@dynatrace/js-runtime
Version:
This package provides the Dynatrace JavaScript runtime used by the [Dynatrace App Toolkit](https://www.npmjs.com/package/dt-app).
921 lines (920 loc) • 71.4 kB
TypeScript
/**
* This module is not supported by the Dynatrace JavaScript Runtime and only
* exists for its referenced types.
* See the `Node.js Compatibility` section for more information.
* @see https://dt-url.net/runtime-apis
*/
// DT-disabled // /**
// DT-disabled // * The `node:tls` module provides an implementation of the Transport Layer Security
// DT-disabled // * (TLS) and Secure Socket Layer (SSL) protocols that is built on top of OpenSSL.
// DT-disabled // * The module can be accessed using:
// DT-disabled // *
// DT-disabled // * ```js
// DT-disabled // * import tls from 'node:tls';
// DT-disabled // * ```
// DT-disabled // * @see [source](https://github.com/nodejs/node/blob/v22.x/lib/tls.js)
// DT-disabled // */
declare module "tls" {
// DT-disabled // import { X509Certificate } from "node:crypto";
import * as net from "node:net";
import * as stream from "stream";
const CLIENT_RENEG_LIMIT: number;
const CLIENT_RENEG_WINDOW: number;
interface Certificate {
/**
* Country code.
*/
C: string;
/**
* Street.
*/
ST: string;
/**
* Locality.
*/
L: string;
/**
* Organization.
*/
O: string;
/**
* Organizational unit.
*/
OU: string;
/**
* Common name.
*/
CN: string;
}
interface PeerCertificate {
/**
* `true` if a Certificate Authority (CA), `false` otherwise.
* @since v18.13.0
*/
ca: boolean;
/**
* The DER encoded X.509 certificate data.
*/
raw: Buffer;
/**
* The certificate subject.
*/
subject: Certificate;
/**
* The certificate issuer, described in the same terms as the `subject`.
*/
issuer: Certificate;
/**
* The date-time the certificate is valid from.
*/
valid_from: string;
/**
* The date-time the certificate is valid to.
*/
valid_to: string;
/**
* The certificate serial number, as a hex string.
*/
serialNumber: string;
/**
* The SHA-1 digest of the DER encoded certificate.
* It is returned as a `:` separated hexadecimal string.
*/
fingerprint: string;
/**
* The SHA-256 digest of the DER encoded certificate.
* It is returned as a `:` separated hexadecimal string.
*/
fingerprint256: string;
/**
* The SHA-512 digest of the DER encoded certificate.
* It is returned as a `:` separated hexadecimal string.
*/
fingerprint512: string;
/**
* The extended key usage, a set of OIDs.
*/
ext_key_usage?: string[];
/**
* A string containing concatenated names for the subject,
* an alternative to the `subject` names.
*/
subjectaltname?: string;
/**
* An array describing the AuthorityInfoAccess, used with OCSP.
*/
infoAccess?: NodeJS.Dict<string[]>;
/**
* For RSA keys: The RSA bit size.
*
* For EC keys: The key size in bits.
*/
bits?: number;
/**
* The RSA exponent, as a string in hexadecimal number notation.
*/
exponent?: string;
/**
* The RSA modulus, as a hexadecimal string.
*/
modulus?: string;
/**
* The public key.
*/
pubkey?: Buffer;
/**
* The ASN.1 name of the OID of the elliptic curve.
* Well-known curves are identified by an OID.
* While it is unusual, it is possible that the curve
* is identified by its mathematical properties,
* in which case it will not have an OID.
*/
asn1Curve?: string;
/**
* The NIST name for the elliptic curve, if it has one
* (not all well-known curves have been assigned names by NIST).
*/
nistCurve?: string;
}
interface DetailedPeerCertificate extends PeerCertificate {
/**
* The issuer certificate object.
* For self-signed certificates, this may be a circular reference.
*/
issuerCertificate: DetailedPeerCertificate;
}
interface CipherNameAndProtocol {
/**
* The cipher name.
*/
name: string;
/**
* SSL/TLS protocol version.
*/
version: string;
/**
* IETF name for the cipher suite.
*/
standardName: string;
}
interface EphemeralKeyInfo {
/**
* The supported types are 'DH' and 'ECDH'.
*/
type: string;
/**
* The name property is available only when type is 'ECDH'.
*/
name?: string | undefined;
/**
* The size of parameter of an ephemeral key exchange.
*/
size: number;
}
interface KeyObject {
/**
* Private keys in PEM format.
*/
pem: string | Buffer;
/**
* Optional passphrase.
*/
passphrase?: string | undefined;
}
interface PxfObject {
/**
* PFX or PKCS12 encoded private key and certificate chain.
*/
buf: string | Buffer;
/**
* Optional passphrase.
*/
passphrase?: string | undefined;
}
// DT-disabled // interface TLSSocketOptions extends SecureContextOptions, CommonConnectionOptions {
// DT-disabled // /**
// DT-disabled // * If true the TLS socket will be instantiated in server-mode.
// DT-disabled // * Defaults to false.
// DT-disabled // */
// DT-disabled // isServer?: boolean | undefined;
// DT-disabled // /**
// DT-disabled // * An optional net.Server instance.
// DT-disabled // */
// DT-disabled // server?: net.Server | undefined;
// DT-disabled // /**
// DT-disabled // * An optional Buffer instance containing a TLS session.
