interimap/tests, branch v0.5.4

libinterimap: add support for the TLS SNI (Server Name Indication) extension.

2020-12-11T10:20:41+00:00

This is controlled by the new 'SSL_hostname' option.  The default value
of that option is the value of the 'host' option when it is hostname,
and the empty string (which disables SNI) when it is an IP literal.

libinterimap: make SSL_verify check the hostname as well.

2020-12-11T10:20:41+00:00

More precisely, ensure that the certificate Subject Alternative Name
(SAN) or Subject CommonName (CN) matches the hostname or IP literal
specified by the 'host' option.  Previously it was only verifying the
chain of trust.

This bumps the minimum Net::SSLeay version to 1.83 and OpenSSL version
1.0.2.

test suite: always generate new certificates on `make test`.

2020-12-11T10:20:41+00:00

In addition, sign test certificates with the same root CA.  Hence
running `make test` now requires OpenSSL 1.1.1 or later.

libinterimap: show the matching pinned SPKI in --debug mode.

2020-12-11T10:20:37+00:00

New test with a server offering both RSA+ECDSA certificates.

2020-12-09T14:29:59+00:00

This requires dovecot-imapd 2.2.31 or later.

Certificate generated with:

      $ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve \
            -out tests/snippets/dovecot/dovecot.ecdsa.key
      $ openssl req -x509 -days 3650 -subj "/CN=InterIMAP test suite" \
            -key tests/snippets/dovecot/dovecot.ecdsa.key \
            -out tests/snippets/dovecot/dovecot.ecdsa.crt

libinterimap: SSL_fingerprint now supports a space-separate list of digests to pin.

2020-12-09T14:29:54+00:00

And succeeds if, and only if, the peer certificate SPKI matches one of
the pinned digest values.  Specifying multiple digest values can key
useful in key rollover scenarios and/or when the server supports
certificates of different types (for instance RSA+ECDSA).

test suite: use a RSA certificate rather than ECDSA.

2020-12-09T13:57:11+00:00

It's arguably the most common use-case.  Generated with

  $ openssl genpkey -algorithm RSA -out tests/snippets/dovecot/dovecot.rsa.key
  $ openssl req -x509 -days 3650 -subj "/CN=InterIMAP test suite" \
        -key tests/snippets/dovecot/dovecot.rsa.key \
        -out tests/snippets/dovecot/dovecot.rsa.crt

Upgrade URLs to secure HTTP.

2020-08-04T00:35:05+00:00

libinterimap: abort on PREAUTH greeting received on plaintext connections

2020-08-03T18:50:08+00:00

Set "STARTTLS = NO" to ignore.  This is similar to CVE-2020-12398 and
CVE-2020-14093.

libinterimap: Fix response injection vulnerability after STARTTLS.

2020-08-03T18:30:46+00:00

For background see https://gitlab.com/muttmua/mutt/-/issues/248 .