binding.cc

#include <node.h>
#include <node_buffer.h>
#include <openssl/ssl.h>
#include <cstring>
#include <vector>

#ifdef NODE_CRYPTO_HAS_GETCTX
#include <node_crypto.h>
#endif

namespace {

using v8::Boolean;
using v8::Context;
using v8::Exception;
using v8::Function;
using v8::FunctionCallbackInfo;
using v8::Global;
using v8::HandleScope;
using v8::Int32;
using v8::Isolate;
using v8::Local;
using v8::MaybeLocal;
using v8::Null;
using v8::Number;
using v8::Object;
using v8::String;
using v8::Value;

struct ExtensionData {
  Isolate* isolate;
  Global<Context> v8_context;
  bool is_static;
  std::vector<unsigned char> static_data;
  Global<Function> add_cb;
  Global<Function> parse_cb;
  Global<Value> secure_context_ref;  // prevent GC of the SecureContext
};

// Called by OpenSSL to get extension data during handshake.
// Runs synchronously on the main thread inside SSL_do_handshake().
static int CustomExtAddCallback(SSL* s,
                                unsigned int ext_type,
                                unsigned int context,
                                const unsigned char** out,
                                size_t* outlen,
                                X509* x,
                                size_t chainidx,
                                int* al,
                                void* add_arg) {
  ExtensionData* data = static_cast<ExtensionData*>(add_arg);

  if (data->is_static) {
    if (data->static_data.empty()) {
      *out = nullptr;
      *outlen = 0;
    } else {
      *out = data->static_data.data();
      *outlen = data->static_data.size();
    }
    return 1;
  }

  // Dynamic mode: call JS add callback
  Isolate* isolate = data->isolate;
  HandleScope handle_scope(isolate);
  Local<Context> ctx = data->v8_context.Get(isolate);
  Context::Scope context_scope(ctx);

  Local<Value> argv[2] = {
    Number::New(isolate, static_cast<double>(ext_type)),
    Number::New(isolate, static_cast<double>(context)),
  };

  v8::TryCatch try_catch(isolate);
  Local<Function> cb = data->add_cb.Get(isolate);
  MaybeLocal<Value> maybe_result = cb->Call(ctx, Null(isolate), 2, argv);

  if (try_catch.HasCaught()) {
    *al = SSL_AD_INTERNAL_ERROR;
    return -1;  // fatal error
  }

  Local<Value> result;
  if (!maybe_result.ToLocal(&result) || result->IsNull() ||
      result->IsUndefined()) {
    return 0;  // skip this extension
  }

  if (!node::Buffer::HasInstance(result)) {
    *al = SSL_AD_INTERNAL_ERROR;
    return -1;
  }

  size_t len = node::Buffer::Length(result);
  if (len == 0) {
    *out = nullptr;
    *outlen = 0;
    return 1;
  }

  // Copy into OPENSSL_malloc'd memory; freed by CustomExtFreeCallback.
  unsigned char* buf =
      static_cast<unsigned char*>(OPENSSL_malloc(len));
  if (buf == nullptr) {
    *al = SSL_AD_INTERNAL_ERROR;
    return -1;
  }
  memcpy(buf, node::Buffer::Data(result), len);
  *out = buf;
  *outlen = len;
  return 1;
}

// Called by OpenSSL to free memory returned by the add callback.
static void CustomExtFreeCallback(SSL* s,
                                  unsigned int ext_type,
                                  unsigned int context,
                                  const unsigned char* out,
                                  void* add_arg) {
  ExtensionData* data = static_cast<ExtensionData*>(add_arg);

  if (data->is_static) {
    // Static data is owned by the struct, not by OpenSSL.
    return;
  }

  // Dynamic mode: free the OPENSSL_malloc'd buffer.
  if (out != nullptr) {
    OPENSSL_free(const_cast<unsigned char*>(out));
  }
}

// Called by OpenSSL when the peer sends this extension type.
static int CustomExtParseCallback(SSL* s,
                                  unsigned int ext_type,
                                  unsigned int context,
                                  const unsigned char* in,
                                  size_t inlen,
                                  X509* x,
                                  size_t chainidx,
                                  int* al,
                                  void* parse_arg) {
  ExtensionData* data = static_cast<ExtensionData*>(parse_arg);

  if (data->parse_cb.IsEmpty()) {
    // No parse callback provided; accept any data.
    return 1;
  }

  Isolate* isolate = data->isolate;
  HandleScope handle_scope(isolate);
  Local<Context> ctx = data->v8_context.Get(isolate);
  Context::Scope context_scope(ctx);

