fix(tlsx): reject unsupported scan modes in New

pkg/tlsx/clients/clients.go

@@ -101,7 +101,8 @@ type Options struct {
 	MaxVersion string
 	// Resolvers contains custom resolvers for the tlsx client
 	Resolvers goflags.StringSlice
-	// ScanMode is the tls connection mode to use
+	// ScanMode is the tls connection mode to use: ctls, ztls, openssl or auto.
+	// An empty value means ctls; any other value makes tlsx.New fail.
 	ScanMode string
 	// VerifyServerCertificate enables optional verification of server certificates
 	VerifyServerCertificate bool

pkg/tlsx/tlsx.go

@@ -51,10 +51,12 @@ func New(options *clients.Options) (*Service, error) {
 		service.client, err = openssl.New(options)
 	case "auto":
 		service.client, err = auto.New(options)
-	default:
-		// Default mode is TLS
+	case "":
 		service.client, err = tls.New(options)
 		options.ScanMode = "ctls"
+	default:
+		// falling back to ctls would hide a typo behind a different tls engine
+		return nil, errkit.Newf("scan mode %v not supported (supported: ctls, ztls, openssl, auto)", options.ScanMode)
 	}
 	if err != nil {
 		return nil, errorutil.NewWithTag("auto", "could not create tls service").Wrap(err) //nolint

pkg/tlsx/tlsx_test.go

@@ -2,6 +2,7 @@ package tlsx_test
 
 import (
 	"errors"
+	"strconv"
 	"testing"
 
 	"github.com/projectdiscovery/fastdialer/fastdialer"
@@ -87,3 +88,56 @@ func TestTLSGroupsScanMode(t *testing.T) {
 		}
 	}
 }
+
+// TestNewScanMode ensures New accepts only the documented scan modes, so a
+// typo or the wrong case fails instead of silently running ctls.
+func TestNewScanMode(t *testing.T) {
+	t.Parallel()
+
+	dialer, err := fastdialer.NewDialer(fastdialer.DefaultOptions)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Cleanup, not defer: the parallel subtests run after this function returns.
+	t.Cleanup(dialer.Close)
+
+	// The empty mode keeps its historical ctls default.
+	valid := map[string]string{"": "ctls", "ctls": "ctls", "ztls": "ztls", "openssl": "openssl", "auto": "auto"}
+	for mode, want := range valid {
+		t.Run(strconv.Quote(mode), func(t *testing.T) {
+			t.Parallel()
+
+			opts := &clients.Options{ScanMode: mode, Fastdialer: dialer}
+
+			_, err := tlsx.New(opts)
+			if errors.Is(err, openssl.ErrNotAvailable) {
+				t.Skip("openssl not available")
+			}
+
+			if err != nil {
+				t.Fatalf("New() error = %v, want nil", err)
+			}
+
+			if opts.ScanMode != want {
+				t.Errorf("ScanMode after New() = %q, want %q", opts.ScanMode, want)
+			}
+		})
+	}
+
+	for _, mode := range []string{"ZTLS", "Auto", "typo", " ctls"} {
+		t.Run(strconv.Quote(mode), func(t *testing.T) {
+			t.Parallel()
+
+			opts := &clients.Options{ScanMode: mode, Fastdialer: dialer}
+
+			_, err := tlsx.New(opts)
+			if err == nil {
+				t.Error("New() error = nil, want unsupported scan mode error")
+			}
+
+			if opts.ScanMode != mode {
+				t.Errorf("ScanMode after New() = %q, want it unchanged", opts.ScanMode)
+			}
+		})
+	}
+}