268 lines
6.8 KiB
Bash
268 lines
6.8 KiB
Bash
#!/bin/bash
|
|
# -*- mode: sh; fill-column: 75; tab-width: 8; coding: utf-8-unix -*-
|
|
|
|
#export LD_LIBRARY_PATH=/usr/local/lib
|
|
#export TOXCORE_LIBS=/mnt/linuxPen19/var/local/src/c-toxcore/_build
|
|
export TOXCORE_LIBS=/mnt/o/var/local/src/tox_profile/libs
|
|
export PYTHONPATH=/mnt/o/var/local/src/toxygen_wrapper.git/
|
|
export https_proxy=
|
|
export http_proxy=
|
|
SOCKS_HOST=127.0.0.1
|
|
SOCKS_PORT=9050
|
|
|
|
NMAP_ARGS="-Pn --script ssl-enum-ciphers --proxies socks4://${SOCKS_HOST}:$SOCKS_PORT --reason"
|
|
CURL_ARGS="-vvvvv --cacert /etc/ssl/cacert-testforge.pem"
|
|
CURL_ARGS="$CURL_ARGS -x socks5h://${SOCKS_HOST}:$SOCKS_PORT"
|
|
CURL_ARGS="$CURL_ARGS --interface lo --dns-interface lo"
|
|
|
|
[ -f /usr/local/bin/usr_local_tput.bash ] && \
|
|
. /usr/local/bin/usr_local_tput.bash || {
|
|
DBUG() { echo DEBUG $* ; }
|
|
INFO() { echo INFO $* ; }
|
|
WARN() { echo WARN $* ; }
|
|
ERROR() { echo ERROR $* ; }
|
|
}
|
|
|
|
if true; then
|
|
HOST=irc.oftc.net
|
|
IRC_PORT=6667
|
|
IRCS_PORT=6697
|
|
ONION=oftcnet6xg6roj6d7id4y4cu6dchysacqj2ldgea73qzdagufflqxrid.onion
|
|
NICK=SyniTox
|
|
TLS=3
|
|
PEM=$HOME/.config/ssl/$HOST/SyniTox.pem
|
|
CRT=$HOME/.config/ssl/$HOST/SyniTox.crt
|
|
KEY=$HOME/.config/ssl/$HOST/SyniTox.key
|
|
FP=$HOME/.config/ssl/$HOST/SyniTox.fp
|
|
else
|
|
HOST=libera.chat
|
|
IRC_PORT=
|
|
IRCS_PORT=6697
|
|
ONION=libera75jm6of4wxpxt4aynol3xjmbtxgfyjpu34ss4d7r7q2v5zrpyd.onion
|
|
NICK=SyniTox
|
|
PEM=$HOME/.config/ssl/$HOST/SyniTox.pem
|
|
KEY=$HOME/.config/ssl/$HOST/SyniTox.key
|
|
CRT=$HOME/.config/ssl/$HOST/SyniTox.crt
|
|
FP=$HOME/.config/ssl/$HOST/SyniTox.fp
|
|
TLS=3
|
|
fi
|
|
|
|
function check_nmap() {
|
|
local retval=$1
|
|
local hfile=$2
|
|
local tag=$3
|
|
INFO $retval $hfile $tag
|
|
if ! grep /tcp $hfile ; then
|
|
ERROR check_nmap no /tcp in $hfile
|
|
return 1
|
|
# whats filtered?
|
|
elif grep '/tcp *filtered' $hfile ; then
|
|
WARN check_nmap filtered $hfile
|
|
return 2
|
|
# whats filtered?
|
|
elif grep '/tcp *open' $hfile ; then
|
|
return 0
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
function check_curl() {
|
|
local retval=$1
|
|
local hfile=$2
|
|
local tag=$3
|
|
|
|
# curl: (1) Received HTTP/0.9 when not allowed
|
|
if grep "SSL_ERROR_SYSCALL" $hfile ; then
|
|
ERROR curl $tag SSL_ERROR_SYSCALL $hfile
|
|
return 2
|
|
elif ! grep "SSL connection using TLSv1" $hfile ; then
|
|
WARN check_curl curl $tag no ciphers $hfile
|
|
elif ! grep "SSL connection using TLSv1.[3$TLS]" $hfile ; then
|
|
WARN check_curl curl $tag no TLS connection in $hfile
|
|
elif [ $TLS -eq 3 ] && grep "SSL connection using TLSv1.[2]" $hfile ; then
|
|
WARN check_curl protocol downgrade attack '?' no TLSv1.3 ciphers from $HOST
|
|
elif [ $retval -gt 1 ] ; then
|
|
grep "$IRCS_PORT/" $hfile
|
|
WARN check_curl curl $tag not OK $retval $hfile
|
|
else
|
|
INFO curl $tag OK $hfile
|
|
return 0
|
|
fi
|
|
return 1
|
|
}
|
|
a=`openssl ciphers -s -v|grep -c v1.3`
|
|
if [ "$a" -lt 3 ] ; then
|
|
WARN no SSL TLSv1.3 ciphers available to the client.
