Re: UW IMAP/Panda compiling with openssl 1.1.x...?
"Erik Kangas, Ph.D." <[email protected]> Thu, 11 Jul 2019 18:47:32 +0000
| Newsgroups | gmane.mail.imap.uw.c-client |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. If you cannot view the attachment(s), then your email client does not support MIME. --------------------_Boundary_2968287.24155743 Content-Type: multipart/alternative; boundary="-------------7316548.72685461" ---------------7316548.72685461 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Hi Folks. So I sat down today to make imapd=A0/ cclient compile with the latest=20 openssl 1.1.1.=A0 It turns out the the changes needed were very few.=A0=20 Here is what I changed, in case it helps someone (the older versions of=20 openssl are losing support soon, so we all should be upgrading to the=20 new version channel). 1. There is only 1 critical change.=A0 There are a lot of fatal compile=20 errors around use of "cert->name".=A0 Openssl=A0no longer exposes the=20 contents of the X509 structure.=A0 The solution seems to be to replace=20 this with something like: cert->name replace with X509_NAME_oneline(X509_get_subject_name(cert),NULL,0) which extracts the name from the cert object and returns it as a newly=20 allocated char*.=A0 This could be a very small memory leak; but for most=20 purposes each imapd and ipop3d only exist for the single connection --=20 so its probably not a concern, just a few bytes.=A0 =A0You could fix by=20 adding a few more lines to create a buffer and have=20 X509_NAME_oneline=A0save to your buffer, etc. 2. There are a couple deprecated functions that should be updated: TLSv1_client_method ->=A0 TLS_client_method RSA_generate_key -> RSA_generate_key_ex That is it -- things seem to be compiling and tests (so far) show=20 things are working properly.=A0 There are still compile warnings here and=20 there (as there always have been with imapd) but they seem OK.=A0 I will=20 still be testing for some time before I push out.=A0 Also, linking to=20 openssl=A0v1.1.1 also seems to have cleared up some issues with C-Client=20 using STARTTLS=A0with TLS 1.2-only servers (we already have support for=20 DHE and ECDHE=A0built in). I'll let you know if anything else needs to be done after further=20 testing.=A0 If anyone notices something I have neglected, please let me=20 know. Probably the next thing we'll need to do down the road is enable TLS=20 v1.3 support.... Thanks! -Erik =A0 Erik Kangas, PhD CEO +1 617.596.9558 [email protected] [1]www.LuxSci.com [2]Erik on LinkedIn =A0 =A0 This email communication is covered under LuxSci's [3]privacy policy. =A0 =A0 =A0 On February 17, 2019 07:13:28 pm EDT, "Eduardo Chappa"=20 <[email protected]> wrote: On Mon, 18 Feb 2019, Erik Kangas, Ph.D. wrote: > This is good and we can probably use this for the imapd server; however, > when I compile Panda against openssl=A01.1.1.x, I find that the first set > of errors I receive involve the c-client library (which we need for > linking with PHP, for example).=A0 The c-client section (i.e. the c-client > directory immediately below "imap" vs the one below "src")=A0seems to be > missing from the alpine source -- as its probably not needed for alpine. Dear Erik, =A0=A0 What you would have to do is to build Alpine. As as result, Alpine w= ill build the c-client library first, and then Alpine. You can stop the build as soon as you have built the c-client library. That will give you the c-client directory that you are looking for under imap/. =A0=A0 I already took care of all the errors you posted a long time ago, an= d I am currently working on adding support for letting applications choose the minimum and maximum versions of the SSL/TLS protocol to use. =A0=A0 Take a look at the repo for alpine at [4]http://repo.or.cz/alpine.gi= t, for the current bits. I am about to commit a few changes in regards to SSL configuration. =A0=A0 Thank you. -- Eduardo =A0 References Visible links 1.=20 https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-link/500/699/se= nd-me?to=3Dhttps://luxsci.com 2.=20 https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-link/500/699/se= nd-me?to=3Dhttps://www.linkedin.com/in/erikkangas/ 3.=20 https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-link/500/699/se= nd-me?to=3Dhttps://luxsci.com/extranet/privacy.html 4.=20 https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-link/500/699/se= nd-me?to=3Dhttp://repo.or.cz/alpine.git ---------------7316548.72685461 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML> <HTML> <HEAD><meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF= -8"></HEAD> <BODY style=3D"padding:5px; line-height: 1.3em; font-size: 14px; color: #33= 3; background-color: #FFF; font-family: Arial, Helvetica, sans-serif"> <div>Hi Folks.<br /> <br /> So I sat down today to make imapd / cclient compile with the latest op= enssl 1.1.1. It turns out the the changes needed were <em>very few</e= m>. Here is what I changed, in case it helps someone (the older versi= ons of openssl are losing support soon, so we all should be upgrading to th= e new version channel).<br /> <br /> 1. There is only 1 critical change. There are a lot of fatal compile = errors around use of "cert->name". Openssl no longe= r exposes the contents of the X509 structure. The solution seems to b= e to replace this with something like:<br /> <br /> cert->name<br /> <br /> replace with <pre> <code>X509_NAME_oneline(</code>X509<span style=3D"font-family: Arial, Helve= tica, sans-serif;">_get_subject_name(cert),NULL,0)</span></pre> <br /> which extracts the name from the cert object and returns it as a newly allo= cated char*. This could be a very small memory leak; but for most pur= poses each imapd and ipop3d only exist for the single connection -- so its = probably not a concern, just a few bytes. You could fix by addi= ng a few more lines to create a buffer and have X509_NAME_oneline save= to your buffer, etc.