jspurefix 5.8.5 → 5.9.1

package/src/transport/session/session-registry.ts

@@ -0,0 +1,112 @@
+import { SessionId } from '../../store/session-id'
+import { IJsFixLogger } from '../../config/js-fix-logger'
+import { JsFixLoggerFactory } from '../../config/js-fix-logger-factory'
+
+/**
+ * The registry only ever needs to ask a session to stop, so it is typed against
+ * that capability rather than against FixSession.  IJsFixConfig carries a registry,
+ * and FixSession is constructed from IJsFixConfig - depending on the concrete class
+ * here would close an import cycle.
+ */
+export interface IStoppableSession {
+  requestStop: (reason: string) => void
+}
+
+/**
+ * Tracks the live session for each SessionId served by an acceptor.
+ *
+ * FIX allows exactly one active session per (BeginString, SenderCompID,
+ * TargetCompID).  A counterparty whose socket has gone half open - no FIN, no RST,
+ * so node never raises 'end' - will happily open a second connection and log on
+ * again.  Without a registry the acceptor then runs two sessions for one CompID
+ * pair, both writing to the same message store and both stamping sequence numbers,
+ * which corrupts the store and produces sequence errors the peer cannot recover
+ * from.  See https://github.com/TimelordUK/jspurefix/issues/153.
+ *
+ * Ported from cspurefix PureFix.Transport/Session/SessionRegistry.cs.
+ */
+export interface ISessionRegistry {
+  /**
+   * Claim this SessionId for the given session.  Any *different* session already
+   * holding it is stopped first, because its transport is by definition stale.
+   * @returns true when an existing session was stopped
+   */
+  register: (sessionId: SessionId, session: IStoppableSession) => boolean
+  /**
+   * Release this SessionId.  A no-op unless the registered session is this exact
+   * instance - a session which has already been replaced must not evict its
+   * successor on the way out.
+   */
+  unregister: (sessionId: SessionId, session: IStoppableSession) => void
+  /** number of live sessions */
+  readonly count: number
+  /** the SessionId keys currently held, for logging and diagnostics */
+  keys: () => string[]
+  get: (sessionId: SessionId) => IStoppableSession | null
+}
+
+export const REPLACED_BY_NEW_CONNECTION =
+  'replaced by new connection - stopping old session with stale transport'
+
+export class SessionRegistry implements ISessionRegistry {
+  private readonly sessions = new Map<string, IStoppableSession>()
+  private readonly logger: IJsFixLogger | null
+
+  constructor (logFactory?: JsFixLoggerFactory) {
+    this.logger = logFactory?.logger('SessionRegistry') ?? null
+  }
+
+  public get count (): number {
+    return this.sessions.size
+  }
+
+  public keys (): string[] {
+    return Array.from(this.sessions.keys())
+  }
+
+  public get (sessionId: SessionId): IStoppableSession | null {
+    return this.sessions.get(sessionId.toString()) ?? null
+  }
+
+  public register (sessionId: SessionId, session: IStoppableSession): boolean {
+    const key = sessionId.toString()
+    const logger = this.logger
+    logger?.info(`register called for SessionId=${key}, activeSessions=${this.sessions.size}`)
+
+    const existing = this.sessions.get(key)
+    let stoppedOld = false
+
+    if (existing && existing !== session) {
+      logger?.info(`FOUND EXISTING SESSION for ${key} - this is a reconnection scenario`)
+      logger?.info('stopping old session to prevent stale transport writes')
+      this.sessions.set(key, session)
+      // stop after re-pointing the map so the old session's unregister (which runs
+      // synchronously inside requestStop) sees it is no longer the holder
+      existing.requestStop(REPLACED_BY_NEW_CONNECTION)
+      stoppedOld = true
+      logger?.info('old session stopped, new session registered')
+    } else if (existing === session) {
+      logger?.debug(`same session instance already registered for ${key}`)
+    } else {
+      logger?.info(`no existing session found - registering new session: ${key}`)
+      this.sessions.set(key, session)
+    }
+
+    logger?.info(`register complete for ${key}: stoppedOldSession=${stoppedOld}, totalActiveSessions=${this.sessions.size}`)
+    return stoppedOld
+  }
+
+  public unregister (sessionId: SessionId, session: IStoppableSession): void {
+    const key = sessionId.toString()
+    const logger = this.logger
+    logger?.info(`unregister called for SessionId=${key}`)
+
+    if (this.sessions.get(key) === session) {
+      this.sessions.delete(key)
+      logger?.info(`successfully unregistered session: ${key}, remainingActiveSessions=${this.sessions.size}`)
+    } else {
+      // expected when a new connection has already taken this SessionId over
+      logger?.info(`session NOT unregistered (already replaced by new connection or not found): ${key}`)
+    }
+  }
+}

