search for: ssl_set

Hi, I came up with the following patch while trying to figure out a good solution for the situation described in Debian bug #871987[1]. In short, OpenSSL in Debian unstable has disabled TLSv1.0 and TLSv1.1 *by default*. That means that unless an application requests otherwise, only TLSv1.2 is supported. In the world of e-mail this is seemingly an issue, as there are still way too many old clients

...ommit lib-ssl-iostream: Support TLSv1.3 ciphersuites https://github.com/dovecot/core/commit/8f6f04eb21276f28b81695dd0d3df57c7b8f43e4 checking openssl rpm -ql openssl-devel-1.1.1g-1.fc32.x86_64 | grep -i ciphersuites /usr/share/man/man3/SSL_CTX_set_ciphersuites.3ssl.gz /usr/share/man/man3/SSL_set_ciphersuites.3ssl.gz man SSL_set_ciphersuites ... SSL_set_cipher_list() sets the list of ciphers (TLSv1.2 and below) only for ssl. SSL_CTX_set_ciphersuites() is used to configure the available TLSv1.3 ciphersuites for ctx. This is a simple colon (":") separated list of TLSv1.3...

...ttings.c | 2 ++ src/lib-master/master-service-ssl-settings.h | 1 + src/login-common/ssl-proxy-openssl.c | 15 ++++++++++++++- 4 files changed, 18 insertions(+), 1 deletion(-) --- a/src/config/all-settings.c +++ b/src/config/all-settings.c @@ -308,6 +308,7 @@ struct master_service_ssl_settings { const char *ssl_cert_username_field; const char *ssl_crypto_device; const char *ssl_options; + const char *ssl_lowest_version; bool ssl_verify_client_cert; bool ssl_require_crl; --- a/src/lib-master/master-service-ssl-settings.c +++ b/src/lib-master/master-service-ssl-settings.c...

...TX_load_verify_locations(ssl_ctx, ca, NULL); + } + if (!ret) { + i_fatal("SSL_CTX_load_verify_locations() failed: %s", ssl_last_error()); } - sk_X509_INFO_pop_free(inf, X509_INFO_free); } -static STACK_OF(X509_NAME) * -ssl_proxy_ctx_init(SSL_CTX *ssl_ctx, const struct master_service_ssl_settings *set, - bool load_xnames) +static void +ssl_proxy_ctx_init(SSL_CTX *ssl_ctx, const struct master_service_ssl_settings *set) { - X509_STORE *store; - STACK_OF(X509_NAME) *xnames = NULL; - /* enable all SSL workarounds, except empty fragments as it makes SSL more vulnerable against a...

...0da6b62f8ba..b8b57a350b9a710d101ac7ccbcc14560d415d905 100644 --- a/src/plugins/fts/fts-parser-tika.c +++ b/src/plugins/fts/fts-parser-tika.c @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) http_set.request_timeout_msecs = 60*1000; http_set.ssl = &ssl_set; http_set.debug = user->mail_debug; -tika_http_client = http_client_init(&http_set); +tika_http_client = http_client_init_private(&http_set); } *http_url_r = tuser->http_url; return 0; -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://dovecot....

...c7ccbcc14560d415d905 100644 > --- a/src/plugins/fts/fts-parser-tika.c > +++ b/src/plugins/fts/fts-parser-tika.c > @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) > http_set.request_timeout_msecs = 60*1000; > http_set.ssl = &ssl_set; > http_set.debug = user->mail_debug; > - tika_http_client = http_client_init(&http_set); > + tika_http_client = http_client_init_private(&http_set); > } > *http_url_r = tuser->http_url; > return 0; >

...ccbcc14560d415d905 > 100644 > --- a/src/plugins/fts/fts-parser-tika.c > +++ b/src/plugins/fts/fts-parser-tika.c > @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, > struct http_url **http_url_r) > http_set.request_timeout_msecs = 60*1000; > http_set.ssl = &ssl_set; > http_set.debug = user->mail_debug; > -tika_http_client = http_client_init(&http_set); > +tika_http_client = http_client_init_private(&http_set); > } > *http_url_r = tuser->http_url; > return 0; -- Hegh QaQ law' quvHa'ghach QaQ puS -------------- next par...

Hi, after the upgrade to Dovecot 2.3.11.3, from 2.3.10.1, I see frequently these errors from different users: Aug 18 11:02:35 Panic: indexer-worker(info at domain.com) session=<g71KISOttvS5LNVj:O3ahCyuZO18cYAAAEPCW+w>: file http-client-request.c: line 1232 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) Aug 18 11:02:35 Error: indexer-worker(info at

...AES-256 cipher suites. diff -r 1fbac590b9d4 -r ccd83f38e4b4 src/login-common/ssl-proxy-openssl.c --- a/src/login-common/ssl-proxy-openssl.c Fri Jun 28 19:48:37 2013 +0300 +++ b/src/login-common/ssl-proxy-openssl.c Sat Jul 06 14:46:16 2013 +1000 @@ -119,6 +119,10 @@ const struct master_service_ssl_settings *ssl_set); static void ssl_server_context_deinit(struct ssl_server_context **_ctx); +static void ssl_proxy_ctx_set_crypto_params(SSL_CTX *ssl_ctx, + const struct master_service_ssl_settings *set); +static int ssl_proxy_ctx_get_pkey_ec_curve_name(co...

