Commit c72743cf authored by Matthias Andree's avatar Matthias Andree

TLS overhaul, bumping version to 6.4

Removes SSLv2, enables TLSv1.1 and v1.2 more easily,
permits SSLv3 (only if specified) and newer TLSv1.1+ for STLS/STARTTLS.
Only negotiates TLSv1 and newer by default, SSLv3 must now be specified
explicitly, as a consequence of the POODLE attack.

This is meant to be a minimally upgraded version, and cannot be usefully
done as a 6.3.X release.

It is strongly recommended that users review their configuration -
especially --sslproto - per instructions in the NEWS file and manual
page.  It has changed semantics and in many cases --sslproto auto or
perhaps --sslproto tls1.2+ should be used now.
parent 07d7fc7b
......@@ -31,7 +31,7 @@ libfm_a_SOURCES= xmalloc.c base64.c rfc822.c report.c rfc2047e.c \
servport.c ntlm.h smbbyteorder.h smbdes.h smbmd4.h \
smbencrypt.h smbdes.c smbencrypt.c smbmd4.c smbutil.c \
libesmtp/gethostbyname.h libesmtp/gethostbyname.c \
smbtypes.h fm_getaddrinfo.c tls.c rfc822valid.c \
smbtypes.h fm_getaddrinfo.c starttls.c rfc822valid.c \
xmalloc.h sdump.h sdump.c x509_name_match.c \
fm_strl.h md5c.c
if NTLM_ENABLE
......
......@@ -51,18 +51,41 @@ removed from a 6.4.0 or newer release.)
* The --bsmtp - mode of operation may be removed in a future release.
* Given that OpenSSL is severely underdocumented, and needs license exceptions,
fetchmail may switch to a different SSL library.
* SSLv2 support will be removed from a future fetchmail release. It has been
obsolete for more than a decade.
* SSLv3 support may be removed from a future fetchmail release. It has been
obsolete for many years and found insecure. Use TLS.
--------------------------------------------------------------------------------
fetchmail-6.3.27 (not yet released, if ever):
fetchmail-6.4.0 (not yet released):
# NOTE THAT FETCHMAIL IS NO LONGER PUBLISHED THROUGH IBIBLIO.
* They have stopped accepting submissions and consider themselves an archive.
## SECURITY FIXES THAT AFFECT BEHAVIOUR AND MAY WANT RECONFIGURATION
* Fetchmail no longer supports SSLv2.
* Fetchmail no longer attempts to negotiate SSLv3 by default,
even with --sslproto ssl23. Fetchmail can now use SSLv3, or TLSv1.1 or a newer
TLS version, with STLS/STARTTLS (it would previously force TLSv1.0). If the
OpenSSL version used at build and run-time supports these versions, --sslproto
ssl3 can be used to enable this specific version. Doing so is discouraged
because these protocols are broken.
Along the lines suggested - as patch - by Kurt Roeckx, Debian Bug #768843.
While this change is supposed to be compatible with common configurations,
users are advised to change all explicit --sslproto ssl2, --sslproto
ssl3, --sslproto tls1 to --sslproto auto, so that they can enable TLSv1.1 and
TLSv1.2 on systems with OpenSSL 1.0.1 or newer.
The --sslproto option now understands the values auto, tls1+, tls1.1+,
tls1.2+ (case insensitively).
## CHANGES
* Fetchmail now supports --sslproto auto and --sslproto tls1+ (same as ssl23).
* --sslproto tls1.1+ and tls1.2+ are now supported for auto-negotiation with a
minimum specified TLS protocol version.
* fetchmail 6.3.X is unsupported.
## FIXES
* Fix a typo in the FAQ. Submitted by David Lawyer, Debian Bug#706776.
* Do not translate header tags such as "Subject:". Reported by Gonzalo Pérez de
......@@ -74,12 +97,9 @@ fetchmail-6.3.27 (not yet released, if ever):
mailboxes do not mix. In response to Jeremy Chadwick's trouble 2014-11-19,
fetchmail-users mailing list.
* Fix SSL-enabled build on systems that do not declare SSLv3_client_method(),
or that #define OPENSSL_NO_SSL3 inside #include <openssl/ssl.h>, the canonical
way that OpenSSL communicates this. Related to Debian Bug#775255.
* Version report lists -SSLv3 on +SSL builds that omit SSLv3_client_method().
* Version report lists -SSLv2 on +SSL builds that omit SSLv2_client_method().
* Also recognize SSLv2 as unsupported if #include <openssl/ssl.h>
defines the OPENSSL_NO_SSL2 macro.
or that #define OPENSSL_NO_SSL3 inside #include <openssl/ssl.h>
Related to Debian Bug#775255.
