From 0a358b8e929be3cbf9586e2a9146c209903f6896 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sun, 13 Dec 2020 18:15:39 +0100
Subject: libinterimap: _start_ssl() now fails immediately with OpenSSL <1.1.0.

It could in principle still work with earlier versions if the new
settings SSL_protocol_{min,max} are not used, however it's cumbersome to
do individual checks for specific settings, let alone maintain test
coverage with multiple OpenSSL versions.
---
 lib/Net/IMAP/InterIMAP.pm | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

(limited to 'lib/Net/IMAP')

diff --git a/lib/Net/IMAP/InterIMAP.pm b/lib/Net/IMAP/InterIMAP.pm
index 89e5cba..99d3a0e 100644
--- a/lib/Net/IMAP/InterIMAP.pm
+++ b/lib/Net/IMAP/InterIMAP.pm
@@ -48,7 +48,6 @@ my $RE_LIST_CHAR    = qr/[\x21\x23-\x27\x2A\x2B-\x5B\x5D-\x7A\x7C-\x7E]/;
 my $RE_TEXT_CHAR    = qr/[\x01-\x09\x0B\x0C\x0E-\x7F]/;
 
 my $RE_SSL_PROTO = qr/(?:SSLv[23]|TLSv1|TLSv1\.[0-3])/;
-my $OPENSSL_VERSION = Net::SSLeay::OPENSSL_VERSION_NUMBER();
 
 # Map each option to a regexp validating its values.
 my %OPTIONS = (
@@ -1704,6 +1703,11 @@ my %SSL_protocol_versions = (
 #   Upgrade the $socket to SSL/TLS.
 sub _start_ssl($$) {
     my ($self, $socket) = @_;
+    # need  OpenSSL 1.1.0 or later for SSL_CTX_set_min_proto_version(3ssl), see
+    # https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_min_proto_version.html
+    $self->panic("SSL/TLS functions require OpenSSL 1.1.0 or later")
+        if Net::SSLeay::OPENSSL_VERSION_NUMBER() < 0x1010000f;
+
     my $ctx = Net::SSLeay::CTX_new() or $self->panic("SSL_CTX_new(): $!");
     $self->{SSL_verify} //= 1; # default is to perform certificate verification
 
@@ -1716,7 +1720,6 @@ sub _start_ssl($$) {
     $ssl_options |= Net::SSLeay::OP_NO_COMPRESSION();
 
     if (defined $self->{SSL_protocol_min} or defined $self->{SSL_protocol_max}) {
-        $self->panic("Failed requirement libssl >=1.1.0") if $OPENSSL_VERSION < 0x1010000f;
         my ($min, $max) = @$self{qw/SSL_protocol_min SSL_protocol_max/};
         if (defined $min) {
             my $v = $SSL_protocol_versions{$min} // $self->panic("Unknown protocol version: $min");
@@ -1772,9 +1775,6 @@ sub _start_ssl($$) {
     my $host = $self->{host} // $self->panic();
     my ($hostip, $hostipfam) = _parse_hostip($host);
     if ($self->{SSL_verify}) {
-        # for X509_VERIFY_PARAM_set1_{ip,host}()
-        $self->panic("Failed requirement libssl >=1.0.2") if $OPENSSL_VERSION < 0x1000200f;
-
         # verify certificate chain
         if (defined $self->{SSL_CAfile} or defined $self->{SSL_CApath}) {
             $self->_ssl_error("SSL_CTX_load_verify_locations()")
@@ -1808,7 +1808,6 @@ sub _start_ssl($$) {
     # always use 'SSL_hostname' when set, otherwise use 'host' (unless it's an IP)
     my $servername = $self->{SSL_hostname} // (defined $hostipfam ? "" : $host);
     if ($servername ne "") {
-        $self->panic("Failed requirement libssl >=0.9.8f") if $OPENSSL_VERSION < 0x00908070;
         $self->_ssl_error("SSL_set_tlsext_host_name($servername)")
             unless Net::SSLeay::set_tlsext_host_name($ssl, $servername) == 1;
         $self->log("Using SNI with name $servername") if $self->{debug};
-- 
cgit v1.2.3