@dynatrace/runtime-simulator
Version:
The Dynatrace JavaScript runtime simulator.
881 lines • 65.9 kB
TypeScript
/**
* This module is not supported by the Dynatrace Javascript Runtime and only
* exists for its referenced types.
* See the `Node.js Compatibility` section for more information.
* @see https://dt-url.net/runtime-apis
*/
declare module 'tls' {
// DT-DISABLED // import { X509Certificate } from 'node:crypto';
import * as net from 'node:net';
import * as stream from 'stream';
// DT-DISABLED // const CLIENT_RENEG_LIMIT: number;
// DT-DISABLED // const CLIENT_RENEG_WINDOW: number;
interface Certificate {
/**
* Country code.
*/
C: string;
/**
* Street.
*/
ST: string;
/**
* Locality.
*/
L: string;
/**
* Organization.
*/
O: string;
/**
* Organizational unit.
*/
OU: string;
/**
* Common name.
*/
CN: string;
}
interface PeerCertificate {
/**
* `true` if a Certificate Authority (CA), `false` otherwise.
* @since v18.13.0
*/
ca: boolean;
/**
* The DER encoded X.509 certificate data.
*/
raw: Buffer;
/**
* The certificate subject.
*/
subject: Certificate;
/**
* The certificate issuer, described in the same terms as the `subject`.
*/
issuer: Certificate;
/**
* The date-time the certificate is valid from.
*/
valid_from: string;
/**
* The date-time the certificate is valid to.
*/
valid_to: string;
/**
* The certificate serial number, as a hex string.
*/
serialNumber: string;
/**
* The SHA-1 digest of the DER encoded certificate.
* It is returned as a `:` separated hexadecimal string.
*/
fingerprint: string;
/**
* The SHA-256 digest of the DER encoded certificate.
* It is returned as a `:` separated hexadecimal string.
*/
fingerprint256: string;
/**
* The SHA-512 digest of the DER encoded certificate.
* It is returned as a `:` separated hexadecimal string.
*/
fingerprint512: string;
/**
* The extended key usage, a set of OIDs.
*/
ext_key_usage?: string[];
/**
* A string containing concatenated names for the subject,
* an alternative to the `subject` names.
*/
subjectaltname?: string;
/**
* An array describing the AuthorityInfoAccess, used with OCSP.
*/
infoAccess?: NodeJS.Dict<string[]>;
/**
* For RSA keys: The RSA bit size.
*
* For EC keys: The key size in bits.
*/
bits?: number;
/**
* The RSA exponent, as a string in hexadecimal number notation.
*/
exponent?: string;
/**
* The RSA modulus, as a hexadecimal string.
*/
modulus?: string;
/**
* The public key.
*/
pubkey?: Buffer;
/**
* The ASN.1 name of the OID of the elliptic curve.
* Well-known curves are identified by an OID.
* While it is unusual, it is possible that the curve
* is identified by its mathematical properties,
* in which case it will not have an OID.
*/
asn1Curve?: string;
/**
* The NIST name for the elliptic curve,if it has one
* (not all well-known curves have been assigned names by NIST).
*/
nistCurve?: string;
}
// DT-DISABLED // interface DetailedPeerCertificate extends PeerCertificate {
// DT-DISABLED // /**
// DT-DISABLED // * The issuer certificate object.
// DT-DISABLED // * For self-signed certificates, this may be a circular reference.
// DT-DISABLED // */
// DT-DISABLED // issuerCertificate: DetailedPeerCertificate;
// DT-DISABLED // }
// DT-DISABLED // interface CipherNameAndProtocol {
// DT-DISABLED // /**
// DT-DISABLED // * The cipher name.
// DT-DISABLED // */
// DT-DISABLED // name: string;
// DT-DISABLED // /**
// DT-DISABLED // * SSL/TLS protocol version.
// DT-DISABLED // */
// DT-DISABLED // version: string;
// DT-DISABLED // /**
// DT-DISABLED // * IETF name for the cipher suite.
// DT-DISABLED // */
// DT-DISABLED // standardName: string;
// DT-DISABLED // }
// DT-DISABLED // interface EphemeralKeyInfo {
// DT-DISABLED // /**
// DT-DISABLED // * The supported types are 'DH' and 'ECDH'.
// DT-DISABLED // */
// DT-DISABLED // type: string;
// DT-DISABLED // /**
// DT-DISABLED // * The name property is available only when type is 'ECDH'.
// DT-DISABLED // */
// DT-DISABLED // name?: string | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * The size of parameter of an ephemeral key exchange.
// DT-DISABLED // */
// DT-DISABLED // size: number;
// DT-DISABLED // }
interface KeyObject {
/**
* Private keys in PEM format.
*/
pem: string | Buffer;
/**
* Optional passphrase.
*/
passphrase?: string | undefined;
}
interface PxfObject {
/**
* PFX or PKCS12 encoded private key and certificate chain.
*/
buf: string | Buffer;
/**
* Optional passphrase.
*/
passphrase?: string | undefined;
}
// DT-DISABLED // interface TLSSocketOptions extends SecureContextOptions, CommonConnectionOptions {
// DT-DISABLED // /**
// DT-DISABLED // * If true the TLS socket will be instantiated in server-mode.
// DT-DISABLED // * Defaults to false.
// DT-DISABLED // */
// DT-DISABLED // isServer?: boolean | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * An optional net.Server instance.
