns Returns true on success, false otherwise.
|
---|
| 273 | */
|
---|
| 274 | setMaxSendFragment(size: number): boolean;
|
---|
| 275 |
|
---|
| 276 | /**
|
---|
| 277 | * Disables TLS renegotiation for this TLSSocket instance. Once called,
|
---|
| 278 | * attempts to renegotiate will trigger an 'error' event on the
|
---|
| 279 | * TLSSocket.
|
---|
| 280 | */
|
---|
| 281 | disableRenegotiation(): void;
|
---|
| 282 |
|
---|
| 283 | /**
|
---|
| 284 | * When enabled, TLS packet trace information is written to `stderr`. This can be
|
---|
| 285 | * used to debug TLS connection problems.
|
---|
| 286 | *
|
---|
| 287 | * Note: The format of the output is identical to the output of `openssl s_client
|
---|
| 288 | * -trace` or `openssl s_server -trace`. While it is produced by OpenSSL's
|
---|
| 289 | * `SSL_trace()` function, the format is undocumented, can change without notice,
|
---|
| 290 | * and should not be relied on.
|
---|
| 291 | */
|
---|
| 292 | enableTrace(): void;
|
---|
| 293 |
|
---|
| 294 | addListener(event: string, listener: (...args: any[]) => void): this;
|
---|
| 295 | addListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
---|
| 296 | addListener(event: "secureConnect", listener: () => void): this;
|
---|
| 297 | addListener(event: "session", listener: (session: Buffer) => void): this;
|
---|
| 298 | addListener(event: "keylog", listener: (line: Buffer) => void): this;
|
---|
| 299 |
|
---|
| 300 | emit(event: string | symbol, ...args: any[]): boolean;
|
---|
| 301 | emit(event: "OCSPResponse", response: Buffer): boolean;
|
---|
| 302 | emit(event: "secureConnect"): boolean;
|
---|
| 303 | emit(event: "session", session: Buffer): boolean;
|
---|
| 304 | emit(event: "keylog", line: Buffer): boolean;
|
---|
| 305 |
|
---|
| 306 | on(event: string, listener: (...args: any[]) => void): this;
|
---|
| 307 | on(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
---|
| 308 | on(event: "secureConnect", listener: () => void): this;
|
---|
| 309 | on(event: "session", listener: (session: Buffer) => void): this;
|
---|
| 310 | on(event: "keylog", listener: (line: Buffer) => void): this;
|
---|
| 311 |
|
---|
| 312 | once(event: string, listener: (...args: any[]) => void): this;
|
---|
| 313 | once(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
---|
| 314 | once(event: "secureConnect", listener: () => void): this;
|
---|
| 315 | once(event: "session", listener: (session: Buffer) => void): this;
|
---|
| 316 | once(event: "keylog", listener: (line: Buffer) => void): this;
|
---|
| 317 |
|
---|
| 318 | prependListener(event: string, listener: (...args: any[]) => void): this;
|
---|
| 319 | prependListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
---|
| 320 | prependListener(event: "secureConnect", listener: () => void): this;
|
---|
| 321 | prependListener(event: "session", listener: (session: Buffer) => void): this;
|
---|
| 322 | prependListener(event: "keylog", listener: (line: Buffer) => void): this;
|
---|
| 323 |
|
---|
| 324 | prependOnceListener(event: string, listener: (...args: any[]) => void): this;
|
---|
| 325 | prependOnceListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
---|
| 326 | prependOnceListener(event: "secureConnect", listener: () => void): this;
|
---|
| 327 | prependOnceListener(event: "session", listener: (session: Buffer) => void): this;
|
---|
| 328 | prependOnceListener(event: "keylog", listener: (line: Buffer) => void): this;
|
---|
| 329 | }
|
---|
| 330 |
|
---|
| 331 | interface CommonConnectionOptions {
|
---|
| 332 | /**
|
---|
| 333 | * An optional TLS context object from tls.createSecureContext()
|
---|
| 334 | */
|
---|
| 335 | secureContext?: SecureContext | undefined;
|
---|
| 336 |
|
---|
| 337 | /**
|
---|
| 338 | * When enabled, TLS packet trace information is written to `stderr`. This can be
|
---|
| 339 | * used to debug TLS connection problems.