* Version report lists -SSLv3 on SSL-enabled no-ssl3 builds.
# KNOWN BUGS AND WORKAROUNDS
(This section floats upwards through the NEWS file so it stays with the
......
......@@ -11,36 +11,45 @@ specific to fetchmail.
In case of troubles, mail the README.SSL-SERVER file to your ISP and
have them check their server configuration against it.
Unfortunately, fetchmail confuses SSL/TLS protocol levels with whether
a service needs to use in-band negotiation (STLS/STARTTLS for POP3/IMAP4) or is
totally SSL-wrapped on a separate port. For compatibility reasons, this cannot
be fixed in a bugfix release.
Unfortunately, fetchmail confuses SSL/TLS protocol levels with whether a
service needs to use in-band negotiation (STLS/STARTTLS for POP3/IMAP4)
or is totally SSL-wrapped on a separate port. For compatibility
reasons, this cannot be fixed in a bugfix or minor release.
-- Matthias Andree, 2009-05-09
Also, fetchmail 6.4.0 and newer releases changed some of the semantics
as the result of a bug-fix, and will auto-negotiate TLSv1 or newer only.
If your server does not support this, you may have to specify --sslproto
ssl3. This is in order to prefer the newer TLS protocols, because SSLv2
and v3 are broken.
-- Matthias Andree, 2015-01-16
Quickstart
----------
Use an up-to-date release of OpenSSL 1.0.1 or newer, so as to get
TLSv1.2 support.
For use of SSL or TLS with in-band negotiation on the regular service's port,
i. e. with STLS or STARTTLS, use these command line options
--sslproto tls1 --sslcertck
--sslproto auto --sslcertck
or these options in the rcfile (after the respective "user"... options)
sslproto tls1 sslcertck
sslproto auto sslcertck
For use of SSL or TLS on a separate port, if the whole TCP connection is
SSL-encrypted from the very beginning, use these command line options (in the
rcfile, omit all leading "--"):
SSL-encrypted from the very beginning (SSL- or TLS-wrapped), use these
command line options (in the rcfile, omit all leading "--"):
--ssl --sslproto ssl3 --sslcertck
--ssl --sslproto auto --sslcertck
or these options in the rcfile (after the respective "user"... options)
ssl sslproto ssl3 sslcertck
ssl sslproto auto sslcertck
Background and use (long version :-))
......
......@@ -9,7 +9,7 @@ dnl Process this file with autoconf to produce a configure script.
dnl
dnl XXX - if bumping version here, check fetchmail.man, too!
AC_INIT([fetchmail],[6.3.27],[fetchmail-users@lists.sourceforge.net])
AC_INIT([fetchmail],[6.4.0.beta1],[fetchmail-users@lists.sourceforge.net])
AC_CONFIG_SRCDIR([fetchmail.h])
AC_CONFIG_HEADERS([config.h])
AC_CONFIG_LIBOBJ_DIR([.])
......
......@@ -667,8 +667,8 @@ because there is not currently a standard way to do this; fetchmail
also uses this method, so the two will interoperate happily. They
better, because this is how Craig gets his mail ;-)</p>
<p>Finally, you can use <a href="#K5">SSL</a> for complete
end-to-end encryption if you have an SSL-enabled mailserver.</p>
<p>Finally, you can use <a href="#K5">SSL or TLS</a> for complete
end-to-end encryption if you have a TLS-enabled mailserver.</p>
<h2><a id="G11" name="G11">G11. Is any special configuration needed
to use a dynamic IP address?</a></h2>
......@@ -2120,7 +2120,7 @@ SSL?</a></h2>
<p>You'll need to have the <a
href="http://www.openssl.org/">OpenSSL</a> libraries installed, and they
should at least be version 0.9.7.
should at least be version 0.9.8, with 1.0.1 preferred.
