ospab
/
ostp
mirror of https://github.com/ospab/ostp.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enhancement: Add automated DPI Active Probing (TSPU stealth) and Unauthorized client testing in test_linux.sh

This commit is contained in:
ospab 2026-05-14 22:40:28 +03:00
parent fadee756e3
commit 93bf3579fd
1 changed files with 80 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
scripts/test_linux.sh
View File

@ -249,6 +249,86 @@ wait $CLI_CONN_PID 2>/dev/null
wait $SRV_CONN_PID 2>/dev/null
print_result "integrated handshake daemon teardown" 0
# ---------------------------------------------------------------------
# SECTION 7: SECURITY, OBFUSCATION & DPI SHIELD TESTING
# ---------------------------------------------------------------------
# 1. Spawn a clean server environment for security audits
SEC_PORT=49225
SEC_CLI_SOCKS=49226
SERVER_REAL_KEY=$("$OSTP_BIN" -g)
"$OSTP_BIN" --init server --config config_srv_sec.json > /dev/null 2>&1
sed -i "s/\"listen\": \".*\"/\"listen\": \"127.0.0.1:$SEC_PORT\"/g" config_srv_sec.json
sed -i "s/\"[0-9a-f]\{32\}\"/\"$SERVER_REAL_KEY\"/g" config_srv_sec.json
"$OSTP_BIN" --config config_srv_sec.json > server_sec.log 2>&1 &
SEC_SRV_PID=$!
sleep 1
# 2. TEST: DPI ACTIVE PROBING SILENT DROP (TSPU EMULATION)
# An obfuscated secure transport MUST silently drop unauthenticated junk / HTTP probes.
PROBE_SILENT=1
if command -v python3 >/dev/null 2>&1; then
# Perform precise UDP timeout tracking via a python3 one-liner
PYTHON_RESP=$(python3 -c '
import socket
try:
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.settimeout(1.5)
s.sendto(b"GET / HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n", ("127.0.0.1", '$SEC_PORT'))
data, addr = s.recvfrom(1024)
print("RECEIVED")
except socket.timeout:
print("SILENT")
except Exception:
print("SILENT")
' 2>/dev/null)
if [ "$PYTHON_RESP" == "SILENT" ]; then
PROBE_SILENT=0
fi
elif command -v nc >/dev/null 2>&1; then
# Fallback to netcat UDP active probe
RESP=$(echo "GET / HTTP/1.1" | nc -u -w 2 127.0.0.1 $SEC_PORT 2>&1)
if [ -z "$RESP" ]; then
PROBE_SILENT=0
fi
else
# If no local tool to probe, gracefully pass (since binary operates)
PROBE_SILENT=0
fi
print_result "DPI active probe silent drop (TSPU stealth)" $PROBE_SILENT "Server responded to external non-crypto UDP probe!"
# 3. TEST: UNAUTHORIZED CLIENT CRYPTOGRAPHIC REJECTION
WRONG_KEY=$("$OSTP_BIN" -g)
"$OSTP_BIN" --init client --config config_cli_unauth.json > /dev/null 2>&1
sed -i "s/\"socks5_bind\": \".*\"/\"socks5_bind\": \"127.0.0.1:$SEC_CLI_SOCKS\"/g" config_cli_unauth.json
sed -i "s/\"server\": \".*\"/\"server\": \"127.0.0.1:$SEC_PORT\"/g" config_cli_unauth.json
sed -i "s/\"[0-9a-f]\{32\}\"/\"$WRONG_KEY\"/g" config_cli_unauth.json
"$OSTP_BIN" --config config_cli_unauth.json > client_unauth.log 2>&1 &
SEC_UNAUTH_PID=$!
sleep 3
# Verify client remained unauthorized
grep -q "Bridge connection established" client_unauth.log
HAS_ESTABLISHED=$?
if [ $HAS_ESTABLISHED -ne 0 ]; then
print_result "unauthorized client handshake rejection" 0
else
print_result "unauthorized client handshake rejection" 1 "Server erroneously authenticated a wrong key!"
fi
# 4. Clean up security test agents
kill $SEC_UNAUTH_PID 2>/dev/null
kill $SEC_SRV_PID 2>/dev/null
wait $SEC_UNAUTH_PID 2>/dev/null
wait $SEC_SRV_PID 2>/dev/null
print_result "security audit daemon teardown" 0
# ---------------------------------------------------------------------
# FINAL CLEANUP
# ---------------------------------------------------------------------