diff options
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | imap.c | 7 | ||||
| -rw-r--r-- | pop3.c | 7 |
3 files changed, 6 insertions, 10 deletions
@@ -78,6 +78,8 @@ fetchmail-6.3.19 (not yet released): * Send a NOOP only after a failed STARTTLS in IMAP. (Sunil Shetye) * Demote GSSAPI verbose/debug syslog to INFO severity. Requested by Carlos E. R. and Derek Simkowiak via the fetchmail-users@ mailing list. +* Do STARTTLS/STLS negotiation in IMAP/POP3 if it is mandatory even if the + server capabilities do not show support for upgradation to TLS. (Sunil Shetye) # DOCUMENTATION: * The manual page now links to IANA for GSSAPI service names. @@ -430,7 +430,8 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) if (ctl->sslcommonname) commonname = ctl->sslcommonname; - if (strstr(capabilities, "STARTTLS")) + if (strstr(capabilities, "STARTTLS") + || must_tls(ctl)) /* if TLS is mandatory, ignore capabilities */ { /* Use "tls1" rather than ctl->sslproto because tls1 is the only * protocol that will work with STARTTLS. Don't need to worry @@ -478,10 +479,6 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) } /* Usable. Proceed with authenticating insecurely. */ } - } else if (must_tls(ctl)) { - /* Config required TLS but STARTTLS is not advertised. */ - report(stderr, GT_("%s: cannot upgrade to TLS: no STARTTLS in CAPABILITY response.\n"), commonname); - return PS_SOCKET; } } #endif /* SSL_ENABLE */ @@ -440,7 +440,8 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) if (ctl->sslcommonname) commonname = ctl->sslcommonname; - if (has_stls) + if (has_stls + || must_tls(ctl)) /* if TLS is mandatory, ignore capabilities */ { /* Use "tls1" rather than ctl->sslproto because tls1 is the only * protocol that will work with STARTTLS. Don't need to worry @@ -490,10 +491,6 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) report(stdout, GT_("%s: opportunistic upgrade to TLS failed, trying to continue.\n"), commonname); } } - } else if (must_tls(ctl)) { - /* Config required TLS but STLS is not advertised. */ - report(stderr, GT_("%s: cannot upgrade to TLS: no STLS in CAPA response.\n"), commonname); - return PS_SOCKET; } } /* maybe_tls() */ #endif /* SSL_ENABLE */ |