Fixed TLS1.3
This commit is contained in:
emdee
@@ -1,4 +1,5 @@
|
||||
#!/bin/bash
|
||||
# -*- mode: sh; fill-column: 75; tab-width: 8; coding: utf-8-unix -*-
|
||||
|
||||
#export LD_LIBRARY_PATH=/usr/local/lib
|
||||
#export TOXCORE_LIBS=/mnt/linuxPen19/var/local/src/c-toxcore/_build
|
||||
@@ -13,13 +14,50 @@ export PYTHONPATH=/mnt/o/var/local/src/toxygen_wrapper.git/
|
||||
ERROR() { echo ERROR $* ; }
|
||||
}
|
||||
|
||||
TLS=2
|
||||
HOST=irc.oftc.net
|
||||
IRC_PORT=6667
|
||||
IRCS_PORT=6697
|
||||
ONION=oftcnet6xg6roj6d7id4y4cu6dchysacqj2ldgea73qzdagufflqxrid.onion
|
||||
|
||||
TLS=0
|
||||
a=`openssl ciphers -s -v|grep -c v1.3`
|
||||
if [ "$a" -lt 3 ] ; then
|
||||
WARN no SSSL TLSv1.3 ciphers available to the client.
|
||||
TLS=2
|
||||
elif nmap --script ssl-enum-ciphers --proxies socks4://127.0.0.1:9050 -p $IRCS_PORT $HOST | grep -q 'TLSv1.3:' ; then
|
||||
TLS=3
|
||||
else
|
||||
TLS=2
|
||||
fi
|
||||
TLS=3
|
||||
|
||||
if [ "$TLS" -ne 0 ] ; then
|
||||
SD=$HOME/.config/ssl/$HOST
|
||||
[ -d $SD ] || mkdir -p $SD || exit 2
|
||||
if [ ! -s $SD/$nick.key ] ; then
|
||||
# ed25519
|
||||
openssl req -x509 -nodes -newkey rsa:2048 \
|
||||
-keyout $SD/$nick.key \
|
||||
-days 3650 -out $SD/$nick.crt || exit 3
|
||||
chmod 400 $SD/$nick.key
|
||||
fi
|
||||
if [ ! -s $SD/$nick.fp ] ; then
|
||||
openssl x509 -noout -fingerprint -SHA1 -text \
|
||||
< $SD/$nick.crt > $SD/$nick.fp || exit 4
|
||||
fi
|
||||
if [ ! -s $SD/$nick.pem ] ; then
|
||||
cat $SD/$nick.crt $SD/$nick.key > $SD/$nick.pem
|
||||
chmod 400 $SD/$nick.pem || exit 5
|
||||
fi
|
||||
ls -l -s $SD/$nick.pem
|
||||
fi
|
||||
|
||||
curl -vvvvv --cacert /etc/ssl/cacert-testforge.pem \
|
||||
--cert ~/.config/ssl/$HOST/SyniTox.pem \
|
||||
https://$HOST:$IRCS_PORT \
|
||||
2>&1| grep "SSL connection using TLSv1.$TLS"
|
||||
[ $? -gt 0 ] && WARN curl not OK
|
||||
|
||||
declare -a RARGS
|
||||
RARGS=(
|
||||
--log_level 10
|
||||
@@ -32,13 +70,12 @@ RARGS+=(
|
||||
)
|
||||
declare -a LARGS
|
||||
LARGS=(
|
||||
--irc_host irc.oftc.net
|
||||
--irc_port 7000
|
||||
--irc_host $HOST
|
||||
--irc_port $IRC_PORT
|
||||
--irc_ssl ""
|
||||
--irc_ident SyniTox
|
||||
--irc_name SyniTox
|
||||
--irc_nick SyniTox
|
||||
--irc_pass password
|
||||
)
|
||||
DBUG $?
|
||||
|
||||
@@ -50,13 +87,13 @@ fi
|
||||
|
||||
CIPHER_DOWNGRADE_OVER_TOR="
|
||||
|
||||
Nmap scan report for irc.oftc.net (130.239.18.116)
|
||||
Nmap scan report for $HOST (130.239.18.116)
|
||||
Host is up (0.26s latency).
