test.js

'use strict';

const assert = require('assert');
const tls = require('tls');

const { addCustomExtension, isPredefinedExtension, constants } = require('./index');

// Self-signed EC test certificate (CN=localhost, valid 10 years)
const serverKey = `-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIJAMcZMa7e8btj/rhtEVB3aZmiuh4BZsGoVNgiWTa0XcoAoGCCqGSM49
AwEHoUQDQgAEXCBj5+sFoUatk0lOoz7V+HautKinf4HUWT917cUKfQYBnoCgONn0
N1RWavhXUhXb8spRHV7kc1sh15HxitClLg==
-----END EC PRIVATE KEY-----`;

const serverCert = `-----BEGIN CERTIFICATE-----
MIIBfDCCASOgAwIBAgIUSvMnW4iAsemsdZXH9BAHXA1BQPwwCgYIKoZIzj0EAwIw
FDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDMwNTE1MDI1MloXDTM2MDMwMjE1
MDI1MlowFDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0CAQYIKoZIzj0D
AQcDQgAEXCBj5+sFoUatk0lOoz7V+HautKinf4HUWT917cUKfQYBnoCgONn0N1RW
avhXUhXb8spRHV7kc1sh15HxitClLqNTMFEwHQYDVR0OBBYEFCiRoQ0TjjnychRc
zVSZjWc3DGQBMB8GA1UdIwQYMBaAFCiRoQ0TjjnychRczVSZjWc3DGQBMA8GA1Ud
EwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIgQnHzgEk6MzOQpDXgL5PyzQ/S
GktmrvfHxUaJomBj13oCIGJnwUZ523O7FwXmsqp6Au/j54Lw/6WmDwu1ur/Fl53F
-----END CERTIFICATE-----`;

let testsRun = 0;
let testsPassed = 0;

function test(name, fn) {
  return new Promise((resolve) => {
    console.log(`  running: ${name}`);
    fn((err) => {
      testsRun++;
      if (err) {
        console.log(`  FAIL: ${name}`);
        console.error(err);
      } else {
        testsPassed++;
        console.log(`  ok: ${name}`);
      }
      resolve();
    });
  });
}

function createServer(connectionHandler) {
  return tls.createServer({
    key: serverKey,
    cert: serverCert,
  }, connectionHandler);
}

function connectAndClose(server, clientSecCtx) {
  return new Promise((resolve, reject) => {
    server.listen(0, () => {
      const client = tls.connect({
        port: server.address().port,
        secureContext: clientSecCtx,
        servername: 'localhost',
        rejectUnauthorized: false,
      }, () => {
        client.end();
      });

      client.on('close', () => {
        server.close(() => resolve());
      });

      client.on('error', (err) => {
        server.close(() => reject(err));
      });
    });
  });
}

async function runTests() {
  console.log('TAP version 13');
  console.log('# custom-tls-extensions tests\n');

  // Test 1: Static extension data round-trip
  await test('static extension data round-trip', (done) => {
    const staticPayload = Buffer.from([0xDE, 0xAD, 0xBE, 0xEF]);
    let serverReceivedData = null;

    const server = createServer((socket) => { socket.end(); });

    addCustomExtension(server, {
      extensionType: 0xFF00,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        serverReceivedData = data;
        return true;
      },
    });

    const clientSecCtx = tls.createSecureContext();
    addCustomExtension(clientSecCtx, {
      extensionType: 0xFF00,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: staticPayload,
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.ok(serverReceivedData !== null,
          'server should have received extension data');
        assert.deepStrictEqual(
          serverReceivedData, staticPayload,
          'received data should match sent data');
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Test 2: Dynamic callback mode
  await test('dynamic callback mode', (done) => {
    const dynamicPayload = Buffer.from([0xCA, 0xFE]);
    let serverReceivedData = null;

    const server = createServer((socket) => { socket.end(); });

    addCustomExtension(server, {
      extensionType: 0xFF03,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        serverReceivedData = data;
        return true;
      },
    });

    const clientSecCtx = tls.createSecureContext();
    addCustomExtension(clientSecCtx, {
      extensionType: 0xFF03,
      context: constants.SSL_EXT_CLIENT_HELLO,
      add(extType, context) {
        return dynamicPayload;
      },
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.ok(serverReceivedData !== null,
          'server should have received dynamic extension data');
        assert.deepStrictEqual(
          serverReceivedData, dynamicPayload,
          'received data should match dynamic callback data');
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Test 3: Null return from add callback skips extension
  await test('null return skips extension', (done) => {
    let serverParseCalled = false;