package/src/transport/tcp/tcp-acceptor-listener.ts

@@ -1,4 +1,4 @@
-import { IJsFixConfig } from '../../config'
+import { IJsFixConfig, IJsFixLogger } from '../../config'
 import { FixAcceptor } from '../fix-acceptor'
 import { TcpAcceptor } from './tcp-acceptor'
 import { MsgTransport } from '../factory'
@@ -6,14 +6,23 @@ import { inject, injectable } from 'tsyringe'
 import { FixSession } from '../session/fix-session'
 import { DITokens } from '../../runtime/di-tokens'
 import { FixEntity } from '../fix-entity'
+import { ISessionRegistry, SessionRegistry } from '../session/session-registry'
 
 @injectable()
 export class TcpAcceptorListener extends FixEntity {
   private acceptor: FixAcceptor | null = null
   private resolveStart: ((value: any) => void) | null = null
+  /**
+   * One registry per listener, so a counterparty reconnecting onto a fresh socket
+   * replaces its previous session instead of running alongside it (issue #153).
+   * An application may supply its own via config.sessionRegistry.
+   */
+  public readonly sessionRegistry: ISessionRegistry
 
   constructor (@inject(DITokens.IJsFixConfig) public readonly config: IJsFixConfig) {
     super(config)
+    this.sessionRegistry = config.sessionRegistry ?? new SessionRegistry(config.logFactory)
+    config.sessionRegistry = this.sessionRegistry
   }
 
   async start (): Promise<any> {
@@ -29,24 +38,53 @@ export class TcpAcceptorListener extends FixEntity {
       this.acceptor = acceptor
 
       acceptor.on('transport', (t: MsgTransport) => {
-        logger.info(`creates new transport using DI token ${DITokens.FixSession}.`)
-        const acceptorSession = sessionContainer.resolve<FixSession>(DITokens.FixSession)
+        // resolve from the transport's own scope, not the listener's container, so
+        // this session gets the per-connection description, buffers and message
+        // factory created by TcpAcceptor.  Falls back to the listener container for
+        // transports created outside the acceptor (tests, custom entities).
+        const scope = t.config?.sessionContainer ?? sessionContainer
+        const description = t.config?.description
+        logger.info(`transport ${t.id}: creating session via DI token ${DITokens.FixSession} ` +
+          `[${description?.SenderCompId ?? '?'} -> ${description?.TargetCompID ?? '?'}]`)
+        const acceptorSession = scope.resolve<FixSession>(DITokens.FixSession)
         this.emit('session', acceptorSession, t)
+        // a wildcard acceptor has not claimed its SessionId yet - report again once
+        // the session ends, by which time the registry line is meaningful
+        this.census(logger)
         // Run the session but do NOT close the listener when it ends.
         // The acceptor keeps listening for new connections (reconnects).
         // This matches the C# TcpAcceptorListener accept-loop pattern.
         acceptorSession.run(t).then(() => {
-          logger.info('session ended normally, acceptor continues listening')
+          logger.info(`transport ${t.id}: session ended normally, acceptor continues listening`)
+          this.census(logger)
         }).catch((e: Error) => {
-          logger.warning(`session ended with error: ${e.message}, acceptor continues listening`)
+          logger.warning(`transport ${t.id}: session ended with error: ${e.message}, acceptor continues listening`)
+          this.census(logger)
         })
       })
 
+      acceptor.on('harvested', (tid: number, reason: string) => {
+        logger.info(`transport ${tid} harvested (${reason})`)
+        this.census(logger)
+      })
+
       this.resolveStart = resolve
       acceptor.listen()
     })
   }
 
