autoSelectFamily: true breaks TLS

[addaleax]

Version

v19.6.0

Platform

x64 macOS 13.2.1; x64 Ubuntu 22.04

Subsystem

tls

What steps will reproduce the bug?

const socket = tls.connect({ host: 'google.com', port: 443, servername: 'google.com', autoSelectFamily: true }); 
socket.on('secureConnect', () => (console.log('secure connect'), socket.end()))

Results in Error: self-signed certificate with autoSelectFamily: true, works with autoSelectFamily: false.

How often does it reproduce? Is there a required condition?

Consistently.

What is the expected behavior?

Same as autoSelectFamily: false / same as when specifying IP addresses directly (with servername set).

What do you see instead?

TLS certificate validation errors.

Additional information

No response

[targos]

Also note that specifying family: 4 or family: 6 both work without error.

[bnoordhuis]

With { autoSelectFamily: true }, SSL_get_servername(TLSEXT_NAMETYPE_host_name) returns NULL.

That is, openssl thinks there's no SNI record and therefore this line returns false instead of 'google.com':

node/lib/_tls_wrap.js

Line 947 in a2bbe5f

this.servername = this._handle.getServername();

I noticed TLSSocket.prototype._init() gets called when autoSelectFamily is set. There's also an extra call to Socket.prototype._read() that wasn't there before. This block seems responsible.

node/lib/net.js

Lines 1547 to 1550 in a2bbe5f

	if (self[kWrapConnectedHandle]) {
	self[kWrapConnectedHandle](handle);
	initSocketHandle(self); // This is called again to initialize the TLSWrap
	}

I suspect this line (possibly other init stuff as well) needs to be reapplied in TLSSocket.prototype._init(), otherwise node "forgets" relevant TLS context state:

node/lib/_tls_wrap.js

Line 1687 in a2bbe5f

tlssock.setServername(options.servername);

An interesting question is if { autoSelectFamily: true, secureContext: context } works and if not, what to do about it.

[mcollina]

cc @ShogunPanda

[ShogunPanda]

Thanks! I'll take a look on Mon when I'll tackle all related problems forever.

[ShogunPanda]

I found the issue. This will be fixed once #46587 is merged.