From a7c364bf90a4593cfbc7911b1b7536dc66b1c879 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sun, 10 Nov 2019 05:39:41 +0100
Subject: Test suite: add new tests for SSL/TLS.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SSL connections are accepted on TCP port 10993.  Also, fix STARTTLS
directive, broken since fba1c36…
---
 tests/tls-pin-fingerprint/interimap.remote |  1 +
 tests/tls-pin-fingerprint/remote.conf      |  1 +
 tests/tls-pin-fingerprint/t                | 33 ++++++++++++++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 120000 tests/tls-pin-fingerprint/interimap.remote
 create mode 120000 tests/tls-pin-fingerprint/remote.conf
 create mode 100644 tests/tls-pin-fingerprint/t

(limited to 'tests/tls-pin-fingerprint')

diff --git a/tests/tls-pin-fingerprint/interimap.remote b/tests/tls-pin-fingerprint/interimap.remote
new file mode 120000
index 0000000..daf3741
--- /dev/null
+++ b/tests/tls-pin-fingerprint/interimap.remote
@@ -0,0 +1 @@
+../tls/interimap.remote
\ No newline at end of file
diff --git a/tests/tls-pin-fingerprint/remote.conf b/tests/tls-pin-fingerprint/remote.conf
new file mode 120000
index 0000000..6029749
--- /dev/null
+++ b/tests/tls-pin-fingerprint/remote.conf
@@ -0,0 +1 @@
+../tls/remote.conf
\ No newline at end of file
diff --git a/tests/tls-pin-fingerprint/t b/tests/tls-pin-fingerprint/t
new file mode 100644
index 0000000..1b84390
--- /dev/null
+++ b/tests/tls-pin-fingerprint/t
@@ -0,0 +1,33 @@
+# backup config
+install -m0600 "$XDG_CONFIG_HOME/interimap/config" "$XDG_CONFIG_HOME/interimap/config~"
+with_remote_config() {
+    install -m0600 "$XDG_CONFIG_HOME/interimap/config~" "$XDG_CONFIG_HOME/interimap/config"
+    cat >>"$XDG_CONFIG_HOME/interimap/config"
+}
+
+# pinned valid fingerprint
+with_remote_config <<-EOF
+	SSL_fingerprint = sha256\$e8fc8d03ffe75e03897136a2f1c5647bf8c36be7136a6883a732a8c4961c1614
+EOF
+
+for ((i = 0; i < 32; i++)); do
+    u="$(shuf -n1 -e "local" "remote")"
+    sample_message | deliver -u "$u"
+done
+interimap_init
+check_mailbox_status "INBOX"
+
+
+# and now an invalid one
+with_remote_config <<-EOF
+	SSL_fingerprint = sha256\$deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef
+EOF
+! interimap --debug || error
+
+grep -Fx "remote: ERROR: Can't initiate TLS/SSL handshake" <"$STDERR" || error
+grep -Fx "remote: WARNING: Fingerprint doesn't match! MiTM in action?" <"$STDERR" || error
+grep -Fx "remote: ERROR: Can't initiate TLS/SSL handshake" <"$STDERR" || error
+# make sure we didn't send any credentials
+! grep -E "^remote: C: .* (AUTHENTICATE|LOGIN) " <"$STDERR" || error
+
+# vim: set filetype=sh :
-- 
cgit v1.2.3