#!/bin/bash # -*- mode: sh; fill-column: 75; tab-width: 8; coding: utf-8-unix -*- #export LD_LIBRARY_PATH=/usr/local/lib #export TOXCORE_LIBS=/mnt/linuxPen19/var/local/src/c-toxcore/_build export TOXCORE_LIBS=/mnt/o/var/local/src/tox_profile/libs export PYTHONPATH=/mnt/o/var/local/src/toxygen_wrapper.git/ export https_proxy= export http_proxy= SOCKS_HOST=127.0.0.1 SOCKS_PORT=9050 NMAP_ARGS="-Pn --script ssl-enum-ciphers --proxies socks4://${SOCKS_HOST}:$SOCKS_PORT --reason" CURL_ARGS="-vvvvv --cacert /etc/ssl/cacert-testforge.pem" CURL_ARGS="$CURL_ARGS -x socks5h://${SOCKS_HOST}:$SOCKS_PORT" CURL_ARGS="$CURL_ARGS --interface lo --dns-interface lo" [ -f /usr/local/bin/usr_local_tput.bash ] && \ . /usr/local/bin/usr_local_tput.bash || { DBUG() { echo DEBUG $* ; } INFO() { echo INFO $* ; } WARN() { echo WARN $* ; } ERROR() { echo ERROR $* ; } } if true; then HOST=irc.oftc.net IRC_PORT=6667 IRCS_PORT=6697 ONION=oftcnet6xg6roj6d7id4y4cu6dchysacqj2ldgea73qzdagufflqxrid.onion NICK=SyniTox TLS=3 PEM=$HOME/.config/ssl/$HOST/SyniTox.pem CRT=$HOME/.config/ssl/$HOST/SyniTox.crt KEY=$HOME/.config/ssl/$HOST/SyniTox.key FP=$HOME/.config/ssl/$HOST/SyniTox.fp else HOST=libera.chat IRC_PORT= IRCS_PORT=6697 ONION=libera75jm6of4wxpxt4aynol3xjmbtxgfyjpu34ss4d7r7q2v5zrpyd.onion NICK=SyniTox PEM=$HOME/.config/ssl/$HOST/SyniTox.pem KEY=$HOME/.config/ssl/$HOST/SyniTox.key CRT=$HOME/.config/ssl/$HOST/SyniTox.crt FP=$HOME/.config/ssl/$HOST/SyniTox.fp TLS=3 fi function check_nmap() { local retval=$1 local hfile=$2 local tag=$3 INFO $retval $hfile $tag if ! grep /tcp $hfile ; then ERROR check_nmap no /tcp in $hfile return 1 # whats filtered? elif grep '/tcp *filtered' $hfile ; then WARN check_nmap filtered $hfile return 2 # whats filtered? elif grep '/tcp *open' $hfile ; then return 0 fi return 0 } function check_curl() { local retval=$1 local hfile=$2 local tag=$3 # curl: (1) Received HTTP/0.9 when not allowed if grep "SSL_ERROR_SYSCALL" $hfile ; then ERROR curl $tag SSL_ERROR_SYSCALL $hfile return 2 elif ! grep "SSL connection using TLSv1" $hfile ; then WARN check_curl curl $tag no ciphers $hfile elif ! grep "SSL connection using TLSv1.[3$TLS]" $hfile ; then WARN check_curl curl $tag no TLS connection in $hfile elif [ $TLS -eq 3 ] && grep "SSL connection using TLSv1.[2]" $hfile ; then WARN check_curl protocol downgrade attack '?' no TLSv1.3 ciphers from $HOST elif [ $retval -gt 1 ] ; then grep "$IRCS_PORT/" $hfile WARN check_curl curl $tag not OK $retval $hfile else INFO curl $tag OK $hfile return 0 fi return 1 } a=`openssl ciphers -s -v|grep -c v1.3` if [ "$a" -lt 3 ] ; then WARN no SSL TLSv1.3 ciphers available to the client. TLS=2 fi [ $TLS = 2 ] && CURL_ARGS="$CURL_ARGS --tlsv1.2" [ $TLS = 3 ] && CURL_ARGS="$CURL_ARGS --tlsv1.3" NICK=emdee if [ "$TLS" -ne 0 ] ; then SD=$HOME/.config/ssl/$HOST [ -d $SD ] || mkdir -p $SD || exit 2 if [ ! -s $SD/$NICK.key ] ; then # ed25519 openssl req -x509 -nodes -newkey rsa:2048 \ -keyout $SD/$NICK.key \ -days 3650 -out $SD/$NICK.crt || exit 3 chmod 400 $SD/$NICK.key fi if [ ! -s $SD/$NICK.fp ] ; then openssl x509 -noout -fingerprint -SHA1 -text \ < $SD/$NICK.crt > $SD/$NICK.fp || exit 4 fi if [ ! -s $SD/$NICK.pem ] ; then cat $SD/$NICK.crt $SD/$NICK.key > $SD/$NICK.pem chmod 400 $SD/$NICK.pem || exit 5 fi ls -l -s $SD/$NICK.pem fi exit 0 declare -a RARGS if [ "$DEBUG" = 1 ] ; then RARGS=( --log_level 10 ) else RARGS=( --log_level 20 ) fi [ -n "$socks_proxy" ] && \ RARGS+=( --proxy_type 2 --proxy_port 9050 --proxy_host ${SOCKS_HOST} --trace_enabled True ) declare -a LARGS LARGS=( --irc_host $HOST --irc_port $IRC_PORT --irc_ssl "" --irc_ident SyniTox --irc_name SyniTox --irc_nick $NICK ) if [ $# -eq 0 -o "$1" = 1 ] && [ -n "$IRC_PORT" ] ; then INFO No SSL python3 tox-irc-sync.py "${LARGS[@]}" "${RARGS[@]}" DBUG $? fi CIPHER_DOWNGRADE_OVER_TOR_LIBERA="Other addresses for libera.chat (not scanned): (null) rDNS record for 130.239.18.116: solenoid.acc.umu.se PORT STATE SERVICE 6697/tcp open ircs-u | ssl-enum-ciphers: | TLSv1.0: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | compressors: | cipher preference: indeterminate | cipher preference error: Too few ciphers supported |_ least strength: A ' " CIPHER_DOWNGRADE_OVER_TOR_OFTC=" Nmap scan report for $HOST (130.239.18.116) Host is up (0.26s latency). Other addresses for $HOST (not scanned): (null) rDNS record for 130.239.18.116: solenoid.acc.umu.se PORT STATE SERVICE $IRCS_PORT/tcp open ircs-u | ssl-enum-ciphers: | TLSv1.0: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | compressors: | cipher preference: indeterminate | cipher preference error: Too few ciphers supported |_ least strength: A " # I know that site does v1.3 3 ciphers LARGS=( --irc_host $HOST --irc_port $IRCS_PORT --irc_ssl tlsv1.$TLS --irc_ident SyniTox --irc_name SyniTox --irc_nick SyniTox --irc_pass password --irc_crt "$CRT" --irc_key "$KEY" # E178E7B9BD9E540278118193AD2C84DEF9B35E85 --irc_fp "$FP" --irc_cafile /usr/local/etc/ssl/cacert-testforge.pem ) ip=`tor-resolve -4 $ONION` if [ -n "$ip" ] ; then curl $CURL_ARGS \ --connect-to $ip:$IRCS_PORT \ https://$HOST:$IRCS_PORT \ > /tmp/TIS$$.curl 2>&1 check_curl $? /tmp/TIS$$.curl "" else ERROR tor-resolve failed exit 6 fi if [ $# -eq 0 -o "$1" = 2 -a $HOST = libera.chat ] ; then ERROR $HOST rejects tor elif [ $# -eq 0 -o "$1" = 2 ] ; then INFO SSL v1.$TLS python3 tox-irc-sync.py "${LARGS[@]}" "${RARGS[@]}" DBUG $? fi if [ -n "$ip" ] ; then [ -n "$PEM" -a -f "$PEM" ] || { ERROR NO $PEM ; exit 7 ; } ls -l $PEM || exit 7 INFO curl $CURL_ARGS \ --cert-type PEM \ --cert $PEM \ --connect-to $ip:$IRCS_PORT \ https://$HOST:$IRCS_PORT curl $CURL_ARGS \ --cert-type PEM \ --cert $PEM \ --connect-to $ip:$IRCS_PORT \ https://$HOST:$IRCS_PORT \ > /tmp/TIS$$.cert 2>&1 check_curl $? /tmp/TIS$$.cert "--connect-to" else ERROR tor-resolve failed exit 8 fi if [ $# -eq 0 -o "$1" = 3 ] ; then [ -n "$PEM" -a -f "$PEM" ] || { ERROR NO $PEM ; exit 7 ; } nmap $NMAP_ARGS -p $IRCS_PORT $ip > /tmp/TIS$$.nmap 2>&1 check_nmap $? /tmp/TIS$$.nmap $1 INFO Onion v1.$TLS python3 tox-irc-sync.py "${LARGS[@]}" --irc_connect $ONION "${RARGS[@]}" DBUG $? fi if [ $? -eq 0 ] && [ $# -eq 0 -o "$1" = 4 ] ; then [ -n "$PEM" -a -f "$PEM" ] || { ERROR NO $PEM ; exit 7 ; } nmap $NMAP_ARGS -p $IRCS_PORT $ip > /tmp/TIS$$.nmap 2>&1 check_nmap $? /tmp/TIS$$.nmap $1 INFO Onion v1.$TLS IP $ip python3 tox-irc-sync.py "${LARGS[@]}" --irc_connect $ip "${RARGS[@]}" DBUG $? fi