Merge tag 'upstream/0.5.3' into debian

Upstream version 0.5.3

1 files changed, 17 insertions, 10 deletions

diff --git a/lib/Net/IMAP/InterIMAP.pm b/lib/Net/IMAP/InterIMAP.pm
index b01e1a9..1a71f59 100644
--- a/lib/Net/IMAP/InterIMAP.pm
+++ b/lib/Net/IMAP/InterIMAP.pm
@@ -13,7 +13,7 @@
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
 #----------------------------------------------------------------------
 
 package Net::IMAP::InterIMAP v0.0.5;
@@ -63,7 +63,7 @@ my %OPTIONS = (
     'null-stderr' => qr/\A(YES|NO)\z/i,
     compress => qr/\A(YES|NO)\z/i,
     SSL_protocols => qr/\A(!?$RE_SSL_PROTO(?: !?$RE_SSL_PROTO)*)\z/,
-    SSL_fingerprint => qr/\A((?:[A-Za-z0-9]+\$)?\p{AHex}+)\z/,
+    SSL_fingerprint => qr/\A((?:[A-Za-z0-9]+\$)?\p{AHex}+(?: (?:[A-Za-z0-9]+\$)?\p{AHex}+)*)\z/,
     SSL_cipherlist => qr/\A(\P{Control}+)\z/,
     SSL_verify => qr/\A(YES|NO)\z/i,
     SSL_CApath => qr/\A(\P{Control}+)\z/,
@@ -329,7 +329,7 @@ sub new($%) {
             open STDOUT, '>&', $s or $self->panic("Can't dup: $!");
 
             my $stderr2;
-            if ($self->{'null-stderr'} // 0) {
+            if (($self->{'null-stderr'} // 0) and !($self->{debug} // 0)) {
                 open $stderr2, '>&', *STDERR;
                 open STDERR, '>', '/dev/null' or $self->panic("Can't open /dev/null: $!");
             }
@@ -1624,15 +1624,22 @@ sub _ssl_verify($$$) {
                       .$algo.'$'.unpack('H*', Net::SSLeay::X509_digest($cert, $type)));
         }
 
-        if (defined (my $fpr = $self->{SSL_fingerprint})) {
-            (my $algo, $fpr) = $fpr =~ /^([^\$]+)\$(.*)/ ? ($1, $2) : ('sha256', $fpr);
-            my $digest = pack 'H*', ($fpr =~ tr/://rd);
+        if (defined (my $fprs = $self->{SSL_fingerprint})) {
+            my $rv = 0;
+            foreach my $fpr (split /\s+/, $fprs) {
+                (my $algo, $fpr) = $fpr =~ /^([^\$]+)\$(.*)/ ? ($1, $2) : ('sha256', $fpr);
+                my $digest = pack 'H*', ($fpr =~ tr/://rd);
 
-            my $type = Net::SSLeay::EVP_get_digestbyname($algo)
-                or $self->_ssl_error("Can't find MD value for name '$algo'");
+                my $type = Net::SSLeay::EVP_get_digestbyname($algo)
+                    or $self->_ssl_error("Can't find MD value for name '$algo'");
 
-            my $pkey = Net::SSLeay::X509_get_X509_PUBKEY($cert);
-            unless (defined $pkey and Net::SSLeay::EVP_Digest($pkey, $type) eq $digest) {
+                my $pkey = Net::SSLeay::X509_get_X509_PUBKEY($cert);
+                if (defined $pkey and Net::SSLeay::EVP_Digest($pkey, $type) eq $digest) {
+                    $rv = 1;
+                    last;
+                }
+            }
+            unless ($rv) {
                 $self->warn("Fingerprint doesn't match! MiTM in action?");
                 $ok = 0;
             }