Scott Gifford writes:

[...] The patches should be fairly easy to update to version 4, or you could just use version 3. If you forward-port the patches to version 4, let me know and I'll add a link to my Web page.

I've decided to see if I could add IMAP STARTTLS support to version 4, based on Scott's patch to 3.22.

I've disentangled what I think are the STARTTLS specific pieces and recast them in the version 4 idiom. I'm playing with pop3 since I can have openssl's s_client negotiate the STARTTLS part for me. I have it working in pass-through mode (just proxying a non-ssl conversation), but can't get the STARTTLS part going.

Using "openssl s_client -connect demo:pop3s" to hit an stunnel process that's expecting an ssl connect (e.g. the default behaviour) works fine.

Telnet-ing to demo, port pop3 (which hits stunnel listening in 'pop3-" mode) then running through a simple "USER, PASS, RETR" session works fine.

If I do "openssl s_client -connect demo:pop3 -starttls pop3" I get: 13845:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s23_clnt.c:478:

and if I add -debug, I get:

(demo)[4:15pm]stunnel>>openssl s_client -connect demo:pop3 -starttls pop3 -debug CONNECTED(00000003) read from 08094700 [080A7000] (8192 bytes => 99 (0x63)) 0000 - 2b 4f 4b 20 44 42 4d 41-49 4c 20 70 6f 70 33 20 +OK DBMAIL pop3 0010 - 73 65 72 76 65 72 20 72-65 61 64 79 20 74 6f 20 server ready to 0020 - 72 6f 63 6b 20 3c 31 63-64 35 61 66 37 31 34 37 rock <1cd5af7147 0030 - 65 31 39 31 31 38 37 33-37 64 61 62 62 39 33 65 e19118737dabb93e 0040 - 36 61 38 35 30 61 40 64-65 6d 6f 2e 61 6c 65 72 [email protected] 0050 - 63 65 2e 63 6f 6d 3e 20-2b 20 73 74 75 6e 6e 65 ce.com> + stunne 0060 - 6c 0d 0a l.. write to 08094700 [BFBFDC70] (6 bytes => 6 (0x6)) 0000 - 53 54 4c 53 0d 0a STLS.. read from 08094700 [080A5000] (8192 bytes => 36 (0x24)) 0000 - 2b 4f 4b 20 73 74 75 6e-6e 65 6c 20 73 74 61 72 +OK stunnel star 0010 - 74 69 6e 67 20 54 4c 53-20 6e 65 67 6f 74 69 61 ting TLS negotia 0020 - 74 69 6f 6e tion write to 08094700 [080AC000] (142 bytes => 142 (0x8E)) 0000 - 80 8c 01 03 01 00 63 00-00 00 20 00 00 39 00 00 ......c... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030 - 00 05 00 00 04 01 00 80-08 00 80 00 00 63 00 00 .............c.. 0040 - 62 00 00 61 00 00 15 00-00 12 00 00 09 06 00 40 b..a...........@ 0050 - 00 00 65 00 00 64 00 00-60 00 00 14 00 00 11 00 ..e..d..`....... 0060 - 00 08 00 00 06 04 00 80-00 00 03 02 00 80 3c fc ..............<. 0070 - 7a 39 c2 3a 4f 59 06 ae-aa ce f8 1c 23 b2 2c 04 z9.:OY......#.,. 0080 - 5b f4 33 a7 56 81 9a f0-88 b4 13 7b 3b 11 [.3.V......{;. read from 08094700 [080B2000] (7 bytes => 2 (0x2)) 0000 - 0d 0a .. read from 08094700 [080B2002] (5 bytes => 5 (0x5)) 0000 - 16 03 01 00 4a ....J 13876:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s23_clnt.c:478:

I'd love any suggestions for places to look next!

Thanks,

g.