1 |
|
2 |
|
3 |
|
4 |
|
5 |
|
6 |
|
7 |
|
8 |
|
9 |
|
10 |
|
11 | declare module 'tls' {
|
12 | import { X509Certificate } from 'node:crypto';
|
13 | import * as net from 'node:net';
|
14 | import * as stream from 'stream';
|
15 | const CLIENT_RENEG_LIMIT: number;
|
16 | const CLIENT_RENEG_WINDOW: number;
|
17 | interface Certificate {
|
18 | |
19 |
|
20 |
|
21 | C: string;
|
22 | |
23 |
|
24 |
|
25 | ST: string;
|
26 | |
27 |
|
28 |
|
29 | L: string;
|
30 | |
31 |
|
32 |
|
33 | O: string;
|
34 | |
35 |
|
36 |
|
37 | OU: string;
|
38 | |
39 |
|
40 |
|
41 | CN: string;
|
42 | }
|
43 | interface PeerCertificate {
|
44 | subject: Certificate;
|
45 | issuer: Certificate;
|
46 | subjectaltname: string;
|
47 | infoAccess: NodeJS.Dict<string[]>;
|
48 | modulus: string;
|
49 | exponent: string;
|
50 | valid_from: string;
|
51 | valid_to: string;
|
52 | fingerprint: string;
|
53 | fingerprint256: string;
|
54 | ext_key_usage: string[];
|
55 | serialNumber: string;
|
56 | raw: Buffer;
|
57 | }
|
58 | interface DetailedPeerCertificate extends PeerCertificate {
|
59 | issuerCertificate: DetailedPeerCertificate;
|
60 | }
|
61 | interface CipherNameAndProtocol {
|
62 | |
63 |
|
64 |
|
65 | name: string;
|
66 | |
67 |
|
68 |
|
69 | version: string;
|
70 | |
71 |
|
72 |
|
73 | standardName: string;
|
74 | }
|
75 | interface EphemeralKeyInfo {
|
76 | |
77 |
|
78 |
|
79 | type: string;
|
80 | |
81 |
|
82 |
|
83 | name?: string | undefined;
|
84 | |
85 |
|
86 |
|
87 | size: number;
|
88 | }
|
89 | interface KeyObject {
|
90 | |
91 |
|
92 |
|
93 | pem: string | Buffer;
|
94 | |
95 |
|
96 |
|
97 | passphrase?: string | undefined;
|
98 | }
|
99 | interface PxfObject {
|
100 | |
101 |
|
102 |
|
103 | buf: string | Buffer;
|
104 | |
105 |
|
106 |
|
107 | passphrase?: string | undefined;
|
108 | }
|
109 | interface TLSSocketOptions extends SecureContextOptions, CommonConnectionOptions {
|
110 | |
111 |
|
112 |
|
113 |
|
114 | isServer?: boolean | undefined;
|
115 | |
116 |
|
117 |
|
118 | server?: net.Server | undefined;
|
119 | |
120 |
|
121 |
|
122 | session?: Buffer | undefined;
|
123 | |
124 |
|
125 |
|
126 |
|
127 |
|
128 | requestOCSP?: boolean | undefined;
|
129 | }
|
130 | |
131 |
|
132 |
|
133 |
|
134 |
|
135 |
|
136 |
|
137 |
|
138 |
|
139 |
|
140 | class TLSSocket extends net.Socket {
|
141 | |
142 |
|
143 |
|
144 | constructor(socket: net.Socket, options?: TLSSocketOptions);
|
145 | /**
|
146 | * Returns `true` if the peer certificate was signed by one of the CAs specified
|
147 | * when creating the `tls.TLSSocket` instance, otherwise `false`.
|
148 | * @since v0.11.4
|
149 | */
|
150 | authorized: boolean;
|
151 | /**
|
152 | * Returns the reason why the peer's certificate was not been verified. This
|
153 | * property is set only when `tlsSocket.authorized === false`.
|
154 | * @since v0.11.4
|
155 | */
|
156 | authorizationError: Error;
|
157 | /**
|
158 | * Always returns `true`. This may be used to distinguish TLS sockets from regular`net.Socket` instances.
|
159 | * @since v0.11.4
|
160 | */
|
161 | encrypted: true;
|
162 | /**
|
163 | * String containing the selected ALPN protocol.
|
164 | * Before a handshake has completed, this value is always null.
|
165 | * When a handshake is completed but not ALPN protocol was selected, tlsSocket.alpnProtocol equals false.
