From 6e19fdb954e5d91c91175416917bc3058bd9a936 Mon Sep 17 00:00:00 2001
From: Paolo Insogna <paolo@cowtech.it>
Date: Thu, 23 Feb 2023 01:47:13 -0800
Subject: [PATCH 1/4] net: rework autoSelectFamily implementation

PR-URL: https://github.com/nodejs/node/pull/46587
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/net.md                                | 64 +++++++++-----
 lib/_tls_wrap.js                              | 70 +++++++++------
 lib/internal/net.js                           |  2 +-
 lib/net.js                                    | 87 +++++++++++++------
 test/parallel/test-http-autoselectfamily.js   | 10 +--
 .../test-http2-ping-settings-heapdump.js      | 10 ++-
 test/parallel/test-https-autoselectfamily.js  | 12 +--
 ...net-autoselectfamily-commandline-option.js | 10 +--
 .../test-net-autoselectfamily-ipv4first.js    | 10 +--
 test/parallel/test-net-autoselectfamily.js    | 10 +--
 test/parallel/test-net-dns-custom-lookup.js   | 19 +++-
 test/parallel/test-net-dns-lookup.js          |  4 +-
 test/parallel/test-net-options-lookup.js      |  6 +-
 test/parallel/test-net-server-reset.js        | 18 ++--
 ...-invalid-autoselectfamilyattempttimeout.js |  6 ++
 .../test-tls-autoselectfamily-servername.js   | 37 ++++++++
 16 files changed, 247 insertions(+), 128 deletions(-)
 create mode 100644 test/parallel/test-tls-autoselectfamily-servername.js

diff --git a/doc/api/net.md b/doc/api/net.md
index 91766ad8e0f2d2..eca3c1ffcfec83 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -935,7 +935,7 @@ For TCP connections, available `options` are:
 * `autoSelectFamilyAttemptTimeout` {number}: The amount of time in milliseconds to wait
   for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option.
   If set to a positive integer less than `10`, then the value `10` will be used instead.
-  **Default:** `250`.
+  **Default:** initially `250`, but it can be changed at runtime using [`net.setDefaultAutoSelectFamilyAttemptTimeout(value)`][]
 
 For [IPC][] connections, available `options` are:
 
@@ -1520,26 +1520,6 @@ immediately initiates connection with
 [`socket.connect(port[, host][, connectListener])`][`socket.connect(port)`],
 then returns the `net.Socket` that starts the connection.
 
-## `net.setDefaultAutoSelectFamily(value)`
-
-<!-- YAML
-added: REPLACEME
--->
-
-Sets the default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
-
-* `value` {boolean} The new default value. The initial default value is `false`.
-
-## `net.getDefaultAutoSelectFamily()`
-
-<!-- YAML
-added: REPLACEME
--->
-
-Gets the current default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
-
-* Returns: {boolean} The current default value of the `autoSelectFamily` option.
-
 ## `net.createServer([options][, connectionListener])`
 
 <!-- YAML
@@ -1640,6 +1620,47 @@ Use `nc` to connect to a Unix domain socket server:
 $ nc -U /tmp/echo.sock
 ```
 
+## `net.getDefaultAutoSelectFamily()`
+
+<!-- YAML
+added: v19.4.0
+-->
+
+Gets the current default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
+
+* Returns: {boolean} The current default value of the `autoSelectFamily` option.
+
+## `net.setDefaultAutoSelectFamily(value)`
+
+<!-- YAML
+added: v19.4.0
+-->
+
+Sets the default value of the `autoSelectFamily` option of [`socket.connect(options)`][].
+
+* `value` {boolean} The new default value. The initial default value is `false`.
+
+## `net.getDefaultAutoSelectFamilyAttemptTimeout()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Gets the current default value of the `autoSelectFamilyAttemptTimeout` option of [`socket.connect(options)`][].
+
+* Returns: {number} The current default value of the `autoSelectFamilyAttemptTimeout` option.
+
+## `net.setDefaultAutoSelectFamilyAttemptTimeout(value)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Sets the default value of the `autoSelectFamilyAttemptTimeout` option of [`socket.connect(options)`][].
+
+* `value` {number} The new default value, which must be a positive number. If the number is less than `10`,
+  the value `10` is used insted The initial default value is `250`.
+
 ## `net.isIP(input)`
 
 <!-- YAML
@@ -1725,6 +1746,7 @@ net.isIPv6('fhqwhgads'); // returns false
 [`net.createConnection(port, host)`]: #netcreateconnectionport-host-connectlistener
 [`net.createServer()`]: #netcreateserveroptions-connectionlistener
 [`net.setDefaultAutoSelectFamily(value)`]: #netsetdefaultautoselectfamilyvalue
+[`net.setDefaultAutoSelectFamilyAttemptTimeout(value)`]: #netsetdefaultautoselectfamilyattempttimeoutvalue
 [`new net.Socket(options)`]: #new-netsocketoptions
 [`readable.setEncoding()`]: stream.md#readablesetencodingencoding
 [`server.close()`]: #serverclosecallback
diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index 1eff3b3fba8a05..79be1cc009ec42 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -54,7 +54,7 @@ const EE = require('events');
 const net = require('net');
 const tls = require('tls');
 const common = require('_tls_common');
-const { kWrapConnectedHandle } = require('internal/net');
+const { kReinitializeHandle } = require('internal/net');
 const JSStreamSocket = require('internal/js_stream_socket');
 const { Buffer } = require('buffer');
 let debug = require('internal/util/debuglog').debuglog('tls', (fn) => {
@@ -633,14 +633,27 @@ TLSSocket.prototype._wrapHandle = function(wrap, handle) {
   return res;
 };
 
-TLSSocket.prototype[kWrapConnectedHandle] = function(handle) {
-  this._handle = this._wrapHandle(null, handle);
+TLSSocket.prototype[kReinitializeHandle] = function reinitializeHandle(handle) {
+  const originalServername = this._handle.getServername();
+  const originalSession = this._handle.getSession();
+
+  this.handle = this._wrapHandle(null, handle);
   this.ssl = this._handle;
+
+  net.Socket.prototype[kReinitializeHandle].call(this, this.handle);
   this._init();
 
   if (this._tlsOptions.enableTrace) {
     this._handle.enableTrace();
   }
+
+  if (originalSession) {
+    this.setSession(originalSession);
+  }
+
+  if (originalServername) {
+    this.setServername(originalServername);
+  }
 };
 
 // This eliminates a cyclic reference to TLSWrap
@@ -679,6 +692,30 @@ TLSSocket.prototype._destroySSL = function _destroySSL() {
   this[kIsVerified] = false;
 };
 
+function keylogNewListener(event) {
+  if (event !== 'keylog')
+    return;
+
+  // Guard against enableKeylogCallback after destroy
+  if (!this._handle) return;
+  this._handle.enableKeylogCallback();
+
+  // Remove this listener since it's no longer needed.
