This patch adds two new options to /CONNECT and /SERVER to let the user
pin either an x509 certificate and/or the public key of a given server.
It is possible to fetch the certificate outside of Irssi itself to
verify the checksum. To fetch the certificate call:
$ openssl s_client -connect chat.freenode.net:6697 < /dev/null 2>/dev/null | \
openssl x509 > freenode.cert
This will download chat.freenode.net:6697's TLS certificate and put it into the
file freenode.cert.
-tls_pinned_cert
----------------
This option allows you to specify the SHA-256 hash of the x509
certificate. When succesfully connected to the server, irssi will verify
that the given server certificate matches the pin set by the user.
The SHA-256 hash of a given certificate can be verified outside of irssi
using the OpenSSL command line tool:
$ openssl x509 -in freenode.cert -fingerprint -sha256 -noout
-tls_pinned_pubkey
------------------
This option allows you to specify the SHA-256 hash of the subject public key
information section of the server certificate. This section contains both the
cryptographic parameters for the public key, but also information about the
algorithm used together with the public key parameters.
When succesfully connected to the server, irssi will verify that the
given public key matches the pin set by the user.
The SHA-256 hash of a public key can be verified outside of irssi using
the OpenSSL command line tool:
$ openssl x509 -in freenode.cert -pubkey -noout | \
openssl pkey -pubin -outform der | \
openssl dgst -sha256 -c | \
tr a-z A-Z
It is possible to specify both -tls_pinned_cert and -tls_pinned_pubkey
together.
This patch changes the internal name of SSL to TLS. We also add -tls_*
options to /CONNECT and /SERVER, but make sure that the -ssl_* versions
of the commands continue to work like before.
this adds the CONFIG_REC * to the config_node_section and
config_node_section_index APIs as they will require access to the config
cache later on to make the config parser more robust.
certificate. See the -ssl_* options for /SERVER and /SERVER ADD. Patch by
Joel Eriksson <je-irssi@bitnux.com>.
git-svn-id: http://svn.irssi.org/repos/irssi/trunk@3146 dbcabf3a-b0e7-0310-adc4-f8d773084564
config_node_index() function. added config_node_section_index() for
adding/moving node to specified position in list.
git-svn-id: http://svn.irssi.org/repos/irssi/trunk@2460 dbcabf3a-b0e7-0310-adc4-f8d773084564
a lot in reconnects etc. this should make it easier to track when it's
supposed to be destroyed. Hopefully fixes a crash I assume is related to
this but couldn't find..
git-svn-id: http://svn.irssi.org/repos/irssi/trunk@1880 dbcabf3a-b0e7-0310-adc4-f8d773084564
host name resolving. /SERVER ADD: added options -4 and -6. Fixed crash
at startup if server didn't have chat network set. "Connecting to xxx
[ip]" is now displayed before calling connect(), so if it fails we'll
still get the IP it's trying to connect to.
git-svn-id: http://svn.irssi.org/repos/irssi/trunk@1268 dbcabf3a-b0e7-0310-adc4-f8d773084564
Several other related multiprotocol updates.
Removed /SILCSERVER from SILC, /CONNECT and /SERVER should work
properly now. Rejoining channels after reconnection works.
git-svn-id: http://svn.irssi.org/repos/irssi/trunk@1245 dbcabf3a-b0e7-0310-adc4-f8d773084564
chatnet config. Moved reading chatnets to core. Lots of other
multiprotocol updates.
git-svn-id: http://svn.irssi.org/repos/irssi/trunk@1237 dbcabf3a-b0e7-0310-adc4-f8d773084564
connect to IPv4 or IPv6 address of the server. If -host or /SET
hostname is set irssi determines from it if it should use IPv4 or v6.
git-svn-id: http://svn.irssi.org/repos/irssi/trunk@1192 dbcabf3a-b0e7-0310-adc4-f8d773084564
