diff options
| -rw-r--r-- | Makefile.am | 2 | ||||
| -rw-r--r-- | NEWS | 38 | ||||
| -rw-r--r-- | README.SSL | 31 | ||||
| -rw-r--r-- | configure.ac | 2 | ||||
| -rw-r--r-- | fetchmail-FAQ.html | 29 | ||||
| -rw-r--r-- | fetchmail.h | 6 | ||||
| -rw-r--r-- | fetchmail.man | 131 | ||||
| -rw-r--r-- | imap.c | 36 | ||||
| -rw-r--r-- | po/de.po | 99 | ||||
| -rw-r--r-- | pop3.c | 42 | ||||
| -rw-r--r-- | socket.c | 28 | ||||
| -rw-r--r-- | starttls.c (renamed from tls.c) | 16 |
12 files changed, 275 insertions, 185 deletions
diff --git a/Makefile.am b/Makefile.am index c7367dd9..3c1a7aab 100644 --- a/Makefile.am +++ b/Makefile.am @@ -31,7 +31,7 @@ libfm_a_SOURCES= xmalloc.c base64.c rfc822.c report.c rfc2047e.c \ servport.c ntlm.h smbbyteorder.h smbdes.h smbmd4.h \ smbencrypt.h smbdes.c smbencrypt.c smbmd4.c smbutil.c \ libesmtp/gethostbyname.h libesmtp/gethostbyname.c \ - smbtypes.h fm_getaddrinfo.c tls.c rfc822valid.c \ + smbtypes.h fm_getaddrinfo.c starttls.c rfc822valid.c \ xmalloc.h sdump.h sdump.c x509_name_match.c \ fm_strl.h md5c.c if NTLM_ENABLE @@ -51,18 +51,41 @@ removed from a 6.4.0 or newer release.) * The --bsmtp - mode of operation may be removed in a future release. * Given that OpenSSL is severely underdocumented, and needs license exceptions, fetchmail may switch to a different SSL library. -* SSLv2 support will be removed from a future fetchmail release. It has been - obsolete for more than a decade. * SSLv3 support may be removed from a future fetchmail release. It has been obsolete for many years and found insecure. Use TLS. -------------------------------------------------------------------------------- -fetchmail-6.3.27 (not yet released, if ever): +fetchmail-6.4.0 (not yet released): # NOTE THAT FETCHMAIL IS NO LONGER PUBLISHED THROUGH IBIBLIO. * They have stopped accepting submissions and consider themselves an archive. +## SECURITY FIXES THAT AFFECT BEHAVIOUR AND MAY WANT RECONFIGURATION +* Fetchmail no longer supports SSLv2. +* Fetchmail no longer attempts to negotiate SSLv3 by default, + even with --sslproto ssl23. Fetchmail can now use SSLv3, or TLSv1.1 or a newer + TLS version, with STLS/STARTTLS (it would previously force TLSv1.0). If the + OpenSSL version used at build and run-time supports these versions, --sslproto + ssl3 can be used to enable this specific version. Doing so is discouraged + because these protocols are broken. + + Along the lines suggested - as patch - by Kurt Roeckx, Debian Bug #768843. + + While this change is supposed to be compatible with common configurations, + users are advised to change all explicit --sslproto ssl2, --sslproto + ssl3, --sslproto tls1 to --sslproto auto, so that they can enable TLSv1.1 and + TLSv1.2 on systems with OpenSSL 1.0.1 or newer. + + The --sslproto option now understands the values auto, tls1+, tls1.1+, + tls1.2+ (case insensitively). + +## CHANGES +* Fetchmail now supports --sslproto auto and --sslproto tls1+ (same as ssl23). +* --sslproto tls1.1+ and tls1.2+ are now supported for auto-negotiation with a + minimum specified TLS protocol version. +* fetchmail 6.3.X is unsupported. + ## FIXES * Fix a typo in the FAQ. Submitted by David Lawyer, Debian Bug#706776. * Do not translate header tags such as "Subject:". Reported by Gonzalo Pérez de @@ -74,12 +97,9 @@ fetchmail-6.3.27 (not yet released, if ever): mailboxes do not mix. In response to Jeremy Chadwick's trouble 2014-11-19, fetchmail-users mailing list. * Fix SSL-enabled build on systems that do not declare SSLv3_client_method(), - or that #define OPENSSL_NO_SSL3 inside #include <openssl/ssl.h>, the canonical - way that OpenSSL communicates this. Related to Debian Bug#775255. -* Version report lists -SSLv3 on +SSL builds that omit SSLv3_client_method(). -* Version report lists -SSLv2 on +SSL builds that omit SSLv2_client_method(). -* Also recognize SSLv2 as unsupported if #include <openssl/ssl.h> - defines the OPENSSL_NO_SSL2 macro. + or that #define OPENSSL_NO_SSL3 inside #include <openssl/ssl.h> + Related to Debian Bug#775255. +* Version report lists -SSLv3 on SSL-enabled no-ssl3 builds. # KNOWN BUGS AND WORKAROUNDS (This section floats upwards through the NEWS file so it stays with the @@ -11,36 +11,45 @@ specific to fetchmail. In case of troubles, mail the README.SSL-SERVER file to your ISP and have them check their server configuration against it. -Unfortunately, fetchmail confuses SSL/TLS protocol levels with whether -a service needs to use in-band negotiation (STLS/STARTTLS for POP3/IMAP4) or is -totally SSL-wrapped