// DT-disabled // */
// DT-disabled // session?: Buffer | undefined;
// DT-disabled // /**
// DT-disabled // * If true, specifies that the OCSP status request extension will be
// DT-disabled // * added to the client hello and an 'OCSPResponse' event will be
// DT-disabled // * emitted on the socket before establishing a secure communication
// DT-disabled // */
// DT-disabled // requestOCSP?: boolean | undefined;
// DT-disabled // }
// DT-disabled // /**
// DT-disabled // * Performs transparent encryption of written data and all required TLS
// DT-disabled // * negotiation.
// DT-disabled // *
// DT-disabled // * Instances of `tls.TLSSocket` implement the duplex `Stream` interface.
// DT-disabled // *
// DT-disabled // * Methods that return TLS connection metadata (e.g.{@link TLSSocket.getPeerCertificate}) will only return data while the
// DT-disabled // * connection is open.
// DT-disabled // * @since v0.11.4
// DT-disabled // */
// DT-disabled // class TLSSocket extends net.Socket {
// DT-disabled // /**
// DT-disabled // * Construct a new tls.TLSSocket object from an existing TCP socket.
// DT-disabled // */
// DT-disabled // constructor(socket: net.Socket | stream.Duplex, options?: TLSSocketOptions);
// DT-disabled // /**
// DT-disabled // * This property is `true` if the peer certificate was signed by one of the CAs
// DT-disabled // * specified when creating the `tls.TLSSocket` instance, otherwise `false`.
// DT-disabled // * @since v0.11.4
// DT-disabled // */
// DT-disabled // authorized: boolean;
// DT-disabled // /**
// DT-disabled // * Returns the reason why the peer's certificate was not been verified. This
// DT-disabled // * property is set only when `tlsSocket.authorized === false`.
// DT-disabled // * @since v0.11.4
// DT-disabled // */
// DT-disabled // authorizationError: Error;
// DT-disabled // /**
// DT-disabled // * Always returns `true`. This may be used to distinguish TLS sockets from regular`net.Socket` instances.
// DT-disabled // * @since v0.11.4
// DT-disabled // */
// DT-disabled // encrypted: true;
// DT-disabled // /**
// DT-disabled // * String containing the selected ALPN protocol.
// DT-disabled // * Before a handshake has completed, this value is always null.
// DT-disabled // * When a handshake is completed but not ALPN protocol was selected, tlsSocket.alpnProtocol equals false.
// DT-disabled // */
// DT-disabled // alpnProtocol: string | false | null;
// DT-disabled // /**
// DT-disabled // * Returns an object representing the local certificate. The returned object has
// DT-disabled // * some properties corresponding to the fields of the certificate.
// DT-disabled // *
// DT-disabled // * See {@link TLSSocket.getPeerCertificate} for an example of the certificate
// DT-disabled // * structure.
// DT-disabled // *
// DT-disabled // * If there is no local certificate, an empty object will be returned. If the
// DT-disabled // * socket has been destroyed, `null` will be returned.
// DT-disabled // * @since v11.2.0
// DT-disabled // */
// DT-disabled // getCertificate(): PeerCertificate | object | null;
// DT-disabled // /**
// DT-disabled // * Returns an object containing information on the negotiated cipher suite.
// DT-disabled // *
// DT-disabled // * For example, a TLSv1.2 protocol with AES256-SHA cipher:
// DT-disabled // *
// DT-disabled // * ```json
// DT-disabled // * {
// DT-disabled // * "name": "AES256-SHA",
// DT-disabled // * "standardName": "TLS_RSA_WITH_AES_256_CBC_SHA",
// DT-disabled // * "version": "SSLv3"
// DT-disabled // * }
// DT-disabled // * ```
// DT-disabled // *
// DT-disabled // * See [SSL\_CIPHER\_get\_name](https://www.openssl.org/docs/man1.1.1/man3/SSL_CIPHER_get_name.html) for more information.
// DT-disabled // * @since v0.11.4
// DT-disabled // */
// DT-disabled // getCipher(): CipherNameAndProtocol;
// DT-disabled // /**
// DT-disabled // * Returns an object representing the type, name, and size of parameter of
// DT-disabled // * an ephemeral key exchange in `perfect forward secrecy` on a client
// DT-disabled // * connection. It returns an empty object when the key exchange is not
// DT-disabled // * ephemeral. As this is only supported on a client socket; `null` is returned
// DT-disabled // * if called on a server socket. The supported types are `'DH'` and `'ECDH'`. The `name` property is available only when type is `'ECDH'`.
// DT-disabled // *
// DT-disabled // * For example: `{ type: 'ECDH', name: 'prime256v1', size: 256 }`.
// DT-disabled // * @since v5.0.0
// DT-disabled // */
// DT-disabled // getEphemeralKeyInfo(): EphemeralKeyInfo | object | null;
// DT-disabled // /**
// DT-disabled // * As the `Finished` messages are message digests of the complete handshake
// DT-disabled // * (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
// DT-disabled // * be used for external authentication procedures when the authentication
// DT-disabled // * provided by SSL/TLS is not desired or is not enough.
// DT-disabled // *
// DT-disabled // * Corresponds to the `SSL_get_finished` routine in OpenSSL and may be used
// DT-disabled // * to implement the `tls-unique` channel binding from [RFC 5929](https://tools.ietf.org/html/rfc5929).