  // Create a copy of the incoming data as a JS Buffer.
  MaybeLocal<Object> maybe_buf = node::Buffer::Copy(isolate,
      reinterpret_cast<const char*>(in), inlen);
  Local<Object> buf;
  if (!maybe_buf.ToLocal(&buf)) {
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
  }

  Local<Value> argv[3] = {
    Number::New(isolate, static_cast<double>(ext_type)),
    Number::New(isolate, static_cast<double>(context)),
    buf,
  };

  v8::TryCatch try_catch(isolate);
  Local<Function> cb = data->parse_cb.Get(isolate);
  MaybeLocal<Value> maybe_result = cb->Call(ctx, Null(isolate), 3, argv);

  if (try_catch.HasCaught()) {
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;  // reject
  }

  Local<Value> result;
  if (!maybe_result.ToLocal(&result)) {
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
  }

  // If the callback explicitly returns false, reject.
  if (result->IsFalse()) {
    *al = SSL_AD_DECODE_ERROR;
    return 0;
  }

  return 1;
}

// Extract SSL_CTX* from a JS value.
// Supports: GetSSLCtx (when available), v8::External, or object with _external.
static SSL_CTX* ExtractSSLCtx(Local<Context> context, Local<Value> value) {
  Isolate* isolate = context->GetIsolate();

#ifdef NODE_CRYPTO_HAS_GETCTX
  SSL_CTX* ctx = node::crypto::GetSSLCtx(context, value);
  if (ctx != nullptr) return ctx;
#endif

  // v8::External wrapping SSL_CTX* directly
  if (value->IsExternal()) {
    return static_cast<SSL_CTX*>(value.As<v8::External>()->Value());
  }

  // Object with _external property (e.g. secureContext.context)
  if (value->IsObject()) {
    Local<Object> obj = value.As<Object>();
    Local<String> key = String::NewFromUtf8Literal(isolate, "_external");
    Local<Value> ext_val;
    if (obj->Get(context, key).ToLocal(&ext_val) && ext_val->IsExternal()) {
      return static_cast<SSL_CTX*>(ext_val.As<v8::External>()->Value());
    }
  }

  isolate->ThrowException(Exception::TypeError(
      String::NewFromUtf8Literal(isolate,
          "First argument must be a SecureContext")));
  return nullptr;
}

// addCustomExtension(secureContext, extType, flags, data|null, add|null, parse|null)
void AddCustomExtension(const FunctionCallbackInfo<Value>& args) {
  Isolate* isolate = args.GetIsolate();
  Local<Context> context = isolate->GetCurrentContext();

  if (args.Length() < 6) {
    isolate->ThrowException(Exception::TypeError(
        String::NewFromUtf8Literal(isolate, "Expected 6 arguments")));
    return;
  }

  // arg[0]: SecureContext native object
  SSL_CTX* ssl_ctx = ExtractSSLCtx(context, args[0]);
  if (ssl_ctx == nullptr) return;  // ExtractSSLCtx already threw

  // arg[1]: extension type (uint16)
  if (!args[1]->IsUint32()) {
    isolate->ThrowException(Exception::TypeError(
        String::NewFromUtf8Literal(isolate,
            "extensionType must be a non-negative integer")));
    return;
  }
  unsigned int ext_type = args[1].As<v8::Uint32>()->Value();
  if (ext_type > 0xFFFF) {
    isolate->ThrowException(Exception::RangeError(
        String::NewFromUtf8Literal(isolate,
            "extensionType must be in range 0-65535")));
    return;
  }

  // arg[2]: context flags
  if (!args[2]->IsUint32()) {
    isolate->ThrowException(Exception::TypeError(
        String::NewFromUtf8Literal(isolate,
            "context flags must be a non-negative integer")));
    return;
  }
  unsigned int ctx_flags = args[2].As<v8::Uint32>()->Value();

  // Create ExtensionData on the heap.
  ExtensionData* ext_data = new ExtensionData();
  ext_data->isolate = isolate;
  ext_data->v8_context.Reset(isolate, context);

  // arg[3]: static data (Buffer or null)
  // arg[4]: add callback (Function or null)
  if (node::Buffer::HasInstance(args[3])) {
    ext_data->is_static = true;
    size_t len = node::Buffer::Length(args[3]);
    if (len > 0) {
      ext_data->static_data.resize(len);
      memcpy(ext_data->static_data.data(), node::Buffer::Data(args[3]), len);
    }
  } else if (args[4]->IsFunction()) {
    ext_data->is_static = false;
    ext_data->add_cb.Reset(isolate, args[4].As<Function>());
  } else {
    delete ext_data;
    isolate->ThrowException(Exception::TypeError(
        String::NewFromUtf8Literal(isolate,
            "Either data (Buffer) or add (Function) must be provided")));
    return;
  }

