From a05f72f9ca48986841e503e59fd7d3d10d3db343 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Thu, 20 Jul 2023 15:20:44 +0200
Subject: [PATCH 01/10] test: delete test-net-bytes-per-incoming-chunk-overhead

The test's assumptions about RSS are no longer valid, at least with
Fedora 38.

Closes: https://github.com/nodejs/node/issues/48490
PR-URL: https://github.com/nodejs/node/pull/48811
Fixes: https://github.com/nodejs/node/issues/48490
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
---
 ...t-net-bytes-per-incoming-chunk-overhead.js | 50 -------------------
 1 file changed, 50 deletions(-)
 delete mode 100644 test/pummel/test-net-bytes-per-incoming-chunk-overhead.js

diff --git a/test/pummel/test-net-bytes-per-incoming-chunk-overhead.js b/test/pummel/test-net-bytes-per-incoming-chunk-overhead.js
deleted file mode 100644
index b3613110ab5c54..00000000000000
--- a/test/pummel/test-net-bytes-per-incoming-chunk-overhead.js
+++ /dev/null
@@ -1,50 +0,0 @@
-// Flags: --expose-gc
-'use strict';
-
-const common = require('../common');
-
-if (process.config.variables.asan) {
-  common.skip('ASAN messes with memory measurements');
-}
-
-if (common.isPi) {
-  common.skip('Too slow for Raspberry Pi devices');
-}
-
-const assert = require('assert');
-const net = require('net');
-
-// Tests that, when receiving small chunks, we do not keep the full length
-// of the original allocation for the libuv read call in memory.
-
-let client;
-let baseRSS;
-const receivedChunks = [];
-const N = 250000;
-
-const server = net.createServer(common.mustCall((socket) => {
-  baseRSS = process.memoryUsage.rss();
-
-  socket.setNoDelay(true);
-  socket.on('data', (chunk) => {
-    receivedChunks.push(chunk);
-    if (receivedChunks.length < N) {
-      client.write('a');
-    } else {
-      client.end();
-      server.close();
-    }
-  });
-})).listen(0, common.mustCall(() => {
-  client = net.connect(server.address().port);
-  client.setNoDelay(true);
-  client.write('hello!');
-}));
-
-process.on('exit', () => {
-  global.gc();
-  const bytesPerChunk =
-    (process.memoryUsage.rss() - baseRSS) / receivedChunks.length;
-  // We should always have less than one page (usually ~ 4 kB) per chunk.
-  assert(bytesPerChunk < 650, `measured ${bytesPerChunk} bytes per chunk`);
-});

From 00cb23af1e9e4d12b475aab619d9c9871235a22f Mon Sep 17 00:00:00 2001
From: Paolo Insogna <paolo@cowtech.it>
Date: Sat, 24 Dec 2022 15:44:11 +0100
Subject: [PATCH 02/10] net: add autoSelectFamily global getter and setter

PR-URL: https://github.com/nodejs/node/pull/45777
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 doc/api/cli.md                                |  10 ++
 doc/api/net.md                                |  46 +++++-
 lib/net.js                                    |  31 +++-
 src/node_options.cc                           |   4 +
 src/node_options.h                            |   1 +
 ...balls.js => test-http-autoselectfamily.js} |   0
 ...alls.js => test-https-autoselectfamily.js} |   0
 ...net-autoselectfamily-commandline-option.js | 108 ++++++++++++++
 ...=> test-net-autoselectfamily-ipv4first.js} |   0
 ...eballs.js => test-net-autoselectfamily.js} |  15 +-
 .../test-net-autoselectfamilydefault.js       | 140 ++++++++++++++++++
 ...socket-connect-invalid-autoselectfamily.js |   9 ++
 12 files changed, 355 insertions(+), 9 deletions(-)
 rename test/parallel/{test-http-happy-eyeballs.js => test-http-autoselectfamily.js} (100%)
 rename test/parallel/{test-https-happy-eyeballs.js => test-https-autoselectfamily.js} (100%)
 create mode 100644 test/parallel/test-net-autoselectfamily-commandline-option.js
 rename test/parallel/{test-net-happy-eyeballs-ipv4first.js => test-net-autoselectfamily-ipv4first.js} (100%)
 rename test/parallel/{test-net-happy-eyeballs.js => test-net-autoselectfamily.js} (91%)
 create mode 100644 test/parallel/test-net-autoselectfamilydefault.js
 create mode 100644 test/parallel/test-net-socket-connect-invalid-autoselectfamily.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 83c76711d01ffc..a60ef3929c6feb 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -314,6 +314,15 @@ added: v6.0.0
 Enable FIPS-compliant crypto at startup. (Requires Node.js to be built
 against FIPS-compatible OpenSSL.)
 
+### `--enable-network-family-autoselection`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Enables the family autoselection algorithm unless connection options explicitly
+disables it.
+
 ### `--enable-source-maps`
 
 <!-- YAML
@@ -1861,6 +1870,7 @@ Node.js options that are allowed are:
 * `--disable-proto`
 * `--dns-result-order`
 * `--enable-fips`
+* `--enable-network-family-autoselection`
 * `--enable-source-maps`
 * `--experimental-abortcontroller`
 * `--experimental-global-customevent`
diff --git a/doc/api/net.md b/doc/api/net.md
index 64f3759ec031d3..91766ad8e0f2d2 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -778,6 +778,20 @@ Returns the bound `address`, the address `family` name and `port` of the
 socket as reported by the operating system:
 `{ port: 12346, family: 'IPv4', address: '127.0.0.1' }`
 
+### `socket.autoSelectFamilyAttemptedAddresses`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {string\[]}
+
+This property is only present if the family autoselection algorithm is enabled in
+[`socket.connect(options)`][] and it is an array of the addresses that have been attempted.
+
+Each address is a string in the form of `$IP:$PORT`. If the connection was successful,
+then the last address is the one that the socket is currently connected to.
+
 ### `socket.bufferSize`
 
 <!-- YAML
@@ -854,6 +868,11 @@ behavior.
 <!-- YAML
 added: v0.1.90
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/45777
+    description: The default value for autoSelectFamily option can be changed
+                 at runtime using `setDefaultAutoSelectFamily` or via the
+                 command line option `--enable-network-family-autoselection`.
   - version: v18.13.0
     pr-url: https://github.com/nodejs/node/pull/44731
     description: Added the `autoSelectFamily` option.
@@ -905,12 +924,14 @@ For TCP connections, available `options` are:
   that loosely implements section 5 of [RFC 8305][].
   The `all` option passed to lookup is set to `true` and the sockets attempts to connect to all
   obtained IPv6 and IPv4 addresses, in sequence, until a connection is established.
-  The first returned AAAA address is tried first, then the first returned A address and so on.
+  The first returned AAAA address is tried first, then the first returned A address,
+  then the second returned AAAA address and so on.
   Each connection attempt is given the amount of time specified by the `autoSelectFamilyAttemptTimeout`
   option before timing out and trying the next address.
   Ignored if the `family` option is not `0` or if `localAddress` is set.
   Connection errors are not emitted if at least one connection succeeds.
-  **Default:** `false`.
+  **Default:** initially `false`, but it can be changed at runtime using [`net.setDefaultAutoSelectFamily(value)`][]
+  or via the command line option `--enable-network-family-autoselection`.
 * `autoSelectFamilyAttemptTimeout` {number}: The amount of time in milliseconds to wait
   for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option.
   If set to a positive integer less than `10`, then the value `10` will be used instead.
@@ -1499,6 +1520,26 @@ immediately initiates connection with
 [`socket.connect(port[, host][, connectListener])`][`socket.connect(port)`],
 then returns the `net.Socket` that starts the connection.
 
+## `net.setDefaultAutoSelectFamily(value)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Sets the default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
+
+* `value` {boolean} The new default value. The initial default value is `false`.
+
+## `net.getDefaultAutoSelectFamily()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Gets the current default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
+
+* Returns: {boolean} The current default value of the `autoSelectFamily` option.
+
 ## `net.createServer([options][, connectionListener])`
 
 <!-- YAML
@@ -1683,6 +1724,7 @@ net.isIPv6('fhqwhgads'); // returns false
 [`net.createConnection(path)`]: #netcreateconnectionpath-connectlistener
 [`net.createConnection(port, host)`]: #netcreateconnectionport-host-connectlistener
 [`net.createServer()`]: #netcreateserveroptions-connectionlistener
+[`net.setDefaultAutoSelectFamily(value)`]: #netsetdefaultautoselectfamilyvalue
 [`new net.Socket(options)`]: #new-netsocketoptions
 [`readable.setEncoding()`]: stream.md#readablesetencodingencoding
 [`server.close()`]: #serverclosecallback
diff --git a/lib/net.js b/lib/net.js
index 9686738845821c..a72e48c96a6db4 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -124,12 +124,14 @@ const {
   DTRACE_NET_SERVER_CONNECTION,
   DTRACE_NET_STREAM_END,
 } = require('internal/dtrace');
+const { getOptionValue } = require('internal/options');
 
 // Lazy loaded to improve startup performance.
 let cluster;
 let dns;
 let BlockList;
 let SocketAddress;
+let autoSelectFamilyDefault = getOptionValue('--enable-network-family-autoselection');
 
 const { clearTimeout, setTimeout } = require('timers');
 const { kTimeout } = require('internal/timers');
@@ -244,6 +246,14 @@ function connect(...args) {
   return socket.connect(normalized);
 }
 
+function getDefaultAutoSelectFamily() {
+  return autoSelectFamilyDefault;
+}
+
+function setDefaultAutoSelectFamily(value) {
+  validateBoolean(value, 'value');
+  autoSelectFamilyDefault = value;
+}
 
 // Returns an array [options, cb], where options is an object,
 // cb is either a function or null.
@@ -1116,6 +1126,8 @@ function internalConnectMultiple(context) {
   req.localAddress = localAddress;
   req.localPort = localPort;
 
+  ArrayPrototypePush(self.autoSelectFamilyAttemptedAddresses, `${address}:${port}`);
+
   if (addressType === 4) {
     err = handle.connect(req, address, port);
   } else {
@@ -1208,9 +1220,9 @@ function socketToDnsFamily(family) {
 }
 
 function lookupAndConnect(self, options) {
-  const { localAddress, localPort, autoSelectFamily } = options;
+  const { localAddress, localPort } = options;
   const host = options.host || 'localhost';
-  let { port, autoSelectFamilyAttemptTimeout } = options;
+  let { port, autoSelectFamilyAttemptTimeout, autoSelectFamily } = options;
 
   if (localAddress && !isIP(localAddress)) {
     throw new ERR_INVALID_IP_ADDRESS(localAddress);
@@ -1229,11 +1241,14 @@ function lookupAndConnect(self, options) {
   }
   port |= 0;
 
-  if (autoSelectFamily !== undefined) {
-    validateBoolean(autoSelectFamily);
+
+  if (autoSelectFamily != null) {
+    validateBoolean(autoSelectFamily, 'options.autoSelectFamily');
+  } else {
+    autoSelectFamily = autoSelectFamilyDefault;
   }
 
-  if (autoSelectFamilyAttemptTimeout !== undefined) {
+  if (autoSelectFamilyAttemptTimeout != null) {
     validateInt32(autoSelectFamilyAttemptTimeout, 'options.autoSelectFamilyAttemptTimeout', 1);
 
     if (autoSelectFamilyAttemptTimeout < 10) {
@@ -1257,7 +1272,7 @@ function lookupAndConnect(self, options) {
     return;
   }
 
-  if (options.lookup !== undefined)
+  if (options.lookup != null)
     validateFunction(options.lookup, 'options.lookup');
 
   if (dns === undefined) dns = require('dns');
@@ -1394,6 +1409,8 @@ function lookupAndConnectMultiple(self, async_id_symbol, lookup, host, options,
         }
       }
 
