libinterimap: make SSL_verify check the hostname as well.

More precisely, ensure that the certificate Subject Alternative Name
(SAN) or Subject CommonName (CN) matches the hostname or IP literal
specified by the 'host' option.  Previously it was only verifying the
chain of trust.

This bumps the minimum Net::SSLeay version to 1.83 and OpenSSL version
1.0.2.

2 files changed, 54 insertions, 8 deletions

diff --git a/tests/tls-verify-peer/interimap.remote b/tests/tls-verify-peer/interimap.remote
index b02fcd0..263655f 100644
--- a/tests/tls-verify-peer/interimap.remote
+++ b/tests/tls-verify-peer/interimap.remote
@@ -1,2 +1 @@
-host = ::1
 port = 10993
diff --git a/tests/tls-verify-peer/t b/tests/tls-verify-peer/t
index 9b676a6..2461a1f 100644
--- a/tests/tls-verify-peer/t
+++ b/tests/tls-verify-peer/t
@@ -1,6 +1,15 @@
+X509_SHA256="$(doveconf -c "$HOME_remote/.dovecot/config" -hx ssl_cert \
+    | openssl x509 -noout -fingerprint -sha256 \
+    | sed -rn "/^.*=\\s*/ {s///p;q}" | tr -d : | tr "[A-Z]" "[a-z]")"
+PKEY_SHA256="$(doveconf -c "$HOME_remote/.dovecot/config" -hx ssl_cert \
+    | openssl x509 -pubkey | openssl pkey -pubin -outform DER \
+    | openssl dgst -sha256 | sed -rn "/^.*=\\s*/ {s///p;q}")"
+
 unverified_peer() {
     ! interimap --debug || error
 
+    # make sure we aborted the handshake immediately after connecting
+    grep -Fx "remote: Peer certificate fingerprint: sha256\$$X509_SHA256" <"$STDERR" || error
     grep -Fx "remote: ERROR: Can't initiate TLS/SSL handshake" <"$STDERR" || error
     sed -nr "s/remote: \[[0-9]+\] (preverify=[0-9]+)$/\1/p" <"$STDERR" >"$TMPDIR/preverify"
     [ -s "$TMPDIR/preverify" ] || error
@@ -11,12 +20,13 @@ unverified_peer() {
 }
 verified_peer() {
     local i u
-    for ((i = 0; i < 32; i++)); do
+    for ((i = 0; i < 4; i++)); do
         u="$(shuf -n1 -e "local" "remote")"
         sample_message | deliver -u "$u"
     done
     interimap --debug || error
 
+    grep -Fx "remote: Peer certificate fingerprint: sha256\$$X509_SHA256" <"$STDERR" || error
     sed -nr "s/remote: \[[0-9]+\] (preverify=[0-9]+)$/\1/p" <"$STDERR" >"$TMPDIR/preverify"
     [ -s "$TMPDIR/preverify" ] || error
     ! grep -Fvx "preverify=1" <"$TMPDIR/preverify" || error
@@ -39,9 +49,6 @@ unverified_peer
 step_done
 
 step_start "peer verification result honored when pinned pubkey matches"
-PKEY_SHA256="$(doveconf -c "$HOME_remote/.dovecot/config" -hx ssl_cert \
-    | openssl x509 -pubkey | openssl pkey -pubin -outform DER \
-    | openssl dgst -sha256 | sed -rn "/^.*=\\s*/ {s///p;q}")"
 with_remote_config <<-EOF
 	SSL_fingerprint = sha256\$$PKEY_SHA256
 EOF
@@ -50,31 +57,71 @@ grep -Fx "remote: Peer certificate matches pinned SPKI digest sha256\$$PKEY_SHA2
 step_done
 
 capath=$(mktemp --tmpdir="$TMPDIR" --directory capath.XXXXXX)
+cp -T -- ~/.dovecot/conf.d/ca.crt "$capath/ca-certificates.crt"
 
 step_start "SSL_CAfile"
 if [ -f "/etc/ssl/certs/ca-certificates.crt" ]; then
-    # our fake root CA should not be in there
+    # assume our fake root CA is not there
     with_remote_config <<<"SSL_CAfile = /etc/ssl/certs/ca-certificates.crt"
     unverified_peer
 fi
 
-cp -T -- ~/.dovecot/conf.d/ca.crt "$capath/ca-certificates.crt"
+# default host (localhost) is the CN (and also subjectAltName)
 with_remote_config <<<"SSL_CAfile = $capath/ca-certificates.crt"
 verified_peer
+
+# hostnames and IPs included in the subjectAltName should work as well
+for host in "ip6-localhost" "127.0.0.1" "::1"; do
+    with_remote_config <<-EOF
+		host = $host
+		SSL_CAfile = $capath/ca-certificates.crt
+	EOF
+    verified_peer
+done
+
+# but not for other IPs or hostnames
+for host in "ip6-loopback" "127.0.1.1"; do
+    with_remote_config <<-EOF
+		host = $host
+		SSL_CAfile = $capath/ca-certificates.crt
+	EOF
+    unverified_peer
+done
+
 step_done
 
 
 step_start "SSL_CApath"
 if [ -d "/etc/ssl/certs" ]; then
-    # our fake root CA should not be in there
+    # assume our fake root CA is not there
     with_remote_config <<<"SSL_CApath = /etc/ssl/certs"
     unverified_peer
 fi
 
 c_rehash "$capath"
 
+# default host (localhost) is the CN (and also subjectAltName)
 with_remote_config <<<"SSL_CApath = $capath"
 verified_peer
+
+# hostnames and IPs included in the subjectAltName should work as well
+for host in "ip6-localhost" "127.0.0.1" "::1"; do
+    with_remote_config <<-EOF
+		host = $host
+		SSL_CApath = $capath
+	EOF
+    verified_peer
+done
+
+# but not for other IPs or hostnames
+for host in "ip6-loopback" "127.0.1.1"; do
+    with_remote_config <<-EOF
+		host = $host
+		SSL_CApath = $capath
+	EOF
+    unverified_peer
+done
+
 step_done
 
 # vim: set filetype=sh :