...c7ccbcc14560d415d905 100644 > --- a/src/plugins/fts/fts-parser-tika.c > +++ b/src/plugins/fts/fts-parser-tika.c > @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) > http_set.request_timeout_msecs = 60*1000; > http_set.ssl = &ssl_set; > http_set.debug = user->mail_debug; > - tika_http_client = http_client_init(&http_set); > + tika_http_client = http_client_init_private(&http_set); > } > *http_url_r = tuser->http_url; > return 0; > Greetings I'm also experiencing these issue...

...--- a/src/plugins/fts/fts-parser-tika.c >> +++ b/src/plugins/fts/fts-parser-tika.c >> @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) >> http_set.request_timeout_msecs = 60*1000; >> http_set.ssl = &ssl_set; >> http_set.debug = user->mail_debug; >> - tika_http_client = http_client_init(&http_set); >> + tika_http_client = http_client_init_private(&http_set); >> } >> *http_url_r = tuser->http_url; >> return 0; >...

...2f8ba..b8b57a350b9a710d101ac7ccbcc14560d415d905 100644 --- a/src/plugins/fts/fts-parser-tika.c +++ b/src/plugins/fts/fts-parser-tika.c @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) http_set.request_timeout_msecs = 60*1000; http_set.ssl = &ssl_set; http_set.debug = user->mail_debug; - tika_http_client = http_client_init(&http_set); + tika_http_client = http_client_init_private(&http_set); } *http_url_r = tuser->http_url; return 0;

...ccbcc14560d415d905 > 100644 > --- a/src/plugins/fts/fts-parser-tika.c > +++ b/src/plugins/fts/fts-parser-tika.c > @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, > struct http_url **http_url_r) > http_set.request_timeout_msecs = 60*1000; > http_set.ssl = &ssl_set; > http_set.debug = user->mail_debug; > -tika_http_client = http_client_init(&http_set); > +tika_http_client = http_client_init_private(&http_set); > } > *http_url_r = tuser->http_url; > return 0; -- Hegh QaQ law' quvHa'ghach QaQ puS

https://www.lerctr.org/~ler/dovecot/doveadm-index-fts-debug.txt https://www.lerctr.org/~ler/dovecot/doveadm-index-fts-bt.txt I wish there was a way to set plugins {fts_solr = <blah>} from the command line :( but I turned it on globally for that run. On Wed, Jan 2, 2019 at 3:40 PM Stephan Bosch <stephan at rename-it.nl> wrote: > Oh, d'oh. I was looking for some solr debug

...ser-tika.c >>>> +++ b/src/plugins/fts/fts-parser-tika.c >>>> @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) >>>> http_set.request_timeout_msecs = 60*1000; >>>> http_set.ssl = &ssl_set; >>>> http_set.debug = user->mail_debug; >>>> - tika_http_client = http_client_init(&http_set); >>>> + tika_http_client = http_client_init_private(&http_set); >>>> } >>>> *http_url_r = tuser->http...

...b8b5c30..b8b57a350 100644 --- a/src/plugins/fts/fts-parser-tika.c +++ b/src/plugins/fts/fts-parser-tika.c @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) ??????????????? http_set.request_timeout_msecs = 60*1000; ??????????????? http_set.ssl = &ssl_set; ??????????????? http_set.debug = user->mail_debug; -?????????????? tika_http_client = http_client_init(&http_set); +?????????????? tika_http_client = http_client_init_private(&http_set); ??????? } ??????? *http_url_r = tuser->http_url; ??????? return 0; This will bluntly prevent...

...0da6b62f8ba..b8b57a350b9a710d101ac7ccbcc14560d415d905 100644 --- a/src/plugins/fts/fts-parser-tika.c +++ b/src/plugins/fts/fts-parser-tika.c @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) http_set.request_timeout_msecs = 60*1000; http_set.ssl = &ssl_set; http_set.debug = user->mail_debug; -tika_http_client = http_client_init(&http_set); +tika_http_client = http_client_init_private(&http_set); } *http_url_r = tuser->http_url; return 0; Greetings I'm also experiencing these issues while running Dovecot 2.3.11.3 with Solr 8....

...gt; +++ b/src/plugins/fts/fts-parser-tika.c >>>>>> @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) >>>>>> http_set.request_timeout_msecs = 60*1000; >>>>>> http_set.ssl = &ssl_set; >>>>>> http_set.debug = user->mail_debug; >>>>>> - tika_http_client = http_client_init(&http_set); >>>>>> + tika_http_client = http_client_init_private(&http_set); >>>>>> } >>>>&gt...

...2f8ba..b8b57a350b9a710d101ac7ccbcc14560d415d905 100644 --- a/src/plugins/fts/fts-parser-tika.c +++ b/src/plugins/fts/fts-parser-tika.c @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) http_set.request_timeout_msecs = 60*1000; http_set.ssl = &ssl_set; http_set.debug = user->mail_debug; - tika_http_client = http_client_init(&http_set); + tika_http_client = http_client_init_private(&http_set); } *http_url_r = tuser->http_url; return 0;

...ns/fts/fts-parser-tika.c >>> +++ b/src/plugins/fts/fts-parser-tika.c >>> @@ -77,7 +77,7 @@ tika_get_http_client_url(struct mail_user *user, struct http_url **http_url_r) >>> http_set.request_timeout_msecs = 60*1000; >>> http_set.ssl = &ssl_set; >>> http_set.debug = user->mail_debug; >>> - tika_http_client = http_client_init(&http_set); >>> + tika_http_client = http_client_init_private(&http_set); >>> } >>> *http_url_r = tuser->http_url; >>&gt...