+      self.autoSelectFamilyAttemptedAddresses = [];
+
       const context = {
         socket: self,
         addresses,
@@ -2262,4 +2279,6 @@ module.exports = {
   Server,
   Socket,
   Stream: Socket, // Legacy naming
+  getDefaultAutoSelectFamily,
+  setDefaultAutoSelectFamily,
 };
diff --git a/src/node_options.cc b/src/node_options.cc
index 47a24ef5e59f04..3c64cb15fd1742 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -359,6 +359,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "returned)",
             &EnvironmentOptions::dns_result_order,
             kAllowedInEnvvar);
+  AddOption("--enable-network-family-autoselection",
+            "Enable network address family autodetection algorithm",
+            &EnvironmentOptions::enable_network_family_autoselection,
+            kAllowedInEnvvar);
   AddOption("--enable-source-maps",
             "Source Map V3 support for stack traces",
             &EnvironmentOptions::enable_source_maps,
diff --git a/src/node_options.h b/src/node_options.h
index c57e7a93b13a85..6910e812ae53f5 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -128,6 +128,7 @@ class EnvironmentOptions : public Options {
   bool frozen_intrinsics = false;
   int64_t heap_snapshot_near_heap_limit = 0;
   std::string heap_snapshot_signal;
+  bool enable_network_family_autoselection = false;
   uint64_t max_http_header_size = 16 * 1024;
   bool deprecation = true;
   bool force_async_hooks_checks = true;
diff --git a/test/parallel/test-http-happy-eyeballs.js b/test/parallel/test-http-autoselectfamily.js
similarity index 100%
rename from test/parallel/test-http-happy-eyeballs.js
rename to test/parallel/test-http-autoselectfamily.js
diff --git a/test/parallel/test-https-happy-eyeballs.js b/test/parallel/test-https-autoselectfamily.js
similarity index 100%
rename from test/parallel/test-https-happy-eyeballs.js
rename to test/parallel/test-https-autoselectfamily.js
diff --git a/test/parallel/test-net-autoselectfamily-commandline-option.js b/test/parallel/test-net-autoselectfamily-commandline-option.js
new file mode 100644
index 00000000000000..78c8a81b0ef126
--- /dev/null
+++ b/test/parallel/test-net-autoselectfamily-commandline-option.js
@@ -0,0 +1,108 @@
+'use strict';
+
+// Flags: --enable-network-family-autoselection
+
+const common = require('../common');
+const { parseDNSPacket, writeDNSPacket } = require('../common/dns');
+
+const assert = require('assert');
+const dgram = require('dgram');
+const { Resolver } = require('dns');
+const { createConnection, createServer } = require('net');
+
+// Test that happy eyeballs algorithm can be enable from command line.
+
+let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
+if (common.isWindows) {
+  // Some of the windows machines in the CI need more time to establish connection
+  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
+}
+
+function _lookup(resolver, hostname, options, cb) {
+  resolver.resolve(hostname, 'ANY', (err, replies) => {
+    assert.notStrictEqual(options.family, 4);
+
+    if (err) {
+      return cb(err);
+    }
+
+    const hosts = replies
+      .map((r) => ({ address: r.address, family: r.type === 'AAAA' ? 6 : 4 }))
+      .sort((a, b) => b.family - a.family);
+
+    if (options.all === true) {
+      return cb(null, hosts);
+    }
+
+    return cb(null, hosts[0].address, hosts[0].family);
+  });
+}
+
+function createDnsServer(ipv6Addr, ipv4Addr, cb) {
+  // Create a DNS server which replies with a AAAA and a A record for the same host
+  const socket = dgram.createSocket('udp4');
+
+  socket.on('message', common.mustCall((msg, { address, port }) => {
+    const parsed = parseDNSPacket(msg);
+    const domain = parsed.questions[0].domain;
+    assert.strictEqual(domain, 'example.org');
+
+    socket.send(writeDNSPacket({
+      id: parsed.id,
+      questions: parsed.questions,
+      answers: [
+        { type: 'AAAA', address: ipv6Addr, ttl: 123, domain: 'example.org' },
+        { type: 'A', address: ipv4Addr, ttl: 123, domain: 'example.org' },
+      ]
+    }), port, address);
+  }));
+
+  socket.bind(0, () => {
+    const resolver = new Resolver();
+    resolver.setServers([`127.0.0.1:${socket.address().port}`]);
+
+    cb({ dnsServer: socket, lookup: _lookup.bind(null, resolver) });
+  });
+}
+
+// Test that IPV4 is reached if IPV6 is not reachable
+{
+  createDnsServer('::1', '127.0.0.1', common.mustCall(function({ dnsServer, lookup }) {
+    const ipv4Server = createServer((socket) => {
+      socket.on('data', common.mustCall(() => {
+        socket.write('response-ipv4');
+        socket.end();
+      }));
+    });
+
+    ipv4Server.listen(0, '127.0.0.1', common.mustCall(() => {
+      const port = ipv4Server.address().port;
+
+      const connection = createConnection({
+        host: 'example.org',
+        port: port,
+        lookup,
+        autoSelectFamilyAttemptTimeout,
+      });
+
+      let response = '';
+      connection.setEncoding('utf-8');
+
+      connection.on('ready', common.mustCall(() => {
+        assert.deepStrictEqual(connection.autoSelectFamilyAttemptedAddresses, [`::1:${port}`, `127.0.0.1:${port}`]);
+      }));
+
+      connection.on('data', (chunk) => {
+        response += chunk;
+      });
+
+      connection.on('end', common.mustCall(() => {
+        assert.strictEqual(response, 'response-ipv4');
+        ipv4Server.close();
+        dnsServer.close();
+      }));
+
+      connection.write('request');
+    }));
+  }));
+}
diff --git a/test/parallel/test-net-happy-eyeballs-ipv4first.js b/test/parallel/test-net-autoselectfamily-ipv4first.js
similarity index 100%
rename from test/parallel/test-net-happy-eyeballs-ipv4first.js
rename to test/parallel/test-net-autoselectfamily-ipv4first.js
diff --git a/test/parallel/test-net-happy-eyeballs.js b/test/parallel/test-net-autoselectfamily.js
similarity index 91%
rename from test/parallel/test-net-happy-eyeballs.js
rename to test/parallel/test-net-autoselectfamily.js
index a7b19a074edd8b..d664d8c15b9572 100644
--- a/test/parallel/test-net-happy-eyeballs.js
+++ b/test/parallel/test-net-autoselectfamily.js
@@ -74,9 +74,11 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
     });
 
     ipv4Server.listen(0, '127.0.0.1', common.mustCall(() => {
+      const port = ipv4Server.address().port;
+
       const connection = createConnection({
         host: 'example.org',
-        port: ipv4Server.address().port,
+        port: port,
         lookup,
         autoSelectFamily: true,
         autoSelectFamilyAttemptTimeout,
@@ -85,6 +87,10 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
       let response = '';
       connection.setEncoding('utf-8');
 
+      connection.on('ready', common.mustCall(() => {
+        assert.deepStrictEqual(connection.autoSelectFamilyAttemptedAddresses, [`::1:${port}`, `127.0.0.1:${port}`]);
+      }));
+
       connection.on('data', (chunk) => {
         response += chunk;
       });
@@ -132,6 +138,10 @@ if (common.hasIPv6) {
         let response = '';
         connection.setEncoding('utf-8');
 
+        connection.on('ready', common.mustCall(() => {
+          assert.deepStrictEqual(connection.autoSelectFamilyAttemptedAddresses, [`::1:${port}`]);
+        }));
+
         connection.on('data', (chunk) => {
           response += chunk;
         });
@@ -162,6 +172,7 @@ if (common.hasIPv6) {
 
     connection.on('ready', common.mustNotCall());
     connection.on('error', common.mustCall((error) => {
+      assert.deepStrictEqual(connection.autoSelectFamilyAttemptedAddresses, ['::1:10', '127.0.0.1:10']);
       assert.strictEqual(error.constructor.name, 'AggregateError');
       assert.strictEqual(error.errors.length, 2);
 
@@ -199,6 +210,8 @@ if (common.hasIPv6) {
 
       connection.on('ready', common.mustNotCall());
       connection.on('error', common.mustCall((error) => {
+        assert.strictEqual(connection.autoSelectFamilyAttemptedAddresses, undefined);
+
         if (common.hasIPv6) {
           assert.strictEqual(error.code, 'ECONNREFUSED');
           assert.strictEqual(error.message, `connect ECONNREFUSED ::1:${port}`);
diff --git a/test/parallel/test-net-autoselectfamilydefault.js b/test/parallel/test-net-autoselectfamilydefault.js
new file mode 100644
index 00000000000000..4b9c7c36a8be83
--- /dev/null
+++ b/test/parallel/test-net-autoselectfamilydefault.js
@@ -0,0 +1,140 @@
+'use strict';
+
+const common = require('../common');
+const { parseDNSPacket, writeDNSPacket } = require('../common/dns');
+
+const assert = require('assert');
+const dgram = require('dgram');
+const { Resolver } = require('dns');
+const { createConnection, createServer, setDefaultAutoSelectFamily } = require('net');
+
+// Test that the default for happy eyeballs algorithm is properly respected.
+
+let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
+if (common.isWindows) {
+  // Some of the windows machines in the CI need more time to establish connection
+  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
+}
+
+function _lookup(resolver, hostname, options, cb) {
+  resolver.resolve(hostname, 'ANY', (err, replies) => {
+    assert.notStrictEqual(options.family, 4);
+
+    if (err) {
+      return cb(err);
+    }
+
+    const hosts = replies
+      .map((r) => ({ address: r.address, family: r.type === 'AAAA' ? 6 : 4 }))
+      .sort((a, b) => b.family - a.family);
+
+    if (options.all === true) {
+      return cb(null, hosts);
+    }
+
+    return cb(null, hosts[0].address, hosts[0].family);
+  });
+}
+
+function createDnsServer(ipv6Addr, ipv4Addr, cb) {
+  // Create a DNS server which replies with a AAAA and a A record for the same host
+  const socket = dgram.createSocket('udp4');
+
+  socket.on('message', common.mustCall((msg, { address, port }) => {
+    const parsed = parseDNSPacket(msg);
+    const domain = parsed.questions[0].domain;
+    assert.strictEqual(domain, 'example.org');
+
+    socket.send(writeDNSPacket({
+      id: parsed.id,
+      questions: parsed.questions,
+      answers: [
+        { type: 'AAAA', address: ipv6Addr, ttl: 123, domain: 'example.org' },
+        { type: 'A', address: ipv4Addr, ttl: 123, domain: 'example.org' },
+      ]
+    }), port, address);
+  }));
+
+  socket.bind(0, () => {
+    const resolver = new Resolver();
+    resolver.setServers([`127.0.0.1:${socket.address().port}`]);
+
+    cb({ dnsServer: socket, lookup: _lookup.bind(null, resolver) });
+  });
+}
+
+// Test that IPV4 is reached by default if IPV6 is not reachable and the default is enabled
+{
+  createDnsServer('::1', '127.0.0.1', common.mustCall(function({ dnsServer, lookup }) {
+    const ipv4Server = createServer((socket) => {
+      socket.on('data', common.mustCall(() => {
+        socket.write('response-ipv4');
+        socket.end();
+      }));
+    });
+
+    ipv4Server.listen(0, '127.0.0.1', common.mustCall(() => {
+      setDefaultAutoSelectFamily(true);
+
+      const connection = createConnection({
+        host: 'example.org',
+        port: ipv4Server.address().port,
+        lookup,
+        autoSelectFamilyAttemptTimeout,
+      });
+
+      let response = '';
+      connection.setEncoding('utf-8');
+
+      connection.on('data', (chunk) => {
+        response += chunk;
+      });
+
+      connection.on('end', common.mustCall(() => {
+        assert.strictEqual(response, 'response-ipv4');
+        ipv4Server.close();
+        dnsServer.close();
+      }));
+
+      connection.write('request');
+    }));
+  }));
+}
+
+// Test that IPV4 is not reached by default if IPV6 is not reachable and the default is disabled
+{
+  createDnsServer('::1', '127.0.0.1', common.mustCall(function({ dnsServer, lookup }) {
+    const ipv4Server = createServer((socket) => {
+      socket.on('data', common.mustCall(() => {
+        socket.write('response-ipv4');
+        socket.end();
+      }));
+    });
+
+    ipv4Server.listen(0, '127.0.0.1', common.mustCall(() => {
+      setDefaultAutoSelectFamily(false);
+
+      const port = ipv4Server.address().port;
+
+      const connection = createConnection({
+        host: 'example.org',
+        port,
+        lookup,
+      });
+
+      connection.on('ready', common.mustNotCall());
+      connection.on('error', common.mustCall((error) => {
+        if (common.hasIPv6) {
+          assert.strictEqual(error.code, 'ECONNREFUSED');
+          assert.strictEqual(error.message, `connect ECONNREFUSED ::1:${port}`);
+        } else {
+          assert.strictEqual(error.code, 'EADDRNOTAVAIL');
+          assert.strictEqual(error.message, `connect EADDRNOTAVAIL ::1:${port} - Local (:::0)`);
+        }
+
+        ipv4Server.close();
+        dnsServer.close();
+      }));
+    }));
+  }));
+}
diff --git a/test/parallel/test-net-socket-connect-invalid-autoselectfamily.js b/test/parallel/test-net-socket-connect-invalid-autoselectfamily.js
new file mode 100644
index 00000000000000..9ca8ab5c5b64b4
--- /dev/null
+++ b/test/parallel/test-net-socket-connect-invalid-autoselectfamily.js
@@ -0,0 +1,9 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const net = require('net');
+
+assert.throws(() => {
+  net.connect({ port: 8080, autoSelectFamily: 'INVALID' });
+}, { code: 'ERR_INVALID_ARG_TYPE' });

