socketduct 0.1.15

package/test/integration/socketduct-https-agent.test.js

@@ -0,0 +1,669 @@
+import assert from "node:assert/strict"
+import {createHook} from "node:async_hooks"
+import {once} from "node:events"
+import {mkdtemp, readdir, readFile, rm} from "node:fs/promises"
+import https from "node:https"
+import {createServer as createTcpServer} from "node:net"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import test from "node:test"
+
+import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
+import {SocketductHttpsAgent} from "../../src/client/https-agent.js"
+import {startTcpRelay} from "../../src/proxy/tcp-relay.js"
+import {SessionStore} from "../../src/sessions/session.js"
+import {generateTestCertificates, generateTestServerCertificate} from "../helpers/tls-certificates.js"
+
+/**
+ * @param {import('node:net').Server} server - Server to bind.
+ * @param {number} [port] - Requested port.
+ * @returns {Promise<number>} Bound port.
+ */
+async function listen(server, port = 0) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(port, "127.0.0.1", () => {
+      server.off("error", reject)
+      resolve(undefined)
+    })
+  })
+  const address = server.address()
+  if (address === null || typeof address === "string") throw new Error("server did not bind")
+  return address.port
+}
+
+/**
+ * @param {import('node:net').Server} server - Server to close.
+ * @returns {Promise<void>}
+ */
+async function closeServer(server) {
+  if (!server.listening) return
+  await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve(undefined)))
+}
+
+/**
+ * @param {() => boolean} predicate - Completion predicate.
+ * @param {number} [timeoutMs] - Maximum wait.
+ * @returns {Promise<void>}
+ */
+async function waitUntil(predicate, timeoutMs = 2_000) {
+  const deadline = Date.now() + timeoutMs
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error("timed out waiting for condition")
+    await new Promise((resolve) => setTimeout(resolve, 2))
+  }
+}
+
+/**
+ * @param {() => Promise<boolean>} predicate - Async completion predicate.
+ * @param {number} [timeoutMs] - Maximum wait.
+ * @returns {Promise<void>}
+ */
+async function waitUntilAsync(predicate, timeoutMs = 2_000) {
+  const deadline = Date.now() + timeoutMs
+  while (!await predicate()) {
+    if (Date.now() >= deadline) throw new Error("timed out waiting for async condition")
+    await new Promise((resolve) => setTimeout(resolve, 2))
+  }
+}
+
+/**
+ * @param {string} directory - Directory to read when present.
+ * @returns {Promise<string[]>} Directory entries or an empty list when absent.
+ */
+async function readDirectoryOrEmpty(directory) {
+  return await readdir(directory).catch((error) => {
+    if (error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ENOENT") return []
+    throw error
+  })
+}
+
+/**
+ * @param {import('node:https').RequestOptions} options - Request options.
+ * @param {(socket: import('node:stream').Duplex) => void} [onSocketductSocket] - Optional raw socket observer.
+ * @returns {Promise<{body: string, statusCode: number | undefined}>} Response.
+ */
+async function request(options, onSocketductSocket) {
+  return await new Promise((resolve, reject) => {
+    const req = https.request(options, (res) => {
+      if (onSocketductSocket !== undefined) {
+        const tlsSocket = /** @type {import('node:tls').TLSSocket & {ssl?: {_parentWrap?: {stream?: import('node:stream').Duplex}}}} */ (res.socket)
+        const socket = tlsSocket.ssl?._parentWrap?.stream
+        if (socket === undefined) {
+          reject(new Error("target TLS socket does not expose its wrapped Socketduct stream"))
+          res.destroy()
+          return
+        }
+        onSocketductSocket(socket)
+      }
+      /** @type {Buffer[]} */
+      const chunks = []
+      res.on("data", (chunk) => chunks.push(chunk))
+      res.on("error", reject)
+      res.on("end", () => resolve({body: Buffer.concat(chunks).toString("utf8"), statusCode: res.statusCode}))
+    })
+    req.on("error", reject)
+    req.end()
+  })
+}
+
+/**
+ * @param {number} targetPort - Authorized target port.
+ * @param {Partial<import('../../src/proxy/tcp-relay.js').TcpRelayOptions>} [options] - Relay overrides.