|
|
TLS=2
|
|
fi
|
|
[ $TLS = 2 ] && CURL_ARGS="$CURL_ARGS --tlsv1.2"
|
|
[ $TLS = 3 ] && CURL_ARGS="$CURL_ARGS --tlsv1.3"
|
|
|
|
NICK=emdee
|
|
if [ "$TLS" -ne 0 ] ; then
|
|
SD=$HOME/.config/ssl/$HOST
|
|
[ -d $SD ] || mkdir -p $SD || exit 2
|
|
if [ ! -s $SD/$NICK.key ] ; then
|
|
# ed25519
|
|
openssl req -x509 -nodes -newkey rsa:2048 \
|
|
-keyout $SD/$NICK.key \
|
|
-days 3650 -out $SD/$NICK.crt || exit 3
|
|
chmod 400 $SD/$NICK.key
|
|
fi
|
|
if [ ! -s $SD/$NICK.fp ] ; then
|
|
openssl x509 -noout -fingerprint -SHA1 -text \
|
|
< $SD/$NICK.crt > $SD/$NICK.fp || exit 4
|
|
fi
|
|
if [ ! -s $SD/$NICK.pem ] ; then
|
|
cat $SD/$NICK.crt $SD/$NICK.key > $SD/$NICK.pem
|
|
chmod 400 $SD/$NICK.pem || exit 5
|
|
fi
|
|
ls -l -s $SD/$NICK.pem
|
|
fi
|
|
exit 0
|
|
|
|
declare -a RARGS
|
|
if [ "$DEBUG" = 1 ] ; then
|
|
RARGS=(
|
|
--log_level 10
|
|
)
|
|
else
|
|
RARGS=(
|
|
--log_level 20
|
|
)
|
|
fi
|
|
[ -n "$socks_proxy" ] && \
|
|
RARGS+=(
|
|
--proxy_type 2
|
|
--proxy_port 9050
|
|
--proxy_host ${SOCKS_HOST}
|
|
--trace_enabled True
|
|
)
|
|
declare -a LARGS
|
|
LARGS=(
|
|
--irc_host $HOST
|
|
--irc_port $IRC_PORT
|
|
--irc_ssl ""
|
|
--irc_ident SyniTox
|
|
--irc_name SyniTox
|
|
--irc_nick $NICK
|
|
)
|
|
|
|
if [ $# -eq 0 -o "$1" = 1 ] && [ -n "$IRC_PORT" ] ; then
|
|
INFO No SSL
|
|
python3 tox-irc-sync.py "${LARGS[@]}" "${RARGS[@]}"
|
|
DBUG $?
|
|
fi
|
|
|
|
CIPHER_DOWNGRADE_OVER_TOR_LIBERA="Other addresses for libera.chat (not scanned): (null)
|
|
rDNS record for 130.239.18.116: solenoid.acc.umu.se
|
|
|
|
PORT STATE SERVICE
|
|
6697/tcp open ircs-u
|
|
| ssl-enum-ciphers:
|
|
| TLSv1.0:
|
|
| ciphers:
|
|
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|
|
| compressors:
|
|
| cipher preference: indeterminate
|
|
| cipher preference error: Too few ciphers supported
|
|
|_ least strength: A
|
|
'
|
|
"
|
|
|
|
CIPHER_DOWNGRADE_OVER_TOR_OFTC="
|
|
|
|
Nmap scan report for $HOST (130.239.18.116)
|
|
Host is up (0.26s latency).
