Subject: imap/ssl v. fetchmail --ssl?

From: [email-masked]
Date: Mon, 12 Aug 2002 21:07:13 -0400

Greetings --

I'm trying to test c-client 2002.RC2 ssl connection with fetchmail --ssl.

Here's what I'm getting, after building everything as described in SSLBUILD,
and the latest fetchmail, and all with the latest OpenSSL:

 # fetchmail --ssl --sslproto tls1 -p imap -u alexy localhost
Enter password for alexy@localhost: 
6063:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:279:
fetchmail: SSL connection failed.

And in the logs we see:

Aug 12 20:58:04 angle imapd[6065]: Connection reset by peer, while flushing line user=??? host=UNKNOWN

Now, when I'm forcing --ssl2, the thing just waits forever. Without --sslproto, 
we get:

 # fetchmail --ssl -p imap -u alexy localhost
Enter password for alexy@localhost: 
6102:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:460:
fetchmail: SSL connection failed.

and same in the logs:

Aug 12 21:02:09 angle imapd[6104]: Connection reset by peer, while flushing line user=??? host=UNKNOWN

I'm running imaps service under xinetd, its logs says:

02/8/12@20:58:04: START: imaps from=::ffff:127.0.0.1
02/8/12@20:58:04: EXIT: imaps status=1 duration=0(sec)
02/8/12@21:02:09: START: imaps from=::ffff:127.0.0.1
02/8/12@21:02:09: EXIT: imaps status=1 duration=0(sec)

Netscape with SSL hangs forever similarly to --sslproto ssl2, and imapd times
it out after 180 seconds.

I've tried these combinations of make:

make slx SSLTYPE=unix
make slx SSLTYPE=nopwd
make lnp SSLTYPE=unix

Is there something I'm missing in trying to run imap/ssl?

Cheers,
Alexy
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Sebastian Hagedorn <[email-masked]>
Date: Tue, 13 Aug 2002 11:07:20 +0200

--On Monday, August 12, 2002 21:07:13 -0400 [email-masked] wrote:

> Here's what I'm getting, after building everything as described in
> SSLBUILD, and the latest fetchmail, and all with the latest OpenSSL:
>
> 6063:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version
> number:s3_pkt.c:279: fetchmail: SSL connection failed.

This reminds me of a problem I once had with Mulberry. fetchmail seems to 
use SSLv23_client_method over TLS. It should use TLSv1_client_method. You 
write

> Now, when I'm forcing --ssl2, the thing just waits forever. Without
> --sslproto,  we get:
>
> 6102:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
> protocol:s23_clnt.c:460: fetchmail: SSL connection failed.

Sounds to me like the *right* way to call it would be:

# fetchmail --ssl --sslproto ssl3 -p imap -u alexy localhost

But that's just a guess, I'm no expert ...
--
Sebastian Hagedorn
Ehrenfeldgürtel 156
50823 Köln
http://www.spinfo.uni-koeln.de/~hgd/

Being just contaminates the void - Robyn Hitchcock