fix(node:https): wrap injected raw connections with TLS

src/js/node/_http_server.ts

@@ -15,9 +15,11 @@ const {
   validateLinkHeaderValue,
   validateBoolean,
   validateInteger,
+  validateNumber,
   validateFunction,
   validateOneOf,
 } = require("internal/validators");
+const { kArmHandshakeTimeout } = require("internal/net/symbols");
 const {
   ConnResetException,
   ErrnoException,
@@ -281,10 +283,9 @@ function normalizeServerTls(tls) {
 
 // Node registers connectionListener on every http.Server so `server.emit("connection", socket)`
 // works for foreign Duplex sockets. The native listener handles its own sockets end to end;
-// this picks up the rest. https://github.com/nodejs/node/blob/main/lib/_http_server.js
-function connectionListener(this: Server, socket) {
-  // A tunnel socket that was handed to 'connect'/'upgrade' has left the native listener: re-emitted, it is a connection like any other.
-  if (NodeHTTPServerSocket && socket instanceof NodeHTTPServerSocket && !socket[kHandedOff]) return;
+// an HTTPS server must TLS-wrap the others before handing them to the HTTP parser.
+// https://github.com/nodejs/node/blob/main/lib/_http_server.js
+function connectionListenerHTTP1(this: Server, socket) {
   (http1Fallback ??= require("internal/http1_server_fallback")).connectionListenerHTTP1(this, socket, {
     http1Options: {
       IncomingMessage: this[kIncomingMessage],
@@ -302,6 +303,62 @@ interface Server extends NodeHTTPServer {
   httpAllowHalfOpen: boolean;
   blockList?: import("node:net").BlockList;
 }
+function tlsVersionName(version) {
+  switch (version) {
+    case 0x0301:
+      return "TLSv1";
+    case 0x0302:
+      return "TLSv1.1";
+    case 0x0303:
+      return "TLSv1.2";
+    case 0x0304:
+      return "TLSv1.3";
+    default:
+      return undefined;
+  }
+}
+
+function connectionListener(this: Server, socket) {
+  if (NodeHTTPServerSocket && socket instanceof NodeHTTPServerSocket && !socket[kHandedOff]) return;
+  const tlsOptions = this[tlsSymbol];
+  if (!tlsOptions) {
+    connectionListenerHTTP1.$call(this, socket);
+    return;
+  }
+
+  let wrapped;
+  try {
+    const { TLSSocket } = require("node:tls");
+    wrapped = new TLSSocket(socket, {
+      ...tlsOptions,
+      isServer: true,
+      servername: tlsOptions.serverName,
+      minVersion: tlsVersionName(tlsOptions.minVersion),
+      maxVersion: tlsVersionName(tlsOptions.maxVersion),
+      ALPNProtocols: this.ALPNProtocols,
+      ALPNCallback: this.ALPNCallback,
+      SNICallback: this._SNICallback,
+    });
+  } catch (err) {
+    socket.destroy();
+    this.emit("error", err);
+    return;
+  }
+  wrapped.server = this;
+  wrapped._requestCert = tlsOptions.requestCert;
+  wrapped._rejectUnauthorized = tlsOptions.rejectUnauthorized;
+  require("node:net").Server.prototype[kArmHandshakeTimeout].$call(this, wrapped);
+}
+
+function secureConnectionListener(this: Server, socket) {
+  if (NodeHTTPServerSocket && socket instanceof NodeHTTPServerSocket && !socket[kHandedOff]) return;
+  connectionListenerHTTP1.$call(this, socket);
+}
+
+function tlsClientErrorListener(this: Server, err, socket) {
+  if (!this.emit("clientError", err, socket)) socket.destroy(err);
+}
+
 function Server(options, callback): void {
   if (!(this instanceof Server)) return new Server(options, callback);
   EventEmitter.$call(this);
@@ -426,6 +483,7 @@ function Server(options, callback): void {
         sessionTimeout: sessionTimeout ?? 0,
         sigalgs: options.sigalgs,
         ecdhCurve: options.ecdhCurve ?? require("node:tls").DEFAULT_ECDH_CURVE,
+        allowPartialTrustChain: tlsOptions.allowPartialTrustChain,
         passphrase,
         secureOptions,
         minVersion,
@@ -434,12 +492,22 @@ function Server(options, callback): void {
         requestCert: options.requestCert,
         rejectUnauthorized: options.rejectUnauthorized,
       });
+      this._SNICallback = options.SNICallback;
+      this._ALPNCallback = options.ALPNCallback;
+      const handshakeTimeout = options.handshakeTimeout || 120 * 1000;
+      validateNumber(handshakeTimeout, "options.handshakeTimeout");
+      this._handshakeTimeout = handshakeTimeout;
     }
   }
 
