node:tls: report a Duplex transport's error on the TLS socket - #42235

…t wraps (#37664)

### Problem
- `new tls.TLSSocket(socket)` on the client side (STARTTLS) does nothing
on main. A write throws `TypeError: socket.@Write is not a function`.
`_start()` throws `ERR_MISSING_ARGS`.
- Since #42181 (not released), `end()` throws an uncaught `TypeError:
socket.shutdown is not a function` at `endNT (node:net)`.
- Cause: the constructor stored the wrapped stream as `_handle`
(`src/js/node/tls.ts`). Nothing replaced it with a TLS handle.

### Fix
- The constructor runs the upgrade of `tls.connect({ socket })`
(`kUpgradeClientTLS`, `src/js/node/net.ts`). `_handle` is never the
stream. `_start()` is a no-op.
- The wrap completes like node's `_finishInit`: `'secure'` and
`ssl.verifyError()`. It gets no hostname check and no `'secureConnect'`,
and `authorized` stays `false`.
- Verified: `test/js/node/tls/node-tls-connect.test.ts`. 16 of its 21
new tests fail on main. Also `test/js/node/tls/` and 657 vendored node
tests.

### Background
- STARTTLS changes a plaintext connection to TLS in place. The `mysql`
driver 2.18.1 does it with this constructor. No user filed an issue for
it.
- In `node:net`, `_write`, `_final` and `_destroy` call into `_handle`
as a native handle.
- Only `tls.connect()` adds node's `onConnectSecure` (hostname check,
`authorized`, `'secureConnect'`). A wrap gets `_finishInit` only.
- Considered a start on `_start()`, as in node. Each handle call then
needs a guard.

### Downsides
- An unused wrap now sends a ClientHello of 1450 bytes (main and node:
0). `setServername()` and `setSession()` after construction have no
effect on that handshake.
- Unlike node, a wrap rejects an untrusted certificate unless the caller
passes `rejectUnauthorized: false`. An app that does its own check must
pass `false`.

<details><summary>Notes</summary>

**Scope.** This head is the core only, as the review of 2026-09-24
asked. The same review decided that a wrap rejects an untrusted
certificate by default. Two parts of the earlier head are gone, because
other changes own them. #42235 landed the forwarding of the `'error'` of
a `Duplex`, and #43791 owns it for a `net.Socket`. #38028 owns the
destroy of a wrapped socket that has not connected yet. The
`UpgradedDuplex.rs` hunk landed with #36909. The review of 2026-09-25
asked for three more changes: commits 6657bc3 and ae669bf, and
this body. The review of 2026-09-30 asked for one more: commit
a460a9d.

**Changes since the earlier head that the review did not list.**
- The `open` handler of an upgraded socket applies the `session` option
on the native socket. See "Sessions" below.
- A wrap gives the `NODE_TLS_REJECT_UNAUTHORIZED=0` warning of
`tls.connect()`.
- `authorized` and `authorizationError` keep their initial values on a
wrap, as in node. The earlier head set `authorized = true` for a good
chain. The wrap checks no host name, so that value accepted a
certificate of any host. The verdict is `ssl.verifyError()`.
- A wrap does not get `onConnectEnd`. A peer that closes during the
handshake gives `'end'`, `'finish'`, `'close'` and no `ECONNRESET`, as
in node. `tls.connect({ socket })` keeps its `ECONNRESET`.
- `servername` is passed into the upgrade. Before, it reached the
ClientHello only when the caller gave no `secureContext`.
- `kStandaloneWrap` is initialised in the `Socket` constructor.

