drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2024-11-30 05:50:53 +03:00
Code Issues Packages Projects Releases Wiki Activity

blockcheck: test for tls-max option present (curl 7.54+)

Browse Source
This commit is contained in:
bol-van 2021-12-11 11:52:53 +03:00
parent 3061833aa8
commit 96a18b2d8d
1 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
blockcheck.sh
View File

@ -141,6 +141,13 @@ curl_supports_tls13()
curl --tlsv1.3 -Is -o /dev/null https://w3.org 2>/dev/null curl --tlsv1.3 -Is -o /dev/null https://w3.org 2>/dev/null
[ $? != 4 ] [ $? != 4 ]
} }
curl_supports_tlsmax()
{
# supported since curl 7.54
curl --tls-max 1.2 -Is -o /dev/null http://$LOCALHOST_IPT:65535 2>/dev/null
# return code 2 = init failed. likely bad command line options
[ $? != 2 ]
}
hdrfile_http_code() hdrfile_http_code()
{ {
@ -184,7 +191,7 @@ curl_test_https_tls12()
# prevent using QUIC if available in curl # prevent using QUIC if available in curl
# do not use tls 1.3 to make sure server certificate is not encrypted # do not use tls 1.3 to make sure server certificate is not encrypted
curl -${1}Ss --max-time $CURL_MAX_TIME $CURL_OPT --http1.1 --tls-max 1.2 "https://$2" -o /dev/null 2>&1 curl -${1}Ss --max-time $CURL_MAX_TIME $CURL_OPT --http1.1 $TLSMAX12 "https://$2" -o /dev/null 2>&1
} }
curl_test_https_tls13() curl_test_https_tls13()
{ {
@ -193,7 +200,7 @@ curl_test_https_tls13()
# prevent using QUIC if available in curl # prevent using QUIC if available in curl
# force TLS1.3 mode # force TLS1.3 mode
curl -${1}Ss --max-time $CURL_MAX_TIME $CURL_OPT --http1.1 --tlsv1.3 --tls-max 1.3 "https://$2" -o /dev/null 2>&1 curl -${1}Ss --max-time $CURL_MAX_TIME $CURL_OPT --http1.1 --tlsv1.3 $TLSMAX13 "https://$2" -o /dev/null 2>&1
} }
nfqws_ipt_prepare() nfqws_ipt_prepare()
@ -484,6 +491,17 @@ configure_ip_version()
LOCALHOST_IPT=127.0.0.1 LOCALHOST_IPT=127.0.0.1
fi fi
} }
configure_curl_opt()
{
TLSMAX12=
TLSMAX13=
curl_supports_tlsmax && {
TLSMAX12="--tls-max 1.2"
TLSMAX13="--tls-max 1.3"
}
TLS13=
curl_supports_tls13 && TLS13=1
}
ask_params() ask_params()
{ {
@ -503,6 +521,7 @@ ask_params()
exitp 1 exitp 1
} }
configure_ip_version configure_ip_version
configure_curl_opt
ENABLE_HTTP=1 ENABLE_HTTP=1
ask_yes_no_var ENABLE_HTTP "check http" ask_yes_no_var ENABLE_HTTP "check http"
@ -512,7 +531,7 @@ ask_params()
ENABLE_HTTPS_TLS13=0 ENABLE_HTTPS_TLS13=0
echo echo
if curl_supports_tls13; then if [ -n "$TLS13" ]; then
echo "TLS 1.3 is the new standard for encrypted communications over TCP" echo "TLS 1.3 is the new standard for encrypted communications over TCP"
echo "its the most important feature for DPI bypass is encrypted TLS ServerHello" echo "its the most important feature for DPI bypass is encrypted TLS ServerHello"
echo "more and more sites enable TLS 1.3 but still there're many sites with only TLS 1.2 support" echo "more and more sites enable TLS 1.3 but still there're many sites with only TLS 1.2 support"