Commit 2933d3e

committed

Merge branch 'pr-222b' into testing

2 parents 4bb9eb2 + 46505c5 commit 2933d3eCopy full SHA for 2933d3e

1 file changed

Lines changed: 12 additions & 2 deletions

File tree

Lines changed: 12 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -390,9 +390,19 @@ def __start_tls(self, imapobj):`
`390`	`390`	`caps_pre = set(getattr(imapobj, '_offlineimap_capabilities_pre_tls',`
`391`	`391`	`getattr(imapobj, 'capabilities', [])))`
`392`	`392`
`393`		`- # If the server does not advertise STARTTLS, respect that.`
	`393`	`+ # If the server does not advertise STARTTLS, warn but attempt anyway.`
	`394`	`+ # Per RFC 2595 section 9, a man-in-the-middle attacker can strip`
	`395`	`+ # STARTTLS from the capability list to force a cleartext connection.`
	`396`	`+ # Silently skipping STARTTLS when the user configured it would make`
	`397`	`+ # offlineimap vulnerable to this attack. We try regardless and let`
	`398`	`+ # the server reject the command if it genuinely does not support it.`
`394`	`399`	`if 'STARTTLS' not in caps_pre:`
`395`		`- return`
	`400`	`+ self.ui.warn(`
	`401`	`+ "Server '%s' did not advertise STARTTLS in its capabilities, "`
	`402`	`+ "but starttls is configured. Attempting STARTTLS anyway to "`
	`403`	`+ "guard against capability-stripping attacks (RFC 2595 §9)."`
	`404`	`+ % self.hostname`
	`405`	`+ )`
`396`	`406`
`397`	`407`	`# Execute STARTTLS.`
`398`	`408`	`self.ui.debug('imap', 'Using STARTTLS connection')`

Comments

(0)