UW IMAP C-Client library and TLS 1.2 STARTTLS support issues.
"Erik Kangas, Ph.D." <[email protected]> Thu, 27 Jun 2019 22:00:51 +0000
| Newsgroups | gmane.mail.imap.uw.c-client |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. If you cannot view the attachment(s), then your email client does not support MIME. --------------------_Boundary_84744371.9886424 Content-Type: multipart/alternative; boundary="-------------1882296.49212672" ---------------1882296.49212672 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Hi All, Some time ago we all developed and integrated patches that allows UW=20 IMAP to speak TLS 1.2 and use DH=A0and ECDHE ciphers.=A0=A0 I have noticed that the c-client library itself, however, seems stuck=20 on TLS 1.0 and non-DH ciphers=A0 (I noticed that as we forced some=20 servers to use ONLY the DH and TLS 1.2+ and found that things using the=20 compiled c-client libraries could no longer connect to them.... where=20 as anything else can (openssl with startls, etc.).=A0=A0 It is interesting as it seems related to STARTTLS, specifically.=A0 I.e.,=20 if a server runs IMAPd on 993 and 143 (for direct-TLS and STARTTLS,=20 respectively), the c-client library seems to have no problem=20 negotiating on port 993.=A0 However, when pointed to 143, it fails to=20 negotiate TLS with a protocol and/or cipher mismatch error (depending=20 on how I configured the server). Has anyone encountered this and / or found a way for upgrade the=20 c-client STARTTLS=A0support?=A0 =A0This seems to be related to code in=20 src/c-client/imap4r1.c but I am not familiar enough with this to=20 formulate a patch myself without climbing a steep learning curve on=20 C-based openssl client software. Thanks, -Erik Kangas =A0 Erik Kangas, PhD CEO +1 617.596.9558 [email protected] [1]www.LuxSci.com [2]Erik on LinkedIn =A0 =A0 This email communication is covered under LuxSci's [3]privacy policy. =A0 =A0 =A0 On February 15, 2019 01:21:54 pm EDT, "Mabry Tyson" <[email protected]> wrot= e: Erik, I had previously expressed interest in doing this.=A0 However, I have just started evaluating other, maintained alternatives (Dovecot,=A0 Courier IMAP, ...) to move to.=A0 We will also move from an older Solaris machine to an Ubuntu machine. At this point, I'm concerned about having to change our site's mail storage format.=A0 We use mix format (we use 10MB files).=A0 Both Dovecot & Courier seem to prefer maildir (1 file per message) which gives me concern about the number of files in a directory. (I am probably the only one, but I have rarely-read mail files of system logs with on the order of 1M messages).=A0 Dovecot has a a mix-like format (multiiple messages per file), but indicates that procmail (which we use) doesn't support that, but apparently there is a dmail-type program that I can use with procmail. I knew Marc Crispin back in the day (from Tops-10 days).=A0 He believed in standards, in being precise with specifications, and coding for future requirements.=A0 He did good work.=A0 I will be sad to move away from his code base, but I can't devote the time to keeping his code running.=A0 (It is less about changing the code, than about making sure it works for the OS & file-system variants other than mine.) Good luck! On 2/15/19 8:03 AM, Erik Kangas, Ph.D. wrote: > Hi=A0All, > > Has anyone progressed with compiling openssl=A01.1.1 with panda IMAP?=A0 > If not, is anyone interested in doing this as a small consulting > project (which we would make available to the group when done)? > > Thanks, > -Erik Kangas > LuxSci > _______________________________________________ Imap-uw mailing list [email protected] [4]http://mailman13.u.washington.edu/mailman/listinfo/imap-uw =A0 References Visible links 1.=20 https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-link/500/5/send= -me?to=3Dhttps://luxsci.com 2.=20 https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-link/500/5/send= -me?to=3Dhttps://www.linkedin.com/in/erikkangas/ 3.=20 https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-link/500/5/send= -me?to=3Dhttps://luxsci.com/extranet/privacy.html 4.=20 https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-link/500/5/send= -me?to=3Dhttp://mailman13.u.washington.edu/mailman/listinfo/imap-uw ---------------1882296.49212672 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML> <HTML> <HEAD><meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF= -8"></HEAD> <BODY style=3D"padding:5px; line-height: 1.3em; font-size: 14px; color: #33= 3; background-color: #FFF; font-family: Arial, Helvetica, sans-serif"> <div>Hi All,<br /> <br /> Some time ago we all developed and integrated patches that allows UW IMAP t= o speak TLS 1.2 and use DH and ECDHE ciphers. <br /> <br /> I have noticed that the c-client library itself, however, seems stuck on TL= S 1.0 and non-DH ciphers (I noticed that as we forced some servers to= use ONLY the DH and TLS 1.2+ and found that things using the compiled c-cl= ient libraries could no longer connect to them.... where as anything else c= an (openssl with startls, etc.). <br /> <br /> It is interesting as it seems related to STARTTLS, specifically. I.e.= , if a server runs IMAPd on 993 and 143 (for direct-TLS and STARTTLS, respe= ctively), the c-client library seems to have no problem negotiating on port= 993. However, when pointed to 143, it fails to negotiate TLS with a = protocol and/or cipher mismatch error (depending on how I configured the se= rver).