fix(tls.connect) fix SNI on tls sockets and also servername (mongodb)

packages/bun-types/bun.d.ts

@@ -1646,12 +1646,16 @@ declare module "bun" {
      * File path to a TLS key
      *
      * To enable TLS, this option is required.
+     * 
+     * @deprecated since v0.6.3 - Use `key: Bun.file(path)` instead.
      */
     keyFile: string;
     /**
      * File path to a TLS certificate
      *
      * To enable TLS, this option is required.
+     * 
+     * @deprecated since v0.6.3 - Use `cert: Bun.file(path)` instead.
      */
     certFile: string;
 
@@ -1661,6 +1665,8 @@ declare module "bun" {
     passphrase?: string;
     /**
      *  File path to a .pem file for a custom root CA
+     * 
+     * @deprecated since v0.6.3 - Use `ca: Bun.file(path)` instead.
      */
     caFile?: string;
 
@@ -1680,6 +1686,42 @@ declare module "bun" {
      * @default false
      */
     lowMemoryMode?: boolean;
+
+     /**
+     * Optionally override the trusted CA certificates. Default is to trust
+     * the well-known CAs curated by Mozilla. Mozilla's CAs are completely
+     * replaced when CAs are explicitly specified using this option.
+     */
+     ca?: string | Buffer | BunFile | Array<string | Buffer | BunFile> | undefined;
+     /**
+      *  Cert chains in PEM format. One cert chain should be provided per
+      *  private key. Each cert chain should consist of the PEM formatted
+      *  certificate for a provided private key, followed by the PEM
+      *  formatted intermediate certificates (if any), in order, and not
+      *  including the root CA (the root CA must be pre-known to the peer,
+      *  see ca). When providing multiple cert chains, they do not have to
+      *  be in the same order as their private keys in key. If the
+      *  intermediate certificates are not provided, the peer will not be
+      *  able to validate the certificate, and the handshake will fail.
+      */
+     cert?: string | Buffer | BunFile | Array<string | Buffer | BunFile> | undefined;
+     /**
+      * Private keys in PEM format. PEM allows the option of private keys
+      * being encrypted. Encrypted keys will be decrypted with
+      * options.passphrase. Multiple keys using different algorithms can be
+      * provided either as an array of unencrypted key strings or buffers,
+      * or an array of objects in the form {pem: <string|buffer>[,
+      * passphrase: <string>]}. The object form can only occur in an array.
+      * object.passphrase is optional. Encrypted keys will be decrypted with
+      * object.passphrase if provided, or options.passphrase if it is not.
+      */
+     key?: string | Buffer | BunFile | Array<string | Buffer | BunFile> | undefined;
+     /**
+      * Optionally affect the OpenSSL protocol behavior, which is not
+      * usually necessary. This should be used carefully if at all! Value is
+      * a numeric bitmask of the SSL_OP_* options from OpenSSL Options
+      */
+     secureOptions?: number | undefined; // Value is a numeric bitmask of the `SSL_OP_*` options
   }
 
   export interface TLSServeOptions extends ServeOptions, TLSOptions {

packages/bun-types/tls.d.ts

@@ -12,6 +12,7 @@ declare module "tls" {
   // import { X509Certificate } from "node:crypto";
   import * as net from "node:net";
   import * as stream from "stream";
+  import { BunFile } from "bun";
   const CLIENT_RENEG_LIMIT: number;
   const CLIENT_RENEG_WINDOW: number;
   interface Certificate {
@@ -860,7 +861,7 @@ declare module "tls" {
      * the well-known CAs curated by Mozilla. Mozilla's CAs are completely
      * replaced when CAs are explicitly specified using this option.
      */
-    ca?: string | Buffer | Array<string | Buffer> | undefined;
+    ca?: string | Buffer | BunFile | Array<string | Buffer | BunFile> | undefined;
     /**
      *  Cert chains in PEM format. One cert chain should be provided per
      *  private key. Each cert chain should consist of the PEM formatted
@@ -872,7 +873,7 @@ declare module "tls" {
      *  intermediate certificates are not provided, the peer will not be
      *  able to validate the certificate, and the handshake will fail.
      */
-    cert?: string | Buffer | Array<string | Buffer> | undefined;
+    cert?: string | Buffer | BunFile | Array<string | Buffer | BunFile> | undefined;
     /**
      *  Colon-separated list of supported signature algorithms. The list
      *  can contain digest algorithms (SHA256, MD5 etc.), public key
@@ -930,7 +931,7 @@ declare module "tls" {
      * object.passphrase is optional. Encrypted keys will be decrypted with
      * object.passphrase if provided, or options.passphrase if it is not.
      */
-    key?: string | Buffer | Array<string | Buffer | KeyObject> | undefined;
+    key?: string | Buffer | BunFile | Array<string | Buffer | BunFile | KeyObject> | undefined;
     /**
      * Name of an OpenSSL engine to get private key from. Should be used
      * together with privateKeyIdentifier.