    const server = createServer((socket) => { socket.end(); });

    addCustomExtension(server, {
      extensionType: 0xFF04,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        serverParseCalled = true;
        return true;
      },
    });

    const clientSecCtx = tls.createSecureContext();
    addCustomExtension(clientSecCtx, {
      extensionType: 0xFF04,
      context: constants.SSL_EXT_CLIENT_HELLO,
      add(extType, context) {
        return null;  // skip this extension
      },
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.strictEqual(serverParseCalled, false,
          'server parse should not be called when client skips extension');
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Test 4: isPredefinedExtension
  await test('isPredefinedExtension', (done) => {
    try {
      assert.strictEqual(isPredefinedExtension(0), true,
        'server_name (0) should be supported');
      assert.strictEqual(isPredefinedExtension(10), true,
        'supported_groups (10) should be supported');
      assert.strictEqual(isPredefinedExtension(0xFF01), true,
        'renegotiation_info (0xFF01) should be supported');
      assert.strictEqual(isPredefinedExtension(0xFF00), false,
        '0xFF00 should not be internally supported');
      assert.strictEqual(isPredefinedExtension(0x0A0A), false,
        'GREASE value 0x0A0A should not be internally supported');
      done();
    } catch (e) {
      done(e);
    }
  });

  // Test 5: Error - internally-handled extension type
  await test('error: internally-handled extension type', (done) => {
    try {
      const ctx = tls.createSecureContext();
      assert.throws(() => {
        addCustomExtension(ctx, {
          extensionType: 0,  // server_name, handled by OpenSSL
          context: constants.SSL_EXT_CLIENT_HELLO,
          data: Buffer.from([0x00]),
        });
      }, /SSL_CTX_add_custom_ext failed/);
      done();
    } catch (e) {
      done(e);
    }
  });

  // Test 6: Error - invalid input
  await test('error: invalid input', (done) => {
    try {
      assert.throws(() => {
        addCustomExtension({}, {
          extensionType: 0xFF00,
          context: constants.SSL_EXT_CLIENT_HELLO,
          data: Buffer.from([0x00]),
        });
      }, /SecureContext|tls\.Server|native context/);
      done();
    } catch (e) {
      done(e);
    }
  });

  // Test 7: Constants exported correctly
  await test('constants exported correctly', (done) => {
    try {
      assert.strictEqual(constants.SSL_EXT_CLIENT_HELLO, 0x0080);
      assert.strictEqual(constants.SSL_EXT_TLS1_2_SERVER_HELLO, 0x0100);
      assert.strictEqual(constants.SSL_EXT_TLS1_3_SERVER_HELLO, 0x0200);
      assert.strictEqual(constants.SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
        0x0400);
      assert.strictEqual(constants.SSL_EXT_TLS1_2_AND_BELOW_ONLY, 0x0010);
      assert.strictEqual(constants.SSL_EXT_TLS1_3_ONLY, 0x0020);
      assert.strictEqual(constants.SSL_EXT_IGNORE_ON_RESUMPTION, 0x0040);
      assert.strictEqual(constants.SSL_EXT_TLS_ONLY, 0x0001);
      assert.strictEqual(constants.SSL_EXT_DTLS_ONLY, 0x0002);
      done();
    } catch (e) {
      done(e);
    }
  });

  // Test 8: GREASE extension
  await test('GREASE extension (0x0A0A)', (done) => {
    const greasePayload = Buffer.from([0x00]);
    let serverReceivedGrease = null;

    const server = createServer((socket) => { socket.end(); });

    addCustomExtension(server, {
      extensionType: 0x0A0A,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        serverReceivedGrease = data;
        return true;
      },
    });

    const clientSecCtx = tls.createSecureContext();
    addCustomExtension(clientSecCtx, {
      extensionType: 0x0A0A,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: greasePayload,
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.ok(serverReceivedGrease !== null,
          'server should have received GREASE extension');
        assert.deepStrictEqual(
          serverReceivedGrease, greasePayload,
          'GREASE data should match');
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Test 9: Accepts tls.SecureContext directly
  await test('accepts tls.SecureContext directly', (done) => {
    const payload = Buffer.from([0x01, 0x02]);
    let serverReceivedData = null;

    const server = createServer((socket) => { socket.end(); });

    addCustomExtension(server, {
      extensionType: 0xFF05,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        serverReceivedData = data;
        return true;
      },
    });

    const clientSecCtx = tls.createSecureContext();
    // Pass SecureContext directly (not .context)
    addCustomExtension(clientSecCtx, {
      extensionType: 0xFF05,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: payload,
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.deepStrictEqual(serverReceivedData, payload);
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Test 10: Accepts tls.Server directly
  await test('accepts tls.Server directly', (done) => {
    const payload = Buffer.from([0x03, 0x04]);
    let serverReceivedData = null;

    const server = createServer((socket) => { socket.end(); });

