Re: Bug with imap.gmail.com and getmail TLS validation

Charles Cazabon <[email protected]> wrote:
> 
> The problem seems to be that [...] when using TLS v1.3, the Gmail servers
> respond with an invalid request error if SNI is not present.

I've confirmed this.  Google/Gmail appears to be using its 900lb-gorilla
status in the email field to try to force client authors to use SNI in IMAP
TLS connections.  Note that the use of SNI is *not* mandatory in the TLS
protocol v.1.3.

I was able to hack in something to cause the SNI field to be sent with the
request to verify the problem, but unfortunately I don't see a way to
compatibly use this in getmail going forward.  If I do anything to make SNI
sent by default (when OpenSSL 1.1.1 or later is in use) then some users'
configurations will suddenly break when the server name in their rc files is
rejected by an IMAP server with some other idea of the correct name(s) for
itself.  I'm not willing to break getmail users' mail for no reason.

I've added the workaround (forcing the use of TLS v1.2) to the getmail FAQ,
and included a pointer to it from the configuration section on SSL options.
Hopefully this will address the issue sufficiently.

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon
GPL'ed software available at:               http://pyropus.ca/software/
-----------------------------------------------------------------------