+ * @returns {Promise<{relay: import('../../src/proxy/tcp-relay.js').TcpRelayHandle, sessions: SessionStore, token: import('../../src/auth/user-store.js').AuthToken}>} Relay fixture.
+ */
+async function authenticatedRelay(targetPort, options = {}) {
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1_000, tokenTtlMs: 60_000})
+  await users.createUser({username: "https-user", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "https-user", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1_000})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    initialTargetRetryDelayMs: 10,
+    initialTargetRetryMaxDelayMs: 20,
+    sessions,
+    tokens,
+    ...options
+  })
+  return {relay, sessions, token}
+}
+
+/**
+ * @param {{ca: Buffer, cert?: Buffer, key?: Buffer, servername?: string}} targetTls
+ * @param {{port: number, relay: Awaited<ReturnType<typeof authenticatedRelay>>["relay"], relayTls?: import('../../src/client/socketduct-socket.js').SocketductTlsOptions, spoolDirectory: string, token: {value: string}}} fixture
+ * @returns {SocketductHttpsAgent} Configured agent.
+ */
+function createAgent(targetTls, fixture) {
+  return new SocketductHttpsAgent({
+    relay: {host: "127.0.0.1", port: fixture.relay.port, token: fixture.token.value},
+    ...(fixture.relayTls === undefined ? {} : {relayTls: fixture.relayTls}),
+    target: {host: "127.0.0.1", port: fixture.port},
+    targetTls: {rejectUnauthorized: true, servername: "localhost", ...targetTls},
+    spoolDirectory: fixture.spoolDirectory,
+    sessionNamePrefix: "https-agent",
+    keepAlive: false
+  })
+}
+
+test("SocketductHttpsAgent rejects callback-less direct connections before allocating resources", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-unowned-"))
+  let targetConnections = 0
+  const targetServer = createTcpServer(() => { targetConnections += 1 })
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  const agent = createAgent({ca: Buffer.alloc(0)}, {
+    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+  })
+  try {
+    assert.throws(() => Reflect.apply(agent.createConnection, agent, [{host: "localhost", port: 443}]), {
+      code: "ERR_INVALID_ARG_TYPE"
+    })
+    await new Promise((resolve) => setImmediate(resolve))
+    assert.equal(targetConnections, 0)
+    assert.deepEqual(fixture.relay.status(), {
+      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+    })
+    assert.deepEqual(await readdir(join(root, "spool")).catch((error) => {
+      if (error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ENOENT") return []
+      throw error
+    }), [])
+  } finally {
+    agent.destroy()
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent rejects an already-aborted request before allocating resources", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-pre-aborted-"))
+  let targetConnections = 0
+  const targetServer = createTcpServer(() => { targetConnections += 1 })
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  const agent = createAgent({ca: Buffer.alloc(0)}, {
+    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+  })
+  const controller = new AbortController()
+  controller.abort()
+  try {
+    await assert.rejects(request({agent, host: "localhost", port: 443, path: "/already-aborted", signal: controller.signal}), (error) => {
+      return error instanceof Error && error.name === "AbortError"
+    })
+    await new Promise((resolve) => setImmediate(resolve))
+    assert.equal(targetConnections, 0)
+    assert.equal(fixture.relay.status().sessions, 0)
+    assert.equal(fixture.relay.status().activeTunnels, 0)
+    assert.equal(fixture.relay.status().activeTargets, 0)
+  } finally {
+    agent.destroy()
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent verifies the target CA and logical hostname", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-strict-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const ca = await readFile(certs.caCertFile)
+  const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => {
+    res.writeHead(200)
+    res.end("secure-ok")
+  })
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port, {tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}})
+  const agent = createAgent({ca}, {
+    port,
+    relay: fixture.relay,
+    relayTls: {caFile: certs.caCertFile, servername: "localhost"},
+    spoolDirectory: join(root, "spool"),
+    token: fixture.token
+  })
+  try {
