libinterimap: deprecate SSL_protocols and introduce SSL_protocol_{min,max}.

Using the libssl interface simplifies our protocol black/whitelist
greatly; this only allows simple min/max bounds, but holes are arguably
not very useful here.

Using the new settings bumps the required libssl version to 1.1.0.

1 files changed, 29 insertions, 3 deletions

diff --git a/lib/Net/IMAP/InterIMAP.pm b/lib/Net/IMAP/InterIMAP.pm
index e2b89ec..49ea343 100644
--- a/lib/Net/IMAP/InterIMAP.pm
+++ b/lib/Net/IMAP/InterIMAP.pm
@@ -63,7 +63,9 @@ my %OPTIONS = (
     command => qr/\A(\P{Control}+)\z/,
     'null-stderr' => qr/\A(YES|NO)\z/i,
     compress => qr/\A(YES|NO)\z/i,
-    SSL_protocols => qr/\A(!?$RE_SSL_PROTO(?: !?$RE_SSL_PROTO)*)\z/,
+    SSL_protocols => qr/\A(!?$RE_SSL_PROTO(?: !?$RE_SSL_PROTO)*)\z/, # TODO deprecated, remove in 0.6
+    SSL_protocol_min => qr/\A(\P{Control}+)\z/,
+    SSL_protocol_max => qr/\A(\P{Control}+)\z/,
     SSL_fingerprint => qr/\A((?:[A-Za-z0-9]+\$)?\p{AHex}+(?: (?:[A-Za-z0-9]+\$)?\p{AHex}+)*)\z/,
     SSL_cipherlist => qr/\A(\P{Control}+)\z/,
     SSL_hostname => qr/\A(\P{Control}*)\z/,
@@ -1676,7 +1678,7 @@ sub _ssl_verify($$$) {
 }
 
 my %SSL_proto;
-BEGIN {
+BEGIN { # TODO deprecated, remove in 0.6
     sub _append_ssl_proto($$) {
         my ($k, $v) = @_;
         $SSL_proto{$k} = $v if defined $v;
@@ -1689,6 +1691,15 @@ BEGIN {
     _append_ssl_proto( "TLSv1.3", eval { Net::SSLeay::OP_NO_TLSv1_3() } );
 }
 
+# see ssl/ssl_conf.c:protocol_from_string() in the OpenSSL source tree
+my %SSL_protocol_versions = (
+    "SSLv3"   => eval { Net::SSLeay::SSL3_VERSION() }
+  , "TLSv1"   => eval { Net::SSLeay::TLS1_VERSION() }
+  , "TLSv1.1" => eval { Net::SSLeay::TLS1_1_VERSION() }
+  , "TLSv1.2" => eval { Net::SSLeay::TLS1_2_VERSION() }
+  , "TLSv1.3" => eval { Net::SSLeay::TLS1_3_VERSION() }
+);
+
 # $self->_start_ssl($socket)
 #   Upgrade the $socket to SSL/TLS.
 sub _start_ssl($$) {
@@ -1703,7 +1714,22 @@ sub _start_ssl($$) {
     my $ssl_options = Net::SSLeay::OP_SINGLE_DH_USE() | Net::SSLeay::OP_SINGLE_ECDH_USE();
     $ssl_options |= Net::SSLeay::OP_NO_COMPRESSION();
 
-    if (defined (my $protos = $self->{SSL_protocols})) {
+    if (defined $self->{SSL_protocol_min} or defined $self->{SSL_protocol_max}) {
+        $self->panic("Failed requirement libssl >=1.1.0") if $OPENSSL_VERSION < 0x1010000f;
+        my ($min, $max) = @$self{qw/SSL_protocol_min SSL_protocol_max/};
+        if (defined $min) {
+            my $v = $SSL_protocol_versions{$min} // $self->panic("Unknown protocol version: $min");
+            $self->_ssl_error("CTX_set_min_proto_version()") unless Net::SSLeay::CTX_set_min_proto_version($ctx, $v) == 1;
+            $self->log("Minimum SSL/TLS protocol version: ", $min) if $self->{debug};
+        }
+        if (defined $max) {
+            my $v = $SSL_protocol_versions{$max} // $self->panic("Unknown protocol version: $max");
+            $self->_ssl_error("CTX_set_max_proto_version()") unless Net::SSLeay::CTX_set_max_proto_version($ctx, $v) == 1;
+            $self->log("Maximum SSL/TLS protocol version: ", $max) if $self->{debug};
+        }
+    } elsif (defined (my $protos = $self->{SSL_protocols})) { # TODO deprecated, remove in 0.6
+        $self->warn("SSL_protocols is deprecated and will be removed in a future release! ",
+                    "Use SSL_protocol_{min,max} instead.");
         my ($proto_include, $proto_exclude) = (0, 0);
         foreach (split /\s+/, $protos) {
             my $neg = s/^!// ? 1 : 0;