node:net: refuse connect() where node's handle refuses it

src/js/node/net.ts

@@ -1925,6 +1925,11 @@ function kConnectDispatch(self, req, opts) {
   req.dispatching = true;
   const promise = doConnect(self._handle, opts);
   req.dispatching = false;
+  // A handle that refuses the connect dials nothing: doConnect returns the errno.
+  if (typeof promise === "number") {
+    traceConnectEnd(req);
+    return promise;
+  }
   promise.catch(_reason => {
     // eat this so there's no unhandledRejection
     // we already catch this in connectError and error
@@ -2310,15 +2315,21 @@ Socket.prototype.connect = function connect(...args) {
       connection = socket;
     }
     if (fd != null) {
-      doConnect(this._handle, {
+      const opened = doConnect(this._handle, {
         data: this,
         fd: fd,
         ...(options.fdIsRawSocket === true ? { fdIsRawSocket: true } : {}),
         socket: SocketHandlers,
         // Always half-open natively; see kConnect.
         allowHalfOpen: true,
         pauseOnConnect,
-      }).catch(error => {
+      });
+      // libuv opens an fd only on a handle that has none.
+      if (typeof opened === "number") {
+        this.destroy(new ErrnoException(opened, "open"));
+        return this;
+      }
+      opened.catch(error => {
         if (!this.destroyed) {
           this.emit("error", error);
           this.emit("close", true);
@@ -3359,6 +3370,8 @@ function internalConnect(self, options, address, port?, addressType?, localAddre
       addressType,
     );
 
+    // A handle that still owns a socket is bound already: libuv reports the EINVAL of its bind(2).
+    if (ownsSocket(self._handle)) err = uv().UV_EINVAL;
     err = checkBindError(err, localPort, self._handle);
     if (err) {
       const ex = new ExceptionWithHostPort(err, "bind", localAddress, localPort);
@@ -3413,11 +3426,22 @@ function internalConnect(self, options, address, port?, addressType?, localAddre
   }
 
   if (err) {
-    const ex = new ExceptionWithHostPort(err, "connect", address, port);
+    const ex = new ExceptionWithHostPort(err, "connect", address, port, boundAddress(self._handle));
     self.destroy(ex);
   }
 }
 
+// Whether a native handle owns a socket: one that is connecting, connected, or not closed yet.
+function ownsSocket(handle) {
+  return handle != null && handle.readyState !== -1;
+}
+
+// The "- Local (ip:port)" detail: https://github.com/nodejs/node/blob/v26.3.0/lib/net.js#L1161-L1170
+function boundAddress(handle) {
+  const address = handle?.localAddress;
+  if (address) return address + ":" + handle.localPort;
+}
+
 function internalConnectMultiple(context, canceled?) {
   clearTimeout(context[kTimeout]);
   const self = context.socket;
@@ -3443,6 +3467,11 @@ function internalConnectMultiple(context, canceled?) {
   const current = context.current++;
 
   if (current > 0) {
+    // Node closes this socket with no event and dials on: https://github.com/nodejs/node/blob/v26.3.0/lib/net.js#L1201-L1203
+    if (ownsSocket(self._handle)) {
+      self.destroy(context.errors[context.errors.length - 1]);
+      return;
+    }
     self[kReinitializeHandle](newDetachedSocket(typeof self[bunTlsSymbol] === "function"));
   }
 
@@ -3470,6 +3499,8 @@ function internalConnectMultiple(context, canceled?) {
       addressType,
     );
 
+    // As in internalConnect.
+    if (ownsSocket(self._handle)) err = uv().UV_EINVAL;
     err = checkBindError(err, localPort, self._handle);
     if (err) {
       ArrayPrototypePush.$call(context.errors, new ExceptionWithHostPort(err, "bind", localAddress, localPort));
@@ -3508,7 +3539,7 @@ function internalConnectMultiple(context, canceled?) {
   err = kConnectTcp(self, addressType, req, address, port);
 
   if (err) {
-    const ex = new ExceptionWithHostPort(err, "connect", address, port);
+    const ex = new ExceptionWithHostPort(err, "connect", address, port, boundAddress(self._handle));
     ArrayPrototypePush.$call(context.errors, ex);
 
     self.emit("connectionAttemptFailed", address, port, addressType, ex);

src/runtime/socket/Listener.rs

@@ -1211,6 +1211,22 @@ impl Listener {
             Some((local_addr_bytes.to_vec().into_boxed_slice(), local_port))
         };
 
