mirror of
https://github.com/drwetter/testssl.sh.git
synced 2026-09-14 13:48:16 +02:00
Use IO::Socket::INET instead of IPC::Run
- hardcode days and protocol as they don't matter - got rid of the ugly system call with nc
This commit is contained in:
Dirk Wetter
Executable → Regular
+63
-53
@@ -1,58 +1,47 @@
|
||||
#!/usr/bin/env perl
|
||||
|
||||
# As the name indicates: Check for TLS 1.3 only hosts
|
||||
# As the name indicates: Check for TLS 1.3 only hosts. It just run the protocol section, there
|
||||
# it checks for TLS 1.2 (disabled) and TLS 1.3 (enabled)
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
use Test::More;
|
||||
use IPC::Run qw( start timeout );
|
||||
use IO::Socket::INET;
|
||||
use File::Temp qw( tempdir );
|
||||
use File::Basename;
|
||||
use File::Path qw( remove_tree );
|
||||
use File::Copy;
|
||||
|
||||
my $port = 1443;
|
||||
my $server_script;
|
||||
my $temp_dir;
|
||||
my $temp_dir = tempdir(CLEANUP => 1);
|
||||
my $server_script = "$temp_dir/start_server.sh";
|
||||
|
||||
BEGIN {
|
||||
$temp_dir = tempdir(CLEANUP => 1);
|
||||
# Path to the testssl.sh script (assuming we are in the project root)
|
||||
$server_script = "$temp_dir/start_server.sh";
|
||||
}
|
||||
|
||||
# 2. The Shell Script (HEREDOC)
|
||||
# We adapt your snippet slightly to ensure it runs deterministically as a test.
|
||||
# 1. The Shell Script as HEREDOC
|
||||
my $shell_code = <<'HEREDOC';
|
||||
#!/bin/bash
|
||||
# Configuration
|
||||
PORT=1443
|
||||
CERT="server.pem"
|
||||
KEY="server.key"
|
||||
PROTOCOL="tls1_3"
|
||||
DAYS=365
|
||||
# This OpenSSL version will support TLS 1.3
|
||||
OPENSSL=/usr/bin/openssl
|
||||
|
||||
# For a test, we force a specific TLS 1.3 cipher suite to ensure the server starts reliably
|
||||
# instead of relying on defaults or user input.
|
||||
# Force a specific TLS 1.3 cipher suite when needed
|
||||
# CIPHER_SUITE="TLS_AES_256_GCM_SHA384"
|
||||
|
||||
# Generate self-signed cert and key if they don't exist
|
||||
if [ ! -f "$CERT" ] || [ ! -f "$KEY" ]; then
|
||||
echo "Generating self-signed certificate and key..."
|
||||
$OPENSSL req -x509 -newkey rsa:2048 -keyout "$KEY" -out "$CERT" -days "$DAYS" -nodes -subj "/CN=localhost"
|
||||
$OPENSSL req -x509 -newkey rsa:2048 -keyout "$KEY" -out "$CERT" -days 42 -nodes -subj "/CN=localhost"
|
||||
fi
|
||||
|
||||
# Start OpenSSL server
|
||||
# Note: We use -tls1_3 to enable TLS 1.3.
|
||||
echo "Starting server on port $PORT..."
