fetchmail-6.3.20 (not yet released):
# CHANGES
-* fetchmail no longer supports SSL v2, nor the corresponding SSL2 option to
- --sslproto. SSLv2 is insecure and had been deprecated 15 years ago. fetchmail
- will actively forbid SSLv2 negotiation by means of SSL_OP_NO_SSLv2.
- To fix Debian Bug#622054.
* fetchmail now always uses its own MD5 implementation. The library and header
variants are too diverse, and we've been bitten before -- and configure
complains noisily on Cyrus-SASL's RFC1321 md5.h.
(Keyword: sslproto)
.br
Forces an SSL/TLS protocol. Possible values are \fB''\fP,
-\&'\fBSSL23\fP' (note however that fetchmail, since v6.3.20, prohibits
-negotiation of SSLv2 -- it has been deprecated for 15 years and is
-insecure), \&'\fBSSL3\fP', and
+\&'\fBSSL2\fP', '\fBSSL23\fP', (use of these two values is discouraged
+and should only be used as a last resort) \&'\fBSSL3\fP', and
\&'\fBTLS1\fP'. The default behaviour if this option is unset is: for
connections without \-\-ssl, use \&'\fBTLS1\fP' so that fetchmail will
opportunistically try STARTTLS negotiation with TLS1. You can configure
P(GT_(" --sslcertpath path to trusted-CA ssl certificate directory\n"));
P(GT_(" --sslcommonname expect this CommonName from server (discouraged)\n"));
P(GT_(" --sslfingerprint fingerprint that must match that of the server's cert.\n"));
- P(GT_(" --sslproto force ssl protocol (SSL23/SSL3/TLS1)\n"));
+ P(GT_(" --sslproto force ssl protocol (SSL2/SSL3/TLS1)\n"));
#endif
P(GT_(" --plugin specify external command to open connection\n"));
P(GT_(" --plugout specify external command to open smtp connection\n"));
"Servers.\n"
#: options.c:654
-msgid " --sslproto force ssl protocol (SSL23/SSL3/TLS1)\n"
-msgstr " --sslproto SSL-Protokoll erzwingen (SSL23/SSL3/TLS1)\n"
+msgid " --sslproto force ssl protocol (SSL2/SSL3/TLS1)\n"
+msgstr " --sslproto SSL-Protokoll erzwingen (SSL2/SSL3/TLS1)\n"
#: options.c:656
msgid " --plugin specify external command to open connection\n"
#: socket.c:899
#, c-format
-msgid "Invalid SSL protocol '%s' specified, using default (SSL23).\n"
+msgid "Invalid SSL protocol '%s' specified, using default (SSLv23).\n"
msgstr ""
-"Ungültiges SSL-Protokoll „%s“ angegeben, benutze Voreinstellung (SSL23).\n"
+"Ungültiges SSL-Protokoll „%s“ angegeben, benutze Voreinstellung (SSLv23).\n"
#: socket.c:992
msgid "Certificate/fingerprint verification was somehow skipped!\n"
/* Make sure a connection referring to an older context is not left */
_ssl_context[sock] = NULL;
if(myproto) {
- if(!strcasecmp("ssl3",myproto)) {
+ if(!strcasecmp("ssl2",myproto)) {
+ _ctx[sock] = SSL_CTX_new(SSLv2_client_method());
+ } else if(!strcasecmp("ssl3",myproto)) {
_ctx[sock] = SSL_CTX_new(SSLv3_client_method());
} else if(!strcasecmp("tls1",myproto)) {
_ctx[sock] = SSL_CTX_new(TLSv1_client_method());
} else if (!strcasecmp("ssl23",myproto)) {
myproto = NULL;
} else {
- fprintf(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSL23).\n"), myproto);
+ fprintf(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto);
myproto = NULL;
}
}
return(-1);
}
- SSL_CTX_set_options(_ctx[sock], SSL_OP_ALL | SSL_OP_NO_SSLv2);
+ SSL_CTX_set_options(_ctx[sock], SSL_OP_ALL);
if (certck) {
SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_ck_verify_callback);