on a separate port. For compatibility reasons, this cannot -be fixed in a bugfix release. +Unfortunately, fetchmail confuses SSL/TLS protocol levels with whether a +service needs to use in-band negotiation (STLS/STARTTLS for POP3/IMAP4) +or is totally SSL-wrapped on a separate port. For compatibility +reasons, this cannot be fixed in a bugfix or minor release. - -- Matthias Andree, 2009-05-09 +Also, fetchmail 6.4.0 and newer releases changed some of the semantics +as the result of a bug-fix, and will auto-negotiate TLSv1 or newer only. +If your server does not support this, you may have to specify --sslproto +ssl3. This is in order to prefer the newer TLS protocols, because SSLv2 +and v3 are broken. + + -- Matthias Andree, 2015-01-16 Quickstart ---------- +Use an up-to-date release of OpenSSL 1.0.1 or newer, so as to get +TLSv1.2 support. + For use of SSL or TLS with in-band negotiation on the regular service's port, i. e. with STLS or STARTTLS, use these command line options - --sslproto tls1 --sslcertck + --sslproto auto --sslcertck or these options in the rcfile (after the respective "user"... options) - sslproto tls1 sslcertck + sslproto auto sslcertck For use of SSL or TLS on a separate port, if the whole TCP connection is -SSL-encrypted from the very beginning, use these command line options (in the -rcfile, omit all leading "--"): +SSL-encrypted from the very beginning (SSL- or TLS-wrapped), use these +command line options (in the rcfile, omit all leading "--"): - --ssl --sslproto ssl3 --sslcertck + --ssl --sslproto auto --sslcertck or these options in the rcfile (after the respective "user"... options) - ssl sslproto ssl3 sslcertck + ssl sslproto auto sslcertck Background and use (long version :-)) diff --git a/configure.ac b/configure.ac index 9248b265..50778b7d 100644 --- a/configure.ac +++ b/configure.ac @@ -9,7 +9,7 @@ dnl Process this file with autoconf to produce a configure script. dnl dnl XXX - if bumping version here, check fetchmail.man, too! -AC_INIT([fetchmail],[6.3.27],[fetchmail-users@lists.sourceforge.net]) +AC_INIT([fetchmail],[6.4.0.beta1],[fetchmail-users@lists.sourceforge.net]) AC_CONFIG_SRCDIR([fetchmail.h]) AC_CONFIG_HEADERS([config.h]) AC_CONFIG_LIBOBJ_DIR([.]) diff --git a/fetchmail-FAQ.html b/fetchmail-FAQ.html index 21173f7a..401f9a41 100644 --- a/fetchmail-FAQ.html +++ b/fetchmail-FAQ.html @@ -667,8 +667,8 @@ because there is not currently a standard way to do this; fetchmail also uses this method, so the two will interoperate happily. They better, because this is how Craig gets his mail ;-)</p> -<p>Finally, you can use <a href="#K5">SSL</a> for complete -end-to-end encryption if you have an SSL-enabled mailserver.</p> +<p>Finally, you can use <a href="#K5">SSL or TLS</a> for complete +end-to-end encryption if you have a TLS-enabled mailserver.</p> <h2><a id="G11" name="G11">G11. Is any special configuration needed to use a dynamic IP address?</a></h2> @@ -2120,7 +2120,7 @@ SSL?</a></h2> <p>You'll need to have the <a href="http://www.openssl.org/">OpenSSL</a> libraries installed, and they -should at least be version 0.9.7. +should at least be version 0.9.8, with 1.0.1 preferred. Configure with --with-ssl. If you have the OpenSSL libraries installed in commonly-used default locations, this will suffice. If you have them installed in a non-default location, @@ -2130,7 +2130,7 @@ to --with-ssl after an equal sign.</p> <p>Fetchmail binaries built this way support <code>ssl</code>, <code>sslkey</code>, and <code>sslcert</code> options that control SSL encryption, and will automatically use <code>tls</code> if the -server offers it. You will need to have an SSL-enabled mailserver to +server offers it. You will need to have an SSL/TLS-enabled mailserver to use these options. See the manual page for details and some words of care on the limited security provided.</p> @@ -2155,13 +2155,14 @@ poll MYSERVER port 993 plugin "openssl s_client -connect %h:%p" protocol imap username MYUSERNAME password MYPASSWORD </pre> -<p>You should note that SSL is only secure against a "man-in-the-middle" -attack if the client is able to verify that the peer's public key is the -correct one, and has not been substituted by an attacker. fetchmail can do -this in one of two ways: by verifying the SSL certificate, or by checking -the fingerprint of the peer's public key.</p> +<p>You should note that SSL or TLS are only secure against a +"man-in-the-middle" attack if the client is able to verify that the +peer's public key is the correct one, and has not been substituted by an +attacker. fetchmail can do this in one of two ways: by verifying the SSL +certificate, or by checking the fingerprint of the peer's public +key.