socketduct 0.1.15

package/test/integration/tls-forwarding.test.js

@@ -0,0 +1,748 @@
+import assert from "node:assert/strict"
+import {connect as tlsConnect} from "node:tls"
+import {createConnection, createServer} from "node:net"
+import {mkdtemp, rm} from "node:fs/promises"
+import {mkdtempSync} from "node:fs"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import {readFileSync} from "node:fs"
+import test from "node:test"
+
+import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
+import {SocketductSocket, connectSocketduct} from "../../src/client/socketduct-socket.js"
+import {startTcpEdge} from "../../src/edge/tcp-edge.js"
+import {encodeCompactData, encodeFrame, FrameDecoder} from "../../src/protocol/frame.js"
+import {startTcpRelay} from "../../src/proxy/tcp-relay.js"
+import {SessionStore} from "../../src/sessions/session.js"
+import {SessionSpool} from "../../src/spool/spool-file.js"
+import {generateTestCertificates} from "../helpers/tls-certificates.js"
+
+/**
+ * @param {import('node:net').Server} server - Server to bind.
+ * @returns {Promise<number>} - Bound port.
+ */
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject)
+      resolve(undefined)
+    })
+  })
+  const address = server.address()
+  if (address === null || typeof address === "string") {
+    throw new Error("Server did not bind to a TCP port")
+  }
+  return /** @type {import('node:net').AddressInfo} */ (address).port
+}
+
+/**
+ * @param {import('node:net').Socket | import('../../src/client/socketduct-socket.js').SocketductSocket} socket - Socket to read from.
+ * @returns {Promise<Buffer>} - Next data chunk.
+ */
+async function readOnce(socket) {
+  return new Promise((resolve) => {
+    socket.once("data", (chunk) => resolve(chunk))
+  })
+}
+
+/**
+ * @param {import('node:net').Socket} socket - Socket to wait on.
+ * @returns {Promise<void>} - Resolves after connection.
+ */
+async function waitConnect(socket) {
+  await new Promise((resolve, reject) => {
+    socket.once("error", reject)
+    socket.once("connect", () => {
+      socket.off("error", reject)
+      resolve(undefined)
+    })
+  })
+}
+
+test("TLS relay forwards traffic and edge replays after reconnect", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-tls-forwarding-"))
+  const certs = generateTestCertificates(certDir)
+
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tls-edge-spool-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+  })
+
+  const tlsSocket = tlsConnect({
+    host: "127.0.0.1",
+    port: relay.port,
+    ca: readFileSync(certs.caCertFile),
+    rejectUnauthorized: true
+  })
+
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tlsSocket)
+
+  const createdPromise = new Promise((resolve) => {
+    tlsSocket.on("data", (chunk) => {
+      for (const frame of decoder.push(chunk)) {
+        if (frame.header.type === "session.created") {
+          resolve(frame.header)
+        }
+      }
+    })
+  })
+
+  tlsSocket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "tls-forward-session",
+    identifier: "tls-forward-session",
+    target: {host: "127.0.0.1", port: targetPort},
+    framing: [2]
+  }))
+
+  const created = await createdPromise
+  assert.equal(/** @type {{type: string}} */ (created).type, "session.created")
+
+  const echoPromise = new Promise((resolve) => {
+    tlsSocket.on("data", (chunk) => {
+      for (const frame of decoder.push(chunk)) {
+        if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+          resolve(frame.payload.toString("utf8"))
+        }
+      }
+    })
+  })
+
+  tlsSocket.write(encodeCompactData({sequence: 8, payload: Buffer.from("tls-echo")}))
+
+  const echoed = await echoPromise
+  assert.equal(echoed, "tls-echo")
+
+  tlsSocket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+  await rm(certDir, {recursive: true, force: true})
+})
+
+test("TLS relay with mTLS rejects client without valid certificate (handshake completes, server closes)", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-reject-"))
+  const certs = generateTestCertificates(certDir)
+
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+  })
+
+  const unauthorizedSocket = tlsConnect({
+    host: "127.0.0.1",
+    port: relay.port,
+    ca: readFileSync(certs.caCertFile),
+    rejectUnauthorized: false
+  })
+
+  let dataReceived = false
+  unauthorizedSocket.on("data", () => { dataReceived = true })
+
+  await new Promise((resolve) => {