   this[optionsSymbol] = options;
   storeHTTPOptions.$call(this, options);
 
+  if (this[tlsSymbol]) {
+    this.on("secureConnection", secureConnectionListener);
+    this.on("tlsClientError", tlsClientErrorListener);
+  }
+
   if (callback) this.on("request", callback);
   return this;
 }
@@ -1676,6 +1744,7 @@ function getNodeHTTPServerSocket() {
     [kDestroySoon] = false;
     [kHandedOff] = false;
     server: Server;
+    #listenerServer: Server | undefined;
     _httpMessage;
     _secureEstablished = false;
     // Node's connectionListener sets socket._paused when it stops reading a
@@ -1711,6 +1780,7 @@ function getNodeHTTPServerSocket() {
       this._readableState.emitClose = true;
       this._writableState.decodeStrings = true;
       this.server = server;
+      this.#listenerServer = server;
       this.#resetSupported = !encrypted && !listenerGeneration?.isUnix;
       this[kHandle] = handle;
       this._secureEstablished = !!handle?.secureEstablished;
@@ -1860,7 +1930,9 @@ function getNodeHTTPServerSocket() {
           this.#closeError = er.code === closeError.code ? er : closeError;
         }
       }
-      const server = this.server;
+      // Re-emitting a handed-off socket changes its public server, not its native listener owner.
+      const server = this.#listenerServer;
+      this.#listenerServer = undefined;
       const tracked = server?.[kTrackedConnections];
       if (tracked) {
         tracked.delete(this);

test/js/bun/http/node-https-server.test.ts

@@ -0,0 +1,8 @@
+import { test } from "bun:test";
+import { tls } from "harness";
+import https from "node:https";
+
+test.each([-1, 0, 1])("node:https accepts handshakeTimeout %d", handshakeTimeout => {
+  const server = https.createServer({ ...tls, handshakeTimeout });
+  server.close();
+});

test/js/node/http/node-http.test.ts

@@ -5428,6 +5428,142 @@ it("connectionListener hands off Upgrade and CONNECT like Node", async () => {
   }
 });
 