**Differences from node v26.3.0 that stay.** The review kept the start
of the handshake in the constructor. The `mysql` driver, the main user
of this API, calls `_start()` right after the constructor, so it sees no
difference.

| shape | node | this PR |
| --- | --- | --- |
| wrap that is never used | sends nothing | sends a ClientHello (1450
bytes) |
| `setServername()` after the constructor | applies, the handshake
starts later | too late. Pass `servername` as an option. |
| `setSession()` after the constructor | applies | no effect. Pass
`session` as an option. |
| untrusted certificate, `rejectUnauthorized` absent or `true` |
`'secure'`, the caller must read `ssl.verifyError()` | destroy with the
verify error, `'_tlsError'`, no `'secure'` |
| untrusted certificate, `rejectUnauthorized: false` | `'secure'`, data
flows | the same |
| `new TLSSocket(raw)`, then `tls.connect({ socket: raw })` | `EALREADY`
on the wrap | `Invalid socket` on the `tls.connect` client (main: works,
because its wrap does nothing) |

Node never rejects a certificate on a wrap. It leaves the check to the
app, so an app that forgets the check accepts any certificate. Here the
wrap uses the rule of `tls.connect()`: it rejects unless the caller
passes `rejectUnauthorized: false`, or `NODE_TLS_REJECT_UNAUTHORIZED` is
`0`. Before commit 4d8b9e5, only `rejectUnauthorized: true` rejected,
and a wrap with default options accepted each certificate, as in node.

The `mysql` driver listens to `'secure'` and to `'_tlsError'`. If the
wrap emitted `'secure'` and then destroyed itself, the driver would
report a bad chain two times. The replay test asserts one report.

**Sessions.** BoringSSL's `SSL_set_session` calls `abort()` when the
handshake has started, in release builds too.
`TLSSocket.prototype.setSession()` calls the native function at once, on
main and on this head. #41671 puts the guard in the native function, for
each caller: a late `setSession()` then throws `Already started.`. An
earlier head of this PR made `setSession()` only store the session. The
review asked to take that rule out, and commit ae669bf did. For a
client-side wrap the review then asked for one narrow rule, in commit
a460a9d: the `TLSSocket` constructor sets `kStandaloneWrap`, and
`setSession()` returns at once when it is set.

| shape | node | main | this PR |
| --- | --- | --- | --- |
| `new TLSSocket(raw)`, `setSession()`, `_start()` | resumes | throws
`ERR_MISSING_ARGS` | no effect, full handshake |
| `tls.connect({ socket })`, then `setSession()` | no effect | process
aborted | process aborted |
| `setSession()` inside `'secureConnect'` | no effect | process aborted
| process aborted |
| `tls.connect({ port })`, then `setSession()` before it connects |
resumes | resumes | resumes |
| `tls.connect({ port })`, then `setSession()` in the `'connect'`
listener | full handshake | resumes | resumes |
| `tls.connect({ socket, session })` | resumes | full handshake |
resumes |
| `new TLSSocket(raw, { session })` | resumes | throws
`ERR_MISSING_ARGS` | resumes |

In the first row, the wrap has sent its ClientHello when `setSession()`
runs. Without the check in `setSession()`, that row aborts the process
(exit 134). The rule also holds for a wrap over a socket that is still
connecting: node resumes there, and this PR runs a full handshake.

The last two rows come from one hunk that stays. `SocketHandlers2.open`
applies the `session` option on the native socket. An fd upgrade assigns
`_handle` after `open`, so `self.setSession()` dropped the option there.

**Two bugs of main that this PR does not fix. An open PR owns each.**
- The native `setSession()` has no check of the handshake state.
`socket.setSession()` in the `handshake` callback of a `Bun.connect`
socket aborts the process (exit 134, release build of main). #41671
fixes it in `set_session` in
`src/runtime/socket/tls_socket_functions.rs`, for each caller. It makes
a late `setSession()` throw `Already started.`.
- Over a `Duplex`, TLS inside TLS, or a named pipe, a handshake that
fails is reported as success. A peer that answers the ClientHello with
plaintext gives `'secureConnect'` for `tls.connect({ socket: duplex,
rejectUnauthorized: false })` on main, and `'secure'` for a wrap with
`rejectUnauthorized: false` here. Node gives
`ERR_SSL_WRONG_VERSION_NUMBER`. Over a TCP socket the result is correct.
The stream engine in `src/uws/lib.rs` reports no protocol error. #32929
fixes it there. One more door of the same bug: with `rejectUnauthorized:
true` and the `session` of an earlier verified connection,
`tls.connect({ socket: duplex })` emits `'secureConnect'` with
`authorized` true on main, and a wrap emits `'secure'` with
`ssl.verifyError()` null here. A write after that fails with
`ERR_SOCKET_CLOSED`, and no byte reaches the transport.