// DT-disabled // * @since v9.9.0
// DT-disabled // * @return The latest `Finished` message that has been sent to the socket as part of a SSL/TLS handshake, or `undefined` if no `Finished` message has been sent yet.
// DT-disabled // */
// DT-disabled // getFinished(): Buffer | undefined;
// DT-disabled // /**
// DT-disabled // * Returns an object representing the peer's certificate. If the peer does not
// DT-disabled // * provide a certificate, an empty object will be returned. If the socket has been
// DT-disabled // * destroyed, `null` will be returned.
// DT-disabled // *
// DT-disabled // * If the full certificate chain was requested, each certificate will include an`issuerCertificate` property containing an object representing its issuer's
// DT-disabled // * certificate.
// DT-disabled // * @since v0.11.4
// DT-disabled // * @param detailed Include the full certificate chain if `true`, otherwise include just the peer's certificate.
// DT-disabled // * @return A certificate object.
// DT-disabled // */
// DT-disabled // getPeerCertificate(detailed: true): DetailedPeerCertificate;
// DT-disabled // getPeerCertificate(detailed?: false): PeerCertificate;
// DT-disabled // getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate;
// DT-disabled // /**
// DT-disabled // * As the `Finished` messages are message digests of the complete handshake
// DT-disabled // * (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
// DT-disabled // * be used for external authentication procedures when the authentication
// DT-disabled // * provided by SSL/TLS is not desired or is not enough.
// DT-disabled // *
// DT-disabled // * Corresponds to the `SSL_get_peer_finished` routine in OpenSSL and may be used
// DT-disabled // * to implement the `tls-unique` channel binding from [RFC 5929](https://tools.ietf.org/html/rfc5929).
// DT-disabled // * @since v9.9.0
// DT-disabled // * @return The latest `Finished` message that is expected or has actually been received from the socket as part of a SSL/TLS handshake, or `undefined` if there is no `Finished` message so
// DT-disabled // * far.
// DT-disabled // */
// DT-disabled // getPeerFinished(): Buffer | undefined;
// DT-disabled // /**
// DT-disabled // * Returns a string containing the negotiated SSL/TLS protocol version of the
// DT-disabled // * current connection. The value `'unknown'` will be returned for connected
// DT-disabled // * sockets that have not completed the handshaking process. The value `null` will
// DT-disabled // * be returned for server sockets or disconnected client sockets.
// DT-disabled // *
// DT-disabled // * Protocol versions are:
// DT-disabled // *
// DT-disabled // * * `'SSLv3'`
// DT-disabled // * * `'TLSv1'`
// DT-disabled // * * `'TLSv1.1'`
// DT-disabled // * * `'TLSv1.2'`
// DT-disabled // * * `'TLSv1.3'`
// DT-disabled // *
// DT-disabled // * See the OpenSSL [`SSL_get_version`](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_version.html) documentation for more information.
// DT-disabled // * @since v5.7.0
// DT-disabled // */
// DT-disabled // getProtocol(): string | null;
// DT-disabled // /**
// DT-disabled // * Returns the TLS session data or `undefined` if no session was
// DT-disabled // * negotiated. On the client, the data can be provided to the `session` option of {@link connect} to resume the connection. On the server, it may be useful
// DT-disabled // * for debugging.
// DT-disabled // *
// DT-disabled // * See `Session Resumption` for more information.
// DT-disabled // *
// DT-disabled // * Note: `getSession()` works only for TLSv1.2 and below. For TLSv1.3, applications
// DT-disabled // * must use the `'session'` event (it also works for TLSv1.2 and below).
// DT-disabled // * @since v0.11.4
// DT-disabled // */
// DT-disabled // getSession(): Buffer | undefined;
// DT-disabled // /**
// DT-disabled // * See [SSL\_get\_shared\_sigalgs](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_shared_sigalgs.html) for more information.
// DT-disabled // * @since v12.11.0
// DT-disabled // * @return List of signature algorithms shared between the server and the client in the order of decreasing preference.
// DT-disabled // */
// DT-disabled // getSharedSigalgs(): string[];
// DT-disabled // /**
// DT-disabled // * For a client, returns the TLS session ticket if one is available, or`undefined`. For a server, always returns `undefined`.
// DT-disabled // *
// DT-disabled // * It may be useful for debugging.
// DT-disabled // *
// DT-disabled // * See `Session Resumption` for more information.
// DT-disabled // * @since v0.11.4
// DT-disabled // */
// DT-disabled // getTLSTicket(): Buffer | undefined;
// DT-disabled // /**
// DT-disabled // * See `Session Resumption` for more information.
// DT-disabled // * @since v0.5.6
// DT-disabled // * @return `true` if the session was reused, `false` otherwise.
// DT-disabled // */
// DT-disabled // isSessionReused(): boolean;
// DT-disabled // /**
// DT-disabled // * The `tlsSocket.renegotiate()` method initiates a TLS renegotiation process.
// DT-disabled // * Upon completion, the `callback` function will be passed a single argument
// DT-disabled // * that is either an `Error` (if the request failed) or `null`.
// DT-disabled // *
// DT-disabled // * This method can be used to request a peer's certificate after the secure
// DT-disabled // * connection has been established.