+  this.removeListener('newListener', keylogNewListener);
+}
+
+function newListener(event) {
+  if (event !== 'session')
+    return;
+
+  // Guard against enableSessionCallbacks after destroy
+  if (!this._handle) return;
+  this._handle.enableSessionCallbacks();
+
+  // Remove this listener since it's no longer needed.
+  this.removeListener('newListener', newListener);
+}
+
 // Constructor guts, arbitrarily factored out.
 let warnOnTlsKeylog = true;
 let warnOnTlsKeylogError = true;
@@ -704,18 +741,9 @@ TLSSocket.prototype._init = function(socket, wrap) {
 
   // Only call .onkeylog if there is a keylog listener.
   ssl.onkeylog = onkeylog;
-  this.on('newListener', keylogNewListener);
 
-  function keylogNewListener(event) {
-    if (event !== 'keylog')
-      return;
-
-    // Guard against enableKeylogCallback after destroy
-    if (!this._handle) return;
-    this._handle.enableKeylogCallback();
-
-    // Remove this listener since it's no longer needed.
-    this.removeListener('newListener', keylogNewListener);
+  if (this.listenerCount('newListener', keylogNewListener) === 0) {
+    this.on('newListener', keylogNewListener);
   }
 
   if (options.isServer) {
@@ -750,18 +778,8 @@ TLSSocket.prototype._init = function(socket, wrap) {
     ssl.onnewsession = onnewsessionclient;
 
     // Only call .onnewsession if there is a session listener.
-    this.on('newListener', newListener);
-
-    function newListener(event) {
-      if (event !== 'session')
-        return;
-
-      // Guard against enableSessionCallbacks after destroy
-      if (!this._handle) return;
-      this._handle.enableSessionCallbacks();
-
-      // Remove this listener since it's no longer needed.
-      this.removeListener('newListener', newListener);
+    if (this.listenerCount('newListener', newListener) === 0) {
+      this.on('newListener', newListener);
     }
   }
 
diff --git a/lib/internal/net.js b/lib/internal/net.js
index 786b03f2c34d8c..32825d4a72ac65 100644
--- a/lib/internal/net.js
+++ b/lib/internal/net.js
@@ -67,7 +67,7 @@ function makeSyncWrite(fd) {
 }
 
 module.exports = {
-  kWrapConnectedHandle: Symbol('wrapConnectedHandle'),
+  kReinitializeHandle: Symbol('reinitializeHandle'),
   isIP,
   isIPv4,
   isIPv6,
diff --git a/lib/net.js b/lib/net.js
index ecc0f078f59dc4..f04f62cce15bef 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -43,7 +43,7 @@ let debug = require('internal/util/debuglog').debuglog('net', (fn) => {
   debug = fn;
 });
 const {
-  kWrapConnectedHandle,
+  kReinitializeHandle,
   isIP,
   isIPv4,
   isIPv6,
@@ -55,6 +55,7 @@ const {
   UV_EADDRINUSE,
   UV_EINVAL,
   UV_ENOTCONN,
+  UV_ECANCELED,
 } = internalBinding('uv');
 
 const { Buffer } = require('buffer');
@@ -132,6 +133,7 @@ let dns;
 let BlockList;
 let SocketAddress;
 let autoSelectFamilyDefault = getOptionValue('--enable-network-family-autoselection');
+let autoSelectFamilyAttemptTimeoutDefault = 250;
 
 const { clearTimeout, setTimeout } = require('timers');
 const { kTimeout } = require('internal/timers');
@@ -254,6 +256,20 @@ function setDefaultAutoSelectFamily(value) {
   autoSelectFamilyDefault = value;
 }
 
+function getDefaultAutoSelectFamilyAttemptTimeout() {
+  return autoSelectFamilyAttemptTimeoutDefault;
+}
+
+function setDefaultAutoSelectFamilyAttemptTimeout(value) {
+  validateInt32(value, 'value', 1);
+
+  if (value < 1) {
+    value = 10;
+  }
+
+  autoSelectFamilyAttemptTimeoutDefault = value;
+}
+
 // Returns an array [options, cb], where options is an object,
 // cb is either a function or null.
 // Used to normalize arguments of Socket.prototype.connect() and
@@ -694,7 +710,11 @@ function tryReadStart(socket) {
 
 // Just call handle.readStart until we have enough in the buffer
 Socket.prototype._read = function(n) {
-  debug('_read');
+  debug(
+    '_read - n', n,
+    'isConnecting?', !!this.connecting,
+    'hasHandle?', !!this._handle,
+  );
 
   if (this.connecting || !this._handle) {
     debug('_read wait for connection');
@@ -1034,7 +1054,7 @@ function internalConnect(
       localAddress = localAddress || DEFAULT_IPV6_ADDR;
       err = self._handle.bind6(localAddress, localPort, flags);
     }
-    debug('binding to localAddress: %s and localPort: %d (addressType: %d)',
+    debug('connect: binding to localAddress: %s and localPort: %d (addressType: %d)',
           localAddress, localPort, addressType);
 
     err = checkBindError(err, localPort, self._handle);
@@ -1045,6 +1065,8 @@ function internalConnect(
     }
   }
 
+  debug('connect: attempting to connect to %s:%d (addressType: %d)', address, port, addressType);
+
   if (addressType === 6 || addressType === 4) {
     const req = new TCPConnectWrap();
     req.oncomplete = afterConnect;
@@ -1081,17 +1103,17 @@ function internalConnect(
 }
 
 
-function internalConnectMultiple(context) {
+function internalConnectMultiple(context, canceled) {
   clearTimeout(context[kTimeout]);
   const self = context.socket;
-  assert(self.connecting);
 
   // All connections have been tried without success, destroy with error
-  if (context.current === context.addresses.length) {
+  if (canceled || context.current === context.addresses.length) {
     self.destroy(aggregateErrors(context.errors));
     return;
   }
 
+  assert(self.connecting);
 
   const current = context.current++;
   const handle = current === 0 ? self._handle : new TCP(TCPConstants.SOCKET);
@@ -1120,6 +1142,8 @@ function internalConnectMultiple(context) {
     }
   }
 
+  debug('connect/multiple: attempting to connect to %s:%d (addressType: %d)', address, port, addressType);
+
   const req = new TCPConnectWrap();
   req.oncomplete = FunctionPrototypeBind(afterConnectMultiple, undefined, context, current);
   req.address = address;
@@ -1213,6 +1237,15 @@ Socket.prototype.connect = function(...args) {
   return this;
 };
 
+Socket.prototype[kReinitializeHandle] = function reinitializeHandle(handle) {
+  this._handle?.close();
+
+  this._handle = handle;
+  this._handle[owner_symbol] = this;
+
+  initSocketHandle(this);
+};
+
 function socketToDnsFamily(family) {
   switch (family) {
     case 'IPv4':
@@ -1260,7 +1293,7 @@ function lookupAndConnect(self, options) {
       autoSelectFamilyAttemptTimeout = 10;
     }
   } else {
-    autoSelectFamilyAttemptTimeout = 250;
+    autoSelectFamilyAttemptTimeout = autoSelectFamilyAttemptTimeoutDefault;
   }
 
   // If host is an IP, skip performing a lookup
@@ -1302,17 +1335,19 @@ function lookupAndConnect(self, options) {
     debug('connect: autodetecting');
 
     dnsopts.all = true;
-    lookupAndConnectMultiple(
-      self,
-      async_id_symbol,
-      lookup,
-      host,
-      options,
-      dnsopts,
-      port,
-      localPort,
-      autoSelectFamilyAttemptTimeout,
-    );
+    defaultTriggerAsyncIdScope(self[async_id_symbol], function() {
+      lookupAndConnectMultiple(
+        self,
+        async_id_symbol,
+        lookup,
+        host,
+        options,
+        dnsopts,
+        port,
+        localPort,
+        autoSelectFamilyAttemptTimeout,
+      );
+    });
 
     return;
   }
@@ -1360,6 +1395,8 @@ function lookupAndConnectMultiple(self, async_id_symbol, lookup, host, options,
       if (!self.connecting) {
         return;
       } else if (err) {
+        self.emit('lookup', err, undefined, undefined, host);
+
         // net.createConnection() creates a net.Socket object and immediately
         // calls net.Socket.connect() on it (that's us). There are no event
         // listeners registered yet so defer the error event to the next tick.
