Re: Patch for TLS 1.2 DHE* cipher support in uwimap/panda?
"Erik Kangas, Ph.D." <[email protected]> Sun, 09 Apr 2017 17:58:01 +0000
| Newsgroups | gmane.mail.imap.uw.c-client |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
If you cannot view the attachment(s), then your email client does not
support MIME.
--------------------_Boundary_83006311.2711216
Content-Type: multipart/alternative; boundary="-------------4745567.02084925"
---------------4745567.02084925
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable
Hi all,
Is this update scheduled to go here:
https://github.com/jonabbey/panda-imap
Or does someone have an updated panda tar ball with the latest patches=20
in it? I am getting errors trying to apply the patch to the version=20
currently in github (or am I looking in the wrong place for the latest=20
branch now ... I have been updating my own source for many years=20
without going out to the originals).
Thanks,
-Erik Kangas
[1]LuxSci Erik Kangas, PhD
President/CEO
[2][email protected] 617-596-9558
be Smart. be Secure.
[3]www.LuxSci.com Follow LuxSci: [4]Follow LuxSci on=20
Twitter [5]Follow LuxSci on Facebook [6][IMG]
On April 6, 2017 10:34:24 pm EDT, "Neal Horman" <[email protected]> wrote:
All,
I have applied, commited, and pushed, David's SSL DH options=20
patch supplied privately.
Constructive comments welcome!
I am presently running the code from this last patch and the=20
update that I previously commited earlier today, and it appears to be=20
working.
Evidence follows;
--- pre-changes from today - using /etc/c-config.cf
# These are the hard coded default values, but are show for completeness
set ssl-protocols -all +TLSV1
set ssl-cipher-list HIGH:!ADH:!EXP:!LOW:!SSLV2:!SSLV3
---
subject=3D/CN=3D --- redacted ---
issuer=3D/C=3DUS/O=3DLet's Encrypt/CN=3DLet's Encrypt Authority X3
---
No client certificate CA names sent
---
SSL handshake has read 2911 bytes and written 712 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: --- redacted ---
Session-ID-ctx:
Master-Key: --- redacted ---
Key-Arg : None
Start Time: 1491529991
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4REV1 I18NLEVEL=3D1 LITERAL+ SASL-IR=20
LOGIN-REFERRALS AUTH=3DPLAIN AUTH=3DLOGIN]=20
cpe-67-10-173-141.satx.res.rr.com Panda IMAP 2010.417 at Thu, 6 Apr=20
2017 20:53:11 -0500 (CDT)
* BYE Autologout (idle for too long)
read:errno=3D0
--- end ---
--- post changes from today - using /etc/c-config.cf
set ssl-protocols -all +TLSV1.1 +TLSV1.2
set ssl-cipher-list HIGH:!ADH:!EXP:!LOW:!SSLV2:!SSLV3
set ssl-dh-parameters /etc/mail/certs/dh.param
---
subject=3D/CN=3D --- redacted ---
issuer=3D/C=3DUS/O=3DLet's Encrypt/CN=3DLet's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 4103 bytes and written 625 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : DHE-RSA-AES256-GCM-SHA384
Session-ID: --- redacted ---
Session-ID-ctx:
Master-Key: --- redacted ---
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - --- redacted ---
Start Time: 1491528526
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4REV1 I18NLEVEL=3D1 LITERAL+ SASL-IR=20
LOGIN-REFERRALS AUTH=3DPLAIN AUTH=3DLOGIN] localhost Panda IMAP 2010.417 at=
=20
Thu, 6 Apr 2017 20:28:46 -0500 (CDT)
* BYE Autologout (idle for too long)
read:errno=3D0
--- end ---
Regards
Neal Horman
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------------------------------------------=
------------------
