Fast code search

  if (net.isIP(hostname)) {
    valid = ips.includes(canonicalizeIP(hostname));
    if (!valid)
      reason = `IP: ${hostname} is not in the cert's list: ` + ips.join(', ');
  } else if (dnsNames.length > 0 || subject?.CN) {
    const hostParts = splitHost(hostname);
    const wildcard = (pattern) => check(hostParts, pattern, true);

    if (dnsNames.length > 0) {
      valid = dnsNames.some(wildcard);
      if (!valid)
        reason =
          `Host: ${hostname}. is not in the cert's altnames: ${altNames}`;
    } else {
      // Match against Common Name only if no supported identifiers exist.
      const cn = subject.CN;

      if (ArrayIsArray(cn))
        valid = cn.some(wildcard);
      else if (cn)
        valid = wildcard(cn);

      if (!valid)
        reason = `Host: ${hostname}. is not cert's CN: ${cn}`;
    }
  } else {
    reason = 'Cert does not contain a DNS name';
  }

  if (!valid) {
    return new ERR_TLS_CERT_ALTNAME_INVALID(reason, hostname, cert);
  }
};

exports.createSecureContext = tlsCommon.createSecureContext;
exports.SecureContext = tlsCommon.SecureContext;
exports.TLSSocket = tlsWrap.TLSSocket;
exports.Server = tlsWrap.Server;
exports.createServer = tlsWrap.createServer;
exports.connect = tlsWrap.connect;

                                          X509_STORE_CTX* ctx) {
  // This callback is invoked by OpenSSL for each certificate in the
  // client's chain during the TLS handshake. The preverify_ok
  // parameter reflects OpenSSL's own chain validation result for
  // the current certificate. Failures include:
  //   - Expired or not-yet-valid certificates
  //   - Self-signed certificates not in the trusted CA list
  //   - Broken chain (signature verification failure)
  //   - Untrusted CA (chain does not terminate at a configured CA)
  //   - Revoked certificates (if CRL is configured)
  //   - Invalid basic constraints or key usage
  //
  // If preverify_ok is 1, validation passed for this cert and we
  // always continue. If it is 0, the behavior depends on the
  // reject_unauthorized option:
  //   - true (default): return 0 to abort the handshake immediately,
  //     avoiding wasted work on an untrusted client.
  //   - false: return 1 to let the handshake complete. The validation
  //     error is still recorded by OpenSSL and will be reported to JS
  //     via VerifyPeerIdentity() in the handshake callback, allowing
  //     the application to make its own decision.
  //
  // Note that even when preverify_ok is 1 (chain validation passed),
  // the application may need to perform additional verification after
  // the handshake — for example, checking the certificate's common
  // name or subject alternative names against an allowlist, verifying
  // application-specific fields or extensions, or enforcing certificate

  {
    TransportParams tp(ngtcp2_conn_get_local_transport_params(*session_));
    // Preflight to get the encoded size.
    ssize_t size = tp.EncodedSize();
    if (size > 0) {
      MaybeStackBuffer<uint8_t, 512> buf(size);
      ssize_t written = tp.EncodeInto(buf.out(), size);
      if (written > 0) {
        ngtcp2_vec vec = {buf.out(), static_cast<size_t>(written)};
        if (!ossl_context_.set_transport_params(vec)) {
          validation_error_ = "Failed to set transport parameters";
          ossl_context_.reset();
          return;
        }
      }
    }
  }
}

std::optional<TLSSession::PeerIdentityValidationError>
TLSSession::VerifyPeerIdentity(Environment* env) {
  // We are just temporarily wrapping the ssl, not taking ownership.
  SSLPointerRef ssl(ossl_context_);
  int err = ssl->verifyPeerCertificate().value_or(X509_V_ERR_UNSPECIFIED);
  if (err == X509_V_OK) return std::nullopt;
  Local<Value> reason;
  Local<Value> code;
  if (!crypto::GetValidationErrorReason(env, err).ToLocal(&reason) ||
      !crypto::GetValidationErrorCode(env, err).ToLocal(&code)) {
    // Getting the validation error details failed. We'll return a value but
    // the fields will be empty.
    return PeerIdentityValidationError{};
  }
  return PeerIdentityValidationError{reason, code};
}

MaybeLocal<Object> TLSSession::cert(Environment* env) const {
  SSLPointerRef ssl(ossl_context_);
  return crypto::X509Certificate::GetCert(env, ssl);
}

function configSecureContext(context, options = kEmptyObject, name = 'options') {
  validateObject(options, name);

  const {
    allowPartialTrustChain,
    ca,
    cert,
    ciphers = getDefaultCiphers(),
    clientCertEngine,
    crl,
    dhparam,
    ecdhCurve = getDefaultEcdhCurve(),
    key,
    passphrase,
    pfx,
    privateKeyIdentifier,
    privateKeyEngine,
    sessionIdContext,
    sessionTimeout,
    sigalgs,
    ticketKeys,
  } = options;