From c96ef056a632dfd00efaa0a2ac0861d711721eb6 Mon Sep 17 00:00:00 2001
From: Paolo Insogna <paolo@cowtech.it>
Date: Thu, 11 May 2023 09:14:03 -0700
Subject: [PATCH 03/10] net: fix family autoselection timeout handling

PR-URL: https://github.com/nodejs/node/pull/47860
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/net.js                                 | 40 +++++++++-----
 test/parallel/test-net-autoselectfamily.js | 64 +++++++++++++++++++++-
 2 files changed, 88 insertions(+), 16 deletions(-)

diff --git a/lib/net.js b/lib/net.js
index a72e48c96a6db4..5866235ba7f38a 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -135,7 +135,6 @@ let autoSelectFamilyDefault = getOptionValue('--enable-network-family-autoselect
 
 const { clearTimeout, setTimeout } = require('timers');
 const { kTimeout } = require('internal/timers');
-const kTimeoutTriggered = Symbol('kTimeoutTriggered');
 
 const DEFAULT_IPV4_ADDR = '0.0.0.0';
 const DEFAULT_IPV6_ADDR = '::';
@@ -1093,9 +1092,11 @@ function internalConnectMultiple(context) {
     return;
   }
 
+
+  const current = context.current++;
+  const handle = current === 0 ? self._handle : new TCP(TCPConstants.SOCKET);
   const { localPort, port, flags } = context;
-  const { address, family: addressType } = context.addresses[context.current++];
-  const handle = new TCP(TCPConstants.SOCKET);
+  const { address, family: addressType } = context.addresses[current];
   let localAddress;
   let err;
 
@@ -1120,7 +1121,7 @@ function internalConnectMultiple(context) {
   }
 
   const req = new TCPConnectWrap();
-  req.oncomplete = FunctionPrototypeBind(afterConnectMultiple, undefined, context);
+  req.oncomplete = FunctionPrototypeBind(afterConnectMultiple, undefined, context, current);
   req.address = address;
   req.port = port;
   req.localAddress = localAddress;
@@ -1147,8 +1148,12 @@ function internalConnectMultiple(context) {
     return;
   }
 
-  // If the attempt has not returned an error, start the connection timer
-  context[kTimeout] = setTimeout(internalConnectMultipleTimeout, context.timeout, context, req);
+  if (current < context.addresses.length - 1) {
+    debug('connect/multiple: setting the attempt timeout to %d ms', context.timeout);
+
+    // If the attempt has not returned an error, start the connection timer
+    context[kTimeout] = setTimeout(internalConnectMultipleTimeout, context.timeout, context, req, handle);
+  }
 }
 
 Socket.prototype.connect = function(...args) {
@@ -1419,7 +1424,6 @@ function lookupAndConnectMultiple(self, async_id_symbol, lookup, host, options,
         localPort,
         timeout,
         [kTimeout]: null,
-        [kTimeoutTriggered]: false,
         errors: [],
       };
 
@@ -1522,12 +1526,20 @@ function afterConnect(status, handle, req, readable, writable) {
   }
 }
 
-function afterConnectMultiple(context, status, handle, req, readable, writable) {
-  const self = context.socket;
-
+function afterConnectMultiple(context, current, status, handle, req, readable, writable) {
   // Make sure another connection is not spawned
   clearTimeout(context[kTimeout]);
 
+  // One of the connection has completed and correctly dispatched but after timeout, ignore this one
+  if (status === 0 && current !== context.current - 1) {
+    debug('connect/multiple: ignoring successful but timedout connection to %s:%s', req.address, req.port);
+    handle.close();
+    return;
+  }
+
+  const self = context.socket;
+
+
   // Some error occurred, add to the list of exceptions
   if (status !== 0) {
     let details;
@@ -1552,7 +1564,7 @@ function afterConnectMultiple(context, status, handle, req, readable, writable)
   }
 
   // One of the connection has completed and correctly dispatched but after timeout, ignore this one
-  if (context[kTimeoutTriggered]) {
+  if (status === 0 && current !== context.current - 1) {
     debug('connect/multiple: ignoring successful but timedout connection to %s:%s', req.address, req.port);
     handle.close();
     return;
@@ -1578,8 +1590,10 @@ function afterConnectMultiple(context, status, handle, req, readable, writable)
   afterConnect(status, handle, req, readable, writable);
 }
 
-function internalConnectMultipleTimeout(context, req) {
-  context[kTimeoutTriggered] = true;
+function internalConnectMultipleTimeout(context, req, handle) {
+  debug('connect/multiple: connection to %s:%s timed out', req.address, req.port);
+  req.oncomplete = undefined;
+  handle.close();
   internalConnectMultiple(context);
 }
 
diff --git a/test/parallel/test-net-autoselectfamily.js b/test/parallel/test-net-autoselectfamily.js
index d664d8c15b9572..43ae91f61c1879 100644
--- a/test/parallel/test-net-autoselectfamily.js
+++ b/test/parallel/test-net-autoselectfamily.js
@@ -36,7 +36,15 @@ function _lookup(resolver, hostname, options, cb) {
   });
 }
 
-function createDnsServer(ipv6Addr, ipv4Addr, cb) {
+function createDnsServer(ipv6Addrs, ipv4Addrs, cb) {
+  if (!Array.isArray(ipv6Addrs)) {
+    ipv6Addrs = [ipv6Addrs];
+  }
+
+  if (!Array.isArray(ipv4Addrs)) {
+    ipv4Addrs = [ipv4Addrs];
+  }
+
   // Create a DNS server which replies with a AAAA and a A record for the same host
   const socket = dgram.createSocket('udp4');
 
@@ -49,8 +57,8 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
       id: parsed.id,
       questions: parsed.questions,
       answers: [
-        { type: 'AAAA', address: ipv6Addr, ttl: 123, domain: 'example.org' },
-        { type: 'A', address: ipv4Addr, ttl: 123, domain: 'example.org' },
+        ...ipv6Addrs.map((address) => ({ type: 'AAAA', address, ttl: 123, domain: 'example.org' })),
+        ...ipv4Addrs.map((address) => ({ type: 'A', address, ttl: 123, domain: 'example.org' })),
       ]
     }), port, address);
   }));
@@ -106,6 +114,56 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
   }));
 }
 
+// Test that only the last successful connection is established.
+{
+  createDnsServer(
+    '::1',
+    ['104.20.22.46', '104.20.23.46', '127.0.0.1'],
+    common.mustCall(function({ dnsServer, lookup }) {
+      const ipv4Server = createServer((socket) => {
+        socket.on('data', common.mustCall(() => {
+          socket.write('response-ipv4');
+          socket.end();
+        }));
+      });
+
+      ipv4Server.listen(0, '127.0.0.1', common.mustCall(() => {
+        const port = ipv4Server.address().port;
+
+        const connection = createConnection({
+          host: 'example.org',
+          port: port,
+          lookup,
+          autoSelectFamily: true,
+          autoSelectFamilyAttemptTimeout,
+        });
+
+        let response = '';
+        connection.setEncoding('utf-8');
+
+        connection.on('ready', common.mustCall(() => {
+          assert.deepStrictEqual(
+            connection.autoSelectFamilyAttemptedAddresses,
+            [`::1:${port}`, `104.20.22.46:${port}`, `104.20.23.46:${port}`, `127.0.0.1:${port}`]
+          );
+        }));
+
+        connection.on('data', (chunk) => {
+          response += chunk;
+        });
+
+        connection.on('end', common.mustCall(() => {
+          assert.strictEqual(response, 'response-ipv4');
+          ipv4Server.close();
+          dnsServer.close();
+        }));
+
+        connection.write('request');
+      }));
+    })
+  );
+}
+
 // Test that IPV4 is NOT reached if IPV6 is reachable
 if (common.hasIPv6) {
   createDnsServer('::1', '127.0.0.1', common.mustCall(function({ dnsServer, lookup }) {

From 27a243f928b9b0104a9157a9f43dcb7ef9e99d17 Mon Sep 17 00:00:00 2001
From: Fedor Indutny <238531+indutny@users.noreply.github.com>
Date: Thu, 1 Jun 2023 13:53:56 -0700
Subject: [PATCH 04/10] net: fix address iteration with autoSelectFamily
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When `autoSelectFamily` is set to `true`, `net.connect` is supposed to
try connecting to both IPv4 and IPv6, interleaving the address types.
Instead, it appears that the array that holds the addresses in the order
they should be attempted was never used after being populated.

PR-URL: https://github.com/nodejs/node/pull/48258
Backport-PR-URL: https://github.com/nodejs/node/pull/48275
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
---
 lib/net.js                                 |  2 +-
 test/parallel/test-net-autoselectfamily.js | 11 +++++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/net.js b/lib/net.js
index 5866235ba7f38a..ecc0f078f59dc4 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -1418,7 +1418,7 @@ function lookupAndConnectMultiple(self, async_id_symbol, lookup, host, options,
 
       const context = {
         socket: self,
-        addresses,
+        addresses: toAttempt,
         current: 0,
         port,
         localPort,
diff --git a/test/parallel/test-net-autoselectfamily.js b/test/parallel/test-net-autoselectfamily.js
index 43ae91f61c1879..2c1fef1c205865 100644
--- a/test/parallel/test-net-autoselectfamily.js
+++ b/test/parallel/test-net-autoselectfamily.js
@@ -117,7 +117,7 @@ function createDnsServer(ipv6Addrs, ipv4Addrs, cb) {
 // Test that only the last successful connection is established.
 {
   createDnsServer(
-    '::1',
+    ['2606:4700::6810:85e5', '2606:4700::6810:84e5', '::1'],
     ['104.20.22.46', '104.20.23.46', '127.0.0.1'],
     common.mustCall(function({ dnsServer, lookup }) {
       const ipv4Server = createServer((socket) => {
@@ -144,7 +144,14 @@ function createDnsServer(ipv6Addrs, ipv4Addrs, cb) {
         connection.on('ready', common.mustCall(() => {
           assert.deepStrictEqual(
             connection.autoSelectFamilyAttemptedAddresses,
-            [`::1:${port}`, `104.20.22.46:${port}`, `104.20.23.46:${port}`, `127.0.0.1:${port}`]
+            [
+              `2606:4700::6810:85e5:${port}`,
+              `104.20.22.46:${port}`,
+              `2606:4700::6810:84e5:${port}`,
+              `104.20.23.46:${port}`,
+              `::1:${port}`,
+              `127.0.0.1:${port}`,
+            ]
           );
         }));
 

From 936970f8d86546daa9d6e68efe903c2dc29b4ec6 Mon Sep 17 00:00:00 2001
From: Tim Perry <1526883+pimterry@users.noreply.github.com>
Date: Mon, 30 Jan 2023 12:27:37 +0100
Subject: [PATCH 05/10] http: keep HTTP/1.1 conns alive even if the Connection
 header is removed

Previously persistence was completed disabled if you removed this
header, which is not correct for modern HTTP, where the header is
optional and all connections should persist by default regardless.