<br /> <br /> Has anyone encountered this and / or found a way for upgrade the c-client S= TARTTLS support? This seems to be related to code in src/c= -client/imap4r1.c but I am not familiar enough with this to formulate a pat= ch myself without climbing a steep learning curve on C-based openssl client= software.<br /> <br /> Thanks,<br /> -Erik Kangas<br /> </div> <div id=3D"signature"><!--SIG--> <div style=3D"background-image: url('https://djrufvackyewl.cloudfront.net/s= 3/2018/LuxSci_Sig2018.png'); width: 575px; height: 209px"> <div style=3D"box-sizing: content-box; padding: 20px 0 0 200px; color: #221= f43; font-size: 18px; font-family: sans-serif; vertical-align:top; font-wei= ght: bold; height: 25px">Erik Kangas, PhD</div> <div style=3D"box-sizing: content-box; padding: 0 0 0 200px; color: #99cdde= ; font-size: 18px; font-family: sans-serif; vertical-align:top; height: 25p= x">CEO</div> <div style=3D"box-sizing: content-box; padding: 35px 0 0 230px; color: #333= ; font-size: 14px; font-family: sans-serif; vertical-align:top; height: 15p= x"> <div style=3D"display:inline-block; width: 190px">+1 617.596.9558</div> <div style=3D"display:inline-block; width: 150px">[email protected]</div> </div> <div style=3D"box-sizing: content-box; padding: 15px 0 0 230px; color: #333= ; font-size: 14px; font-family: sans-serif; vertical-align:top; height: 15p= x"> <div style=3D"display:inline-block; width: 190px"><a href=3D "https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-link/500/5/sen= d-me?to=3Dhttps://luxsci.com" style=3D"color: #333;text-decoration:none" ta= rget=3D"_blank">www.LuxSci.com</a></div> <div style=3D"display:inline-block; width: 150px"><a href=3D "https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-link/500/5/sen= d-me?to=3Dhttps://www.linkedin.com/in/erikkangas/" style=3D"color: #333;tex= t-decoration:none" target=3D"_blank">Erik on LinkedIn</a></div> </div> <div style=3D"box-sizing: content-box; padding: 25px 0 0 0; height: 35px"> <div style=3D"display:inline-block; cursor:pointer; width:575px; height: 28= px;"> </div> </div> </div> <p style=3D"color: #333; font-size: 14px; font-family: sans-serif;">This em= ail communication is covered under LuxSci's <a href=3D "https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-link/500/5/sen= d-me?to=3Dhttps://luxsci.com/extranet/privacy.html">privacy policy</a>.</p> <!--/SIG--></div> <div><br /> </div> <br /> <div style=3D"padding:3px 0 3px 0;border-top:1px solid #DDD; border-bottom:= 1px solid #DDD;margin:3px 0 3px 0">On February 15, 2019 01:21:54 pm EDT, &= quot;Mabry Tyson" <[email protected]> wrote:</div> <br /> <br /> Erik, I had previously expressed interest in doing this. However, I<b= r /> have just started evaluating other, maintained alternatives (Dovecot, = <br /> Courier IMAP, ...) to move to. We will also move from an older Solari= s<br /> machine to an Ubuntu machine.<br /> <br /> At this point, I'm concerned about having to change our site's mail= <br /> storage format. We use mix format (we use 10MB files). Both Dov= ecot &<br /> Courier seem to prefer maildir (1 file per message) which gives me<br /> concern about the number of files in a directory. (I am probably the<br /> only one, but I have rarely-read mail files of system logs with on the<br /> order of 1M messages). Dovecot has a a mix-like format (multiiple<br = /> messages per file), but indicates that procmail (which we use) doesn't<= br /> support that, but apparently there is a dmail-type program that I can<br /> use with procmail.<br /> <br /> I knew Marc Crispin back in the day (from Tops-10 days). He believed = in<br /> standards, in being precise with specifications, and coding for future<br /> requirements. He did good work. I will be sad to move away from= his<br /> code base, but I can't devote the time to keeping his code running.&nbs= p; (It<br /> is less about changing the code, than about making sure it works for the<br= /> OS & file-system variants other than mine.)<br /> <br /> Good luck!<br /> <br /> <br /> <br /> On 2/15/19 8:03 AM, Erik Kangas, Ph.D. wrote:<br /> > Hi All,<br /> ><br /> > Has anyone progressed with compiling openssl 1.1.1 with panda IMA= P? <br /> > If not, is anyone interested in doing this as a small consulting<br /> > project (which we would make available to the group when done)?<br /> ><br /> > Thanks,<br /> > -Erik Kangas<br /> > LuxSci<br /> ><br /> <br /> _______________________________________________<br /> Imap-uw mailing list<br /> [email protected]<br /> <a class=3D"monobody" href=3D "https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-link/500/5/sen= d-me?to=3Dhttp://mailman13.u.washington.edu/mailman/listinfo/imap-uw" targe= t=3D"_blank">http://mailman13.u.washington.edu/mailman/listinfo/imap-uw</a>= <br /> <img src=3D "https://luxsci-email.com/92tKupfhQ9vC8W0ErYgFr_-BYRKwv2mTcbYP88oHkpf7_-5/email-image/500/5/im= age.png" height=3D"2" width=3D"10" /> </body></html>= ---------------1882296.49212672-- --------------------_Boundary_84744371.9886424 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Imap-uw mailing list [email protected] http://mailman13.u.washington.edu/mailman/listinfo/imap-uw --------------------_Boundary_84744371.9886424--