|
|
Other addresses for $HOST (not scanned): (null)
|
|
rDNS record for 130.239.18.116: solenoid.acc.umu.se
|
|
|
|
PORT STATE SERVICE
|
|
$IRCS_PORT/tcp open ircs-u
|
|
| ssl-enum-ciphers:
|
|
| TLSv1.0:
|
|
| ciphers:
|
|
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|
|
| compressors:
|
|
| cipher preference: indeterminate
|
|
| cipher preference error: Too few ciphers supported
|
|
|_ least strength: A
|
|
"
|
|
# I know that site does v1.3 3 ciphers
|
|
LARGS=(
|
|
--irc_host $HOST
|
|
--irc_port $IRCS_PORT
|
|
--irc_ssl tlsv1.$TLS
|
|
--irc_ident SyniTox
|
|
--irc_name SyniTox
|
|
--irc_nick SyniTox
|
|
--irc_pass password
|
|
--irc_crt "$CRT"
|
|
--irc_key "$KEY"
|
|
# E178E7B9BD9E540278118193AD2C84DEF9B35E85
|
|
--irc_fp "$FP"
|
|
--irc_cafile /usr/local/etc/ssl/cacert-testforge.pem
|
|
)
|
|
|
|
ip=`tor-resolve -4 $ONION`
|
|
if [ -n "$ip" ] ; then
|
|
curl $CURL_ARGS \
|
|
--connect-to $ip:$IRCS_PORT \
|
|
https://$HOST:$IRCS_PORT \
|
|
> /tmp/TIS$$.curl 2>&1
|
|
check_curl $? /tmp/TIS$$.curl ""
|
|
else
|
|
ERROR tor-resolve failed
|
|
exit 6
|
|
fi
|
|
|
|
if [ $# -eq 0 -o "$1" = 2 -a $HOST = libera.chat ] ; then
|
|
ERROR $HOST rejects tor
|
|
elif [ $# -eq 0 -o "$1" = 2 ] ; then
|
|
INFO SSL v1.$TLS
|
|
python3 tox-irc-sync.py "${LARGS[@]}" "${RARGS[@]}"
|
|
DBUG $?
|
|
fi
|
|
|
|
if [ -n "$ip" ] ; then
|
|
[ -n "$PEM" -a -f "$PEM" ] || { ERROR NO $PEM ; exit 7 ; }
|
|
ls -l $PEM || exit 7
|
|
INFO curl $CURL_ARGS \
|
|
--cert-type PEM \
|
|
--cert $PEM \
|
|
--connect-to $ip:$IRCS_PORT \
|
|
https://$HOST:$IRCS_PORT
|
|
curl $CURL_ARGS \
|
|
--cert-type PEM \
|
|
--cert $PEM \
|
|
--connect-to $ip:$IRCS_PORT \
|
|
https://$HOST:$IRCS_PORT \
|
|
> /tmp/TIS$$.cert 2>&1
|
|
check_curl $? /tmp/TIS$$.cert "--connect-to"
|
|
else
|
|
ERROR tor-resolve failed
|
|
exit 8
|
|
fi
|
|
|
|
if [ $# -eq 0 -o "$1" = 3 ] ; then
|
|
[ -n "$PEM" -a -f "$PEM" ] || { ERROR NO $PEM ; exit 7 ; }
|
|
|
|
nmap $NMAP_ARGS -p $IRCS_PORT $ip > /tmp/TIS$$.nmap 2>&1
|
|
check_nmap $? /tmp/TIS$$.nmap $1
|
|
|
|
INFO Onion v1.$TLS
|
|
python3 tox-irc-sync.py "${LARGS[@]}" --irc_connect $ONION "${RARGS[@]}"
|
|
DBUG $?
|
|
fi
|
|
|
|
if [ $? -eq 0 ] && [ $# -eq 0 -o "$1" = 4 ] ; then
|
|
[ -n "$PEM" -a -f "$PEM" ] || { ERROR NO $PEM ; exit 7 ; }
|
|
|
|
nmap $NMAP_ARGS -p $IRCS_PORT $ip > /tmp/TIS$$.nmap 2>&1
|
|
check_nmap $? /tmp/TIS$$.nmap $1
|
|
|
|
INFO Onion v1.$TLS IP $ip
|
|
python3 tox-irc-sync.py "${LARGS[@]}" --irc_connect $ip "${RARGS[@]}"
|
|
DBUG $?
|
|
fi
|