@@ -1559,7 +1596,7 @@ function afterConnectMultiple(context, current, status, handle, req, readable, w
     ArrayPrototypePush(context.errors, ex);
 
     // Try the next address
-    internalConnectMultiple(context);
+    internalConnectMultiple(context, status === UV_ECANCELED);
     return;
   }
 
@@ -1570,13 +1607,9 @@ function afterConnectMultiple(context, current, status, handle, req, readable, w
     return;
   }
 
-  // Perform initialization sequence on the handle, then move on with the regular callback
-  self._handle = handle;
-  initSocketHandle(self);
-
-  if (self[kWrapConnectedHandle]) {
-    self[kWrapConnectedHandle](handle);
-    initSocketHandle(self); // This is called again to initialize the TLSWrap
+  if (context.current > 1 && self[kReinitializeHandle]) {
+    self[kReinitializeHandle](handle);
+    handle = self._handle;
   }
 
   if (hasObserver('net')) {
@@ -2295,4 +2328,6 @@ module.exports = {
   Stream: Socket, // Legacy naming
   getDefaultAutoSelectFamily,
   setDefaultAutoSelectFamily,
+  getDefaultAutoSelectFamilyAttemptTimeout,
+  setDefaultAutoSelectFamilyAttemptTimeout,
 };
diff --git a/test/parallel/test-http-autoselectfamily.js b/test/parallel/test-http-autoselectfamily.js
index da81ce9a0146f1..6749d960f9122a 100644
--- a/test/parallel/test-http-autoselectfamily.js
+++ b/test/parallel/test-http-autoselectfamily.js
@@ -7,14 +7,12 @@ const assert = require('assert');
 const dgram = require('dgram');
 const { Resolver } = require('dns');
 const { request, createServer } = require('http');
+const { setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
 
 // Test that happy eyeballs algorithm is properly implemented when using HTTP.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
@@ -77,7 +75,6 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
         {
           lookup,
           autoSelectFamily: true,
-          autoSelectFamilyAttemptTimeout
         },
         (res) => {
           assert.strictEqual(res.statusCode, 200);
@@ -122,7 +119,6 @@ if (common.hasIPv6) {
           {
             lookup,
             autoSelectFamily: true,
-            autoSelectFamilyAttemptTimeout,
           },
           (res) => {
             assert.strictEqual(res.statusCode, 200);
diff --git a/test/parallel/test-http2-ping-settings-heapdump.js b/test/parallel/test-http2-ping-settings-heapdump.js
index 7d27310700c7a8..775110c098607b 100644
--- a/test/parallel/test-http2-ping-settings-heapdump.js
+++ b/test/parallel/test-http2-ping-settings-heapdump.js
@@ -11,6 +11,14 @@ const v8 = require('v8');
 // after it is destroyed, either because they are detached from it or have been
 // destroyed themselves.
 
+// We use an higher autoSelectFamilyAttemptTimeout in this test as the v8.getHeapSnapshot().resume()
+// will slow the connection flow and we don't want the second connection attempt to start.
+let autoSelectFamilyAttemptTimeout = common.platformTimeout(1000);
+if (common.isWindows) {
+  // Some of the windows machines in the CI need more time to establish connection
+  autoSelectFamilyAttemptTimeout = common.platformTimeout(10000);
+}
+
 for (const variant of ['ping', 'settings']) {
   const server = http2.createServer();
   server.on('session', common.mustCall((session) => {
@@ -30,7 +38,7 @@ for (const variant of ['ping', 'settings']) {
   }));
 
   server.listen(0, common.mustCall(() => {
-    const client = http2.connect(`http://localhost:${server.address().port}`,
+    const client = http2.connect(`http://localhost:${server.address().port}`, { autoSelectFamilyAttemptTimeout },
                                  common.mustCall());
     client.on('error', (err) => {
       // We destroy the session so it's possible to get ECONNRESET here.
diff --git a/test/parallel/test-https-autoselectfamily.js b/test/parallel/test-https-autoselectfamily.js
index 71a69f2fb20c63..422e4759022cd7 100644
--- a/test/parallel/test-https-autoselectfamily.js
+++ b/test/parallel/test-https-autoselectfamily.js
@@ -13,6 +13,7 @@ const assert = require('assert');
 const dgram = require('dgram');
 const { Resolver } = require('dns');
 const { request, createServer } = require('https');
+const { setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
@@ -24,11 +25,8 @@ const options = {
 
 // Test that happy eyeballs algorithm is properly implemented when using HTTP.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
@@ -93,8 +91,6 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
           lookup,
           rejectUnauthorized: false,
           autoSelectFamily: true,
-          autoSelectFamilyAttemptTimeout,
-          servername: 'example.org',
         },
         (res) => {
           assert.strictEqual(res.statusCode, 200);
@@ -142,8 +138,6 @@ if (common.hasIPv6) {
             lookup,
             rejectUnauthorized: false,
             autoSelectFamily: true,
-            autoSelectFamilyAttemptTimeout,
-            servername: 'example.org',
           },
           (res) => {
             assert.strictEqual(res.statusCode, 200);
diff --git a/test/parallel/test-net-autoselectfamily-commandline-option.js b/test/parallel/test-net-autoselectfamily-commandline-option.js
index 78c8a81b0ef126..555423374187b9 100644
--- a/test/parallel/test-net-autoselectfamily-commandline-option.js
+++ b/test/parallel/test-net-autoselectfamily-commandline-option.js
@@ -8,15 +8,12 @@ const { parseDNSPacket, writeDNSPacket } = require('../common/dns');
 const assert = require('assert');
 const dgram = require('dgram');
 const { Resolver } = require('dns');
-const { createConnection, createServer } = require('net');
+const { createConnection, createServer, setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
 
 // Test that happy eyeballs algorithm can be enable from command line.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
@@ -82,7 +79,6 @@ function createDnsServer(ipv6Addr, ipv4Addr, cb) {
         host: 'example.org',
         port: port,
         lookup,
-        autoSelectFamilyAttemptTimeout,
       });
 
       let response = '';
diff --git a/test/parallel/test-net-autoselectfamily-ipv4first.js b/test/parallel/test-net-autoselectfamily-ipv4first.js
index 00bff09ac6dde8..794f7464a80639 100644
--- a/test/parallel/test-net-autoselectfamily-ipv4first.js
+++ b/test/parallel/test-net-autoselectfamily-ipv4first.js
@@ -6,15 +6,12 @@ const { parseDNSPacket, writeDNSPacket } = require('../common/dns');
 const assert = require('assert');
 const dgram = require('dgram');
 const { Resolver } = require('dns');
-const { createConnection, createServer } = require('net');
+const { createConnection, createServer, setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
 
 // Test that happy eyeballs algorithm is properly implemented when a A record is returned first.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
@@ -88,7 +85,6 @@ if (common.hasIPv6) {
           port,
           lookup,
           autoSelectFamily: true,
-          autoSelectFamilyAttemptTimeout
         });
 
         let response = '';
diff --git a/test/parallel/test-net-autoselectfamily.js b/test/parallel/test-net-autoselectfamily.js
index 2c1fef1c205865..e9539e73fd08e8 100644
--- a/test/parallel/test-net-autoselectfamily.js
+++ b/test/parallel/test-net-autoselectfamily.js
@@ -10,11 +10,11 @@ const { createConnection, createServer } = require('net');
 
 // Test that happy eyeballs algorithm is properly implemented.
