Skip to content

Commit 881ce77

Browse files
drwetterdrwetter
committed
wait_kill() is now 0.1 seconds
... which leads to a performance gain., most noteably on Macs. All times when calling were re-adjusted. Also: * PROXY_WAIT was decrease to 10 seconds. 20 seemed just too much * passed var to `starttls_just_read()` was simplyfied
1 parent 8f03672 commit 881ce77

1 file changed

Lines changed: 26 additions & 23 deletions

File tree

‎testssl.sh‎

Lines changed: 26 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -196,16 +196,16 @@ ADDTL_CA_FILES="${ADDTL_CA_FILES:-""}" # single file with a CA in PEM format or
196196
TESTSSL_INSTALL_DIR="${TESTSSL_INSTALL_DIR:-""}" # If you run testssl.sh and it doesn't find it necessary file automagically set TESTSSL_INSTALL_DIR
197197
CA_BUNDLES_PATH="${CA_BUNDLES_PATH:-""}" # You can have your CA stores some place else
198198
EXPERIMENTAL=${EXPERIMENTAL:-false} # a development hook which allows us to disable code
199-
PROXY_WAIT=${PROXY_WAIT:-20} # waiting at max 20 seconds for socket reply through proxy
199+
PROXY_WAIT=${PROXY_WAIT:-10} # waiting at max 10 seconds for socket reply through proxy
200200
DNS_VIA_PROXY=${DNS_VIA_PROXY:-false} # do DNS lookups via proxy. --ip=proxy reverses this
201201
IGN_OCSP_PROXY=${IGN_OCSP_PROXY:-false} # Also when --proxy is supplied it is ignored when testing for revocation via OCSP via --phone-out
202-
HEADER_MAXSLEEP=${HEADER_MAXSLEEP:-5} # we wait this long before killing the process to retrieve a service banner / http header
202+
HEADER_MAXSLEEP=${HEADER_MAXSLEEP:-5} # we wait this long sec before killing the process to retrieve a service banner / http header
203203
MAX_SOCKET_FAIL=${MAX_SOCKET_FAIL:-2} # If this many failures for TCP socket connects are reached we terminate
204204
MAX_OSSL_FAIL=${MAX_OSSL_FAIL:-2} # If this many failures for s_client connects are reached we terminate
205205
MAX_STARTTLS_FAIL=${MAX_STARTTLS_FAIL:-2} # max number of STARTTLS handshake failures in plaintext phase
206206
MAX_HEADER_FAIL=${MAX_HEADER_FAIL:-2} # If this many failures for HTTP GET are encountered we don't try again to get the header
207207
MAX_WAITSOCK=${MAX_WAITSOCK:-5} # waiting at max 5 seconds for socket reply. There shouldn't be any reason to change this.
208-
QUIC_WAIT=${QUIC_WAIT:-3} # QUIC is UDP. Thus we run the connect in the background. This is how long to wait
208+
QUIC_WAIT=${QUIC_WAIT:-3} # QUIC is UDP. Thus we run the connect in the background. This is how long in sec to wait
209209
CCS_MAX_WAITSOCK=${CCS_MAX_WAITSOCK:-5} # for the two CCS payload (each). There shouldn't be any reason to change this.
210210
HEARTBLEED_MAX_WAITSOCK=${HEARTBLEED_MAX_WAITSOCK:-8} # for the heartbleed payload. There shouldn't be any reason to change this.
211211
STARTTLS_SLEEP=${STARTTLS_SLEEP:-10} # max time wait on a socket for STARTTLS. MySQL has a fixed value of 1 which can't be overwritten (#914)
@@ -1948,7 +1948,7 @@ http_head_printf() {
19481948
# $node works here good as it connects via IPv6 first, then IPv4.
19491949
# This is a subshell, so fd 8 is not inherited
19501950
bash -c "exec 8<>/dev/tcp/$node/80" 2>/dev/null &
1951-
wait_kill $! $HEADER_MAXSLEEP
1951+
wait_kill $! $((HEADER_MAXSLEEP * 10))
19521952
if [[ $? -ne 3 ]]; then
19531953
# process with pid !$ wasn't killed but was that a reject? So we try again
19541954
# to make sure there wasn't a TCP reset
@@ -2234,30 +2234,31 @@ check_revocation_ocsp() {
22342234
fi
22352235
}
22362236

