Re: Bug with imap.gmail.com and getmail TLS validation

So....

Apologies if this is top-posting, I'm having to use googles hideous
gmail interface at the moment.

I do not *yet* have this issue with other imap servers, but all the
other imap servers that I use are TLSv1.2 maximum, whereas gmail is
TLSv1.3 maximum.

With ssl_version = tlsv1_2 we get this:

_connect() [_retrieverbases.py:599] establishing IMAP SSL connection
to imap.gmail.com:993 using protocol ve
rsion TLSV1_2, with ca_certs /usr/local/etc/ssl/cert.pem
_connect() [_retrieverbases.py:699] IMAP SSL connection
<getmailcore._retrieverbases.IMAP4_SSL_EXTENDED inst
ance at 0x801bdda28> established with fingerprint
8ca13e0411ebab888e5909e693dc5c5925ee9aec9124eaeb2ae7b820d1
6df696 using cipher ECDHE-RSA-AES128-GCM-SHA256:TLSv1.2:128

With that option commented out we get this:

_connect() [_retrieverbases.py:599] establishing IMAP SSL connection
to imap.gmail.com:993 with ca_certs /usr/local/etc/ssl/cert.pem
abort() [_retrieverbases.py:1757] trace
gmail: operation error (socket sslerror during connect ([SSL:
CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)))

It's a shame that this trace isn't dumping out the actual received
certificate. But I have just taken a tcpdump of the negotiation and I
can see getmail immediately respond to google with an "Unknown CA" TLS
alert. With openssl below it responds with a "Change Cipher Spec".
Maybe Python 2.7 doesn't support TLSv1.3 properly or something. I
don't pretend to know a lot about the inner workings of TLS but
interestingly it looks like the server certificate is encrypted.

If we use openssl s_client -CAfile /usr/local/etc/ssl/cert.pem
-connect imap.gmail.com:993 then this validates successfully, and you
can see that it's using TLSv1.3.

% openssl s_client -CAfile /usr/local/etc/ssl/cert.pem -connect
imap.gmail.com:993             ~
CONNECTED(00000003)
depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = US, O = Google Trust Services, CN = Google Internet
Authority G3
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN
= imap.gmail.com
verify return:1

...

SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384

....

Verify return code: 0 (ok)

Thanks, Matt.

On Tue, 29 Jan 2019 at 21:28, Charles Cazabon
<[email protected]> wrote:
>
> Matt Smith <[email protected]> wrote:
> >
> > So if getmail isn't using imaplib2
>
> It isn't.  imaplib from the standard library only.
>
> > python standard library then it might be something that needs solving
> > there.
>
> Perhaps.  It might be useful to enable trace-level logging (--trace), which is
> very verbose and contains a bunch of info about the SSL connection steps.  I'm
> not sure if anyone else also suggested seeing whether this occurs on
> connections to different mailhosts, or just the one you're trying now?
>
> > Except of course it's python 2.x which is soon going to be EOL.
>
> Well, Python 2 isn't going to disappear when it stops being officially
> supported.  I strongly suspect lots of us will still be running Python 2 code
> in 2030 and later.
>
> Charles
> --
> -----------------------------------------------------------------------
> Charles Cazabon
> GPL'ed software available at:               http://pyropus.ca/software/
> -----------------------------------------------------------------------
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>