Re: [spam][crazy] Adding Cert Pinning to E-X

[Undiscussed Horrific Abuse, One Victim of Many]

the script to enumerate cert fingerprints didn't output what i wanted,
the output seemed short, etc. i'll try to attach it to this post to
the wrong thread.

cert_prints.list.5
Description: Binary data

import electrumx
import aiorpcx

import asyncio
import hashlib
import socket
import ssl

async def main():
    coin_peers = {
        coin.NAME: coin.PEERS
        for coin in electrumx.lib.coins.util.subclasses(electrumx.lib.coins.Coin)
        if len(coin.PEERS) > 0
    }

    nonverifying_ssl = ssl.SSLContext(ssl.PROTOCOL_TLS)
    
    for name, peers in coin_peers.items():
        try:
            for peer in peers:
                peer = electrumx.lib.peer.Peer.from_real_name(peer, '')
                cert_msg = ''
                client = aiorpcx.connect_rs(peer.host, peer.ssl_port, ssl=True)
                try:
                    transport, protocol = await client.create_connection()
                except ssl.SSLCertVerificationError as err:
                    if err.reason != 'CERTIFICATE_VERIFY_FAILED':
                        raise
                    else:
                        cert_msg = err.verify_message
                        client = aiorpcx.connect_rs(peer.host, peer.ssl_port, ssl=nonverifying_ssl)
                        transport, protocol = await client.create_connection()
                except socket.gaierror as err:
                    print(peer.real_name(), err.args[1])
                    continue
                except ConnectionRefusedError:
                    print(peer.real_name(), 'ssl connection refused')
                    continue
                except OSError as err:
                    if type(err) is OSError:
                        print(peer.real_name(), err.args[0].split(': ', 1)[1])
                    elif type(err) is TimeoutError:
                        print(peer.real_name(), 'timeout', err.strerror)
                    else:
                        import pdb; pdb.set_trace()
                        print(err)
                    continue
                try:
                    ssl_obj = protocol.session.transport._asyncio_transport.get_extra_info('ssl_object')
                    der_cert = ssl_obj.getpeercert(True)
                    for alg in 'md5 sha1 sha256 blake2b'.split(' '):
                        cert_print = getattr(hashlib, alg)(der_cert).hexdigest()
                        print(peer.real_name(), alg, cert_print, cert_msg)
                finally:
                    await protocol.session.close()
        except KeyError:
            continue

asyncio.run(main())