From 26e5c04abfb81bdcbd4d89d9f9329b8433920b26 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 10 Dec 2020 14:34:48 +0100
Subject: test suite: always generate new certificates on `make test`.

In addition, sign test certificates with the same root CA.  Hence
running `make test` now requires OpenSSL 1.1.1 or later.
---
 tests/certs/generate | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100755 tests/certs/generate

(limited to 'tests/certs/generate')

diff --git a/tests/certs/generate b/tests/certs/generate
new file mode 100755
index 0000000..19463d5
--- /dev/null
+++ b/tests/certs/generate
@@ -0,0 +1,38 @@
+#!/bin/sh
+
+set -ue
+PATH="/usr/bin:/bin"
+export PATH
+
+BASEDIR="$(dirname -- "$0")"
+OU="InterIMAP test suite"
+cd "$BASEDIR"
+
+cadir="$(mktemp --tmpdir --directory)"
+trap 'rm -rf -- "$cadir"' EXIT INT TERM
+
+# generate CA (we intentionally throw away the private key and serial
+# file to avoid reuse)
+openssl genpkey -algorithm RSA -out "$cadir/ca.key"
+openssl req -new -x509 -rand /dev/urandom -subj "/OU=$OU/CN=Fake Root CA" -key "$cadir/ca.key" -out ./ca.crt
+
+SERIAL=1
+new() {
+    local key="$1" cn="$2"
+    openssl req -new -rand /dev/urandom -key "$key" \
+        -subj "/OU=$OU/CN=$cn" \
+        -out "$cadir/new.csr"
+	cat >"$cadir/new-ext.cnf" <<-EOF
+		basicConstraints = critical, CA:FALSE
+		keyUsage = critical, digitalSignature, keyEncipherment
+		extendedKeyUsage = critical, serverAuth
+	EOF
+    openssl x509 -req -in "$cadir/new.csr" -CA ./ca.crt -CAkey "$cadir/ca.key" \
+        -CAserial "$cadir/ca.srl" -CAcreateserial -extfile "$cadir/new-ext.cnf"
+}
+
+openssl genpkey -algorithm RSA -out ./dovecot.rsa.key
+new ./dovecot.rsa.key "localhost" >./dovecot.rsa.crt
+
+openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out ./dovecot.ecdsa.key
+new ./dovecot.ecdsa.key "localhost" >./dovecot.ecdsa.crt
-- 
cgit v1.2.3


From 265f133600e9812726a52ea3067409ed3578e882 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 10 Dec 2020 19:39:10 +0100
Subject: libinterimap: make SSL_verify check the hostname as well.

More precisely, ensure that the certificate Subject Alternative Name
(SAN) or Subject CommonName (CN) matches the hostname or IP literal
specified by the 'host' option.  Previously it was only verifying the
chain of trust.

This bumps the minimum Net::SSLeay version to 1.83 and OpenSSL version
1.0.2.
---
 tests/certs/generate | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'tests/certs/generate')

diff --git a/tests/certs/generate b/tests/certs/generate
index 19463d5..6457765 100755
--- a/tests/certs/generate
+++ b/tests/certs/generate
@@ -20,19 +20,22 @@ SERIAL=1
 new() {
     local key="$1" cn="$2"
     openssl req -new -rand /dev/urandom -key "$key" \
-        -subj "/OU=$OU/CN=$cn" \
+        -subj "/OU=$OU/CN=$cn" ${3+-addext subjectAltName="$3"} \
         -out "$cadir/new.csr"
 	cat >"$cadir/new-ext.cnf" <<-EOF
 		basicConstraints = critical, CA:FALSE
 		keyUsage = critical, digitalSignature, keyEncipherment
 		extendedKeyUsage = critical, serverAuth
 	EOF
+    if [ -n "${3+x}" ]; then
+        printf "subjectAltName = %s\\n" "$3" >>"$cadir/new-ext.cnf"
+    fi
     openssl x509 -req -in "$cadir/new.csr" -CA ./ca.crt -CAkey "$cadir/ca.key" \
         -CAserial "$cadir/ca.srl" -CAcreateserial -extfile "$cadir/new-ext.cnf"
 }
 
 openssl genpkey -algorithm RSA -out ./dovecot.rsa.key
-new ./dovecot.rsa.key "localhost" >./dovecot.rsa.crt
+new ./dovecot.rsa.key "localhost" "DNS:localhost,DNS:ip6-localhost,IP:127.0.0.1,IP:::1" >./dovecot.rsa.crt
 
 openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out ./dovecot.ecdsa.key
 new ./dovecot.ecdsa.key "localhost" >./dovecot.ecdsa.crt
-- 
cgit v1.2.3


From 4ed6f0982cc0553e31e7beadf441beb8573a07d4 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 10 Dec 2020 21:52:44 +0100
Subject: libinterimap: add support for the TLS SNI (Server Name Indication)
 extension.

This is controlled by the new 'SSL_hostname' option.  The default value
of that option is the value of the 'host' option when it is hostname,
and the empty string (which disables SNI) when it is an IP literal.
---
 tests/certs/generate | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'tests/certs/generate')

diff --git a/tests/certs/generate b/tests/certs/generate
index 6457765..de379a0 100755
--- a/tests/certs/generate
+++ b/tests/certs/generate
@@ -39,3 +39,6 @@ new ./dovecot.rsa.key "localhost" "DNS:localhost,DNS:ip6-localhost,IP:127.0.0.1,
 
 openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out ./dovecot.ecdsa.key
 new ./dovecot.ecdsa.key "localhost" >./dovecot.ecdsa.crt
+
+openssl genpkey -algorithm RSA -out ./dovecot.rsa2.key
+new ./dovecot.rsa2.key "imap.example.net" "DNS:imap.example.net,DNS:localhost" >./dovecot.rsa2.crt
-- 
cgit v1.2.3