Re: Patch for TLS 1.2 DHE* cipher support in uwimap/panda?
Neal Horman <[email protected]> Thu, 6 Apr 2017 21:29:48 -0500
| Newsgroups | gmane.mail.imap.uw.c-client |
|---|---|
| Message-ID | <[email protected]> |
This is a cryptographically signed message in MIME format.
--===============7751559772589791737==
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms060001070000020204080906"
This is a cryptographically signed message in MIME format.
--------------ms060001070000020204080906
Content-Type: multipart/alternative;
boundary="------------1C6F89C5808633A6FEFFE189"
This is a multi-part message in MIME format.
--------------1C6F89C5808633A6FEFFE189
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
All,
I have applied, commited, and pushed, David's SSL DH options patch =
supplied privately.
Constructive comments welcome!
I am presently running the code from this last patch and the update =
that I previously commited earlier today, and it appears to be working.
Evidence follows;
--- pre-changes from today - using /etc/c-config.cf
# These are the hard coded default values, but are show for completen=
ess
set ssl-protocols -all +TLSV1
set ssl-cipher-list HIGH:!ADH:!EXP:!LOW:!SSLV2:!SSLV3
---
subject=3D/CN=3D --- redacted ---
issuer=3D/C=3DUS/O=3DLet's Encrypt/CN=3DLet's Encrypt Authority X3
---
No client certificate CA names sent
---
SSL handshake has read 2911 bytes and written 712 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: --- redacted ---
Session-ID-ctx:
Master-Key: --- redacted ---
Key-Arg : None
Start Time: 1491529991
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4REV1 I18NLEVEL=3D1 LITERAL+ SASL-IR LOGIN-REFERRALS=
AUTH=3DPLAIN AUTH=3DLOGIN] cpe-67-10-173-141.satx.res.rr.com Panda IMAP =
2010.417 at Thu, 6 Apr 2017 20:53:11 -0500 (CDT)
* BYE Autologout (idle for too long)
read:errno=3D0
--- end ---
--- post changes from today - using /etc/c-config.cf
set ssl-protocols -all +TLSV1.1 +TLSV1.2
set ssl-cipher-list HIGH:!ADH:!EXP:!LOW:!SSLV2:!SSLV3
set ssl-dh-parameters /etc/mail/certs/dh.param
---
subject=3D/CN=3D --- redacted ---
issuer=3D/C=3DUS/O=3DLet's Encrypt/CN=3DLet's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 4103 bytes and written 625 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : DHE-RSA-AES256-GCM-SHA384
Session-ID: --- redacted ---
Session-ID-ctx:
Master-Key: --- redacted ---
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - --- redacted ---
Start Time: 1491528526
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4REV1 I18NLEVEL=3D1 LITERAL+ SASL-IR LOGIN-REFERRALS=
AUTH=3DPLAIN AUTH=3DLOGIN] localhost Panda IMAP 2010.417 at Thu, 6 Apr 2=
017 20:28:46 -0500 (CDT)
* BYE Autologout (idle for too long)
read:errno=3D0
--- end ---
Regards
Neal Horman
--------------1C6F89C5808633A6FEFFE189
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Ty=
pe">
</head>
<body bgcolor=3D"#FFFFFF" text=3D"#000000">
All,<br>
=C2=A0=C2=A0=C2=A0 I have applied, commited, and pushed,=C2=A0 David'=
s SSL DH options
patch supplied privately.<br>
<br>
=C2=A0=C2=A0=C2=A0 Constructive comments welcome!<br>
<br>
=C2=A0=C2=A0=C2=A0 I am presently running the code from this last pat=
ch and the
update that I previously commited earlier today, and it appears to
be working.<br>
=C2=A0=C2=A0=C2=A0 Evidence follows;<br>
<br>
--- pre-changes from today - using /etc/c-config.cf<br>
<blockquote>
<pre># These are the hard coded default values, but are show for co=
mpleteness
set ssl-protocols -all +TLSV1
set ssl-cipher-list HIGH:!ADH:!EXP:!LOW:!SSLV2:!SSLV3
</pre>
</blockquote>
---<br>
<pre>subject=3D/CN=3D --- redacted ---
