fix(client): reject pipelined TLS altname errors (#5373)

Drain already running requests before rejecting same-servername pending requests so TLS hostname failures reject the request promises instead of tripping the queue assertion.

Fixes #5355

Signed-off-by: marko1olo <barsukdana@gmail.com>

Author: marko1olo

lib/dispatcher/client.js

@@ -568,9 +568,15 @@ function handleConnectError (client, err, { host, hostname, protocol, port }) {
   }
 
   if (err.code === 'ERR_TLS_CERT_ALTNAME_INVALID') {
-    assert(client[kRunning] === 0)
+    const running = client[kQueue].splice(client[kRunningIdx], client[kRunning])
+    client[kPendingIdx] = client[kRunningIdx]
+
+    for (let i = 0; i < running.length; i++) {
+      util.errorRequest(client, running[i], err)
+    }
+
     while (client[kPending] > 0 && client[kQueue][client[kPendingIdx]].servername === client[kServerName]) {
-      const request = client[kQueue][client[kPendingIdx]++]
+      const request = client[kQueue].splice(client[kPendingIdx], 1)[0]
       util.errorRequest(client, request, err)
     }
   } else {

test/node-test/client-tls.js

@@ -0,0 +1,44 @@
+'use strict'
+
+const { test } = require('node:test')
+const assert = require('node:assert')
+const { once } = require('node:events')
+const fs = require('node:fs')
+const https = require('node:https')
+const path = require('node:path')
+const { Pool } = require('../..')
+
+test('TLS altname errors reject pipelined requests', async (t) => {
+  const server = https.createServer({
+    key: fs.readFileSync(path.join(__dirname, '..', 'fixtures', 'key.pem')),
+    cert: fs.readFileSync(path.join(__dirname, '..', 'fixtures', 'cert.pem'))
+  }, (req, res) => {
+    res.end('ok')
+  })
+
+  t.after(() => {
+    server.close()
+  })
+
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+
+  const pool = new Pool(`https://localhost:${server.address().port}`, {
+    connections: 1,
+    pipelining: 10,
+    connect: {
+      ca: fs.readFileSync(path.join(__dirname, '..', 'fixtures', 'ca.pem'))
+    }
+  })
+
+  t.after(async () => {
+    await pool.close().catch(() => {})
+  })
+
+  const settled = await Promise.allSettled(
+    Array.from({ length: 20 }, () => pool.request({ path: '/', method: 'GET' }))
+  )
+
+  assert.ok(settled.every(({ status }) => status === 'rejected'))
+  assert.ok(settled.every(({ reason }) => reason.code === 'ERR_TLS_CERT_ALTNAME_INVALID'))
+})