// DT-disabled // *
// DT-disabled // * When running as the server, the socket will be destroyed with an error after `handshakeTimeout` timeout.
// DT-disabled // *
// DT-disabled // * For TLSv1.3, renegotiation cannot be initiated, it is not supported by the
// DT-disabled // * protocol.
// DT-disabled // * @since v0.11.8
// DT-disabled // * @param callback If `renegotiate()` returned `true`, callback is attached once to the `'secure'` event. If `renegotiate()` returned `false`, `callback` will be called in the next tick with
// DT-disabled // * an error, unless the `tlsSocket` has been destroyed, in which case `callback` will not be called at all.
// DT-disabled // * @return `true` if renegotiation was initiated, `false` otherwise.
// DT-disabled // */
// DT-disabled // renegotiate(
// DT-disabled // options: {
// DT-disabled // rejectUnauthorized?: boolean | undefined;
// DT-disabled // requestCert?: boolean | undefined;
// DT-disabled // },
// DT-disabled // callback: (err: Error | null) => void,
// DT-disabled // ): undefined | boolean;
// DT-disabled // /**
// DT-disabled // * The `tlsSocket.setKeyCert()` method sets the private key and certificate to use for the socket.
// DT-disabled // * This is mainly useful if you wish to select a server certificate from a TLS server's `ALPNCallback`.
// DT-disabled // * @since v22.5.0, v20.17.0
// DT-disabled // * @param context An object containing at least `key` and `cert` properties from the {@link createSecureContext()} `options`,
// DT-disabled // * or a TLS context object created with {@link createSecureContext()} itself.
// DT-disabled // */
// DT-disabled // setKeyCert(context: SecureContextOptions | SecureContext): void;
// DT-disabled // /**
// DT-disabled // * The `tlsSocket.setMaxSendFragment()` method sets the maximum TLS fragment size.
// DT-disabled // * Returns `true` if setting the limit succeeded; `false` otherwise.
// DT-disabled // *
// DT-disabled // * Smaller fragment sizes decrease the buffering latency on the client: larger
// DT-disabled // * fragments are buffered by the TLS layer until the entire fragment is received
// DT-disabled // * and its integrity is verified; large fragments can span multiple roundtrips
// DT-disabled // * and their processing can be delayed due to packet loss or reordering. However,
// DT-disabled // * smaller fragments add extra TLS framing bytes and CPU overhead, which may
// DT-disabled // * decrease overall server throughput.
// DT-disabled // * @since v0.11.11
// DT-disabled // * @param [size=16384] The maximum TLS fragment size. The maximum value is `16384`.
// DT-disabled // */
// DT-disabled // setMaxSendFragment(size: number): boolean;
// DT-disabled // /**
// DT-disabled // * Disables TLS renegotiation for this `TLSSocket` instance. Once called, attempts
// DT-disabled // * to renegotiate will trigger an `'error'` event on the `TLSSocket`.
// DT-disabled // * @since v8.4.0
// DT-disabled // */
// DT-disabled // disableRenegotiation(): void;
// DT-disabled // /**
// DT-disabled // * When enabled, TLS packet trace information is written to `stderr`. This can be
// DT-disabled // * used to debug TLS connection problems.
// DT-disabled // *
// DT-disabled // * The format of the output is identical to the output of`openssl s_client -trace` or `openssl s_server -trace`. While it is produced by
// DT-disabled // * OpenSSL's `SSL_trace()` function, the format is undocumented, can change
// DT-disabled // * without notice, and should not be relied on.
// DT-disabled // * @since v12.2.0
// DT-disabled // */
// DT-disabled // enableTrace(): void;
// DT-disabled // /**
// DT-disabled // * Returns the peer certificate as an `X509Certificate` object.
// DT-disabled // *
// DT-disabled // * If there is no peer certificate, or the socket has been destroyed,`undefined` will be returned.
// DT-disabled // * @since v15.9.0
// DT-disabled // */
// DT-disabled // getPeerX509Certificate(): X509Certificate | undefined;
// DT-disabled // /**
// DT-disabled // * Returns the local certificate as an `X509Certificate` object.
// DT-disabled // *
// DT-disabled // * If there is no local certificate, or the socket has been destroyed,`undefined` will be returned.
// DT-disabled // * @since v15.9.0
// DT-disabled // */
// DT-disabled // getX509Certificate(): X509Certificate | undefined;
// DT-disabled // /**
// DT-disabled // * Keying material is used for validations to prevent different kind of attacks in
// DT-disabled // * network protocols, for example in the specifications of IEEE 802.1X.
// DT-disabled // *
// DT-disabled // * Example
// DT-disabled // *
// DT-disabled // * ```js
// DT-disabled // * const keyingMaterial = tlsSocket.exportKeyingMaterial(
// DT-disabled // * 128,
// DT-disabled // * 'client finished');
// DT-disabled // *
// DT-disabled // * /*
// DT-disabled // * Example return value of keyingMaterial:
// DT-disabled // * <Buffer 76 26 af 99 c5 56 8e 42 09 91 ef 9f 93 cb ad 6c 7b 65 f8 53 f1 d8 d9
// DT-disabled // * 12 5a 33 b8 b5 25 df 7b 37 9f e0 e2 4f b8 67 83 a3 2f cd 5d 41 42 4c 91
// DT-disabled // * 74 ef 2c ... 78 more bytes>
// DT-disabled // *
// DT-disabled // * ```
// DT-disabled // *
// DT-disabled // * See the OpenSSL [`SSL_export_keying_material`](https://www.openssl.org/docs/man1.1.1/man3/SSL_export_keying_material.html) documentation for more
// DT-disabled // * information.