    // Pass server directly
    addCustomExtension(server, {
      extensionType: 0xFF06,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        serverReceivedData = data;
        return true;
      },
    });

    const clientSecCtx = tls.createSecureContext();
    addCustomExtension(clientSecCtx, {
      extensionType: 0xFF06,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: payload,
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.deepStrictEqual(serverReceivedData, payload);
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Test 11: Backward compat with raw .context
  await test('backward compat with raw .context', (done) => {
    const payload = Buffer.from([0x05, 0x06]);
    let serverReceivedData = null;

    const server = createServer((socket) => { socket.end(); });

    addCustomExtension(server._sharedCreds.context, {
      extensionType: 0xFF07,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        serverReceivedData = data;
        return true;
      },
    });

    const clientSecCtx = tls.createSecureContext();
    addCustomExtension(clientSecCtx.context, {
      extensionType: 0xFF07,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: payload,
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.deepStrictEqual(serverReceivedData, payload);
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Test 12: Server-to-client extension
  await test('server-to-client extension', (done) => {
    const serverPayload = Buffer.from([0xBE, 0xEF]);
    let clientReceivedData = null;

    const server = createServer((socket) => { socket.end(); });

    // Server must parse CLIENT_HELLO (to see the client's advertisement)
    // and send in SERVER_HELLO.
    addCustomExtension(server, {
      extensionType: 0xFF08,
      context: constants.SSL_EXT_CLIENT_HELLO |
               constants.SSL_EXT_TLS1_2_SERVER_HELLO |
               constants.SSL_EXT_TLS1_3_SERVER_HELLO,
      data: serverPayload,
    });

    const clientSecCtx = tls.createSecureContext();
    // Client must advertise in ClientHello AND parse the ServerHello response.
    // OpenSSL requires a single registration with combined context flags.
    addCustomExtension(clientSecCtx, {
      extensionType: 0xFF08,
      context: constants.SSL_EXT_CLIENT_HELLO |
               constants.SSL_EXT_TLS1_2_SERVER_HELLO |
               constants.SSL_EXT_TLS1_3_SERVER_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        clientReceivedData = data;
        return true;
      },
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.deepStrictEqual(clientReceivedData, serverPayload,
          'client should receive server extension data');
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Test 13: Multiple extensions on same context
  await test('multiple extensions on same context', (done) => {
    const payload1 = Buffer.from([0xAA]);
    const payload2 = Buffer.from([0xBB]);
    let received1 = null;
    let received2 = null;

    const server = createServer((socket) => { socket.end(); });

    addCustomExtension(server, {
      extensionType: 0xFF0A,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        received1 = data;
        return true;
      },
    });

    addCustomExtension(server, {
      extensionType: 0xFF0B,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: Buffer.alloc(0),
      parse(extType, context, data) {
        received2 = data;
        return true;
      },
    });

    const clientSecCtx = tls.createSecureContext();
    addCustomExtension(clientSecCtx, {
      extensionType: 0xFF0A,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: payload1,
    });
    addCustomExtension(clientSecCtx, {
      extensionType: 0xFF0B,
      context: constants.SSL_EXT_CLIENT_HELLO,
      data: payload2,
    });

    connectAndClose(server, clientSecCtx).then(() => {
      try {
        assert.deepStrictEqual(received1, payload1, 'first ext data should match');
        assert.deepStrictEqual(received2, payload2, 'second ext data should match');
        done();
      } catch (e) {
        done(e);
      }
    }).catch(done);
  });

  // Summary
  console.log(`\n1..${testsRun}`);
  console.log(`# tests ${testsRun}`);
  console.log(`# pass  ${testsPassed}`);
  console.log(`# fail  ${testsRun - testsPassed}`);

  if (testsPassed !== testsRun) {
    process.exitCode = 1;
  }
}

runTests().catch((err) => {
  console.error('Fatal error:', err);
  process.exitCode = 1;
});