+    unauthorizedSocket.once("error", () => resolve("error"))
+    unauthorizedSocket.once("close", () => resolve("close"))
+  })
+
+  assert.equal(dataReceived, false, "client without mTLS certificate must not receive data from the relay")
+
+  unauthorizedSocket.destroy()
+  await relay.close()
+  await rm(certDir, {recursive: true, force: true})
+})
+
+test("TLS relay with mTLS accepts client with valid certificate", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-accept-"))
+  const certs = generateTestCertificates(certDir)
+
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+  })
+
+  const clientSocket = tlsConnect({
+    host: "127.0.0.1",
+    port: relay.port,
+    ca: readFileSync(certs.caCertFile),
+    cert: readFileSync(certs.clientCertFile),
+    key: readFileSync(certs.clientKeyFile),
+    rejectUnauthorized: true
+  })
+
+  const decoder = new FrameDecoder()
+  await waitConnect(clientSocket)
+
+  const sessionPromise = new Promise((resolve) => {
+    clientSocket.on("data", (chunk) => {
+      for (const frame of decoder.push(chunk)) {
+        if (frame.header.type === "session.created" || frame.header.type === "error") {
+          resolve(frame.header)
+        }
+      }
+    })
+  })
+
+  clientSocket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "mtls-session",
+    target: {host: "127.0.0.1", port: targetPort},
+    framing: [2]
+  }))
+
+  const response = await sessionPromise
+  assert.equal(/** @type {{type: string}} */ (response).type, "session.created")
+
+  clientSocket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(certDir, {recursive: true, force: true})
+})
+
+test("TLS relay with mTLS requires certificate from the configured client CA (handshake completes, server closes)", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-wrong-ca-"))
+  const wrongCertDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-wrong-ca-alt-"))
+  const certs = generateTestCertificates(certDir)
+  const wrongCerts = generateTestCertificates(wrongCertDir)
+
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+  })
+
+  const clientSocket = tlsConnect({
+    host: "127.0.0.1",
+    port: relay.port,
+    ca: readFileSync(certs.caCertFile),
+    cert: readFileSync(wrongCerts.clientCertFile),
+    key: readFileSync(wrongCerts.clientKeyFile),
+    rejectUnauthorized: false
+  })
+
+  let dataReceived = false
+  clientSocket.on("data", () => { dataReceived = true })
+
+  await new Promise((resolve) => {
+    clientSocket.once("error", () => resolve("error"))
+    clientSocket.once("close", () => resolve("close"))
+  })
+
+  assert.equal(dataReceived, false, "client with wrong-CA certificate must not receive data from the relay")
+
+  clientSocket.destroy()
+  await relay.close()
+  await rm(certDir, {recursive: true, force: true})
+  await rm(wrongCertDir, {recursive: true, force: true})
+})
+
+test("Plaintext client is rejected by TLS relay (no plaintext protocol reply)", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-trust-"))
+  const certs = generateTestCertificates(certDir)
+
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+  })
+
+  const plainSocket = createConnection({host: "127.0.0.1", port: relay.port})
+  await waitConnect(plainSocket)
+  plainSocket.write("GET / HTTP/1.1\r\n\r\n")
+
+  let dataReceived = false
+  plainSocket.on("data", () => { dataReceived = true })
+
+  await new Promise((resolve) => {
+    plainSocket.once("close", () => resolve("close"))
+    plainSocket.once("error", () => resolve("error"))
+  })
+
+  assert.equal(dataReceived, false, "plaintext client must not receive any protocol reply from a TLS relay")
+
+  plainSocket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(certDir, {recursive: true, force: true})
+})
+
+test("Edge with TLS reconnects and replays spooled data after relay tunnel drop", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-edge-tls-replay-"))
+  const certs = generateTestCertificates(certDir)
+
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-edge-tls-replay-spool-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    resumeWindowMs: 1_000,
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+  })
+
+  const edge = await startTcpEdge({
+    relayHost: "127.0.0.1",
+    relayPort: relay.port,
+    token: token.value,
+    sessionName: "edge-tls-replay",
+    spool: new SessionSpool({rootDir: tempDir}),
+    reconnectDelayMs: 10,
+    target: {host: "127.0.0.1", port: targetPort},
