PazeSSH/build/run_tls_test.ps1

# TLS 1.2/1.3 自测脚本(一次性)
$ErrorActionPreference = "Continue"
$Root = "F:\TLS-SSH"
$exe = Join-Path $Root "bin\pazessl.exe"
$key = Join-Path $Root "build\key.pem"
$cert = Join-Path $Root "build\cert.pem"

# 1) 生成证书(若不存在)
if (-not (Test-Path $cert)) {
    & $exe req -x509 -newkey rsa:2048 -keyout $key -out $cert -days 365 -subj /CN=localhost 2>&1 | Out-Null
    if ($LASTEXITCODE -ne 0) { Write-Host "FAIL: req"; exit 1 }
}

function Test-Conn($tag, $port, $serverArgs, $clientArgs) {
    $sout = Join-Path $Root "build\srv_$tag.out.log"
    $serr = Join-Path $Root "build\srv_$tag.err.log"
    $cout = Join-Path $Root "build\cli_$tag.out.log"
    $cerr = Join-Path $Root "build\cli_$tag.err.log"
    # 启动服务端(输出重定向到文件)
    $srv = Start-Process -FilePath $exe -ArgumentList $serverArgs -NoNewWindow -PassThru `
                         -RedirectStandardOutput $sout -RedirectStandardError $serr
    Start-Sleep -Milliseconds 1200
    $alive = -not $srv.HasExited
    # 启动客户端(中继只读,握手后阻塞,故用轮询判据)
    $cli = Start-Process -FilePath $exe -ArgumentList $clientArgs -NoNewWindow -PassThru `
                         -RedirectStandardOutput $cout -RedirectStandardError $cerr
    $ok = $false
    for ($i = 0; $i -lt 20; $i++) {
        Start-Sleep -Milliseconds 500
        if ($cli.HasExited) { break }
        if (Test-Path $cerr) {
            $t = Get-Content $cerr -Raw -ErrorAction SilentlyContinue
            if ($t -match "Connected \(TLS 03") { $ok = $true; break }
        }
    }
    if (-not $cli.HasExited) { Stop-Process -Id $cli.Id -Force }
    if (-not $srv.HasExited) { Stop-Process -Id $srv.Id -Force }
    Write-Host "== $tag =="
    Write-Host "server-alive=$alive client-ok=$ok"
    if (Test-Path $cerr) { Get-Content $cerr | ForEach-Object { Write-Host "C: $_" } }
    if (Test-Path $serr) { Get-Content $serr | ForEach-Object { Write-Host "S: $_" } }
    return $ok
}

# TLS 1.2 自测
Test-Conn "tls1_2-self" "14433" @("s_server","-accept","14433","-cert",$cert,"-key",$key,"-tls1_2") `
                                @("s_client","-connect","127.0.0.1:14433","-tls1_2")

# TLS 1.3 自测(默认版本)
Test-Conn "tls1_3-self" "14434" @("s_server","-accept","14434","-cert",$cert,"-key",$key) `
                                @("s_client","-connect","127.0.0.1:14434")

# 回退场景 A: 客户端默认(先试 1.3) ↔ 服务端仅 1.2 → 客户端回退到 1.2
Test-Conn "fallback-cli" "14435" @("s_server","-accept","14435","-cert",$cert,"-key",$key,"-tls1_2") `
                                @("s_client","-connect","127.0.0.1:14435")

# 回退场景 B: 客户端仅 1.2 ↔ 服务端默认(先试 1.3) → 服务端回退到 1.2
Test-Conn "fallback-srv" "14436" @("s_server","-accept","14436","-cert",$cert,"-key",$key) `
                                @("s_client","-connect","127.0.0.1:14436","-tls1_2")

# TLS 1.3 PSK 会话恢复:同一服务端进程内两连接,第二连接用第一连接的 session
function Test-PskResume {
    $port = 14437
    $sess = Join-Path $Root "build\session_resume.bin"
    Remove-Item -ErrorAction SilentlyContinue $sess
    $serr = Join-Path $Root "build\srv_psk.err.log"
    $sout = Join-Path $Root "build\srv_psk.out.log"
    Remove-Item -ErrorAction SilentlyContinue $serr, $sout
    $srv = Start-Process -FilePath $exe -ArgumentList @("s_server","-accept","$port","-cert",$cert,"-key",$key,"-reuse","2") `
                         -NoNewWindow -PassThru -RedirectStandardOutput $sout -RedirectStandardError $serr
    Start-Sleep -Milliseconds 1200
    # 连接 #1: 全握手,保存 session
    & $exe s_client -connect "127.0.0.1:$port" -msg hi -sess_out $sess 2>&1 | Out-Null
    Start-Sleep -Milliseconds 500
    # 连接 #2: 用 session 恢复
    $c2out = Join-Path $Root "build\cli_psk2.err.log"
    Remove-Item -ErrorAction SilentlyContinue $c2out
    $c2 = Start-Process -FilePath $exe -ArgumentList @("s_client","-connect","127.0.0.1:$port","-msg","hi","-sess_in",$sess) `
                        -NoNewWindow -PassThru -RedirectStandardError $c2out
    $resumed = $false
    for ($i = 0; $i -lt 20; $i++) {
        Start-Sleep -Milliseconds 300
        $t = Get-Content $c2out -Raw -ErrorAction SilentlyContinue
        if ($t -match "resumed YES") { $resumed = $true; break }
        if ($c2.HasExited) { break }
    }
    if (-not $c2.HasExited) { Stop-Process -Id $c2.Id -Force }
    if (-not $srv.HasExited) { Stop-Process -Id $srv.Id -Force }
    Write-Host "== psk-resume =="
    Write-Host "session-file=$([bool](Test-Path $sess)) resumed=$resumed"
    if (Test-Path $serr) { Get-Content $serr | ForEach-Object { Write-Host "S: $_" } }
    if (Test-Path $c2out) { Get-Content $c2out | ForEach-Object { Write-Host "C2: $_" } }
}
Test-PskResume