PKEY_SHA256="$(doveconf -c "$HOME_remote/.dovecot/config" -hx ssl_cert \
    | openssl x509 -pubkey | openssl pkey -pubin -outform DER \
    | openssl dgst -sha256 | sed -rn "/^.*=\\s*/ {s///p;q}")"
INVALID_FPR="sha256\$deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
INVALID_FPR2="sha256\$deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbee2"

# backup config
install -m0600 "$XDG_CONFIG_HOME/interimap/config" "$XDG_CONFIG_HOME/interimap/config~"
with_remote_config() {
    install -m0600 "$XDG_CONFIG_HOME/interimap/config~" "$XDG_CONFIG_HOME/interimap/config"
    cat >>"$XDG_CONFIG_HOME/interimap/config"
}

# pinned valid fingerprint
with_remote_config <<-EOF
	SSL_fingerprint = sha256\$$PKEY_SHA256
EOF

for ((i = 0; i < 32; i++)); do
    u="$(shuf -n1 -e "local" "remote")"
    sample_message | deliver -u "$u"
done
interimap_init
check_mailbox_status "INBOX"


# with default algorithm (SHA256)
with_remote_config <<-EOF
	SSL_fingerprint = $INVALID_FPR $PKEY_SHA256
EOF
interimap --debug || error
grep -Fx "remote: Peer certificate matches pinned SPKI digest sha256\$$PKEY_SHA256" <"$STDERR" || error


# and now an invalid one
with_remote_config <<-EOF
	SSL_fingerprint = $INVALID_FPR
EOF
! interimap --debug || error

grep -Fx "remote: ERROR: Can't initiate TLS/SSL handshake" <"$STDERR" || error
grep -Fx "remote: WARNING: Fingerprint doesn't match! MiTM in action?" <"$STDERR" || error
grep -Fx "remote: ERROR: Can't initiate TLS/SSL handshake" <"$STDERR" || error
# make sure we didn't send any credentials
! grep -E "^remote: C: .* (AUTHENTICATE|LOGIN) " <"$STDERR" || error

# two invalid ones
with_remote_config <<-EOF
	SSL_fingerprint = $INVALID_FPR $INVALID_FPR2
EOF
! interimap --debug || error

grep -Fx "remote: ERROR: Can't initiate TLS/SSL handshake" <"$STDERR" || error
grep -Fx "remote: WARNING: Fingerprint doesn't match! MiTM in action?" <"$STDERR" || error
grep -Fx "remote: ERROR: Can't initiate TLS/SSL handshake" <"$STDERR" || error
# make sure we didn't send any credentials
! grep -E "^remote: C: .* (AUTHENTICATE|LOGIN) " <"$STDERR" || error


# valid + invalid
with_remote_config <<-EOF
	SSL_fingerprint = sha256\$$PKEY_SHA256 $INVALID_FPR
EOF
interimap --debug || error
grep -Fx "remote: Peer certificate matches pinned SPKI digest sha256\$$PKEY_SHA256" <"$STDERR" || error


# invalid + valid
with_remote_config <<-EOF
	SSL_fingerprint = $INVALID_FPR sha256\$$PKEY_SHA256
EOF
interimap --debug || error
grep -Fx "remote: Peer certificate matches pinned SPKI digest sha256\$$PKEY_SHA256" <"$STDERR" || error

# vim: set filetype=sh :