Reproduction for the first one (needs a key and a certificate, for
example `test/js/node/tls/fixtures/agent1-*.pem`):

```ts
const server = Bun.listen({ hostname: "127.0.0.1", port: 0, tls: { key, cert }, socket: { data() {}, open() {}, error() {} } });
await Bun.connect({
  hostname: "127.0.0.1", port: server.port, tls: { rejectUnauthorized: false },
  socket: { data() {}, error() {}, handshake(socket) { socket.setSession(socket.getSession()); /* the process aborts here */ } },
});
```

Reproduction for the second one:

```js
const tls = require("tls"), { Duplex } = require("stream");
let answered = false;
const raw = new Duplex({
  read() {},
  write(chunk, encoding, callback) {
    callback();
    if (!answered) { answered = true; setImmediate(() => this.push(Buffer.from("HTTP/1.1 400 Bad Request\r\n\r\n"))); }
  },
});
const socket = tls.connect({ socket: raw, rejectUnauthorized: false });
socket.on("secureConnect", () => console.log("secureConnect")); // main prints this
socket.on("error", error => console.log(error.code)); // node prints ERR_SSL_WRONG_VERSION_NUMBER
```

**Gaps that this PR does not close.** Each one also exists on main for
`tls.connect({ socket })`, with the same result.

| shape | node | this PR | owner |
| --- | --- | --- | --- |
| `end()` or `destroySoon()` before the socket connects | waits for
`'connect'`, then sends the FIN | `'finish'` at once, no FIN | #42339 |
| refused connection under a wrap | `'_tlsError'`, `'close'` | uncaught
`ECONNREFUSED`, the wrap stays open | #38122 |
| `end()` over a `Duplex` before the handshake completes | runs the
`final()` of the `Duplex` | `'finish'`, no `final()` | #42350 |

A wrapped `Duplex` that fails when it is read was in this list. #42235
landed, and the wrap now reports `'_tlsError'` and then `'close'`, as
node does (measured on d31efd7).

**Inherited options.** `kUpgradeClientTLS` passed a plain `{ socket,
servername }` object to `Socket.prototype.connect`, and that function
reads `rejectUnauthorized` through the prototype chain. With
`Object.prototype.rejectUnauthorized = false`, the wrap accepted an
untrusted certificate, also with an explicit `rejectUnauthorized: true`.
Commit 6657bc3 passes the decision of the constructor as an own
property, as `tls.connect()` does. Measured on this head under that
pollution: a wrap with default options, with `{}` and with an explicit
`true` rejects, and an own `false` accepts. `new TLSSocket(raw, {
rejectUnauthorized: undefined })` with `NODE_TLS_REJECT_UNAUTHORIZED=0`
rejects.

**`'finish'`.** `new TLSSocket(new PassThrough()).end()` emits
`'finish'` and `'close'` on this head. The shutdown cells do not assert
`'finish'`. A separate check reports that `'finish'` is lost there when
#43962 is applied on top of this PR. This session did not build that
combination.

Cell by cell for the 21-cell matrix of #42330 on the earlier head:
#37664 (comment)

**Releases.** Earlier comments in this thread measured the same failures
on Bun 1.4.0 and 1.4.3. This session measured main only.

**User.** `Connection.prototype._startTLS` in mysql 2.18.1
(`lib/Connection.js`) is the known caller of the client-side
constructor. The replay test matches that function line by line, and
`lib/protocol/sequences/Handshake.js` sends the SSLRequest and starts
TLS with no reply in between. The xmpp report in this thread is for
`tls.connect({ socket })`, a different path. A search of the open and
closed issues finds no report for the constructor.