Configure with --with-ssl. If you have the OpenSSL libraries
installed in commonly-used default locations, this will
suffice. If you have them installed in a non-default location,
......@@ -2130,7 +2130,7 @@ to --with-ssl after an equal sign.</p>
<p>Fetchmail binaries built this way support <code>ssl</code>,
<code>sslkey</code>, and <code>sslcert</code> options that control
SSL encryption, and will automatically use <code>tls</code> if the
server offers it. You will need to have an SSL-enabled mailserver to
server offers it. You will need to have an SSL/TLS-enabled mailserver to
use these options. See the manual page for details and some words
of care on the limited security provided.</p>
......@@ -2155,13 +2155,14 @@ poll MYSERVER port 993 plugin "openssl s_client -connect %h:%p"
protocol imap username MYUSERNAME password MYPASSWORD
</pre>
<p>You should note that SSL is only secure against a "man-in-the-middle"
attack if the client is able to verify that the peer's public key is the
correct one, and has not been substituted by an attacker. fetchmail can do
this in one of two ways: by verifying the SSL certificate, or by checking
the fingerprint of the peer's public key.</p>
<p>You should note that SSL or TLS are only secure against a
"man-in-the-middle" attack if the client is able to verify that the
peer's public key is the correct one, and has not been substituted by an
attacker. fetchmail can do this in one of two ways: by verifying the SSL
certificate, or by checking the fingerprint of the peer's public
key.</p>
<p>There are three parts to SSL certificate verification: checking that the
<p>There are three parts to TLS certificate verification: checking that the
domain name in the certificate matches the hostname you asked to connect to;
checking that the certificate expiry date has not passed; and checking that
the certificate has been signed by a known Certificate Authority (CA). This
......@@ -2227,8 +2228,12 @@ will automatically attempt TLS negotiation if SSL was enabled at compile
time. This can however cause problems if the upstream didn't configure
his certificates properly.</p>
<p>In order to prevent fetchmail from trying TLS (STLS, STARTTLS)
negotiation, add this option:</p>
<p>In order to prevent fetchmail 6.4.0 and newer versions from trying
STLS or STARTTLS negotiation, add this option:</p>
<pre>sslproto ''</pre>
<p>In order to prevent older fetchmail versions from trying TLS (STLS, STARTTLS)
negotiation where the above does not work, try this option:</p>
<pre>sslproto ssl23</pre>
......
......@@ -774,9 +774,9 @@ int servport(const char *service);
int fm_getaddrinfo(const char *node, const char *serv, const struct addrinfo *hints, struct addrinfo **res);
void fm_freeaddrinfo(struct addrinfo *ai);
/* prototypes from tls.c */
int maybe_tls(struct query *ctl);
int must_tls(struct query *ctl);
/* prototypes from starttls.c */
int maybe_starttls(struct query *ctl);
int must_starttls(struct query *ctl);
/* prototype from rfc822valid.c */
int rfc822_valid_msgid(const unsigned char *);
......
......@@ -10,7 +10,7 @@
.\" Load www macros to process .URL requests, this requires groff:
.mso www.tmac
.\"
.TH fetchmail 1 "fetchmail 6.3.27" "fetchmail" "fetchmail reference manual"
.TH fetchmail 1 "fetchmail 6.4.0" "fetchmail" "fetchmail reference manual"
.SH NAME
fetchmail \- fetch mail from a POP, IMAP, ETRN, or ODMR-capable server
......@@ -413,23 +413,22 @@ from. The folder information is written only since version 6.3.4.
.B \-\-ssl
(Keyword: ssl)
.br
Causes the connection to the mail server to be encrypted
via SSL. Connect to the server using the specified base protocol over a
connection secured by SSL. This option defeats opportunistic starttls
negotiation. It is highly recommended to use \-\-sslproto 'SSL3'
\-\-sslcertck to validate the certificates presented by the server and
defeat the obsolete SSLv2 negotiation. More information is available in
the \fIREADME.SSL\fP file that ships with fetchmail.
Causes the connection to the mail server to be encrypted via SSL, by
negotiating SSL directly after connecting (SSL-wrapped mode). It is
highly recommended to use \-\-sslcertck to validate the certificates
presented by the server. Please see the description of \-\-sslproto
below! More information is available in the \fIREADME.SSL\fP file that
ships with fetchmail.
.IP
Note that fetchmail may still try to negotiate SSL through starttls even
if this option is omitted. You can use the \-\-sslproto option to defeat
this behavior or tell fetchmail to negotiate a particular SSL protocol.
Note that even if this option is omitted, fetchmail may still negotiate
SSL in-band for POP3 or IMAP, through the STLS or STARTTLS feature. You
can use the \-\-sslproto option to modify that behavior.
.IP
If no port is specified, the connection is attempted to the well known
port of the SSL version of the base protocol. This is generally a
different port than the port used by the base protocol. For IMAP, this
is port 143 for the clear protocol and port 993 for the SSL secured
protocol, for POP3, it is port 110 for the clear text and port 995 for
protocol; for POP3, it is port 110 for the clear text and port 995 for
the encrypted variant.
.IP
If your system lacks the corresponding entries from /etc/services, see
......@@ -471,39 +470,61 @@ cause some complications in daemon mode.