  // Set the cipher list and cipher suite before anything else because
  // @SECLEVEL=<n> changes the security level and that affects subsequent
  // operations.
  if (ciphers !== undefined && ciphers !== null)
    validateString(ciphers, `${name}.ciphers`);

  // Work around an OpenSSL API quirk. cipherList is for TLSv1.2 and below,
  // cipherSuites is for TLSv1.3 (and presumably any later versions). TLSv1.3
  // cipher suites all have a standard name format beginning with TLS_, so split
  // the ciphers and pass them to the appropriate API.
  const {
    cipherList,
    cipherSuites,
  } = processCiphers(ciphers, `${name}.ciphers`);

  if (cipherSuites !== '')
    context.setCipherSuites(cipherSuites);
  context.setCiphers(cipherList);

  if (cipherList === '' &&
      context.getMinProto() < TLS1_3_VERSION &&
      context.getMaxProto() > TLS1_2_VERSION) {
    context.setMinProto(TLS1_3_VERSION);
  }

  // Add CA before the cert to be able to load cert's issuer in C++ code.
  // NOTE(@jasnell): ca, cert, and key are permitted to be falsy, so do not
  // change the checks to !== undefined checks.

  {
    ClearErrorOnReturn clear_error_on_return;
    for (const auto& cert : options_.certs) {
      uv_buf_t buf = cert;
      if (buf.len > 0) {
        BIOPointer bio = crypto::NodeBIO::NewFixed(buf.base, buf.len);
        CHECK(bio);
        cert_.reset();
        issuer_.reset();
        if (crypto::SSL_CTX_use_certificate_chain(
                ctx.get(), std::move(bio), &cert_, &issuer_) == 0) {
          validation_error_ = "Invalid certificate";
          return SSLCtxPointer();
        }
      }
    }
  }

  {
    ClearErrorOnReturn clear_error_on_return;
    for (const auto& key : options_.keys) {
      if (key.GetKeyType() != crypto::KeyType::kKeyTypePrivate) {
        validation_error_ = "Invalid key";
        return SSLCtxPointer();
      }
      if (!SSL_CTX_use_PrivateKey(ctx.get(), key.GetAsymmetricKey().get())) {
        validation_error_ = "Invalid key";
        return SSLCtxPointer();
      }
    }
  }

const {
  encodingsMap,
  normalizeEncoding,
} = require('internal/util');
const {
  ERR_INVALID_ARG_TYPE,
  ERR_INVALID_THIS,
  ERR_UNKNOWN_ENCODING,
} = require('internal/errors').codes;

const kNativeDecoder = Symbol('kNativeDecoder');

/**
 * StringDecoder provides an interface for efficiently splitting a series of
 * buffers into a series of JS strings without breaking apart multibyte
 * characters.
 * @param {string} [encoding]
 */
function StringDecoder(encoding) {
  this.encoding = normalizeEncoding(encoding);
  if (this.encoding === undefined) {
    throw new ERR_UNKNOWN_ENCODING(encoding);
  }
  this[kNativeDecoder] = Buffer.alloc(kSize);
  this[kNativeDecoder][kEncodingField] = encodingsMap[this.encoding];
}

/**
 * Returns a decoded string, omitting any incomplete multi-bytes
 * characters at the end of the Buffer, or TypedArray, or DataView
 * @param {string | Buffer | TypedArray | DataView} buf
 * @returns {string}
 * @throws {TypeError} Throws when buf is not in one of supported types
 */
StringDecoder.prototype.write = function write(buf) {
  if (typeof buf === 'string')
    return buf;
  if (!ArrayBufferIsView(buf))
    throw new ERR_INVALID_ARG_TYPE('buf',
                                   ['Buffer', 'TypedArray', 'DataView'],
                                   buf);
  if (!this[kNativeDecoder]) {
    throw new ERR_INVALID_THIS('StringDecoder');
  }
  return decode(this[kNativeDecoder], buf);
};

  // Write the bytes from the string or buffer into the char*
  // returns the number of bytes written, which will always be
  // <= buflen.  Use StorageSize/Size first to know how much
  // memory to allocate.
  static size_t Write(v8::Isolate* isolate,
                      char* buf,
                      size_t buflen,
                      v8::Local<v8::Value> val,
                      enum encoding enc);

