Skip to content

net: multiple dtls improvements #64314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nodejs-github-bot merged 12 commits into from
Aug 1, 2026
Merged

net: multiple dtls improvements #64314

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
d793a4b
net: improve dtls cert verification
jasnell Jul 6, 2026
1f1b7bd
net: fixing up dtls details
jasnell Jul 6, 2026
5fb654d
net: fixup UAF in dtls
jasnell Jul 6, 2026
315bba9
net: fix session leak in dtls
jasnell Jul 6, 2026
cc991f3
net: fixup failed-connect hang in dtls
jasnell Jul 6, 2026
e9a512e
net: fix dtls unhandled rejections
jasnell Jul 6, 2026
2c39e2a
net: add missing dtls permission check
jasnell Jul 6, 2026
ec94e96
net: fix multiple minor dtls issues
jasnell Jul 6, 2026
0c6d648
net: improve dtls buffer handling
jasnell Jul 6, 2026
344f9f2
net: additional dtls fixups and tests
jasnell Jul 6, 2026
9953529
test: dtls test improvements
jasnell Jul 6, 2026
d7ecfc4
net: fixup dtls c++ formatting
jasnell Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
net: add missing dtls permission check 
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Claude/Opus
  • Loading branch information
@jasnell
jasnell committed Jul 7, 2026
commit 2c39e2aec103a4ea4a78903ca5d1f9c24264591b
3 changes: 3 additions & 0 deletions src/dtls/dtls_endpoint.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -541,6 +541,9 @@ void DTLSEndpoint::DoBind(const FunctionCallbackInfo<Value>& args) {
return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid address");
}

THROW_IF_INSUFFICIENT_PERMISSIONS(
env, permission::PermissionScope::kNet, addr.ToString());

int err = endpoint->Bind(addr);
if (err != 0) {
return THROW_ERR_INVALID_STATE(env, uv_strerror(err));
Expand Down
11 changes: 9 additions & 2 deletions test/parallel/test-permission-net-dtls.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,9 +51,16 @@ const ca = readFileSync(join(fixturesDir, 'ca1-cert.pem')).toString();
);
}

// Test: Creating a DTLSEndpoint without connect/listen is allowed
// since no network I/O occurs at construction time.
// Test: Creating a DTLSEndpoint is allowed (no network I/O at construction
// time), but bind() requires net permission.
{
const endpoint = new DTLSEndpoint();
assert.ok(endpoint);
assert.throws(
() => endpoint.bind('127.0.0.1', 0),
{
code: 'ERR_ACCESS_DENIED',
permission: 'Net',
},
);
}