+  /**
+   * What is actually connected, and which SessionIds are claimed.  Emitted whenever
+   * the population changes so "how many clients do I have, and who are they" is
+   * answerable from the server log alone.
+   */
+  private census (logger: IJsFixLogger): void {
+    const acceptor = this.acceptor as TcpAcceptor | null
+    const transports = acceptor?.liveTransports() ?? []
+    logger.info(`acceptor census: transports=${transports.length} [${transports.join(', ')}] ` +
+      `sessions=${this.sessionRegistry.count} [${this.sessionRegistry.keys().join(', ')}]`)
+  }
+
   /**
    * Explicitly stop the acceptor listener. Call this when the application
    * is shutting down (e.g., timeout, SIGINT). Without this call, the

package/src/transport/tcp/tcp-acceptor.ts

@@ -5,8 +5,10 @@ import { IJsFixConfig, IJsFixLogger } from '../../config'
 import { createServer as netCreateServer, Server, Socket } from 'net'
 import { createServer as tlsCreateServer, TlsOptions, TLSSocket } from 'tls'
 import { TlsOptionsFactory } from './tls-options-factory'
+import { describeNegotiated, describePeerCertificate, describeServerOptions } from './tls-diagnostics'
 import { inject, injectable } from 'tsyringe'
 import { DITokens } from '../../runtime/di-tokens'
+import { makeSessionScope } from '../../runtime/session-scope'
 
 @injectable()
 export class TcpAcceptor extends FixAcceptor {
@@ -40,19 +42,29 @@ export class TcpAcceptor extends FixAcceptor {
       const tlsOptions: TlsOptions | null = tcp?.tls ? TlsOptionsFactory.getTlsOptions(tcp.tls) : null
       this.logger.info('create tls server')
       if (!tlsOptions) return
+      this.logger.info(`tls server options ${describeServerOptions(tlsOptions)}`)
       this.server = tlsCreateServer(tlsOptions, (tlsSocket: TLSSocket) => {
         if (tcp?.tls?.enableTrace) {
           this.logger.info('enabling tls session trace')
           tlsSocket.enableTrace()
         }
-        if (tlsSocket.authorized) {
-          tlsSocket.setEncoding('utf8')
-          const id: number = this.getId()
-          this.logger.info(`tls creates session ${id} ${tlsSocket.authorized}`)
-          this.onSocket(id, tlsSocket, config)
-        } else {
-          this.logger.info('no transport created on tls with no authorized connection')
+        this.logger.info(`tls negotiated ${describeNegotiated(tlsSocket)}`)
+        this.logger.info(`tls peer certificate ${describePeerCertificate(tlsSocket)}`)
+        // mirrors the initiator fix for #94 - an unauthorized peer is only fatal when the
+        // caller has not explicitly opted out.  the default stays secure: rejectUnauthorized
+        // undefined means reject, exactly as before.
+        if (!tlsSocket.authorized && tlsOptions.rejectUnauthorized !== false) {
+          this.logger.warning(`no transport created, unauthorized tls connection: ${String(tlsSocket.authorizationError)}`)
+          tlsSocket.end()
+          return
         }
+        if (!tlsSocket.authorized) {
+          this.logger.warning(`accepting unauthorized tls peer (rejectUnauthorized: false): ${String(tlsSocket.authorizationError)}`)
+        }
+        tlsSocket.setEncoding('utf8')
+        const id: number = this.getId()
+        this.logger.info(`tls creates session ${id} authorized ${tlsSocket.authorized}`)
+        this.onSocket(id, tlsSocket, config)
       })
     } catch (e) {
       this.logger.error(e as Error)
@@ -82,17 +94,50 @@ export class TcpAcceptor extends FixAcceptor {
   }
 
