node:tls: inherit allowHalfOpen from the wrapped socket

src/js/node/net.ts

@@ -143,6 +143,7 @@
 const kConnectOptions = Symbol("connect-options");
 const kAttach = Symbol("kAttach");
 const kCloseRawConnection = Symbol("kCloseRawConnection");
+const kOnUpgradedClose = Symbol("kOnUpgradedClose");
 const kupgraded = Symbol("kupgraded");
 const kAdoptedTLSRaw = Symbol("kAdoptedTLSRaw");
 const ksocket = Symbol("ksocket");
@@ -256,6 +257,18 @@
 function destroyNT(self, err) {
   self.destroy(err);
 }
+// 'close' listener armed on the connection a TLS socket is upgraded over: the
+// connection going away (its owner destroyed it, or the transport under a
+// wrapped duplex closed) takes the TLS socket with it, like node's wrap 'close'
+// listener. The connection's EOF alone does not; that is what an allowHalfOpen
+// TLS socket outlives.
+// https://github.com/nodejs/node/blob/v26.3.0/lib/internal/tls/wrap.js#L739-L741
+function onUpgradedClose(self, connection) {
+  if (self[kupgraded] === connection) self.destroy();
+}
+function destroyWhenUpgradedCloses(self, connection) {
+  connection.once("close", (self[kOnUpgradedClose] = onUpgradedClose.bind(null, self, connection)));
+}
 let addAbortListener;
 function destroyWhenAborted(err) {
   if (!this.destroyed) {
@@ -1886,8 +1899,13 @@
   SocketHandlers.drain(socket);
 };
 
+// 'end' listener of an fd-upgraded TLS socket: retires the net.Socket whose fd
+// this socket took over.
 Socket.prototype[kCloseRawConnection] = function () {
   const connection = this[kupgraded];
+  // The 'close' this retirement emits is not the connection going away under
+  // this socket; one its owner already started (connection.destroyed) is.
+  if (!connection.destroyed) connection.removeListener("close", this[kOnUpgradedClose]);
   connection.connecting = false;
   connection._handle = null;
   connection.unref();
@@ -2023,6 +2041,7 @@
           connection.on("end", events[1]);
           connection.on("drain", events[2]);
           connection.on("close", events[3]);
+          destroyWhenUpgradedCloses(this, connection);
           this._handle = result;
         } else {
           // upgradeTLS requires an established socket; a socket that is still
@@ -2042,6 +2061,7 @@
               connection._handle = raw;
               raw[kAdoptedTLSRaw] = true;
               this.once("end", this[kCloseRawConnection]);
+              destroyWhenUpgradedCloses(this, connection);
               raw.connecting = false;
               this._handle = tls;
             } else {
@@ -2074,6 +2094,7 @@
                 connection.on("end", events[1]);
                 connection.on("drain", events[2]);
                 connection.on("close", events[3]);
+                destroyWhenUpgradedCloses(this, connection);
                 this._handle = result;
               } else {
                 this[kupgraded] = connection;
@@ -2089,6 +2110,7 @@
                   connection._handle = raw;
                   raw[kAdoptedTLSRaw] = true;
                   this.once("end", this[kCloseRawConnection]);
+                  destroyWhenUpgradedCloses(this, connection);
                   raw.connecting = false;
                   this._handle = tls;
                 } else {
@@ -2384,6 +2406,7 @@
     connection.on("end", events[1]);
     connection.on("drain", events[2]);
     connection.on("close", events[3]);
+    destroyWhenUpgradedCloses(this, connection);
     this[kupgraded] = connection;
     this._handle = result;
     return;
@@ -2413,6 +2436,7 @@
       connection.on("end", events[1]);
       connection.on("drain", events[2]);
       connection.on("close", events[3]);
+      destroyWhenUpgradedCloses(this, connection);
       this._handle = result;
       this.emit(kUpgradeAttached);
       return;
@@ -2437,6 +2461,7 @@
     connection._handle = raw;
     raw[kAdoptedTLSRaw] = true;
     this.once("end", this[kCloseRawConnection]);
+    destroyWhenUpgradedCloses(this, connection);
     raw.connecting = false;
     this._handle = tlsHandle;
     this.emit(kUpgradeAttached);

src/js/node/tls.ts

@@ -735,7 +735,21 @@ function TLSSocket(socket?, options?) {
     throw $ERR_INVALID_ARG_TYPE("socket", "Duplex", socket);
   }
 
-  options = isNetSocketOrDuplex ? { ...options, allowHalfOpen: false } : options || socket || {};
+  // A wrapped socket decides allowHalfOpen; the option only applies when this
+  // socket opens its own connection. The wrapped socket is the first argument
+  // here, or `options.socket` on the tls.connect({ socket }) path (node's
+  // connect() forwards it as the first argument).
+  // https://github.com/nodejs/node/blob/v26.3.0/lib/internal/tls/wrap.js#L592
+  // https://github.com/nodejs/node/blob/v26.3.0/lib/internal/tls/wrap.js#L1756-L1757
+  if (isNetSocketOrDuplex) {
+    options = { ...options, allowHalfOpen: socket.allowHalfOpen };
+  } else {
+    options = options || socket || {};
+    const wrapped = options.socket;
+    if (wrapped instanceof Duplex) {
+      options = { ...options, allowHalfOpen: wrapped.allowHalfOpen };
+    }
+  }
 
   this._rejectUnauthorized = !!options.rejectUnauthorized;