|
166 | */
|
167 | alpnProtocol: string | false | null;
|
168 | /**
|
169 | * Returns an object representing the local certificate. The returned object has
|
170 | * some properties corresponding to the fields of the certificate.
|
171 | *
|
172 | * See {@link TLSSocket.getPeerCertificate} for an example of the certificate
|
173 | * structure.
|
174 | *
|
175 | * If there is no local certificate, an empty object will be returned. If the
|
176 | * socket has been destroyed, `null` will be returned.
|
177 | * @since v11.2.0
|
178 | */
|
179 | getCertificate(): PeerCertificate | object | null;
|
180 | |
181 |
|
182 |
|
183 |
|
184 |
|
185 |
|
186 |
|
187 |
|
188 |
|
189 |
|
190 |
|
191 |
|
192 |
|
193 |
|
194 |
|
195 |
|
196 | getCipher(): CipherNameAndProtocol;
|
197 | |
198 |
|
199 |
|
200 |
|
201 |
|
202 |
|
203 |
|
204 |
|
205 |
|
206 |
|
207 | getEphemeralKeyInfo(): EphemeralKeyInfo | object | null;
|
208 | |
209 |
|
210 |
|
211 |
|
212 |
|
213 |
|
214 |
|
215 |
|
216 |
|
217 |
|
218 |
|
219 | getFinished(): Buffer | undefined;
|
220 | |
221 |
|
222 |
|
223 |
|
224 |
|
225 |
|
226 |
|
227 |
|
228 |
|
229 |
|
230 |
|
231 | getPeerCertificate(detailed: true): DetailedPeerCertificate;
|
232 | getPeerCertificate(detailed?: false): PeerCertificate;
|
233 | getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate;
|
234 | |
235 |
|
236 |
|
237 |
|
238 |
|
239 |
|
240 |
|
241 |
|
242 |
|
243 |
|
244 |
|
245 |
|
246 | getPeerFinished(): Buffer | undefined;
|
247 | |
248 |
|
249 |
|
250 |
|
251 |
|
252 |
|
253 |
|
254 |
|
255 |
|
256 |
|
257 |
|
258 |
|
259 |
|
260 |
|
261 |
|
262 |
|
263 |
|
264 | getProtocol(): string | null;
|
265 | |
266 |
|
267 |
|
268 |
|
269 |
|
270 |
|
271 |
|
272 |
|
273 |
|
274 |
|
275 |
|
276 | getSession(): Buffer | undefined;
|
277 | |
278 |
|
279 |
|
280 |
|
281 |
|
282 | getSharedSigalgs(): string[];
|
283 | |
284 |
|
285 |
|
286 |
|
287 |
|
288 |
|
289 |
|
290 |
|
291 | getTLSTicket(): Buffer | undefined;
|
292 | |
293 |
|
294 |
|
295 |
|
296 |
|
297 | isSessionReused(): boolean;
|
298 | |
299 |
|
300 |
|
301 |
|
302 |
|
303 |
|
304 |
|
305 |
|
306 |
|
307 |
|
308 |
|
309 |
|
310 |
|
311 |
|
312 |
|
313 |
|
314 |
|
315 | renegotiate(
|
316 | options: {
|
317 | rejectUnauthorized?: boolean | undefined;
|
318 | requestCert?: boolean | undefined;
|
319 | },
|
320 | callback: (err: Error | null) => void
|
321 | ): undefined | boolean;
|
322 | |
323 |
|
324 |
|
325 |
|
326 |
|
327 |
|
328 |
|
329 |
|
330 |
|
331 |
|
332 |
|
333 |
|
334 |
|
335 | setMaxSendFragment(size: number): boolean;
|
336 | |
337 |
|
338 |
|
339 |
|
340 |
|
341 | disableRenegotiation(): void;
|
342 | |
343 |
|
344 |
|
345 |
|
346 |
|
347 |
|
348 |
|
349 |
|
350 |
|
351 | enableTrace(): void;
|
352 | |
353 |
|
354 |
|
355 |
|
356 |
|
357 |
|
358 | getPeerX509Certificate(): X509Certificate | undefined;
|
359 | |
360 |
|
361 |
|
362 |
|
363 |
|
364 |
|
365 | getX509Certificate(): X509Certificate | undefined;
|
366 | |
367 |
|
368 |
|
369 |
|
370 |
|
371 |
|
372 |
|
373 |
|
374 |
|
375 |
|
376 |
|
377 |
|
378 |
|
379 |
|
380 |
|
381 |
|
382 |
|
383 |
|
384 |
|
385 |
|
386 |
|
387 |
|
388 |
|
389 |
|
390 |
|
391 |
|
392 |
|
393 |
|
394 | exportKeyingMaterial(length: number, label: string, context: Buffer): Buffer;
|
395 | addListener(event: string, listener: (...args: any[]) => void): this;
|
396 | addListener(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
|
397 | addListener(event: 'secureConnect', listener: () => void): this;
|
398 | addListener(event: 'session', listener: (session: Buffer) => void): this;