   private onSocket (id: number, socket: Socket, config: IJsFixConfig): void {
-    const transport: MsgTransport = new MsgTransport(id, config, new TcpDuplex(socket))
-    this.saveTransport(id, transport)
+    // Every accepted connection gets its own DI scope: its own parse and transmit
+    // buffers, its own session description (hence its own SessionId and message
+    // store) and its own session message factory.  Without this, concurrent clients
+    // on one listener share buffers and collide on a single store.
+    const sessionConfig = makeSessionScope(config)
+    const remote = `${socket.remoteAddress ?? '?'}:${socket.remotePort ?? 0}`
+    this.applyKeepAlive(id, socket)
+    this.logger.info(`transport ${id} from ${remote} given its own session scope`)
+    const transport: MsgTransport = new MsgTransport(id, sessionConfig, new TcpDuplex(socket))
+    this.saveTransport(id, transport, remote)
     transport.receiver.on('end', () => {
-      this.harvestTransport(id)
+      this.harvestTransport(id, 'peer ended the connection')
     })
     transport.receiver.on('error', (e: Error) => {
       this.logger.error(e)
-      this.harvestTransport(id)
+      this.harvestTransport(id, `receiver error: ${e.message}`)
+    })
+    // 'end' only fires on a clean FIN.  A socket dropped by a firewall, or one this
+    // side destroyed after a failed graceful close, arrives here instead - without
+    // it the transport would sit in the map forever.
+    socket.on('close', (hadError: boolean) => {
+      this.harvestTransport(id, hadError ? 'socket closed after error' : 'socket closed')
     })
   }
 
+  /**
+   * TCP keep-alive is the only mechanism that detects a peer which has vanished
+   * without sending FIN or RST - the half open socket described in issue #153.  The
+   * session level TestRequest timeout is the protocol level backstop; this is the
+   * transport level one.
+   */
+  private applyKeepAlive (id: number, socket: Socket): void {
+    const configured = this.config.description.application?.tcp?.keepAliveMs
+    const keepAliveMs = configured ?? TcpAcceptor.defaultKeepAliveMs
+    if (keepAliveMs <= 0) {
+      this.logger.info(`transport ${id} keep-alive disabled`)
+      return
+    }
+    socket.setKeepAlive(true, keepAliveMs)
+    this.logger.info(`transport ${id} keep-alive enabled, initial delay ${keepAliveMs}ms`)
+  }
+
+  public static defaultKeepAliveMs: number = 30000
+
   public listen (): void {
     const port = this.config.description.application?.tcp?.port
     this.logger.info(`start to listen ${port}`)
@@ -107,20 +152,49 @@ export class TcpAcceptor extends FixAcceptor {
 
   public close (callback?: (err?: Error) => void): void {
     const port = this.config.description.application?.tcp?.port ?? -1
-    this.logger.info(`close listener on port ${port}`)
+    this.logger.info(`close listener on port ${port} with ${this.transportCount} live transport(s)`)
+    // Server.close only stops accepting - it waits for existing connections to go.
+    // Release them, otherwise a shutdown blocks on whichever counterparty happens to
+    // be connected (and forever on one that is half open).
+    Object.keys(this.transports).forEach(id => {
+      const tid = Number(id)
+      this.logger.info(`close: releasing transport ${tid}`)
+      this.transports[tid]?.end()
+    })
     this.server.close(callback)
   }
 
-  private saveTransport (tid: number, transport: MsgTransport): void {
+  /** how many connections this listener currently holds */
+  public get transportCount (): number {
+    return Object.keys(this.transports).length
+  }
+
+  /** ids of the live transports, for a periodic census in the application log */
+  public liveTransports (): string[] {
+    return Object.keys(this.transports).map(id => {
+      const meta = this.accepted[id as any]
+      const age = meta ? Math.round((Date.now() - meta.at) / 1000) : -1
+      return `${id}@${meta?.remote ?? '?'} up ${age}s`
+    })
+  }
+
+  private readonly accepted: Record<number, { remote: string, at: number }> = {}
+
+  private saveTransport (tid: number, transport: MsgTransport, remote: string): void {
     this.transports[tid] = transport
-    const keys: string[] = Object.keys(this.transports)
-    this.logger.info(`new transport id = ${tid} created total transports = ${keys.length}`)
+    this.accepted[tid] = { remote, at: Date.now() }
+    this.logger.info(`new transport id = ${tid} from ${remote} created total transports = ${this.transportCount}`)
     this.emit('transport', transport)
   }
 