 
-let autoSelectFamilyAttemptTimeout = common.platformTimeout(250);
-if (common.isWindows) {
-  // Some of the windows machines in the CI need more time to establish connection
-  autoSelectFamilyAttemptTimeout = common.platformTimeout(1500);
-}
+// Purposely not using setDefaultAutoSelectFamilyAttemptTimeout here to test the
+// parameter is correctly used in options.
+//
+// Some of the windows machines in the CI need more time to establish connection
+const autoSelectFamilyAttemptTimeout = common.platformTimeout(common.isWindows ? 1500 : 250);
 
 function _lookup(resolver, hostname, options, cb) {
   resolver.resolve(hostname, 'ANY', (err, replies) => {
diff --git a/test/parallel/test-net-dns-custom-lookup.js b/test/parallel/test-net-dns-custom-lookup.js
index a7c05c82b95419..e1e425abd0beb8 100644
--- a/test/parallel/test-net-dns-custom-lookup.js
+++ b/test/parallel/test-net-dns-custom-lookup.js
@@ -26,13 +26,22 @@ function check(addressType, cb) {
 
   function lookup(host, dnsopts, cb) {
     dnsopts.family = addressType;
+
     if (addressType === 4) {
       process.nextTick(function() {
-        cb(null, common.localhostIPv4, 4);
+        if (dnsopts.all) {
+          cb(null, [{ address: common.localhostIPv4, family: 4 }]);
+        } else {
+          cb(null, common.localhostIPv4, 4);
+        }
       });
     } else {
       process.nextTick(function() {
-        cb(null, '::1', 6);
+        if (dnsopts.all) {
+          cb(null, [{ address: '::1', family: 6 }]);
+        } else {
+          cb(null, '::1', 6);
+        }
       });
     }
   }
@@ -48,7 +57,11 @@ check(4, function() {
     host: 'localhost',
     port: 80,
     lookup(host, dnsopts, cb) {
-      cb(null, undefined, 4);
+      if (dnsopts.all) {
+        cb(null, [{ address: undefined, family: 4 }]);
+      } else {
+        cb(null, undefined, 4);
+      }
     }
   }).on('error', common.expectsError({ code: 'ERR_INVALID_IP_ADDRESS' }));
 }
diff --git a/test/parallel/test-net-dns-lookup.js b/test/parallel/test-net-dns-lookup.js
index 8c7bbef128d7b1..8ef0382ae1a816 100644
--- a/test/parallel/test-net-dns-lookup.js
+++ b/test/parallel/test-net-dns-lookup.js
@@ -31,10 +31,10 @@ const server = net.createServer(function(client) {
 
 server.listen(0, common.mustCall(function() {
   net.connect(this.address().port, 'localhost')
-    .on('lookup', common.mustCall(function(err, ip, type, host) {
+    .on('lookup', common.mustCallAtLeast(function(err, ip, type, host) {
       assert.strictEqual(err, null);
       assert.match(ip, /^(127\.0\.0\.1|::1)$/);
       assert.match(type.toString(), /^(4|6)$/);
       assert.strictEqual(host, 'localhost');
-    }));
+    }, 1));
 }));
diff --git a/test/parallel/test-net-options-lookup.js b/test/parallel/test-net-options-lookup.js
index 0341a9f8d546b5..9a7ab00de96fba 100644
--- a/test/parallel/test-net-options-lookup.js
+++ b/test/parallel/test-net-options-lookup.js
@@ -36,7 +36,11 @@ function connectDoesNotThrow(input) {
 {
   // Verify that an error is emitted when an invalid address family is returned.
