Re: TLS 1.3 and SNI; test script included

> On 9 Feb 2019, at 05:10, Charles Cazabon <[email protected]> wrote:
> 
> 
> So if I'm going to make getmail send SNI whenever the underlying Python and
> OpenSSL versions support it, I need to know it's NOT breaking connections with
> previously-working configs.
> 
> As such, here's a test script.  Anyone who is interested in this issue, please
> run it with the IMAP server to connect to as a first argument (and you can
> supply port as a second argument if you don't want the default 993).  It will
> make two connections to the IMAP server (without logging in), one using SNI
> and one without, and then report on stdout/stderr:
> 
>  (a) what server it connected to
>  (b) whether either or both connections failed
>  (c) what TLS cipher/protocol was negotiated
>  (d) whether it got different SSL certificates from the server between the
>      two connections.
> 
> Example for imap.gmail.com:
> 
>  $ ./test-imap.py imap.gmail.com 
>  Connecting to imap.gmail.com:993
>  No SNI - got cipher ('TLS_AES_256_GCM_SHA384', 'TLSv1.3', 256)
>  SNI - got cipher ('TLS_AES_256_GCM_SHA384', 'TLSv1.3', 256)
>  Different certs for no-SNI and SNI: d5129635a050f63dd607ffa9271eefaab597c0975809765dad253973fc554d25 vs 1c971dad98db354df4c1b93aefd0098dbc17b62f11a9e7bdc0d438076889836d
> 
> (The script will report if TLS 1.3 or SNI is not supported by your
> Python/OpenSSL combination).
> 
> I'd like to see results for a selection of IMAP servers current getmail users
> are currently using, not just Gmail, which I can test from here ;)  Please
> post the output to the list.
> 
> If there's a reasonable number of reports and it doesn't show connections
> breaking when SNI is in use, I'll consider making the change.

Not sure how helpful this is, delete if it is not…

On my Synology diskstation, where i normally run getmail:

Wodan> ./test-imap.py imap.gmail.com <http://imap.gmail.com/>
Traceback (most recent call last):
  File "./test-imap.py", line 11, in <module>
    ssl_version=ssl.PROTOCOL_TLS, ca_certs=None,
AttributeError: 'module' object has no attribute 'PROTOCOL_TLS'
Wodan> python --version
Python 2.7.12

>>> dir (ssl)
['AF_INET', 'ALERT_DESCRIPTION_ACCESS_DENIED', 'ALERT_DESCRIPTION_BAD_CERTIFICATE', 'ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE', 'ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE', 'ALERT_DESCRIPTION_BAD_RECORD_MAC', 'ALERT_DESCRIPTION_CERTIFICATE_EXPIRED', 'ALERT_DESCRIPTION_CERTIFICATE_REVOKED', 'ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN', 'ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE', 'ALERT_DESCRIPTION_CLOSE_NOTIFY', 'ALERT_DESCRIPTION_DECODE_ERROR', 'ALERT_DESCRIPTION_DECOMPRESSION_FAILURE', 'ALERT_DESCRIPTION_DECRYPT_ERROR', 'ALERT_DESCRIPTION_HANDSHAKE_FAILURE', 'ALERT_DESCRIPTION_ILLEGAL_PARAMETER', 'ALERT_DESCRIPTION_INSUFFICIENT_SECURITY', 'ALERT_DESCRIPTION_INTERNAL_ERROR', 'ALERT_DESCRIPTION_NO_RENEGOTIATION', 'ALERT_DESCRIPTION_PROTOCOL_VERSION', 'ALERT_DESCRIPTION_RECORD_OVERFLOW', 'ALERT_DESCRIPTION_UNEXPECTED_MESSAGE', 'ALERT_DESCRIPTION_UNKNOWN_CA', 'ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY', 'ALERT_DESCRIPTION_UNRECOGNIZED_NAME', 'ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE', 'ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION', 'ALERT_DESCRIPTION_USER_CANCELLED', 'CERT_NONE', 'CERT_OPTIONAL', 'CERT_REQUIRED', 'CHANNEL_BINDING_TYPES', 'CertificateError', 'DER_cert_to_PEM_cert', 'DefaultVerifyPaths', 'HAS_ALPN', 'HAS_ECDH', 'HAS_NPN', 'HAS_SNI', 'OPENSSL_VERSION', 'OPENSSL_VERSION_INFO', 'OPENSSL_VERSION_NUMBER', 'OP_ALL', 'OP_CIPHER_SERVER_PREFERENCE', 'OP_NO_COMPRESSION', 'OP_NO_SSLv2', 'OP_NO_SSLv3', 'OP_NO_TLSv1', 'OP_NO_TLSv1_1', 'OP_NO_TLSv1_2', 'OP_SINGLE_DH_USE', 'OP_SINGLE_ECDH_USE', 'PEM_FOOTER', 'PEM_HEADER', 'PEM_cert_to_DER_cert', 'PROTOCOL_SSLv23', 'PROTOCOL_TLSv1', 'PROTOCOL_TLSv1_1', 'PROTOCOL_TLSv1_2', 'Purpose', 'RAND_add', 'RAND_egd', 'RAND_status', 'SOCK_STREAM', 'SOL_SOCKET', 'SO_TYPE', 'SSLContext', 'SSLEOFError', 'SSLError', 'SSLSocket', 'SSLSyscallError', 'SSLWantReadError', 'SSLWantWriteError', 'SSLZeroReturnError', 'SSL_ERROR_EOF', 'SSL_ERROR_INVALID_ERROR_CODE', 'SSL_ERROR_SSL', 'SSL_ERROR_SYSCALL', 'SSL_ERROR_WANT_CONNECT', 'SSL_ERROR_WANT_READ', 'SSL_ERROR_WANT_WRITE', 'SSL_ERROR_WANT_X509_LOOKUP', 'SSL_ERROR_ZERO_RETURN', 'VERIFY_CRL_CHECK_CHAIN', 'VERIFY_CRL_CHECK_LEAF', 'VERIFY_DEFAULT', 'VERIFY_X509_STRICT', 'VERIFY_X509_TRUSTED_FIRST', '_ASN1Object', '_DEFAULT_CIPHERS', '_OPENSSL_API_VERSION', '_PROTOCOL_NAMES', '_RESTRICTED_SERVER_CIPHERS', '_SSLContext', '_SSLv2_IF_EXISTS', '__builtins__', '__doc__', '__file__', '__name__', '__package__', '_create_default_https_context', '_create_stdlib_context', '_create_unverified_context', '_delegate_methods', '_dnsname_match', '_fileobject', '_get_https_context_factory', '_https_verify_certificates', '_https_verify_envvar', '_import_symbols', '_nid2obj', '_ssl', '_txt2obj', 'base64', 'cert_time_to_seconds', 'closing', 'create_connection', 'create_default_context', 'errno', 'get_default_verify_paths', 'get_protocol_name', 'get_server_certificate', 'match_hostname', 'namedtuple', 'os', 're', 'socket', 'socket_error', 'sslwrap_simple', 'sys', 'textwrap', 'warnings', 'wrap_socket']


Just to check I ran it on my macbook and got the same error.
It has 2.7.10
Both are kept up-to-date.

Python docs say 2.7.13 required for that attribute.

Kind regards,
Patrick