</p> -<p>There are three parts to SSL certificate verification: checking that the +<p>There are three parts to TLS certificate verification: checking that the domain name in the certificate matches the hostname you asked to connect to; checking that the certificate expiry date has not passed; and checking that the certificate has been signed by a known Certificate Authority (CA). This @@ -2227,8 +2228,12 @@ will automatically attempt TLS negotiation if SSL was enabled at compile time. This can however cause problems if the upstream didn't configure his certificates properly.</p> -<p>In order to prevent fetchmail from trying TLS (STLS, STARTTLS) -negotiation, add this option:</p> +<p>In order to prevent fetchmail 6.4.0 and newer versions from trying +STLS or STARTTLS negotiation, add this option:</p> +<pre>sslproto ''</pre> + +<p>In order to prevent older fetchmail versions from trying TLS (STLS, STARTTLS) +negotiation where the above does not work, try this option:</p> <pre>sslproto ssl23</pre> diff --git a/fetchmail.h b/fetchmail.h index f3e45144..52a1d4b9 100644 --- a/fetchmail.h +++ b/fetchmail.h @@ -774,9 +774,9 @@ int servport(const char *service); int fm_getaddrinfo(const char *node, const char *serv, const struct addrinfo *hints, struct addrinfo **res); void fm_freeaddrinfo(struct addrinfo *ai); -/* prototypes from tls.c */ -int maybe_tls(struct query *ctl); -int must_tls(struct query *ctl); +/* prototypes from starttls.c */ +int maybe_starttls(struct query *ctl); +int must_starttls(struct query *ctl); /* prototype from rfc822valid.c */ int rfc822_valid_msgid(const unsigned char *); diff --git a/fetchmail.man b/fetchmail.man index 895e511a..82a27fc0 100644 --- a/fetchmail.man +++ b/fetchmail.man @@ -10,7 +10,7 @@ .\" Load www macros to process .URL requests, this requires groff: .mso www.tmac .\" -.TH fetchmail 1 "fetchmail 6.3.27" "fetchmail" "fetchmail reference manual" +.TH fetchmail 1 "fetchmail 6.4.0" "fetchmail" "fetchmail reference manual" .SH NAME fetchmail \- fetch mail from a POP, IMAP, ETRN, or ODMR-capable server @@ -413,23 +413,22 @@ from. The folder information is written only since version 6.3.4. .B \-\-ssl (Keyword: ssl) .br -Causes the connection to the mail server to be encrypted -via SSL. Connect to the server using the specified base protocol over a -connection secured by SSL. This option defeats opportunistic starttls -negotiation. It is highly recommended to use \-\-sslproto 'SSL3' -\-\-sslcertck to validate the certificates presented by the server and -defeat the obsolete SSLv2 negotiation. More information is available in -the \fIREADME.SSL\fP file that ships with fetchmail. +Causes the connection to the mail server to be encrypted via SSL, by +negotiating SSL directly after connecting (SSL-wrapped mode). It is +highly recommended to use \-\-sslcertck to validate the certificates +presented by the server. Please see the description of \-\-sslproto +below! More information is available in the \fIREADME.SSL\fP file that +ships with fetchmail. .IP -Note that fetchmail may still try to negotiate SSL through starttls even -if this option is omitted. You can use the \-\-sslproto option to defeat -this behavior or tell fetchmail to negotiate a particular SSL protocol. +Note that even if this option is omitted, fetchmail may still negotiate +SSL in-band for POP3 or IMAP, through the STLS or STARTTLS feature. You +can use the \-\-sslproto option to modify that behavior. .IP If no port is specified, the connection is attempted to the well known port of the SSL version of the base protocol. This is generally a different port than the port used by the base protocol. For IMAP, this is port 143 for the clear protocol and port 993 for the SSL secured -protocol, for POP3, it is port 110 for the clear text and port 995 for +protocol; for POP3, it is port 110 for the clear text and port 995 for the encrypted variant. .IP If your system lacks the corresponding entries from /etc/services, see @@ -471,39 +470,61 @@ cause some complications in daemon mode. .IP Also see \-\-sslcert above. .TP -.B \-\-sslproto <name> -(Keyword: sslproto) +.B \-\-sslproto <value> +(Keyword: sslproto, NOTE: semantic changes since v6.4.0) .br -Forces an SSL/TLS protocol. Possible values are \fB''\fP, -\&'\fBSSL2\fP' (not supported on all systems), -\&'\fBSSL23\fP', (use of these two values is discouraged -and should only be used as a last resort) \&'\fBSSL3\fP', and -\&'\fBTLS1\fP'. The default behaviour if this option is unset is: for -connections without \-\-ssl, use \&'\fBTLS1\fP' so that fetchmail will -opportunistically try STARTTLS negotiation with TLS1. You can configure -this option explicitly if the default handshake (TLS1 if \-\-ssl is not -used) does not work for your server. -.IP -Use this option with '\fBTLS1\fP' value to enforce a STARTTLS -connection. In this mode, it is highly recommended to also use -\-\-sslcertck (see below). Note that this will then cause fetchmail -v6.3.19 to force STARTTLS negotiation even if it is not advertised by -the server. +This option has a dual use, out of historic fetchmail behaviour. It +controls both the SSL/TLS protocol version and, if \-\-ssl is not +specified, the STARTTLS behaviour (upgrading the protocol to an SSL or +TLS connection in-band). Some other options may however make TLS +mandatory. +.PP +Only if this option and \-\-ssl are both missing for a poll, there will +be opportunistic TLS for POP3 and IMAP, where fetchmail will attempt to +upgrade to TLSv1 or newer. +.PP +Recognized values for \-\-sslproto are: +.RS +.IP "\fB''\fP, the empty string" +Disable STARTTLS. If \-\-ssl is given for the same server, log an error +and pretend that '\fBauto\fP' had been used instead. +.IP '\fBauto\fP' +Since v6.4.0 Require TLS. Auto-negotiate TLSv1 or newer, disable SSLv3 downgrade. +(fetchmail 6.3.26 and older have auto-negotiated all protocols that +their OpenSSL library supported, including the broken SSLv3). +.IP "\&'\fBSSL23\fP' +see '\fBauto\fP'. +.IP \&'\fBSSL3\fP' +Require SSLv3. SSLv3 is broken, not supported on all systems, avoid it +if possible. This will make fetchmail negotiate SSLv3 only, and is the +only way to have fetchmail 6.4.0 or newer permit SSLv3. +.IP \&'\fBTLS1\fP' +Require TLSv1. This does not negotiate TLSv1.1 or newer, and is +discouraged. Replace by TLS1+. +.IP \&'\fBTLS1+\fP' +Since v6.4.0. See 'fBauto\fP'. +.IP \&'\fBTLS1.1+\fP' +Since v6.4.0. Require TLS. Auto-negotiate TLSv1.1 or newer. +.IP '\fBTLS1.2+\fP' +Since v6.4.0. Require TLS. Auto-negotiate TLSv1.2 or newer. +.IP "Unrecognized parameters" +are treated the same as '\fBauto\fP'. +.RE .IP -To defeat opportunistic TLSv1 negotiation when the server advertises -STARTTLS or STLS, and use a cleartext connection use \fB''\fP. This -option, even if the argument is the empty string, will also suppress the -diagnostic 'SERVER: opportunistic upgrade to TLS.' message in verbose -mode. The default is to try appropriate protocols depending on context. +NOTE: you should hardly ever need to use anything other than '' (to +force an unencrypted connection) or 'auto' (to force it). .TP .B \-\-sslcertck (Keyword: sslcertck) .br -Causes fetchmail to strictly check the server certificate against a set of -local trusted certificates (see the \fBsslcertfile\fP and \fBsslcertpath\fP -options). If the server certificate cannot be obtained or is not signed by one -of the trusted ones (directly or indirectly), the SSL connection will fail, -regardless of the \fBsslfingerprint\fP option. +Causes fetchmail to require that SSL/TLS be used and disconnect if it +can not successfully negotiate SSL or TLS, or if it cannot successfully +verify and validate the certificate and follow it to a trust anchor (or +trusted root certificate). The trust anchors are given as a set of local +trusted certificates (see the \fBsslcertfile\fP and \fBsslcertpath\fP +options). If the server certificate cannot be obtained or is not signed +by one of the trusted ones (directly or indirectly), fetchmail will +disconnect, regardless of the \fBsslfingerprint\fP option. .IP Note that CRL (certificate revocation lists) are only supported in OpenSSL 0.9.7 and newer! Your system clock should also be reasonably @@ -1203,31 +1224,33 @@ capability response. Specify a user option value that looks like username and the part to the right as the NTLM domain. .SS Secure Socket Layers (SSL) and Transport Layer Security (TLS) +.PP All retrieval protocols can use SSL or TLS wrapping for the +transport. Additionally, POP3 and IMAP retrival can also negotiate +SSL/TLS by means of STARTTLS (or STLS). .PP Note that fetchmail currently uses the OpenSSL library, which is severely underdocumented, so failures may occur just because the programmers are not aware of OpenSSL's requirement of the day. For instance, since v6.3.16, fetchmail calls OpenSSL_add_all_algorithms(), which is necessary to support