   const s = connectDoesNotThrow((host, options, cb) => {
-    cb(null, '127.0.0.1', 100);
+    if (options.all) {
+      cb(null, [{ address: '127.0.0.1', family: 100 }]);
+    } else {
+      cb(null, '127.0.0.1', 100);
+    }
   });
 
   s.on('error', common.expectsError({
diff --git a/test/parallel/test-net-server-reset.js b/test/parallel/test-net-server-reset.js
index ea78cd2743298e..3f9c049f3c3c36 100644
--- a/test/parallel/test-net-server-reset.js
+++ b/test/parallel/test-net-server-reset.js
@@ -20,17 +20,11 @@ server.on('close', common.mustCall());
 
 assert.strictEqual(server, server.listen(0, () => {
   net.createConnection(server.address().port)
-    .on('error', common.mustCall(
-      common.expectsError({
-        code: 'ECONNRESET',
-        name: 'Error'
-      }))
-    );
+    .on('error', common.mustCall((error) => {
+      assert.strictEqual(error.code, 'ECONNRESET');
+    }));
   net.createConnection(server.address().port)
-    .on('error', common.mustCall(
-      common.expectsError({
-        code: 'ECONNRESET',
-        name: 'Error'
-      }))
-    );
+    .on('error', common.mustCall((error) => {
+      assert.strictEqual(error.code, 'ECONNRESET');
+    }));
 }));
diff --git a/test/parallel/test-net-socket-connect-invalid-autoselectfamilyattempttimeout.js b/test/parallel/test-net-socket-connect-invalid-autoselectfamilyattempttimeout.js
index b7bd1ec0751ae8..adec8200f697d2 100644
--- a/test/parallel/test-net-socket-connect-invalid-autoselectfamilyattempttimeout.js
+++ b/test/parallel/test-net-socket-connect-invalid-autoselectfamilyattempttimeout.js
@@ -1,5 +1,7 @@
 'use strict';
+
 require('../common');
+
 const assert = require('assert');
 const net = require('net');
 
@@ -11,4 +13,8 @@ for (const autoSelectFamilyAttemptTimeout of [-10, 0]) {
       autoSelectFamilyAttemptTimeout,
     });
   }, { code: 'ERR_OUT_OF_RANGE' });
+
+  assert.throws(() => {
+    net.setDefaultAutoSelectFamilyAttemptTimeout(autoSelectFamilyAttemptTimeout);
+  }, { code: 'ERR_OUT_OF_RANGE' });
 }
diff --git a/test/parallel/test-tls-autoselectfamily-servername.js b/test/parallel/test-tls-autoselectfamily-servername.js
new file mode 100644
index 00000000000000..f2b0f7b3499b85
--- /dev/null
+++ b/test/parallel/test-tls-autoselectfamily-servername.js
@@ -0,0 +1,37 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
+const { connect } = require('tls');
+
+// Some of the windows machines in the CI need more time to establish connection
+setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
+
+// Test that TLS connecting works without autoSelectFamily
+{
+  const socket = connect({
+    host: 'google.com',
+    port: 443,
+    servername: 'google.com',
+    autoSelectFamily: false,
+  });
+
+  socket.on('secureConnect', common.mustCall(() => socket.end()));
+}
+
+// Test that TLS connecting works with autoSelectFamily
+{
+  const socket = connect({
+    host: 'google.com',
+    port: 443,
+    servername: 'google.com',
+    autoSelectFamily: true,
+  });
+
+  socket.on('secureConnect', common.mustCall(() => socket.end()));
+}

From 009414ec671e679671d84b0f22085e8d9bacd1e2 Mon Sep 17 00:00:00 2001
From: Paolo Insogna <paolo@cowtech.it>
Date: Fri, 26 May 2023 16:28:34 +0200
Subject: [PATCH 2/4] net: fix family autoselection SSL connection handling

PR-URL: https://github.com/nodejs/node/pull/48189
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
---
 lib/_tls_wrap.js                              |  4 ++--
 ...est-https-autoselectfamily-slow-timeout.js | 20 +++++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 test/internet/test-https-autoselectfamily-slow-timeout.js

diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index 79be1cc009ec42..5950c52c1dc2ec 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -634,8 +634,8 @@ TLSSocket.prototype._wrapHandle = function(wrap, handle) {
 };
 
 TLSSocket.prototype[kReinitializeHandle] = function reinitializeHandle(handle) {
-  const originalServername = this._handle.getServername();
-  const originalSession = this._handle.getSession();
+  const originalServername = this.ssl ? this._handle.getServername() : null;
+  const originalSession = this.ssl ? this._handle.getSession() : null;
 
   this.handle = this._wrapHandle(null, handle);
   this.ssl = this._handle;
diff --git a/test/internet/test-https-autoselectfamily-slow-timeout.js b/test/internet/test-https-autoselectfamily-slow-timeout.js
new file mode 100644
index 00000000000000..ea8f1374c01a23
--- /dev/null
+++ b/test/internet/test-https-autoselectfamily-slow-timeout.js
@@ -0,0 +1,20 @@
+'use strict';
+
+const common = require('../common');
+const { addresses } = require('../common/internet');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { request } = require('https');
+
+request(
+  `https://${addresses.INET_HOST}/en`,
+  // Purposely set this to false because we want all connection but the last to fail
+  { autoSelectFamily: true, autoSelectFamilyAttemptTimeout: 10 },
+  (res) => {
+    assert.strictEqual(res.statusCode, 200);
+    res.resume();
+  },
+).end();

From bc475f5aded11eb446400f4ff39adda7a6f2f413 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 11 Mar 2023 14:52:43 +0100
Subject: [PATCH 3/4] test: move `test-tls-autoselectfamily-servername` to
 `test/internet`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

And switch from `google.com` to `nodejs.org`.

PR-URL: https://github.com/nodejs/node/pull/47029
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
---
 .../test-tls-autoselectfamily-servername.js   | 37 -------------------
 1 file changed, 37 deletions(-)
 delete mode 100644 test/parallel/test-tls-autoselectfamily-servername.js

diff --git a/test/parallel/test-tls-autoselectfamily-servername.js b/test/parallel/test-tls-autoselectfamily-servername.js
deleted file mode 100644
index f2b0f7b3499b85..00000000000000
--- a/test/parallel/test-tls-autoselectfamily-servername.js
+++ /dev/null
@@ -1,37 +0,0 @@
-'use strict';
-
-const common = require('../common');
-
-if (!common.hasCrypto) {
-  common.skip('missing crypto');
-}
-
-const { setDefaultAutoSelectFamilyAttemptTimeout } = require('net');
-const { connect } = require('tls');
-
-// Some of the windows machines in the CI need more time to establish connection
-setDefaultAutoSelectFamilyAttemptTimeout(common.platformTimeout(common.isWindows ? 1500 : 250));
-
-// Test that TLS connecting works without autoSelectFamily
-{
-  const socket = connect({
-    host: 'google.com',
-    port: 443,
-    servername: 'google.com',
-    autoSelectFamily: false,
-  });
-
-  socket.on('secureConnect', common.mustCall(() => socket.end()));
-}
-
-// Test that TLS connecting works with autoSelectFamily
-{
-  const socket = connect({
-    host: 'google.com',
-    port: 443,
-    servername: 'google.com',
-    autoSelectFamily: true,
-  });
-
-  socket.on('secureConnect', common.mustCall(() => socket.end()));
-}

From afa5fd7372638dc5a5136f252916c27699ef3ede Mon Sep 17 00:00:00 2001
From: rogertyang <rogertyang@tencent.com>
Date: Sat, 15 Jul 2023 09:48:53 +0800
Subject: [PATCH 4/4] tls: fix bugs of double TLS

Fixs two issues in `TLSWrap`, one of them is reported in
https://github.com/nodejs/node/issues/30896.

1. `TLSWrap` has exactly one `StreamListener`, however,
that `StreamListener` can be replaced. We have not been
rigorous enough here: if an active write has not been
finished before the transition, the finish callback of it
will be wrongly fired the successor `StreamListener`.

2. A `TLSWrap` does not allow more than one active write,
as checked in the assertion about current_write in
`TLSWrap::DoWrite()`.

However, when users make use of an existing `tls.TLSSocket`
to establish double TLS, by
either
  tls.connect({socket: tlssock})
or
  tlsServer.emit('connection', tlssock)
we have both of the user provided `tls.TLSSocket`, tlssock and
a brand new created `TLSWrap` writing to the `TLSWrap` bound to
tlssock, which easily violates the constranint because two writers
have no idea of each other.

The design of the fix is:
when a `TLSWrap` is created on top of a user provided socket,
do not send any data to the socket until all existing writes
of the socket are done and ensure registered callbacks of
those writes can be fired.