.IP
Also see \-\-sslcert above.
.TP
.B \-\-sslproto <name>
(Keyword: sslproto)
.B \-\-sslproto <value>
(Keyword: sslproto, NOTE: semantic changes since v6.4.0)
.br
Forces an SSL/TLS protocol. Possible values are \fB''\fP,
\&'\fBSSL2\fP' (not supported on all systems),
\&'\fBSSL23\fP', (use of these two values is discouraged
and should only be used as a last resort) \&'\fBSSL3\fP', and
\&'\fBTLS1\fP'. The default behaviour if this option is unset is: for
connections without \-\-ssl, use \&'\fBTLS1\fP' so that fetchmail will
opportunistically try STARTTLS negotiation with TLS1. You can configure
this option explicitly if the default handshake (TLS1 if \-\-ssl is not
used) does not work for your server.
.IP
Use this option with '\fBTLS1\fP' value to enforce a STARTTLS
connection. In this mode, it is highly recommended to also use
\-\-sslcertck (see below). Note that this will then cause fetchmail
v6.3.19 to force STARTTLS negotiation even if it is not advertised by
the server.
This option has a dual use, out of historic fetchmail behaviour. It
controls both the SSL/TLS protocol version and, if \-\-ssl is not
specified, the STARTTLS behaviour (upgrading the protocol to an SSL or
TLS connection in-band). Some other options may however make TLS
mandatory.
.PP
Only if this option and \-\-ssl are both missing for a poll, there will
be opportunistic TLS for POP3 and IMAP, where fetchmail will attempt to
upgrade to TLSv1 or newer.
.PP
Recognized values for \-\-sslproto are:
.RS
.IP "\fB''\fP, the empty string"
Disable STARTTLS. If \-\-ssl is given for the same server, log an error
and pretend that '\fBauto\fP' had been used instead.
.IP '\fBauto\fP'
Since v6.4.0 Require TLS. Auto-negotiate TLSv1 or newer, disable SSLv3 downgrade.
(fetchmail 6.3.26 and older have auto-negotiated all protocols that
their OpenSSL library supported, including the broken SSLv3).
.IP "\&'\fBSSL23\fP'
see '\fBauto\fP'.
.IP \&'\fBSSL3\fP'
Require SSLv3. SSLv3 is broken, not supported on all systems, avoid it
if possible. This will make fetchmail negotiate SSLv3 only, and is the
only way to have fetchmail 6.4.0 or newer permit SSLv3.
.IP \&'\fBTLS1\fP'
Require TLSv1. This does not negotiate TLSv1.1 or newer, and is
discouraged. Replace by TLS1+.
.IP \&'\fBTLS1+\fP'
Since v6.4.0. See 'fBauto\fP'.
.IP \&'\fBTLS1.1+\fP'
Since v6.4.0. Require TLS. Auto-negotiate TLSv1.1 or newer.
.IP '\fBTLS1.2+\fP'
Since v6.4.0. Require TLS. Auto-negotiate TLSv1.2 or newer.
.IP "Unrecognized parameters"
are treated the same as '\fBauto\fP'.
.RE
.IP
To defeat opportunistic TLSv1 negotiation when the server advertises
STARTTLS or STLS, and use a cleartext connection use \fB''\fP. This
option, even if the argument is the empty string, will also suppress the
diagnostic 'SERVER: opportunistic upgrade to TLS.' message in verbose
mode. The default is to try appropriate protocols depending on context.
NOTE: you should hardly ever need to use anything other than '' (to
force an unencrypted connection) or 'auto' (to force it).
.TP
.B \-\-sslcertck
(Keyword: sslcertck)
.br
Causes fetchmail to strictly check the server certificate against a set of
local trusted certificates (see the \fBsslcertfile\fP and \fBsslcertpath\fP
options). If the server certificate cannot be obtained or is not signed by one
of the trusted ones (directly or indirectly), the SSL connection will fail,
regardless of the \fBsslfingerprint\fP option.
Causes fetchmail to require that SSL/TLS be used and disconnect if it
can not successfully negotiate SSL or TLS, or if it cannot successfully
verify and validate the certificate and follow it to a trust anchor (or
trusted root certificate). The trust anchors are given as a set of local
trusted certificates (see the \fBsslcertfile\fP and \fBsslcertpath\fP
options). If the server certificate cannot be obtained or is not signed
by one of the trusted ones (directly or indirectly), fetchmail will
disconnect, regardless of the \fBsslfingerprint\fP option.