-  private harvestTransport (tid: number): void {
+  private harvestTransport (tid: number, reason: string): void {
+    if (!this.transports[tid]) return
+    const meta = this.accepted[tid]
+    const lifetime = meta ? Math.round((Date.now() - meta.at) / 1000) : -1
     delete this.transports[tid]
-    const keys: string[] = Object.keys(this.transports)
-    this.logger.info(`transport ${tid} ends total transports = ${keys.length}`)
+    delete this.accepted[tid]
+    this.logger.info(`transport ${tid} from ${meta?.remote ?? '?'} harvested after ${lifetime}s ` +
+      `(${reason}) total transports = ${this.transportCount}`)
+    this.emit('harvested', tid, reason)
   }
 }

package/src/transport/tcp/tcp-initiator.ts

@@ -9,6 +9,7 @@ import { connect as tlsConnect, ConnectionOptions, TLSSocket } from 'tls'
 import { createConnection } from 'net'
 import Timeout = NodeJS.Timeout
 import { TlsOptionsFactory } from './tls-options-factory'
+import { describeConnectionOptions, describeNegotiated, describePeerCertificate } from './tls-diagnostics'
 import { inject, injectable } from 'tsyringe'
 import { DITokens } from '../../runtime/di-tokens'
 import { ITcpTransportDescription } from './tcp-transport-description'
@@ -67,8 +68,13 @@ export class TcpInitiator extends FixInitiator {
           this.logger.info(`connecting with timeout ${timeoutSeconds}`)
           this.tryConnect()
             .then((t: MsgTransport) => { resolve(t) })
-            .catch((_: Error) => {
-              this.repeatConnect(timeoutSeconds)
+            .catch((first: Error) => {
+              // carry the first failure into repeatConnect.  it used to be discarded, so a
+              // connect() whose timeout expires before the first retry interval fires - the
+              // default case, timeout and reconnectSeconds are both 5 - reported a generic
+              // "timeout whilst connecting" and threw away the reason.  see #94.
+              this.logger.info(`first connect attempt failed: ${first.message}`)
+              this.repeatConnect(timeoutSeconds, first)
                 .then((t: MsgTransport) => { resolve(t) })
                 .catch((e: Error) => { reject(e) })
             })
@@ -120,15 +126,26 @@ export class TcpInitiator extends FixInitiator {
       const connectionOptions: ConnectionOptions | null = tcp ? TlsOptionsFactory.getTlsConnectionOptions(tcp) : null
       if (connectionOptions) {
         try {
+          this.logger.info(`tls connect with ${describeConnectionOptions(connectionOptions)}`)
           tlsSocket = tlsConnect(connectionOptions, () => {
             if (!tlsSocket) return null
             this.logger.info(`client connected ${tlsSocket.authorized ? 'authorized' : 'unauthorized'}`)
-            if (!tlsSocket.authorized) {
+            this.logger.info(`tls negotiated ${describeNegotiated(tlsSocket)}`)
+            this.logger.info(`tls peer certificate ${describePeerCertificate(tlsSocket)}`)
+            // https://github.com/TimelordUK/jspurefix/issues/94 - honour rejectUnauthorized:
+            // false rather than always rejecting on an unauthorized cert. Node's tls.connect()
+            // never throws for an unauthorized peer by itself; it's the caller's job to decide
+            // what to do with tlsSocket.authorized, and rejectUnauthorized is how a caller opts
+            // out of that check - so only reject here when the caller didn't opt out.
+            if (!tlsSocket.authorized && connectionOptions.rejectUnauthorized !== false) {
               const error = tlsSocket.authorizationError
               this.logger.warning(`rejecting from state ${this.state} authorizationError ${error}`)
               tlsSocket.end()
               reject(error)
             } else {
+              if (!tlsSocket.authorized) {
+                this.logger.warning(`proceeding despite unauthorized TLS peer (rejectUnauthorized: false): ${tlsSocket.authorizationError}`)
+              }
               tlsSocket.setEncoding('utf8')
               const tlsDuplex = new TcpDuplex(tlsSocket)
               if (tcp?.tls?.enableTrace) {
@@ -140,6 +157,9 @@ export class TcpInitiator extends FixInitiator {
             }
           })
           tlsSocket.on('error', (err) => {
+            // previously silent - the socket error is the real reason a tls session failed,
+            // and without it the caller only ever sees repeatConnect's generic timeout.
+            this.logger.warning(`tls socket error from state ${this.state}: ${err.message}`)
             reject(err)
           })
         } catch (e) {
@@ -171,14 +191,14 @@ export class TcpInitiator extends FixInitiator {
     }
   }
 
