flewkey/flewkey.com
1
0
Fork 0
Code Releases Activity

nds-constrain't: Update post

Browse Source
This commit is contained in:
Ryan Fox 2020-12-31 04:26:46 +00:00
parent ff3280d8d8
commit ca4c9731b0
Signed by: flewkey
GPG Key ID: 94F56ADFD848851E
1 changed files with 49 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
posts/2020-07-12-nds-constraint.md
View File

@ -10,13 +10,17 @@ made it possible to connect to alternative online services without ROM patching.
The bug itself is simple: the NDS SSL library does not care whether or not a The bug itself is simple: the NDS SSL library does not care whether or not a
certificate is authorized to act as a certificate authority. This means that certificate is authorized to act as a certificate authority. This means that
— with any valid certificate — we can sign whatever we want, even a — with any valid certificate — we can sign whatever we want,
certificate under a false hostname. including a certificate under a false hostname.
A guide to using this bug for fun and profit is now available on the A guide to using this bug for fun and profit is now available on the
[official page](https://github.com/KaeruTeam/nds-constraint), which is much [official page](https://github.com/KaeruTeam/nds-constraint), which is much
better written than mine. However, you are free to keep reading this one. better written than mine. However, you are free to keep reading this one.
**Update (2020-12-31):** I have corrected some mistakes in this post. There is
also information at the bottom of this post regarding OpenSSL which is important
to setting up nds-constrain't properly.
--- ---
### Getting the Wii client certificate ### Getting the Wii client certificate
@ -25,8 +29,8 @@ As explained in the [official page](https://github.com/KaeruTeam/nds-constraint)
for nds-constrain't, the Wii client certificate is signed by Nintendo and for nds-constrain't, the Wii client certificate is signed by Nintendo and
considered valid. Therefore, we can use it's key to sign whatever we want. You considered valid. Therefore, we can use it's key to sign whatever we want. You
_could_ grab it from a Wii, but it is much easier to download it from _could_ grab it from a Wii, but it is much easier to download it from
[Larsenv's page](https://larsenv.github.io/NintendoCerts/index.html). You will [Larsenv's page](https://larsenv.github.io/NintendoCerts/index.html). Choose the
want to use the link labelled "Wii NWC Prod 1", by the way. "Wii NWC Prod 1" key pair.
### Converting it to a useable format ### Converting it to a useable format
@ -41,41 +45,46 @@ files, which I will name NWC.crt and NWC.key.
### Signing your certificate ### Signing your certificate
Instructions for this are listed on the official GitHub page, but I have copied Instructions for this are listed on the [official guide](https://github.com/KaeruTeam/nds-constraint).
them for reference. If I remember correctly, the DS can only handle the SHA-1 I have copied them for reference.
and MD5 hash formats, so pay attention to the `-sha1` flag.
openssl genrsa -out server.key 1024 openssl genrsa -out server.key 1024
openssl req -new -key server.key -out server.csr openssl req -new -key server.key -out server.csr
openssl x509 -req -in server.csr -CA NWC.crt -CAkey NWC.key -CAcreateserial -out server.crt -days 3650 -sha1 openssl x509 -req -in server.csr -CA NWC.crt -CAkey NWC.key -CAcreateserial -out server.crt -days 3650 -sha1
Your webserver probably wants the certificate chain as well, so let's generate NGINX users need to create a file for the certificate chain as well.
that as well.
cat server.crt NWC.crt > server-chain.crt cat server.crt NWC.crt > server-chain.crt
We are ready to rock and roll! We are now ready to rock and roll!
### Using your phony certificate ### Using your phony certificate
Once the SSL certificate is installed, you may run into issues connecting with Once the SSL certificate is installed, you may run into issues connecting with
your DS. This because your NDS only knows how to use SSLv3, with the SHA-1 or your DS. This because your NDS only knows how to use SSLv3, with either the
MD5 cipher sets. Enabling SSLv3 and SHA-1 isn't always possible with webservers, RC4-SHA or RC4-MD5 cipher set. To enable DS compatibility for NGINX, add the
so I recommend using NGINX as a reverse-proxy. To enable DS compatibility for following lines to your NGINX configuration.
NGINX, add the following lines to your NGINX configuration.
ssl_protocols SSLv3; ssl_protocols SSLv3;
ssl_ciphers ECDHE-RSA-AES128-SHA; ssl_ciphers RC4-SHA:RC4-MD5:@SECLEVEL=0;
Most services on Nintendo consoles make liberal use of headers. Because of this, The config settings are nearly identical in Apache.
some extra options need to be enabled.
SSLProtocol SSLv3
SSLCipherSuite RC4-SHA:RC4-MD5:@SECLEVEL=0
Most services for Nintendo consoles make liberal use of headers. Unfortunately,
some headers (e.g. `http_x_gamecd`) contain underscores, which
[shouldn't be in the header field](https://tools.ietf.org/html/rfc7230#section-3.2.6).
Allowing this in NGINX is simple.
underscores_in_headers on; underscores_in_headers on;
proxy_pass_request_headers on; proxy_pass_request_headers on;
Because we have enabled insecure SSL settings on NGINX, you probably don't want Working around this in Apache is a bit more difficult. For information about
to use it for any mission-critical web applications. If you continue having working around invalid headers in Apache, see
issues with NDS connectivity, please contact me. [this example](http://httpd.apache.org/docs/trunk/env.html#fixheader). If you
continue having issues with NDS connectivity, please contact me.
### Having fun ### Having fun
@ -87,11 +96,24 @@ without ROM patches!
### Update ### Update
After receiving some e-mails, I have learned that the NDS-supported ciphers have Modern versions of OpenSSL have SSLv3 and the RC4 ciphers disabled by default,
been disabled in OpenSSL versions past 1.0.2g, unless configured with which means that you will need to compile OpenSSL yourself. For information on
"enable-weak-ssl-ciphers". This means that you may have to re-build NGINX (or doing this, see the
mod_ssl for Apache) to get it working. [INSTALL.md](https://github.com/openssl/openssl/blob/master/INSTALL.md)
from the OpenSSL repository, or the
[Compilation and Installation](https://wiki.openssl.org/index.php/Compilation_and_Installation)
page from their wiki.
If you have the means, I suggest taking Wireshark captures to find the cause of When configuring OpenSSL, be sure to specify the "enable-ssl3",
any SSL issues. Enabling debug logging in NGINX can also help you pinpoint "enable-ssl3-method" and "enable-weak-ciphers" flags like so:
handshake errors. If all else fails, you can find my e-mail on the about page.
./config enable-ssl3 enable-ssl3-method enable-weak-ciphers
It will install in /usr/local and /usr/local/ssl by default, so it shouldn't
interfere with the version currently installed on your system.
Gentoo users can add the "sslv3" and "weak-ciphers" USE flags to OpenSSL
and rebuild it. Since there is no weak-ciphers USE flag at the time of writing,
you might want to add my
[flewkey-overlay](https://git.sdf.org/flewkey/flewkey-overlay) and unmask
`dev-libs/openssl::flewkey-overlay`.