certificates -using SHA256 on OpenSSL 0.9.8 -- this information is deeply hidden in the -documentation and not at all obvious. Please do not hesitate to report -subtle SSL failures. -.PP -You can access SSL encrypted services by specifying the \-\-ssl option. -You can also do this using the "ssl" user option in the .fetchmailrc -file. With SSL encryption enabled, queries are initiated over a -connection after negotiating an SSL session, and the connection fails if -SSL cannot be negotiated. Some services, such as POP3 and IMAP, have +using SHA256 on OpenSSL 0.9.8 -- this information is deeply hidden in +the documentation and not at all obvious. Please do not hesitate to +report subtle SSL failures. +.PP +You can access SSL encrypted services by specifying the options starting +with \-\-ssl, such as \-\-ssl, \-\-sslproto, \-\-sslcertck, and others. +You can also do this using the corresponding user options in the .fetchmailrc +file. Some services, such as POP3 and IMAP, have different well known ports defined for the SSL encrypted services. The encrypted ports will be selected automatically when SSL is enabled and -no explicit port is specified. The \-\-sslproto 'SSL3' option should be -used to select the SSLv3 protocol (default if unset: v2 or v3). Also, -the \-\-sslcertck command line or sslcertck run control file option -should be used to force strict certificate checking - see below. +no explicit port is specified. Also, the \-\-sslcertck command line or +sslcertck run control file option should be used to force strict +certificate checking - see below. .PP If SSL is not configured, fetchmail will usually opportunistically try to use -STARTTLS. STARTTLS can be enforced by using \-\-sslproto "TLS1". TLS -connections use the same port as the unencrypted version of the +STARTTLS. STARTTLS can be enforced by using \-\-sslproto\~auto and +defeated by using \-\-sslproto\~''. +TLS connections use the same port as the unencrypted version of the protocol and negotiate TLS via special command. The \-\-sslcertck command line or sslcertck run control file option should be used to force strict certificate checking - see below. @@ -405,6 +405,8 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) /* apply for connection authorization */ { int ok = 0; + char *commonname; + (void)greeting; /* @@ -429,25 +431,21 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) return(PS_SUCCESS); } -#ifdef SSL_ENABLE - if (maybe_tls(ctl)) { - char *commonname; - - commonname = ctl->server.pollname; - if (ctl->server.via) - commonname = ctl->server.via; - if (ctl->sslcommonname) - commonname = ctl->sslcommonname; + commonname = ctl->server.pollname; + if (ctl->server.via) + commonname = ctl->server.via; + if (ctl->sslcommonname) + commonname = ctl->sslcommonname; - if (strstr(capabilities, "STARTTLS") - || must_tls(ctl)) /* if TLS is mandatory, ignore capabilities */ +#ifdef SSL_ENABLE + if (maybe_starttls(ctl)) { + if ((strstr(capabilities, "STARTTLS") && maybe_starttls(ctl)) + || must_starttls(ctl)) /* if TLS is mandatory, ignore capabilities */ { - /* Use "tls1" rather than ctl->sslproto because tls1 is the only - * protocol that will work with STARTTLS. Don't need to worry - * whether TLS is mandatory or opportunistic unless SSLOpen() fails - * (see below). */ + /* Don't need to worry whether TLS is mandatory or + * opportunistic unless SSLOpen() fails (see below). */ if (gen_transact(sock, "STARTTLS") == PS_SUCCESS - && (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, "tls1", ctl->sslcertck, + && (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, ctl->sslproto, ctl->sslcertck, ctl->sslcertfile, ctl->sslcertpath, ctl->sslfingerprint, commonname, ctl->server.pollname, &ctl->remotename)) != -1) { @@ -470,7 +468,7 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) { report(stdout, GT_("%s: upgrade to TLS succeeded.\n"), commonname); } - } else if (must_tls(ctl)) { + } else if (must_starttls(ctl)) { /* Config required TLS but we couldn't guarantee it, so we must * stop. */ set_timeout(0); @@ -492,6 +490,10 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) /* Usable. Proceed with authenticating insecurely. */ } } + } else { + if (strstr(capabilities, "STARTTLS") && outlevel >= O_VERBOSE) { + report(stdout, GT_("%s: WARNING: server offered STARTTLS but sslproto '' given.