diff options
Diffstat (limited to 'tools')
| -rwxr-xr-x | tools/testssl | 173 |
1 files changed, 173 insertions, 0 deletions
diff --git a/tools/testssl b/tools/testssl new file mode 100755 index 000000000..ece15984f --- /dev/null +++ b/tools/testssl @@ -0,0 +1,173 @@ +#!/usr/bin/env perl +# +# InspIRCd -- Internet Relay Chat Daemon +# +# Copyright (C) 2020 Sadie Powell <sadie@witchery.services> +# +# This file is part of InspIRCd. InspIRCd is free software: you can +# redistribute it and/or modify it under the terms of the GNU General Public +# License as published by the Free Software Foundation, version 2. +# +# This program is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS +# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more +# details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + + +BEGIN { + require 5.10.0; +} + +use feature ':5.10'; +use strict; +use warnings FATAL => qw(all); + +use IO::Socket(); +use IO::Socket::SSL(); + +use constant { + CC_BOLD => -t STDOUT ? "\e[1m" : '', + CC_RESET => -t STDOUT ? "\e[0m" : '', + CC_GREEN => -t STDOUT ? "\e[1;32m" : '', + CC_RED => -t STDOUT ? "\e[1;31m" : '', +}; + +if (scalar @ARGV < 2) { + say STDERR "Usage: $0 <hostip> <port> [selfsigned]"; + exit 1; +} + +# By default STDOUT is only flushed at the end of each line. This sucks for our +# needs so we disable it. +STDOUT->autoflush(1); + +my $hostip = shift @ARGV; +if ($hostip =~ /[^A-Za-z0-9.:]/) { + say STDERR "Error: invalid hostname or IP address: $hostip"; + exit 1; +} + +my $port = shift @ARGV; +if ($port =~ /\D/ || $port < 1 || $port > 65535) { + say STDERR "Error: invalid TCP port: $port"; + exit 1; +} + +my $self_signed = shift // '' eq 'selfsigned'; + +print "Checking whether ${\CC_BOLD}$hostip/$port${\CC_RESET} is reachable ... "; +my $sock = IO::Socket::INET->new( + PeerAddr => $hostip, + PeerPort => $port, +); + +unless ($sock) { + say <<"EOM"; +${\CC_RED}no${\CC_RESET} + +It seems like the server endpoint you specified is not reachable! Make sure that: + + * You have specified a <bind> tag in your config for this endpoint. + * You have rehashed or restarted the server since adding the <bind> tag. + * If you are using a firewall incoming connections on TCP port $port are allowed. + * The endpoint your server is listening on is not local or private. + +See https://docs.inspircd.org/3/configuration/#ltbindgt for more information. +EOM + exit 1; +} + +say "${\CC_GREEN}yes${\CC_RESET}"; +print "Checking whether ${\CC_BOLD}$hostip/$port${\CC_RESET} is using plaintext ... "; +my $error = $sock->recv(my $data, 1); + +if ($error) { + say <<"EOM"; +${\CC_RED}error${\CC_RESET} + +It seems like the server dropped the connection before sending anything! Make sure that: + + * The endpoint you specified is actually your IRC server. + * If you are using a firewall incoming data on TCP port $port are allowed. + +See https://docs.inspircd.org/3/configuration/#ltbindgt for more information. +EOM + exit 1; +} elsif ($data =~ /[A-Z:@]/) { + say <<"EOM"; +${\CC_RED}yes${\CC_RESET} + +It appears that the server endpoint is using plaintext! Make sure that: + + * You have one or more of the following modules loaded: + - ssl_gnutls + - ssl_openssl + - ssl_mbedtls + + * If you have specified one or more <sslprofile> tags then the value of + <bind:ssl> is the same as an <sslprofile:name> field. Otherwise, it should + be set to "gnutls" for the ssl_gnutls module, "openssl" for the ssl_openssl + module, or "mbedtls" for the ssl_mbedtls module. + + * If you have specified the name of an <sslprofile> in <bind:ssl> then the + value of <sslprofile:provider> is set to "gnutls" if using the ssl_gnutls + module, "openssl" if using the ssl_openssl module, or "mbedtls" if using + the ssl_mbedtls module. + + * If you have your SSL configuration in a file other than inspircd.conf then + that file is included by inspircd.conf. + +See the following links for more information: + + https://docs.inspircd.org/3/modules/ssl_gnutls/#configuration + https://docs.inspircd.org/3/modules/ssl_mbedtls/#configuration + https://docs.inspircd.org/3/modules/ssl_openssl/#configuration +EOM + exit 1; +} + +$sock->close(); +say "${\CC_GREEN}no${\CC_RESET}"; +print "Checking whether ${\CC_BOLD}$hostip/$port${\CC_RESET} can have an SSL session negotiated ... "; +$sock = IO::Socket::SSL->new( + PeerAddr => $hostip, + PeerPort => $port, + SSL_hostname => $hostip, + SSL_verify_mode => $self_signed ? IO::Socket::SSL::SSL_VERIFY_NONE : IO::Socket::SSL::SSL_VERIFY_PEER, +); + +unless ($sock) { + say <<"EOM"; +${\CC_RED}no${\CC_RESET} + +It appears that something is wrong with your server. Make sure that: + + - You are not using an old version of GnuTLS, mbedTLS, or OpenSSL which only + supports deprecated algorithms like SSLv3. + +The error provided by the SSL library was: + + $IO::Socket::SSL::SSL_ERROR +EOM + exit 1; +} + + +say <<"EOM"; +${\CC_GREEN}yes${\CC_RESET} + +It seems like SSL is working fine on your server. If you are having trouble +connecting try using a different client or connecting from a different host. + +You may also find running some of the following commands to be helpful: + + gnutls-cli-debug --port $port $hostip + openssl s_client -connect $hostip:$port -debug -security_debug + +If you need any help working out what is wrong then visit our support channel +at irc.inspircd.org #inspircd. +EOM |