_______________________________________________
Imap-uw mailing list
[email protected]
[7]http://mailman13.u.washington.edu/mailman/listinfo/imap-uw
References
Visible links
1. https://luxsci.com/
2. mailto:[email protected]
3. http://www.luxsci.com/
4. http://www.twitter.com/LuxSci
5. http://www.facebook.com/pages/Westwood-MA/LuxSci/25893114249
6. http://feeds2.feedburner.com/LuxsciFyi
7. http://mailman13.u.washington.edu/mailman/listinfo/imap-uw
---------------4745567.02084925
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML>
<HTML>
<HEAD><meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF=
-8"></HEAD>
<BODY style=3D"padding:5px; line-height: 1.3em; font-size: 14px; color: #33=
3; background-color: #FFF; font-family: Arial, Helvetica, sans-serif">
<div>Hi all,<br />
<br />
Is this update scheduled to go here:<br />
<br />
https://github.com/jonabbey/panda-imap<br />
<br />
Or does someone have an updated panda tar ball with the latest patches in i=
t? I am getting errors trying to apply the patch to the version =
currently in github (or am I looking in the wrong place for the latest bran=
ch now ... I have been updating my own source for many years without going =
out to the originals).<br />
<br />
Thanks,<br />
-Erik Kangas<br />
<br />
</div>
<div id=3D"signature"><!--SIG-->
<div style=3D"width:500px; padding:5px; border: 1px solid #CCC; border-radi=
us: 5px; background-color: #EEEEEE">
<table border=3D"0" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-rad=
ius:5px; background-color: #FFFFFF; padding: 5px; width:100%">
<tbody>
<tr valign=3D"top">
<td style=3D""><a href=3D"https://luxsci.com" target=3D"_blank"><img alt=
=3D"LuxSci" border=3D"0" height=3D"128" src=3D"https://djrufvackyewl.cloudf=
ront.net/s3/logo/Logo_final_128_dark.png" width=3D"128" /></a></td>
<td width=3D"100%">
<div style=3D"margin: 5px 0 5px 0"><b><span style=3D"color:#35638d;font-=
family:arial,helvetica,sans-serif; font-size: 18px">Erik Kangas, PhD </span=
></b></div>
<div style=3D"margin-bottom: 5px"><span style=3D"color:#35638d;font-fami=
ly:arial,helvetica,sans-serif;font-size: 14px"><strong>President/CEO </stro=
ng></span></div>
<div style=3D"margin-bottom: 25px"><span style=3D"color:#646464;font-fam=
ily:arial,helvetica,sans-serif;font-size: 14px"><a href=3D"mailto:kangas@lu=
xsci.com" style=3D"color:#646464; text-decoration: none">[email protected]<=
/a> 617-596-9558</span></div>
<div style=3D"margin-bottom: 5px"><span style=3D"color:#646464;font-fami=
ly:arial,helvetica,sans-serif; font-size: 14px"><strong>be Smart. be Secure=
.</strong></span></div>
<div><a href=3D"http://www.luxsci.com" style=3D"font-family:arial,helvet=
ica,sans-serif;font-size: 14px;color: #646464" target=3D"_blank">www.LuxSci=
.com</a> <span style=3D"color:#646464;font-family:=
arial,helvetica,sans-serif;font-size: 14px">Follow LuxSci: <a href=3D"=
http://www.twitter.com/LuxSci" target=3D"_blank"><img alt=3D"Follow LuxSci =
on Twitter" height=3D"24" src=3D"https://d4hm2u4pioc0c.cloudfront.net/icons=
/custom/24x24/plain/Twitter-icon.png" style=3D"vertical-align:middle;border=
:0" width=3D"24" /></a> <a href=3D"http://www.facebook.com/pages/Westwood-M=
A/LuxSci/25893114249" target=3D"_blank"><img alt=3D"Follow LuxSci on Facebo=
ok" height=3D"24/" src=3D"https://d4hm2u4pioc0c.cloudfront.net/icons/custom=
/24x24/plain/FaceBook-icon.png" style=3D"vertical-align:middle;border:0" wi=
dth=3D"24" /></a> <a href=3D"http://feeds2.feedburner.com/LuxsciFyi" rel=3D=