|
---|
| 340 | * @default false
|
---|
| 341 | */
|
---|
| 342 | enableTrace?: boolean | undefined;
|
---|
| 343 | /**
|
---|
| 344 | * If true the server will request a certificate from clients that
|
---|
| 345 | * connect and attempt to verify that certificate. Defaults to
|
---|
| 346 | * false.
|
---|
| 347 | */
|
---|
| 348 | requestCert?: boolean | undefined;
|
---|
| 349 | /**
|
---|
| 350 | * An array of strings or a Buffer naming possible ALPN protocols.
|
---|
| 351 | * (Protocols should be ordered by their priority.)
|
---|
| 352 | */
|
---|
| 353 | ALPNProtocols?: string[] | Uint8Array[] | Uint8Array | undefined;
|
---|
| 354 | /**
|
---|
| 355 | * SNICallback(servername, cb) <Function> A function that will be
|
---|
| 356 | * called if the client supports SNI TLS extension. Two arguments
|
---|
| 357 | * will be passed when called: servername and cb. SNICallback should
|
---|
| 358 | * invoke cb(null, ctx), where ctx is a SecureContext instance.
|
---|
| 359 | * (tls.createSecureContext(...) can be used to get a proper
|
---|
| 360 | * SecureContext.) If SNICallback wasn't provided the default callback
|
---|
| 361 | * with high-level API will be used (see below).
|
---|
| 362 | */
|
---|
| 363 | SNICallback?: ((servername: string, cb: (err: Error | null, ctx: SecureContext) => void) => void) | undefined;
|
---|
| 364 | /**
|
---|
| 365 | * If true the server will reject any connection which is not
|
---|
| 366 | * authorized with the list of supplied CAs. This option only has an
|
---|
| 367 | * effect if requestCert is true.
|
---|
| 368 | * @default true
|
---|
| 369 | */
|
---|
| 370 | rejectUnauthorized?: boolean | undefined;
|
---|
| 371 | }
|
---|
| 372 |
|
---|
| 373 | interface TlsOptions extends SecureContextOptions, CommonConnectionOptions {
|
---|
| 374 | /**
|
---|
| 375 | * Abort the connection if the SSL/TLS handshake does not finish in the
|
---|
| 376 | * specified number of milliseconds. A 'tlsClientError' is emitted on
|
---|
| 377 | * the tls.Server object whenever a handshake times out. Default:
|
---|
| 378 | * 120000 (120 seconds).
|
---|
| 379 | */
|
---|
| 380 | handshakeTimeout?: number | undefined;
|
---|
| 381 | /**
|
---|
| 382 | * The number of seconds after which a TLS session created by the
|
---|
| 383 | * server will no longer be resumable. See Session Resumption for more
|
---|
| 384 | * information. Default: 300.
|
---|
| 385 | */
|
---|
| 386 | sessionTimeout?: number | undefined;
|
---|
| 387 | /**
|
---|
| 388 | * 48-bytes of cryptographically strong pseudo-random data.
|
---|
| 389 | */
|
---|
| 390 | ticketKeys?: Buffer | undefined;
|
---|
| 391 | }
|
---|
| 392 |
|
---|
| 393 | interface ConnectionOptions extends SecureContextOptions, CommonConnectionOptions {
|
---|
| 394 | host?: string | undefined;
|
---|
| 395 | port?: number | undefined;
|
---|
| 396 | path?: string | undefined; // Creates unix socket connection to path. If this option is specified, `host` and `port` are ignored.