|
||||
# $OPENSSL s_server -accept "$PORT" -cert "$CERT" -key "$KEY" -tls1_3 -ciphersuites "$CIPHER_SUITE"
|
||||
$OPENSSL s_server -accept "$PORT" -cert "$CERT" -key "$KEY" -tls1_3
|
||||
HEREDOC
|
||||
|
||||
# 3. Setup: Write and execute the script
|
||||
# Write and execute the script
|
||||
subtest 'TLS 1.3 Only Server Setup', sub {
|
||||
plan skip_all => "IPC::Run not available" unless eval { require IPC::Run; 1 };
|
||||
plan skip_all => "File::Temp not available" unless eval { require File::Temp; 1 };
|
||||
|
||||
# Write the script to the temp directory
|
||||
open(my $fh, '>', $server_script) or die "Cannot write script: $!";
|
||||
@@ -61,41 +50,62 @@ subtest 'TLS 1.3 Only Server Setup', sub {
|
||||
|
||||
chmod 0755, $server_script;
|
||||
|
||||
# Start the server in the background
|
||||
my $server = IPC::Run::start([ $server_script ]);
|
||||
# Start the server in the background using fork/exec
|
||||
my $pid = fork();
|
||||
if ($pid == 0) {
|
||||
# Exec the script in a child process
|
||||
exec($server_script);
|
||||
exit 0; # Should not reach here
|
||||
}
|
||||
elsif ($pid > 0) {
|
||||
# Parent process: Wait for server to be ready
|
||||
|
||||
# Wait for the server to be listening on the port
|
||||
my $ready = 0;
|
||||
for my $i (1..20) {
|
||||
if (system("nc -z localhost $port") == 0) {
|
||||
$ready = 1;
|
||||
last;
|
||||
# Wait for the server to be listening on the port
|
||||
my $socket;
|
||||
my $ready = 0;
|
||||
|
||||
for my $i (1..30) {
|
||||
$socket = IO::Socket::INET->new(
|
||||
PeerAddr => 'localhost',
|
||||
PeerPort => $port,
|
||||
Proto => 'tcp',
|
||||
Timeout => 2,
|
||||
);
|
||||
|
||||
if ($socket) {
|
||||
$ready = 1;
|
||||
last;
|
||||
}
|
||||
sleep 1;
|
||||
}
|
||||
sleep 1;
|
||||
|
||||
ok($ready, "Server is listening on port $port");
|
||||
|
||||
if ($ready) {
|
||||
# Run testssl.sh
|
||||
# capture both stdout and stderr
|
||||
my $testssl_output = `./testssl.sh --protocols localhost:$port 2>&1`;
|
||||
|
||||
# Check if TLS 1.3 is found
|
||||
like($testssl_output, qr/TLS 1\.3/, "TLS 1.3 is supported");
|
||||
|
||||
# Check if TLS 1.2 is NOT found
|
||||
unlike($testssl_output, qr/OFFERED\s+TLS 1\.2/, "TLS 1.2 is NOT offered");
|
||||
|
||||
diag("Test output:\n$testssl_output");
|
||||
} else {
|
||||
diag("Server failed to start");
|
||||
}
|
||||
|
||||
# Cleanup: Kill the server process
|
||||
kill 9, $pid;
|
||||
waitpid($pid, 0);
|
||||
}
|
||||
|
||||
ok($ready, "Server is listening on port $port");
|
||||
|
||||
if (!$ready) {
|
||||
diag("Server failed to start");
|
||||
$server->finish;
|
||||
return;
|
||||
else {
|
||||
die "Fork failed: $!";
|
||||
}
|
||||
|
||||
# Run testssl.sh
|
||||
my $testssl_output = `./testssl.sh --protocols localhost:$port 2>&1`;
|
||||
|
||||
# Verify
|
||||
like($testssl_output, qr/TLS 1\.3/, "TLS 1.3 is supported");
|
||||
|
||||
# Check if TLS 1.2 is NOT found (since we only enabled tls1_3)
|
||||
# We look for "TLS 1.2" but try to exclude it if it's in a "not supported" section,
|
||||
# but usually testssl prints "NOT offered" or similar.
|
||||
# A safer check for "TLS 1.3 ONLY" is to ensure 1.2 is explicitly rejected.
|
||||
unlike($testssl_output, qr/OFFERED\s+TLS 1\.2/, "TLS 1.2 is NOT offered");
|
||||
|
||||
# Cleanup the server process
|
||||
$server->finish;
|
||||
};
|
||||
|
||||
done_testing();
|
||||
|
||||
# vim:ts=5:sw=5:expandtab
|
||||
|
||||
Reference in New Issue
Block a user