PR-URL: https://github.com/nodejs/node/pull/46331
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ricky Zhou <0x19951125@gmail.com>
---
 lib/_http_outgoing.js                         |  5 +-
 ...e-connection-header-persists-connection.js | 72 +++++++++++++++++++
 2 files changed, 75 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-http-remove-connection-header-persists-connection.js

diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index bc57cd067507f7..da3bf99fd1ecb8 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -483,8 +483,9 @@ function _storeHeader(firstLine, headers) {
 
   // keep-alive logic
   if (this._removedConnection) {
-    this._last = true;
-    this.shouldKeepAlive = false;
+    // shouldKeepAlive is generally true for HTTP/1.1. In that common case,
+    // even if the connection header isn't sent, we still persist by default.
+    this._last = !this.shouldKeepAlive;
   } else if (!state.connection) {
     const shouldSendKeepAlive = this.shouldKeepAlive &&
         (state.contLen || this.useChunkedEncodingByDefault || this.agent);
diff --git a/test/parallel/test-http-remove-connection-header-persists-connection.js b/test/parallel/test-http-remove-connection-header-persists-connection.js
new file mode 100644
index 00000000000000..6d05874272df03
--- /dev/null
+++ b/test/parallel/test-http-remove-connection-header-persists-connection.js
@@ -0,0 +1,72 @@
+'use strict';
+require('../common');
+const assert = require('assert');
+
+const net = require('net');
+const http = require('http');
+
+const server = http.createServer(function(request, response) {
+  // When the connection header is removed, for HTTP/1.1 the connection should still persist.
+  // For HTTP/1.0, the connection should be closed after the response automatically.
+  response.removeHeader('connection');
+
+  response.end('beep boop\n');
+});
+
+const agent = new http.Agent({ keepAlive: true });
+
+function makeHttp11Request(cb) {
+  http.get({
+    port: server.address().port,
+    agent
+  }, function(res) {
+    const socket = res.socket;
+
+    assert.strictEqual(res.statusCode, 200);
+    assert.strictEqual(res.headers.connection, undefined);
+
+    res.setEncoding('ascii');
+    let response = '';
+    res.on('data', function(chunk) {
+      response += chunk;
+    });
+    res.on('end', function() {
+      assert.strictEqual(response, 'beep boop\n');
+
+      // Wait till next tick to ensure that the socket is returned to the agent before
+      // we continue to the next request
+      process.nextTick(function() {
+        cb(socket);
+      });
+    });
+  });
+}
+
+function makeHttp10Request(cb) {
+  // We have to manually make HTTP/1.0 requests since Node does not allow sending them:
+  const socket = net.connect({ port: server.address().port }, function() {
+    socket.write('GET / HTTP/1.0\r\n' +
+               'Host: localhost:' + server.address().port + '\r\n' +
+                '\r\n');
+    socket.resume(); // Ignore the response itself
+
+    setTimeout(function() {
+      cb(socket);
+    }, 10);
+  });
+}
+
+server.listen(0, function() {
+  makeHttp11Request(function(firstSocket) {
+    makeHttp11Request(function(secondSocket) {
+      // Both HTTP/1.1 requests should have used the same socket:
+      assert.strictEqual(firstSocket, secondSocket);
+
+      makeHttp10Request(function(socket) {
+        // The server should have immediately closed the HTTP/1.0 socket:
+        assert.strictEqual(socket.closed, true);
+        server.close();
+      });
+    });
+  });
+});

From 568975f89f8030f3362c54e07a855a8e07d8a61c Mon Sep 17 00:00:00 2001
From: Paolo Insogna <paolo@cowtech.it>
Date: Thu, 23 Feb 2023 01:47:13 -0800
Subject: [PATCH 06/10] net: rework autoSelectFamily implementation

PR-URL: https://github.com/nodejs/node/pull/46587
Backport-PR-URL:
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/net.md                                | 64 +++++++++-----
 lib/_tls_wrap.js                              | 70 +++++++++------
 lib/internal/net.js                           |  2 +-
 lib/net.js                                    | 87 +++++++++++++------
 test/parallel/test-http-autoselectfamily.js   | 10 +--
 .../test-http2-ping-settings-heapdump.js      | 10 ++-
 test/parallel/test-https-autoselectfamily.js  | 12 +--
 ...net-autoselectfamily-commandline-option.js | 10 +--
 .../test-net-autoselectfamily-ipv4first.js    | 10 +--
 test/parallel/test-net-autoselectfamily.js    | 10 +--
 test/parallel/test-net-dns-custom-lookup.js   | 19 +++-
 test/parallel/test-net-dns-lookup.js          |  4 +-
 test/parallel/test-net-options-lookup.js      |  6 +-
 test/parallel/test-net-server-reset.js        | 18 ++--
 ...-invalid-autoselectfamilyattempttimeout.js |  6 ++
 .../test-tls-autoselectfamily-servername.js   | 37 ++++++++
 16 files changed, 247 insertions(+), 128 deletions(-)
 create mode 100644 test/parallel/test-tls-autoselectfamily-servername.js

diff --git a/doc/api/net.md b/doc/api/net.md
index 91766ad8e0f2d2..eca3c1ffcfec83 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -935,7 +935,7 @@ For TCP connections, available `options` are:
 * `autoSelectFamilyAttemptTimeout` {number}: The amount of time in milliseconds to wait
   for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option.
   If set to a positive integer less than `10`, then the value `10` will be used instead.
-  **Default:** `250`.
+  **Default:** initially `250`, but it can be changed at runtime using [`net.setDefaultAutoSelectFamilyAttemptTimeout(value)`][]
 
 For [IPC][] connections, available `options` are:
 
@@ -1520,26 +1520,6 @@ immediately initiates connection with
 [`socket.connect(port[, host][, connectListener])`][`socket.connect(port)`],
 then returns the `net.Socket` that starts the connection.
 
-## `net.setDefaultAutoSelectFamily(value)`
-
-<!-- YAML
-added: REPLACEME
--->
-
-Sets the default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
-
-* `value` {boolean} The new default value. The initial default value is `false`.
-
-## `net.getDefaultAutoSelectFamily()`
-
-<!-- YAML
-added: REPLACEME
--->
-
-Gets the current default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
-
-* Returns: {boolean} The current default value of the `autoSelectFamily` option.
-
 ## `net.createServer([options][, connectionListener])`
 
