Re: ANN: getmail v. 5.9

Daniel Kahn Gillmor <[email protected]> wrote:
> 
> hm, ok, well the previous tarball was already uploaded to debian, and
> now won't match the distributed version.  oh well.

I take it you can't upload a new package with the same version number.  I
could bump the version number and re-release if it's a big deal.

> > cause connections to fail if the server name the user puts in their
> > getmailrc file resolves to the correct IP address but which the server
> > does not consider as (one of) its proper name(s).  This happens a lot with
> > servers having many DNS aliases but which don't have valid SSL
> > certificates installed for every corresponding name.
> 
> In this case, how is the client authenticating the server correctly anyway?
> surely the certificate failure would be causing a problem for them anyway,
> because the certificate wouldn't match the configured hostname.

Take a user who's not doing certificate validation at all.  To date, getmail
has been connecting to the server without sending SNI, but now after this
hypothetical change, getmail sends SNI "imap.isp.example.net".

And the server says "wtf, never heard of that domain, I'm
*mail*.isp.example.net" because that's the only TLS cert and domain it's been
configured for.  Server drops the connection with an error.

Cue very unhappy getmail user, who had a working config, upgraded, and now
can't retrieve his mail.

> Can you give an example of a config that would be broken?

See above.

> so if we have a way that we could just fix it, that would be great.

I spent some time looking at the problem and didn't see any obvious way to fix
Gmail's borkage without introducing problems for other getmail users, which is
obviously not acceptable.

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon
GPL'ed software available at:               http://pyropus.ca/software/
-----------------------------------------------------------------------