-  private async repeatConnect (timeoutSeconds: number): Promise < MsgTransport > {
+  private async repeatConnect (timeoutSeconds: number, initialError?: Error): Promise < MsgTransport > {
     return await new Promise<MsgTransport>(async (resolve, reject) => {
       const application = this.application
       const promisify = util.promisify
       const timeoutPromise = promisify(setTimeout)
       const reconnectSeconds = application?.reconnectSeconds ?? 5
       let retries = 0
-      let lastError: Error
+      let lastError: Error = initialError as Error
       const name = application?.name ?? 'initiator'
       this.th = setInterval(() => {
         ++retries
@@ -196,6 +216,7 @@ export class TcpInitiator extends FixInitiator {
         this.clearTimer()
         this.state = InitiatorState.Stopped
         const e = lastError ?? new Error(`${name}: timeout of ${timeoutSeconds} whilst connecting`)
+        this.logger.warning(`${name}: giving up after ${timeoutSeconds}s and ${retries} retries, last error: ${e.message}`)
         reject(e)
       }).catch(e => {
         reject(e)

package/src/transport/tcp/tcp-transport-description.ts

@@ -4,4 +4,11 @@ export interface ITcpTransportDescription {
   readonly port: number
   readonly host: string
   readonly tls?: ITlsOptions
+  /**
+   * TCP keep-alive probe delay in milliseconds for connections accepted by this
+   * listener.  Keep-alive is what lets the OS notice a peer that has vanished
+   * without FIN or RST - the half open socket in issue #153.  Set 0 to disable.
+   * Default 30000.
+   */
+  readonly keepAliveMs?: number
 }

package/src/transport/tcp/tls-diagnostics.ts

@@ -0,0 +1,76 @@
+import { ConnectionOptions, TLSSocket, TlsOptions } from 'tls'
+
+/*
+   tls failures are routinely reported as "it just times out" - see issues #94 and #151.  the
+   session either connects or it does not, and nothing in the log says which options were
+   actually applied or what the peer presented.  enableTrace exists but is node's raw handshake
+   trace: all or nothing, written to stderr rather than through IJsFixLogger.
+
+   these helpers render the small number of facts needed to diagnose a handshake, and are
+   deliberately conservative about what they include - never key material, never a full
+   certificate, only the identifying fields of one.
+ */
+
+function describeCommonOptions (options: ConnectionOptions | TlsOptions): string[] {
+  const parts: string[] = []
+  // presence only - the values are private keys and certificate bodies.
+  parts.push(`key ${options.key ? 'supplied' : 'none'}`)
+  parts.push(`cert ${options.cert ? 'supplied' : 'none'}`)
+  const ca = options.ca
+  const caCount = Array.isArray(ca) ? ca.length : (ca ? 1 : 0)
+  parts.push(`ca ${caCount}`)
+  // the whole point of #94/#151 - make it unambiguous which value won.
+  parts.push(`rejectUnauthorized ${String(options.rejectUnauthorized ?? '(default true)')}`)
+  parts.push(`requestCert ${String(options.requestCert ?? '(default false)')}`)
+  if (options.minVersion) parts.push(`minVersion ${options.minVersion}`)
+  if (options.maxVersion) parts.push(`maxVersion ${options.maxVersion}`)
+  return parts
+}
+
+export function describeConnectionOptions (options: ConnectionOptions): string {
+  const parts: string[] = [`host ${options.host ?? '?'}`, `port ${options.port ?? '?'}`]
+  if (options.servername) parts.push(`servername ${options.servername}`)
+  return parts.concat(describeCommonOptions(options)).join(', ')
+}
+
+export function describeServerOptions (options: TlsOptions): string {
+  return describeCommonOptions(options).join(', ')
+}
+
+/*
+   what the handshake actually negotiated.  the maintainer's suggestion in #94 was to reproduce
+   the connection in powershell to see the negotiated suite - this puts the same facts in our
+   own log instead.
+ */
+export function describeNegotiated (socket: TLSSocket): string {
+  const parts: string[] = []
+  parts.push(`protocol ${socket.getProtocol() ?? 'none'}`)
+  const cipher = socket.getCipher()
+  parts.push(`cipher ${cipher ? `${cipher.name} (${cipher.version})` : 'none'}`)
+  parts.push(`authorized ${socket.authorized}`)
+  if (!socket.authorized && socket.authorizationError) {
+    parts.push(`authorizationError ${String(socket.authorizationError)}`)
+  }
+  return parts.join(', ')
+}
+
+/*
+   identifying fields of the peer certificate only.  getPeerCertificate() returns the full DER
+   in .raw plus the public key - none of that belongs in a log, so pick fields explicitly.
+ */
+export function describePeerCertificate (socket: TLSSocket): string {
+  const cert = socket.getPeerCertificate(false)
+  if (!cert || Object.keys(cert).length === 0) {
+    return 'peer presented no certificate'
+  }
+  const subject = cert.subject ? (cert.subject.CN ?? JSON.stringify(cert.subject)) : '?'
+  const issuer = cert.issuer ? (cert.issuer.CN ?? JSON.stringify(cert.issuer)) : '?'
+  const parts: string[] = [
+    `subject ${subject}`,
+    `issuer ${issuer}`,
+    `valid ${cert.valid_from ?? '?'} to ${cert.valid_to ?? '?'}`
+  ]
+  if (cert.subjectaltname) parts.push(`san ${cert.subjectaltname}`)
+  if (cert.fingerprint256) parts.push(`sha256 ${cert.fingerprint256}`)
+  return parts.join(', ')
+}