|
---|
| 397 | socket?: net.Socket | undefined; // Establish secure connection on a given socket rather than creating a new socket
|
---|
| 398 | checkServerIdentity?: typeof checkServerIdentity | undefined;
|
---|
| 399 | servername?: string | undefined; // SNI TLS Extension
|
---|
| 400 | session?: Buffer | undefined;
|
---|
| 401 | minDHSize?: number | undefined;
|
---|
| 402 | lookup?: net.LookupFunction | undefined;
|
---|
| 403 | timeout?: number | undefined;
|
---|
| 404 | }
|
---|
| 405 |
|
---|
| 406 | class Server extends net.Server {
|
---|
| 407 | /**
|
---|
| 408 | * The server.addContext() method adds a secure context that will be
|
---|
| 409 | * used if the client request's SNI name matches the supplied hostname
|
---|
| 410 | * (or wildcard).
|
---|
| 411 | */
|
---|
| 412 | addContext(hostName: string, credentials: SecureContextOptions): void;
|
---|
| 413 | /**
|
---|
| 414 | * Returns the session ticket keys.
|
---|
| 415 | */
|
---|
| 416 | getTicketKeys(): Buffer;
|
---|
| 417 | /**
|
---|
| 418 | *
|
---|
| 419 | * The server.setSecureContext() method replaces the
|
---|
| 420 | * secure context of an existing server. Existing connections to the
|
---|
| 421 | * server are not interrupted.
|
---|
| 422 | */
|
---|
| 423 | setSecureContext(details: SecureContextOptions): void;
|
---|
| 424 | /**
|
---|
| 425 | * The server.setSecureContext() method replaces the secure context of
|
---|
| 426 | * an existing server. Existing connections to the server are not
|
---|
| 427 | * interrupted.
|
---|
| 428 | */
|
---|
| 429 | setTicketKeys(keys: Buffer): void;
|
---|
| 430 |
|
---|
| 431 | /**
|
---|
| 432 | * events.EventEmitter
|
---|
| 433 | * 1. tlsClientError
|
---|
| 434 | * 2. newSession
|
---|
| 435 | * 3. OCSPRequest
|
---|
| 436 | * 4. resumeSession
|
---|
| 437 | * 5. secureConnection
|
---|
| 438 | * 6. keylog
|
---|
| 439 | */
|
---|
| 440 | addListener(event: string, listener: (...args: any[]) => void): this;
|
---|
| 441 | addListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
---|
| 442 | addListener(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
---|
| 443 | addListener(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
---|
| 444 | addListener(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
---|
| 445 | addListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
---|
| 446 | addListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
---|
| 447 |
|
---|
| 448 | emit(event: string | symbol, ...args: any[]): boolean;
|
---|
| 449 | emit(event: "tlsClientError", err: Error, tlsSocket: TLSSocket): boolean;
|
---|
| 450 | emit(event: "newSession", sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void): boolean;
|
---|
| 451 | emit(event: "OCSPRequest", certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void): boolean;
|
---|
| 452 | emit(event: "resumeSession", sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void): boolean;
|
---|
| 453 | emit(event: "secureConnection", tlsSocket: TLSSocket): boolean;
|
---|
| 454 | emit(event: "keylog", line: Buffer, tlsSocket: TLSSocket): boolean;
|
---|
| 455 |
|
---|
| 456 | on(event: string, listener: (...args: any[]) => void): this;
|
---|
| 457 | on(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
---|
| 458 | on(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
---|
| 459 | on(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
---|
| 460 | on(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
---|
| 461 | on(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
---|
| 462 | on(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
---|
| 463 |
|
---|
| 464 | once(event: string, listener: (...args: any[]) => void): this;
|
---|
| 465 | once(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
---|
| 466 | once(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
---|
| 467 | once(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
---|
| 468 | once(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
---|
| 469 | once(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
---|
| 470 | once(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