// DT-DISABLED // */
// DT-DISABLED // server?: net.Server | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * An optional Buffer instance containing a TLS session.
// DT-DISABLED // */
// DT-DISABLED // session?: Buffer | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * If true, specifies that the OCSP status request extension will be
// DT-DISABLED // * added to the client hello and an 'OCSPResponse' event will be
// DT-DISABLED // * emitted on the socket before establishing a secure communication
// DT-DISABLED // */
// DT-DISABLED // requestOCSP?: boolean | undefined;
// DT-DISABLED // }
// DT-DISABLED // /**
// DT-DISABLED // * Performs transparent encryption of written data and all required TLS
// DT-DISABLED // * negotiation.
// DT-DISABLED // *
// DT-DISABLED // * Instances of `tls.TLSSocket` implement the duplex `Stream` interface.
// DT-DISABLED // *
// DT-DISABLED // * Methods that return TLS connection metadata (e.g.{@link TLSSocket.getPeerCertificate}) will only return data while the
// DT-DISABLED // * connection is open.
// DT-DISABLED // * @since v0.11.4
// DT-DISABLED // */
// DT-DISABLED // class TLSSocket extends net.Socket {
// DT-DISABLED // /**
// DT-DISABLED // * Construct a new tls.TLSSocket object from an existing TCP socket.
// DT-DISABLED // */
// DT-DISABLED // constructor(socket: net.Socket, options?: TLSSocketOptions);
// DT-DISABLED // /**
// DT-DISABLED // * This property is `true` if the peer certificate was signed by one of the CAs
// DT-DISABLED // * specified when creating the `tls.TLSSocket` instance, otherwise `false`.
// DT-DISABLED // * @since v0.11.4
// DT-DISABLED // */
// DT-DISABLED // authorized: boolean;
// DT-DISABLED // /**
// DT-DISABLED // * Returns the reason why the peer's certificate was not been verified. This
// DT-DISABLED // * property is set only when `tlsSocket.authorized === false`.
// DT-DISABLED // * @since v0.11.4
// DT-DISABLED // */
// DT-DISABLED // authorizationError: Error;
// DT-DISABLED // /**
// DT-DISABLED // * Always returns `true`. This may be used to distinguish TLS sockets from regular`net.Socket` instances.
// DT-DISABLED // * @since v0.11.4
// DT-DISABLED // */
// DT-DISABLED // encrypted: true;
// DT-DISABLED // /**
// DT-DISABLED // * String containing the selected ALPN protocol.
// DT-DISABLED // * Before a handshake has completed, this value is always null.
// DT-DISABLED // * When a handshake is completed but not ALPN protocol was selected, tlsSocket.alpnProtocol equals false.
// DT-DISABLED // */
// DT-DISABLED // alpnProtocol: string | false | null;
// DT-DISABLED // /**
// DT-DISABLED // * Returns an object representing the local certificate. The returned object has
// DT-DISABLED // * some properties corresponding to the fields of the certificate.
// DT-DISABLED // *
// DT-DISABLED // * See {@link TLSSocket.getPeerCertificate} for an example of the certificate
// DT-DISABLED // * structure.
// DT-DISABLED // *
// DT-DISABLED // * If there is no local certificate, an empty object will be returned. If the
// DT-DISABLED // * socket has been destroyed, `null` will be returned.
// DT-DISABLED // * @since v11.2.0
// DT-DISABLED // */
// DT-DISABLED // getCertificate(): PeerCertificate | object | null;
// DT-DISABLED // /**
// DT-DISABLED // * Returns an object containing information on the negotiated cipher suite.
// DT-DISABLED // *
// DT-DISABLED // * For example, a TLSv1.2 protocol with AES256-SHA cipher:
// DT-DISABLED // *
// DT-DISABLED // * ```json
// DT-DISABLED // * {
// DT-DISABLED // * "name": "AES256-SHA",
// DT-DISABLED // * "standardName": "TLS_RSA_WITH_AES_256_CBC_SHA",
// DT-DISABLED // * "version": "SSLv3"
// DT-DISABLED // * }
// DT-DISABLED // * ```
// DT-DISABLED // *
// DT-DISABLED // * See [SSL\_CIPHER\_get\_name](https://www.openssl.org/docs/man1.1.1/man3/SSL_CIPHER_get_name.html) for more information.
// DT-DISABLED // * @since v0.11.4
// DT-DISABLED // */
// DT-DISABLED // getCipher(): CipherNameAndProtocol;
// DT-DISABLED // /**
// DT-DISABLED // * Returns an object representing the type, name, and size of parameter of
// DT-DISABLED // * an ephemeral key exchange in `perfect forward secrecy` on a client
// DT-DISABLED // * connection. It returns an empty object when the key exchange is not
// DT-DISABLED // * ephemeral. As this is only supported on a client socket; `null` is returned
// DT-DISABLED // * if called on a server socket. The supported types are `'DH'` and `'ECDH'`. The`name` property is available only when type is `'ECDH'`.
// DT-DISABLED // *
// DT-DISABLED // * For example: `{ type: 'ECDH', name: 'prime256v1', size: 256 }`.