package/src/transport/tcp/tls-options-factory.ts

@@ -5,6 +5,22 @@ const path = require('path')
 const fs = require('fs')
 
 export class TlsOptionsFactory {
+  /*
+     session descriptions are routinely hand written json, where a boolean flag is easily
+     quoted by mistake i.e. "rejectUnauthorized": "false".  node treats that string as truthy
+     and so does exactly the opposite of what was intended, silently.  accept the two string
+     spellings rather than inverting the caller's meaning - anything else is left alone so it
+     shows up as an obviously wrong value rather than being guessed at.
+   */
+  static asBoolean (value: any): any {
+    if (typeof value === 'string') {
+      const lowered = value.toLowerCase()
+      if (lowered === 'true') return true
+      if (lowered === 'false') return false
+    }
+    return value
+  }
+
   static read (filePath: string): string {
     const root: string = path.join(__dirname, '../../../')
     const fullPath = path.join(root, filePath)
@@ -18,8 +34,8 @@ export class TlsOptionsFactory {
     let tlsOptions: TlsOptions | null = null
     if (tls) {
       tlsOptions = {
-        requestCert: tls.requestCert,
-        rejectUnauthorized: tls.rejectUnauthorized
+        requestCert: TlsOptionsFactory.asBoolean(tls.requestCert),
+        rejectUnauthorized: TlsOptionsFactory.asBoolean(tls.rejectUnauthorized)
       } as TlsOptions
 
       if (tls.key) {
@@ -62,11 +78,27 @@ export class TlsOptionsFactory {
       if (tcp.tls.sessionTimeout) {
         connectionOptions.sessionTimeout = tcp.tls.sessionTimeout
       }
+      // https://github.com/TimelordUK/jspurefix/issues/151 - ITlsOptions declares these and
+      // getTlsOptions honours them on the server path, so map them here too rather than making
+      // nodeTlsConnectionOptions the only spelling that works for an initiator.  Applied before
+      // the spread below so an explicit nodeTlsConnectionOptions value still wins.
+      if (tls.requestCert !== undefined) {
+        connectionOptions.requestCert = TlsOptionsFactory.asBoolean(tls.requestCert)
+      }
+      if (tls.rejectUnauthorized !== undefined) {
+        connectionOptions.rejectUnauthorized = TlsOptionsFactory.asBoolean(tls.rejectUnauthorized)
+      }
       if (tls.nodeTlsConnectionOptions) {
         connectionOptions = {
           ...connectionOptions,
           ...tls.nodeTlsConnectionOptions
         }
+        if (connectionOptions.rejectUnauthorized !== undefined) {
+          connectionOptions.rejectUnauthorized = TlsOptionsFactory.asBoolean(connectionOptions.rejectUnauthorized)
+        }
+        if (connectionOptions.requestCert !== undefined) {
+          connectionOptions.requestCert = TlsOptionsFactory.asBoolean(connectionOptions.requestCert)
+        }
       }
     }
     return connectionOptions