// DT-disabled // * @since v13.10.0, v12.17.0
// DT-disabled // * @param length number of bytes to retrieve from keying material
// DT-disabled // * @param label an application specific label, typically this will be a value from the [IANA Exporter Label
// DT-disabled // * Registry](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#exporter-labels).
// DT-disabled // * @param context Optionally provide a context.
// DT-disabled // * @return requested bytes of the keying material
// DT-disabled // */
// DT-disabled // exportKeyingMaterial(length: number, label: string, context: Buffer): Buffer;
// DT-disabled // addListener(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // addListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
// DT-disabled // addListener(event: "secureConnect", listener: () => void): this;
// DT-disabled // addListener(event: "session", listener: (session: Buffer) => void): this;
// DT-disabled // addListener(event: "keylog", listener: (line: Buffer) => void): this;
// DT-disabled // emit(event: string | symbol, ...args: any[]): boolean;
// DT-disabled // emit(event: "OCSPResponse", response: Buffer): boolean;
// DT-disabled // emit(event: "secureConnect"): boolean;
// DT-disabled // emit(event: "session", session: Buffer): boolean;
// DT-disabled // emit(event: "keylog", line: Buffer): boolean;
// DT-disabled // on(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // on(event: "OCSPResponse", listener: (response: Buffer) => void): this;
// DT-disabled // on(event: "secureConnect", listener: () => void): this;
// DT-disabled // on(event: "session", listener: (session: Buffer) => void): this;
// DT-disabled // on(event: "keylog", listener: (line: Buffer) => void): this;
// DT-disabled // once(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // once(event: "OCSPResponse", listener: (response: Buffer) => void): this;
// DT-disabled // once(event: "secureConnect", listener: () => void): this;
// DT-disabled // once(event: "session", listener: (session: Buffer) => void): this;
// DT-disabled // once(event: "keylog", listener: (line: Buffer) => void): this;
// DT-disabled // prependListener(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // prependListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
// DT-disabled // prependListener(event: "secureConnect", listener: () => void): this;
// DT-disabled // prependListener(event: "session", listener: (session: Buffer) => void): this;
// DT-disabled // prependListener(event: "keylog", listener: (line: Buffer) => void): this;
// DT-disabled // prependOnceListener(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // prependOnceListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
// DT-disabled // prependOnceListener(event: "secureConnect", listener: () => void): this;
// DT-disabled // prependOnceListener(event: "session", listener: (session: Buffer) => void): this;
// DT-disabled // prependOnceListener(event: "keylog", listener: (line: Buffer) => void): this;
// DT-disabled // }
interface CommonConnectionOptions {
/**
* An optional TLS context object from tls.createSecureContext()
*/
secureContext?: SecureContext | undefined;
/**
* When enabled, TLS packet trace information is written to `stderr`. This can be
* used to debug TLS connection problems.
* @default false
*/
enableTrace?: boolean | undefined;
/**
* If true the server will request a certificate from clients that
* connect and attempt to verify that certificate. Defaults to
* false.
*/
requestCert?: boolean | undefined;
/**
* An array of strings or a Buffer naming possible ALPN protocols.
* (Protocols should be ordered by their priority.)
*/
ALPNProtocols?: string[] | Uint8Array[] | Uint8Array | undefined;
/**
* SNICallback(servername, cb) <Function> A function that will be
* called if the client supports SNI TLS extension. Two arguments
* will be passed when called: servername and cb. SNICallback should
* invoke cb(null, ctx), where ctx is a SecureContext instance.
* (tls.createSecureContext(...) can be used to get a proper
* SecureContext.) If SNICallback wasn't provided the default callback
* with high-level API will be used (see below).
*/
SNICallback?: ((servername: string, cb: (err: Error | null, ctx?: SecureContext) => void) => void) | undefined;
/**
* If true the server will reject any connection which is not
* authorized with the list of supplied CAs. This option only has an
* effect if requestCert is true.
* @default true
*/
rejectUnauthorized?: boolean | undefined;
}
// DT-disabled // interface TlsOptions extends SecureContextOptions, CommonConnectionOptions, net.ServerOpts {
// DT-disabled // /**
// DT-disabled // * Abort the connection if the SSL/TLS handshake does not finish in the
// DT-disabled // * specified number of milliseconds. A 'tlsClientError' is emitted on
// DT-disabled // * the tls.Server object whenever a handshake times out. Default:
// DT-disabled // * 120000 (120 seconds).
// DT-disabled // */
// DT-disabled // handshakeTimeout?: number | undefined;
// DT-disabled // /**
// DT-disabled // * The number of seconds after which a TLS session created by the
// DT-disabled // * server will no longer be resumable. See Session Resumption for more
// DT-disabled // * information. Default: 300.
// DT-disabled // */
// DT-disabled // sessionTimeout?: number | undefined;
// DT-disabled // /**
// DT-disabled // * 48-bytes of cryptographically strong pseudo-random data.
// DT-disabled // */
// DT-disabled // ticketKeys?: Buffer | undefined;
// DT-disabled // /**
// DT-disabled // * @param socket
// DT-disabled // * @param identity identity parameter sent from the client.