PR-URL: https://github.com/nodejs/node/pull/48969
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 lib/_tls_wrap.js                              | 68 ++++++++++----
 src/crypto/crypto_tls.cc                      | 48 +++++++++-
 src/crypto/crypto_tls.h                       |  9 +-
 test/parallel/test-double-tls-client.js       | 58 ++++++++++++
 test/parallel/test-double-tls-server.js       | 94 +++++++++++++++++++
 ...cket-writes-before-passed-to-tls-socket.js | 42 +++++++++
 test/sequential/test-async-wrap-getasyncid.js |  2 +-
 7 files changed, 297 insertions(+), 24 deletions(-)
 create mode 100644 test/parallel/test-double-tls-client.js
 create mode 100644 test/parallel/test-double-tls-server.js
 create mode 100644 test/parallel/test-socket-writes-before-passed-to-tls-socket.js

diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index 5950c52c1dc2ec..84599102be4b74 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -502,17 +502,28 @@ function TLSSocket(socket, opts) {
   this[kPendingSession] = null;
 
   let wrap;
-  if ((socket instanceof net.Socket && socket._handle) || !socket) {
-    // 1. connected socket
-    // 2. no socket, one will be created with net.Socket().connect
-    wrap = socket;
+  let handle;
+  let wrapHasActiveWriteFromPrevOwner;
+
+  if (socket) {
+    if (socket instanceof net.Socket && socket._handle) {
+      // 1. connected socket
+      wrap = socket;
+    } else {
+      // 2. socket has no handle so it is js not c++
+      // 3. unconnected sockets are wrapped
+      // TLS expects to interact from C++ with a net.Socket that has a C++ stream
+      // handle, but a JS stream doesn't have one. Wrap it up to make it look like
+      // a socket.
+      wrap = new JSStreamSocket(socket);
+    }
+
+    handle = wrap._handle;
+    wrapHasActiveWriteFromPrevOwner = wrap.writableLength > 0;
   } else {
-    // 3. socket has no handle so it is js not c++
-    // 4. unconnected sockets are wrapped
-    // TLS expects to interact from C++ with a net.Socket that has a C++ stream
-    // handle, but a JS stream doesn't have one. Wrap it up to make it look like
-    // a socket.
-    wrap = new JSStreamSocket(socket);
+    // 4. no socket, one will be created with net.Socket().connect
+    wrap = null;
+    wrapHasActiveWriteFromPrevOwner = false;
   }
 
   // Just a documented property to make secure sockets
@@ -520,7 +531,7 @@ function TLSSocket(socket, opts) {
   this.encrypted = true;
 
   ReflectApply(net.Socket, this, [{
-    handle: this._wrapHandle(wrap),
+    handle: this._wrapHandle(wrap, handle, wrapHasActiveWriteFromPrevOwner),
     allowHalfOpen: socket ? socket.allowHalfOpen : tlsOptions.allowHalfOpen,
     pauseOnCreate: tlsOptions.pauseOnConnect,
     manualStart: true,
@@ -539,6 +550,21 @@ function TLSSocket(socket, opts) {
   if (enableTrace && this._handle)
     this._handle.enableTrace();
 
+  if (wrapHasActiveWriteFromPrevOwner) {
+    // `wrap` is a streams.Writable in JS. This empty write will be queued
+    // and hence finish after all existing writes, which is the timing
+    // we want to start to send any tls data to `wrap`.
+    wrap.write('', (err) => {
+      if (err) {
+        debug('error got before writing any tls data to the underlying stream');
+        this.destroy(err);
+        return;
+      }
+
+      this._handle.writesIssuedByPrevListenerDone();
+    });
+  }
+
   // Read on next tick so the caller has a chance to setup listeners
   process.nextTick(initRead, this, socket);
 }
@@ -599,11 +625,14 @@ TLSSocket.prototype.disableRenegotiation = function disableRenegotiation() {
   this[kDisableRenegotiation] = true;
 };
 
-TLSSocket.prototype._wrapHandle = function(wrap, handle) {
-  if (!handle && wrap) {
-    handle = wrap._handle;
-  }
-
+/**
+ *
+ * @param {null|net.Socket} wrap
+ * @param {null|object} handle
+ * @param {boolean} wrapHasActiveWriteFromPrevOwner
+ * @returns {object}
+ */
+TLSSocket.prototype._wrapHandle = function(wrap, handle, wrapHasActiveWriteFromPrevOwner) {
   const options = this._tlsOptions;
   if (!handle) {
     handle = options.pipe ?
@@ -620,7 +649,10 @@ TLSSocket.prototype._wrapHandle = function(wrap, handle) {
   if (!(context.context instanceof NativeSecureContext)) {
     throw new ERR_TLS_INVALID_CONTEXT('context');
   }
-  const res = tls_wrap.wrap(handle, context.context, !!options.isServer);
+
+  const res = tls_wrap.wrap(handle, context.context,
+                            !!options.isServer,
+                            wrapHasActiveWriteFromPrevOwner);
   res._parent = handle;  // C++ "wrap" object: TCPWrap, JSStream, ...
   res._parentWrap = wrap;  // JS object: net.Socket, JSStreamSocket, ...