+    assert.deepEqual(await request({agent, host: "localhost", port: 443, path: "/_ping"}), {body: "secure-ok", statusCode: 200})
+  } finally {
+    agent.destroy()
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent omits IP SNI while strictly verifying the target IP", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-ip-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const ca = await readFile(certs.caCertFile)
+  /** @type {Array<string | false | null>} */
+  const servernames = []
+  const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => res.end("ip-ok"))
+  targetServer.on("secureConnection", (socket) => servernames.push(socket.servername))
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  const successAgent = createAgent({ca, servername: "127.0.0.1"}, {
+    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+  })
+  const mismatchAgent = createAgent({ca, servername: "127.0.0.2"}, {
+    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+  })
+  try {
+    assert.equal((await request({agent: successAgent, host: "127.0.0.1", port: 443, path: "/ip"})).body, "ip-ok")
+    successAgent.destroy()
+    await waitUntil(() => fixture.relay.status().sessions === 0)
+    assert.deepEqual(servernames, [false])
+
+    await assert.rejects(request({agent: mismatchAgent, host: "127.0.0.2", port: 443, path: "/ip-mismatch"}), {
+      code: "ERR_TLS_CERT_ALTNAME_INVALID"
+    })
+    mismatchAgent.destroy()
+    await waitUntil(() => fixture.relay.status().sessions === 0)
+  } finally {
+    successAgent.destroy()
+    mismatchAgent.destroy()
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent derives an omitted target TLS identity from the fixed IP without sending SNI", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-derived-ip-"))
+  const certs = generateTestCertificates(join(root, "certs"), {serverSubjectAltName: "IP:127.0.0.1"})
+  const ca = await readFile(certs.caCertFile)
+  /** @type {Array<string | false | null>} */
+  const servernames = []
+  const targetServer = https.createServer({
+    cert: await readFile(certs.serverCertFile),
+    key: await readFile(certs.serverKeyFile)
+  }, (req, res) => res.end("derived-ip-ok"))
+  targetServer.on("secureConnection", (socket) => servernames.push(socket.servername))
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  const spoolDirectory = join(root, "spool")
+  const agent = new SocketductHttpsAgent({
+    relay: {host: "127.0.0.1", port: fixture.relay.port, token: fixture.token.value},
+    target: {host: "127.0.0.1", port},
+    targetTls: {ca, rejectUnauthorized: true},
+    spoolDirectory,
+    keepAlive: false
+  })
+  try {
+    assert.equal((await request({agent, host: "127.0.0.1", port: 443, path: "/derived-ip"})).body, "derived-ip-ok")
+    agent.destroy()
+    await waitUntil(() => {
+      const status = fixture.relay.status()
+      return status.sessions === 0 && status.activeTunnels === 0 && status.activeTargets === 0
+    })
+    assert.deepEqual(servernames, [false])
+    assert.deepEqual(fixture.relay.status(), {
+      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+    })
+    await waitUntilAsync(async () => (await readDirectoryOrEmpty(spoolDirectory)).length === 0)
+    assert.deepEqual(await readDirectoryOrEmpty(spoolDirectory), [])
+  } finally {
+    agent.destroy()
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent rejects a trusted different identity when target TLS servername is omitted", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-derived-ip-mismatch-"))
+  const certs = generateTestCertificates(join(root, "certs"), {serverSubjectAltName: "IP:127.0.0.1"})
+  const wrongCerts = generateTestServerCertificate(join(root, "wrong-certs"), {
+    caCertFile: certs.caCertFile,
+    caKeyFile: certs.caKeyFile,
+    commonName: "localhost",
+    subjectAltName: "DNS:localhost"
+  })
+  const ca = await readFile(certs.caCertFile)
+  const targetServer = https.createServer({
+    cert: await readFile(wrongCerts.serverCertFile),
+    key: await readFile(wrongCerts.serverKeyFile)
+  }, (req, res) => res.end("wrongly-accepted"))
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  const spoolDirectory = join(root, "spool")
+  const agent = new SocketductHttpsAgent({
+    relay: {host: "127.0.0.1", port: fixture.relay.port, token: fixture.token.value},
+    target: {host: "127.0.0.1", port},
+    targetTls: {ca, rejectUnauthorized: true},
+    spoolDirectory,
+    keepAlive: false
+  })
+  try {