|
399 | addListener(event: 'keylog', listener: (line: Buffer) => void): this;
|
400 | emit(event: string | symbol, ...args: any[]): boolean;
|
401 | emit(event: 'OCSPResponse', response: Buffer): boolean;
|
402 | emit(event: 'secureConnect'): boolean;
|
403 | emit(event: 'session', session: Buffer): boolean;
|
404 | emit(event: 'keylog', line: Buffer): boolean;
|
405 | on(event: string, listener: (...args: any[]) => void): this;
|
406 | on(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
|
407 | on(event: 'secureConnect', listener: () => void): this;
|
408 | on(event: 'session', listener: (session: Buffer) => void): this;
|
409 | on(event: 'keylog', listener: (line: Buffer) => void): this;
|
410 | once(event: string, listener: (...args: any[]) => void): this;
|
411 | once(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
|
412 | once(event: 'secureConnect', listener: () => void): this;
|
413 | once(event: 'session', listener: (session: Buffer) => void): this;
|
414 | once(event: 'keylog', listener: (line: Buffer) => void): this;
|
415 | prependListener(event: string, listener: (...args: any[]) => void): this;
|
416 | prependListener(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
|
417 | prependListener(event: 'secureConnect', listener: () => void): this;
|
418 | prependListener(event: 'session', listener: (session: Buffer) => void): this;
|
419 | prependListener(event: 'keylog', listener: (line: Buffer) => void): this;
|
420 | prependOnceListener(event: string, listener: (...args: any[]) => void): this;
|
421 | prependOnceListener(event: 'OCSPResponse', listener: (response: Buffer) => void): this;
|
422 | prependOnceListener(event: 'secureConnect', listener: () => void): this;
|
423 | prependOnceListener(event: 'session', listener: (session: Buffer) => void): this;
|
424 | prependOnceListener(event: 'keylog', listener: (line: Buffer) => void): this;
|
425 | }
|
426 | interface CommonConnectionOptions {
|
427 | |
428 |
|
429 |
|
430 | secureContext?: SecureContext | undefined;
|
431 | |
432 |
|
433 |
|
434 |
|
435 |
|
436 | enableTrace?: boolean | undefined;
|
437 | |
438 |
|
439 |
|
440 |
|
441 |
|
442 | requestCert?: boolean | undefined;
|
443 | |
444 |
|
445 |
|
446 |
|
447 | ALPNProtocols?: string[] | Uint8Array[] | Uint8Array | undefined;
|
448 | |
449 |
|
450 |
|
451 |
|
452 |
|
453 |
|
454 |
|
455 |
|
456 |
|
457 | SNICallback?: ((servername: string, cb: (err: Error | null, ctx?: SecureContext) => void) => void) | undefined;
|
458 | /**
|
459 | * If true the server will reject any connection which is not
|
460 | * authorized with the list of supplied CAs. This option only has an
|
461 | * effect if requestCert is true.
|
462 | * @default true
|
463 | */
|
464 | rejectUnauthorized?: boolean | undefined;
|
465 | }
|
466 | interface TlsOptions extends SecureContextOptions, CommonConnectionOptions, net.ServerOpts {
|
467 | /**
|
468 | * Abort the connection if the SSL/TLS handshake does not finish in the
|
469 | * specified number of milliseconds. A 'tlsClientError' is emitted on
|
470 | * the tls.Server object whenever a handshake times out. Default:
|
471 | * 120000 (120 seconds).
|
472 | */
|
473 | handshakeTimeout?: number | undefined;
|
474 | /**
|
475 | * The number of seconds after which a TLS session created by the
|
476 | * server will no longer be resumable. See Session Resumption for more
|
477 | * information. Default: 300.
|
478 | */
|
479 | sessionTimeout?: number | undefined;
|
480 | /**
|
481 | * 48-bytes of cryptographically strong pseudo-random data.