2237-
# waits maxsleep seconds (arg2) until process with arg1 (pid) will be killed
2237+
# waits maxsleep 1/10 seconds (arg2) until process with arg1 (pid) will be killed
22382238
#
22392239
# return values
22402240
# 0: process terminated before be killed
22412241
# 3: was killed
22422242
#
22432243
wait_kill(){
2244-
local pid=$1 # pid we wait for or kill
2245-
local maxsleep=$2 # how long we wait before killing
2244+
local pid=$1 # pid we wait for or kill
2245+
local maxsleep=$2 # how long we wait before killing
22462246

22472247
HAD_SLEPT=0
22482248
while true; do
22492249
if ! ps $pid >/dev/null ; then
2250-
return 0 # process terminated before didn't reach $maxsleep
2250+
return 0 # process terminated before didn't reach $maxsleep
22512251
fi
22522252
[[ "$DEBUG" -ge 6 ]] && ps $pid
2253-
sleep 1
2253+
sleep 0.1
22542254
maxsleep=$((maxsleep - 1))
22552255
HAD_SLEPT=$((HAD_SLEPT + 1))
22562256
test $maxsleep -le 0 && break
2257-
done # needs to be killed:
2257+
done # needs to be killed:
22582258
kill $pid >&2 2>/dev/null
2259-
wait $pid 2>/dev/null # make sure pid terminated, see wait(1p)
2260-
return 3 # means killed
2259+
wait $pid 2>/dev/null # make sure pid terminated, see wait(1p)
2260+
HAD_SLEPT=$((HAD_SLEPT/10)) # correct HAD_SLEPT. #FIXME: is only being used by run_http_header()
2261+
return 3 # means killed
22612262
}
22622263

22632264
# Convert date formats -- we always use GMT=UTC here
@@ -2499,7 +2500,7 @@ service_detection() {
24992500
else
25002501
# SNI is not standardized for !HTTPS but fortunately for other protocols s_client doesn't seem to care
25012502
tm_out "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$1 -quiet $BUGS -connect $NODEIP:$PORT $PROXY $SNI") >$TMPFILE 2>$ERRFILE &
2502-
wait_kill $! $HEADER_MAXSLEEP
2503+
wait_kill $! $((HEADER_MAXSLEEP * 10))
25032504
was_killed=$?
25042505
fi
25052506
head $TMPFILE | grep -aq '^HTTP/' && SERVICE=HTTP
@@ -2613,7 +2614,7 @@ run_http_header() {
26132614
[[ -z "$1" ]] && url="/" || url="$1"
26142615

26152616
tm_out "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$OPTIMAL_PROTO $BUGS -quiet -ign_eof -connect $NODEIP:$PORT $PROXY $SNI") >$HEADERFILE 2>$ERRFILE &
2616-
wait_kill $! $HEADER_MAXSLEEP
2617+
wait_kill $! $((HEADER_MAXSLEEP * 10))
26172618
if [[ $? -eq 0 ]]; then
26182619
# Issue HTTP GET again as it properly finished within $HEADER_MAXSLEEP and didn't hang.
26192620
# Doing it again in the foreground to get an accurate header time
@@ -6245,7 +6246,7 @@ sub_quic() {
62456246
fi
62466247
OPENSSL_CONF='' $use_openssl s_client -quic -alpn h3 -connect $NODEIP:$PORT -servername $NODE </dev/null \
62476248
2>$sclient_errfile >$sclient_outfile &
6248-
wait_kill $! $QUIC_WAIT
6249+
wait_kill $! $((QUIC_WAIT * 10))
62496250
ret=$?
62506251
if [[ $ret -eq 3 ]]; then
62516252
# process was killed
@@ -11783,16 +11784,17 @@ starttls_just_send(){
1178311784
}
1178411785

1178511786
# arg1: (optional): wait time
11787+
#
1178611788
starttls_just_read(){
11787-
local waitsleep=$STARTTLS_SLEEP
11788-
[[ -n "$1" ]] && waitsleep=$1
11789+
local waitsleep=${1:-$STARTTLS_SLEEP}
11790+
1178911791
if [[ "$DEBUG" -ge 2 ]]; then
1179011792
echo "=== just read banner ==="
1179111793
cat <&5 &
1179211794
else
1179311795
dd of=/dev/null count=8 <&5 2>/dev/null &
1179411796
fi
11795-
wait_kill $! $waitsleep
11797+
wait_kill $! $((waitsleep * 10))
1179611798
return 0
1179711799
}
1179811800