**Guard design.** #42330 kept the stream as `_handle` and added a guard
at 2 of the 6 places that call it as a native handle.

**Signatures on main.** `destroy()` on the wrap fails with `handle.close
is not a function`. `end()`, `end(cb)` and `destroySoon()` throw
`socket.shutdown is not a function` from `process.nextTick`.

**Tests.** All are in `test/js/node/tls/node-tls-connect.test.ts`, block
`new tls.TLSSocket(socket) on the client side`.
- Four reports come from `node-tls-client-wrap-fixture.mjs`. Bun calls
its functions in the test process. Node runs the same file as a script.
The expected report is the same for both.
- `shutdown`: 16 cells. The methods are `end()`, `end(cb)`,
`destroySoon()` and `destroy()`. The streams are a connected, a
connecting and a never-connected `net.Socket`, and a `Duplex`. Each cell
calls the method and then `destroy()`. It asserts no throw, no `'error'`
and `'close'`. The cells run together. On main each cell fails with
`socket.shutdown is not a function` or `handle.close is not a function`.
- `mysql`: the calls of `Connection.prototype._startTLS` in mysql
2.18.1, in the driver's order and at its time. The driver writes the
SSLRequest and starts TLS in the same turn, and the server sends no
reply in between. Three configurations: `rejectUnauthorized: false`, the
CA of the server, no CA. `onSecure` runs one time in each.
  - `peerCloses`: the peer closes when the ClientHello arrives.
- `session`: the `session` option on the three paths, and `setSession()`
before the socket connects. Each one resumes.
- Both sides of `rejectUnauthorized` run in the test process only,
because node accepts in each case. `unlike node, an untrusted
certificate destroys the wrap with the verify error` has one case for
default options and one for `true`. `with rejectUnauthorized: false,
'secure' fires for an untrusted certificate and a write goes out over
TLS` is the other side. `NODE_TLS_REJECT_UNAUTHORIZED=0 turns the
default off, as for tls.connect()` pins the environment variable.
- `an inherited rejectUnauthorized cannot turn the check of a wrap off`
runs in a child process with `Object.prototype.rejectUnauthorized =
false`: default options and an own `true` reject, an own `false`
accepts. It fails on d31efd7. ``an own `rejectUnauthorized:
undefined` still rejects with NODE_TLS_REJECT_UNAUTHORIZED=0, as for
tls.connect()`` pins that rule.
- `setSession() on a wrap has no effect: it does not abort the process
and does not throw` runs in a child process, because the failure is a
process abort. Without the check it gets exit code 134. No test covers a
late `setSession()` on a `tls.connect()` socket: it aborts the process
until #41671 lands.
- On main (canary 367d939, release build), 16 of the 21 tests in the
block fail. 8 fail at once, and 8 fail by the timeout, because main
starts no handshake. The 5 that pass are the http2-wrapper guard and the
4 rows that run node.
- The SNI test fails when only the `servername` argument is reverted
(`Expected: "sni.example"`, `Received: undefined`).

**Cost for callers that never wrap a socket,** from the diff:
- per `net.Socket`: one more property store in the constructor.
- per TLS `connect()`, per client handshake and per `setSession()`: one
more property read and branch.
- per `internalConnect` and `internalConnectMultiple`: two property
reads and branches fewer. Each `[buntls]` options object has one
property fewer.
- `tls.connect({ socket })` puts the same bytes on the wire as on main
(1452).
- This session did not measure instructions, syscalls or binary size:
`perf`, `valgrind`, `strace` and `bloaty` are not in the test container.
A separate differential check of d31efd7 merged onto main reports
equal instruction counts: 10,162,756 (main) and 10,159,922 (this PR) for
each TLS connection, and 2,195 and 2,200 for `new net.Socket()`.