---|
| 471 |
|
---|
| 472 | prependListener(event: string, listener: (...args: any[]) => void): this;
|
---|
| 473 | prependListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
---|
| 474 | prependListener(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
---|
| 475 | prependListener(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
---|
| 476 | prependListener(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
---|
| 477 | prependListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
---|
| 478 | prependListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
---|
| 479 |
|
---|
| 480 | prependOnceListener(event: string, listener: (...args: any[]) => void): this;
|
---|
| 481 | prependOnceListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
---|
| 482 | prependOnceListener(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
---|
| 483 | prependOnceListener(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
---|
| 484 | prependOnceListener(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
---|
| 485 | prependOnceListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
---|
| 486 | prependOnceListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
---|
| 487 | }
|
---|
| 488 |
|
---|
| 489 | interface SecurePair {
|
---|
| 490 | encrypted: TLSSocket;
|
---|
| 491 | cleartext: TLSSocket;
|
---|
| 492 | }
|
---|
| 493 |
|
---|
| 494 | type SecureVersion = 'TLSv1.3' | 'TLSv1.2' | 'TLSv1.1' | 'TLSv1';
|
---|
| 495 |
|
---|
| 496 | interface SecureContextOptions {
|
---|
| 497 | /**
|
---|
| 498 | * Optionally override the trusted CA certificates. Default is to trust
|
---|
| 499 | * the well-known CAs curated by Mozilla. Mozilla's CAs are completely
|
---|
| 500 | * replaced when CAs are explicitly specified using this option.
|
---|
| 501 | */
|
---|
| 502 | ca?: string | Buffer | Array<string | Buffer> | undefined;
|
---|
| 503 | /**
|
---|
| 504 | * Cert chains in PEM format. One cert chain should be provided per
|
---|
| 505 | * private key. Each cert chain should consist of the PEM formatted
|
---|
| 506 | * certificate for a provided private key, followed by the PEM
|
---|
| 507 | * formatted intermediate certificates (if any), in order, and not
|
---|
| 508 | * including the root CA (the root CA must be pre-known to the peer,
|
---|
| 509 | * see ca). When providing multiple cert chains, they do not have to
|
---|
| 510 | * be in the same order as their private keys in key. If the
|
---|
| 511 | * intermediate certificates are not provided, the peer will not be
|
---|
| 512 | * able to validate the certificate, and the handshake will fail.
|
---|
| 513 | */
|
---|
| 514 | cert?: string | Buffer | Array<string | Buffer> | undefined;
|
---|
| 515 | /**
|
---|
| 516 | * Colon-separated list of supported signature algorithms. The list
|
---|
| 517 | * can contain digest algorithms (SHA256, MD5 etc.), public key
|
---|
| 518 | * algorithms (RSA-PSS, ECDSA etc.), combination of both (e.g
|
---|
| 519 | * 'RSA+SHA384') or TLS v1.3 scheme names (e.g. rsa_pss_pss_sha512).
|
---|
| 520 | */
|
---|
| 521 | sigalgs?: string | undefined;
|
---|
| 522 | /**
|
---|
| 523 | * Cipher suite specification, replacing the default. For more
|
---|
| 524 | * information, see modifying the default cipher suite. Permitted
|
---|
| 525 | * ciphers can be obtained via tls.getCiphers(). Cipher names must be
|
---|
| 526 | * uppercased in order for OpenSSL to accept them.
|
---|
| 527 | */
|
---|
| 528 | ciphers?: string | undefined;
|
---|
| 529 | /**
|
---|
| 530 | * Name of an OpenSSL engine which can provide the client certificate.
|
---|
| 531 | */
|
---|
| 532 | clientCertEngine?: string | undefined;
|
---|
| 533 | /**
|
---|
| 534 | * PEM formatted CRLs (Certificate Revocation Lists).
|
---|
| 535 | */
|
---|
| 536 | crl?: string | Buffer | Array<string | Buffer> | undefined;
|
---|
| 537 | /**
|
---|
| 538 | * Diffie Hellman parameters, required for Perfect Forward Secrecy. Use
|
---|
| 539 | * openssl dhparam to create the parameters. The key length must be
|
---|
| 540 | * greater than or equal to 1024 bits or else an error will be thrown.