.IP
Note that CRL (certificate revocation lists) are only supported in
OpenSSL 0.9.7 and newer! Your system clock should also be reasonably
......@@ -1203,31 +1224,33 @@ capability response. Specify a user option value that looks like
username and the part to the right as the NTLM domain.
.SS Secure Socket Layers (SSL) and Transport Layer Security (TLS)
.PP All retrieval protocols can use SSL or TLS wrapping for the
transport. Additionally, POP3 and IMAP retrival can also negotiate
SSL/TLS by means of STARTTLS (or STLS).
.PP
Note that fetchmail currently uses the OpenSSL library, which is
severely underdocumented, so failures may occur just because the
programmers are not aware of OpenSSL's requirement of the day.
For instance, since v6.3.16, fetchmail calls
OpenSSL_add_all_algorithms(), which is necessary to support certificates
using SHA256 on OpenSSL 0.9.8 -- this information is deeply hidden in the
documentation and not at all obvious. Please do not hesitate to report
subtle SSL failures.
.PP
You can access SSL encrypted services by specifying the \-\-ssl option.
You can also do this using the "ssl" user option in the .fetchmailrc
file. With SSL encryption enabled, queries are initiated over a
connection after negotiating an SSL session, and the connection fails if
SSL cannot be negotiated. Some services, such as POP3 and IMAP, have
using SHA256 on OpenSSL 0.9.8 -- this information is deeply hidden in
the documentation and not at all obvious. Please do not hesitate to
report subtle SSL failures.
.PP
You can access SSL encrypted services by specifying the options starting
with \-\-ssl, such as \-\-ssl, \-\-sslproto, \-\-sslcertck, and others.
You can also do this using the corresponding user options in the .fetchmailrc
file. Some services, such as POP3 and IMAP, have
different well known ports defined for the SSL encrypted services. The
encrypted ports will be selected automatically when SSL is enabled and
no explicit port is specified. The \-\-sslproto 'SSL3' option should be
used to select the SSLv3 protocol (default if unset: v2 or v3). Also,
the \-\-sslcertck command line or sslcertck run control file option
should be used to force strict certificate checking - see below.
no explicit port is specified. Also, the \-\-sslcertck command line or
sslcertck run control file option should be used to force strict
certificate checking - see below.
.PP
If SSL is not configured, fetchmail will usually opportunistically try to use
STARTTLS. STARTTLS can be enforced by using \-\-sslproto "TLS1". TLS
connections use the same port as the unencrypted version of the
STARTTLS. STARTTLS can be enforced by using \-\-sslproto\~auto and
defeated by using \-\-sslproto\~''.
TLS connections use the same port as the unencrypted version of the
protocol and negotiate TLS via special command. The \-\-sslcertck
command line or sslcertck run control file option should be used to
force strict certificate checking - see below.
......
......@@ -405,6 +405,8 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting)
/* apply for connection authorization */
{
int ok = 0;
char *commonname;
(void)greeting;
/*
......@@ -429,25 +431,21 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting)
return(PS_SUCCESS);
}
#ifdef SSL_ENABLE
if (maybe_tls(ctl)) {
char *commonname;
commonname = ctl->server.pollname;
if (ctl->server.via)
commonname = ctl->server.via;
if (ctl->sslcommonname)
commonname = ctl->sslcommonname;
commonname = ctl->server.pollname;
if (ctl->server.via)
commonname = ctl->server.via;
if (ctl->sslcommonname)
commonname = ctl->sslcommonname;
if (strstr(capabilities, "STARTTLS")
|| must_tls(ctl)) /* if TLS is mandatory, ignore capabilities */
#ifdef SSL_ENABLE
if (maybe_starttls(ctl)) {
if ((strstr(capabilities, "STARTTLS") && maybe_starttls(ctl))
|| must_starttls(ctl)) /* if TLS is mandatory, ignore capabilities */
{
/* Use "tls1" rather than ctl->sslproto because tls1 is the only
* protocol that will work with STARTTLS. Don't need to worry
* whether TLS is mandatory or opportunistic unless SSLOpen() fails
* (see below). */
/* Don't need to worry whether TLS is mandatory or
* opportunistic unless SSLOpen() fails (see below). */
if (gen_transact(sock, "STARTTLS") == PS_SUCCESS
&& (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, "tls1", ctl->sslcertck,
&& (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, ctl->sslproto, ctl->sslcertck,
ctl->sslcertfile, ctl->sslcertpath, ctl->sslfingerprint, commonname,
ctl->server.pollname, &ctl->remotename)) != -1)
{
......@@ -470,7 +468,7 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting)
{
report(stdout, GT_("%s: upgrade to TLS succeeded.\n"), commonname);
}
} else if (must_tls(ctl)) {
} else if (must_starttls(ctl)) {
/* Config required TLS but we couldn't guarantee it, so we must
* stop. */
set_timeout(0);
......@@ -492,6 +490,10 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting)
/* Usable. Proceed with authenticating insecurely. */
}
}
} else {
if (strstr(capabilities, "STARTTLS") && outlevel >= O_VERBOSE) {
report(stdout, GT_("%s: WARNING: server offered STARTTLS but sslproto '' given.\n"), commonname);
}
}
#endif /* SSL_ENABLE */
......