**Suites run with a debug build of this head.**
- On the head a460a9d: `test/js/node/tls/node-tls-connect.test.ts`
gives 107 pass, 18 skip, 0 fail with a 30 s limit, in 2 of 2 runs. With
the default 5 s limit, 4 to 8 tests reach the timeout in each run on
this machine, and the set differs from run to run. Most of them came
from main. The load average was 450 to 970 on 16 cores.
- One of those tests from main (`server write() and end(data) from
inside ALPNCallback`) takes the same time with the source of main and
with this PR: 3.9 to 6.4 s and 3.8 to 6.0 s, 10 runs each.
- `tsc --noEmit -p src/js/tsconfig.json` and `bun lint` pass on
a460a9d.
- The suites below ran on the head c81cee3, before the merge of main.
- `test/js/node/tls/` (28 files): 2 failures in each run, and this
change causes neither. `SNICallback runs even when the requested
servername matches the bind hostname` fails on the release build of main
too. `concurrent Workers all see the same CA certificate lists` fails 5
of 5 times with the `net.ts` and `tls.ts` of main on the same debug
build. In the last run the machine was overloaded, and 2 more tests
reached the 5 s timeout. Both pass alone in 3 of 3 runs, and neither
builds a client-side wrap.
- `test-tls-*`, `test-https-*`, `test-net-*`, `test-http2-*` in
`test/js/node/test/parallel` (657 files): no failure from this change.
10 files fail on main too (`test-https-proxy-request*.mjs`,
`test-https-request-proxy-post.mjs`,
`test-tls-client-allow-partial-trust-chain.js`). `test-https-timeout.js`
hangs on a debug build, with the source of main too.
- `test/js/bun/net/socket.test.ts`: 94 pass, 1 fail. The failure needs
DNS for `www.example.com` and fails on main too.

</details>

<!-- robobun:evidence:begin -->

---

**[human-review]** gate passed · iteration 0 · 5 files touched

<details><summary>fails on main (without fix)</summary>

```console
ASAN without fix: 16 failed, 18 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/pr_gate.xml" test/js/node/tls/node-tls-connect.test.ts
bun test v1.4.3 (367d939)

test/js/node/tls/node-tls-connect.test.ts:
(pass) should have checkServerIdentity [3.32ms]
(pass) should thow ECONNRESET if FIN is received before handshake [351.98ms]
(pass) initializes authorizationError to null in the TLSSocket constructor [9.71ms]
(pass) setMaxSendFragment mirrors OpenSSL's [512, 16384] acceptance without throwing [175.18ms]
(pass) should be able to grab the JSStreamSocket constructor [18.49ms]
(skip) tls.connect > should work with alpnProtocols
(pass) tls.connect > Bun.serve() should work with tls and Bun.file() [114.28ms]
(pass) tls.connect > should have peer certificate when using self asign certificate [269.78ms]
(skip) tls.connect > should have peer certificate
(skip) tls.connect > getCipher, getProtocol, getEphemeralKeyInfo, getSharedSigalgs, getSession, exportKeyingMaterial and isSessionReused should work
(skip) tls.connect > should process options correctly when connect is called with only options
(skip) tls.connect > should process port 
... (truncated)

release without fix: 34 failed, 18 skipped
bun test v1.4.3-canary.1 (367d939)

test/js/node/tls/node-tls-connect.test.ts:
(pass) should have checkServerIdentity [20.95ms]
(pass) should thow ECONNRESET if FIN is received before handshake [48.67ms]
(pass) initializes authorizationError to null in the TLSSocket constructor [0.39ms]
(pass) setMaxSendFragment mirrors OpenSSL's [512, 16384] acceptance without throwing [5.88ms]
(pass) should be able to grab the JSStreamSocket constructor [0.30ms]
(skip) tls.connect > should work with alpnProtocols
(pass) tls.connect > Bun.serve() should work with tls and Bun.file() [5.44ms]
(pass) tls.connect > should have peer certificate when using self asign certificate [24.26ms]
(skip) tls.connect > should have peer certificate
(skip) tls.connect > getCipher, getProtocol, getEphemeralKeyInfo, getSharedSigalgs, getSession, exportKeyingMaterial and isSessionReused should work
(skip) tls.connect > should process options correctly when connect is called with only options
(skip) tls.connect > should process port and host correctly
(skip) tls.connect > should process port, host, and callback correctly
(skip) tls.connect > should handle the absence of a callback gracefully
(skip) tl
... (truncated)
```