  // Take the bytes in the src, and turn it into a Buffer or String.
  static v8::MaybeLocal<v8::Value> Encode(v8::Isolate* isolate,
                                          const char* buf,
                                          size_t buflen,
                                          enum encoding encoding);

  // Like Encode(..., UTF8) but does not re-validate. Input must be valid UTF-8.
  static v8::MaybeLocal<v8::Value> EncodeValidUtf8(v8::Isolate* isolate,
                                                   const char* buf,
                                                   size_t buflen);

  // Warning: This reverses endianness on BE platforms, even though the
  // signature using uint16_t implies that it should not.
  // However, the brokenness is already public API and can't therefore
  // be changed easily.
  static v8::MaybeLocal<v8::Value> Encode(v8::Isolate* isolate,
                                          const uint16_t* buf,
                                          size_t buflen);

  static v8::MaybeLocal<v8::Value> Encode(v8::Isolate* isolate,
                                          const char* buf,
                                          enum encoding encoding);

 private:
  static size_t WriteUCS2(v8::Isolate* isolate,
                          char* buf,
                          size_t buflen,
                          v8::Local<v8::String> str);
};

}  // namespace node

#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS

#endif  // SRC_STRING_BYTES_H_

MaybeLocal<Value> StringBytes::Encode(Isolate* isolate,
                                      const uint16_t* buf,
                                      size_t buflen) {
  if (buflen == 0) return String::Empty(isolate);
  CHECK_BUFLEN_IN_RANGE(buflen);

  // Node's "ucs2" encoding expects LE character data inside a
  // Buffer, so we need to reorder on BE platforms.  See
  // https://nodejs.org/api/buffer.html regarding Node's "ucs2"
  // encoding specification
  if constexpr (IsBigEndian()) {
    return EncodeTwoByteString(isolate, buflen, [buf, buflen](uint16_t* dst) {
      size_t nbytes = buflen * sizeof(uint16_t);
      memcpy(dst, buf, nbytes);
      CHECK(nbytes::SwapBytes16(reinterpret_cast<char*>(dst), nbytes));
    });
  } else {
    return ExternTwoByteString::NewFromCopy(isolate, buf, buflen);
  }
}

MaybeLocal<Value> StringBytes::Encode(Isolate* isolate,
                                      const char* buf,
                                      enum encoding encoding) {
  const size_t len = strlen(buf);
  return Encode(isolate, buf, len, encoding);
}

}  // namespace node

Local<ArrayBuffer> ByteSource::ToArrayBuffer(Environment* env) {
  std::unique_ptr<BackingStore> store = ReleaseToBackingStore(env);
  return ArrayBuffer::New(env->isolate(), std::move(store));
}

MaybeLocal<Uint8Array> ByteSource::ToBuffer(Environment* env) {
  Local<ArrayBuffer> ab = ToArrayBuffer(env);
  return Buffer::New(env, ab, 0, ab->ByteLength());
}

ByteSource ByteSource::FromBIO(const BIOPointer& bio) {
  CHECK(bio);
  BUF_MEM* bptr = bio;
  auto out = DataPointer::Alloc(bptr->length);
  memcpy(out.get(), bptr->data, bptr->length);
  return ByteSource::Allocated(out.release());
}

ByteSource ByteSource::FromEncodedString(Environment* env,
                                         Local<String> key,
                                         enum encoding enc) {
  size_t length = 0;
  ByteSource out;

  if (StringBytes::Size(env->isolate(), key, enc).To(&length) && length > 0) {
    auto buf = DataPointer::Alloc(length);
    size_t actual = StringBytes::Write(
        env->isolate(), static_cast<char*>(buf.get()), length, key, enc);
    out = ByteSource::Allocated(buf.resize(actual).release());
  }

  return out;
}

ByteSource ByteSource::FromStringOrBuffer(Environment* env,
                                          Local<Value> value) {
  return IsAnyBufferSource(value) ? FromBuffer(value)
                                  : FromString(env, value.As<String>());
}

namespace worker {

namespace worker {

namespace worker {

void Worker::Run() {

cluster.fork = function(env) {
  cluster.setupPrimary();
  const id = ++ids;
  const workerProcess = createWorkerProcess(id, env);
  const worker = new Worker({
    id: id,
    process: workerProcess,
  });

  worker.on('message', function(message, handle) {
    cluster.emit('message', this, message, handle);
  });

  worker.process.once('exit', (exitCode, signalCode) => {
    /*
     * Remove the worker from the workers list only
     * if it has disconnected, otherwise we might
     * still want to access it.
     */
    if (!worker.isConnected()) {
      removeHandlesForWorker(worker);
      removeWorker(worker);
    }

    worker.exitedAfterDisconnect = !!worker.exitedAfterDisconnect;
    worker.state = 'dead';
    worker.emit('exit', exitCode, signalCode);
    cluster.emit('exit', worker, exitCode, signalCode);
  });

  worker.process.once('disconnect', () => {
    /*
     * Now is a good time to remove the handles
     * associated with this worker because it is
     * not connected to the primary anymore.
     */
    removeHandlesForWorker(worker);