+        // Past the last option getter: script cannot give the handle a socket after this check.
+        let refusal = match (prev_maybe_tcp, prev_maybe_tls) {
+            // SAFETY: the caller passes a live socket, owned by its JS wrapper.
+            (Some(prev), _) => unsafe { &*prev }.connect_refusal(&connection),
+            // SAFETY: as above.
+            (_, Some(prev)) => unsafe { &*prev }.connect_refusal(&connection),
+            _ => None,
+        };
+        if let Some(errno) = refusal {
+            #[cfg(windows)]
+            let uv_errno = uv::e_discriminant_to_uv(errno as u16).unwrap_or(uv::UV_EISCONN);
+            #[cfg(not(windows))]
+            let uv_errno = -(errno as c_int);
+            return Ok(JSValue::js_number_from_int32(uv_errno));
+        }
+
         #[cfg(windows)]
         let mut connection = connection;
         #[cfg(windows)]

src/runtime/socket/socket_body.rs

@@ -1388,6 +1388,53 @@ impl<const SSL: bool> NewSocket<SSL> {
         socket.close(code);
     }
 
+    /// The errno that node's handle answers to this `connect()` while it owns a socket. `None`: dial.
+    pub(crate) fn connect_refusal(
+        &self,
+        connection: &super::listener::UnixOrHost,
+    ) -> Option<sys::SystemErrno> {
+        use super::listener::UnixOrHost;
+        use sys::SystemErrno as E;
+        let socket = self.socket.get();
+        if socket.is_detached() {
+            return None;
+        }
+        // libuv opens an fd only on a handle that has none.
+        if matches!(connection, UnixOrHost::Fd(_)) {
+            return Some(E::EBUSY);
+        }
+        let is_tcp = matches!(
+            socket.local_address(&mut [0u8; 64]).map(<[u8]>::len),
+            Some(4 | 16)
+        );
+        if !is_tcp {
+            // A pipe handle reports what connect(2) says for the new path: EISCONN when it is a socket.
+            return Some(E::EISCONN);
+        }
+        // Node parses the path as an IPv4 address first: https://github.com/nodejs/node/blob/v26.3.0/src/tcp_wrap.cc#L433-L465
+        if let UnixOrHost::Unix(path) = connection {
+            if !matches!(
+                bun_core::ip_address::parse_uv_inet_pton(path),
+                Some(core::net::IpAddr::V4(_))
+            ) {
+                return Some(E::EINVAL);
+            }
+        }
+        if !socket.is_established() {
+            // One connect per handle (ConnectEx says EISCONN): https://github.com/nodejs/node/blob/v26.3.0/deps/uv/src/unix/tcp.c#L288-L289
+            return Some(if cfg!(windows) {
+                E::EISCONN
+            } else {
+                E::EALREADY
+            });
+        }
+        // Linux answers 0 once for a client socket that has not sent its FIN: `connect_finish` swaps it, as before.
+        if !self.is_server() && !socket.is_shutdown() {
+            return None;
+        }
+        Some(E::EISCONN)
+    }
+
     /// Discard a still-live native socket so this wrapper can be reused for a
     /// fresh connect. `node:net` permits `socket.connect()` on an
     /// already-connected socket; without this the previous `us_socket_t`'s

test/js/node/net/node-net.test.ts

@@ -516,7 +516,7 @@ describe("net.Socket write", () => {
     }),
   );
 
-  it("should allow reconnecting after end()", async () => {
+  it("should allow reconnecting after end(), once the socket emitted 'close'", async () => {
     const server = new Server(socket => socket.end());
     const port = await new Promise<number>(resolve => {
       server.once("listening", () => resolve((server.address() as import("node:net").AddressInfo).port));
@@ -532,7 +532,9 @@ describe("net.Socket write", () => {
         socket.once("connect", (...args) => {
           socket.write("script\n", err => {
             if (err) return reject(err);
-            socket.end(() => setTimeout(resolve, 3));
+            // The handle owns its socket until then: a connect() before it is EISCONN.
+            socket.once("close", resolve);
+            socket.end();
           });
         });
         socket.connect(port, "127.0.0.1");