Re: [stunnel-users] IMAP TLS support in stunnel 4?

Scott Gifford writes:
> [...]
> The patches should be fairly easy to update to version 4, or you could
> just use version 3. If you forward-port the patches to version 4, let
> me know and I'll add a link to my Web page.

I've decided to see if I could add IMAP STARTTLS support to version 4,
based on Scott's patch to 3.22.

I've disentangled what I think are the STARTTLS specific pieces and
recast them in the version 4 idiom. I'm playing with pop3 since I can
have openssl's s_client negotiate the STARTTLS part for me. I have it
working in pass-through mode (just proxying a non-ssl conversation),
but can't get the STARTTLS part going.

Using "openssl s_client -connect demo:pop3s" to hit an stunnel process
that's expecting an ssl connect (e.g. the default behaviour) works
fine.

Telnet-ing to demo, port pop3 (which hits stunnel listening in 'pop3-"
mode) then running through a simple "USER, PASS, RETR" session works
fine.

If I do "openssl s_client -connect demo:pop3 -starttls pop3" I get:
13845:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s23_clnt.c:478:

and if I add -debug, I get:

(demo)[4:15pm]stunnel>>openssl s_client -connect demo:pop3 -starttls pop3 -debug
CONNECTED(00000003)
read from 08094700 [080A7000] (8192 bytes => 99 (0x63))
0000 - 2b 4f 4b 20 44 42 4d 41-49 4c 20 70 6f 70 33 20 +OK DBMAIL pop3
0010 - 73 65 72 76 65 72 20 72-65 61 64 79 20 74 6f 20 server ready to
0020 - 72 6f 63 6b 20 3c 31 63-64 35 61 66 37 31 34 37 rock <1cd5af7147
0030 - 65 31 39 31 31 38 37 33-37 64 61 62 62 39 33 65 e19118737dabb93e
0040 - 36 61 38 35 30 61 40 64-65 6d 6f 2e 61 6c 65 72 6a850a@demo.aler
0050 - 63 65 2e 63 6f 6d 3e 20-2b 20 73 74 75 6e 6e 65 ce.com> + stunne
0060 - 6c 0d 0a l..
write to 08094700 [BFBFDC70] (6 bytes => 6 (0x6))
0000 - 53 54 4c 53 0d 0a STLS..
read from 08094700 [080A5000] (8192 bytes => 36 (0x24))
0000 - 2b 4f 4b 20 73 74 75 6e-6e 65 6c 20 73 74 61 72 +OK stunnel star
0010 - 74 69 6e 67 20 54 4c 53-20 6e 65 67 6f 74 69 61 ting TLS negotia
0020 - 74 69 6f 6e tion
write to 08094700 [080AC000] (142 bytes => 142 (0x8E))
0000 - 80 8c 01 03 01 00 63 00-00 00 20 00 00 39 00 00 ......c... ..9..
0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............
0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 66 00 ..3..2../.....f.
0030 - 00 05 00 00 04 01 00 80-08 00 80 00 00 63 00 00 .............c..
0040 - 62 00 00 61 00 00 15 00-00 12 00 00 09 06 00 40 b..a...........@
0050 - 00 00 65 00 00 64 00 00-60 00 00 14 00 00 11 00 ..e..d..`.......
0060 - 00 08 00 00 06 04 00 80-00 00 03 02 00 80 3c fc ..............<.
0070 - 7a 39 c2 3a 4f 59 06 ae-aa ce f8 1c 23 b2 2c 04 z9.:OY......#.,.
0080 - 5b f4 33 a7 56 81 9a f0-88 b4 13 7b 3b 11 [.3.V......{;.
read from 08094700 [080B2000] (7 bytes => 2 (0x2))
0000 - 0d 0a ..
read from 08094700 [080B2002] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 4a ....J
13876:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s23_clnt.c:478:

I'd love any suggestions for places to look next!

Thanks,

g.

_______________________________________________
stunnel-users mailing list
stunnel-users@mirt.net
http://stunnel.mirt.net/mailman/listinfo/stunnel-users