+    await assert.rejects(request({agent, host: "127.0.0.1", port: 443, path: "/wrong-identity"}), {
+      code: "ERR_TLS_CERT_ALTNAME_INVALID"
+    })
+    agent.destroy()
+    await waitUntil(() => {
+      const status = fixture.relay.status()
+      return status.sessions === 0 && status.activeTunnels === 0 && status.activeTargets === 0
+    })
+    assert.deepEqual(fixture.relay.status(), {
+      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+    })
+    await waitUntilAsync(async () => (await readDirectoryOrEmpty(spoolDirectory)).length === 0)
+    assert.deepEqual(await readDirectoryOrEmpty(spoolDirectory), [])
+  } finally {
+    agent.destroy()
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent rejects an explicitly empty target TLS servername before allocation", () => {
+  assert.throws(() => new SocketductHttpsAgent({
+    relay: {host: "127.0.0.1", port: 1, token: "unused-test-token"},
+    target: {host: "127.0.0.1", port: 1},
+    targetTls: {servername: ""},
+    spoolDirectory: "/unused"
+  }), /Target TLS servername must be a non-empty string/)
+})
+
+test("SocketductHttpsAgent supports target mTLS", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-mtls-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const ca = await readFile(certs.caCertFile)
+  const targetServer = https.createServer({
+    ca,
+    cert: await readFile(certs.serverCertFile),
+    key: await readFile(certs.serverKeyFile),
+    requestCert: true,
+    rejectUnauthorized: true
+  }, (req, res) => {
+    res.writeHead(200)
+    res.end(/** @type {import('node:tls').TLSSocket} */ (req.socket).authorized ? "mtls-ok" : "unauthorized")
+  })
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  const agent = createAgent({
+    ca,
+    cert: await readFile(certs.clientCertFile),
+    key: await readFile(certs.clientKeyFile)
+  }, {port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token})
+  try {
+    assert.equal((await request({agent, host: "localhost", port: 443, path: "/_ping"})).body, "mtls-ok")
+  } finally {
+    agent.destroy()
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent keeps one target TLS connection through relay interruption", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-resume-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const ca = await readFile(certs.caCertFile)
+  let targetConnections = 0
+  /** @type {(() => void) | undefined} */
+  let releaseResponse
+  const continueResponse = new Promise((resolve) => { releaseResponse = () => resolve(undefined) })
+  /** @type {(() => void) | undefined} */
+  let firstChunkResolve
+  const firstChunk = new Promise((resolve) => { firstChunkResolve = () => resolve(undefined) })
+  const targetServer = https.createServer({
+    cert: await readFile(certs.serverCertFile),
+    key: await readFile(certs.serverKeyFile)
+  }, (req, res) => {
+    res.writeHead(200)
+    res.write("before-")
+    firstChunkResolve?.()
+    void continueResponse.then(() => res.end("after"))
+  })
+  targetServer.on("connection", () => { targetConnections += 1 })
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  const spoolDirectory = join(root, "spool")
+  const agent = createAgent({ca}, {port, relay: fixture.relay, spoolDirectory, token: fixture.token})
+  /** @type {Promise<void> | undefined} */
+  let socketductClosed
+  try {
+    const responsePromise = request(
+      {agent, host: "localhost", port: 443, path: "/stream"},
+      (socket) => { socketductClosed = once(socket, "close").then(() => undefined) }
+    )
+    await firstChunk
+    await waitUntil(() => fixture.relay.status().attachedSessions === 1)
+    await fixture.relay.closeActiveTunnel()
+    await waitUntil(() => fixture.relay.status().attachedSessions === 1)
+    releaseResponse?.()
+    assert.equal((await responsePromise).body, "before-after")
+    assert.equal(targetConnections, 1)
+    agent.destroy()
+    await socketductClosed
+    assert.deepEqual(await readDirectoryOrEmpty(spoolDirectory), [])
+  } finally {
+    releaseResponse?.()
+    agent.destroy()
+    await socketductClosed
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent preserves TLS verification errors and settles its callback once", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-failure-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)})
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  const agent = createAgent({ca: await readFile(certs.caCertFile), servername: "wrong.example.test"}, {