// DT-DISABLED // * @since v5.0.0
// DT-DISABLED // */
// DT-DISABLED // getEphemeralKeyInfo(): EphemeralKeyInfo | object | null;
// DT-DISABLED // /**
// DT-DISABLED // * As the `Finished` messages are message digests of the complete handshake
// DT-DISABLED // * (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
// DT-DISABLED // * be used for external authentication procedures when the authentication
// DT-DISABLED // * provided by SSL/TLS is not desired or is not enough.
// DT-DISABLED // *
// DT-DISABLED // * Corresponds to the `SSL_get_finished` routine in OpenSSL and may be used
// DT-DISABLED // * to implement the `tls-unique` channel binding from [RFC 5929](https://tools.ietf.org/html/rfc5929).
// DT-DISABLED // * @since v9.9.0
// DT-DISABLED // * @return The latest `Finished` message that has been sent to the socket as part of a SSL/TLS handshake, or `undefined` if no `Finished` message has been sent yet.
// DT-DISABLED // */
// DT-DISABLED // getFinished(): Buffer | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * Returns an object representing the peer's certificate. If the peer does not
// DT-DISABLED // * provide a certificate, an empty object will be returned. If the socket has been
// DT-DISABLED // * destroyed, `null` will be returned.
// DT-DISABLED // *
// DT-DISABLED // * If the full certificate chain was requested, each certificate will include an`issuerCertificate` property containing an object representing its issuer's
// DT-DISABLED // * certificate.
// DT-DISABLED // * @since v0.11.4
// DT-DISABLED // * @param detailed Include the full certificate chain if `true`, otherwise include just the peer's certificate.
// DT-DISABLED // * @return A certificate object.
// DT-DISABLED // */
// DT-DISABLED // getPeerCertificate(detailed: true): DetailedPeerCertificate;
// DT-DISABLED // getPeerCertificate(detailed?: false): PeerCertificate;
// DT-DISABLED // getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate;
// DT-DISABLED // /**
// DT-DISABLED // * As the `Finished` messages are message digests of the complete handshake
// DT-DISABLED // * (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
// DT-DISABLED // * be used for external authentication procedures when the authentication
// DT-DISABLED // * provided by SSL/TLS is not desired or is not enough.
// DT-DISABLED // *
// DT-DISABLED // * Corresponds to the `SSL_get_peer_finished` routine in OpenSSL and may be used
// DT-DISABLED // * to implement the `tls-unique` channel binding from [RFC 5929](https://tools.ietf.org/html/rfc5929).
// DT-DISABLED // * @since v9.9.0
// DT-DISABLED // * @return The latest `Finished` message that is expected or has actually been received from the socket as part of a SSL/TLS handshake, or `undefined` if there is no `Finished` message so
// DT-DISABLED // * far.
// DT-DISABLED // */
// DT-DISABLED // getPeerFinished(): Buffer | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * Returns a string containing the negotiated SSL/TLS protocol version of the
// DT-DISABLED // * current connection. The value `'unknown'` will be returned for connected
// DT-DISABLED // * sockets that have not completed the handshaking process. The value `null` will
// DT-DISABLED // * be returned for server sockets or disconnected client sockets.
// DT-DISABLED // *
// DT-DISABLED // * Protocol versions are:
// DT-DISABLED // *
// DT-DISABLED // * * `'SSLv3'`
// DT-DISABLED // * * `'TLSv1'`
// DT-DISABLED // * * `'TLSv1.1'`
// DT-DISABLED // * * `'TLSv1.2'`
// DT-DISABLED // * * `'TLSv1.3'`
// DT-DISABLED // *
// DT-DISABLED // * See the OpenSSL [`SSL_get_version`](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_version.html) documentation for more information.
// DT-DISABLED // * @since v5.7.0
// DT-DISABLED // */
// DT-DISABLED // getProtocol(): string | null;
// DT-DISABLED // /**
// DT-DISABLED // * Returns the TLS session data or `undefined` if no session was
// DT-DISABLED // * negotiated. On the client, the data can be provided to the `session` option of {@link connect} to resume the connection. On the server, it may be useful
// DT-DISABLED // * for debugging.
// DT-DISABLED // *
// DT-DISABLED // * See `Session Resumption` for more information.
// DT-DISABLED // *
// DT-DISABLED // * Note: `getSession()` works only for TLSv1.2 and below. For TLSv1.3, applications
// DT-DISABLED // * must use the `'session'` event (it also works for TLSv1.2 and below).
// DT-DISABLED // * @since v0.11.4
// DT-DISABLED // */
// DT-DISABLED // getSession(): Buffer | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * See [SSL\_get\_shared\_sigalgs](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_shared_sigalgs.html) for more information.
// DT-DISABLED // * @since v12.11.0
// DT-DISABLED // * @return List of signature algorithms shared between the server and the client in the order of decreasing preference.
// DT-DISABLED // */
// DT-DISABLED // getSharedSigalgs(): string[];
// DT-DISABLED // /**
// DT-DISABLED // * For a client, returns the TLS session ticket if one is available, or`undefined`. For a server, always returns `undefined`.
// DT-DISABLED // *
// DT-DISABLED // * It may be useful for debugging.
// DT-DISABLED // *
// DT-DISABLED // * See `Session Resumption` for more information.
// DT-DISABLED // * @since v0.11.4
// DT-DISABLED // */
// DT-DISABLED // getTLSTicket(): Buffer | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * See `Session Resumption` for more information.
// DT-DISABLED // * @since v0.5.6
// DT-DISABLED // * @return `true` if the session was reused, `false` otherwise.