|
||||
Other addresses for irc.oftc.net (not scanned): (null)
|
||||
Other addresses for $HOST (not scanned): (null)
|
||||
rDNS record for 130.239.18.116: solenoid.acc.umu.se
|
||||
|
||||
PORT STATE SERVICE
|
||||
6697/tcp open ircs-u
|
||||
$IRCS_PORT/tcp open ircs-u
|
||||
| ssl-enum-ciphers:
|
||||
| TLSv1.0:
|
||||
| ciphers:
|
||||
@@ -67,44 +104,44 @@ PORT STATE SERVICE
|
||||
|_ least strength: A
|
||||
"
|
||||
# I know that site does v1.3 3 ciphers
|
||||
if [ $# -eq 0 -o "$1" = 2 ] ; then
|
||||
nmap --script ssl-enum-ciphers --proxies socks4://127.0.0.1:9050 -p 6697 irc.oftc.net
|
||||
|
||||
# oftcnet6xg6roj6d7id4y4cu6dchysacqj2ldgea73qzdagufflqxrid.onion
|
||||
# irc.oftc.net
|
||||
LARGS=(
|
||||
--irc_host irc.oftc.net
|
||||
--irc_port 6697
|
||||
LARGS=(
|
||||
--irc_host $HOST
|
||||
--irc_port $IRCS_PORT
|
||||
--irc_ssl tlsv1.$TLS
|
||||
--irc_ident SyniTox
|
||||
--irc_name SyniTox
|
||||
--irc_nick SyniTox
|
||||
--irc_pass password
|
||||
--irc_pem $HOME/.config/ssl/irc.oftc.net/SyniTox.pem
|
||||
--irc_pem $HOME/.config/ssl/$HOST/SyniTox.pem
|
||||
# E178E7B9BD9E540278118193AD2C84DEF9B35E85
|
||||
--irc_fp $HOME/.config/ssl/irc.oftc.net/SyniTox.fp
|
||||
--irc_cadir '/etc/ssl/certs'
|
||||
--irc_cafile /etc/ssl/cacert.pem
|
||||
--irc_fp $HOME/.config/ssl/$HOST/SyniTox.fp
|
||||
--irc_cafile /usr/local/etc/ssl/cacert-testforge.pem
|
||||
)
|
||||
|
||||
if [ $# -eq 0 -o "$1" = 2 ] ; then
|
||||
INFO SSL v1.$TLS
|
||||
python3 tox-irc-sync.py "${LARGS[@]}" "${RARGS[@]}" "$@"
|
||||
DBUG $?
|
||||
fi
|
||||
|
||||
if [ $# -eq 0 -o "$1" = 2 ] ; then
|
||||
INFO SSL
|
||||
python3 tox-irc-sync.py "${LARGS[@]}" "${RARGS[@]}" "$@"
|
||||
fi
|
||||
|
||||
ip=oftcnet6xg6roj6d7id4y4cu6dchysacqj2ldgea73qzdagufflqxrid.onion
|
||||
ip=$ONION
|
||||
if [ $# -eq 0 -o "$1" = 3 ] ; then
|
||||
nmap --script ssl-enum-ciphers --proxies socks4://127.0.0.1:9050 -p 6697 $ip
|
||||
INFO Onion
|
||||
nmap --script ssl-enum-ciphers --proxies socks4://127.0.0.1:9050 -p $IRCS_PORT $ip
|
||||
INFO Onion v1.$TLS
|
||||
python3 tox-irc-sync.py "${LARGS[@]}" --irc_connect $ip "${RARGS[@]}" "$@"
|
||||
DBUG $?
|
||||
fi
|
||||
|
||||
ip=`tor-resolve -4 $ip`
|
||||
ip=`tor-resolve -4 $ONION`
|
||||
if [ $? -eq 0 -a -n "$ip" ] && [ $# -eq 0 -o "$1" = 4 ] ; then
|
||||
nmap --script ssl-enum-ciphers --proxies socks4://127.0.0.1:9050 -p 6697 $ip
|
||||
curl -vvvvv --cacert /etc/ssl/cacert-testforge.pem \
|
||||
--cert ~/.config/ssl/$HOST/SyniTox.pem \
|
||||
--connect-to $ip:$IRCS_PORT \
|
||||
https://$HOST:$IRCS_PORT \
|
||||
2>&1| grep "SSL connection using TLSv1.$TLS"
|
||||
|
||||
[ $? -gt 0 ] && WARN curl not OK
|
||||
nmap --script ssl-enum-ciphers --proxies socks4://127.0.0.1:9050 -p $IRCS_PORT $ip
|
||||
INFO IP $ip
|
||||
python3 tox-irc-sync.py "${LARGS[@]}" --irc_connect $ip "${RARGS[@]}" "$@"
|
||||
DBUG $?
|
||||
|
||||
Reference in New Issue
Block a user