blob: 16ec9d942da8a8d4b960f05aa1fd212fd2b802d1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
doveconf_remote() {
doveconf -c "$HOME_remote/.dovecot/config" -hx "$1"
}
pkey_sha256() {
openssl x509 -in /dev/stdin -pubkey \
| openssl pkey -in /dev/stdin -pubin -outform DER \
| openssl dgst -sha256 | sed -rn "/^.*=\\s*/ {s///p;q}"
}
x509_sha256() {
openssl x509 -in /dev/stdin -noout -fingerprint -sha256 \
| sed -rn "/^.*=\\s*/ {s///p;q}" | tr -d : | tr "[A-Z]" "[a-z]"
}
PKEY_SHA256="$(doveconf_remote ssl_cert | pkey_sha256)"
X509_SHA256="$(doveconf_remote ssl_cert | x509_sha256)"
PKEY_ALT_SHA256="$(doveconf_remote ssl_alt_cert | pkey_sha256)"
X509_ALT_SHA256="$(doveconf_remote ssl_alt_cert | x509_sha256)"
# pinned valid fingerprints
cat >>"$XDG_CONFIG_HOME/interimap/config" <<-EOF
SSL_fingerprint = sha256\$$PKEY_SHA256 sha256\$$PKEY_ALT_SHA256
EOF
for ((i = 0; i < 32; i++)); do
u="$(shuf -n1 -e "local" "remote")"
sample_message | deliver -u "$u"
done
interimap_init
check_mailbox_status "INBOX"
interimap --debug || error
# which peer certificate is used is up to libssl
grep -Fx -e "remote: Peer certificate fingerprint: sha256\$$X509_SHA256" \
-e "remote: Peer certificate fingerprint: sha256\$$X509_ALT_SHA256" \
<"$STDERR" || error
grep -Fx -e "remote: Peer certificate matches pinned SPKI digest sha256\$$PKEY_SHA256" \
-e "remote: Peer certificate matches pinned SPKI digest sha256\$$PKEY_ALT_SHA256" \
<"$STDERR" || error
# force RSA
# XXX we also have to force TLS <=1.2 here as the TLSv1.3 ciphersuites
# don't specify the certificate type (nor key exchange)
cat >>"$XDG_CONFIG_HOME/interimap/config" <<-EOF
SSL_protocol_max = TLSv1.2
SSL_cipherlist = EECDH+AESGCM+aRSA
EOF
interimap --debug || error
grep -Fx "remote: Peer certificate fingerprint: sha256\$$X509_SHA256" <"$STDERR" || error
grep -Fx "remote: Peer certificate matches pinned SPKI digest sha256\$$PKEY_SHA256" <"$STDERR" || error
# force ECDSA
sed -i "s/^SSL_cipherlist\\s*=.*/SSL_cipherlist = EECDH+AESGCM+aECDSA/" -- "$XDG_CONFIG_HOME/interimap/config"
interimap --debug || error
grep -Fx "remote: Peer certificate fingerprint: sha256\$$X509_ALT_SHA256" <"$STDERR" || error
grep -Fx "remote: Peer certificate matches pinned SPKI digest sha256\$$PKEY_ALT_SHA256" <"$STDERR" || error
# vim: set filetype=bash :
|