"alternate" target=3D"_blank" title=3D"Subscribe to our RSS feed" type=3D"a=
pplication/rss+xml"><img alt=3D"" height=3D"24/" src=3D"https://d4hm2u4pioc=
0c.cloudfront.net/icons/custom/24x24/plain/feed.png" style=3D"vertical-alig=
n:middle;border:0" width=3D"24" /></a></span></div>
</td>
</tr>
</tbody>
</table>
</div>
<!--/SIG--></div>
<div><br />
</div>
<br />
<div style=3D"padding:3px 0 3px 0;border-top:1px solid #DDD; border-bottom:=
1px solid #DDD;margin:3px 0 3px 0">On April 6, 2017 10:34:24 pm EDT, "=
;Neal Horman" <[email protected]> wrote:</div>
<br />
<br />
All,<br />
I have applied, commited, and pushed, David's =
SSL DH options patch supplied privately.<br />
<br />
Constructive comments welcome!<br />
<br />
I am presently running the code from this last patch and=
the update that I previously commited earlier today, and it appears to be =
working.<br />
Evidence follows;<br />
<br />
--- pre-changes from today - using /etc/c-config.cf
<blockquote>
<pre>
# These are the hard coded default values, but are show for completeness
set ssl-protocols -all +TLSV1
set ssl-cipher-list HIGH:!ADH:!EXP:!LOW:!SSLV2:!SSLV3
</pre>
</blockquote>
---
<pre>
subject=3D/CN=3D --- redacted ---
issuer=3D/C=3DUS/O=3DLet's Encrypt/CN=3DLet's Encrypt Authority X3
---
No client certificate CA names sent
---
SSL handshake has read 2911 bytes and written 712 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: --- redacted ---
Session-ID-ctx:=20
Master-Key: --- redacted ---
Key-Arg : None
Start Time: 1491529991
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4REV1 I18NLEVEL=3D1 LITERAL+ SASL-IR LOGIN-REFERRALS A=
UTH=3DPLAIN AUTH=3DLOGIN] cpe-67-10-173-141.satx.res.rr.com Panda IMAP 2010=
.417 at Thu, 6 Apr 2017 20:53:11 -0500 (CDT)
* BYE Autologout (idle for too long)
read:errno=3D0
</pre>
--- end ---<br />
<br />
<br />
<br />
--- post changes from today - using /etc/c-config.cf
<blockquote>
<pre>
set ssl-protocols -all +TLSV1.1 +TLSV1.2
set ssl-cipher-list HIGH:!ADH:!EXP:!LOW:!SSLV2:!SSLV3
set ssl-dh-parameters /etc/mail/certs/dh.param
</pre>
</blockquote>
---
<pre>
subject=3D/CN=3D --- redacted ---
issuer=3D/C=3DUS/O=3DLet's Encrypt/CN=3DLet's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 4103 bytes and written 625 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : DHE-RSA-AES256-GCM-SHA384
Session-ID: --- redacted ---
Session-ID-ctx:
Master-Key: --- redacted ---
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - --- redacted ---
Start Time: 1491528526
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4REV1 I18NLEVEL=3D1 LITERAL+ SASL-IR LOGIN-REFERRALS A=
UTH=3DPLAIN AUTH=3DLOGIN] localhost Panda IMAP 2010.417 at Thu, 6 Apr 2017 =
20:28:46 -0500 (CDT)
* BYE Autologout (idle for too long)
read:errno=3D0
</pre>
--- end ---<br />
<br />
<br />
Regards<br />
Neal Horman<br />
<hr />_______________________________________________<br />
Imap-uw mailing list<br />
[email protected]<br />
<a class=3D"monobody" href=3D"http://mailman13.u.washington.edu/mailman/lis=
tinfo/imap-uw" target=3D"_blank">http://mailman13.u.washington.edu/mailman/=
listinfo/imap-uw</a>
</BODY>
</HTML>
---------------4745567.02084925--
--------------------_Boundary_83006311.2711216
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Imap-uw mailing list
[email protected]
http://mailman13.u.washington.edu/mailman/listinfo/imap-uw
--------------------_Boundary_83006311.2711216--