ex-tls

ex-session-client.js

const crypto = require('crypto');
const fs = require('fs');
const path = require('path');
const tls = require('tls');
const util = require('util');

function read(file, encoding) {
  return fs.readFileSync(path.resolve(__dirname, file), encoding);
}

function ID(b) {
  if (!b)
    return '(null)';
  return b.toString('hex').slice(0, 20);
}

function T(b) {
  if (!b)
    return '(null)';
  return '...' + b.toString('hex').slice(32, 32 + 50) + '...';
}

function S(b) {
  if (!b)
    return '(null)';
  return '...' + b.toString('hex').slice(28, 28 + 50) + '...';
}

var connections = 0;

function connect(port, session) {
  var useSession;
  const client = tls.connect({
    port: port,
    host: 'localhost',
    session: session,
    rejectUnauthorized: true,
    servername: 'localhost',
    checkServerIdentity: (servername, cert) => {
      let err = tls.checkServerIdentity(servername, cert);
      console.log('client.checkServerIdentity %s ok? %j', servername, !err);
      if (err) {
        console.log('  %s', err.message);
        delete err.cert;
        console.log('  %j', err);
        console.log('', util.inspect(cert, {showHidden: true, depth: 2}));
      }
    },
    ca: read('server.crt'),
  });

  client.on('error', (err) => {
    console.log('client.on error %j', err);
  });

  client.on('secureConnect', () => {
    connections++;
    console.log('client.on secureConnect',
      connections, client.getProtocol());
    useSession = client.getSession();
    ticket = client.getTLSTicket();
    if (session) console.log('  try session', S(session));
    if (useSession) console.log('  use session', S(useSession));
    if (ticket) console.log('  ticket', T(ticket));
    client.end();
  });

  client.on('close', () => {
    if (connections < 3)
      connect(5555, useSession);
  });
}

connect(5555);

ex-session-server.js

const fs = require('fs');
const path = require('path');
const tls = require('tls');

function read(file, encoding) {
  return fs.readFileSync(path.resolve(__dirname, file), encoding);
}

const args = process.argv.slice(2).join(' ');
const useSids = args.includes('sids')
const useTickets = args.includes('tickets')
const ticketKeys = Buffer.alloc(48, 0); // Not very secure...

const server = tls.createServer({
  secureOptions: useTickets ? 0 : require('constants').SSL_OP_NO_TICKET,
  cert: read('server.crt'),
  key: read('server.key'),
  ticketKeys: ticketKeys,
}).listen(5555);

server.on('error', (err) => {
  console.log('server.on error %j', err);
});

server.on('tlsClientError', (err, tlssock) => {
  console.log('server.on tlsClientError %j %s', err, tlssock.constructor.name);
});

server.on('listening', () => {
  console.log('-----LISTENING %j localhost:%s', args, server.address().port);
  const ticketKeys = server.getTicketKeys();
  if (ticketKeys)
    console.log('  ticket keys', ticketKeys.toString('hex'));

  fs.writeFileSync('_listening', '');
});

const SESSION = Object.create(null);

function ID(b) {
  if (!b)
    return '(null)';
  return b.toString('hex').toUpperCase().slice(0, 20);
}

function B(b) {
  if (!b)
    return '(null)';
  return b.toString('hex').slice(0, 45) + '...';
}

function S(b) {
  if (!b)
    return '(null)';
  return '...' + b.toString('hex').slice(28, 28 + 40) + '...';
}


server.on('newSession', (id, sess, callback) => {
  const key = id.toString('hex');
  console.log('save session', ID(id), B(sess));
  SESSION[key] = sess;
  return callback();
});

if (useSids) {
  server.on('resumeSession', (id, callback) => {
    const key = id.toString('hex');
    const sess = SESSION[key];
    console.log('resume session', ID(id), B(sess));
    return callback(null, sess);
  });
}

server.on('secureConnection', (tlssock) => {
  console.log('server.on secureConnection %s',
    tlssock.constructor.name, tlssock.getProtocol());
  const session = tlssock.getSession();
  const ticket = tlssock.getTLSTicket();
  if (session) console.log('  session', S(session));
  if (ticket) console.log('  ticket', B(ticket));

  tlssock.pipe(tlssock);
});

ex-tls.js

const crypto = require('crypto');
const fs = require('fs');
const tls = require('tls');
const util = require('util');

// console.log('getCiphers', tls.getCiphers());
// console.log('getCurves', crypto.getCurves());
console.log('DEFAULT_ECDH_CURVE', tls.DEFAULT_ECDH_CURVE);

const server = tls.createServer({
  ALPNProtocols: ['http/1.1'],
  requestCert: false,
  SNICallback: (servername, cb) => {
    console.log('SNICallback', servername);
    return cb();
  },
  cert: fs.readFileSync('server.crt'),
  key: fs.readFileSync('server.key'),
  // ticketKeys: ... does setting this enable session tickets?
  secureProtocol: 'TLSv1_2_method',
}).listen(5555);

// server.addContext(...

server.on('close', () => {
  console.log('server.on close');
});

server.on('connection', (sock) => {
  console.log('server.on connection %s', sock.constructor.name);
  server.close();
});

server.on('error', (err) => {
  console.log('server.on error %j', err);
});

server.on('listening', () => {
  console.log('server.on listening %j', server.address());

  connect(server.address().port);
});

// server.on('newSession', ...
// server.on('OCSPRequest', ...
// server.on('resumeSession', ...

server.on('secureConnection', (tlssock) => {
  console.log('server.on secureConnection %s', tlssock.constructor.name);
  console.log('  authorized %j', tlssock.authorized);
  console.log('  authorizationError %j', tlssock.authorizationError);
  console.log('  alpnProtocol %j', tlssock.alpnProtocol);
  console.log('  servername %j', tlssock.servername);
});

server.on('tlsClientError', (err, tlssock) => {
  console.log('server.on tlsClientError %j %s', err, tlssock.constructor.name);
});

function connect(port) {
  const client = tls.connect({
    port: port,
    host: 'localhost',
    rejectUnauthorized: true,
    ALPNProtocols: ['http/1.1'],
    servername: 'localhost',
    checkServerIdentity: (servername, cert) => {
      let err = tls.checkServerIdentity(servername, cert);
      console.log('client.checkServerIdentity %s ok? %j', servername, !err);
      if (err) {
        console.log('  %s', err.message);
        delete err.cert;
        console.log('  %j', err);
        console.log('', util.inspect(cert, {showHidden: true, depth: 2}));
      }
    },
    ca: fs.readFileSync('server.crt'),
  });

  client.on('error', (err) => {
    console.log('client.on error %j', err);
  });

  // client.on('ocspResponse', ...
  client.on('secureConnect', () => {
    console.log('client.on secureConnect');
    console.log('  authorized %j', client.authorized);
    console.log('  authorizationError %j', client.authorizationError);

    client.end();
  });
}

make-certs.sh

set -e
SUBJ="/CN=localhost"
openssl genrsa -des3 -passout pass:123456789 -out server.pass.key 2048
openssl rsa -passin pass:123456789 -in server.pass.key -out server.key
rm server.pass.key
openssl req -batch -new -key server.key -out server.csr -subj "$SUBJ"
openssl x509 -req -sha256 -days 365 -in server.csr -signkey server.key -out server.crt