Re: TLS 1.3 and SNI; test script included

ndre <[email protected]> Mon, 11 Feb 2019 12:05:21 -0200

Newsgroups	gmane.mail.getmail.user
Message-ID	<[email protected]>

Hello,

Fri 08 Feb 2019 às 22:10:11 (1549674611), [email protected] enviou:
> So if I'm going to make getmail send SNI whenever the underlying Python and
> OpenSSL versions support it, I need to know it's NOT breaking connections with
> previously-working configs.
>
> As such, here's a test script.  Anyone who is interested in this issue, please
> run it with the IMAP server to connect to as a first argument (and you can
> supply port as a second argument if you don't want the default 993).  It will
> make two connections to the IMAP server (without logging in), one using SNI
> and one without, and then report on stdout/stderr:
>
>   (a) what server it connected to
>   (b) whether either or both connections failed
>   (c) what TLS cipher/protocol was negotiated
>   (d) whether it got different SSL certificates from the server between the
>       two connections.
>
> Example for imap.gmail.com:
>
>   $ ./test-imap.py imap.gmail.com
>   Connecting to imap.gmail.com:993
>   No SNI - got cipher ('TLS_AES_256_GCM_SHA384', 'TLSv1.3', 256)
>   SNI - got cipher ('TLS_AES_256_GCM_SHA384', 'TLSv1.3', 256)
>   Different certs for no-SNI and SNI: d5129635a050f63dd607ffa9271eefaab597c0975809765dad253973fc554d25 vs 1c971dad98db354df4c1b93aefd0098dbc17b62f11a9e7bdc0d438076889836d

So I ran your script and got the following results, highlight for mail.fsf.org.

Python 2.7.15+
Openssl 1.1.1a

mail.txt (text/plain, 2 KB)

Connecting to mail.fsf.org:993
TLS 1.3, no SNI - connection failed ([SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:727))
TLS 1.3, with SNI - connection failed ([SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:727))

Connecting to imap.mail.yahoo.com:993
No SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)
SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)

Connecting to imap.outlook.com:993
No SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)
SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)

Connecting to imap.aol.com:993
No SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)
SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)

Connecting to imap.zoho.eu:993
No SNI - got cipher ('ECDHE-RSA-AES256-SHA', 'TLSv1.0', 256)
SNI - got cipher ('ECDHE-RSA-AES256-SHA', 'TLSv1.0', 256)

Connecting to imap.zoho.com:993
No SNI - got cipher ('ECDHE-RSA-AES256-SHA', 'TLSv1.0', 256)
SNI - got cipher ('ECDHE-RSA-AES256-SHA', 'TLSv1.0', 256)

Connecting to mail.gandi.net:993
No SNI - got cipher ('ECDHE-RSA-AES128-GCM-SHA256', 'TLSv1.2', 128)
SNI - got cipher ('ECDHE-RSA-AES128-GCM-SHA256', 'TLSv1.2', 128)

Connecting to imap.mail.com:993
No SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)
SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)

Connecting to mail.riseup.net:993
No SNI - got cipher ('ECDHE-RSA-AES128-GCM-SHA256', 'TLSv1.2', 128)
SNI - got cipher ('ECDHE-RSA-AES128-GCM-SHA256', 'TLSv1.2', 128)

Connecting to zsolxunfmbfuq7wf.onion:993
No SNI - got cipher ('ECDHE-RSA-AES128-GCM-SHA256', 'TLSv1.2', 128)
SNI - got cipher ('ECDHE-RSA-AES128-GCM-SHA256', 'TLSv1.2', 128)

Connecting to imap.gmx.com:993
No SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)
SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)

Connecting to imap.hushmail.com:993
No SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)
SNI - got cipher ('ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256)

signature.asc (application/pgp-signature, 841 B)