\n"), commonname); + } } #endif /* SSL_ENABLE */ @@ -8,8 +8,8 @@ msgid "" msgstr "" "Project-Id-Version: fetchmail 6.3.26\n" "Report-Msgid-Bugs-To: fetchmail-devel@lists.sourceforge.net\n" -"POT-Creation-Date: 2015-01-16 21:15+0100\n" -"PO-Revision-Date: 2014-11-22 00:29+0100\n" +"POT-Creation-Date: 2015-01-17 01:08+0100\n" +"PO-Revision-Date: 2015-01-17 00:41+0100\n" "Last-Translator: Matthias Andree <matthias.andree@gmx.de>\n" "Language-Team: Deutsch <de@li.org>\n" "Language: de\n" @@ -1826,97 +1826,103 @@ msgstr "Protokoll identifiziert als IMAP2 oder IMAP2BIS\n" msgid "will idle after poll\n" msgstr "werde nach Abfrage untätig sein\n" -#: imap.c:471 pop3.c:476 +#: imap.c:469 pop3.c:472 #, c-format msgid "%s: upgrade to TLS succeeded.\n" msgstr "%s: Upgrade auf TLS erfolgreich.\n" -#: imap.c:477 pop3.c:482 +#: imap.c:475 pop3.c:478 #, c-format msgid "%s: upgrade to TLS failed.\n" msgstr "%s: Upgrade auf TLS fehlgeschlagen.\n" -#: imap.c:482 +#: imap.c:480 #, c-format msgid "%s: opportunistic upgrade to TLS failed, trying to continue\n" msgstr "" "%s: opportunistisches Upgrade auf TLS fehlgeschlagen, versuche Fortsetzung.\n" -#: imap.c:598 +#: imap.c:495 +#, c-format +msgid "%s: WARNING: server offered STARTTLS but sslproto '' given.\n" +msgstr "" +"%s: WARNUNG: Server hat STARTTLS angeboten, aber sslproto '' ist angegeben.\n" + +#: imap.c:600 msgid "Required OTP capability not compiled into fetchmail\n" msgstr "Benötigte OTP-Fähigkeit nicht in fetchmail einkompiliert\n" -#: imap.c:618 pop3.c:558 +#: imap.c:620 pop3.c:558 msgid "Required NTLM capability not compiled into fetchmail\n" msgstr "Benötigte NTLM-Fähigkeit nicht in fetchmail einkompiliert\n" -#: imap.c:627 +#: imap.c:629 msgid "Required LOGIN capability not supported by server\n" msgstr "Benötigte LOGIN-Fähigkeit nicht vom Server unterstützt\n" -#: imap.c:691 +#: imap.c:693 #, c-format msgid "mail expunge mismatch (%d actual != %d expected)\n" msgstr "unerwartete Expunge-Bestätigung (%d tatsächlich != %d erwartet)\n" -#: imap.c:818 +#: imap.c:820 #, c-format msgid "%lu is unseen\n" msgstr "%lu ist ungesehen\n" -#: imap.c:868 pop3.c:844 pop3.c:856 pop3.c:1095 pop3.c:1102 +#: imap.c:870 pop3.c:844 pop3.c:856 pop3.c:1095 pop3.c:1102 #, c-format msgid "%u is unseen\n" msgstr "%u ist ungesehen\n" -#: imap.c:903 imap.c:962 +#: imap.c:905 imap.c:964 msgid "re-poll failed\n" msgstr "erneute Abfrage fehlgeschlagen\n" -#: imap.c:911 imap.c:967 +#: imap.c:913 imap.c:969 #, c-format msgid "%d message waiting after re-poll\n" msgid_plural "%d messages waiting after re-poll\n" msgstr[0] "%d Nachricht wartet nach erneuter Abfrage\n" msgstr[1] "%d Nachrichten warten nach erneuter Abfrage\n" -#: imap.c:928 +#: imap.c:930 msgid "mailbox selection failed\n" msgstr "Postfach-Auswahl fehlgeschlagen\n" -#: imap.c:932 +#: imap.c:934 #, c-format msgid "%d message waiting after first poll\n" msgid_plural "%d messages waiting after first poll\n" msgstr[0] "%d Nachricht wartet nach der ersten Abfrage\n" msgstr[1] "%d Nachrichten warten nach der ersten Abfrage\n" -#: imap.c:946 +#: imap.c:948 msgid "expunge failed\n" msgstr "Säubern fehlgeschlagen\n" -#: imap.c:950 +#: imap.c:952 #, c-format msgid "%d message waiting after expunge\n" msgid_plural "%d messages waiting after expunge\n" msgstr[0] "%d Nachricht wartet nach dem Löschen\n" msgstr[1] "%d Nachrichten warten nach dem Löschen\n" -#: imap.c:989 +#: imap.c:991 msgid "search for unseen messages failed\n" msgstr "Suche nach ungesehenen Nachrichten fehlgeschlagen\n" -#: imap.c:994 pop3.c:865 +#: imap.c:996 pop3.c:865 #, c-format msgid "%u is first unseen\n" msgstr "%u ist erste ungesehene\n" -#: imap.c:1078 +#: imap.c:1080 msgid "" "Warning: ignoring bogus data for message sizes returned by the server.\n" msgstr "Warnung: ignoriere falsche Größendaten vom Server.\n" -#: imap.c:1177 imap.c:1184 +#: imap.c:1179 imap.c:1186 #, c-format msgid "Incorrect FETCH response: %s.\n" msgstr "Unpassende Antwort auf FETCH: %s.\n" @@ -2456,27 +2462,33 @@ msgstr " -r, --folder Namen des entfernten Ordners angeben\n" msgid " --showdots show progress dots even in logfiles\n" msgstr " --showdots Fortschrittspunkte auch in Log-Dateien zeigen\n" -#: pop3.c:327 +#: pop3.c:328 msgid "" "Warning: \"Maillennium POP3\" found, using RETR command instead of TOP.\n" msgstr "Warnung: „Maillennium POP3” gefunden, benutze RETR-Befehl statt TOP.\n" -#: pop3.c:411 +#: pop3.c:412 msgid "TLS is mandatory for this session, but server refused CAPA command.\n" msgstr "" "TLS ist für diese Sitzung nötig, aber der Server hat den CAPA-Befehl " "abgelehnt.\n" -#: pop3.c:412 +#: pop3.c:413 msgid "The CAPA command is however necessary for TLS.\n" msgstr "Der CAPA-Befehl ist allerdings für TLS erforderlich.