tickets

3.4 KB

1. // tls-on-plain-port.mjs — a TLS ClientHello sent to a plain hl:http1 port must be
2. // closed at once, not held open until the client times out (routger, 2026-09-27:
3. // Firefox's HTTPS-First tries https:// first on any non-localhost name, so the
4. // page "loaded forever" instead of falling back to http). Drives the built
5. // libhttp1.so through the interpreter (tls_on_plain_port.hl), then talks to it
6. // with raw sockets — this is protocol-shape testing, below what an .hl fixture
7. // can reach.
8. import { spawn } from 'node:child_process';
9. import { connect } from 'node:net';
10. import { fileURLToPath } from 'node:url';
11. import { dirname, resolve } from 'node:path';
13. const HERE = dirname(fileURLToPath(import.meta.url));
14. const ROOT = resolve(HERE, '../../..');
15. const BIN = resolve(ROOT, 'native/zig-out/bin/hybriel');
16. const FIXTURE = resolve(HERE, 'tls_on_plain_port.hl');
17. const PORT = Number(process.env.HL_TEST_PORT || 14980);
18. const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
20. let failed = false;
21. const fail = (msg) => { console.log('FAIL ' + msg); failed = true; };
23. const server = spawn(BIN, [FIXTURE], {
24. env: { ...process.env, HL_TEST_PORT: String(PORT) },
25. stdio: ['ignore', 'pipe', 'pipe'],
26. });
27. let log = '';
28. server.stdout.on('data', (d) => { log += d; });
29. server.stderr.on('data', (d) => { log += d; });
31. let up = false;
32. for (let i = 0; i < 80; i++) {
33. try {
34. const r = await fetch(`http://127.0.0.1:${PORT}/`);
35. if (r.status === 200) { up = true; break; }
36. } catch {}
37. await sleep(250);
38. }
39. if (!up) {
40. console.log('FAIL server did not come up\n' + log.slice(0, 4000));
41. server.kill('SIGKILL');
42. process.exit(1);
43. }
45. // A TLS 1.2-shaped ClientHello record header: content type 0x16 (handshake),
46. // version 0x03 0x03, followed by a plausible length and a few handshake bytes.
47. // The fix only looks at the first two bytes, but this is what a real client
48. // sends, so the fixture proves it against a realistic prefix.
49. const clientHello = Buffer.from([
50. 0x16, 0x03, 0x03, 0x00, 0x2f, // TLS record: handshake, TLS 1.2, length 0x2f
51. 0x01, 0x00, 0x00, 0x2b, // handshake: ClientHello, length 0x2b
52. 0x03, 0x03, // client_version 1.2
53. ...Array(32).fill(0x42), // "random"
54. ]);
56. const closedInTime = await new Promise((resolvePromise) => {
57. const sock = connect(PORT, '127.0.0.1');
58. const start = Date.now();
59. let settled = false;
60. sock.on('connect', () => sock.write(clientHello));
61. sock.on('close', () => {
62. if (settled) return;
63. settled = true;
64. resolvePromise(Date.now() - start);
65. });
66. sock.on('error', () => {}); // ECONNRESET counts as closed
67. setTimeout(() => {
68. if (settled) return;
69. settled = true;
70. sock.destroy();
71. resolvePromise(-1); // never closed within the budget
72. }, 1000);
73. });
75. if (closedInTime < 0) {
76. fail(`TLS ClientHello prefix was NOT closed within 1000ms`);
77. } else {
78. console.log(`ClientHello prefix closed in ${closedInTime}ms`);
79. }
81. // Plain HTTP on the same port must still answer — the fix must not have
82. // turned the port TLS-only or broken ordinary requests.
83. try {
84. const r = await fetch(`http://127.0.0.1:${PORT}/`);
85. const body = await r.text();
86. if (r.status === 200 && body === 'ok') {
87. console.log('plain HTTP still answers: 200 ok');
88. } else {
89. fail(`plain HTTP answered ${r.status} ${JSON.stringify(body)}`);
90. }
91. } catch (e) {
92. fail(`plain HTTP request threw: ${e}`);
93. }
95. server.kill('SIGTERM');
96. await sleep(300);
97. if (!server.killed) server.kill('SIGKILL');
99. console.log(failed ? 'FAIL' : 'PASS');
100. process.exit(failed ? 1 : 0);