......@@ -8,8 +8,8 @@ msgid ""
msgstr ""
"Project-Id-Version: fetchmail 6.3.26\n"
"Report-Msgid-Bugs-To: fetchmail-devel@lists.sourceforge.net\n"
"POT-Creation-Date: 2015-01-16 21:15+0100\n"
"PO-Revision-Date: 2014-11-22 00:29+0100\n"
"POT-Creation-Date: 2015-01-17 01:08+0100\n"
"PO-Revision-Date: 2015-01-17 00:41+0100\n"
"Last-Translator: Matthias Andree <matthias.andree@gmx.de>\n"
"Language-Team: Deutsch <de@li.org>\n"
"Language: de\n"
......@@ -1826,97 +1826,103 @@ msgstr "Protokoll identifiziert als IMAP2 oder IMAP2BIS\n"
msgid "will idle after poll\n"
msgstr "werde nach Abfrage untätig sein\n"
#: imap.c:471 pop3.c:476
#: imap.c:469 pop3.c:472
#, c-format
msgid "%s: upgrade to TLS succeeded.\n"
msgstr "%s: Upgrade auf TLS erfolgreich.\n"
#: imap.c:477 pop3.c:482
#: imap.c:475 pop3.c:478
#, c-format
msgid "%s: upgrade to TLS failed.\n"
msgstr "%s: Upgrade auf TLS fehlgeschlagen.\n"
#: imap.c:482
#: imap.c:480
#, c-format
msgid "%s: opportunistic upgrade to TLS failed, trying to continue\n"
msgstr ""
"%s: opportunistisches Upgrade auf TLS fehlgeschlagen, versuche Fortsetzung.\n"
#: imap.c:598
#: imap.c:495
#, c-format
msgid "%s: WARNING: server offered STARTTLS but sslproto '' given.\n"
msgstr ""
"%s: WARNUNG: Server hat STARTTLS angeboten, aber sslproto '' ist angegeben.\n"
#: imap.c:600
msgid "Required OTP capability not compiled into fetchmail\n"
msgstr "Benötigte OTP-Fähigkeit nicht in fetchmail einkompiliert\n"
#: imap.c:618 pop3.c:558
#: imap.c:620 pop3.c:558
msgid "Required NTLM capability not compiled into fetchmail\n"
msgstr "Benötigte NTLM-Fähigkeit nicht in fetchmail einkompiliert\n"
#: imap.c:627
#: imap.c:629
msgid "Required LOGIN capability not supported by server\n"
msgstr "Benötigte LOGIN-Fähigkeit nicht vom Server unterstützt\n"
#: imap.c:691
#: imap.c:693
#, c-format
msgid "mail expunge mismatch (%d actual != %d expected)\n"
msgstr "unerwartete Expunge-Bestätigung (%d tatsächlich != %d erwartet)\n"
#: imap.c:818
#: imap.c:820
#, c-format
msgid "%lu is unseen\n"
msgstr "%lu ist ungesehen\n"
#: imap.c:868 pop3.c:844 pop3.c:856 pop3.c:1095 pop3.c:1102
#: imap.c:870 pop3.c:844 pop3.c:856 pop3.c:1095 pop3.c:1102
#, c-format
msgid "%u is unseen\n"
msgstr "%u ist ungesehen\n"
#: imap.c:903 imap.c:962
#: imap.c:905 imap.c:964
msgid "re-poll failed\n"
msgstr "erneute Abfrage fehlgeschlagen\n"
#: imap.c:911 imap.c:967
#: imap.c:913 imap.c:969
#, c-format
msgid "%d message waiting after re-poll\n"
msgid_plural "%d messages waiting after re-poll\n"
msgstr[0] "%d Nachricht wartet nach erneuter Abfrage\n"
msgstr[1] "%d Nachrichten warten nach erneuter Abfrage\n"
#: imap.c:928
#: imap.c:930
msgid "mailbox selection failed\n"
msgstr "Postfach-Auswahl fehlgeschlagen\n"
#: imap.c:932
#: imap.c:934
#, c-format
msgid "%d message waiting after first poll\n"
msgid_plural "%d messages waiting after first poll\n"
msgstr[0] "%d Nachricht wartet nach der ersten Abfrage\n"
msgstr[1] "%d Nachrichten warten nach der ersten Abfrage\n"
#: imap.c:946
#: imap.c:948
msgid "expunge failed\n"
msgstr "Säubern fehlgeschlagen\n"
#: imap.c:950
#: imap.c:952
#, c-format
msgid "%d message waiting after expunge\n"
msgid_plural "%d messages waiting after expunge\n"
msgstr[0] "%d Nachricht wartet nach dem Löschen\n"