issuer=3D/C=3DUS/O=3DLet's Encrypt/CN=3DLet's Encrypt Authority X3
---
No client certificate CA names sent
---
SSL handshake has read 2911 bytes and written 712 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: --- redacted ---
Session-ID-ctx:=20
Master-Key: --- redacted ---
Key-Arg : None
Start Time: 1491529991
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4REV1 I18NLEVEL=3D1 LITERAL+ SASL-IR LOGIN-REFERRALS=
AUTH=3DPLAIN AUTH=3DLOGIN] cpe-67-10-173-141.satx.res.rr.com Panda IMAP =
2010.417 at Thu, 6 Apr 2017 20:53:11 -0500 (CDT)
* BYE Autologout (idle for too long)
read:errno=3D0
</pre>
--- end ---<br>
<br>
<br>
<br>
--- post changes from today=C2=A0 - using /etc/c-config.cf<br>
<blockquote>
<pre>set ssl-protocols -all +TLSV1.1 +TLSV1.2
set ssl-cipher-list HIGH:!ADH:!EXP:!LOW:!SSLV2:!SSLV3
set ssl-dh-parameters /etc/mail/certs/dh.param
</pre>
</blockquote>
---
<pre>subject=3D/CN=3D --- redacted ---
issuer=3D/C=3DUS/O=3DLet's Encrypt/CN=3DLet's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 4103 bytes and written 625 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : DHE-RSA-AES256-GCM-SHA384
Session-ID: --- redacted ---
Session-ID-ctx:
Master-Key: --- redacted ---
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - --- redacted ---
Start Time: 1491528526
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4REV1 I18NLEVEL=3D1 LITERAL+ SASL-IR LOGIN-REFERRALS=
AUTH=3DPLAIN AUTH=3DLOGIN] localhost Panda IMAP 2010.417 at Thu, 6 Apr 2=
017 20:28:46 -0500 (CDT)
* BYE Autologout (idle for too long)
read:errno=3D0
</pre>
--- end ---<br>
<br>
<br>
Regards<br>
Neal Horman<br>
<br>
</body>
</html>
--------------1C6F89C5808633A6FEFFE189--
--------------ms060001070000020204080906
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
CtowggTwMIID2KADAgECAhA8XaOdkBoMZJ/i/3PLtQ0cMA0GCSqGSIb3DQEBCwUAMHUxCzAJ
BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD
ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll
bnQgQ0EwHhcNMTYwNDMwMTQzNjA5WhcNMTkwNzMwMTQzNjA5WjA8MRkwFwYDVQQDDBBuZWFs
QHdhbmxpbmsuY29tMR8wHQYJKoZIhvcNAQkBFhBuZWFsQHdhbmxpbmsuY29tMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArEhcsUIgdRkd0jqQWOKXKLwfcZSj/6DnxZRhz6B5
4V1D7x1JC/RulBFYf3x5TUgc30fmDHQ/X0lB+608X6vf0Q4feG2hTnqtPl2H6BbVDcQUWl6C
+6cXvJFZ3g8C6kXfdt188r+J9050w9dRdmHZogcEjASlqk6yIOC5jlm74/6eRuwHuZVpjpg1
8cxzl+rwcV3RjT8aBvP1TDrS27LyZFbTjOl2CUlK37kLLpQok6LWgnHkt8HQPfXxdlh4sE2X
gfFPQYhkrDghUL8ZIRCoFBUckUT86Zjyp8HzyY69eHl+mfaO4dtcl1ic45Dt5Jgh/Ep9BhhY
LU3tDBcfpvwTEwIDAQABo4IBszCCAa8wDgYDVR0PAQH/BAQDAgSwMB0GA1UdJQQWMBQGCCsG
AQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBSKUMTs47GFLABrEYT6Wxe9
5fl6+DAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBvBggrBgEFBQcBAQRjMGEw
JAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5BggrBgEFBQcwAoYtaHR0
cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEuY3J0MDgGA1UdHwQxMC8w
LaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGllbnQxLmNybDAbBgNVHREE
FDASgRBuZWFsQHdhbmxpbmsuY29tMCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wu
Y29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIFMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93
d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0BAQsFAAOCAQEAlxJ6KHJ1vmbr+rz1
05wPXOwfuMO8YGOm7Wn1vKM4x/DHEm/Lo8yIwjvET2/hvnFcC2HvgmXcnEJBa/vfCepoi9zf
qDtMhzV9zDzLISspTS4p4qkH6LoqkDIyJWNuHucMbb8M6Pk3TtWEoEa+C8DaJNDCBXdSoJsV
Av3ncbauhMbgA4k1mhgqGysS7c3gBEp7+bFh5EDcsTEJEy8mE86H4U3UlYTHBNwylQPxG5JZ
Rvw5rxiqKUtRqWzJTlBh/QzhV4qTbHXcgFh/89YCVDZe4kkL2cp+Wep8EmEXSMlHE87+aD3O
yqkWG15E9aFN9wOOIYKy4BWHwdNujIy64TZSuzCCBeIwggPKoAMCAQICEGunin0K14jWUQr5
WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t
IEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn
BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAw
NVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0
ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQD
ExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmvmCSsu1d52DXsCR58zJQbCtB2/A5uFqNx
WacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnmVkS6Iye8wUbYzMsDzgnpazlPg19dnSqf
hM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bG
WxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PIdopmykwvIjLPqbJK7yPwFZYekKE015Os
W6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuuN0jhrxK1ljz50hH23gA9cbMCAwEAAaOC
AWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQw
EgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0
c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEEWjBYMCQGCCsGAQUFBzABhhhodHRwOi8v
b2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKGJGh0dHA6Ly9haWEuc3RhcnRzc2wuY29t
L2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgw
FoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0gBDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUH
AgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0BAQsFAAOCAgEA
i+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY0JdOruKbrWDsXUsiI0j/7Crft9S5oxvP
iDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpFNjDmQbcM3yl3WFIRS4WhNrsOY14V7y2I
rUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhi
jixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p6q/CW+uVrZiSW57+q5an2P2i7hP85jQJ
cy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOvZ3UDsTDTagXpRDIKQLZo02wrlxY6iMFq
vlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOumZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e
0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0o
T+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO/ZskmSY8wtAk24orAc0vwXgYanqNsBX5
Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsNJQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5
Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPMMIIDyAIBATCBiTB1MQswCQYDVQQGEwJJ
TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNh
dGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhA8
XaOdkBoMZJ/i/3PLtQ0cMA0GCWCGSAFlAwQCAQUAoIICEzAYBgkqhkiG9w0BCQMxCwYJKoZI
hvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNzA0MDcwMjI5NDhaMC8GCSqGSIb3DQEJBDEiBCDF
k2mGEYOq7r28RfThOmGaOPa3zIXAqdxka7eKc0zhAjBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCG
SAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqG
SIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkw
dTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0
Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAx
IENsaWVudCBDQQIQPF2jnZAaDGSf4v9zy7UNHDCBnAYLKoZIhvcNAQkQAgsxgYyggYkwdTEL
MAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29t
IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENs
aWVudCBDQQIQPF2jnZAaDGSf4v9zy7UNHDANBgkqhkiG9w0BAQEFAASCAQBV83he+cDtDH+f
IaK+C/G1eQS4Wbum59jn9YPUoHrMzzZTk1yOnWexT73Oy7PyFnLp+lNu4L7poIuhttKX3Oej
DrL6SlyOiulf+GJm1oGyAznPrNZ5rTBSHb9aN0oKM8c5RW8KzLmB+qaFUzHmUTAnubVH2Oct
GW6J6Ps6D0egbbK13WEVSH5oz2YTcP49e8+MgOPQMu4npUJuSaKryeg4ZfFMvczR+tEVznTe
yXIsgKY8nXKWkgz/ySKICtYuDawD2MVBT6/h2eekPa/HeSqMmCFcwyg2ss4Y6iG0t7JUMty5
aI4gPpseucmh5NFDpQzE1cLcS0BK6Vg4AV4+L5ZKAAAAAAAA
--------------ms060001070000020204080906--
--===============7751559772589791737==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Imap-uw mailing list
[email protected]
http://mailman13.u.washington.edu/mailman/listinfo/imap-uw
--===============7751559772589791737==--