// DT-DISABLED // */
// DT-DISABLED // isSessionReused(): boolean;
// DT-DISABLED // /**
// DT-DISABLED // * The `tlsSocket.renegotiate()` method initiates a TLS renegotiation process.
// DT-DISABLED // * Upon completion, the `callback` function will be passed a single argument
// DT-DISABLED // * that is either an `Error` (if the request failed) or `null`.
// DT-DISABLED // *
// DT-DISABLED // * This method can be used to request a peer's certificate after the secure
// DT-DISABLED // * connection has been established.
// DT-DISABLED // *
// DT-DISABLED // * When running as the server, the socket will be destroyed with an error after`handshakeTimeout` timeout.
// DT-DISABLED // *
// DT-DISABLED // * For TLSv1.3, renegotiation cannot be initiated, it is not supported by the
// DT-DISABLED // * protocol.
// DT-DISABLED // * @since v0.11.8
// DT-DISABLED // * @param callback If `renegotiate()` returned `true`, callback is attached once to the `'secure'` event. If `renegotiate()` returned `false`, `callback` will be called in the next tick with
// DT-DISABLED // * an error, unless the `tlsSocket` has been destroyed, in which case `callback` will not be called at all.
// DT-DISABLED // * @return `true` if renegotiation was initiated, `false` otherwise.
// DT-DISABLED // */
// DT-DISABLED // renegotiate(
// DT-DISABLED // options: {
// DT-DISABLED // rejectUnauthorized?: boolean | undefined;
// DT-DISABLED // requestCert?: boolean | undefined;
// DT-DISABLED // },
// DT-DISABLED // callback: (err: Error | null) => void
// DT-DISABLED // ): undefined | boolean;
// DT-DISABLED // /**
// DT-DISABLED // * The `tlsSocket.setMaxSendFragment()` method sets the maximum TLS fragment size.
// DT-DISABLED // * Returns `true` if setting the limit succeeded; `false` otherwise.
// DT-DISABLED // *
// DT-DISABLED // * Smaller fragment sizes decrease the buffering latency on the client: larger
// DT-DISABLED // * fragments are buffered by the TLS layer until the entire fragment is received
// DT-DISABLED // * and its integrity is verified; large fragments can span multiple roundtrips
// DT-DISABLED // * and their processing can be delayed due to packet loss or reordering. However,
// DT-DISABLED // * smaller fragments add extra TLS framing bytes and CPU overhead, which may
// DT-DISABLED // * decrease overall server throughput.
// DT-DISABLED // * @since v0.11.11
// DT-DISABLED // * @param [size=16384] The maximum TLS fragment size. The maximum value is `16384`.
// DT-DISABLED // */
// DT-DISABLED // setMaxSendFragment(size: number): boolean;
// DT-DISABLED // /**
// DT-DISABLED // * Disables TLS renegotiation for this `TLSSocket` instance. Once called, attempts
// DT-DISABLED // * to renegotiate will trigger an `'error'` event on the `TLSSocket`.
// DT-DISABLED // * @since v8.4.0
// DT-DISABLED // */
// DT-DISABLED // disableRenegotiation(): void;
// DT-DISABLED // /**
// DT-DISABLED // * When enabled, TLS packet trace information is written to `stderr`. This can be
// DT-DISABLED // * used to debug TLS connection problems.
// DT-DISABLED // *
// DT-DISABLED // * The format of the output is identical to the output of`openssl s_client -trace` or `openssl s_server -trace`. While it is produced by
// DT-DISABLED // * OpenSSL's `SSL_trace()` function, the format is undocumented, can change
// DT-DISABLED // * without notice, and should not be relied on.
// DT-DISABLED // * @since v12.2.0
// DT-DISABLED // */
// DT-DISABLED // enableTrace(): void;
// DT-DISABLED // /**
// DT-DISABLED // * Returns the peer certificate as an `X509Certificate` object.
// DT-DISABLED // *
// DT-DISABLED // * If there is no peer certificate, or the socket has been destroyed,`undefined` will be returned.
// DT-DISABLED // * @since v15.9.0
// DT-DISABLED // */
// DT-DISABLED // getPeerX509Certificate(): X509Certificate | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * Returns the local certificate as an `X509Certificate` object.
// DT-DISABLED // *
// DT-DISABLED // * If there is no local certificate, or the socket has been destroyed,`undefined` will be returned.
// DT-DISABLED // * @since v15.9.0
// DT-DISABLED // */
// DT-DISABLED // getX509Certificate(): X509Certificate | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * Keying material is used for validations to prevent different kind of attacks in
// DT-DISABLED // * network protocols, for example in the specifications of IEEE 802.1X.
// DT-DISABLED // *
// DT-DISABLED // * Example
// DT-DISABLED // *
// DT-DISABLED // * ```js
// DT-DISABLED // * const keyingMaterial = tlsSocket.exportKeyingMaterial(
// DT-DISABLED // * 128,
// DT-DISABLED // * 'client finished');
// DT-DISABLED // *
// DT-DISABLED // * /*
// DT-DISABLED // * Example return value of keyingMaterial:
// DT-DISABLED // * <Buffer 76 26 af 99 c5 56 8e 42 09 91 ef 9f 93 cb ad 6c 7b 65 f8 53 f1 d8 d9
// DT-DISABLED // * 12 5a 33 b8 b5 25 df 7b 37 9f e0 e2 4f b8 67 83 a3 2f cd 5d 41 42 4c 91
// DT-DISABLED // * 74 ef 2c ... 78 more bytes>
// DT-DISABLED // *
// DT-DISABLED // * ```
// DT-DISABLED // *
// DT-DISABLED // * See the OpenSSL [`SSL_export_keying_material`](https://www.openssl.org/docs/man1.1.1/man3/SSL_export_keying_material.html) documentation for more
// DT-DISABLED // * information.
