idk/reseed-tools
1
0
Fork 0
Code Issues 4 Pull Requests Packages Projects Releases Wiki Activity

resolve conflicts with and merge in martin61 branch so I can start working off that instead

Browse Source
This commit is contained in:
idk
2019-06-27 16:45:30 -04:00
parent 33558398da 7267f1d718
commit 1c775b22d7
5 changed files with 63 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -4,3 +4,4 @@
/_netdb
i2pseeds.su3
*.pem
onion.key

4
CHANGELOG.md
View File

@@ -1,3 +1,7 @@
2019-04-21
* app.Version = "0.1.7"
* enabling TLS 1.3 *only*
2016-12-21
* deactivating previous random time delta, makes only sense when patching ri too
* app.Version = "0.1.6"

34
history.txt Normal file
View File

@@ -0,0 +1,34 @@
2019-04-21
* app.Version = "0.1.7"
* enabling TLS 1.3 *only*
2016-12-21
* deactivating previous random time delta, makes only sense when patching ri too
* app.Version = "0.1.6"
2016-10-09
* seed the math random generator with time.Now().UnixNano()
* added 6h+6h random time delta at su3-age to increase anonymity
* app.Version = "0.1.5"
2016-05-15
* README.md updated
* allowed routerInfos age increased from 96 to 192 hours
* app.Version = "0.1.4"
2016-03-05
* app.Version = "0.1.3"
* CRL creation added
2016-01-31
* allowed TLS ciphers updated (hardened)
* TLS certificate generation: RSA 4096 --> ECDSAWithSHA512 384bit secp384r1
* ECDHE handshake: only CurveP384 + CurveP521, default CurveP256 removed
* TLS certificate valid: 2y --> 5y
* throttled.PerDay(4) --> PerHour(4), to enable limited testing
* su3 RebuildInterval: 24h --> 90h, higher anonymity for the running i2p-router
* numRi per su3 file: 75 --> 77
2016-01
* fork from https://github.com/MDrollette/i2p-tools

5
main.go
View File

@@ -9,6 +9,11 @@ import (
)
func main() {
// TLS 1.3 is available only on an opt-in basis in Go 1.12.
// To enable it, set the GODEBUG environment variable (comma-separated key=value options) such that it includes "tls13=1".
// To enable it from within the process, set the environment variable before any use of TLS:
os.Setenv("GODEBUG", os.Getenv("GODEBUG")+",tls13=1")
// use at most half the cpu cores
runtime.GOMAXPROCS(runtime.NumCPU() / 2)

28
reseed/server.go
View File

@@ -15,10 +15,10 @@ import (
"github.com/cretz/bine/tor"
"github.com/cretz/bine/torutil/ed25519"
"github.com/throttled/throttled"
"github.com/throttled/throttled/store"
"github.com/gorilla/handlers"
"github.com/justinas/alice"
"gopkg.in/throttled/throttled.v2"
"gopkg.in/throttled/throttled.v2/store"
)
const (
@@ -34,17 +34,23 @@ type Server struct {
func NewServer(prefix string, trustProxy bool) *Server {
config := &tls.Config{
MinVersion: tls.VersionTLS10,
// MinVersion: tls.VersionTLS10,
// PreferServerCipherSuites: true,
// CipherSuites: []uint16{
// tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
// tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
// tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
// },
MinVersion: tls.VersionTLS13,
PreferServerCipherSuites: true,
CipherSuites: []uint16{
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
tls.TLS_AES_256_GCM_SHA384,
tls.TLS_CHACHA20_POLY1305_SHA256,
},
CurvePreferences: []tls.CurveID{tls.CurveP384, tls.CurveP521}, // default CurveP256 removed
}