\n" -#: pop3.c:494 +#: pop3.c:490 #, c-format msgid "%s: opportunistic upgrade to TLS failed, trying to continue.\n" msgstr "" "%s: opportunistisches Upgrade auf TLS fehlgeschlagen, versuche Fortsetzung.\n" +#: pop3.c:496 +#, c-format +msgid "%s: WARNING: server offered STLS, but sslproto '' given.\n" +msgstr "" +"%s: WARNUNG: Server hat STLS angeboten, aber sslproto '' ist angegeben.\n" + #: pop3.c:621 msgid "We've run out of allowed authenticators and cannot continue.\n" msgstr "" @@ -3195,29 +3207,37 @@ msgstr "" "Verzeichnis ausgeführt werden muss. Details sind in der fetchmail-" "Handbuchseite im bei --sslcertpath beschrieben.\n" -#: socket.c:902 +#: socket.c:903 msgid "File descriptor out of range for SSL" msgstr "Datei-Deskriptor außerhalb des Bereichs für SSL" -#: socket.c:913 -msgid "Your OpenSSL version does not support SSLv2.\n" -msgstr "Ihre OpenSSL-Version unterstützt SSLv2 nicht.\n" - -#: socket.c:920 +#: socket.c:915 msgid "Your OpenSSL version does not support SSLv3.\n" msgstr "Ihre OpenSSL-Version unterstützt SSLv3 nicht.\n" -#: socket.c:928 +#: socket.c:934 #, c-format -msgid "Invalid SSL protocol '%s' specified, using default (SSLv23).\n" +msgid "" +"Invalid SSL protocol '%s' specified, using default autoselect (SSL23).\n" +msgstr "" +"Ungültiges SSL-Protokoll „%s“ angegeben, benutze Voreinstellung automatische " +"Wahl (SSL23).\n" + +#: socket.c:1041 +msgid "Cannot obtain current SSL/TLS cipher - no session established?\n" msgstr "" -"Ungültiges SSL-Protokoll „%s“ angegeben, benutze Voreinstellung (SSLv23).\n" +"Kann aktuelle SSL/TLS-Chiffre nicht ermitteln - keine Sitzung aufgebaut?\n" + +#: socket.c:1044 +#, c-format +msgid "SSL/TLS: using protocol %s, cipher %s, %d/%d secret/processed bits\n" +msgstr "SSL/TLS: Protokoll %s, Chiffre %s, %d/%d geheime/verarbeitete bits\n" -#: socket.c:1027 +#: socket.c:1051 msgid "Certificate/fingerprint verification was somehow skipped!\n" msgstr "Zertifikat-/Fingerabdruck-Überprüfung wurde irgendwie übersprungen!\n" -#: socket.c:1044 +#: socket.c:1068 msgid "" "Warning: the connection is insecure, continuing anyways. (Better use --" "sslcertck!)\n" @@ -3225,11 +3245,11 @@ msgstr "" "Warnung: Die Verbindung ist unsicher, mache trotzdem weiter. (Nehmen Sie " "lieber --sslcertck!)\n" -#: socket.c:1086 +#: socket.c:1110 msgid "Cygwin socket read retry\n" msgstr "Cygwin-Socket-Lese-Wiederholung\n" -#: socket.c:1089 +#: socket.c:1113 msgid "Cygwin socket read retry failed!\n" msgstr "Cygwin-Socket-Lese-Wiederholung fehlgeschlagen!\n" @@ -3420,3 +3440,6 @@ msgstr "malloc fehlgeschlagen\n" #: xmalloc.c:47 msgid "realloc failed\n" msgstr "realloc fehlgeschlagen\n" + +#~ msgid "Your OpenSSL version does not support SSLv2.\n" +#~ msgstr "Ihre OpenSSL-Version unterstützt SSLv2 nicht.\n" @@ -281,6 +281,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) #endif /* OPIE_ENABLE */ #ifdef SSL_ENABLE flag connection_may_have_tls_errors = FALSE; + char *commonname; #endif /* SSL_ENABLE */ done_capa = FALSE; @@ -393,7 +394,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) (ctl->server.authenticate == A_KERBEROS_V5) || (ctl->server.authenticate == A_OTP) || (ctl->server.authenticate == A_CRAM_MD5) || - maybe_tls(ctl)) + maybe_starttls(ctl)) { if ((ok = capa_probe(sock)) != PS_SUCCESS) /* we are in STAGE_GETAUTH => failure is PS_AUTHFAIL! */ @@ -406,12 +407,12 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) (ok == PS_SOCKET && !ctl->wehaveauthed)) { #ifdef SSL_ENABLE - if (must_tls(ctl)) { + if (must_starttls(ctl)) { /* fail with mandatory STLS without repoll */ report(stderr, GT_("TLS is mandatory for this session, but server refused CAPA command.\n")); report(stderr, GT_("The CAPA command is however necessary for TLS.\n")); return ok; - } else if (maybe_tls(ctl)) { + } else if (maybe_starttls(ctl)) { /* defeat opportunistic STLS */ xfree(ctl->sslproto); ctl->sslproto = xstrdup(""); @@ -431,24 +432,19 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) } #ifdef SSL_ENABLE - if (maybe_tls(ctl)) { - char *commonname; - - commonname = ctl->server.pollname; - if (ctl->server.via) - commonname = ctl->server.via; - if (ctl->sslcommonname) - commonname = ctl->sslcommonname; - - if (has_stls - || must_tls(ctl)) /* if TLS is mandatory, ignore capabilities */ + commonname = ctl->server.pollname; + if (ctl->server.via) + commonname = ctl->server.via; + if (ctl->sslcommonname) + commonname = ctl->sslcommonname; + + if (maybe_starttls(ctl)) { + if (has_stls || must_starttls(ctl)) /* if TLS is mandatory, ignore