// DT-DISABLED // * @since v13.10.0, v12.17.0
// DT-DISABLED // * @param length number of bytes to retrieve from keying material
// DT-DISABLED // * @param label an application specific label, typically this will be a value from the [IANA Exporter Label
// DT-DISABLED // * Registry](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#exporter-labels).
// DT-DISABLED // * @param context Optionally provide a context.
// DT-DISABLED // * @return requested bytes of the keying material
// DT-DISABLED // */
// DT-DISABLED // exportKeyingMaterial(length: number, label: string, context: Buffer): Buffer;
// DT-DISABLED // addListener(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // addListener(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
// DT-DISABLED // addListener(event: 'secureConnect', listener: () => void): this;
// DT-DISABLED // addListener(event: 'session', listener: (session: Buffer) => void): this;
// DT-DISABLED // addListener(event: 'keylog', listener: (line: Buffer) => void): this;
// DT-DISABLED // emit(event: string | symbol, ...args: any[]): boolean;
// DT-DISABLED // emit(event: 'OCSPResponse', response: Buffer): boolean;
// DT-DISABLED // emit(event: 'secureConnect'): boolean;
// DT-DISABLED // emit(event: 'session', session: Buffer): boolean;
// DT-DISABLED // emit(event: 'keylog', line: Buffer): boolean;
// DT-DISABLED // on(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // on(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
// DT-DISABLED // on(event: 'secureConnect', listener: () => void): this;
// DT-DISABLED // on(event: 'session', listener: (session: Buffer) => void): this;
// DT-DISABLED // on(event: 'keylog', listener: (line: Buffer) => void): this;
// DT-DISABLED // once(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // once(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
// DT-DISABLED // once(event: 'secureConnect', listener: () => void): this;
// DT-DISABLED // once(event: 'session', listener: (session: Buffer) => void): this;
// DT-DISABLED // once(event: 'keylog', listener: (line: Buffer) => void): this;
// DT-DISABLED // prependListener(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // prependListener(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
// DT-DISABLED // prependListener(event: 'secureConnect', listener: () => void): this;
// DT-DISABLED // prependListener(event: 'session', listener: (session: Buffer) => void): this;
// DT-DISABLED // prependListener(event: 'keylog', listener: (line: Buffer) => void): this;
// DT-DISABLED // prependOnceListener(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // prependOnceListener(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
// DT-DISABLED // prependOnceListener(event: 'secureConnect', listener: () => void): this;
// DT-DISABLED // prependOnceListener(event: 'session', listener: (session: Buffer) => void): this;
// DT-DISABLED // prependOnceListener(event: 'keylog', listener: (line: Buffer) => void): this;
// DT-DISABLED // }
interface CommonConnectionOptions {
/**
* An optional TLS context object from tls.createSecureContext()
*/
secureContext?: SecureContext | undefined;
/**
* When enabled, TLS packet trace information is written to `stderr`. This can be
* used to debug TLS connection problems.
* @default false
*/
enableTrace?: boolean | undefined;
/**
* If true the server will request a certificate from clients that
* connect and attempt to verify that certificate. Defaults to
* false.
*/
requestCert?: boolean | undefined;
/**
* An array of strings or a Buffer naming possible ALPN protocols.
* (Protocols should be ordered by their priority.)
*/
ALPNProtocols?: string[] | Uint8Array[] | Uint8Array | undefined;
/**
* SNICallback(servername, cb) <Function> A function that will be
* called if the client supports SNI TLS extension. Two arguments
* will be passed when called: servername and cb. SNICallback should
* invoke cb(null, ctx), where ctx is a SecureContext instance.
* (tls.createSecureContext(...) can be used to get a proper
* SecureContext.) If SNICallback wasn't provided the default callback
* with high-level API will be used (see below).
*/
SNICallback?:
| ((
servername: string,
cb: (err: Error | null, ctx?: SecureContext) => void,
) => void)
| undefined;
/**
* If true the server will reject any connection which is not
* authorized with the list of supplied CAs. This option only has an
* effect if requestCert is true.
* @default true
*/
rejectUnauthorized?: boolean | undefined;
}
// DT-DISABLED // interface TlsOptions extends SecureContextOptions, CommonConnectionOptions, net.ServerOpts {
// DT-DISABLED // /**
// DT-DISABLED // * Abort the connection if the SSL/TLS handshake does not finish in the
// DT-DISABLED // * specified number of milliseconds. A 'tlsClientError' is emitted on
// DT-DISABLED // * the tls.Server object whenever a handshake times out. Default:
// DT-DISABLED // * 120000 (120 seconds).
// DT-DISABLED // */
// DT-DISABLED // handshakeTimeout?: number | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * The number of seconds after which a TLS session created by the
// DT-DISABLED // * server will no longer be resumable. See Session Resumption for more
// DT-DISABLED // * information. Default: 300.