msgstr[1] "%d Nachrichten warten nach dem Löschen\n"
#: imap.c:989
#: imap.c:991
msgid "search for unseen messages failed\n"
msgstr "Suche nach ungesehenen Nachrichten fehlgeschlagen\n"
#: imap.c:994 pop3.c:865
#: imap.c:996 pop3.c:865
#, c-format
msgid "%u is first unseen\n"
msgstr "%u ist erste ungesehene\n"
#: imap.c:1078
#: imap.c:1080
msgid ""
"Warning: ignoring bogus data for message sizes returned by the server.\n"
msgstr "Warnung: ignoriere falsche Größendaten vom Server.\n"
#: imap.c:1177 imap.c:1184
#: imap.c:1179 imap.c:1186
#, c-format
msgid "Incorrect FETCH response: %s.\n"
msgstr "Unpassende Antwort auf FETCH: %s.\n"
......@@ -2456,27 +2462,33 @@ msgstr " -r, --folder Namen des entfernten Ordners angeben\n"
msgid " --showdots show progress dots even in logfiles\n"
msgstr " --showdots Fortschrittspunkte auch in Log-Dateien zeigen\n"
#: pop3.c:327
#: pop3.c:328
msgid ""
"Warning: \"Maillennium POP3\" found, using RETR command instead of TOP.\n"
msgstr "Warnung: „Maillennium POP3” gefunden, benutze RETR-Befehl statt TOP.\n"
#: pop3.c:411
#: pop3.c:412
msgid "TLS is mandatory for this session, but server refused CAPA command.\n"
msgstr ""
"TLS ist für diese Sitzung nötig, aber der Server hat den CAPA-Befehl "
"abgelehnt.\n"
#: pop3.c:412
#: pop3.c:413
msgid "The CAPA command is however necessary for TLS.\n"
msgstr "Der CAPA-Befehl ist allerdings für TLS erforderlich.\n"
#: pop3.c:494
#: pop3.c:490
#, c-format
msgid "%s: opportunistic upgrade to TLS failed, trying to continue.\n"
msgstr ""
"%s: opportunistisches Upgrade auf TLS fehlgeschlagen, versuche Fortsetzung.\n"
#: pop3.c:496
#, c-format
msgid "%s: WARNING: server offered STLS, but sslproto '' given.\n"
msgstr ""
"%s: WARNUNG: Server hat STLS angeboten, aber sslproto '' ist angegeben.\n"
#: pop3.c:621
msgid "We've run out of allowed authenticators and cannot continue.\n"
msgstr ""
......@@ -3195,29 +3207,37 @@ msgstr ""
"Verzeichnis ausgeführt werden muss. Details sind in der fetchmail-"
"Handbuchseite im bei --sslcertpath beschrieben.\n"
#: socket.c:902
#: socket.c:903
msgid "File descriptor out of range for SSL"
msgstr "Datei-Deskriptor außerhalb des Bereichs für SSL"
#: socket.c:913
msgid "Your OpenSSL version does not support SSLv2.\n"
msgstr "Ihre OpenSSL-Version unterstützt SSLv2 nicht.\n"
#: socket.c:920
#: socket.c:915
msgid "Your OpenSSL version does not support SSLv3.\n"
msgstr "Ihre OpenSSL-Version unterstützt SSLv3 nicht.\n"
#: socket.c:928
#: socket.c:934
#, c-format
msgid "Invalid SSL protocol '%s' specified, using default (SSLv23).\n"
msgid ""
"Invalid SSL protocol '%s' specified, using default autoselect (SSL23).\n"
msgstr ""
"Ungültiges SSL-Protokoll „%s“ angegeben, benutze Voreinstellung automatische "
"Wahl (SSL23).\n"
#: socket.c:1041
msgid "Cannot obtain current SSL/TLS cipher - no session established?\n"
msgstr ""
"Ungültiges SSL-Protokoll „%s“ angegeben, benutze Voreinstellung (SSLv23).\n"
"Kann aktuelle SSL/TLS-Chiffre nicht ermitteln - keine Sitzung aufgebaut?\n"
#: socket.c:1044
#, c-format
msgid "SSL/TLS: using protocol %s, cipher %s, %d/%d secret/processed bits\n"
msgstr "SSL/TLS: Protokoll %s, Chiffre %s, %d/%d geheime/verarbeitete bits\n"
#: socket.c:1027
#: socket.c:1051
