tls: initialize session and SNI before connecting

A synchronous custom lookup can abort the socket before tls.connect()
applies the session and SNI, leaving the TLS handle unavailable.
Initialize both before starting the connection so the original
socket error is emitted normally.

Assisted-by: Codex
Signed-off-by: Steven <steven@ceriously.com>
PR-URL: #65624
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: styfle

lib/internal/tls/wrap.js

@@ -1912,6 +1912,12 @@ exports.connect = function connect(...args) {
   if (cb)
     tlssock.once('secureConnect', cb);
 
+  if (options.session)
+    tlssock.setSession(options.session);
+
+  if (options.servername)
+    tlssock.setServername(options.servername);
+
   if (!options.socket) {
     // If user provided the socket, it's their responsibility to manage its
     // connectivity. If we created one internally, we connect it.
@@ -1924,13 +1930,6 @@ exports.connect = function connect(...args) {
 
   tlssock._releaseControl();
 
-  if (options.session)
-    tlssock.setSession(options.session);
-
-  if (options.servername) {
-    tlssock.setServername(options.servername);
-  }
-
   if (options.socket)
     tlssock._start();
 

test/parallel/test-tls-connect-sync-lookup.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const tls = require('node:tls');
+
+// Verify that a synchronous lookup cannot interrupt TLS socket initialization.
+const controller = new AbortController();
+const socket = tls.connect({
+  host: 'example.com',
+  servername: 'example.com',
+  port: 443,
+  signal: controller.signal,
+  lookup(_hostname, _options, callback) {
+    callback(null, [{ address: '2001:db8::1', family: 6 }]);
+    controller.abort();
+  },
+});
+
+socket.on('error', common.mustCall());