+    tls: {caFile: certs.caCertFile, rejectUnauthorized: true}
+  })
+
+  const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
+  await waitConnect(appSocket)
+  appSocket.write("tls-first")
+  assert.equal((await readOnce(appSocket)).toString("utf8"), "tls-first")
+
+  relay.closeActiveTunnel()
+  appSocket.write("tls-second")
+  assert.equal((await readOnce(appSocket)).toString("utf8"), "tls-second")
+
+  appSocket.destroy()
+  await edge.close()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+  await rm(certDir, {recursive: true, force: true})
+})
+
+test("SocketductSocket with valid mTLS client cert is accepted by mTLS relay", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-socket-accept-"))
+  const certs = generateTestCertificates(certDir)
+
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-mtls-socket-spool-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+  })
+
+  const socket = new SocketductSocket({
+    relayHost: "127.0.0.1",
+    relayPort: relay.port,
+    token: token.value,
+    sessionName: "mtls-socket",
+    target: {host: "127.0.0.1", port: targetPort},
+    spool: new SessionSpool({rootDir: tempDir}),
+    reconnectDelayMs: 50,
+    tls: {
+      caFile: certs.caCertFile,
+      certFile: certs.clientCertFile,
+      keyFile: certs.clientKeyFile,
+      rejectUnauthorized: true
+    }
+  })
+
+  socket.connect()
+  await new Promise((resolve, reject) => {
+    socket.once("error", reject)
+    socket.once("connect", () => {
+      socket.off("error", reject)
+      resolve(undefined)
+    })
+  })
+
+  socket.write("mtls-test")
+  assert.equal((await readOnce(socket)).toString("utf8"), "mtls-test")
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+  await rm(certDir, {recursive: true, force: true})
+})
+
+test("SocketductSocket without client cert is rejected by mTLS relay (connect never fires)", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-no-cert-"))
+  const certs = generateTestCertificates(certDir)
+
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-mtls-no-cert-spool-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+  })
+
+  const socket = new SocketductSocket({
+    relayHost: "127.0.0.1",
+    relayPort: relay.port,
+    token: token.value,
+    sessionName: "mtls-no-cert",
+    target: {host: "127.0.0.1", port: targetPort},
+    spool: new SessionSpool({rootDir: tempDir}),
+    reconnectDelayMs: 1000,
+    tls: {
+      caFile: certs.caCertFile,
+      rejectUnauthorized: true
+    }
+  })
+
+  socket.connect()
+
+  let connectFired = false
+  let dataReceived = false
+  socket.on("connect", () => { connectFired = true })
+  socket.on("data", () => { dataReceived = true })
+
+  const error = await new Promise((resolve) => { socket.once("error", resolve) })
+  assert.ok(error instanceof Error, "expected error when mTLS client cert is missing")
+  assert.equal(connectFired, false, "connect must not fire when mTLS client cert is missing")
+  assert.equal(dataReceived, false, "no data must be exchanged without a valid mTLS client cert")
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+  await rm(certDir, {recursive: true, force: true})
+})
+
+test("SocketductSocket with wrong server CA is rejected during TLS handshake (connect never fires)", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-server-ca-"))
+  const wrongCertDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-server-ca-alt-"))
+  const certs = generateTestCertificates(certDir)
+  const wrongCerts = generateTestCertificates(wrongCertDir)
+
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-wrong-server-ca-spool-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+  })
+
+  const socket = connectSocketduct({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    sessionName: "wrong-server-ca",
+    target: {host: "127.0.0.1", port: targetPort},
+    spoolDirectory: tempDir,
+    reconnect: {initialDelayMs: 1000},
+    tls: {
+      caFile: wrongCerts.caCertFile,
+      rejectUnauthorized: true
+    }
+  })
+
+  let connectFired = false
+  let dataReceived = false
+  socket.on("connect", () => { connectFired = true })
+  socket.on("data", () => { dataReceived = true })
+
+  const error = await new Promise((resolve) => { socket.once("error", resolve) })
+  assert.ok(error instanceof Error, "expected error when server CA is untrusted")
+  assert.equal(connectFired, false, "connect must not fire when server CA is untrusted")
+  assert.equal(dataReceived, false, "no data must be exchanged with an untrusted server CA")
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+  await rm(certDir, {recursive: true, force: true})
+  await rm(wrongCertDir, {recursive: true, force: true})
+})
+
+test("TcpEdge with mTLS client cert connects to mTLS relay and forwards data", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-tcp-edge-mtls-"))
+  const certs = generateTestCertificates(certDir)
+
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tcp-edge-mtls-spool-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+  })
+
+  const edge = await startTcpEdge({
+    relayHost: "127.0.0.1",
+    relayPort: relay.port,
+    token: token.value,
+    sessionName: "tcp-edge-mtls",
+    spool: new SessionSpool({rootDir: tempDir}),
+    target: {host: "127.0.0.1", port: targetPort},
+    reconnectDelayMs: 50,
+    tls: {
+      caFile: certs.caCertFile,
+      certFile: certs.clientCertFile,
+      keyFile: certs.clientKeyFile,
+      rejectUnauthorized: true
+    }
+  })
+
+  const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
+  await waitConnect(appSocket)
+  appSocket.write("tcp-edge-mtls")
+  assert.equal((await readOnce(appSocket)).toString("utf8"), "tcp-edge-mtls")
+
+  appSocket.destroy()
+  await edge.close()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+  await rm(certDir, {recursive: true, force: true})
+})
+
+test("TLS SocketductSocket reconnects cleanly when relay closes connection after TLS handshake but before session response", async () => {
+  const certDir = mkdtempSync(join(tmpdir(), "socketduct-tls-pre-session-close-"))
+  const certs = generateTestCertificates(certDir)
+
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tls-pre-session-close-spool-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+  })
+
+  const socket = connectSocketduct({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    sessionName: "tls-pre-session-close",
+    target: {host: "127.0.0.1", port: targetPort},
+    spoolDirectory: tempDir,
+    reconnect: {initialDelayMs: 25},
+    tls: {
+      caFile: certs.caCertFile,
+      rejectUnauthorized: true
+    }
+  })
+
+  let errorEmitted = false
+  socket.on("error", () => { errorEmitted = true })
+
+  let connectCount = 0
+  socket.on("connect", () => { connectCount += 1 })
+
+  // Force-close the relay tunnel after the TLS handshake completes
+  // but before any protocol frame is exchanged. The relay's
+  // secureConnection event fires synchronously inside setupTunnel
+  // — which adds the socket to the tunnel set — so closeActiveTunnel
+  // destroys it before any data event can process session.create.
+  // This proves the vulnerable pre-session branch: the first TLS
+  // connection reaches secureConnect yet is closed before the client
+  // receives session.created / session.resumed.
+  socket.connect()
+  await new Promise((resolve) => {
+    relay.server.once("secureConnection", () => {
+      relay.closeActiveTunnel()
+      resolve(undefined)
+    })
+  })
+
+  assert.equal(socket.pending, true, "socket must still be pending after pre-session forced close")
+
+  // The socket must not be destroyed with an error; it must reconnect
+  // and deliver data on the later connection. "connect" fires only on
+  // the first successful session creation; reconnects emit "ready".
+  await new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error("Timed out waiting for TLS reconnect")), 5000)
+    const onConnect = () => {
+      clearTimeout(timeout)
+      cleanup()
+      resolve(undefined)
+    }
+    const onReady = () => {
+      clearTimeout(timeout)
+      cleanup()
+      resolve(undefined)
+    }
+    const onError = (/** @type {Error} */ err) => {
+      clearTimeout(timeout)
+      cleanup()
+      reject(err)
+    }
+    const cleanup = () => {
+      socket.off("connect", onConnect)
+      socket.off("ready", onReady)
+      socket.off("error", onError)
+    }
+    socket.on("connect", onConnect)
+    socket.on("ready", onReady)
+    socket.on("error", onError)
+  })
+
+  assert.equal(errorEmitted, false, "no error must emit when TLS connection closes before session response")
+  assert.ok(connectCount >= 1, "connect must have fired at least once")
+
+  socket.write("tls-pre-session-reconnect")
+  assert.equal((await readOnce(socket)).toString("utf8"), "tls-pre-session-reconnect")
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+  await rm(certDir, {recursive: true, force: true})
+})