+    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+  })
+  let callbackCount = 0
+  try {
+    const result = await new Promise((resolve) => {
+      agent.createConnection({host: "wrong.example.test", port: 443}, (error, socket) => {
+        callbackCount += 1
+        resolve({error, socket})
+      })
+    })
+    assert.equal(callbackCount, 1)
+    assert.ok(result.error instanceof Error)
+    assert.equal(result.error.code, "ERR_TLS_CERT_ALTNAME_INVALID")
+    assert.equal(result.socket, undefined)
+    await waitUntil(() => fixture.relay.status().sessions === 0).catch(() => {
+      assert.fail(`relay resources after TLS verification failure: ${JSON.stringify(fixture.relay.status())}`)
+    })
+  } finally {
+    agent.destroy()
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent aborts and times out stalled target TLS handshakes without resources", {timeout: 5_000}, async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-stalled-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  /** @type {Set<import('node:net').Socket>} */
+  const accepted = new Set()
+  let acceptedCount = 0
+  /** @type {Set<{count: number, resolve: () => void}>} */
+  const acceptanceWaiters = new Set()
+  const stalledTarget = createTcpServer((socket) => {
+    socket.once("close", () => accepted.delete(socket))
+    socket.once("data", () => {
+      accepted.add(socket)
+      acceptedCount += 1
+      for (const waiter of acceptanceWaiters) {
+        if (acceptedCount < waiter.count) continue
+        acceptanceWaiters.delete(waiter)
+        waiter.resolve()
+      }
+    })
+  })
+  const port = await listen(stalledTarget)
+  const fixture = await authenticatedRelay(port)
+  const agent = createAgent({ca: await readFile(certs.caCertFile)}, {
+    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+  })
+  /**
+   * @param {number} count - Expected accepted sockets.
+   * @returns {Promise<void>}
+   */
+  const waitForAccepted = async (count) => {
+    if (acceptedCount >= count) return
+    await new Promise((resolve) => {
+      acceptanceWaiters.add({count, resolve: () => resolve(undefined)})
+    })
+  }
+  const repeatingTimeouts = new Set()
+  const timeoutHook = createHook({
+    init: (asyncId, type, _triggerAsyncId, resource) => {
+      const repeat = /** @type {{_repeat?: unknown}} */ (resource)._repeat
+      if (type === "Timeout" && typeof repeat === "number" && repeat > 0) repeatingTimeouts.add(asyncId)
+    },
+    destroy: (asyncId) => repeatingTimeouts.delete(asyncId)
+  })
+  try {
+    const controller = new AbortController()
+    /** @type {import('node:http').ClientRequest | undefined} */
+    let signalRequest
+    let signalErrorCount = 0
+    const signalAborted = new Promise((resolve, reject) => {
+      signalRequest = https.request({agent, host: "localhost", port: 443, path: "/signal-abort", signal: controller.signal}, resolve)
+      signalRequest.on("error", (error) => {
+        signalErrorCount += 1
+        reject(error)
+      })
+      signalRequest.end()
+    })
+    void signalAborted.catch(() => {})
+    await waitForAccepted(1)
+    controller.abort()
+    await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0, 100).catch(() => {
+      assert.fail(`relay resources after AbortSignal: ${JSON.stringify(fixture.relay.status())}; accepted=${accepted.size}`)
+    })
+    await assert.rejects(signalAborted, (error) => error instanceof Error && error.name === "AbortError")
+    await new Promise((resolve) => setImmediate(resolve))
+    assert.equal(signalErrorCount, 1)
+    assert.equal(signalRequest?.listeners("abort").some((listener) => listener.name === "abort"), false)
+    assert.equal(signalRequest?.listeners("close").some((listener) => listener.name === "onClose"), false)
+
+    timeoutHook.enable()
+    /** @type {import('node:http').ClientRequest | undefined} */
+    let abortRequest
+    const aborted = new Promise((resolve, reject) => {
+      abortRequest = https.request({agent, host: "localhost", port: 443, path: "/abort"}, resolve)
+      abortRequest.once("error", reject)
+      abortRequest.end()
+    })
+    await waitForAccepted(2)
+    await new Promise((resolve) => setImmediate(resolve))
+    const repeatingTimeoutCount = repeatingTimeouts.size
+    timeoutHook.disable()
+    abortRequest?.abort()
+    await assert.rejects(aborted, (error) => error instanceof Error && error.name === "AbortError")
+    assert.equal(repeatingTimeoutCount, 0, "a pending request must not install a polling timer")
