From 0d1e69ae10af5eba7cd3426e802d40d17b6db218 Mon Sep 17 00:00:00 2001 From: "Eric S. Raymond" Date: Wed, 27 Oct 1999 00:15:14 +0000 Subject: This preliminary SSL patch goes to Mike. svn path=/trunk/; revision=2643 --- INSTALL | 28 ++++- Makefile.in | 35 +++--- NEWS | 9 ++ acconfig.h | 3 + conf.c | 8 ++ configure.in | 21 +++- driver.c | 15 +++ etrn.c | 2 + fetchmail-features.html | 9 +- fetchmail.c | 16 +++ fetchmail.h | 10 ++ fetchmailconf | 34 +++++- imap.c | 2 + options.c | 31 ++++++ pop2.c | 4 +- pop3.c | 2 + rcfile_l.l | 3 + rcfile_y.y | 8 +- sample.rcfile | 8 ++ socket.c | 290 +++++++++++++++++++++++++++++++++++++++++++++++- 20 files changed, 505 insertions(+), 33 deletions(-) diff --git a/INSTALL b/INSTALL index 2d980995..79ff0486 100644 --- a/INSTALL +++ b/INSTALL @@ -26,7 +26,8 @@ you should install OPIE. You need version 2.32 or better. The OPIE library sources are available at ftp://ftp.inner.net/pub/opie. You can also find OPIE and IPV6-capable servers there. -Building in IPv6 support or the IPsec patches REQUIRES that Craig +Building in IPv6 support or the IPsec patches *requires* + that Craig Metz's inet6-apps kit be installed; the IPsec patches require that the kit be built with network security API support enabled. The kit can be gotten from ftp.ipv6.inner.net:/pub/ipv6 (via IPv6) or ftp.inner.net @@ -56,12 +57,23 @@ Support for CompuServe's RPA authentication method (rather similar to APOP) is available but also not included in the standard build. You can compile it in with `configure --enable-RPA'. +Support for Microsoft's NTLM authentication method is also available +but also not included in the standard build. You can compile it in +with `configure --enable-NTLM'. + Support for authentication using RFC1731 GSSAPI is available but also not included by default. You can compile it in with `configure --with-gssapi', which looks for GSSAPI support in standard locations (/usr, /usr/local). If you set --with-GSSAPI=DIR you can direct the build to look for GSSAPI support under DIR. +Hooks for the OpenSSL library (see http://www.openssl.org/) are +included in the distribution. To enable these, configure with +--with-ssl; they are not included in the standard build. Note that +due to U.S. crypto export regulations (which we hope will soon be +overturned on Constitutional grounds), no actual cryptography code is +included in the distribution. + If you want to build for debugging, CFLAGS=-g LDFLAGS=" " ./configure @@ -135,7 +147,7 @@ If you're upgrading from popclient, see question F4 in the FAQ file. 6. TEST -I strongly recommend that your first fetchmail run use the -v and -k +I strongly recommend that your first fetchmail run use the -v, -a and -k options, in case there is something not quite right with your server, your local delivery configuration or your port 25 listener. Also, beware of aliases that direct your local mail back to the server host! @@ -143,10 +155,14 @@ beware of aliases that direct your local mail back to the server host! This software is known to work with the qpop/popper series of freeware POP3 servers; also with the IMAP2bis and IMAP4 servers that are distributed with Pine from the University of Washington; also with the -Cyrus IMAP server from CMU. This covers all the servers normally -hosted on Linux and *BSD systems. It also works with Microsoft Exchange, -despite the fact that Microsoft Exchange is extremely broken (returns -incorrect message lengths in LIST responses). +Cyrus IMAP server from CMU. This covers all the servers commonly +hosted on Linux and *BSD systems. It also works with the IMAP service +of Microsoft Exchange, despite the fact that Microsoft Exchange is +extremely broken (returns incorrect message lengths in LIST +responses). + +See the FAQ, section S, for detailed advice on running with various +servers. 7. REPORTING BUGS diff --git a/Makefile.in b/Makefile.in index 6033ae03..e1753c23 100644 --- a/Makefile.in +++ b/Makefile.in @@ -185,20 +185,27 @@ realclean: distclean mostlyclean: clean -config.status: configure Makefile.in - $(srcdir)/configure - -config.h: config.status config.h.in - sh config.status; touch config.h - -Makefile: config.status - sh config.status - -configure: configure.in - autoconf $(ACFLAGS) - -config.h.in: acconfig.h configure.in - autoheader $(ACFLAGS); touch config.h.in +# These magic rules are copied from the autoconf documentation + +${srcdir}/configure: configure.in aclocal.m4 + cd ${srcdir} && autoconf + +# autoheader might not change config.h.in, so touch a stamp file. +${srcdir}/config.h.in: stamp-h.in + +${srcdir}/stamp-h.in: configure.in aclocal.m4 acconfig.h # config.h.top config.h.bot + cd ${srcdir} && autoheader + echo timestamp> ${srcdir}/stamp-h.in + +config.h: stamp-h +stamp-h: config.h.in config.status + ./config.status + +Makefile: Makefile.in config.status + ./config.status + +config.status: configure + ./config.status --recheck # This tells versions [3.59,3.63) of GNU make not to export all variables. .NOEXPORT: diff --git a/NEWS b/NEWS