 <!-- YAML
@@ -1640,6 +1620,47 @@ Use `nc` to connect to a Unix domain socket server:
 $ nc -U /tmp/echo.sock
 ```
 
+## `net.getDefaultAutoSelectFamily()`
+
+<!-- YAML
+added: v19.4.0
+-->
+
+Gets the current default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
+
+* Returns: {boolean} The current default value of the `autoSelectFamily` option.
+
+## `net.setDefaultAutoSelectFamily(value)`
+
+<!-- YAML
+added: v19.4.0
+-->
+
+Sets the default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
+
+* `value` {boolean} The new default value. The initial default value is `false`.
+
+## `net.getDefaultAutoSelectFamilyAttemptTimeout()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Gets the current default value of the `autoSelectFamilyAttemptTimeout` option of [`socket.connect(options)`][].
+
+* Returns: {number} The current default value of the `autoSelectFamilyAttemptTimeout` option.
+
+## `net.setDefaultAutoSelectFamilyAttemptTimeout(value)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Sets the default value of the `autoSelectFamilyAttemptTimeout` option of [`socket.connect(options)`][].
+
+* `value` {number} The new default value, which must be a positive number. If the number is less than `10`,
+  the value `10` is used insted The initial default value is `250`.
+
 ## `net.isIP(input)`
 
 <!-- YAML
@@ -1725,6 +1746,7 @@ net.isIPv6('fhqwhgads'); // returns false
 [`net.createConnection(port, host)`]: #netcreateconnectionport-host-connectlistener
 [`net.createServer()`]: #netcreateserveroptions-connectionlistener
 [`net.setDefaultAutoSelectFamily(value)`]: #netsetdefaultautoselectfamilyvalue
+[`net.setDefaultAutoSelectFamilyAttemptTimeout(value)`]: #netsetdefaultautoselectfamilyattempttimeoutvalue
 [`new net.Socket(options)`]: #new-netsocketoptions
 [`readable.setEncoding()`]: stream.md#readablesetencodingencoding
 [`server.close()`]: #serverclosecallback
diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index 1eff3b3fba8a05..79be1cc009ec42 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -54,7 +54,7 @@ const EE = require('events');
 const net = require('net');
 const tls = require('tls');
 const common = require('_tls_common');
-const { kWrapConnectedHandle } = require('internal/net');
+const { kReinitializeHandle } = require('internal/net');
 const JSStreamSocket = require('internal/js_stream_socket');
 const { Buffer } = require('buffer');
 let debug = require('internal/util/debuglog').debuglog('tls', (fn) => {
@@ -633,14 +633,27 @@ TLSSocket.prototype._wrapHandle = function(wrap, handle) {
   return res;
 };
 
-TLSSocket.prototype[kWrapConnectedHandle] = function(handle) {
-  this._handle = this._wrapHandle(null, handle);
+TLSSocket.prototype[kReinitializeHandle] = function reinitializeHandle(handle) {
+  const originalServername = this._handle.getServername();
+  const originalSession = this._handle.getSession();
+
+  this.handle = this._wrapHandle(null, handle);
   this.ssl = this._handle;
+
+  net.Socket.prototype[kReinitializeHandle].call(this, this.handle);
   this._init();
 
   if (this._tlsOptions.enableTrace) {
     this._handle.enableTrace();
   }
+
+  if (originalSession) {
+    this.setSession(originalSession);
+  }
+
+  if (originalServername) {
+    this.setServername(originalServername);
+  }
 };
 
 // This eliminates a cyclic reference to TLSWrap
@@ -679,6 +692,30 @@ TLSSocket.prototype._destroySSL = function _destroySSL() {
   this[kIsVerified] = false;
 };
 
+function keylogNewListener(event) {
+  if (event !== 'keylog')
+    return;
+
+  // Guard against enableKeylogCallback after destroy
+  if (!this._handle) return;
+  this._handle.enableKeylogCallback();
+
+  // Remove this listener since it's no longer needed.
+  this.removeListener('newListener', keylogNewListener);
+}
+
+function newListener(event) {
+  if (event !== 'session')
+    return;
+
+  // Guard against enableSessionCallbacks after destroy
+  if (!this._handle) return;
+  this._handle.enableSessionCallbacks();
+
+  // Remove this listener since it's no longer needed.
+  this.removeListener('newListener', newListener);
+}
+
 // Constructor guts, arbitrarily factored out.
 let warnOnTlsKeylog = true;
 let warnOnTlsKeylogError = true;
@@ -704,18 +741,9 @@ TLSSocket.prototype._init = function(socket, wrap) {
 
   // Only call .onkeylog if there is a keylog listener.
   ssl.onkeylog = onkeylog;
-  this.on('newListener', keylogNewListener);
 
-  function keylogNewListener(event) {
-    if (event !== 'keylog')
-      return;
-
-    // Guard against enableKeylogCallback after destroy
-    if (!this._handle) return;
-    this._handle.enableKeylogCallback();
-
-    // Remove this listener since it's no longer needed.
-    this.removeListener('newListener', keylogNewListener);
+  if (this.listenerCount('newListener', keylogNewListener) === 0) {
+    this.on('newListener', keylogNewListener);
   }
 
   if (options.isServer) {
@@ -750,18 +778,8 @@ TLSSocket.prototype._init = function(socket, wrap) {
     ssl.onnewsession = onnewsessionclient;
 
     // Only call .onnewsession if there is a session listener.
-    this.on('newListener', newListener);
-
-    function newListener(event) {
-      if (event !== 'session')
-        return;
-
-      // Guard against enableSessionCallbacks after destroy
-      if (!this._handle) return;
-      this._handle.enableSessionCallbacks();
-
-      // Remove this listener since it's no longer needed.
-      this.removeListener('newListener', newListener);
+    if (this.listenerCount('newListener', newListener) === 0) {
+      this.on('newListener', newListener);
     }
   }
 
diff --git a/lib/internal/net.js b/lib/internal/net.js
index 786b03f2c34d8c..32825d4a72ac65 100644
--- a/lib/internal/net.js
+++ b/lib/internal/net.js
@@ -67,7 +67,7 @@ function makeSyncWrite(fd) {
 }
 
 module.exports = {
-  kWrapConnectedHandle: Symbol('wrapConnectedHandle'),
+  kReinitializeHandle: Symbol('reinitializeHandle'),
   isIP,
   isIPv4,
   isIPv6,
diff --git a/lib/net.js b/lib/net.js
index ecc0f078f59dc4..5e0499a35c8f68 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -43,7 +43,7 @@ let debug = require('internal/util/debuglog').debuglog('net', (fn) => {
   debug = fn;
 });
 const {
-  kWrapConnectedHandle,
+  kReinitializeHandle,
   isIP,
   isIPv4,
   isIPv6,
@@ -55,6 +55,7 @@ const {
   UV_EADDRINUSE,
   UV_EINVAL,
   UV_ENOTCONN,
+  UV_ECANCELED
 } = internalBinding('uv');
 
 const { Buffer } = require('buffer');
@@ -132,6 +133,7 @@ let dns;
 let BlockList;
 let SocketAddress;
 let autoSelectFamilyDefault = getOptionValue('--enable-network-family-autoselection');
+let autoSelectFamilyAttemptTimeoutDefault = 250;
 
 const { clearTimeout, setTimeout } = require('timers');
 const { kTimeout } = require('internal/timers');
@@ -254,6 +256,20 @@ function setDefaultAutoSelectFamily(value) {
   autoSelectFamilyDefault = value;
 }
 
+function getDefaultAutoSelectFamilyAttemptTimeout() {
+  return autoSelectFamilyAttemptTimeoutDefault;
+}
+
+function setDefaultAutoSelectFamilyAttemptTimeout(value) {
+  validateInt32(value, 'value', 1);
+
+  if (value < 1) {
+    value = 10;
+  }
+
+  autoSelectFamilyAttemptTimeoutDefault = value;
+}
+
 // Returns an array [options, cb], where options is an object,
 // cb is either a function or null.
 // Used to normalize arguments of Socket.prototype.connect() and
@@ -694,7 +710,11 @@ function tryReadStart(socket) {
 
 // Just call handle.readStart until we have enough in the buffer
 Socket.prototype._read = function(n) {
-  debug('_read');
+  debug(
+    '_read - n', n,
+    'isConnecting?', !!this.connecting,
+    'hasHandle?', !!this._handle,
+  );
 
   if (this.connecting || !this._handle) {
     debug('_read wait for connection');
@@ -1034,7 +1054,7 @@ function internalConnect(
       localAddress = localAddress || DEFAULT_IPV6_ADDR;
       err = self._handle.bind6(localAddress, localPort, flags);
     }
-    debug('binding to localAddress: %s and localPort: %d (addressType: %d)',
+    debug('connect: binding to localAddress: %s and localPort: %d (addressType: %d)',
           localAddress, localPort, addressType);
 
     err = checkBindError(err, localPort, self._handle);
@@ -1045,6 +1065,8 @@ function internalConnect(
     }
   }
 
+  debug('connect: attempting to connect to %s:%d (addressType: %d)', address, port, addressType);
+
   if (addressType === 6 || addressType === 4) {
     const req = new TCPConnectWrap();
     req.oncomplete = afterConnect;
@@ -1081,17 +1103,17 @@ function internalConnect(
 }
 
 
-function internalConnectMultiple(context) {
+function internalConnectMultiple(context, canceled) {
   clearTimeout(context[kTimeout]);
   const self = context.socket;
-  assert(self.connecting);
 
   // All connections have been tried without success, destroy with error
-  if (context.current === context.addresses.length) {
+  if (canceled || context.current === context.addresses.length) {
     self.destroy(aggregateErrors(context.errors));
     return;
   }
 
+  assert(self.connecting);
 
   const current = context.current++;
   const handle = current === 0 ? self._handle : new TCP(TCPConstants.SOCKET);
@@ -1120,6 +1142,8 @@ function internalConnectMultiple(context) {
     }
   }
 
+  debug('connect/multiple: attempting to connect to %s:%d (addressType: %d)', address, port, addressType);
+
   const req = new TCPConnectWrap();
   req.oncomplete = FunctionPrototypeBind(afterConnectMultiple, undefined, context, current);
   req.address = address;
@@ -1213,6 +1237,15 @@ Socket.prototype.connect = function(...args) {
   return this;
 };
 
+Socket.prototype[kReinitializeHandle] = function reinitializeHandle(handle) {
+  this._handle?.close();
+
+  this._handle = handle;
+  this._handle[owner_symbol] = this;
+
+  initSocketHandle(this);
+};
+
 function socketToDnsFamily(family) {
   switch (family) {
     case 'IPv4':
@@ -1260,7 +1293,7 @@ function lookupAndConnect(self, options) {
       autoSelectFamilyAttemptTimeout = 10;
     }
   } else {
-    autoSelectFamilyAttemptTimeout = 250;
+    autoSelectFamilyAttemptTimeout = autoSelectFamilyAttemptTimeoutDefault;
   }
 
   // If host is an IP, skip performing a lookup
@@ -1302,17 +1335,19 @@ function lookupAndConnect(self, options) {
     debug('connect: autodetecting');
 
     dnsopts.all = true;
-    lookupAndConnectMultiple(
-      self,
-      async_id_symbol,
-      lookup,
-      host,
-      options,
-      dnsopts,
-      port,
-      localPort,
-      autoSelectFamilyAttemptTimeout,
-    );
+    defaultTriggerAsyncIdScope(self[async_id_symbol], function() {
+      lookupAndConnectMultiple(
+        self,
+        async_id_symbol,
+        lookup,
+        host,
+        options,
+        dnsopts,
+        port,
+        localPort,
+        autoSelectFamilyAttemptTimeout,
+      );
+    });
 
     return;
   }
@@ -1360,6 +1395,8 @@ function lookupAndConnectMultiple(self, async_id_symbol, lookup, host, options,
       if (!self.connecting) {
         return;
       } else if (err) {
+        self.emit('lookup', err, undefined, undefined, host);
+
         // net.createConnection() creates a net.Socket object and immediately
         // calls net.Socket.connect() on it (that's us). There are no event
         // listeners registered yet so defer the error event to the next tick.
@@ -1559,7 +1596,7 @@ function afterConnectMultiple(context, current, status, handle, req, readable, w
     ArrayPrototypePush(context.errors, ex);
 
     // Try the next address
-    internalConnectMultiple(context);
+    internalConnectMultiple(context, status === UV_ECANCELED);
     return;
   }
 
@@ -1570,13 +1607,9 @@ function afterConnectMultiple(context, current, status, handle, req, readable, w
     return;
   }
 
-  // Perform initialization sequence on the handle, then move on with the regular callback
-  self._handle = handle;
-  initSocketHandle(self);
-
-  if (self[kWrapConnectedHandle]) {
-    self[kWrapConnectedHandle](handle);
-    initSocketHandle(self); // This is called again to initialize the TLSWrap
+  if (context.current > 1 && self[kReinitializeHandle]) {
+    self[kReinitializeHandle](handle);
+    handle = self._handle;
   }
 
   if (hasObserver('net')) {
@@ -2295,4 +2328,6 @@ module.exports = {
   Stream: Socket, // Legacy naming
   getDefaultAutoSelectFamily,
   setDefaultAutoSelectFamily,
+  getDefaultAutoSelectFamilyAttemptTimeout,
+  setDefaultAutoSelectFamilyAttemptTimeout,
 };
diff --git a/test/parallel/test-http-autoselectfamily.js b/test/parallel/test-http-autoselectfamily.js
index da81ce9a0146f1..6749d960f9122a 100644
--- a/test/parallel/test-http-autoselectfamily.js
+++ b/test/parallel/test-http-autoselectfamily.js
@@ -7,14 +7,12 @@ const assert = require('assert');
 const dgram = require('dgram');
 const { Resolver } = require('dns');
 const { request, createServer } = require('http');
+const { setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
 
 // Test that happy eyeballs algorithm is properly implemented when using HTTP.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
@@ -77,7 +75,6 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
         {
           lookup,
           autoSelectFamily: true,
-          autoSelectFamilyAttemptTimeout
         },
         (res) => {
           assert.strictEqual(res.statusCode, 200);
@@ -122,7 +119,6 @@ if (common.hasIPv6) {
           {
             lookup,
             autoSelectFamily: true,
-            autoSelectFamilyAttemptTimeout,
           },
           (res) => {
             assert.strictEqual(res.statusCode, 200);
diff --git a/test/parallel/test-http2-ping-settings-heapdump.js b/test/parallel/test-http2-ping-settings-heapdump.js
index 7d27310700c7a8..775110c098607b 100644
--- a/test/parallel/test-http2-ping-settings-heapdump.js
+++ b/test/parallel/test-http2-ping-settings-heapdump.js
@@ -11,6 +11,14 @@ const v8 = require('v8');
 // after it is destroyed, either because they are detached from it or have been
 // destroyed themselves.
 
+// We use an higher autoSelectFamilyAttemptTimeout in this test as the v8.getHeapSnapshot().resume()
+// will slow the connection flow and we don't want the second connection attempt to start.
+let autoSelectFamilyAttemptTimeout = common.platformTimeout(1000);
+if (common.isWindows) {
+  // Some of the windows machines in the CI need more time to establish connection
+  autoSelectFamilyAttemptTimeout = common.platformTimeout(10000);
+}
+
 for (const variant of ['ping', 'settings']) {
   const server = http2.createServer();
   server.on('session', common.mustCall((session) => {
@@ -30,7 +38,7 @@ for (const variant of ['ping', 'settings']) {
   }));
 
   server.listen(0, common.mustCall(() => {
-    const client = http2.connect(`http://localhost:${server.address().port}`,
+    const client = http2.connect(`http://localhost:${server.address().port}`, { autoSelectFamilyAttemptTimeout },
                                  common.mustCall());
     client.on('error', (err) => {
       // We destroy the session so it's possible to get ECONNRESET here.
diff --git a/test/parallel/test-https-autoselectfamily.js b/test/parallel/test-https-autoselectfamily.js
index 71a69f2fb20c63..422e4759022cd7 100644
--- a/test/parallel/test-https-autoselectfamily.js
+++ b/test/parallel/test-https-autoselectfamily.js
@@ -13,6 +13,7 @@ const assert = require('assert');
 const dgram = require('dgram');
 const { Resolver } = require('dns');
 const { request, createServer } = require('https');
+const { setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
@@ -24,11 +25,8 @@ const options = {
 
 // Test that happy eyeballs algorithm is properly implemented when using HTTP.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
@@ -93,8 +91,6 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
           lookup,
           rejectUnauthorized: false,
           autoSelectFamily: true,
-          autoSelectFamilyAttemptTimeout,
-          servername: 'example.org',
         },
         (res) => {
           assert.strictEqual(res.statusCode, 200);
@@ -142,8 +138,6 @@ if (common.hasIPv6) {
             lookup,
             rejectUnauthorized: false,
             autoSelectFamily: true,
-            autoSelectFamilyAttemptTimeout,
-            servername: 'example.org',
           },
           (res) => {
             assert.strictEqual(res.statusCode, 200);
diff --git a/test/parallel/test-net-autoselectfamily-commandline-option.js b/test/parallel/test-net-autoselectfamily-commandline-option.js
index 78c8a81b0ef126..555423374187b9 100644
--- a/test/parallel/test-net-autoselectfamily-commandline-option.js
+++ b/test/parallel/test-net-autoselectfamily-commandline-option.js
@@ -8,15 +8,12 @@ const { parseDNSPacket, writeDNSPacket } = require('../common/dns');
 const assert = require('assert');
 const dgram = require('dgram');
 const { Resolver } = require('dns');
-const { createConnection, createServer } = require('net');
+const { createConnection, createServer, setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
 
 // Test that happy eyeballs algorithm can be enable from command line.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
@@ -82,7 +79,6 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
         host: 'example.org',
         port: port,
         lookup,
-        autoSelectFamilyAttemptTimeout,
       });
 
       let response = '';
diff --git a/test/parallel/test-net-autoselectfamily-ipv4first.js b/test/parallel/test-net-autoselectfamily-ipv4first.js
index 00bff09ac6dde8..794f7464a80639 100644
--- a/test/parallel/test-net-autoselectfamily-ipv4first.js
+++ b/test/parallel/test-net-autoselectfamily-ipv4first.js
@@ -6,15 +6,12 @@ const { parseDNSPacket, writeDNSPacket } = require('../common/dns');
 const assert = require('assert');
 const dgram = require('dgram');
 const { Resolver } = require('dns');
-const { createConnection, createServer } = require('net');
+const { createConnection, createServer, setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
 
 // Test that happy eyeballs algorithm is properly implemented when a A record is returned first.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
@@ -88,7 +85,6 @@ if (common.hasIPv6) {
           port,
           lookup,
           autoSelectFamily: true,
-          autoSelectFamilyAttemptTimeout
         });
 
         let response = '';
diff --git a/test/parallel/test-net-autoselectfamily.js b/test/parallel/test-net-autoselectfamily.js
index 2c1fef1c205865..e9539e73fd08e8 100644
--- a/test/parallel/test-net-autoselectfamily.js
+++ b/test/parallel/test-net-autoselectfamily.js
@@ -10,11 +10,11 @@ const { createConnection, createServer } = require('net');
 
 // Test that happy eyeballs algorithm is properly implemented.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Purposely not using setDefaultAutoSelectFamilyAttemptTimeout here to test the
+// parameter is correctly used in options.
+//
+// Some of the windows machines in the CI need more time to establish connection
+const autoSelectFamilyAttemptTimeout = common.platformTimeout(common.isWindows ? 1500 : 250);
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
diff --git a/test/parallel/test-net-dns-custom-lookup.js b/test/parallel/test-net-dns-custom-lookup.js
index a7c05c82b95419..e1e425abd0beb8 100644
--- a/test/parallel/test-net-dns-custom-lookup.js
+++ b/test/parallel/test-net-dns-custom-lookup.js
@@ -26,13 +26,22 @@ function check(addressType, cb) {
 
   function lookup(host, dnsopts, cb) {
     dnsopts.family = addressType;
+
     if (addressType === 4) {
       process.nextTick(function() {
-        cb(null, common.localhostIPv4, 4);
+        if (dnsopts.all) {
+          cb(null, [{ address: common.localhostIPv4, family: 4 }]);
+        } else {
+          cb(null, common.localhostIPv4, 4);
+        }
       });
     } else {
       process.nextTick(function() {
-        cb(null, '::1', 6);
+        if (dnsopts.all) {
+          cb(null, [{ address: '::1', family: 6 }]);
+        } else {
+          cb(null, '::1', 6);
+        }
       });
     }
   }
@@ -48,7 +57,11 @@ check(4, function() {
     host: 'localhost',
     port: 80,
     lookup(host, dnsopts, cb) {
-      cb(null, undefined, 4);
+      if (dnsopts.all) {
+        cb(null, [{ address: undefined, family: 4 }]);
+      } else {
+        cb(null, undefined, 4);
+      }
     }
   }).on('error', common.expectsError({ code: 'ERR_INVALID_IP_ADDRESS' }));
 }
diff --git a/test/parallel/test-net-dns-lookup.js b/test/parallel/test-net-dns-lookup.js
index 8c7bbef128d7b1..8ef0382ae1a816 100644
--- a/test/parallel/test-net-dns-lookup.js
+++ b/test/parallel/test-net-dns-lookup.js
@@ -31,10 +31,10 @@ const server = net.createServer(function(client) {
 
 server.listen(0, common.mustCall(function() {
   net.connect(this.address().port, 'localhost')
-    .on('lookup', common.mustCall(function(err, ip, type, host) {
+    .on('lookup', common.mustCallAtLeast(function(err, ip, type, host) {
       assert.strictEqual(err, null);
       assert.match(ip, /^(127\.0\.0\.1|::1)$/);
       assert.match(type.toString(), /^(4|6)$/);
       assert.strictEqual(host, 'localhost');
-    }));
+    }, 1));
 }));
diff --git a/test/parallel/test-net-options-lookup.js b/test/parallel/test-net-options-lookup.js
index 0341a9f8d546b5..9a7ab00de96fba 100644
--- a/test/parallel/test-net-options-lookup.js
+++ b/test/parallel/test-net-options-lookup.js
@@ -36,7 +36,11 @@ function connectDoesNotThrow(input) {
 {
   // Verify that an error is emitted when an invalid address family is returned.
   const s = connectDoesNotThrow((host, options, cb) => {
-    cb(null, '127.0.0.1', 100);
+    if (options.all) {
+      cb(null, [{ address: '127.0.0.1', family: 100 }]);
+    } else {
+      cb(null, '127.0.0.1', 100);
+    }
   });
 
   s.on('error', common.expectsError({
diff --git a/test/parallel/test-net-server-reset.js b/test/parallel/test-net-server-reset.js
index ea78cd2743298e..3f9c049f3c3c36 100644
--- a/test/parallel/test-net-server-reset.js
+++ b/test/parallel/test-net-server-reset.js
@@ -20,17 +20,11 @@ server.on('close', common.mustCall());
 
 assert.strictEqual(server, server.listen(0, () => {
   net.createConnection(server.address().port)
-    .on('error', common.mustCall(
-      common.expectsError({
-        code: 'ECONNRESET',
-        name: 'Error'
-      }))
-    );
+    .on('error', common.mustCall((error) => {
+      assert.strictEqual(error.code, 'ECONNRESET');
+    }));
   net.createConnection(server.address().port)
-    .on('error', common.mustCall(
-      common.expectsError({
-        code: 'ECONNRESET',
-        name: 'Error'
-      }))
-    );
+    .on('error', common.mustCall((error) => {
+      assert.strictEqual(error.code, 'ECONNRESET');
+    }));
 }));
diff --git a/test/parallel/test-net-socket-connect-invalid-autoselectfamilyattempttimeout.js b/test/parallel/test-net-socket-connect-invalid-autoselectfamilyattempttimeout.js
index b7bd1ec0751ae8..adec8200f697d2 100644
--- a/test/parallel/test-net-socket-connect-invalid-autoselectfamilyattempttimeout.js
+++ b/test/parallel/test-net-socket-connect-invalid-autoselectfamilyattempttimeout.js
@@ -1,5 +1,7 @@
 'use strict';
+
 require('../common');
+
 const assert = require('assert');
 const net = require('net');
 
@@ -11,4 +13,8 @@ for (const autoSelectFamilyAttemptTimeout of [-10, 0]) {
       autoSelectFamilyAttemptTimeout,
     });
   }, { code: 'ERR_OUT_OF_RANGE' });
+
+  assert.throws(() => {
+    net.setDefaultAutoSelectFamilyAttemptTimeout(autoSelectFamilyAttemptTimeout);
+  }, { code: 'ERR_OUT_OF_RANGE' });
 }
diff --git a/test/parallel/test-tls-autoselectfamily-servername.js b/test/parallel/test-tls-autoselectfamily-servername.js
new file mode 100644
index 00000000000000..f2b0f7b3499b85
--- /dev/null
+++ b/test/parallel/test-tls-autoselectfamily-servername.js
@@ -0,0 +1,37 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
+const { connect } = require('tls');
+
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
+
+// Test that TLS connecting works without autoSelectFamily
+{
+  const socket = connect({
+    host: 'google.com',
+    port: 443,
+    servername: 'google.com',
+    autoSelectFamily: false,
+  });
+
+  socket.on('secureConnect', common.mustCall(() => socket.end()));