|
482 | */
|
483 | ticketKeys?: Buffer | undefined;
|
484 | /**
|
485 | *
|
486 | * @param socket
|
487 | * @param identity identity parameter sent from the client.
|
488 | * @return pre-shared key that must either be
|
489 | * a buffer or `null` to stop the negotiation process. Returned PSK must be
|
490 | * compatible with the selected cipher's digest.
|
491 | *
|
492 | * When negotiating TLS-PSK (pre-shared keys), this function is called
|
493 | * with the identity provided by the client.
|
494 | * If the return value is `null` the negotiation process will stop and an
|
495 | * "unknown_psk_identity" alert message will be sent to the other party.
|
496 | * If the server wishes to hide the fact that the PSK identity was not known,
|
497 | * the callback must provide some random data as `psk` to make the connection
|
498 | * fail with "decrypt_error" before negotiation is finished.
|
499 | * PSK ciphers are disabled by default, and using TLS-PSK thus
|
500 | * requires explicitly specifying a cipher suite with the `ciphers` option.
|
501 | * More information can be found in the RFC 4279.
|
502 | */
|
503 | pskCallback?(socket: TLSSocket, identity: string): DataView | NodeJS.TypedArray | null;
|
504 | /**
|
505 | * hint to send to a client to help
|
506 | * with selecting the identity during TLS-PSK negotiation. Will be ignored
|
507 | * in TLS 1.3. Upon failing to set pskIdentityHint `tlsClientError` will be
|
508 | * emitted with `ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED` code.
|
509 | */
|
510 | pskIdentityHint?: string | undefined;
|
511 | }
|
512 | interface PSKCallbackNegotation {
|
513 | psk: DataView | NodeJS.TypedArray;
|
514 | identity: string;
|
515 | }
|
516 | interface ConnectionOptions extends SecureContextOptions, CommonConnectionOptions {
|
517 | host?: string | undefined;
|
518 | port?: number | undefined;
|
519 | path?: string | undefined; // Creates unix socket connection to path. If this option is specified, `host` and `port` are ignored.
|
520 | socket?: stream.Duplex | undefined; // Establish secure connection on a given socket rather than creating a new socket
|
521 | checkServerIdentity?: typeof checkServerIdentity | undefined;
|
522 | servername?: string | undefined; // SNI TLS Extension
|
523 | session?: Buffer | undefined;
|
524 | minDHSize?: number | undefined;
|
525 | lookup?: net.LookupFunction | undefined;
|
526 | timeout?: number | undefined;
|
527 | /**
|
528 | * When negotiating TLS-PSK (pre-shared keys), this function is called
|
529 | * with optional identity `hint` provided by the server or `null`
|
530 | * in case of TLS 1.3 where `hint` was removed.
|
531 | * It will be necessary to provide a custom `tls.checkServerIdentity()`
|
532 | * for the connection as the default one will try to check hostname/IP
|
533 | * of the server against the certificate but that's not applicable for PSK
|
534 | * because there won't be a certificate present.
|
535 | * More information can be found in the RFC 4279.
|
536 | *
|
537 | * @param hint message sent from the server to help client
|
538 | * decide which identity to use during negotiation.
|
539 | * Always `null` if TLS 1.3 is used.
|
540 | * @returns Return `null` to stop the negotiation process. `psk` must be
|
541 | * compatible with the selected cipher's digest.
|
542 | * `identity` must use UTF-8 encoding.
|
543 | */
|
544 | pskCallback?(hint: string | null): PSKCallbackNegotation | null;
|
545 | }
|
546 | /**
|
547 | * Accepts encrypted connections using TLS or SSL.
|
548 | * @since v0.3.2
|
549 | */
|
550 | class Server extends net.Server {
|
551 | constructor(secureConnectionListener?: (socket: TLSSocket) => void);
|
552 | constructor(options: TlsOptions, secureConnectionListener?: (socket: TLSSocket) => void);
|
553 | /**
|
554 | * The `server.addContext()` method adds a secure context that will be used if
|
555 | * the client request's SNI name matches the supplied `hostname` (or wildcard).
|
556 | *
|
557 | * When there are multiple matching contexts, the most recently added one is
|
558 | * used.
|
559 | * @since v0.5.3
|
560 | * @param hostname A SNI host name or wildcard (e.g. `'*'`)
|
561 | * @param context An object containing any of the possible properties from the {@link createSecureContext} `options` arguments (e.g. `key`, `cert`, `ca`, etc).