|
---|
| 541 | * Although 1024 bits is permissible, use 2048 bits or larger for
|
---|
| 542 | * stronger security. If omitted or invalid, the parameters are
|
---|
| 543 | * silently discarded and DHE ciphers will not be available.
|
---|
| 544 | */
|
---|
| 545 | dhparam?: string | Buffer | undefined;
|
---|
| 546 | /**
|
---|
| 547 | * A string describing a named curve or a colon separated list of curve
|
---|
| 548 | * NIDs or names, for example P-521:P-384:P-256, to use for ECDH key
|
---|
| 549 | * agreement. Set to auto to select the curve automatically. Use
|
---|
| 550 | * crypto.getCurves() to obtain a list of available curve names. On
|
---|
| 551 | * recent releases, openssl ecparam -list_curves will also display the
|
---|
| 552 | * name and description of each available elliptic curve. Default:
|
---|
| 553 | * tls.DEFAULT_ECDH_CURVE.
|
---|
| 554 | */
|
---|
| 555 | ecdhCurve?: string | undefined;
|
---|
| 556 | /**
|
---|
| 557 | * Attempt to use the server's cipher suite preferences instead of the
|
---|
| 558 | * client's. When true, causes SSL_OP_CIPHER_SERVER_PREFERENCE to be
|
---|
| 559 | * set in secureOptions
|
---|
| 560 | */
|
---|
| 561 | honorCipherOrder?: boolean | undefined;
|
---|
| 562 | /**
|
---|
| 563 | * Private keys in PEM format. PEM allows the option of private keys
|
---|
| 564 | * being encrypted. Encrypted keys will be decrypted with
|
---|
| 565 | * options.passphrase. Multiple keys using different algorithms can be
|
---|
| 566 | * provided either as an array of unencrypted key strings or buffers,
|
---|
| 567 | * or an array of objects in the form {pem: <string|buffer>[,
|
---|
| 568 | * passphrase: <string>]}. The object form can only occur in an array.
|
---|
| 569 | * object.passphrase is optional. Encrypted keys will be decrypted with
|
---|
| 570 | * object.passphrase if provided, or options.passphrase if it is not.
|
---|
| 571 | */
|
---|
| 572 | key?: string | Buffer | Array<Buffer | KeyObject> | undefined;
|
---|
| 573 | /**
|
---|
| 574 | * Name of an OpenSSL engine to get private key from. Should be used
|
---|
| 575 | * together with privateKeyIdentifier.
|
---|
| 576 | */
|
---|
| 577 | privateKeyEngine?: string | undefined;
|
---|
| 578 | /**
|
---|
| 579 | * Identifier of a private key managed by an OpenSSL engine. Should be
|
---|
| 580 | * used together with privateKeyEngine. Should not be set together with
|
---|
| 581 | * key, because both options define a private key in different ways.
|
---|
| 582 | */
|
---|
| 583 | privateKeyIdentifier?: string | undefined;
|
---|
| 584 | /**
|
---|
| 585 | * Optionally set the maximum TLS version to allow. One
|
---|
| 586 | * of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified along with the
|
---|
| 587 | * `secureProtocol` option, use one or the other.
|
---|
| 588 | * **Default:** `'TLSv1.3'`, unless changed using CLI options. Using
|
---|
| 589 | * `--tls-max-v1.2` sets the default to `'TLSv1.2'`. Using `--tls-max-v1.3` sets the default to
|
---|
| 590 | * `'TLSv1.3'`. If multiple of the options are provided, the highest maximum is used.
|
---|
| 591 | */
|
---|
| 592 | maxVersion?: SecureVersion | undefined;
|
---|
| 593 | /**
|
---|
| 594 | * Optionally set the minimum TLS version to allow. One
|
---|
| 595 | * of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified along with the
|
---|
| 596 | * `secureProtocol` option, use one or the other. It is not recommended to use
|
---|
| 597 | * less than TLSv1.2, but it may be required for interoperability.