+}
+
+// Test that TLS connecting works with autoSelectFamily
+{
+  const socket = connect({
+    host: 'google.com',
+    port: 443,
+    servername: 'google.com',
+    autoSelectFamily: true,
+  });
+
+  socket.on('secureConnect', common.mustCall(() => socket.end()));
+}

From 26d38d0aad8cb7be5c4343e1dfbc386b9f73f24c Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 11 Mar 2023 14:52:43 +0100
Subject: [PATCH 07/10] test: move `test-tls-autoselectfamily-servername` to
 `test/internet`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

And switch from `google.com` to `nodejs.org`.

PR-URL: https://github.com/nodejs/node/pull/47029
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
---
 .../test-tls-autoselectfamily-servername.js   | 37 -------------------
 1 file changed, 37 deletions(-)
 delete mode 100644 test/parallel/test-tls-autoselectfamily-servername.js

diff --git a/test/parallel/test-tls-autoselectfamily-servername.js b/test/parallel/test-tls-autoselectfamily-servername.js
deleted file mode 100644
index f2b0f7b3499b85..00000000000000
--- a/test/parallel/test-tls-autoselectfamily-servername.js
+++ /dev/null
@@ -1,37 +0,0 @@
-'use strict';
-
-const common = require('../common');
-
-if (!common.hasCrypto) {
-  common.skip('missing crypto');
-}
-
-const { setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
-const { connect } = require('tls');
-
-// Some of the windows machines in the CI need more time to establish connection
-setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
-
-// Test that TLS connecting works without autoSelectFamily
-{
-  const socket = connect({
-    host: 'google.com',
-    port: 443,
-    servername: 'google.com',
-    autoSelectFamily: false,
-  });
-
-  socket.on('secureConnect', common.mustCall(() => socket.end()));
-}
-
-// Test that TLS connecting works with autoSelectFamily
-{
-  const socket = connect({
-    host: 'google.com',
-    port: 443,
-    servername: 'google.com',
-    autoSelectFamily: true,
-  });
-
-  socket.on('secureConnect', common.mustCall(() => socket.end()));
-}

From d3b123b20dfcb2419cb356154bde3707dbefd8e0 Mon Sep 17 00:00:00 2001
From: rogertyang <rogertyang@tencent.com>
Date: Sat, 15 Jul 2023 09:48:53 +0800
Subject: [PATCH 08/10] tls: fix bugs of double TLS

Fixs two issues in `TLSWrap`, one of them is reported in
https://github.com/nodejs/node/issues/30896.

1. `TLSWrap` has exactly one `StreamListener`, however,
that `StreamListener` can be replaced. We have not been
rigorous enough here: if an active write has not been
finished before the transition, the finish callback of it
will be wrongly fired the successor `StreamListener`.

2. A `TLSWrap` does not allow more than one active write,
as checked in the assertion about current_write in
`TLSWrap::DoWrite()`.

However, when users make use of an existing `tls.TLSSocket`
to establish double TLS, by
either
  tls.connect({socket: tlssock})
or
  tlsServer.emit('connection', tlssock)
we have both of the user provided `tls.TLSSocket`, tlssock and
a brand new created `TLSWrap` writing to the `TLSWrap` bound to
tlssock, which easily violates the constranint because two writers
have no idea of each other.

The design of the fix is:
when a `TLSWrap` is created on top of a user provided socket,
do not send any data to the socket until all existing writes
of the socket are done and ensure registered callbacks of
those writes can be fired.

PR-URL: https://github.com/nodejs/node/pull/48969
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 lib/_tls_wrap.js                              |  68 ++++++++----
 src/crypto/crypto_tls.cc                      |  48 ++++++++-
 src/crypto/crypto_tls.h                       |   9 +-
 test/parallel/test-double-tls-client.js       |  58 ++++++++++
 test/parallel/test-double-tls-server.js       | 101 ++++++++++++++++++
 ...cket-writes-before-passed-to-tls-socket.js |  42 ++++++++
 test/sequential/test-async-wrap-getasyncid.js |   2 +-
 7 files changed, 304 insertions(+), 24 deletions(-)
 create mode 100644 test/parallel/test-double-tls-client.js
 create mode 100644 test/parallel/test-double-tls-server.js
 create mode 100644 test/parallel/test-socket-writes-before-passed-to-tls-socket.js

diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index 79be1cc009ec42..74413ee5a30840 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -502,17 +502,28 @@ function TLSSocket(socket, opts) {
   this[kPendingSession] = null;
 
   let wrap;
-  if ((socket instanceof net.Socket && socket._handle) || !socket) {
-    // 1. connected socket
-    // 2. no socket, one will be created with net.Socket().connect
-    wrap = socket;
+  let handle;
+  let wrapHasActiveWriteFromPrevOwner;
+
+  if (socket) {
+    if (socket instanceof net.Socket && socket._handle) {
+      // 1. connected socket
+      wrap = socket;
+    } else {
+      // 2. socket has no handle so it is js not c++
+      // 3. unconnected sockets are wrapped
+      // TLS expects to interact from C++ with a net.Socket that has a C++ stream
+      // handle, but a JS stream doesn't have one. Wrap it up to make it look like
+      // a socket.
+      wrap = new JSStreamSocket(socket);
+    }
+
+    handle = wrap._handle;
+    wrapHasActiveWriteFromPrevOwner = wrap.writableLength > 0;
   } else {
-    // 3. socket has no handle so it is js not c++
-    // 4. unconnected sockets are wrapped
-    // TLS expects to interact from C++ with a net.Socket that has a C++ stream
-    // handle, but a JS stream doesn't have one. Wrap it up to make it look like
-    // a socket.
-    wrap = new JSStreamSocket(socket);
+    // 4. no socket, one will be created with net.Socket().connect
+    wrap = null;
+    wrapHasActiveWriteFromPrevOwner = false;
   }
 
   // Just a documented property to make secure sockets
@@ -520,7 +531,7 @@ function TLSSocket(socket, opts) {
   this.encrypted = true;
 
   ReflectApply(net.Socket, this, [{
-    handle: this._wrapHandle(wrap),
+    handle: this._wrapHandle(wrap, handle, wrapHasActiveWriteFromPrevOwner),
     allowHalfOpen: socket ? socket.allowHalfOpen : tlsOptions.allowHalfOpen,
     pauseOnCreate: tlsOptions.pauseOnConnect,
     manualStart: true,
@@ -539,6 +550,21 @@ function TLSSocket(socket, opts) {
   if (enableTrace && this._handle)
     this._handle.enableTrace();
 
+  if (wrapHasActiveWriteFromPrevOwner) {
+    // `wrap` is a streams.Writable in JS. This empty write will be queued
+    // and hence finish after all existing writes, which is the timing
+    // we want to start to send any tls data to `wrap`.
+    wrap.write('', (err) => {
+      if (err) {
+        debug('error got before writing any tls data to the underlying stream');
+        this.destroy(err);
+        return;
+      }
+
+      this._handle.writesIssuedByPrevListenerDone();
+    });
+  }
+
   // Read on next tick so the caller has a chance to setup listeners
   process.nextTick(initRead, this, socket);
 }
@@ -599,11 +625,14 @@ TLSSocket.prototype.disableRenegotiation = function disableRenegotiation() {
   this[kDisableRenegotiation] = true;
 };
 
-TLSSocket.prototype._wrapHandle = function(wrap, handle) {
-  if (!handle && wrap) {
-    handle = wrap._handle;
-  }
-
+/**
+ *
+ * @param {null|net.Socket} wrap
+ * @param {null|object} handle
+ * @param {boolean} wrapHasActiveWriteFromPrevOwner
+ * @returns {object}
+ */
+TLSSocket.prototype._wrapHandle = function(wrap, handle, wrapHasActiveWriteFromPrevOwner) {
   const options = this._tlsOptions;
   if (!handle) {
     handle = options.pipe ?
@@ -620,7 +649,10 @@ TLSSocket.prototype._wrapHandle = function(wrap, handle) {
   if (!(context.context instanceof NativeSecureContext)) {
     throw new ERR_TLS_INVALID_CONTEXT('context');
   }
-  const res = tls_wrap.wrap(handle, context.context, !!options.isServer);
+
+  const res = tls_wrap.wrap(handle, context.context,
+                            !!options.isServer,
+                            wrapHasActiveWriteFromPrevOwner);
   res._parent = handle;  // C++ "wrap" object: TCPWrap, JSStream, ...
   res._parentWrap = wrap;  // JS object: net.Socket, JSStreamSocket, ...
   res._secureContext = context;
@@ -637,7 +669,7 @@ TLSSocket.prototype[kReinitializeHandle] = function reinitializeHandle(handle) {
   const originalServername = this._handle.getServername();
   const originalSession = this._handle.getSession();
 
-  this.handle = this._wrapHandle(null, handle);
+  this.handle = this._wrapHandle(null, handle, false);
   this.ssl = this._handle;
 
   net.Socket.prototype[kReinitializeHandle].call(this, this.handle);
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 71d59b511e1736..13937262997365 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -319,12 +319,15 @@ TLSWrap::TLSWrap(Environment* env,
                  Local<Object> obj,
                  Kind kind,
                  StreamBase* stream,
-                 SecureContext* sc)
+                 SecureContext* sc,
+                 UnderlyingStreamWriteStatus under_stream_ws)
     : AsyncWrap(env, obj, AsyncWrap::PROVIDER_TLSWRAP),
       StreamBase(env),
       env_(env),
       kind_(kind),
-      sc_(sc) {
+      sc_(sc),
+      has_active_write_issued_by_prev_listener_(
+          under_stream_ws == UnderlyingStreamWriteStatus::kHasActive) {
   MakeWeak();
   CHECK(sc_);
   ssl_ = sc_->CreateSSL();
@@ -434,14 +437,19 @@ void TLSWrap::InitSSL() {
 void TLSWrap::Wrap(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
-  CHECK_EQ(args.Length(), 3);
+  CHECK_EQ(args.Length(), 4);
   CHECK(args[0]->IsObject());
   CHECK(args[1]->IsObject());
   CHECK(args[2]->IsBoolean());
+  CHECK(args[3]->IsBoolean());
 
   Local<Object> sc = args[1].As<Object>();
   Kind kind = args[2]->IsTrue() ? Kind::kServer : Kind::kClient;
 
+  UnderlyingStreamWriteStatus under_stream_ws =
+      args[3]->IsTrue() ? UnderlyingStreamWriteStatus::kHasActive
+                        : UnderlyingStreamWriteStatus::kVacancy;
+
   StreamBase* stream = StreamBase::FromObject(args[0].As<Object>());
   CHECK_NOT_NULL(stream);
 
@@ -452,7 +460,8 @@ void TLSWrap::Wrap(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  TLSWrap* res = new TLSWrap(env, obj, kind, stream, Unwrap<SecureContext>(sc));
+  TLSWrap* res = new TLSWrap(
+      env, obj, kind, stream, Unwrap<SecureContext>(sc), under_stream_ws);
 
   args.GetReturnValue().Set(res->object());
 }
@@ -558,6 +567,13 @@ void TLSWrap::EncOut() {
     return;
   }
 
+  if (UNLIKELY(has_active_write_issued_by_prev_listener_)) {
+    Debug(this,
+          "Returning from EncOut(), "
+          "has_active_write_issued_by_prev_listener_ is true");
+    return;
+  }
+
   // Split-off queue
   if (established_ && current_write_) {
     Debug(this, "EncOut() write is scheduled");
@@ -628,6 +644,15 @@ void TLSWrap::EncOut() {
 
 void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {
   Debug(this, "OnStreamAfterWrite(status = %d)", status);
+
+  if (UNLIKELY(has_active_write_issued_by_prev_listener_)) {
+    Debug(this, "Notify write finish to the previous_listener_");
+    CHECK_EQ(write_size_, 0);  // we must have restrained writes
+
+    previous_listener_->OnStreamAfterWrite(req_wrap, status);
+    return;
+  }
+
   if (current_empty_write_) {
     Debug(this, "Had empty write");
     BaseObjectPtr<AsyncWrap> current_empty_write =
@@ -1974,6 +1999,16 @@ void TLSWrap::GetALPNNegotiatedProto(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(result);
 }
 
+void TLSWrap::WritesIssuedByPrevListenerDone(
+    const FunctionCallbackInfo<Value>& args) {
+  TLSWrap* w;
+  ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
+
+  Debug(w, "WritesIssuedByPrevListenerDone is called");
+  w->has_active_write_issued_by_prev_listener_ = false;
+  w->EncOut();  // resume all of our restrained writes
+}
+
 void TLSWrap::Cycle() {
   // Prevent recursion
   if (++cycle_depth_ > 1)
@@ -2050,6 +2085,10 @@ void TLSWrap::Initialize(
   SetProtoMethod(isolate, t, "setSession", SetSession);
   SetProtoMethod(isolate, t, "setVerifyMode", SetVerifyMode);
   SetProtoMethod(isolate, t, "start", Start);
+  SetProtoMethod(isolate,