|
562 | */
|
563 | addContext(hostname: string, context: SecureContextOptions): void;
|
564 | /**
|
565 | * Returns the session ticket keys.
|
566 | *
|
567 | * See `Session Resumption` for more information.
|
568 | * @since v3.0.0
|
569 | * @return A 48-byte buffer containing the session ticket keys.
|
570 | */
|
571 | getTicketKeys(): Buffer;
|
572 | /**
|
573 | * The `server.setSecureContext()` method replaces the secure context of an
|
574 | * existing server. Existing connections to the server are not interrupted.
|
575 | * @since v11.0.0
|
576 | * @param options An object containing any of the possible properties from the {@link createSecureContext} `options` arguments (e.g. `key`, `cert`, `ca`, etc).
|
577 | */
|
578 | setSecureContext(options: SecureContextOptions): void;
|
579 | /**
|
580 | * Sets the session ticket keys.
|
581 | *
|
582 | * Changes to the ticket keys are effective only for future server connections.
|
583 | * Existing or currently pending server connections will use the previous keys.
|
584 | *
|
585 | * See `Session Resumption` for more information.
|
586 | * @since v3.0.0
|
587 | * @param keys A 48-byte buffer containing the session ticket keys.
|
588 | */
|
589 | setTicketKeys(keys: Buffer): void;
|
590 | /**
|
591 | * events.EventEmitter
|
592 | * 1. tlsClientError
|
593 | * 2. newSession
|
594 | * 3. OCSPRequest
|
595 | * 4. resumeSession
|
596 | * 5. secureConnection
|
597 | * 6. keylog
|
598 | */
|
599 | addListener(event: string, listener: (...args: any[]) => void): this;
|
600 | addListener(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
601 | addListener(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
602 | addListener(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
603 | addListener(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
604 | addListener(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
|
605 | addListener(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
606 | emit(event: string | symbol, ...args: any[]): boolean;
|
607 | emit(event: 'tlsClientError', err: Error, tlsSocket: TLSSocket): boolean;
|
608 | emit(event: 'newSession', sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void): boolean;
|
609 | emit(event: 'OCSPRequest', certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void): boolean;
|
610 | emit(event: 'resumeSession', sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void): boolean;
|
611 | emit(event: 'secureConnection', tlsSocket: TLSSocket): boolean;
|
612 | emit(event: 'keylog', line: Buffer, tlsSocket: TLSSocket): boolean;
|
613 | on(event: string, listener: (...args: any[]) => void): this;
|
614 | on(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
615 | on(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
616 | on(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
617 | on(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
618 | on(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
|
619 | on(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
620 | once(event: string, listener: (...args: any[]) => void): this;
|
621 | once(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
622 | once(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
623 | once(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
624 | once(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
625 | once(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
|
626 | once(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
627 | prependListener(event: string, listener: (...args: any[]) => void): this;
|
628 | prependListener(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
629 | prependListener(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
630 | prependListener(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
631 | prependListener(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
632 | prependListener(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
|
633 | prependListener(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
634 | prependOnceListener(event: string, listener: (...args: any[]) => void): this;
|
635 | prependOnceListener(event: 'tlsClientError', listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
636 | prependOnceListener(event: 'newSession', listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
637 | prependOnceListener(event: 'OCSPRequest', listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
638 | prependOnceListener(event: 'resumeSession', listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
639 | prependOnceListener(event: 'secureConnection', listener: (tlsSocket: TLSSocket) => void): this;
|
640 | prependOnceListener(event: 'keylog', listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
641 | }
|
642 | /**
|
643 | * @deprecated since v0.11.3 Use `tls.TLSSocket` instead.
|
644 | */
|
645 | interface SecurePair {
|
646 | encrypted: TLSSocket;
|
647 | cleartext: TLSSocket;
|
648 | }
|
649 | type SecureVersion = 'TLSv1.3' | 'TLSv1.2' | 'TLSv1.1' | 'TLSv1';
|
650 | interface SecureContextOptions {
|
651 | /**
|
652 | * Optionally override the trusted CA certificates. Default is to trust
|
653 | * the well-known CAs curated by Mozilla. Mozilla's CAs are completely
|
654 | * replaced when CAs are explicitly specified using this option.
