Merge branch 'seththeriault-starttls-imap'

* seththeriault-starttls-imap:
  Mention STARTTLS IMAP support in README
  Rename dumpAuthTLSFromXXX methods
  Add support for IMAP STARTTLS

README.md

@@ -13,7 +13,7 @@ Certigo is a utility to examine and validate certificates to help with debugging
 
 **Validation and linting**: Not sure if your generated certificate is valid? Certigo can connect to remote servers to display and validate their certificate chains. It can also point out common errors on certififcates, such as using an older X.509 format, signatures with outdated hashes, or keys that are too small.
 
-**Supports STARTTLS Protocols**: Trying to debug SSL/TLS connections on a database or mail server? Certigo supports establishing connections via StartTLS protocols for MySQL, PostgreSQL, SMTP, LDAP, and FTP, making it possible to debug connection issues or scan for expired certificates more easily.
+**Supports STARTTLS Protocols**: Trying to debug SSL/TLS connections on a database or mail server? Certigo supports establishing connections via StartTLS protocols for MySQL, PostgreSQL, SMTP, LDAP, IMAP, and FTP, making it possible to debug connection issues or scan for expired certificates more easily.
 
 **Scripting support**: All commands in certigo have support for optional JSON output, which can be used in shell scripts to analyze or filter output. Combine certigo with [jq](https://stedolan.github.io/jq) to find all certificates in a bundle that are signed with SHA1-RSA, or filter for CA certificates, or whatever you need!
 

starttls/ftp.go

@@ -24,7 +24,7 @@ import (
 	"strconv"
 )
 
-func dumpAuthTLSFromFTP(dialer Dialer, address string, config *tls.Config) (*tls.ConnectionState, error) {
+func dumpTLSConnStateFromFTP(dialer Dialer, address string, config *tls.Config) (*tls.ConnectionState, error) {
 	c, err := dialer.Dial("tcp", address)
 	if err != nil {
 		return nil, err

starttls/imap.go

@@ -0,0 +1,67 @@
+/*-
+ * Copyright 2017 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package starttls
+
+import (
+	"bufio"
+	"crypto/tls"
+	"fmt"
+	"net"
+)
+
+func dumpTLSConnStateFromIMAP(dialer Dialer, address string, config *tls.Config) (*tls.ConnectionState, error) {
+	c, err := dialer.Dial("tcp", address)
+	if err != nil {
+		return nil, err
+	}
+
+	conn := c.(*net.TCPConn)
+	status, err := readIMAP(conn)
+	if err != nil {
+		return nil, err
+	}
+	if status != "OK" {
+		return nil, fmt.Errorf("IMAP server responded with %s, was expecting OK", status)
+	}
+
+	fmt.Fprintf(conn, "1 STARTTLS\r\n")
+	status, err = readIMAP(conn)
+	if err != nil {
+		return nil, err
+	}
+	if status != "OK" {
+		return nil, fmt.Errorf("IMAP server responded with %s, was expecting OK", status)
+	}
+
+	tlsConn := tls.Client(conn, config)
+	err = tlsConn.Handshake()
+	if err != nil {
+		return nil, err
+	}
+
+	state := tlsConn.ConnectionState()
+	return &state, nil
+}
+
+func readIMAP(conn *net.TCPConn) (string, error) {
+	reader := bufio.NewReader(conn)
+	response, err := reader.ReadString('\n')
+	if err != nil {
+		return "", err
+	}
+	return response[2:4], nil
+}

starttls/starttls.go

@@ -29,13 +29,13 @@ import (
 
 	"github.com/square/certigo/starttls/ldap"
 	"github.com/square/certigo/starttls/mysql"
-	"github.com/square/certigo/starttls/psql"
+	pq "github.com/square/certigo/starttls/psql"
 
-	"github.com/mwitkow/go-http-dialer"
+	http_dialer "github.com/mwitkow/go-http-dialer"
 )
 
 // Protocols are the names of supported protocols
-var Protocols []string = []string{"mysql", "postgres", "psql", "smtp", "ldap", "ftp"}
+var Protocols []string = []string{"mysql", "postgres", "psql", "smtp", "ldap", "ftp", "imap"}
 
 type connectResult struct {
 	state *tls.ConnectionState
@@ -232,7 +232,11 @@ func GetConnectionState(startTLSType, connectName, connectTo, identity, clientCe
 			res <- connectResult{&state, nil}
 		case "ftp":
 			addr := withDefaultPort(connectTo, 21)
-			state, err = dumpAuthTLSFromFTP(dialer, addr, tlsConfig)
+			state, err = dumpTLSConnStateFromFTP(dialer, addr, tlsConfig)
+			res <- connectResult{state, err}
+		case "imap":
+			addr := withDefaultPort(connectTo, 143)
+			state, err = dumpTLSConnStateFromIMAP(dialer, addr, tlsConfig)
 			res <- connectResult{state, err}
 		default:
 			res <- connectResult{nil, fmt.Errorf("unknown StartTLS protocol: %s", startTLSType)}