+                 t,
+                 "writesIssuedByPrevListenerDone",
+                 WritesIssuedByPrevListenerDone);
 
   SetProtoMethodNoSideEffect(
       isolate, t, "exportKeyingMaterial", ExportKeyingMaterial);
@@ -2131,6 +2170,7 @@ void TLSWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetSharedSigalgs);
   registry->Register(GetTLSTicket);
   registry->Register(VerifyError);
+  registry->Register(WritesIssuedByPrevListenerDone);
 
 #ifdef SSL_set_max_send_fragment
   registry->Register(SetMaxSendFragment);
diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
index 5d1b24ff772328..01414efc6b0258 100644
--- a/src/crypto/crypto_tls.h
+++ b/src/crypto/crypto_tls.h
@@ -48,6 +48,8 @@ class TLSWrap : public AsyncWrap,
     kServer
   };
 
+  enum class UnderlyingStreamWriteStatus { kHasActive, kVacancy };
+
   static void Initialize(v8::Local<v8::Object> target,
                          v8::Local<v8::Value> unused,
                          v8::Local<v8::Context> context,
@@ -136,7 +138,8 @@ class TLSWrap : public AsyncWrap,
           v8::Local<v8::Object> obj,
           Kind kind,
           StreamBase* stream,
-          SecureContext* sc);
+          SecureContext* sc,
+          UnderlyingStreamWriteStatus under_stream_ws);
 
   static void SSLInfoCallback(const SSL* ssl_, int where, int ret);
   void InitSSL();
@@ -216,6 +219,8 @@ class TLSWrap : public AsyncWrap,
   static void Start(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void VerifyError(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Wrap(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void WritesIssuedByPrevListenerDone(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
 
 #ifdef SSL_set_max_send_fragment
   static void SetMaxSendFragment(
@@ -283,6 +288,8 @@ class TLSWrap : public AsyncWrap,
 
   BIOPointer bio_trace_;
 
+  bool has_active_write_issued_by_prev_listener_ = false;
+
  public:
   std::vector<unsigned char> alpn_protos_;  // Accessed by SelectALPNCallback.
 };
diff --git a/test/parallel/test-double-tls-client.js b/test/parallel/test-double-tls-client.js
new file mode 100644
index 00000000000000..8309a1b9559c7a
--- /dev/null
+++ b/test/parallel/test-double-tls-client.js
@@ -0,0 +1,58 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+if (!common.hasCrypto) common.skip('missing crypto');
+const fixtures = require('../common/fixtures');
+const tls = require('tls');
+
+// In reality, this can be a HTTP CONNECT message, signaling the incoming
+// data is TLS encrypted
+const HEAD = 'XXXX';
+
+const subserver = tls.createServer({
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+})
+  .on('secureConnection', common.mustCall(() => {
+    process.exit(0);
+  }));
+
+const server = tls.createServer({
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+})
+  .listen(client)
+  .on('secureConnection', (serverTlsSock) => {
+    serverTlsSock.on('data', (chunk) => {
+      assert.strictEqual(chunk.toString(), HEAD);
+      subserver.emit('connection', serverTlsSock);
+    });
+  });
+
+function client() {
+  const down = tls.connect({
+    host: '127.0.0.1',
+    port: server.address().port,
+    rejectUnauthorized: false
+  }).on('secureConnect', () => {
+    down.write(HEAD, common.mustSucceed());
+
+    // Sending tls data on a client TLSSocket with an active write led to a crash:
+    //
+    //  node[16862]: ../src/crypto/crypto_tls.cc:963:virtual int node::crypto::TLSWrap::DoWrite(node::WriteWrap*,
+    //    uv_buf_t*, size_t, uv_stream_t*): Assertion `!current_write_' failed.
+    //  1: 0xb090e0 node::Abort() [node]
+    //  2: 0xb0915e  [node]
+    //  3: 0xca8413 node::crypto::TLSWrap::DoWrite(node::WriteWrap*, uv_buf_t*, unsigned long, uv_stream_s*) [node]
+    //  4: 0xcaa549 node::StreamBase::Write(uv_buf_t*, unsigned long, uv_stream_s*, v8::Local<v8::Object>) [node]
+    //  5: 0xca88d7 node::crypto::TLSWrap::EncOut() [node]
+    //  6: 0xd3df3e  [node]
+    //  7: 0xd3f35f v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) [node]
+    //  8: 0x15d9ef9  [node]
+    // Aborted
+    tls.connect({
+      socket: down,
+      rejectUnauthorized: false
+    });
+  });
+}
diff --git a/test/parallel/test-double-tls-server.js b/test/parallel/test-double-tls-server.js
new file mode 100644
index 00000000000000..f06a83a1264aad
--- /dev/null
+++ b/test/parallel/test-double-tls-server.js
@@ -0,0 +1,101 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+if (!common.hasCrypto) common.skip('missing crypto');
+const fixtures = require('../common/fixtures');
+const tls = require('tls');
+const net = require('net');
+
+// Sending tls data on a server TLSSocket with an active write led to a crash:
+//
+// node[1296]: ../src/crypto/crypto_tls.cc:963:virtual int node::crypto::TLSWrap::DoWrite(node::WriteWrap*,
+//    uv_buf_t*, size_t, uv_stream_t*): Assertion `!current_write_' failed.
+//  1: 0xb090e0 node::Abort() [node]
+//  2: 0xb0915e  [node]
+//  3: 0xca8413 node::crypto::TLSWrap::DoWrite(node::WriteWrap*, uv_buf_t*, unsigned long, uv_stream_s*) [node]
+//  4: 0xcaa549 node::StreamBase::Write(uv_buf_t*, unsigned long, uv_stream_s*, v8::Local<v8::Object>) [node]
+//  5: 0xca88d7 node::crypto::TLSWrap::EncOut() [node]
+//  6: 0xca9ba8 node::crypto::TLSWrap::OnStreamRead(long, uv_buf_t const&) [node]
+//  7: 0xca8eb0 node::crypto::TLSWrap::ClearOut() [node]
+//  8: 0xca9ba0 node::crypto::TLSWrap::OnStreamRead(long, uv_buf_t const&) [node]
+//  9: 0xbe50dd node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) [node]
+// 10: 0xbe54c4  [node]
+// 11: 0x15583d7  [node]
+// 12: 0x1558c00  [node]
+// 13: 0x155ede4  [node]
+// 14: 0x154d008 uv_run [node]
+
+const serverReplaySize = 2 * 1024 * 1024;
+
+(async function() {
+  const tlsClientHello = await getClientHello();
+
+  const subserver = tls.createServer({
+    key: fixtures.readKey('agent1-key.pem'),
+    cert: fixtures.readKey('agent1-cert.pem'),
+    ALPNCallback: common.mustCall(({ sn, protocols }) => {
+      // Once `subserver` receives `tlsClientHello` from the underlying net.Socket,
+      // in this test, a TLSSocket actually, it should be able to proceed to the handshake
+      // and emit this event
+      assert.strictEqual(protocols[0], 'h2');
+      return 'h2';
+    }),
+  });
+
+  const server = tls.createServer({
+    key: fixtures.readKey('agent1-key.pem'),
+    cert: fixtures.readKey('agent1-cert.pem'),
+  })
+    .listen(startClient)
+    .on('secureConnection', (serverTlsSock) => {
+      // Craft writes that are large enough to stuck in sending
+      // In reality this can be a 200 response to the incoming HTTP CONNECT
+      const half = Buffer.alloc(serverReplaySize / 2, 0);
+      serverTlsSock.write(half, common.mustSucceed());
+      serverTlsSock.write(half, common.mustSucceed());
+
+      subserver.emit('connection', serverTlsSock);
+    });
+
+
+  function startClient() {
+    const clientTlsSock = tls.connect({
+      host: '127.0.0.1',
+      port: server.address().port,
+      rejectUnauthorized: false,
+    });
+
+    const recv = [];
+    let revcLen = 0;
+    clientTlsSock.on('data', (chunk) => {
+      revcLen += chunk.length;
+      recv.push(chunk);
+      if (revcLen > serverReplaySize) {
+        // Check the server's replay is followed by the subserver's TLS ServerHello
+        const serverHelloFstByte = Buffer.concat(recv).subarray(serverReplaySize, serverReplaySize + 1);
+        assert.strictEqual(serverHelloFstByte.toString('hex'), '16');
+        process.exit(0);
+      }
+    });
+
+    // In reality, one may want to send a HTTP CONNECT before starting this double TLS
+    clientTlsSock.write(tlsClientHello);
+  }
+})().then(common.mustCall());
+
+function getClientHello() {
+  return new Promise((resolve) => {
+    const server = net.createServer((sock) => {
+      sock.on('data', (chunk) => {
+        resolve(chunk);
+      });
+    })
+    .listen(() => {
+      tls.connect({
+        port: server.address().port,
+        host: '127.0.0.1',
+        ALPNProtocols: ['h2'],
+      }).on('error', () => {});
+    });
+  });
+}
diff --git a/test/parallel/test-socket-writes-before-passed-to-tls-socket.js b/test/parallel/test-socket-writes-before-passed-to-tls-socket.js
new file mode 100644
index 00000000000000..22c5b87111579c
--- /dev/null
+++ b/test/parallel/test-socket-writes-before-passed-to-tls-socket.js
@@ -0,0 +1,42 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+if (!common.hasCrypto) common.skip('missing crypto');
+const tls = require('tls');
+const net = require('net');
+
+const HEAD = Buffer.alloc(1024 * 1024, 0);
+
+const server = net.createServer((serverSock) => {
+  let recvLen = 0;
+  const recv = [];
+  serverSock.on('data', common.mustCallAtLeast((chunk) => {
+    recv.push(chunk);
+    recvLen += chunk.length;
+
+    // Check that HEAD is followed by a client hello
+    if (recvLen > HEAD.length) {
+      const clientHelloFstByte = Buffer.concat(recv).subarray(HEAD.length, HEAD.length + 1);
+      assert.strictEqual(clientHelloFstByte.toString('hex'), '16');
+      process.exit(0);
+    }
+  }, 1));
+})
+  .listen(client);
+
+function client() {
+  const socket = net.createConnection({
+    host: '127.0.0.1',
+    port: server.address().port,
+  });
+  socket.write(HEAD.subarray(0, HEAD.length / 2), common.mustSucceed());
+
+  // This write will be queued by streams.Writable, the super class of net.Socket,
+  // which will dequeue this write when it gets notified about the finish of the first write.
+  // We had a bug that it wouldn't get notified. This test verifies the bug is fixed.
+  socket.write(HEAD.subarray(HEAD.length / 2), common.mustSucceed());
+
+  tls.connect({
+    socket,
+  });
+}
diff --git a/test/sequential/test-async-wrap-getasyncid.js b/test/sequential/test-async-wrap-getasyncid.js
index de7af137c47489..2f1cc19b49905b 100644
--- a/test/sequential/test-async-wrap-getasyncid.js
+++ b/test/sequential/test-async-wrap-getasyncid.js
@@ -292,7 +292,7 @@ if (common.hasCrypto) { // eslint-disable-line node-core/crypto-check
 
   // TLSWrap is exposed, but needs to be instantiated via tls_wrap.wrap().
   const tls_wrap = internalBinding('tls_wrap');
-  testInitialized(tls_wrap.wrap(tcp, credentials.context, true), 'TLSWrap');
+  testInitialized(tls_wrap.wrap(tcp, credentials.context, true, false), 'TLSWrap');
 }
 
 {

From 1fb21b60ebc391501945f7ca3d0e7198975acc99 Mon Sep 17 00:00:00 2001
From: Michael Dawson <mdawson@devrus.com>
Date: Wed, 26 Jul 2023 16:32:16 -0400
Subject: [PATCH 09/10] test: fixup Double TLS tests for 18.x

- APLN option is not supported on 18.x so remove

Signed-off-by: Michael Dawson <mdawson@devrus.com>
---
 test/parallel/test-double-tls-server.js | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/test/parallel/test-double-tls-server.js b/test/parallel/test-double-tls-server.js
index f06a83a1264aad..2964748a121159 100644
--- a/test/parallel/test-double-tls-server.js
+++ b/test/parallel/test-double-tls-server.js
@@ -33,13 +33,6 @@ const serverReplaySize = 2 * 1024 * 1024;
   const subserver = tls.createServer({
     key: fixtures.readKey('agent1-key.pem'),
     cert: fixtures.readKey('agent1-cert.pem'),
-    ALPNCallback: common.mustCall(({ sn, protocols }) => {
-      // Once `subserver` receives `tlsClientHello` from the underlying net.Socket,
-      // in this test, a TLSSocket actually, it should be able to proceed to the handshake
-      // and emit this event
-      assert.strictEqual(protocols[0], 'h2');
-      return 'h2';
-    }),
   });
 
   const server = tls.createServer({

From 9796b1ae5bf44fa7429ab012e33244922df8d654 Mon Sep 17 00:00:00 2001
From: Michael Dawson <mdawson@devrus.com>
Date: Mon, 14 Aug 2023 17:22:04 -0400
Subject: [PATCH 10/10] Update lib/net.js

---
 lib/net.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/net.js b/lib/net.js
index 5e0499a35c8f68..f04f62cce15bef 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -55,7 +55,7 @@ const {
   UV_EADDRINUSE,
   UV_EINVAL,
   UV_ENOTCONN,
-  UV_ECANCELED
+  UV_ECANCELED,
 } = internalBinding('uv');
 
 const { Buffer } = require('buffer');