mirror of
https://github.com/irssi/irssi.git
synced 2024-09-15 04:28:09 -04:00
5146ce9631
This patch adds two new options to /CONNECT and /SERVER to let the user
pin either an x509 certificate and/or the public key of a given server.
It is possible to fetch the certificate outside of Irssi itself to
verify the checksum. To fetch the certificate call:
$ openssl s_client -connect chat.freenode.net:6697 < /dev/null 2>/dev/null | \
openssl x509 > freenode.cert
This will download chat.freenode.net:6697's TLS certificate and put it into the
file freenode.cert.
-tls_pinned_cert
----------------
This option allows you to specify the SHA-256 hash of the x509
certificate. When succesfully connected to the server, irssi will verify
that the given server certificate matches the pin set by the user.
The SHA-256 hash of a given certificate can be verified outside of irssi
using the OpenSSL command line tool:
$ openssl x509 -in freenode.cert -fingerprint -sha256 -noout
-tls_pinned_pubkey
------------------
This option allows you to specify the SHA-256 hash of the subject public key
information section of the server certificate. This section contains both the
cryptographic parameters for the public key, but also information about the
algorithm used together with the public key parameters.
When succesfully connected to the server, irssi will verify that the
given public key matches the pin set by the user.
The SHA-256 hash of a public key can be verified outside of irssi using
the OpenSSL command line tool:
$ openssl x509 -in freenode.cert -pubkey -noout | \
openssl pkey -pubin -outform der | \
openssl dgst -sha256 -c | \
tr a-z A-Z
It is possible to specify both -tls_pinned_cert and -tls_pinned_pubkey
together.
75 lines
3.3 KiB
Plaintext
75 lines
3.3 KiB
Plaintext
|
|
%9Syntax:%9
|
|
|
|
@SYNTAX:server@
|
|
|
|
%9Parameters:%9
|
|
|
|
LIST: Displays the list of servers you are connected to.
|
|
CONNECT: Connects to the given server.
|
|
ADD: Adds a server to your configuration.
|
|
MODIFY: Modifies a server in your configuration.
|
|
REMOVE: Removes a server from your configuration.
|
|
PURGE: Purges the commands queued to be sent to the server.
|
|
|
|
-!: Doesn't autojoin the channels.
|
|
-4: Connects using IPv4.
|
|
-6: Connects using IPv6.
|
|
-tls: Connects using TLS encryption.
|
|
-tls_cert: The TLS client certificate file.
|
|
-tls_pkey: The TLS client private key, if not included in the
|
|
certificate file.
|
|
-tls_pass: The password for the TLS client private key or certificate.
|
|
-tls_verify: Verifies the TLS certificate of the server.
|
|
-tls_cafile: The file with the list of CA certificates.
|
|
-tls_capath: The directory which contains the CA certificates.
|
|
-tls_ciphers: TLS cipher suite preference lists.
|
|
-tls_pinned_cert: Pinned x509 certificate fingerprint.
|
|
-tls_pinned_pubkey: Pinned public key fingerprint.
|
|
-auto: Automatically connects to the server on startup.
|
|
-noauto: Doesn't connect to the server on startup.
|
|
-network: The network the server belongs to.
|
|
-host: The hostname you would like to connect from.
|
|
-cmdspeed: Specifies the minimum amount of time, expressed in
|
|
milliseconds, that the client must wait before sending
|
|
additional commands to the server.
|
|
-cmdmax: Specifies the maximum number of commands to perform
|
|
before starting the internal flood protection.
|
|
-port: Specifies the port to connect to the server.
|
|
-noproxy: Ignores the global proxy configuration.
|
|
-rawlog: Immediately open rawlog after connecting.
|
|
-noautosendcmd: Doesn't execute autosendcmd.
|
|
|
|
The server, port and network to add, modify or remove; if no argument is
|
|
given, the list of servers you are connected to will be returned.
|
|
|
|
%9Description:%9
|
|
|
|
Displays, adds, modifies or removes the network configuration of IRC
|
|
servers.
|
|
|
|
When using the ADD parameter on a server that already exists, the
|
|
configuration will be merged with each other.
|
|
|
|
When using the command without any of the given parameters, it will
|
|
connect to the specified server; the server in the active window will be
|
|
disconnected unless you prepend the server with the '+' character; the same
|
|
method is applicable to the CONNECT parameter.
|
|
|
|
%9Examples:%9
|
|
|
|
/SERVER
|
|
/SERVER chat.freenode.net
|
|
/SERVER +chat.freenode.net
|
|
/SERVER CONNECT chat.freenode.net
|
|
/SERVER CONNECT +chat.freenode.net
|
|
/SERVER ADD -network Freenode -noautosendcmd orwell.freenode.net
|
|
/SERVER ADD -! -auto -host staff.irssi.org -port 6667 -4 -network Freenode -noproxy orwell.freenode.net
|
|
/SERVER MODIFY -network Freenode -noauto orwell.freenode.net
|
|
/SERVER REMOVE orwell.freenode.net 6667 Freenode
|
|
/SERVER PURGE
|
|
/SERVER PURGE orwell.freenode.net
|
|
|
|
%9See also:%9 CHANNEL, CONNECT, DISCONNECT, NETWORK, RECONNECT, RMRECONNS
|
|
|