</details>

<details><summary>passes on PR (with fix)</summary>

```console
ASAN with fix: 18 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/pr_gate.xml" test/js/node/tls/node-tls-connect.test.ts
bun test v1.4.3 (367d939)

test/js/node/tls/node-tls-connect.test.ts:
(pass) should have checkServerIdentity [3.27ms]
(pass) should thow ECONNRESET if FIN is received before handshake [394.13ms]
(pass) initializes authorizationError to null in the TLSSocket constructor [8.43ms]
(pass) setMaxSendFragment mirrors OpenSSL's [512, 16384] acceptance without throwing [196.56ms]
(pass) should be able to grab the JSStreamSocket constructor [33.22ms]
(skip) tls.connect > should work with alpnProtocols
(pass) tls.connect > Bun.serve() should work with tls and Bun.file() [298.86ms]
(pass) tls.connect > should have peer certificate when using self asign certificate [101.96ms]
(skip) tls.connect > should have peer certificate
(skip) tls.connect > getCipher, getProtocol, getEphemeralKeyInfo, getSharedSigalgs, getSession, exportKeyingMaterial and isSessionReused should work
(skip) tls.connect > should process options correctly when connect is called with only options
(skip) tls.connect > should process port 
... (truncated)

release with fix: 18 skipped
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped)
  target       linux-x64-gnu
  build type   Release
  build dir    ./build/release
  revision     d31efd7
  features     lto, baseline

23 deps, 136 codegen, 1176 objects in 6018ms

ninja: Entering directory `/workspace/bun/build/release'
[1/4] fetch lolhtml
[lolhtml] up to date
[2/4] fetch rust-argon2
[rust-argon2] up to date
[2/4] cargo plan → /workspace/bun/build/release/rust-target/plan.json
244 units: 172 lib, 16 proc-macro (host), 19 custom-build (host), 15 run custom-build, 17 lib (host), 4 run custom-build (host), 1 rlib
[3/4] reconfigure
[1/1499] mkdir stamps
[2/1499] mkdir codegen
[3/1499] install /workspace/bun
bun install v1.4.3-canary.1 (367d939)

Checked 26 installs across 65 packages (no changes) [231.00ms]
[4/1499] rustc unicode_xid 
[5/1499] rustc heck 
[6/1499] rustc build_script_build 
[7/1499] rustc build_script_build 
[8/1499] rustc unicode_ident 
[9/1499] rustc build_script_build 
[10/1499] rustc build_script_build 
[11/1499] install /workspace/bun/packages/bun-error
bun install v1.4.3-canary.1 (367d939)

Checked 1 install across 2 packages (no changes
... (truncated)
```

</details>

<details><summary>diff hotspot</summary>

```
src/js/internal/net/symbols.ts                    |   2 +
 src/js/node/net.ts                                |  68 ++--
 src/js/node/tls.ts                                |  47 +--
 test/js/node/tls/node-tls-client-wrap-fixture.mjs | 387 ++++++++++++++++++++++
 test/js/node/tls/node-tls-connect.test.ts         | 356 +++++++++++++++++++-
 5 files changed, 806 insertions(+), 54 deletions(-)
```

</details>

**gate history** · 2 passed · 0 rejected · iteration 0

<details><summary>evidence per changed file</summary>

```
file                                               reads  edits  tests
src/js/internal/net/symbols.ts                         0      0     72
src/js/node/net.ts                                     8      0     73
src/js/node/tls.ts                                     1      0     74
test/js/node/tls/node-tls-client-wrap-fixture.mjs      2      3     77
test/js/node/tls/node-tls-connect.test.ts              0      0     69
```

</details>

<!-- robobun:evidence:end -->