    /*
     * Remove the worker from the workers list only
     * if its process has exited. Otherwise, we might
     * still want to access it.
     */
    if (worker.isDead())
      removeWorker(worker);

    worker.exitedAfterDisconnect = !!worker.exitedAfterDisconnect;
    worker.state = 'disconnected';
    worker.emit('disconnect');
    cluster.emit('disconnect', worker);
  });

  worker.process.on('internalMessage', internal(worker, onmessage));

function parseCommandLine() {

  if (!(flags & ProcessInitializationFlags::kDisableCLIOptions)) {
    // Parse the options coming from the config file.
    // This is done before parsing the command line options
    // as the cli flags are expected to override the config file ones.
    std::vector<std::string> extra_argv =
        per_process::config_reader.GetNamespaceFlags();
    // [0] is expected to be the program name, fill it in from the real argv.
    extra_argv.insert(extra_argv.begin(), argv->at(0));
    // Parse the extra argv coming from the config file
    ExitCode exit_code = ProcessGlobalArgsInternal(
        &extra_argv, nullptr, errors, kDisallowedInEnvvar);
    if (exit_code != ExitCode::kNoFailure) return exit_code;
    // Parse options coming from the command line.
    exit_code =
        ProcessGlobalArgsInternal(argv, exec_argv, errors, kDisallowedInEnvvar);
    if (exit_code != ExitCode::kNoFailure) return exit_code;
  }

  // Set the process.title immediately after processing argv if --title is set.
  if (!per_process::cli_options->title.empty())
    uv_set_process_title(per_process::cli_options->title.c_str());

  const tokens = argsToTokens(args, options);

  // Phase 2: process tokens into parsed option values and positionals
  const result = {
    values: { __proto__: null },
    positionals: [],
  };
  if (returnTokens) {
    result.tokens = tokens;
  }
  ArrayPrototypeForEach(tokens, (token) => {
    if (token.kind === 'option') {
      if (strict) {
        checkOptionUsage(parseConfig, token);
        checkOptionLikeValue(token);
      }
      storeOption(token, options, result.values, parseConfig.allowNegative);
    } else if (token.kind === 'positional') {
      if (!allowPositionals) {
        throw new ERR_PARSE_ARGS_UNEXPECTED_POSITIONAL(token.value);
      }
      ArrayPrototypePush(result.positionals, token.value);
    }
  });

  // Phase 3: fill in default values for missing args
  ArrayPrototypeForEach(ObjectEntries(options), ({ 0: longOption,
                                                   1: optionConfig }) => {
    const mustSetDefault = useDefaultValueOption(longOption,
                                                 optionConfig,
                                                 result.values);
    if (mustSetDefault) {
      storeDefaultOption(longOption,
                         objectGetOwn(optionConfig, 'default'),
                         result.values);
    }
  });


  return result;
};

module.exports = {
  parseArgs,
};

void GetOptionsAsFlags(const FunctionCallbackInfo<Value>& args) {
  Isolate* isolate = args.GetIsolate();
  Local<Context> context = isolate->GetCurrentContext();
  Environment* env = Environment::GetCurrent(context);

  if (!env->has_run_bootstrapping_code()) {
    // No code because this is an assertion.
    THROW_ERR_OPTIONS_BEFORE_BOOTSTRAPPING(
        isolate, "Should not query options before bootstrapping is done");
  }
  env->set_has_serialized_options(true);

  Mutex::ScopedLock lock(per_process::cli_options_mutex);
  IterateCLIOptionsScope s(env);

  std::vector<std::string> flags;
  PerProcessOptions* opts = per_process::cli_options.get();

/**
 * Store the default option value in `values`.
 * @param {string} longOption - long option name e.g. 'foo'
 * @param {string
 *         | boolean
 *         | string[]
 *         | boolean[]} optionValue - default value from option config
 * @param {object} values - option values returned in `values` by parseArgs
 */
function storeDefaultOption(longOption, optionValue, values) {
  if (longOption === '__proto__') {
    return; // No. Just no.
  }

  values[longOption] = optionValue;
}

/**
 * Process args and turn into identified tokens:
 * - option (along with value, if any)
 * - positional
 * - option-terminator
 * @param {string[]} args - from parseArgs({ args }) or mainArgs
 * @param {object} options - option configs, from parseArgs({ options })
 * @returns {any[]}
 */