|
655 | */
|
656 | ca?: string | Buffer | Array<string | Buffer> | undefined;
|
657 | /**
|
658 | * Cert chains in PEM format. One cert chain should be provided per
|
659 | * private key. Each cert chain should consist of the PEM formatted
|
660 | * certificate for a provided private key, followed by the PEM
|
661 | * formatted intermediate certificates (if any), in order, and not
|
662 | * including the root CA (the root CA must be pre-known to the peer,
|
663 | * see ca). When providing multiple cert chains, they do not have to
|
664 | * be in the same order as their private keys in key. If the
|
665 | * intermediate certificates are not provided, the peer will not be
|
666 | * able to validate the certificate, and the handshake will fail.
|
667 | */
|
668 | cert?: string | Buffer | Array<string | Buffer> | undefined;
|
669 | /**
|
670 | * Colon-separated list of supported signature algorithms. The list
|
671 | * can contain digest algorithms (SHA256, MD5 etc.), public key
|
672 | * algorithms (RSA-PSS, ECDSA etc.), combination of both (e.g
|
673 | * 'RSA+SHA384') or TLS v1.3 scheme names (e.g. rsa_pss_pss_sha512).
|
674 | */
|
675 | sigalgs?: string | undefined;
|
676 | /**
|
677 | * Cipher suite specification, replacing the default. For more
|
678 | * information, see modifying the default cipher suite. Permitted
|
679 | * ciphers can be obtained via tls.getCiphers(). Cipher names must be
|
680 | * uppercased in order for OpenSSL to accept them.
|
681 | */
|
682 | ciphers?: string | undefined;
|
683 | /**
|
684 | * Name of an OpenSSL engine which can provide the client certificate.
|
685 | */
|
686 | clientCertEngine?: string | undefined;
|
687 | /**
|
688 | * PEM formatted CRLs (Certificate Revocation Lists).
|
689 | */
|
690 | crl?: string | Buffer | Array<string | Buffer> | undefined;
|
691 | /**
|
692 | * Diffie Hellman parameters, required for Perfect Forward Secrecy. Use
|
693 | * openssl dhparam to create the parameters. The key length must be
|
694 | * greater than or equal to 1024 bits or else an error will be thrown.
|
695 | * Although 1024 bits is permissible, use 2048 bits or larger for
|
696 | * stronger security. If omitted or invalid, the parameters are
|
697 | * silently discarded and DHE ciphers will not be available.
|
698 | */
|
699 | dhparam?: string | Buffer | undefined;
|
700 | /**
|
701 | * A string describing a named curve or a colon separated list of curve
|
702 | * NIDs or names, for example P-521:P-384:P-256, to use for ECDH key
|
703 | * agreement. Set to auto to select the curve automatically. Use
|
704 | * crypto.getCurves() to obtain a list of available curve names. On
|
705 | * recent releases, openssl ecparam -list_curves will also display the
|
706 | * name and description of each available elliptic curve. Default:
|
707 | * tls.DEFAULT_ECDH_CURVE.
|
708 | */
|
709 | ecdhCurve?: string | undefined;
|
710 | /**
|
711 | * Attempt to use the server's cipher suite preferences instead of the
|
712 | * client's. When true, causes SSL_OP_CIPHER_SERVER_PREFERENCE to be
|
713 | * set in secureOptions
|
714 | */
|
715 | honorCipherOrder?: boolean | undefined;
|
716 | /**
|
717 | * Private keys in PEM format. PEM allows the option of private keys
|
718 | * being encrypted. Encrypted keys will be decrypted with
|
719 | * options.passphrase. Multiple keys using different algorithms can be
|
720 | * provided either as an array of unencrypted key strings or buffers,
|
721 | * or an array of objects in the form {pem: <string|buffer>[,
|
722 | * passphrase: <string>]}. The object form can only occur in an array.
|
723 | * object.passphrase is optional. Encrypted keys will be decrypted with
|
724 | * object.passphrase if provided, or options.passphrase if it is not.
|
725 | */
|
726 | key?: string | Buffer | Array<string | Buffer | KeyObject> | undefined;
|
727 | /**
|
728 | * Name of an OpenSSL engine to get private key from. Should be used
|
729 | * together with privateKeyIdentifier.
|
730 | */
|
731 | privateKeyEngine?: string | undefined;
|
732 | /**
|
733 | * Identifier of a private key managed by an OpenSSL engine. Should be
|
734 | * used together with privateKeyEngine. Should not be set together with
|
735 | * key, because both options define a private key in different ways.