+it.each([
+  ["default", {}, "http/1.1"],
+  ["ALPNProtocols", { ALPNProtocols: ["http/1.1"] }, "http/1.1"],
+  ["ALPNCallback", { ALPNCallback: () => "http/1.1" }, "http/1.1"],
+])("https wraps a raw socket injected through the connection event (%s)", async (_name, options, protocol) => {
+  const server = createHttpsServer({ ...tlsCert, ...options }, (req, res) => {
+    expect((req.socket as any).encrypted).toBe(true);
+    expect((req.socket as any).alpnProtocol).toBe(protocol);
+    res.writeHead(200, { Connection: "close" });
+    res.end("injected-ok");
+  });
+  const rawClosed = Promise.withResolvers<void>();
+  const front = createNetServer(socket => {
+    socket.once("close", () => rawClosed.resolve());
+    server.emit("connection", socket);
+  });
+
+  try {
+    await once(front.listen(0, "127.0.0.1"), "listening");
+    const response = await new Promise<{ statusCode: number | undefined; body: string }>((resolve, reject) => {
+      const request = https.get(
+        {
+          host: "127.0.0.1",
+          port: (front.address() as AddressInfo).port,
+          rejectUnauthorized: false,
+          agent: false,
+          ALPNProtocols: ["http/1.1"],
+        },
+        response => {
+          const chunks: Buffer[] = [];
+          response.on("data", chunk => chunks.push(chunk));
+          response.on("end", () =>
+            resolve({ statusCode: response.statusCode, body: Buffer.concat(chunks).toString("utf8") }),
+          );
+        },
+      );
+      request.on("error", reject);
+    });
+
+    expect(response).toEqual({ statusCode: 200, body: "injected-ok" });
+    await rawClosed.promise;
+  } finally {
+    front.close();
+  }
+});
+
+it("https wraps a handed-off native CONNECT tunnel", async () => {
+  const server = createHttpsServer(tlsCert, (req, res) => {
+    res.writeHead(200, { Connection: "close" });
+    res.end(req.socket.encrypted ? "tunnel-ok" : "plaintext");
+  });
+  const frontClosed = Promise.withResolvers<void>();
+  const front = createServer();
+  front.on("connect", (_req, socket) => {
+    socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    server.emit("connection", socket);
+    front.close(err => (err ? frontClosed.reject(err) : frontClosed.resolve()));
+  });
+  let client;
+  try {
+    await once(front.listen(0, "127.0.0.1"), "listening");
+    const result = await new Promise<string>((resolve, reject) => {
+      const tunnel = http.request({
+        host: "127.0.0.1",
+        port: (front.address() as AddressInfo).port,
+        method: "CONNECT",
+        path: "localhost:443",
+      });
+      tunnel.on("error", reject);
+      tunnel.on("connect", (_response, socket) => {
+        client = tlsConnect({ socket, rejectUnauthorized: false }, () => {
+          client.write("GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n");
+        });
+        const chunks: Buffer[] = [];
+        client.on("error", reject);
+        client.on("data", chunk => chunks.push(chunk));
+        client.on("end", () => resolve(Buffer.concat(chunks).toString()));
+      });
+      tunnel.end();
+    });
+    expect(result).toContain("HTTP/1.1 200 OK");
+    expect(result).toContain("tunnel-ok");
+    await frontClosed.promise;
+  } finally {
+    client?.destroy();
+    front.closeAllConnections();
+    if (front.listening) front.close();
+  }
+});
+
+async function withStalledInjectedHttpsConnection<T>(observe: (server: https.Server) => Promise<T>) {
+  const server = createHttpsServer({ ...tlsCert, handshakeTimeout: 50 });
+  const rawClosed = Promise.withResolvers<void>();
+  const front = createNetServer(socket => {
+    socket.once("close", () => rawClosed.resolve());
+    server.emit("connection", socket);
+  });
+  let client;
+
+  try {
+    const observed = observe(server);
+    await once(front.listen(0, "127.0.0.1"), "listening");
+    client = connect((front.address() as AddressInfo).port, "127.0.0.1");
+    client.on("error", () => {});
+    const result = await observed;
+    await rawClosed.promise;
+    return result;
+  } finally {
+    client?.destroy();
+    front.close();
+  }
+}
+
+it("https routes an injected socket handshake timeout through clientError", async () => {
+  const result = await withStalledInjectedHttpsConnection(server => {
+    const clientError = Promise.withResolvers<{ code: string | undefined; destroyed: boolean }>();
+    server.on("clientError", (err: Error & { code?: string }, socket) => {
+      clientError.resolve({ code: err.code, destroyed: socket.destroyed });
+      socket.destroy();
+    });
+    return clientError.promise;
+  });
+  expect(result).toEqual({ code: "ERR_TLS_HANDSHAKE_TIMEOUT", destroyed: false });
+});
+
+it("https destroys an injected socket after an unhandled handshake timeout", async () => {
+  const result = await withStalledInjectedHttpsConnection(server => {
+    const tlsClientError = Promise.withResolvers<{ code: string | undefined; destroyed: boolean }>();
+    server.on("tlsClientError", (err: Error & { code?: string }, socket) => {
+      tlsClientError.resolve({ code: err.code, destroyed: socket.destroyed });
+    });
+    return tlsClientError.promise;
+  });
+  expect(result).toEqual({ code: "ERR_TLS_HANDSHAKE_TIMEOUT", destroyed: true });
+});
+
 // A TLS client that is mid-handshake when an https server with a 'clientError' listener is closed still
 // belongs to that server: once its handshake completes, a malformed request from it reaches 'clientError'
 // (as in Node). The connection used to go uncounted until the handshake finished, so close() considered the