|
---|
| 598 | * **Default:** `'TLSv1.2'`, unless changed using CLI options. Using
|
---|
| 599 | * `--tls-v1.0` sets the default to `'TLSv1'`. Using `--tls-v1.1` sets the default to
|
---|
| 600 | * `'TLSv1.1'`. Using `--tls-min-v1.3` sets the default to
|
---|
| 601 | * 'TLSv1.3'. If multiple of the options are provided, the lowest minimum is used.
|
---|
| 602 | */
|
---|
| 603 | minVersion?: SecureVersion | undefined;
|
---|
| 604 | /**
|
---|
| 605 | * Shared passphrase used for a single private key and/or a PFX.
|
---|
| 606 | */
|
---|
| 607 | passphrase?: string | undefined;
|
---|
| 608 | /**
|
---|
| 609 | * PFX or PKCS12 encoded private key and certificate chain. pfx is an
|
---|
| 610 | * alternative to providing key and cert individually. PFX is usually
|
---|
| 611 | * encrypted, if it is, passphrase will be used to decrypt it. Multiple
|
---|
| 612 | * PFX can be provided either as an array of unencrypted PFX buffers,
|
---|
| 613 | * or an array of objects in the form {buf: <string|buffer>[,
|
---|
| 614 | * passphrase: <string>]}. The object form can only occur in an array.
|
---|
| 615 | * object.passphrase is optional. Encrypted PFX will be decrypted with
|
---|
| 616 | * object.passphrase if provided, or options.passphrase if it is not.
|
---|
| 617 | */
|
---|
| 618 | pfx?: string | Buffer | Array<string | Buffer | PxfObject> | undefined;
|
---|
| 619 | /**
|
---|
| 620 | * Optionally affect the OpenSSL protocol behavior, which is not
|
---|
| 621 | * usually necessary. This should be used carefully if at all! Value is
|
---|
| 622 | * a numeric bitmask of the SSL_OP_* options from OpenSSL Options
|
---|
| 623 | */
|
---|
| 624 | secureOptions?: number | undefined; // Value is a numeric bitmask of the `SSL_OP_*` options
|
---|
| 625 | /**
|
---|
| 626 | * Legacy mechanism to select the TLS protocol version to use, it does
|
---|
| 627 | * not support independent control of the minimum and maximum version,
|
---|
| 628 | * and does not support limiting the protocol to TLSv1.3. Use
|
---|
| 629 | * minVersion and maxVersion instead. The possible values are listed as
|
---|
| 630 | * SSL_METHODS, use the function names as strings. For example, use
|
---|
| 631 | * 'TLSv1_1_method' to force TLS version 1.1, or 'TLS_method' to allow
|
---|
| 632 | * any TLS protocol version up to TLSv1.3. It is not recommended to use
|
---|
| 633 | * TLS versions less than 1.2, but it may be required for
|
---|
| 634 | * interoperability. Default: none, see minVersion.
|
---|
| 635 | */
|
---|
| 636 | secureProtocol?: string | undefined;
|
---|
| 637 | /**
|
---|
| 638 | * Opaque identifier used by servers to ensure session state is not
|
---|
| 639 | * shared between applications. Unused by clients.
|
---|
| 640 | */
|
---|
| 641 | sessionIdContext?: string | undefined;
|
---|
| 642 | /**
|
---|
| 643 | * 48-bytes of cryptographically strong pseudo-random data.
|
---|
| 644 | * See Session Resumption for more information.
|
---|
| 645 | */
|
---|
| 646 | ticketKeys?: Buffer | undefined;
|
---|
| 647 | /**
|
---|
| 648 | * The number of seconds after which a TLS session created by the
|
---|
| 649 | * server will no longer be resumable. See Session Resumption for more
|
---|
| 650 | * information. Default: 300.
|
---|
| 651 | */
|
---|
| 652 | sessionTimeout?: number | undefined;
|
---|
| 653 | }
|
---|
| 654 |
|
---|
| 655 | interface SecureContext {
|
---|
| 656 | context: any;
|
---|
| 657 | }
|
---|
| 658 |
|
---|
| 659 | /*
|
---|
| 660 | * Verifies the certificate `cert` is issued to host `host`.