capabilities */ { - /* Use "tls1" rather than ctl->sslproto because tls1 is the only - * protocol that will work with STARTTLS. Don't need to worry - * whether TLS is mandatory or opportunistic unless SSLOpen() fails - * (see below). */ + /* Don't need to worry whether TLS is mandatory or + * opportunistic unless SSLOpen() fails (see below). */ if (gen_transact(sock, "STLS") == PS_SUCCESS - && (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, "tls1", ctl->sslcertck, + && (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, ctl->sslproto, ctl->sslcertck, ctl->sslcertfile, ctl->sslcertpath, ctl->sslfingerprint, commonname, ctl->server.pollname, &ctl->remotename)) != -1) { @@ -475,7 +471,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) { report(stdout, GT_("%s: upgrade to TLS succeeded.\n"), commonname); } - } else if (must_tls(ctl)) { + } else if (must_starttls(ctl)) { /* Config required TLS but we couldn't guarantee it, so we must * stop. */ set_timeout(0); @@ -495,7 +491,11 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) } } } - } /* maybe_tls() */ + } else { /* maybe_starttls() */ + if (has_stls && outlevel >= O_VERBOSE) { + report(stdout, GT_("%s: WARNING: server offered STLS, but sslproto '' given.\n"), commonname); + } + } /* maybe_starttls() */ #endif /* SSL_ENABLE */ /* @@ -876,6 +876,7 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck { struct stat randstat; int i; + int avoid_ssl_versions = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3; long sslopts = SSL_OP_ALL; SSL_load_error_strings(); @@ -906,26 +907,31 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck /* Make sure a connection referring to an older context is not left */ _ssl_context[sock] = NULL; if(myproto) { - if(!strcasecmp("ssl2",myproto)) { -#if (HAVE_DECL_SSLV2_CLIENT_METHOD + 0 > 0) && (0 == OPENSSL_NO_SSL2 + 0) - _ctx[sock] = SSL_CTX_new(SSLv2_client_method()); -#else - report(stderr, GT_("Your OpenSSL version does not support SSLv2.\n")); - return -1; -#endif - } else if(!strcasecmp("ssl3",myproto)) { + if(!strcasecmp("ssl3",myproto)) { #if (HAVE_DECL_SSLV3_CLIENT_METHOD + 0 > 0) && (0 == OPENSSL_NO_SSL3 + 0) _ctx[sock] = SSL_CTX_new(SSLv3_client_method()); + avoid_ssl_versions &= ~SSL_OP_NO_SSLv2; #else report(stderr, GT_("Your OpenSSL version does not support SSLv3.\n")); return -1; #endif } else if(!strcasecmp("tls1",myproto)) { _ctx[sock] = SSL_CTX_new(TLSv1_client_method()); - } else if (!strcasecmp("ssl23",myproto)) { + } else if(!strcasecmp("tls1+",myproto)) { + myproto = NULL; + } else if(!strcasecmp("tls1.1+",myproto)) { + myproto = NULL; + avoid_ssl_versions |= SSL_OP_NO_TLSv1; + } else if(!strcasecmp("tls1.2+",myproto)) { + myproto = NULL; + avoid_ssl_versions |= SSL_OP_NO_TLSv1; +#ifdef SSL_OP_NO_TLSv1_1 + avoid_ssl_versions |= SSL_OP_NO_TLSv1_1; +#endif + } else if (!strcasecmp("ssl23",myproto) || 0 == strcasecmp("auto",myproto)) { myproto = NULL; } else { - report(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto); + report(stderr,GT_("Invalid SSL protocol '%s' specified, using default autoselect (SSL23).\n"), myproto); myproto = NULL; } } @@ -943,7 +949,7 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck sslopts &= ~ SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; } - SSL_CTX_set_options(_ctx[sock], sslopts); + SSL_CTX_set_options(_ctx[sock], sslopts | avoid_ssl_versions); if (certck) { SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_ck_verify_callback); @@ -5,15 +5,17 @@ #include "fetchmail.h" +#include <string.h> + #ifdef HAVE_STRINGS_H #include <strings.h> #endif -/** return true if user allowed TLS */ -int maybe_tls(struct query *ctl) { +/** return true if user allowed opportunistic STARTTLS/STLS */ +int maybe_starttls(struct query *ctl) { #ifdef SSL_ENABLE /* opportunistic or forced TLS */ - return (!ctl->sslproto || !strcasecmp(ctl->sslproto,"tls1")) + return (!ctl->sslproto || strlen(ctl->sslproto)) && !ctl->use_ssl; #else (void)ctl; @@ -21,11 +23,11 @@ int maybe_tls(struct query *ctl) { #endif } -/** return true if user requires TLS, note though that this code must - * always use a logical AND with maybe_tls(). */ -int must_tls(struct query *ctl) { +/** return true if user requires STARTTLS/STLS, note though that this + * code must always use a logical AND with maybe_tls(). */ +int must_starttls(struct query *ctl) { #ifdef SSL_ENABLE - return maybe_tls(ctl) + return maybe_starttls(ctl) && (ctl->sslfingerprint || ctl->sslcertck || (ctl->sslproto && !strcasecmp(ctl->sslproto, "tls1"))); #else |