msgid "Certificate/fingerprint verification was somehow skipped!\n"
msgstr "Zertifikat-/Fingerabdruck-Überprüfung wurde irgendwie übersprungen!\n"
#: socket.c:1044
#: socket.c:1068
msgid ""
"Warning: the connection is insecure, continuing anyways. (Better use --"
"sslcertck!)\n"
......@@ -3225,11 +3245,11 @@ msgstr ""
"Warnung: Die Verbindung ist unsicher, mache trotzdem weiter. (Nehmen Sie "
"lieber --sslcertck!)\n"
#: socket.c:1086
#: socket.c:1110
msgid "Cygwin socket read retry\n"
msgstr "Cygwin-Socket-Lese-Wiederholung\n"
#: socket.c:1089
#: socket.c:1113
msgid "Cygwin socket read retry failed!\n"
msgstr "Cygwin-Socket-Lese-Wiederholung fehlgeschlagen!\n"
......@@ -3420,3 +3440,6 @@ msgstr "malloc fehlgeschlagen\n"
#: xmalloc.c:47
msgid "realloc failed\n"
msgstr "realloc fehlgeschlagen\n"
#~ msgid "Your OpenSSL version does not support SSLv2.\n"
#~ msgstr "Ihre OpenSSL-Version unterstützt SSLv2 nicht.\n"
......@@ -281,6 +281,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
#endif /* OPIE_ENABLE */
#ifdef SSL_ENABLE
flag connection_may_have_tls_errors = FALSE;
char *commonname;
#endif /* SSL_ENABLE */
done_capa = FALSE;
......@@ -393,7 +394,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
(ctl->server.authenticate == A_KERBEROS_V5) ||
(ctl->server.authenticate == A_OTP) ||
(ctl->server.authenticate == A_CRAM_MD5) ||
maybe_tls(ctl))
maybe_starttls(ctl))
{
if ((ok = capa_probe(sock)) != PS_SUCCESS)
/* we are in STAGE_GETAUTH => failure is PS_AUTHFAIL! */
......@@ -406,12 +407,12 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
(ok == PS_SOCKET && !ctl->wehaveauthed))
{
#ifdef SSL_ENABLE
if (must_tls(ctl)) {
if (must_starttls(ctl)) {
/* fail with mandatory STLS without repoll */
report(stderr, GT_("TLS is mandatory for this session, but server refused CAPA command.\n"));
report(stderr, GT_("The CAPA command is however necessary for TLS.\n"));
return ok;
} else if (maybe_tls(ctl)) {
} else if (maybe_starttls(ctl)) {
/* defeat opportunistic STLS */
xfree(ctl->sslproto);
ctl->sslproto = xstrdup("");
......@@ -431,24 +432,19 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
}
#ifdef SSL_ENABLE
if (maybe_tls(ctl)) {
char *commonname;
commonname = ctl->server.pollname;
if (ctl->server.via)
commonname = ctl->server.via;
if (ctl->sslcommonname)
commonname = ctl->sslcommonname;
if (has_stls
|| must_tls(ctl)) /* if TLS is mandatory, ignore capabilities */
commonname = ctl->server.pollname;
if (ctl->server.via)
commonname = ctl->server.via;
if (ctl->sslcommonname)
commonname = ctl->sslcommonname;
if (maybe_starttls(ctl)) {
if (has_stls || must_starttls(ctl)) /* if TLS is mandatory, ignore capabilities */
{
/* Use "tls1" rather than ctl->sslproto because tls1 is the only
* protocol that will work with STARTTLS. Don't need to worry
* whether TLS is mandatory or opportunistic unless SSLOpen() fails
* (see below). */
/* Don't need to worry whether TLS is mandatory or
* opportunistic unless SSLOpen() fails (see below). */
if (gen_transact(sock, "STLS") == PS_SUCCESS
&& (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, "tls1", ctl->sslcertck,
&& (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, ctl->sslproto, ctl->sslcertck,
ctl->sslcertfile, ctl->sslcertpath, ctl->sslfingerprint, commonname,