   res._secureContext = context;
@@ -637,7 +669,7 @@ TLSSocket.prototype[kReinitializeHandle] = function reinitializeHandle(handle) {
   const originalServername = this.ssl ? this._handle.getServername() : null;
   const originalSession = this.ssl ? this._handle.getSession() : null;
 
-  this.handle = this._wrapHandle(null, handle);
+  this.handle = this._wrapHandle(null, handle, false);
   this.ssl = this._handle;
 
   net.Socket.prototype[kReinitializeHandle].call(this, this.handle);
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 71d59b511e1736..13937262997365 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -319,12 +319,15 @@ TLSWrap::TLSWrap(Environment* env,
                  Local<Object> obj,
                  Kind kind,
                  StreamBase* stream,
-                 SecureContext* sc)
+                 SecureContext* sc,
+                 UnderlyingStreamWriteStatus under_stream_ws)
     : AsyncWrap(env, obj, AsyncWrap::PROVIDER_TLSWRAP),
       StreamBase(env),
       env_(env),
       kind_(kind),
-      sc_(sc) {
+      sc_(sc),
+      has_active_write_issued_by_prev_listener_(
+          under_stream_ws == UnderlyingStreamWriteStatus::kHasActive) {
   MakeWeak();
   CHECK(sc_);
   ssl_ = sc_->CreateSSL();
@@ -434,14 +437,19 @@ void TLSWrap::InitSSL() {
 void TLSWrap::Wrap(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
-  CHECK_EQ(args.Length(), 3);
+  CHECK_EQ(args.Length(), 4);
   CHECK(args[0]->IsObject());
   CHECK(args[1]->IsObject());
   CHECK(args[2]->IsBoolean());
+  CHECK(args[3]->IsBoolean());
 
   Local<Object> sc = args[1].As<Object>();
   Kind kind = args[2]->IsTrue() ? Kind::kServer : Kind::kClient;
 
+  UnderlyingStreamWriteStatus under_stream_ws =
+      args[3]->IsTrue() ? UnderlyingStreamWriteStatus::kHasActive
+                        : UnderlyingStreamWriteStatus::kVacancy;
+
   StreamBase* stream = StreamBase::FromObject(args[0].As<Object>());
   CHECK_NOT_NULL(stream);
 
@@ -452,7 +460,8 @@ void TLSWrap::Wrap(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  TLSWrap* res = new TLSWrap(env, obj, kind, stream, Unwrap<SecureContext>(sc));
+  TLSWrap* res = new TLSWrap(
+      env, obj, kind, stream, Unwrap<SecureContext>(sc), under_stream_ws);
 
   args.GetReturnValue().Set(res->object());
 }
@@ -558,6 +567,13 @@ void TLSWrap::EncOut() {
     return;
   }
 
+  if (UNLIKELY(has_active_write_issued_by_prev_listener_)) {
+    Debug(this,
+          "Returning from EncOut(), "
+          "has_active_write_issued_by_prev_listener_ is true");
+    return;
+  }
+
   // Split-off queue
   if (established_ && current_write_) {
     Debug(this, "EncOut() write is scheduled");
@@ -628,6 +644,15 @@ void TLSWrap::EncOut() {
 
 void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {
   Debug(this, "OnStreamAfterWrite(status = %d)", status);
+
+  if (UNLIKELY(has_active_write_issued_by_prev_listener_)) {
+    Debug(this, "Notify write finish to the previous_listener_");
+    CHECK_EQ(write_size_, 0);  // we must have restrained writes
+
+    previous_listener_->OnStreamAfterWrite(req_wrap, status);
+    return;
+  }
+
   if (current_empty_write_) {
     Debug(this, "Had empty write");
     BaseObjectPtr<AsyncWrap> current_empty_write =
@@ -1974,6 +1999,16 @@ void TLSWrap::GetALPNNegotiatedProto(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(result);
 }
 
+void TLSWrap::WritesIssuedByPrevListenerDone(
+    const FunctionCallbackInfo<Value>& args) {
+  TLSWrap* w;
+  ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
+
+  Debug(w, "WritesIssuedByPrevListenerDone is called");
+  w->has_active_write_issued_by_prev_listener_ = false;
+  w->EncOut();  // resume all of our restrained writes
+}
+
 void TLSWrap::Cycle() {
   // Prevent recursion
   if (++cycle_depth_ > 1)
@@ -2050,6 +2085,10 @@ void TLSWrap::Initialize(
   SetProtoMethod(isolate, t, "setSession", SetSession);
   SetProtoMethod(isolate, t, "setVerifyMode", SetVerifyMode);
   SetProtoMethod(isolate, t, "start", Start);
+  SetProtoMethod(isolate,
+                 t,
+                 "writesIssuedByPrevListenerDone",
+                 WritesIssuedByPrevListenerDone);
 
   SetProtoMethodNoSideEffect(
       isolate, t, "exportKeyingMaterial", ExportKeyingMaterial);
@@ -2131,6 +2170,7 @@ void TLSWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetSharedSigalgs);
   registry->Register(GetTLSTicket);
   registry->Register(VerifyError);
+  registry->Register(WritesIssuedByPrevListenerDone);
 
 #ifdef SSL_set_max_send_fragment
   registry->Register(SetMaxSendFragment);
diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
index 5d1b24ff772328..01414efc6b0258 100644
--- a/src/crypto/crypto_tls.h
+++ b/src/crypto/crypto_tls.h
@@ -48,6 +48,8 @@ class TLSWrap : public AsyncWrap,
     kServer
   };
 
+  enum class UnderlyingStreamWriteStatus { kHasActive, kVacancy };
+
   static void Initialize(v8::Local<v8::Object> target,
                          v8::Local<v8::Value> unused,
                          v8::Local<v8::Context> context,
@@ -136,7 +138,8 @@ class TLSWrap : public AsyncWrap,
           v8::Local<v8::Object> obj,
           Kind kind,
           StreamBase* stream,
-          SecureContext* sc);
+          SecureContext* sc,
+          UnderlyingStreamWriteStatus under_stream_ws);
 
   static void SSLInfoCallback(const SSL* ssl_, int where, int ret);
   void InitSSL();
@@ -216,6 +219,8 @@ class TLSWrap : public AsyncWrap,
   static void Start(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void VerifyError(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Wrap(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void WritesIssuedByPrevListenerDone(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
 
 #ifdef SSL_set_max_send_fragment
   static void SetMaxSendFragment(
@@ -283,6 +288,8 @@ class TLSWrap : public AsyncWrap,
 
   BIOPointer bio_trace_;
 
+  bool has_active_write_issued_by_prev_listener_ = false;
+
  public:
   std::vector<unsigned char> alpn_protos_;  // Accessed by SelectALPNCallback.
 };
diff --git a/test/parallel/test-double-tls-client.js b/test/parallel/test-double-tls-client.js
new file mode 100644
index 00000000000000..8309a1b9559c7a
--- /dev/null
+++ b/test/parallel/test-double-tls-client.js
@@ -0,0 +1,58 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+if (!common.hasCrypto) common.skip('missing crypto');
+const fixtures = require('../common/fixtures');
+const tls = require('tls');
+
+// In reality, this can be a HTTP CONNECT message, signaling the incoming
+// data is TLS encrypted
+const HEAD = 'XXXX';
+
+const subserver = tls.createServer({
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+})
+  .on('secureConnection', common.mustCall(() => {
+    process.exit(0);
+  }));
+
+const server = tls.createServer({
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+})
+  .listen(client)
+  .on('secureConnection', (serverTlsSock) => {
+    serverTlsSock.on('data', (chunk) => {
+      assert.strictEqual(chunk.toString(), HEAD);
+      subserver.emit('connection', serverTlsSock);
+    });
+  });
+
+function client() {
+  const down = tls.connect({
+    host: '127.0.0.1',
+    port: server.address().port,
+    rejectUnauthorized: false
+  }).on('secureConnect', () => {
+    down.write(HEAD, common.mustSucceed());
+
+    // Sending tls data on a client TLSSocket with an active write led to a crash:
+    //
+    //  node[16862]: ../src/crypto/crypto_tls.cc:963:virtual int node::crypto::TLSWrap::DoWrite(node::WriteWrap*,
+    //    uv_buf_t*, size_t, uv_stream_t*): Assertion `!current_write_' failed.