<br /> <br /> 2. There are a couple deprecated functions that should be updated:<br /> <br /> TLSv1_client_method<br /> -> TLS_client_method<br /> <br /> RSA_generate_key<br /> -> RSA_generate_key_ex<br /> <br /> That is it -- things seem to be compiling and tests (so far) show things ar= e working properly. There are still compile warnings here and there (= as there always have been with imapd) but they seem OK. I will still = be testing for some time before I push out. Also, linking to openssl&= nbsp;v1.1.1 also seems to have cleared up some issues with C-Client using S= TARTTLS with TLS 1.2-only servers (we already have support for DHE and= ECDHE built in).<br /> <br /> I'll let you know if anything else needs to be done after further testi= ng. If anyone notices something I have neglected, please let me know.= <br /> <br /> Probably the next thing we'll need to do down the road is enable TLS v1= .3 support....<br /> <br /> Thanks!<br /> -Erik<br /> </div> <div id=3D"signature"><!--SIG--> <div style=3D"background-image: url('https://djrufvackyewl.cloudfront.net/s= 3/2018/LuxSci_Sig2018.png'); width: 575px; height: 209px"> <div style=3D"box-sizing: content-box; padding: 20px 0 0 200px; color: #221= f43; font-size: 18px; font-family: sans-serif; vertical-align:top; font-wei= ght: bold; height: 25px">Erik Kangas, PhD</div> <div style=3D"box-sizing: content-box; padding: 0 0 0 200px; color: #99cdde= ; font-size: 18px; font-family: sans-serif; vertical-align:top; height: 25p= x">CEO</div> <div style=3D"box-sizing: content-box; padding: 35px 0 0 230px; color: #333= ; font-size: 14px; font-family: sans-serif; vertical-align:top; height: 15p= x"> <div style=3D"display:inline-block; width: 190px">+1 617.596.9558</div> <div style=3D"display:inline-block; width: 150px">[email protected]</div> </div> <div style=3D"box-sizing: content-box; padding: 15px 0 0 230px; color: #333= ; font-size: 14px; font-family: sans-serif; vertical-align:top; height: 15p= x"> <div style=3D"display:inline-block; width: 190px"><a href=3D "https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-link/500/699/s= end-me?to=3Dhttps://luxsci.com" style=3D"color: #333;text-decoration:none" = target=3D"_blank">www.LuxSci.com</a></div> <div style=3D"display:inline-block; width: 150px"><a href=3D "https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-link/500/699/s= end-me?to=3Dhttps://www.linkedin.com/in/erikkangas/" style=3D"color: #333;t= ext-decoration:none" target=3D"_blank">Erik on LinkedIn</a></div> </div> <div style=3D"box-sizing: content-box; padding: 25px 0 0 0; height: 35px"> <div style=3D"display:inline-block; cursor:pointer; width:575px; height: 28= px;"> </div> </div> </div> <p style=3D"color: #333; font-size: 14px; font-family: sans-serif;">This em= ail communication is covered under LuxSci's <a href=3D "https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-link/500/699/s= end-me?to=3Dhttps://luxsci.com/extranet/privacy.html">privacy policy</a>.</= p> <!--/SIG--></div> <div><br /> </div> <br /> <div style=3D"padding:3px 0 3px 0;border-top:1px solid #DDD; border-bottom:= 1px solid #DDD;margin:3px 0 3px 0">On February 17, 2019 07:13:28 pm EDT, &= quot;Eduardo Chappa" <[email protected]> wrote:</div> <br /> <br /> On Mon, 18 Feb 2019, Erik Kangas, Ph.D. wrote:<br /> <br /> > This is good and we can probably use this for the imapd server; howeve= r,<br /> > when I compile Panda against openssl 1.1.1.x, I find that the fir= st set<br /> > of errors I receive involve the c-client library (which we need for<br= /> > linking with PHP, for example). The c-client section (i.e. the c= -client<br /> > directory immediately below "imap" vs the one below "sr= c") seems to be<br /> > missing from the alpine source -- as its probably not needed for alpin= e.<br /> <br /> Dear Erik,<br /> <br /> What you would have to do is to build Alpine. As as result, Al= pine will<br /> build the c-client library first, and then Alpine. You can stop the build<b= r /> as soon as you have built the c-client library. That will give you the<br /> c-client directory that you are looking for under imap/.<br /> <br /> I already took care of all the errors you posted a long time a= go, and I<br /> am currently working on adding support for letting applications choose the<= br /> minimum and maximum versions of the SSL/TLS protocol to use.<br /> <br /> Take a look at the repo for alpine at <a class=3D"monobody" hr= ef=3D "https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-link/500/699/s= end-me?to=3Dhttp://repo.or.cz/alpine.git" target=3D"_blank">http://repo.or.= cz/alpine.git</a>, for<br /> the current bits. I am about to commit a few changes in regards to SSL<br /> configuration.<br /> <br /> Thank you.<br /> <br /> --<br /> Eduardo<br /> <img src=3D "https://luxsci-email.com/X_cxUJK1rGjOtl9jzm5Aq_-Q7KyUO1eIsy_LXWG3usgS_-699/email-image/500/699/= image.png" height=3D"2" width=3D"10" /> </body></html>= ---------------7316548.72685461-- --------------------_Boundary_2968287.24155743 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Imap-uw mailing list [email protected] http://mailman13.u.washington.edu/mailman/listinfo/imap-uw --------------------_Boundary_2968287.24155743--