From 4b909a76bc6da7c95c9402ecce0ff98471d14c5e Mon Sep 17 00:00:00 2001
From: Dirk Wetter <dirk@testssl.sh>
Date: Thu, 3 Sep 2026 16:18:19 +0200
Subject: [PATCH] Use IO::Socket::INET instead of IPC::Run

- hardcode days and protocol as they don't matter
- got rid of the ugly system call with nc
---
 t/40_tls13.only.t | 116 +++++++++++++++++++++++++---------------------
 1 file changed, 63 insertions(+), 53 deletions(-)
 mode change 100755 => 100644 t/40_tls13.only.t

diff --git a/t/40_tls13.only.t b/t/40_tls13.only.t
old mode 100755
new mode 100644
index 8a76ea5..ee4b2ff
--- a/t/40_tls13.only.t
+++ b/t/40_tls13.only.t
@@ -1,58 +1,47 @@
 #!/usr/bin/env perl
 
-# As the name indicates: Check for TLS 1.3 only hosts
+# As the name indicates: Check for TLS 1.3 only hosts. It just run the protocol section, there
+# it checks for TLS 1.2 (disabled) and TLS 1.3 (enabled)
 
 use strict;
 use warnings;
 use Test::More;
-use IPC::Run qw( start timeout );
+use IO::Socket::INET;
 use File::Temp qw( tempdir );
 use File::Basename;
-use File::Path qw( remove_tree );
-use File::Copy;
 
 my $port = 1443;
-my $server_script;
-my $temp_dir;
+my $temp_dir = tempdir(CLEANUP => 1);
+my $server_script = "$temp_dir/start_server.sh";
 
-BEGIN {
-    $temp_dir = tempdir(CLEANUP => 1);
-    # Path to the testssl.sh script (assuming we are in the project root)
-    $server_script = "$temp_dir/start_server.sh";
-}
-
-# 2. The Shell Script (HEREDOC)
-# We adapt your snippet slightly to ensure it runs deterministically as a test.
+# 1. The Shell Script as HEREDOC
 my $shell_code = <<'HEREDOC';
 #!/bin/bash
 # Configuration
 PORT=1443
 CERT="server.pem"
 KEY="server.key"
-PROTOCOL="tls1_3"
-DAYS=365
+# This OpenSSL version will support TLS 1.3
 OPENSSL=/usr/bin/openssl
 
-# For a test, we force a specific TLS 1.3 cipher suite to ensure the server starts reliably
-# instead of relying on defaults or user input.
+# Force a specific TLS 1.3 cipher suite when needed
 # CIPHER_SUITE="TLS_AES_256_GCM_SHA384"
 
 # Generate self-signed cert and key if they don't exist
 if [ ! -f "$CERT" ] || [ ! -f "$KEY" ]; then
     echo "Generating self-signed certificate and key..."
-    $OPENSSL req -x509 -newkey rsa:2048 -keyout "$KEY" -out "$CERT" -days "$DAYS" -nodes -subj "/CN=localhost"
+    $OPENSSL req -x509 -newkey rsa:2048 -keyout "$KEY" -out "$CERT" -days 42 -nodes -subj "/CN=localhost"
 fi
 
 # Start OpenSSL server
-# Note: We use -tls1_3 to enable TLS 1.3.
 echo "Starting server on port $PORT..."
 # $OPENSSL s_server -accept "$PORT" -cert "$CERT" -key "$KEY" -tls1_3 -ciphersuites "$CIPHER_SUITE"
 $OPENSSL s_server -accept "$PORT" -cert "$CERT" -key "$KEY" -tls1_3
 HEREDOC
 
-# 3. Setup: Write and execute the script
+# Write and execute the script
 subtest 'TLS 1.3 Only Server Setup', sub {
-    plan skip_all => "IPC::Run not available" unless eval { require IPC::Run; 1 };
+    plan skip_all => "File::Temp not available" unless eval { require File::Temp; 1 };
 
     # Write the script to the temp directory
     open(my $fh, '>', $server_script) or die "Cannot write script: $!";
@@ -61,41 +50,62 @@ subtest 'TLS 1.3 Only Server Setup', sub {
 
     chmod 0755, $server_script;
 
-    # Start the server in the background
-    my $server = IPC::Run::start([ $server_script ]);
+    # Start the server in the background using fork/exec
+    my $pid = fork();
+    if ($pid == 0) {
+        # Exec the script in a child process
+        exec($server_script);
+        exit 0; # Should not reach here
+    }
+    elsif ($pid > 0) {
+        # Parent process: Wait for server to be ready
 
-    # Wait for the server to be listening on the port
-    my $ready = 0;
-    for my $i (1..20) {
-        if (system("nc -z localhost $port") == 0) {
-            $ready = 1;
-            last;
+        # Wait for the server to be listening on the port
+        my $socket;
+        my $ready = 0;
+
+        for my $i (1..30) {
+            $socket = IO::Socket::INET->new(
+                PeerAddr => 'localhost',
+                PeerPort => $port,
+                Proto    => 'tcp',
+                Timeout  => 2,
+            );
+
+            if ($socket) {
+                $ready = 1;
+                last;
+            }
+            sleep 1;
         }
-        sleep 1;
+
+        ok($ready, "Server is listening on port $port");
+
+        if ($ready) {
+            # Run testssl.sh
+            # capture both stdout and stderr
+            my $testssl_output = `./testssl.sh --protocols localhost:$port 2>&1`;
+
+            # Check if TLS 1.3 is found
+            like($testssl_output, qr/TLS 1\.3/, "TLS 1.3 is supported");
+
+            # Check if TLS 1.2 is NOT found
+            unlike($testssl_output, qr/OFFERED\s+TLS 1\.2/, "TLS 1.2 is NOT offered");
+
+            diag("Test output:\n$testssl_output");
+        } else {
+            diag("Server failed to start");
+        }
+
+        # Cleanup: Kill the server process
+        kill 9, $pid;
+        waitpid($pid, 0);
     }
-
-    ok($ready, "Server is listening on port $port");
-
-    if (!$ready) {
-        diag("Server failed to start");
-        $server->finish;
-        return;
+    else {
+        die "Fork failed: $!";
     }
-
-    # Run testssl.sh
-    my $testssl_output = `./testssl.sh --protocols localhost:$port 2>&1`;
-
-    # Verify
-    like($testssl_output, qr/TLS 1\.3/, "TLS 1.3 is supported");
-
-    # Check if TLS 1.2 is NOT found (since we only enabled tls1_3)
-    # We look for "TLS 1.2" but try to exclude it if it's in a "not supported" section, 
-    # but usually testssl prints "NOT offered" or similar.
-    # A safer check for "TLS 1.3 ONLY" is to ensure 1.2 is explicitly rejected.
-    unlike($testssl_output, qr/OFFERED\s+TLS 1\.2/, "TLS 1.2 is NOT offered");
-
-    # Cleanup the server process
-    $server->finish;
 };
 
 done_testing();
+
+#  vim:ts=5:sw=5:expandtab