@@ -12363,7 +12365,7 @@ sockread() {
1236312365
[[ -z "$2" ]] && maxsleep=$MAX_WAITSOCK || maxsleep=$2
1236412366
SOCK_REPLY_FILE=$(mktemp $TEMPDIR/ddreply.XXXXXX) || return 7
1236512367
dd bs=$1 of=$SOCK_REPLY_FILE count=1 <&5 2>/dev/null &
12366-
wait_kill $! $maxsleep
12368+
wait_kill $! $((maxsleep * 10))
1236712369
return $?
1236812370
}
1236912371

@@ -18120,13 +18122,14 @@ run_crime() {
1812018122
# when GET command was stalled or killed (which is no not always used)
1812118123
# and echos "warn_*". It return 0 when everything went ok and echos the
1812218124
# compression if any.
18125+
#
1812318126
sub_breach_helper() {
1812418127
local get_command="$1"
1812518128
local detected_compression=""
1812618129
local -i was_killed=0
1812718130

1812818131
safe_echo "$get_command" | $OPENSSL s_client $(s_client_options "$OPTIMAL_PROTO $BUGS -quiet -ign_eof -connect $NODEIP:$PORT $PROXY $SNI") 1>$TMPFILE 2>$ERRFILE &
18129-
wait_kill $! $HEADER_MAXSLEEP
18132+
wait_kill $! $((HEADER_MAXSLEEP * 10))
1813018133
was_killed=$? # !=0 when it was killed
1813118134
detected_compression=$(grep -ia ^Content-Encoding: $TMPFILE)
1813218135
detected_compression="$(strip_lf "$detected_compression")"
@@ -22378,7 +22381,7 @@ get_txt_record() {
2237822381
shouldwedo_ipv6() {
2237922382
"$do_ipv4_only" && return 0
2238022383
bash -c "exec 5<>/dev/tcp/$1/$PORT" &>/dev/null &
22381-
wait_kill $! $MAX_WAITSOCK
22384+
wait_kill $! $((MAX_WAITSOCK * 10))
2238222385
if [[ $? -eq 3 ]]; then
2238322386
# was killed, so this got stuck
2238422387
IPv6_OK=false
@@ -22990,7 +22993,7 @@ determine_optimal_proto() {
2299022993
$OPENSSL s_client $(s_client_options "$proto $BUGS -connect "$NODEIP:$PORT" -msg $PROXY $SNI") </dev/null >$TMPFILE 2>>$ERRFILE
2299122994
else
2299222995
safe_echo "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$proto $BUGS -connect "$NODEIP:$PORT" -msg $PROXY $SNI -ign_eof -enable_pha") >$TMPFILE 2>>$ERRFILE &
22993-
wait_kill $! $HEADER_MAXSLEEP
22996+
wait_kill $! $((HEADER_MAXSLEEP * 10))
2299422997
if [[ $? -eq 0 ]]; then
2299522998
# Issue HTTP GET again as it properly finished within $HEADER_MAXSLEEP and didn't hang.
2299622999
# Doing it again in the foreground to get an accurate return code.
@@ -23028,7 +23031,7 @@ determine_optimal_proto() {
2302823031
if [[ "$(has_server_protocol "tls1_2")" -eq 0 ]] || [[ "$(has_server_protocol "tls1_1")" -eq 0 ]] || \
2302923032
[[ "$(has_server_protocol "tls1")" -eq 0 ]] || [[ "$(has_server_protocol "ssl3")" -eq 0 ]]; then
2303023033
safe_echo "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$BUGS -connect "$NODEIP:$PORT" -msg $PROXY $SNI -ign_eof -no_tls1_3") >$TEMPDIR/client_auth_test.txt 2>>$ERRFILE &
23031-
wait_kill $! $HEADER_MAXSLEEP
23034+
wait_kill $! $((HEADER_MAXSLEEP * 10))
2303223035
# If the HTTP properly finished within $HEADER_MAXSLEEP and didn't hang, then
2303323036
# do it again in the foreground to get an accurate return code. If it did hang,
2303423037
# there is no way to test for client authentication, so don't try.

0 commit comments

Comments
 (0)