// DT-disabled // * @return pre-shared key that must either be
// DT-disabled // * a buffer or `null` to stop the negotiation process. Returned PSK must be
// DT-disabled // * compatible with the selected cipher's digest.
// DT-disabled // *
// DT-disabled // * When negotiating TLS-PSK (pre-shared keys), this function is called
// DT-disabled // * with the identity provided by the client.
// DT-disabled // * If the return value is `null` the negotiation process will stop and an
// DT-disabled // * "unknown_psk_identity" alert message will be sent to the other party.
// DT-disabled // * If the server wishes to hide the fact that the PSK identity was not known,
// DT-disabled // * the callback must provide some random data as `psk` to make the connection
// DT-disabled // * fail with "decrypt_error" before negotiation is finished.
// DT-disabled // * PSK ciphers are disabled by default, and using TLS-PSK thus
// DT-disabled // * requires explicitly specifying a cipher suite with the `ciphers` option.
// DT-disabled // * More information can be found in the RFC 4279.
// DT-disabled // */
// DT-disabled // pskCallback?(socket: TLSSocket, identity: string): DataView | NodeJS.TypedArray | null;
// DT-disabled // /**
// DT-disabled // * hint to send to a client to help
// DT-disabled // * with selecting the identity during TLS-PSK negotiation. Will be ignored
// DT-disabled // * in TLS 1.3. Upon failing to set pskIdentityHint `tlsClientError` will be
// DT-disabled // * emitted with `ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED` code.
// DT-disabled // */
// DT-disabled // pskIdentityHint?: string | undefined;
// DT-disabled // }
interface PSKCallbackNegotation {
psk: DataView | NodeJS.TypedArray;
identity: string;
}
interface ConnectionOptions extends SecureContextOptions, CommonConnectionOptions {
host?: string | undefined;
port?: number | undefined;
path?: string | undefined; // Creates unix socket connection to path. If this option is specified, `host` and `port` are ignored.
socket?: stream.Duplex | undefined; // Establish secure connection on a given socket rather than creating a new socket
checkServerIdentity?: typeof checkServerIdentity | undefined;
servername?: string | undefined; // SNI TLS Extension
session?: Buffer | undefined;
minDHSize?: number | undefined;
lookup?: net.LookupFunction | undefined;
timeout?: number | undefined;
/**
* When negotiating TLS-PSK (pre-shared keys), this function is called
* with optional identity `hint` provided by the server or `null`
* in case of TLS 1.3 where `hint` was removed.
* It will be necessary to provide a custom `tls.checkServerIdentity()`
* for the connection as the default one will try to check hostname/IP
* of the server against the certificate but that's not applicable for PSK
* because there won't be a certificate present.
* More information can be found in the RFC 4279.
*
* @param hint message sent from the server to help client
* decide which identity to use during negotiation.
* Always `null` if TLS 1.3 is used.
* @returns Return `null` to stop the negotiation process. `psk` must be
* compatible with the selected cipher's digest.
* `identity` must use UTF-8 encoding.
*/
pskCallback?(hint: string | null): PSKCallbackNegotation | null;
}
// DT-disabled // /**
// DT-disabled // * Accepts encrypted connections using TLS or SSL.
// DT-disabled // * @since v0.3.2
// DT-disabled // */
// DT-disabled // class Server extends net.Server {
// DT-disabled // constructor(secureConnectionListener?: (socket: TLSSocket) => void);
// DT-disabled // constructor(options: TlsOptions, secureConnectionListener?: (socket: TLSSocket) => void);
// DT-disabled // /**
// DT-disabled // * The `server.addContext()` method adds a secure context that will be used if
// DT-disabled // * the client request's SNI name matches the supplied `hostname` (or wildcard).
// DT-disabled // *
// DT-disabled // * When there are multiple matching contexts, the most recently added one is
// DT-disabled // * used.
// DT-disabled // * @since v0.5.3
// DT-disabled // * @param hostname A SNI host name or wildcard (e.g. `'*'`)
// DT-disabled // * @param context An object containing any of the possible properties from the {@link createSecureContext} `options` arguments (e.g. `key`, `cert`, `ca`, etc), or a TLS context object created
// DT-disabled // * with {@link createSecureContext} itself.
// DT-disabled // */
// DT-disabled // addContext(hostname: string, context: SecureContextOptions | SecureContext): void;
// DT-disabled // /**
// DT-disabled // * Returns the session ticket keys.
// DT-disabled // *
// DT-disabled // * See `Session Resumption` for more information.
// DT-disabled // * @since v3.0.0
// DT-disabled // * @return A 48-byte buffer containing the session ticket keys.
// DT-disabled // */
// DT-disabled // getTicketKeys(): Buffer;
// DT-disabled // /**
// DT-disabled // * The `server.setSecureContext()` method replaces the secure context of an
// DT-disabled // * existing server. Existing connections to the server are not interrupted.
// DT-disabled // * @since v11.0.0
// DT-disabled // * @param options An object containing any of the possible properties from the {@link createSecureContext} `options` arguments (e.g. `key`, `cert`, `ca`, etc).
// DT-disabled // */
// DT-disabled // setSecureContext(options: SecureContextOptions): void;
// DT-disabled // /**
// DT-disabled // * Sets the session ticket keys.