|
736 | */
|
737 | privateKeyIdentifier?: string | undefined;
|
738 | /**
|
739 | * Optionally set the maximum TLS version to allow. One
|
740 | * of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified along with the
|
741 | * `secureProtocol` option, use one or the other.
|
742 | * **Default:** `'TLSv1.3'`, unless changed using CLI options. Using
|
743 | * `--tls-max-v1.2` sets the default to `'TLSv1.2'`. Using `--tls-max-v1.3` sets the default to
|
744 | * `'TLSv1.3'`. If multiple of the options are provided, the highest maximum is used.
|
745 | */
|
746 | maxVersion?: SecureVersion | undefined;
|
747 | /**
|
748 | * Optionally set the minimum TLS version to allow. One
|
749 | * of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified along with the
|
750 | * `secureProtocol` option, use one or the other. It is not recommended to use
|
751 | * less than TLSv1.2, but it may be required for interoperability.
|
752 | * **Default:** `'TLSv1.2'`, unless changed using CLI options. Using
|
753 | * `--tls-v1.0` sets the default to `'TLSv1'`. Using `--tls-v1.1` sets the default to
|
754 | * `'TLSv1.1'`. Using `--tls-min-v1.3` sets the default to
|
755 | * 'TLSv1.3'. If multiple of the options are provided, the lowest minimum is used.
|
756 | */
|
757 | minVersion?: SecureVersion | undefined;
|
758 | /**
|
759 | * Shared passphrase used for a single private key and/or a PFX.
|
760 | */
|
761 | passphrase?: string | undefined;
|
762 | /**
|
763 | * PFX or PKCS12 encoded private key and certificate chain. pfx is an
|
764 | * alternative to providing key and cert individually. PFX is usually
|
765 | * encrypted, if it is, passphrase will be used to decrypt it. Multiple
|
766 | * PFX can be provided either as an array of unencrypted PFX buffers,
|
767 | * or an array of objects in the form {buf: <string|buffer>[,
|
768 | * passphrase: <string>]}. The object form can only occur in an array.
|
769 | * object.passphrase is optional. Encrypted PFX will be decrypted with
|
770 | * object.passphrase if provided, or options.passphrase if it is not.
|
771 | */
|
772 | pfx?: string | Buffer | Array<string | Buffer | PxfObject> | undefined;
|
773 | /**
|
774 | * Optionally affect the OpenSSL protocol behavior, which is not
|
775 | * usually necessary. This should be used carefully if at all! Value is
|
776 | * a numeric bitmask of the SSL_OP_* options from OpenSSL Options
|
777 | */
|
778 | secureOptions?: number | undefined; // Value is a numeric bitmask of the `SSL_OP_*` options
|
779 | /**
|
780 | * Legacy mechanism to select the TLS protocol version to use, it does
|
781 | * not support independent control of the minimum and maximum version,
|
782 | * and does not support limiting the protocol to TLSv1.3. Use
|
783 | * minVersion and maxVersion instead. The possible values are listed as
|
784 | * SSL_METHODS, use the function names as strings. For example, use
|
785 | * 'TLSv1_1_method' to force TLS version 1.1, or 'TLS_method' to allow
|
786 | * any TLS protocol version up to TLSv1.3. It is not recommended to use
|
787 | * TLS versions less than 1.2, but it may be required for
|
788 | * interoperability. Default: none, see minVersion.
|
789 | */
|
790 | secureProtocol?: string | undefined;
|
791 | /**
|
792 | * Opaque identifier used by servers to ensure session state is not
|
793 | * shared between applications. Unused by clients.
|
794 | */
|
795 | sessionIdContext?: string | undefined;
|
796 | /**
|
797 | * 48-bytes of cryptographically strong pseudo-random data.
|
798 | * See Session Resumption for more information.
|
799 | */
|
800 | ticketKeys?: Buffer | undefined;
|
801 | /**
|
802 | * The number of seconds after which a TLS session created by the
|
803 | * server will no longer be resumable. See Session Resumption for more
|
804 | * information. Default: 300.
|
805 | */
|
806 | sessionTimeout?: number | undefined;
|
807 | }
|
808 | interface SecureContext {
|
809 | context: any;
|
810 | }
|
811 | /**
|
812 | * Verifies the certificate `cert` is issued to `hostname`.