index f62eab93..dd9d6884 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,10 @@ + Things to do: + +In the SSL support, we eed to add server certificate validation (In +other words, does the certificate match the system we are trying to +contact?). Also, add authentication of Certifying Authority (Is this +a Certifying Authority we recognize?). + Release Notes: (The `lines' figures total .c, .h, .l, and .y files under version control.) @@ -8,6 +15,8 @@ * Backed out the 5.1.0 change to quote usernames with embedded spaces. It actually breaks things. * Added to fetchmailconf a warning about Imail IMAP servers. +* SSL patches by Michael Warfield merged in. Distribution still contains + no crypto code. fetchmail-5.1.2 (Thu Oct 7 09:46:07 EDT 1999), 17906 lines: * Joe Loughry sent a patch to handle multihomed machines. diff --git a/acconfig.h b/acconfig.h index 15440a3b..3214bdd1 100644 --- a/acconfig.h +++ b/acconfig.h @@ -100,6 +100,9 @@ /* Define if you want SDPS support compiled in */ #undef SDPS_ENABLE +/* Define if you want SSL support compiled in */ +#undef SSL_ENABLE + /* Define if you want OPIE support compiled in */ #undef OPIE diff --git a/conf.c b/conf.c index ea7e3bad..499e141d 100644 --- a/conf.c +++ b/conf.c @@ -169,6 +169,9 @@ void dump_config(struct runctl *runp, struct query *querylist) #ifdef ETRN_ENABLE printf("'etrn',"); #endif /* ETRN_ENABLE */ +#ifdef SSL_ENABLE + printf("'ssl',"); +#endif /* SSL_ENABLE */ #if OPIE printf("'opie',"); #endif /* OPIE */ @@ -342,6 +345,11 @@ void dump_config(struct runctl *runp, struct query *querylist) numdump("warnings", ctl->warnings); numdump("fetchlimit", ctl->fetchlimit); numdump("batchlimit", ctl->batchlimit); +#ifdef SSL_ENABLE + booldump("ssl", ctl->use_ssl); + stringdump("sslkey", ctl->sslkey); + stringdump("sslcert", ctl->sslcert); +#endif /* SSL_ENABLE */ numdump("expunge", ctl->expunge); stringdump("properties", ctl->properties); listdump("smtphunt", ctl->smtphunt); diff --git a/configure.in b/configure.in index f146305e..d1c91d2c 100644 --- a/configure.in +++ b/configure.in @@ -346,6 +346,24 @@ else fi fi +### use option --with-ssl to compile in the SSL support +AC_ARG_WITH(ssl, + [ --with-ssl[=DIR] enable SSL and point its top directory]) + +if test -n "$with_ssl" +then + if test "$with_ssl" = "yes" + then + # Let's just define the standard location for the SSLeay root + with_ssl="/usr/local/ssl" + fi + includedir=$with_ssl/include + AC_DEFINE(SSL_ENABLE) + CEFLAGS="$CPPFLAGS -I$includedir" + LDEFLAGS="$LDEFLAGS -L$with_ssl/lib" + LIBS="$LIBS -lssl -lcrypto" +fi + ### use option --with-kerberos=DIR to point at a Kerberos directory AC_ARG_WITH(kerberos, [ --with-kerberos=DIR point fetchmail compilation at a Kerberos directory]) @@ -488,7 +506,8 @@ AC_OUTPUT([Makefile intl/Makefile po/Makefile.in], [ # The reason for this odd makedepend line is that we want # to have all dependencies evaluated relative to the source directory # and let VPATH do all the dirty work when we build remotely - echo "You can ignore any makedepend error messages"; + echo "You can ignore any makedepend error messages:"; + echo timestamp > stamp-h; (cd $srcdir; makedepend -f - *.c) >>Makefile]) dnl Local Variables: diff --git a/driver.c b/driver.c index 950830f0..38475016 100644 --- a/driver.c +++ b/driver.c @@ -1556,7 +1556,11 @@ const int maxfetch; /* maximum number of messages to fetch */ phase = OPEN_WAIT; set_timeout(mytimeout); #if !INET6 +#ifdef SSL_ENABLE + port = ctl->server.port ? ctl->server.port : ( ctl->use_ssl ? protocol->sslport : protocol->port ); +#else port = ctl->server.port ? ctl->server.port : protocol->port; +#endif #endif /* !INET6 */ realhost = ctl->server.via ? ctl->server.via : ctl->server.pollname; @@ -1615,6 +1619,17 @@ const int maxfetch; /* maximum number of messages to fetch */ set_timeout(0); phase = oldphase; +#ifdef SSL_ENABLE + /* perform initial SSL handshake on open connection */ + /* Note: We pass the realhost name over for certificate + verification. We may want to make this configurable */ + if (ctl->use_ssl && SSLOpen(mailserver_socket,ctl->sslkey,ctl->sslcert,realhost) == -1) + { + report(stderr, "SSL connection failed."); + goto closeUp; + } +#endif + #ifdef KERBEROS_V4 if (ctl->server.preauthenticate == A_KERBEROS_V4) { diff --git a/etrn.c b/etrn.c index 1d540c2b..1588ac34 100644 --- a/etrn.c +++ b/etrn.c @@ -119,8 +119,10 @@ const static struct method etrn = "ETRN", /* ESMTP ETRN extension */ #if INET6 "smtp", /* standard SMTP port */ + "smtps", /* ssl SMTP port */ #else /* INET6 */ 25, /* standard SMTP port */ + 465, /* ssl SMTP port */ #endif /* INET6 */ FALSE, /* this is not a tagged protocol */ FALSE, /* this does not use a message delimiter */ diff --git a/fetchmail-features.html b/fetchmail-features.html index 1cc54ab2..81d8ac19 100644 --- a/fetchmail-features.html +++ b/fetchmail-features.html @@ -10,7 +10,7 @@
Back to Fetchmail Home Page To Site Map -$Date: 1999/09/14 07:38:00 $ +$Date: 1999/10/27 00:15:09 $
@@ -18,6 +18,11 @@

Since 5.0: