lib: shorten extraneous comments in dtls.js

Signed-off-by: James M Snell <jasnell@gmail.com>

Author: jasnell

lib/internal/dtls/dtls.js

@@ -102,16 +102,8 @@ const {
 
 const kEmptyObject = { __proto__: null };
 
-// Default bounds on how many server sessions an endpoint will hold. Each one
-// owns an SSL, two BIOs and a timer, so an unbounded table is a memory
-// exhaustion vector for anyone willing to complete cookie exchanges. The
-// per-host cap is what stops a single peer taking the whole table; it is set
-// well above what a large NAT would plausibly need, and either can be raised,
-// or set to 0 to disable, via dtls.listen().
 // Upper bound on exported keying material. RFC 5705 sets no limit, but every
-// real exporter wants tens of bytes -- DTLS-SRTP's is 60 -- and without a
-// bound a caller can ask for a 4 GiB allocation. Rejecting that with a
-// TypeError beats failing the allocation.
+// real exporter wants tens of bytes -- DTLS-SRTP's is 60.
 const kMaxKeyingMaterialLength = 65536;
 
 // Matches node:tls, which derives the default from the process invocation so
@@ -359,22 +351,13 @@ class DTLSSession {
   }
 
   get peerX509Certificate() {
-    // Cached deliberately, not just to hand back a stable object. The
-    // underlying X509Certificate::GetPeerCert() is destructive on the client
-    // side: with no peer certificate of its own to start from it lifts the
-    // leaf out of the SSL's chain with sk_X509_delete(), so calling it a
-    // second time yields a shorter chain and eventually nothing at all.
-    // Calling it once and keeping the result is the only correct use.
     if (this.#peerX509Certificate !== undefined) {
       return this.#peerX509Certificate;
     }
     if (this.#handle === null) return undefined;
 
     const cert = this.#handle.getPeerX509Certificate();
     if (!cert) {
-      // No peer certificate yet, or none at all. Not cached: before the
-      // handshake completes there is nothing to take, and the call does not
-      // disturb the chain when it finds none, so a later access can retry.
       return undefined;
     }
 
@@ -524,12 +507,6 @@ class DTLSSession {
     }
   }
 
-  // Mark that this session owns its endpoint (for client sessions
-  // created by connect() where the endpoint is internal).
-  // Not a public accessor. This says whether closing the session should take
-  // the endpoint with it, which is true only for the endpoint connect()
-  // creates for a single session. Setting it on a server session made closing
-  // that one session tear down the listener and every other session on it.
   get [kOwnsEndpoint]() { return this.#ownsEndpoint; }
   set [kOwnsEndpoint](val) { this.#ownsEndpoint = val; }
 
@@ -1241,10 +1218,6 @@ function resolveSNIValue(value, name) {
 
 function applySNIContexts(context, sni) {
   if (typeof sni === 'function') {
-    // The binding calls this during the handshake and wants a context back,
-    // so the conversion an options bag needs is done here rather than there.
-    // Building one costs a certificate parse on every handshake, which is
-    // why returning a prepared DTLSSecureContext is worth doing.
     const select = (servername) => {
       const value = sni(servername);
       if (value === undefined || value === null) return undefined;
@@ -1270,10 +1243,6 @@ function applySNIContexts(context, sni) {
               resolveSNIValue(sni[hostname], `options.sni['${hostname}']`));
   }
 
-  // The binding holds these weakly. A context is allowed to appear in its own
-  // SNI map, or in a cycle with another, and a reference count cannot free
-  // either -- but a property on the owning wrapper is an edge the garbage
-  // collector can trace, so the whole group goes when nothing else holds it.
   context[kSNIContexts] = flat;
   context.setSNIContexts(flat, undefined);
 }
@@ -1423,11 +1392,6 @@ function connect(host, port, options = kEmptyObject) {
   validateInteger(port, 'port', 0, 65535);
   validateObject(options, 'options');
 
-  // The local socket has to be in the same family as the peer: binding the
-  // IPv4 wildcard and then sending to an IPv6 address cannot work. Default to
-  // the wildcard matching the remote literal. isIP() only parses, so this
-  // stays synchronous -- a hostname returns 0 and keeps the IPv4 default,
-  // which is what happens today for anything DNS would have resolved.
   if (options.bindHost !== undefined) {
     validateString(options.bindHost, 'options.bindHost');
   }
@@ -1458,8 +1422,8 @@ function connect(host, port, options = kEmptyObject) {
   endpoint[kBind](bindHost, bindPort);
 
   // SNI and peer-identity verification are resolved inside
-  // DTLSEndpoint.connect(), which defaults both to the host argument (matching
-  // Node.js TLS). The identity is enforced whenever the context verifies, i.e.
+  // DTLSEndpoint.connect(), which defaults both to the host argument.
+  // The identity is enforced whenever the context verifies, i.e.
   // unless rejectUnauthorized is false.
   const session = endpoint[kDoConnect](
     context, host, port, options.servername, options.session);