|
813 | *
|
814 | * Returns [Error](https:
|
815 | * failure. On success, returns [undefined](https:
|
816 | *
|
817 | * This function can be overwritten by providing alternative function as part of
|
818 | * the `options.checkServerIdentity` option passed to `tls.connect()`. The
|
819 | * overwriting function can call `tls.checkServerIdentity()` of course, to augment
|
820 | * the checks done with additional verification.
|
821 | *
|
822 | * This function is only called if the certificate passed all other checks, such as
|
823 | * being issued by trusted CA (`options.ca`).
|
824 | * @since v0.8.4
|
825 | * @param hostname The host name or IP address to verify the certificate against.
|
826 | * @param cert A `certificate object` representing the peer's certificate.
|
827 | */
|
828 | function checkServerIdentity(hostname: string, cert: PeerCertificate): Error | undefined;
|
829 | |
830 |
|
831 |
|
832 |
|
833 |
|
834 |
|
835 |
|
836 |
|
837 |
|
838 |
|
839 |
|
840 |
|
841 |
|
842 |
|
843 |
|
844 |
|
845 |
|
846 |
|
847 |
|
848 |
|
849 |
|
850 |
|
851 |
|
852 |
|
853 |
|
854 |
|
855 |
|
856 |
|
857 |
|
858 |
|
859 |
|
860 |
|
861 |
|
862 |
|
863 |
|
864 |
|
865 |
|
866 |
|
867 |
|
868 | function createServer(secureConnectionListener?: (socket: TLSSocket) => void): Server;
|
869 | function createServer(options: TlsOptions, secureConnectionListener?: (socket: TLSSocket) => void): Server;
|
870 | |
871 |
|
872 |
|
873 |
|
874 |
|
875 |
|
876 |
|
877 |
|
878 |
|
879 |
|
880 |
|
881 |
|
882 |
|
883 |
|
884 |
|
885 |
|
886 |
|
887 |
|
888 |
|
889 |
|
890 |
|
891 |
|
892 |
|
893 |
|
894 |
|
895 |
|
896 |
|
897 |
|
898 |
|
899 |
|
900 |
|
901 |
|
902 |
|
903 |
|
904 |
|
905 |
|
906 |
|
907 |
|
908 |
|
909 |
|
910 |
|
911 |
|
912 |
|
913 |
|
914 |
|
915 |
|
916 | function connect(options: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
917 | function connect(port: number, host?: string, options?: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
918 | function connect(port: number, options?: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
919 | |
920 |
|
921 |
|
922 |
|
923 |
|
924 |
|
925 |
|
926 |
|
927 |
|
928 |
|
929 |
|
930 |
|
931 |
|
932 |
|
933 |
|
934 |
|
935 |
|
936 |
|
937 |
|
938 |
|
939 |
|
940 |
|
941 |
|
942 |
|
943 |
|
944 |
|
945 |
|
946 |
|
947 |
|
948 |
|
949 |
|
950 |
|
951 |
|
952 | function createSecurePair(context?: SecureContext, isServer?: boolean, requestCert?: boolean, rejectUnauthorized?: boolean): SecurePair;
|
953 | |
954 |
|
955 |
|
956 |
|
957 |
|
958 |
|
959 |
|
960 |
|
961 |
|
962 |
|
963 |
|
964 |
|
965 |
|
966 |
|
967 |
|
968 |
|
969 |
|
970 | function createSecureContext(options?: SecureContextOptions): SecureContext;
|
971 | |
972 |
|
973 |
|
974 |
|
975 |
|
976 |
|
977 |
|
978 |
|
979 |
|
980 |
|
981 |
|
982 |
|
983 |
|
984 | function getCiphers(): string[];
|
985 | |
986 |
|
987 |
|
988 |
|
989 |
|
990 | let DEFAULT_ECDH_CURVE: string;
|
991 | |
992 |
|
993 |
|
994 |
|
995 |
|
996 |
|
997 |
|
998 |
|
999 |
|
1000 | let DEFAULT_MAX_VERSION: SecureVersion;
|
1001 | |
1002 |
|
1003 |
|
1004 |
|
1005 |
|
1006 |
|
1007 |
|
1008 |
|
1009 |
|
1010 | let DEFAULT_MIN_VERSION: SecureVersion;
|
1011 | |
1012 |
|
1013 |
|
1014 |
|
1015 |
|
1016 | const rootCertificates: ReadonlyArray<string>;
|
1017 | }
|
1018 | declare module 'node:tls' {
|
1019 | export * from 'tls';
|
1020 | }
|
1021 |
|
\ | No newline at end of file |