// DT-DISABLED // */
// DT-DISABLED // sessionTimeout?: number | undefined;
// DT-DISABLED // /**
// DT-DISABLED // * 48-bytes of cryptographically strong pseudo-random data.
// DT-DISABLED // */
// DT-DISABLED // ticketKeys?: Buffer | undefined;
// DT-DISABLED // /**
// DT-DISABLED // *
// DT-DISABLED // * @param socket
// DT-DISABLED // * @param identity identity parameter sent from the client.
// DT-DISABLED // * @return pre-shared key that must either be
// DT-DISABLED // * a buffer or `null` to stop the negotiation process. Returned PSK must be
// DT-DISABLED // * compatible with the selected cipher's digest.
// DT-DISABLED // *
// DT-DISABLED // * When negotiating TLS-PSK (pre-shared keys), this function is called
// DT-DISABLED // * with the identity provided by the client.
// DT-DISABLED // * If the return value is `null` the negotiation process will stop and an
// DT-DISABLED // * "unknown_psk_identity" alert message will be sent to the other party.
// DT-DISABLED // * If the server wishes to hide the fact that the PSK identity was not known,
// DT-DISABLED // * the callback must provide some random data as `psk` to make the connection
// DT-DISABLED // * fail with "decrypt_error" before negotiation is finished.
// DT-DISABLED // * PSK ciphers are disabled by default, and using TLS-PSK thus
// DT-DISABLED // * requires explicitly specifying a cipher suite with the `ciphers` option.
// DT-DISABLED // * More information can be found in the RFC 4279.
// DT-DISABLED // */
// DT-DISABLED // pskCallback?(socket: TLSSocket, identity: string): DataView | NodeJS.TypedArray | null;
// DT-DISABLED // /**
// DT-DISABLED // * hint to send to a client to help
// DT-DISABLED // * with selecting the identity during TLS-PSK negotiation. Will be ignored
// DT-DISABLED // * in TLS 1.3. Upon failing to set pskIdentityHint `tlsClientError` will be
// DT-DISABLED // * emitted with `ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED` code.
// DT-DISABLED // */
// DT-DISABLED // pskIdentityHint?: string | undefined;
// DT-DISABLED // }
interface PSKCallbackNegotation {
psk: DataView | NodeJS.TypedArray;
identity: string;
}
interface ConnectionOptions
extends SecureContextOptions,
CommonConnectionOptions {
host?: string | undefined;
port?: number | undefined;
path?: string | undefined; // Creates unix socket connection to path. If this option is specified, `host` and `port` are ignored.
socket?: stream.Duplex | undefined; // Establish secure connection on a given socket rather than creating a new socket
checkServerIdentity?: typeof checkServerIdentity | undefined;
servername?: string | undefined; // SNI TLS Extension
session?: Buffer | undefined;
minDHSize?: number | undefined;
lookup?: net.LookupFunction | undefined;
timeout?: number | undefined;
/**
* When negotiating TLS-PSK (pre-shared keys), this function is called
* with optional identity `hint` provided by the server or `null`
* in case of TLS 1.3 where `hint` was removed.
* It will be necessary to provide a custom `tls.checkServerIdentity()`
* for the connection as the default one will try to check hostname/IP
* of the server against the certificate but that's not applicable for PSK
* because there won't be a certificate present.
* More information can be found in the RFC 4279.
*
* @param hint message sent from the server to help client
* decide which identity to use during negotiation.
* Always `null` if TLS 1.3 is used.
* @returns Return `null` to stop the negotiation process. `psk` must be
* compatible with the selected cipher's digest.
* `identity` must use UTF-8 encoding.
*/
pskCallback?(hint: string | null): PSKCallbackNegotation | null;
}
// DT-DISABLED // /**
// DT-DISABLED // * Accepts encrypted connections using TLS or SSL.
// DT-DISABLED // * @since v0.3.2
// DT-DISABLED // */
// DT-DISABLED // class Server extends net.Server {
// DT-DISABLED // constructor(secureConnectionListener?: (socket: TLSSocket) => void);
// DT-DISABLED // constructor(options: TlsOptions, secureConnectionListener?: (socket: TLSSocket) => void);
// DT-DISABLED // /**
// DT-DISABLED // * The `server.addContext()` method adds a secure context that will be used if
// DT-DISABLED // * the client request's SNI name matches the supplied `hostname` (or wildcard).
// DT-DISABLED // *
// DT-DISABLED // * When there are multiple matching contexts, the most recently added one is
// DT-DISABLED // * used.
// DT-DISABLED // * @since v0.5.3
// DT-DISABLED // * @param hostname A SNI host name or wildcard (e.g. `'*'`)
// DT-DISABLED // * @param context An object containing any of the possible properties from the {@link createSecureContext} `options` arguments (e.g. `key`, `cert`, `ca`, etc), or a TLS context object created
// DT-DISABLED // * with {@link createSecureContext} itself.
// DT-DISABLED // */
// DT-DISABLED // addContext(hostname: string, context: SecureContextOptions): void;
// DT-DISABLED // /**
// DT-DISABLED // * Returns the session ticket keys.
// DT-DISABLED // *
// DT-DISABLED // * See `Session Resumption` for more information.
// DT-DISABLED // * @since v3.0.0
// DT-DISABLED // * @return A 48-byte buffer containing the session ticket keys.