+    await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0).catch(() => {
+      assert.fail(`relay resources after request abort: ${JSON.stringify(fixture.relay.status())}; accepted=${accepted.size}`)
+    })
+
+    const timedOut = assert.rejects(
+      request({agent, host: "localhost", port: 443, path: "/timeout", timeout: 25}),
+      (error) => error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ETIMEDOUT"
+    )
+    await waitForAccepted(3)
+    await timedOut
+    await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0)
+  } finally {
+    timeoutHook.disable()
+    agent.destroy()
+    for (const socket of accepted) socket.destroy()
+    await fixture.relay.close()
+    await closeServer(stalledTarget)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent destroy cancels a stalled handshake exactly once", {timeout: 5_000}, async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-destroy-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  /** @type {((socket: import('node:net').Socket) => void) | undefined} */
+  let acceptedResolve
+  const accepted = new Promise((resolve) => { acceptedResolve = resolve })
+  let targetClosed = false
+  const stalledTarget = createTcpServer((socket) => {
+    socket.once("close", () => { targetClosed = true })
+    socket.once("data", () => acceptedResolve?.(socket))
+  })
+  const port = await listen(stalledTarget)
+  const fixture = await authenticatedRelay(port)
+  const agent = createAgent({ca: await readFile(certs.caCertFile)}, {
+    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+  })
+  let callbackCount = 0
+  const result = new Promise((resolve) => {
+    agent.createConnection({host: "localhost", port: 443}, (error, socket) => {
+      callbackCount += 1
+      resolve({error, socket})
+    })
+  })
+  const targetSocket = /** @type {import('node:net').Socket} */ (await accepted)
+  try {
+    agent.destroy()
+    const settled = await result
+    assert.equal(callbackCount, 1)
+    assert.ok(settled.error instanceof Error)
+    assert.equal(settled.socket, undefined)
+    await waitUntil(() => fixture.relay.status().sessions === 0 && targetClosed).catch(() => {
+      assert.fail(`relay resources after agent destroy: ${JSON.stringify(fixture.relay.status())}; targetClosed=${targetClosed}`)
+    })
+  } finally {
+    agent.destroy()
+    targetSocket.destroy()
+    await fixture.relay.close()
+    await closeServer(stalledTarget)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpsAgent repeated success and verification failure returns to baseline without spool leaks", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-https-bounded-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const ca = await readFile(certs.caCertFile)
+  const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => res.end("ok"))
+  const port = await listen(targetServer)
+  const fixture = await authenticatedRelay(port)
+  try {
+    for (let index = 0; index < 3; index += 1) {
+      const successAgent = createAgent({ca}, {port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token})
+      assert.equal((await request({agent: successAgent, host: "localhost", port: 443, path: `/ok-${index}`})).body, "ok")
+      successAgent.destroy()
+      await waitUntil(() => fixture.relay.status().sessions === 0)
+
+      const failureAgent = createAgent({ca, servername: "wrong.example.test"}, {
+        port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+      })
+      await assert.rejects(request({agent: failureAgent, host: "localhost", port: 443, path: `/fail-${index}`}), {
+        code: "ERR_TLS_CERT_ALTNAME_INVALID"
+      })
+      failureAgent.destroy()
+      await waitUntil(() => fixture.relay.status().sessions === 0)
+      assert.equal(fixture.relay.status().activeTargets, 0)
+      assert.equal(fixture.relay.status().targetConnectionAttempts, 0)
+      assert.equal(fixture.relay.status().targetRetryTimers, 0)
+    }
+    const readSpoolEntries = async () => await readdir(join(root, "spool")).catch((error) => {
+      if (error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ENOENT") return []
+      throw error
+    })
+    await waitUntilAsync(async () => (await readSpoolEntries()).length === 0)
+    const spoolEntries = await readSpoolEntries()
+    assert.deepEqual(spoolEntries, [])
+  } finally {
+    await fixture.relay.close()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})