// DT-disabled // *
// DT-disabled // * Changes to the ticket keys are effective only for future server connections.
// DT-disabled // * Existing or currently pending server connections will use the previous keys.
// DT-disabled // *
// DT-disabled // * See `Session Resumption` for more information.
// DT-disabled // * @since v3.0.0
// DT-disabled // * @param keys A 48-byte buffer containing the session ticket keys.
// DT-disabled // */
// DT-disabled // setTicketKeys(keys: Buffer): void;
// DT-disabled // /**
// DT-disabled // * events.EventEmitter
// DT-disabled // * 1. tlsClientError
// DT-disabled // * 2. newSession
// DT-disabled // * 3. OCSPRequest
// DT-disabled // * 4. resumeSession
// DT-disabled // * 5. secureConnection
// DT-disabled // * 6. keylog
// DT-disabled // */
// DT-disabled // addListener(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // addListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-disabled // addListener(
// DT-disabled // event: "newSession",
// DT-disabled // listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void,
// DT-disabled // ): this;
// DT-disabled // addListener(
// DT-disabled // event: "OCSPRequest",
// DT-disabled // listener: (
// DT-disabled // certificate: Buffer,
// DT-disabled // issuer: Buffer,
// DT-disabled // callback: (err: Error | null, resp: Buffer) => void,
// DT-disabled // ) => void,
// DT-disabled // ): this;
// DT-disabled // addListener(
// DT-disabled // event: "resumeSession",
// DT-disabled // listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
// DT-disabled // ): this;
// DT-disabled // addListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
// DT-disabled // addListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-disabled // emit(event: string | symbol, ...args: any[]): boolean;
// DT-disabled // emit(event: "tlsClientError", err: Error, tlsSocket: TLSSocket): boolean;
// DT-disabled // emit(event: "newSession", sessionId: Buffer, sessionData: Buffer, callback: () => void): boolean;
// DT-disabled // emit(
// DT-disabled // event: "OCSPRequest",
// DT-disabled // certificate: Buffer,
// DT-disabled // issuer: Buffer,
// DT-disabled // callback: (err: Error | null, resp: Buffer) => void,
// DT-disabled // ): boolean;
// DT-disabled // emit(
// DT-disabled // event: "resumeSession",
// DT-disabled // sessionId: Buffer,
// DT-disabled // callback: (err: Error | null, sessionData: Buffer | null) => void,
// DT-disabled // ): boolean;
// DT-disabled // emit(event: "secureConnection", tlsSocket: TLSSocket): boolean;
// DT-disabled // emit(event: "keylog", line: Buffer, tlsSocket: TLSSocket): boolean;
// DT-disabled // on(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // on(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-disabled // on(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void): this;
// DT-disabled // on(
// DT-disabled // event: "OCSPRequest",
// DT-disabled // listener: (
// DT-disabled // certificate: Buffer,
// DT-disabled // issuer: Buffer,
// DT-disabled // callback: (err: Error | null, resp: Buffer) => void,
// DT-disabled // ) => void,
// DT-disabled // ): this;
// DT-disabled // on(
// DT-disabled // event: "resumeSession",
// DT-disabled // listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
// DT-disabled // ): this;
// DT-disabled // on(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
// DT-disabled // on(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-disabled // once(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // once(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-disabled // once(
// DT-disabled // event: "newSession",
// DT-disabled // listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void,
// DT-disabled // ): this;
// DT-disabled // once(
// DT-disabled // event: "OCSPRequest",
// DT-disabled // listener: (
// DT-disabled // certificate: Buffer,
// DT-disabled // issuer: Buffer,
// DT-disabled // callback: (err: Error | null, resp: Buffer) => void,
// DT-disabled // ) => void,
// DT-disabled // ): this;
// DT-disabled // once(
// DT-disabled // event: "resumeSession",
// DT-disabled // listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
// DT-disabled // ): this;
// DT-disabled // once(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
// DT-disabled // once(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-disabled // prependListener(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // prependListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-disabled // prependListener(
// DT-disabled // event: "newSession",
// DT-disabled // listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void,
// DT-disabled // ): this;
// DT-disabled // prependListener(
// DT-disabled // event: "OCSPRequest",
// DT-disabled // listener: (
// DT-disabled // certificate: Buffer,
// DT-disabled // issuer: Buffer,
// DT-disabled // callback: (err: Error | null, resp: Buffer) => void,
// DT-disabled // ) => void,
// DT-disabled // ): this;
// DT-disabled // prependListener(
// DT-disabled // event: "resumeSession",
// DT-disabled // listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
// DT-disabled // ): this;
// DT-disabled // prependListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
// DT-disabled // prependListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-disabled // prependOnceListener(event: string, listener: (...args: any[]) => void): this;
// DT-disabled // prependOnceListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-disabled // prependOnceListener(
// DT-disabled // event: "newSession",
// DT-disabled // listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void,
// DT-disabled // ): this;
// DT-disabled // prependOnceListener(
// DT-disabled // event: "OCSPRequest",
// DT-disabled // listener: (
// DT-disabled // certificate: Buffer,
// DT-disabled // issuer: Buffer,
// DT-disabled // callback: (err: Error | null, resp: Buffer) => void,
// DT-disabled // ) => void,
// DT-disabled // ): this;
// DT-disabled // prependOnceListener(
// DT-disabled // event: "resumeSession",
// DT-disabled // listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
// DT-disabled // ): this;
// DT-disabled // prependOnceListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
// DT-disabled // prependOnceListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-disabled // }
// DT-disabled // /**
// DT-disabled // * @deprecated since v0.11.3 Use `tls.TLSSocket` instead.