// DT-DISABLED // */
// DT-DISABLED // getTicketKeys(): Buffer;
// DT-DISABLED // /**
// DT-DISABLED // * The `server.setSecureContext()` method replaces the secure context of an
// DT-DISABLED // * existing server. Existing connections to the server are not interrupted.
// DT-DISABLED // * @since v11.0.0
// DT-DISABLED // * @param options An object containing any of the possible properties from the {@link createSecureContext} `options` arguments (e.g. `key`, `cert`, `ca`, etc).
// DT-DISABLED // */
// DT-DISABLED // setSecureContext(options: SecureContextOptions): void;
// DT-DISABLED // /**
// DT-DISABLED // * Sets the session ticket keys.
// DT-DISABLED // *
// DT-DISABLED // * Changes to the ticket keys are effective only for future server connections.
// DT-DISABLED // * Existing or currently pending server connections will use the previous keys.
// DT-DISABLED // *
// DT-DISABLED // * See `Session Resumption` for more information.
// DT-DISABLED // * @since v3.0.0
// DT-DISABLED // * @param keys A 48-byte buffer containing the session ticket keys.
// DT-DISABLED // */
// DT-DISABLED // setTicketKeys(keys: Buffer): void;
// DT-DISABLED // /**
// DT-DISABLED // * events.EventEmitter
// DT-DISABLED // * 1. tlsClientError
// DT-DISABLED // * 2. newSession
// DT-DISABLED // * 3. OCSPRequest
// DT-DISABLED // * 4. resumeSession
// DT-DISABLED // * 5. secureConnection
// DT-DISABLED // * 6. keylog
// DT-DISABLED // */
// DT-DISABLED // addListener(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // addListener(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // addListener(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void): this;
// DT-DISABLED // addListener(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
// DT-DISABLED // addListener(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void): this;
// DT-DISABLED // addListener(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // addListener(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // emit(event: string | symbol, ...args: any[]): boolean;
// DT-DISABLED // emit(event: 'tlsClientError', err: Error, tlsSocket: TLSSocket): boolean;
// DT-DISABLED // emit(event: 'newSession', sessionId: Buffer, sessionData: Buffer, callback: () => void): boolean;
// DT-DISABLED // emit(event: 'OCSPRequest', certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void): boolean;
// DT-DISABLED // emit(event: 'resumeSession', sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void): boolean;
// DT-DISABLED // emit(event: 'secureConnection', tlsSocket: TLSSocket): boolean;
// DT-DISABLED // emit(event: 'keylog', line: Buffer, tlsSocket: TLSSocket): boolean;
// DT-DISABLED // on(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // on(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // on(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void): this;
// DT-DISABLED // on(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
// DT-DISABLED // on(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void): this;
// DT-DISABLED // on(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // on(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // once(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // once(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // once(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void): this;
// DT-DISABLED // once(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
// DT-DISABLED // once(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void): this;
// DT-DISABLED // once(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // once(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // prependListener(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // prependListener(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // prependListener(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void): this;
// DT-DISABLED // prependListener(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
// DT-DISABLED // prependListener(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void): this;
// DT-DISABLED // prependListener(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // prependListener(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // prependOnceListener(event: string, listener: (...args: any[]) => void): this;
// DT-DISABLED // prependOnceListener(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // prependOnceListener(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void): this;
// DT-DISABLED // prependOnceListener(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
// DT-DISABLED // prependOnceListener(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void): this;
// DT-DISABLED // prependOnceListener(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // prependOnceListener(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
// DT-DISABLED // }
// DT-DISABLED // /**
// DT-DISABLED // * @deprecated since v0.11.3 Use `tls.TLSSocket` instead.
// DT-DISABLED // */
// DT-DISABLED // interface SecurePair {
// DT-DISABLED // encrypted: TLSSocket;
// DT-DISABLED // cleartext: TLSSocket;
// DT-DISABLED // }
type SecureVersion = 'TLSv1.3' | 'TLSv1.2' | 'TLSv1.1' | 'TLSv1';
interface SecureContextOptions {
/**
* If set, this will be called when a client opens a connection using the ALPN extension.
* One argument will be passed to the callback: an object containing `servername` and `protocols` fields,
* respectively containing the server name from the SNI extension (if any) and an array of
* ALPN protocol name strings. The callback must return either one of the strings listed in `protocols`,
* which will be returned to the client as the selected ALPN protocol, or `undefined`,
* to reject the connection with a fatal alert. If a string is returned that does not match one of
* the client's ALPN protocols, an error will be thrown.
* This option cannot be used with the `ALPNProtocols` option, and setting both options will throw an error.
*/
ALPNCallback?:
| ((arg: {
servername: string;
protocols: string[];
}) => string | undefined)
| undefined;
/**
* Optionally override the trusted CA certificates. Default is to trust
* the well-known CAs curated by Mozilla. Mozilla's CAs are completely
* replaced when CAs are explicitly specified using this option.
*/
ca?: string | Buffer | Array<string | Buffer> | undefined;
/**
* Cert chains in PEM format. One cert chain should be provided per
* private key. Each cert chain should consist of the PEM formatted
* certificate for a provided private key, followed by the PEM
* formatted intermediate certificates (if any), in order, and not
* including the root CA (the root CA must be pre-known to the peer,
* see ca). When providing multiple cert chains, they do not have to
* be in the same order as their private keys in key. If the
* intermediate certificates are not provided, the peer will not be
* able to validate the certificate, and the handshake will fail.