src/bun.js/api/bun/socket.zig

@@ -15,6 +15,7 @@ const JSGlobalObject = JSC.JSGlobalObject;
 const Which = @import("../../../which.zig");
 const uws = @import("root").bun.uws;
 const ZigString = JSC.ZigString;
+const BoringSSL = bun.BoringSSL;
 // const Corker = struct {
 //     ptr: ?*[16384]u8 = null,
 //     holder: ?*anyopaque = null,
@@ -831,6 +832,7 @@ pub const Listener = struct {
                 .handlers = handlers_ptr,
                 .this_value = .zero,
                 .socket = undefined,
+                .connection = connection,
             };
 
             TLSSocket.dataSetCached(tls.getThisValue(globalObject), globalObject, default_data);
@@ -853,6 +855,7 @@ pub const Listener = struct {
                 .handlers = handlers_ptr,
                 .this_value = .zero,
                 .socket = undefined,
+                .connection = null,
             };
 
             TCPSocket.dataSetCached(tcp.getThisValue(globalObject), globalObject, default_data);
@@ -891,6 +894,7 @@ fn NewSocket(comptime ssl: bool) type {
         reffer: JSC.Ref = JSC.Ref.init(),
         last_4: [4]u8 = .{ 0, 0, 0, 0 },
         authorized: bool = false,
+        connection: ?Listener.UnixOrHost = null,
 
         // TODO: switch to something that uses `visitAggregate` and have the
         // `Listener` keep a list of all the sockets JSValue in there
@@ -1068,7 +1072,25 @@ fn NewSocket(comptime ssl: bool) type {
 
         pub fn onOpen(this: *This, socket: Socket) void {
             JSC.markBinding(@src());
-            log("onOpen", .{});
+            log("onOpen ssl: {}", .{comptime ssl});
+
+            // Add SNI support for TLS (mongodb and others requires this)
+            if (comptime ssl) {
+                if (this.connection) |connection| {
+                    if (connection == .host) {
+                        const host = normalizeHost(connection.host.host);
+                        if (host.len > 0) {
+                            var ssl_ptr: *BoringSSL.SSL = @ptrCast(*BoringSSL.SSL, socket.getNativeHandle());
+                            if (!ssl_ptr.isInitFinished()) {
+                                var host__ = default_allocator.dupeZ(u8, host) catch unreachable;
+                                defer default_allocator.free(host__);
+                                ssl_ptr.setHostname(host__);
+                            }
+                        }
+                    }
+                }
+            }
+
             this.poll_ref.ref(this.handlers.vm);
             this.detached = false;
             this.socket = socket;
@@ -1145,6 +1167,7 @@ fn NewSocket(comptime ssl: bool) type {
         }
 
         pub fn onHandshake(this: *This, _: Socket, success: i32, ssl_error: uws.us_bun_verify_error_t) void {
+            log("onHandshake({d})", .{success});
             JSC.markBinding(@src());
 
             const authorized = if (success == 1) true else false;
@@ -1651,6 +1674,10 @@ fn NewSocket(comptime ssl: bool) type {
             if (!this.socket.isClosed()) {
                 this.socket.close(0, null);
             }
+            if (this.connection) |connection| {
+                connection.deinit();
+                this.connection = null;
+            }
             this.markInactive();
             this.poll_ref.unref(JSC.VirtualMachine.get());
         }