  // arg[5]: parse callback (Function or null, optional for both modes)
  if (args[5]->IsFunction()) {
    ext_data->parse_cb.Reset(isolate, args[5].As<Function>());
  }

  // Keep a reference to the SecureContext to prevent GC.
  ext_data->secure_context_ref.Reset(isolate, args[0]);

  int rc = SSL_CTX_add_custom_ext(
      ssl_ctx,
      ext_type,
      ctx_flags,
      CustomExtAddCallback,
      CustomExtFreeCallback,
      ext_data,
      CustomExtParseCallback,
      ext_data);

  if (rc != 1) {
    delete ext_data;
    isolate->ThrowException(Exception::Error(
        String::NewFromUtf8Literal(isolate,
            "SSL_CTX_add_custom_ext failed (duplicate or internally-handled "
            "extension type?)")));
    return;
  }
}

// isPredefinedExtension(extType) -> bool
// Returns true if OpenSSL handles this extension type internally.
void IsPredefinedExtension(const FunctionCallbackInfo<Value>& args) {
  Isolate* isolate = args.GetIsolate();

  if (args.Length() < 1 || !args[0]->IsUint32()) {
    isolate->ThrowException(Exception::TypeError(
        String::NewFromUtf8Literal(isolate,
            "extensionType must be a non-negative integer")));
    return;
  }

  unsigned int ext_type = args[0].As<v8::Uint32>()->Value();
  int supported = SSL_extension_supported(ext_type);
  args.GetReturnValue().Set(Boolean::New(isolate, supported == 1));
}

void Initialize(Local<Object> exports,
                Local<Value> module,
                Local<Context> context) {
  Isolate* isolate = Isolate::GetCurrent();

  NODE_SET_METHOD(exports, "addCustomExtension", AddCustomExtension);
  NODE_SET_METHOD(exports, "isPredefinedExtension", IsPredefinedExtension);

  // Export SSL_EXT_* constants
  Local<Object> constants = Object::New(isolate);

  auto set_const = [&](const char* name, unsigned int value) {
    constants->Set(context,
        String::NewFromUtf8(isolate, name).ToLocalChecked(),
        Number::New(isolate, static_cast<double>(value))).Check();
  };

  set_const("SSL_EXT_TLS_ONLY", SSL_EXT_TLS_ONLY);
  set_const("SSL_EXT_DTLS_ONLY", SSL_EXT_DTLS_ONLY);
  set_const("SSL_EXT_TLS_IMPLEMENTATION_ONLY", SSL_EXT_TLS_IMPLEMENTATION_ONLY);
  set_const("SSL_EXT_SSL3_ALLOWED", SSL_EXT_SSL3_ALLOWED);
  set_const("SSL_EXT_TLS1_2_AND_BELOW_ONLY", SSL_EXT_TLS1_2_AND_BELOW_ONLY);
  set_const("SSL_EXT_TLS1_3_ONLY", SSL_EXT_TLS1_3_ONLY);
  set_const("SSL_EXT_IGNORE_ON_RESUMPTION", SSL_EXT_IGNORE_ON_RESUMPTION);
  set_const("SSL_EXT_CLIENT_HELLO", SSL_EXT_CLIENT_HELLO);
  set_const("SSL_EXT_TLS1_2_SERVER_HELLO", SSL_EXT_TLS1_2_SERVER_HELLO);
  set_const("SSL_EXT_TLS1_3_SERVER_HELLO", SSL_EXT_TLS1_3_SERVER_HELLO);
  set_const("SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS",
            SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS);
  set_const("SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST",
            SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST);
  set_const("SSL_EXT_TLS1_3_CERTIFICATE", SSL_EXT_TLS1_3_CERTIFICATE);
  set_const("SSL_EXT_TLS1_3_NEW_SESSION_TICKET",
            SSL_EXT_TLS1_3_NEW_SESSION_TICKET);
  set_const("SSL_EXT_TLS1_3_CERTIFICATE_REQUEST",
            SSL_EXT_TLS1_3_CERTIFICATE_REQUEST);

  exports->Set(context,
      String::NewFromUtf8Literal(isolate, "constants"),
      constants).Check();
}

}  // anonymous namespace

NODE_MODULE_CONTEXT_AWARE(NODE_GYP_MODULE_NAME, Initialize)