*/
cert?: string | Buffer | Array<string | Buffer> | undefined;
/**
* Colon-separated list of supported signature algorithms. The list
* can contain digest algorithms (SHA256, MD5 etc.), public key
* algorithms (RSA-PSS, ECDSA etc.), combination of both (e.g
* 'RSA+SHA384') or TLS v1.3 scheme names (e.g. rsa_pss_pss_sha512).
*/
sigalgs?: string | undefined;
/**
* Cipher suite specification, replacing the default. For more
* information, see modifying the default cipher suite. Permitted
* ciphers can be obtained via tls.getCiphers(). Cipher names must be
* uppercased in order for OpenSSL to accept them.
*/
ciphers?: string | undefined;
/**
* Name of an OpenSSL engine which can provide the client certificate.
*/
clientCertEngine?: string | undefined;
/**
* PEM formatted CRLs (Certificate Revocation Lists).
*/
crl?: string | Buffer | Array<string | Buffer> | undefined;
/**
* `'auto'` or custom Diffie-Hellman parameters, required for non-ECDHE perfect forward secrecy.
* If omitted or invalid, the parameters are silently discarded and DHE ciphers will not be available.
* ECDHE-based perfect forward secrecy will still be available.
*/
dhparam?: string | Buffer | undefined;
/**
* A string describing a named curve or a colon separated list of curve
* NIDs or names, for example P-521:P-384:P-256, to use for ECDH key
* agreement. Set to auto to select the curve automatically. Use
* crypto.getCurves() to obtain a list of available curve names. On
* recent releases, openssl ecparam -list_curves will also display the
* name and description of each available elliptic curve. Default:
* tls.DEFAULT_ECDH_CURVE.
*/
ecdhCurve?: string | undefined;
/**
* Attempt to use the server's cipher suite preferences instead of the
* client's. When true, causes SSL_OP_CIPHER_SERVER_PREFERENCE to be
* set in secureOptions
*/
honorCipherOrder?: boolean | undefined;
/**
* Private keys in PEM format. PEM allows the option of private keys
* being encrypted. Encrypted keys will be decrypted with
* options.passphrase. Multiple keys using different algorithms can be
* provided either as an array of unencrypted key strings or buffers,
* or an array of objects in the form {pem: `<string|buffer>`[,
* passphrase: `<string>`]}. The object form can only occur in an array.
* object.passphrase is optional. Encrypted keys will be decrypted with
* object.passphrase if provided, or options.passphrase if it is not.
*/
key?: string | Buffer | Array<string | Buffer | KeyObject> | undefined;
/**
* Name of an OpenSSL engine to get private key from. Should be used
* together with privateKeyIdentifier.
*/
privateKeyEngine?: string | undefined;
/**
* Identifier of a private key managed by an OpenSSL engine. Should be
* used together with privateKeyEngine. Should not be set together with
* key, because both options define a private key in different ways.
*/
privateKeyIdentifier?: string | undefined;
/**
* Optionally set the maximum TLS version to allow. One
* of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified along with the
* `secureProtocol` option, use one or the other.
* **Default:** `'TLSv1.3'`, unless changed using CLI options. Using
* `--tls-max-v1.2` sets the default to `'TLSv1.2'`. Using `--tls-max-v1.3` sets the default to
* `'TLSv1.3'`. If multiple of the options are provided, the highest maximum is used.
*/
maxVersion?: SecureVersion | undefined;
/**
* Optionally set the minimum TLS version to allow. One
* of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified along with the
* `secureProtocol` option, use one or the other. It is not recommended to use
* less than TLSv1.2, but it may be required for interoperability.
* **Default:** `'TLSv1.2'`, unless changed using CLI options. Using
* `--tls-v1.0` sets the default to `'TLSv1'`. Using `--tls-v1.1` sets the default to
* `'TLSv1.1'`. Using `--tls-min-v1.3` sets the default to
* 'TLSv1.3'. If multiple of the options are provided, the lowest minimum is used.
*/
minVersion?: SecureVersion | undefined;
/**
* Shared passphrase used for a single private key and/or a PFX.
*/
passphrase?: string | undefined;
/**
* PFX or PKCS12 encoded private key and certificate chain. pfx is an
* alternative to providing key and cert individually. PFX is usually
* encrypted, if it is, passphrase will be used to decrypt it. Multiple
* PFX can be provided either as an array of unencrypted PFX buffers,
* or an array of objects in the form {buf: `<string|buffer>`[,
* passphrase: `<string>`]}. The object form can only occur in an array.
* object.passphrase is optional. Encrypted PFX will be decrypted with
* object.passphrase if provided, or options.passphrase if it is not.
*/
pfx?: string | Buffer | Array<string | Buffer | PxfObject> | undefined;
/**
* Optionally affect the OpenSSL protocol behavior, which is not
* usually necessary. This should be used carefully if at all! Value is
* a numeric bitmask of the SSL_OP_* options from OpenSSL Options
*/
secureOptions?: number | undefined; // Value is a numeric bitmask of the `SSL_OP_*` options
/**
* Legacy mechanism to select the TLS protocol version to use, it does
* not support independent control of the minimum and maximum version,
* and does not support limiting the protocol to TLSv1.3. Use
* minVersion and maxVersion instead. The possible values are listed as
* SSL_METHODS, use the function names as strings. For example, use
* 'TLSv1_1_method' to force TLS version 1.1, o