// DT-disabled // */
// DT-disabled // interface SecurePair {
// DT-disabled // encrypted: TLSSocket;
// DT-disabled // cleartext: TLSSocket;
// DT-disabled // }
type SecureVersion = "TLSv1.3" | "TLSv1.2" | "TLSv1.1" | "TLSv1";
interface SecureContextOptions {
/**
* If set, this will be called when a client opens a connection using the ALPN extension.
* One argument will be passed to the callback: an object containing `servername` and `protocols` fields,
* respectively containing the server name from the SNI extension (if any) and an array of
* ALPN protocol name strings. The callback must return either one of the strings listed in `protocols`,
* which will be returned to the client as the selected ALPN protocol, or `undefined`,
* to reject the connection with a fatal alert. If a string is returned that does not match one of
* the client's ALPN protocols, an error will be thrown.
* This option cannot be used with the `ALPNProtocols` option, and setting both options will throw an error.
*/
ALPNCallback?: ((arg: { servername: string; protocols: string[]; }) => string | undefined) | undefined;
/**
* Treat intermediate (non-self-signed)
* certificates in the trust CA certificate list as trusted.
* @since v22.9.0, v20.18.0
*/
allowPartialTrustChain?: boolean | undefined;
/**
* Optionally override the trusted CA certificates. Default is to trust
* the well-known CAs curated by Mozilla. Mozilla's CAs are completely
* replaced when CAs are explicitly specified using this option.
*/
ca?: string | Buffer | Array<string | Buffer> | undefined;
/**
* Cert chains in PEM format. One cert chain should be provided per
* private key. Each cert chain should consist of the PEM formatted
* certificate for a provided private key, followed by the PEM
* formatted intermediate certificates (if any), in order, and not
* including the root CA (the root CA must be pre-known to the peer,
* see ca). When providing multiple cert chains, they do not have to
* be in the same order as their private keys in key. If the
* intermediate certificates are not provided, the peer will not be
* able to validate the certificate, and the handshake will fail.
*/
cert?: string | Buffer | Array<string | Buffer> | undefined;
/**
* Colon-separated list of supported signature algorithms. The list
* can contain digest algorithms (SHA256, MD5 etc.), public key
* algorithms (RSA-PSS, ECDSA etc.), combination of both (e.g
* 'RSA+SHA384') or TLS v1.3 scheme names (e.g. rsa_pss_pss_sha512).
*/
sigalgs?: string | undefined;
/**
* Cipher suite specification, replacing the default. For more
* information, see modifying the default cipher suite. Permitted
* ciphers can be obtained via tls.getCiphers(). Cipher names must be
* uppercased in order for OpenSSL to accept them.
*/
ciphers?: string | undefined;
/**
* Name of an OpenSSL engine which can provide the client certificate.
* @deprecated
*/
clientCertEngine?: string | undefined;
/**
* PEM formatted CRLs (Certificate Revocation Lists).
*/
crl?: string | Buffer | Array<string | Buffer> | undefined;
/**
* `'auto'` or custom Diffie-Hellman parameters, required for non-ECDHE perfect forward secrecy.
* If omitted or invalid, the parameters are silently discarded and DHE ciphers will not be available.
* ECDHE-based perfect forward secrecy will still be available.
*/
dhparam?: string | Buffer | undefined;
/**
* A string describing a named curve or a colon separated list of curve
* NIDs or names, for example P-521:P-384:P-256, to use for ECDH key
* agreement. Set to auto to select the curve automatically. Use
* crypto.getCurves() to obtain a list of available curve names. On
* recent releases, openssl ecparam -list_curves will also display the
* name and description of each available elliptic curve. Default:
* tls.DEFAULT_ECDH_CURVE.
*/
ecdhCurve?: string | undefined;
/**
* Attempt to use the server's cipher suite preferences instead of the
* client's. When true, causes SSL_OP_CIPHER_SERVER_PREFERENCE to be
* set in secureOptions
*/
honorCipherOrder?: boolean | undefined;
/**
* Private keys in PEM format. PEM allows the option of private keys
* being encrypted. Encrypted keys will be decrypted with
* options.passphrase. Multiple keys using different algorithms can be
* provided either as an array of unencrypted key strings or buffers,
* or an array of objects in the form {pem: <string|buffer>[,
* passphrase: <string>]}. The object form can only occur in an array.
* object.passphrase is optional. Encrypted keys will be decrypted with
* object.passphrase if provided, or options.passphrase if it is not.
*/
key?: string | Buffer | Array<string | Buffer | KeyObject> | undefined;
/**
* Name of an OpenSSL engine to get private key from. Should be used
* together with privateKeyIdentifier.
* @deprecated
*/
privateKeyEngine?: string | undefined;
/**
* Identifier of a private key managed by an OpenSSL engine. Should be
* used together with privateKeyEngine. Should not be set together with
* key, because both options define a private key in different ways.
* @deprecated
*/
privateKeyIdentifier?: string | undefined;
/**
* Optionally set the maximum TLS version to allow. One