t/nntpd*.t: skip TLS tests for old Net::NNTP

[public-inbox.git] / t / nntpd-tls.t

diff --git a/t/nntpd-tls.t b/t/nntpd-tls.t
index 00b03b66835e152a7b3e7fb3eb3fcac56c326b66..e3ecdd4fa0ecd4d83c4122b17ab31ff17a5e0afe 100644 (file)
--- a/t/nntpd-tls.t
+++ b/t/nntpd-tls.t
@@ -4,11 +4,16 @@ use strict;
 use warnings;
 use Test::More;
 use File::Temp qw(tempdir);
-use Socket qw(SOCK_STREAM);
-foreach my $mod (qw(DBD::SQLite IO::Socket::SSL Net::NNTP)) {
+use Socket qw(SOCK_STREAM IPPROTO_TCP SOL_SOCKET);
+# IO::Poll and Net::NNTP are part of the standard library, but
+# distros may split them off...
+foreach my $mod (qw(DBD::SQLite IO::Socket::SSL Net::NNTP IO::Poll)) {
        eval "require $mod";
        plan skip_all => "$mod missing for $0" if $@;
 }
+Net::NNTP->can('starttls') or
+       plan skip_all => 'Net::NNTP does not support TLS';
+
 my $cert = 'certs/server-cert.pem';
 my $key = 'certs/server-key.pem';
 unless (-r $key && -r $cert) {
@@ -108,21 +113,32 @@ for my $args (
        my %o = (
                SSL_hostname => 'server.local',
                SSL_verifycn_name => 'server.local',
-               SSL => 1,
                SSL_verify_mode => SSL_VERIFY_PEER(),
                SSL_ca_file => 'certs/test-ca.pem',
        );
        my $expect = { $group => [qw(1 1 n)] };
 
+       # start negotiating a slow TLS connection
+       my $slow = IO::Socket::INET->new(
+               Proto => 'tcp',
+               PeerAddr => $nntps_addr,
+               Type => SOCK_STREAM,
+               Blocking => 0,
+       );
+       $slow = IO::Socket::SSL->start_SSL($slow, SSL_startHandshake => 0, %o);
+       my $slow_done = $slow->connect_SSL;
+       diag('W: connect_SSL early OK, slow client test invalid') if $slow_done;
+       my @poll = (fileno($slow), PublicInbox::TLS::epollbit());
+       # we should call connect_SSL much later...
+
        # NNTPS
-       my $c = Net::NNTP->new($nntps_addr, %o);
+       my $c = Net::NNTP->new($nntps_addr, %o, SSL => 1);
        my $list = $c->list;
        is_deeply($list, $expect, 'NNTPS LIST works');
        is($c->command('QUIT')->response(), Net::Cmd::CMD_OK(), 'QUIT works');
        is(0, sysread($c, my $buf, 1), 'got EOF after QUIT');
 
        # STARTTLS
-       delete $o{SSL};
        $c = Net::NNTP->new($starttls_addr, %o);
        $list = $c->list;
        is_deeply($list, $expect, 'plain LIST works');
@@ -154,6 +170,42 @@ for my $args (
        $c = Net::NNTP->new($nntps_addr, %o, SSL => 1);
        ok($c, 'NNTPS succeeds again with valid hostname');
 
+       # slow TLS connection did not block the other fast clients while
+       # connecting, finish it off:
+       until ($slow_done) {
+               IO::Poll::_poll(-1, @poll);
+               $slow_done = $slow->connect_SSL and last;
+               @poll = (fileno($slow), PublicInbox::TLS::epollbit());
+       }
+       $slow->blocking(1);
+       ok(sysread($slow, my $greet, 4096) > 0, 'slow got greeting');
+       like($greet, qr/\A201 /, 'got expected greeting');
+       is(syswrite($slow, "QUIT\r\n"), 6, 'slow wrote QUIT');
+       ok(sysread($slow, my $end, 4096) > 0, 'got EOF');
+       is(sysread($slow, my $eof, 4096), 0, 'got EOF');
+       $slow = undef;
+
+       SKIP: {
+               skip 'TCP_DEFER_ACCEPT is Linux-only', 2 if $^O ne 'linux';
+               my $var = Socket::TCP_DEFER_ACCEPT();
+               defined(my $x = getsockopt($nntps, IPPROTO_TCP, $var)) or die;
+               ok(unpack('i', $x) > 0, 'TCP_DEFER_ACCEPT set on NNTPS');
+               defined($x = getsockopt($starttls, IPPROTO_TCP, $var)) or die;
+               is(unpack('i', $x), 0, 'TCP_DEFER_ACCEPT is 0 on plain NNTP');
+       };
+       SKIP: {
+               skip 'SO_ACCEPTFILTER is FreeBSD-only', 2 if $^O ne 'freebsd';
+               if (system('kldstat -m accf_data >/dev/null')) {
+                       skip 'accf_data not loaded? kldload accf_data', 2;
+               }
+               require PublicInbox::Daemon;
+               my $var = PublicInbox::Daemon::SO_ACCEPTFILTER();
+               my $x = getsockopt($nntps, SOL_SOCKET, $var);
+               like($x, qr/\Adataready\0+\z/, 'got dataready accf for NNTPS');
+               $x = getsockopt($starttls, IPPROTO_TCP, $var);
+               is($x, undef, 'no BSD accept filter for plain NNTP');
+       };
+
        $c = undef;
        kill('TERM', $pid);
        is($pid, waitpid($pid, 0), 'nntpd exited successfully');