+    //  1: 0xb090e0 node::Abort() [node]
+    //  2: 0xb0915e  [node]
+    //  3: 0xca8413 node::crypto::TLSWrap::DoWrite(node::WriteWrap*, uv_buf_t*, unsigned long, uv_stream_s*) [node]
+    //  4: 0xcaa549 node::StreamBase::Write(uv_buf_t*, unsigned long, uv_stream_s*, v8::Local<v8::Object>) [node]
+    //  5: 0xca88d7 node::crypto::TLSWrap::EncOut() [node]
+    //  6: 0xd3df3e  [node]
+    //  7: 0xd3f35f v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) [node]
+    //  8: 0x15d9ef9  [node]
+    // Aborted
+    tls.connect({
+      socket: down,
+      rejectUnauthorized: false
+    });
+  });
+}
diff --git a/test/parallel/test-double-tls-server.js b/test/parallel/test-double-tls-server.js
new file mode 100644
index 00000000000000..2964748a121159
--- /dev/null
+++ b/test/parallel/test-double-tls-server.js
@@ -0,0 +1,94 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+if (!common.hasCrypto) common.skip('missing crypto');
+const fixtures = require('../common/fixtures');
+const tls = require('tls');
+const net = require('net');
+
+// Sending tls data on a server TLSSocket with an active write led to a crash:
+//
+// node[1296]: ../src/crypto/crypto_tls.cc:963:virtual int node::crypto::TLSWrap::DoWrite(node::WriteWrap*,
+//    uv_buf_t*, size_t, uv_stream_t*): Assertion `!current_write_' failed.
+//  1: 0xb090e0 node::Abort() [node]
+//  2: 0xb0915e  [node]
+//  3: 0xca8413 node::crypto::TLSWrap::DoWrite(node::WriteWrap*, uv_buf_t*, unsigned long, uv_stream_s*) [node]
+//  4: 0xcaa549 node::StreamBase::Write(uv_buf_t*, unsigned long, uv_stream_s*, v8::Local<v8::Object>) [node]
+//  5: 0xca88d7 node::crypto::TLSWrap::EncOut() [node]
+//  6: 0xca9ba8 node::crypto::TLSWrap::OnStreamRead(long, uv_buf_t const&) [node]
+//  7: 0xca8eb0 node::crypto::TLSWrap::ClearOut() [node]
+//  8: 0xca9ba0 node::crypto::TLSWrap::OnStreamRead(long, uv_buf_t const&) [node]
+//  9: 0xbe50dd node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) [node]
+// 10: 0xbe54c4  [node]
+// 11: 0x15583d7  [node]
+// 12: 0x1558c00  [node]
+// 13: 0x155ede4  [node]
+// 14: 0x154d008 uv_run [node]
+
+const serverReplaySize = 2 * 1024 * 1024;
+
+(async function() {
+  const tlsClientHello = await getClientHello();
+
+  const subserver = tls.createServer({
+    key: fixtures.readKey('agent1-key.pem'),
+    cert: fixtures.readKey('agent1-cert.pem'),
+  });
+
+  const server = tls.createServer({
+    key: fixtures.readKey('agent1-key.pem'),
+    cert: fixtures.readKey('agent1-cert.pem'),
+  })
+    .listen(startClient)
+    .on('secureConnection', (serverTlsSock) => {
+      // Craft writes that are large enough to stuck in sending
+      // In reality this can be a 200 response to the incoming HTTP CONNECT
+      const half = Buffer.alloc(serverReplaySize / 2, 0);
+      serverTlsSock.write(half, common.mustSucceed());
+      serverTlsSock.write(half, common.mustSucceed());
+
+      subserver.emit('connection', serverTlsSock);
+    });
+
+
+  function startClient() {
+    const clientTlsSock = tls.connect({
+      host: '127.0.0.1',
+      port: server.address().port,
+      rejectUnauthorized: false,
+    });
+
+    const recv = [];
+    let revcLen = 0;
+    clientTlsSock.on('data', (chunk) => {
+      revcLen += chunk.length;
+      recv.push(chunk);
+      if (revcLen > serverReplaySize) {
+        // Check the server's replay is followed by the subserver's TLS ServerHello
+        const serverHelloFstByte = Buffer.concat(recv).subarray(serverReplaySize, serverReplaySize + 1);
+        assert.strictEqual(serverHelloFstByte.toString('hex'), '16');
+        process.exit(0);
+      }
+    });
+
+    // In reality, one may want to send a HTTP CONNECT before starting this double TLS
+    clientTlsSock.write(tlsClientHello);
+  }
+})().then(common.mustCall());
+
+function getClientHello() {
+  return new Promise((resolve) => {
+    const server = net.createServer((sock) => {
+      sock.on('data', (chunk) => {
+        resolve(chunk);
+      });
+    })
+    .listen(() => {
+      tls.connect({
+        port: server.address().port,
+        host: '127.0.0.1',
+        ALPNProtocols: ['h2'],
+      }).on('error', () => {});
+    });
+  });
+}
diff --git a/test/parallel/test-socket-writes-before-passed-to-tls-socket.js b/test/parallel/test-socket-writes-before-passed-to-tls-socket.js
new file mode 100644
index 00000000000000..22c5b87111579c
--- /dev/null
+++ b/test/parallel/test-socket-writes-before-passed-to-tls-socket.js
@@ -0,0 +1,42 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+if (!common.hasCrypto) common.skip('missing crypto');
+const tls = require('tls');
+const net = require('net');
+
+const HEAD = Buffer.alloc(1024 * 1024, 0);
+
+const server = net.createServer((serverSock) => {
+  let recvLen = 0;
+  const recv = [];
+  serverSock.on('data', common.mustCallAtLeast((chunk) => {
+    recv.push(chunk);
+    recvLen += chunk.length;
+
+    // Check that HEAD is followed by a client hello
+    if (recvLen > HEAD.length) {
+      const clientHelloFstByte = Buffer.concat(recv).subarray(HEAD.length, HEAD.length + 1);
+      assert.strictEqual(clientHelloFstByte.toString('hex'), '16');
+      process.exit(0);
+    }
+  }, 1));
+})
+  .listen(client);
+
+function client() {
+  const socket = net.createConnection({
+    host: '127.0.0.1',
+    port: server.address().port,
+  });
+  socket.write(HEAD.subarray(0, HEAD.length / 2), common.mustSucceed());
+
+  // This write will be queued by streams.Writable, the super class of net.Socket,
+  // which will dequeue this write when it gets notified about the finish of the first write.
+  // We had a bug that it wouldn't get notified. This test verifies the bug is fixed.
+  socket.write(HEAD.subarray(HEAD.length / 2), common.mustSucceed());
+
+  tls.connect({
+    socket,
+  });
+}
diff --git a/test/sequential/test-async-wrap-getasyncid.js b/test/sequential/test-async-wrap-getasyncid.js
index de7af137c47489..2f1cc19b49905b 100644
--- a/test/sequential/test-async-wrap-getasyncid.js
+++ b/test/sequential/test-async-wrap-getasyncid.js
@@ -292,7 +292,7 @@ if (common.hasCrypto) { // eslint-disable-line node-core/crypto-check
 
   // TLSWrap is exposed, but needs to be instantiated via tls_wrap.wrap().
   const tls_wrap = internalBinding('tls_wrap');
-  testInitialized(tls_wrap.wrap(tcp, credentials.context, true), 'TLSWrap');
+  testInitialized(tls_wrap.wrap(tcp, credentials.context, true, false), 'TLSWrap');
 }
 
 {