|
---|
| 661 | * @host The hostname to verify the certificate against
|
---|
| 662 | * @cert PeerCertificate representing the peer's certificate
|
---|
| 663 | *
|
---|
| 664 | * Returns Error object, populating it with the reason, host and cert on failure. On success, returns undefined.
|
---|
| 665 | */
|
---|
| 666 | function checkServerIdentity(host: string, cert: PeerCertificate): Error | undefined;
|
---|
| 667 | function createServer(secureConnectionListener?: (socket: TLSSocket) => void): Server;
|
---|
| 668 | function createServer(options: TlsOptions, secureConnectionListener?: (socket: TLSSocket) => void): Server;
|
---|
| 669 | function connect(options: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
---|
| 670 | function connect(port: number, host?: string, options?: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
---|
| 671 | function connect(port: number, options?: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
---|
| 672 | /**
|
---|
| 673 | * @deprecated
|
---|
| 674 | */
|
---|
| 675 | function createSecurePair(credentials?: SecureContext, isServer?: boolean, requestCert?: boolean, rejectUnauthorized?: boolean): SecurePair;
|
---|
| 676 | function createSecureContext(options?: SecureContextOptions): SecureContext;
|
---|
| 677 | function getCiphers(): string[];
|
---|
| 678 |
|
---|
| 679 | /**
|
---|
| 680 | * The default curve name to use for ECDH key agreement in a tls server.
|
---|
| 681 | * The default value is 'auto'. See tls.createSecureContext() for further
|
---|
| 682 | * information.
|
---|
| 683 | */
|
---|
| 684 | let DEFAULT_ECDH_CURVE: string;
|
---|
| 685 | /**
|
---|
| 686 | * The default value of the maxVersion option of
|
---|
| 687 | * tls.createSecureContext(). It can be assigned any of the supported TLS
|
---|
| 688 | * protocol versions, 'TLSv1.3', 'TLSv1.2', 'TLSv1.1', or 'TLSv1'. Default:
|
---|
| 689 | * 'TLSv1.3', unless changed using CLI options. Using --tls-max-v1.2 sets
|
---|
| 690 | * the default to 'TLSv1.2'. Using --tls-max-v1.3 sets the default to
|
---|
| 691 | * 'TLSv1.3'. If multiple of the options are provided, the highest maximum
|
---|
| 692 | * is used.
|
---|
| 693 | */
|
---|
| 694 | let DEFAULT_MAX_VERSION: SecureVersion;
|
---|
| 695 | /**
|
---|
| 696 | * The default value of the minVersion option of tls.createSecureContext().
|
---|
| 697 | * It can be assigned any of the supported TLS protocol versions,
|
---|
| 698 | * 'TLSv1.3', 'TLSv1.2', 'TLSv1.1', or 'TLSv1'. Default: 'TLSv1.2', unless
|
---|
| 699 | * changed using CLI options. Using --tls-min-v1.0 sets the default to
|
---|
| 700 | * 'TLSv1'. Using --tls-min-v1.1 sets the default to 'TLSv1.1'. Using
|
---|
| 701 | * --tls-min-v1.3 sets the default to 'TLSv1.3'. If multiple of the options
|
---|
| 702 | * are provided, the lowest minimum is used.
|
---|
| 703 | */
|
---|
| 704 | let DEFAULT_MIN_VERSION: SecureVersion;
|
---|
| 705 |
|
---|
| 706 | /**
|
---|
| 707 | * An immutable array of strings representing the root certificates (in PEM
|
---|
| 708 | * format) used for verifying peer certificates. This is the default value
|
---|
| 709 | * of the ca option to tls.createSecureContext().
|
---|
| 710 | */
|
---|
| 711 | const rootCertificates: ReadonlyArray<string>;
|
---|
| 712 | }
|
---|