{"thread":{"id":"34355","subject":"[PATCH v2 0/2] Squelch warning from send-email","startedAt":"2013-07-05T12:05:45Z","lastAt":"2013-07-18T17:36:33Z","messageCount":32,"participants":["Ramkumar Ramachandra","Eric Sunshine","brian m. carlson","Junio C Hamano","John Keeping","Torsten Bögershausen","Jeff King"],"isPatch":true,"patchVersion":2,"patchTotal":2},"messages":[{"id":"222629","messageId":"1373025947-26495-1-git-send-email-artagnon@gmail.com","threadId":"34355","inReplyTo":null,"subject":"[PATCH v2 0/2] Squelch warning from send-email","fromName":"Ramkumar Ramachandra","fromEmail":"artagnon@gmail.com","sentAt":"2013-07-05T12:05:45Z","receivedAt":"2013-07-05T12:05:45Z","isPatch":true,"sender":{"key":"r@artagnon.com","avatar":"https://avatars.githubusercontent.com/u/37226?v=4"},"body":"Hi,\n\nSince nobody stepped up to write it, I wrote [2/2] myself. It will be\ntested when I send out this series.\n\nThanks.\n\nRamkumar Ramachandra (2):\n send-email: squelch warning from Net::SMTP::SSL\n send-email: introduce sendemail.smtpsslcertpath\n\n Documentation/config.txt | 3 +++\n Documentation/git-send-email.txt | 4 ++++\n git-send-email.perl | 20 ++++++++++++++++++--\n 3 files changed, 25 insertions(+), 2 deletions(-)\n\n-- \n1.8.3.2.722.g3244e19.dirty\n"},{"id":"222630","messageId":"1373025947-26495-2-git-send-email-artagnon@gmail.com","threadId":"34355","inReplyTo":"1373025947-26495-1-git-send-email-artagnon@gmail.com","subject":"[PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"Ramkumar Ramachandra","fromEmail":"artagnon@gmail.com","sentAt":"2013-07-05T12:05:46Z","receivedAt":"2013-07-05T12:05:46Z","isPatch":true,"sender":{"key":"r@artagnon.com","avatar":"https://avatars.githubusercontent.com/u/37226?v=4"},"body":"Due to a recent change in the Net::SMTP::SSL module, send-email emits\nthe following ugly warning everytime a email is sent via SSL:\n\n*******************************************************************\n Using the default of SSL_verify_mode of SSL_VERIFY_NONE for client\n is deprecated! Please set SSL_verify_mode to SSL_VERIFY_PEER\n together with SSL_ca_file|SSL_ca_path for verification.\n If you really don't want to verify the certificate and keep the\n connection open to Man-In-The-Middle attacks please set\n SSL_verify_mode explicitly to SSL_VERIFY_NONE in your application.\n*******************************************************************\n\nFix this by explicitly specifying SSL_verify_mode => SSL_VERIFY_NONE in\nNet::SMTP::SSL->start_SSL().\n\nHelped-by: brian m. carlson \nSigned-off-by: Ramkumar Ramachandra \n---\n git-send-email.perl | 4 +++-\n 1 file changed, 3 insertions(+), 1 deletion(-)\n\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex ecbf56f..758100d 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -1193,10 +1193,12 @@ X-Mailer: git-send-email $gitversion\n \t\t\t\t\t\t Debug => $debug_net_smtp);\n \t\t\tif ($smtp_encryption eq 'tls' && $smtp) {\n \t\t\t\trequire Net::SMTP::SSL;\n+\t\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_NONE);\n \t\t\t\t$smtp->command('STARTTLS');\n \t\t\t\t$smtp->response();\n \t\t\t\tif ($smtp->code == 220) {\n-\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp)\n+\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n+\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n \t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n \t\t\t\t\t$smtp_encryption = '';\n \t\t\t\t\t# Send EHLO again to receive fresh\n-- \n1.8.3.2.723.gad7967b.dirty\n"},{"id":"222631","messageId":"1373025947-26495-3-git-send-email-artagnon@gmail.com","threadId":"34355","inReplyTo":"1373025947-26495-1-git-send-email-artagnon@gmail.com","subject":"[PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Ramkumar Ramachandra","fromEmail":"artagnon@gmail.com","sentAt":"2013-07-05T12:05:47Z","receivedAt":"2013-07-05T12:05:47Z","isPatch":true,"sender":{"key":"r@artagnon.com","avatar":"https://avatars.githubusercontent.com/u/37226?v=4"},"body":"Use the ca-certificates in /etc/ssl/certs by default (that's where most\ndistributions put it). SSL_VERIFY_NONE is now the fallback mode.\n\nSigned-off-by: Ramkumar Ramachandra \n---\n Documentation/config.txt | 3 +++\n Documentation/git-send-email.txt | 4 ++++\n git-send-email.perl | 22 ++++++++++++++++++----\n 3 files changed, 25 insertions(+), 4 deletions(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex b4d4887..b216a63 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -2048,6 +2048,9 @@ sendemail.smtpencryption::\n sendemail.smtpssl::\n \tDeprecated alias for 'sendemail.smtpencryption = ssl'.\n \n+sendemail.smtpsslcertpath::\n+\tPath to ca-certificates. Defaults to `/etc/ssl/certs`.\n+\n sendemail..*::\n \tIdentity-specific versions of the 'sendemail.*' parameters\n \tfound below, taking precedence over those when the this\ndiff --git a/Documentation/git-send-email.txt b/Documentation/git-send-email.txt\nindex 40a9a9a..605f263 100644\n--- a/Documentation/git-send-email.txt\n+++ b/Documentation/git-send-email.txt\n@@ -198,6 +198,10 @@ must be used for each option.\n --smtp-ssl::\n \tLegacy alias for '--smtp-encryption ssl'.\n \n+--smtp-ssl-cert-path::\n+\tPath to ca-certificates. Defaults to `/etc/ssl/certs`, or\n+\t'sendemail.smtpsslcertpath'.\n+\n --smtp-user=::\n \tUsername for SMTP-AUTH. Default is the value of 'sendemail.smtpuser';\n \tif a username is not specified (with '--smtp-user' or 'sendemail.smtpuser'),\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex 758100d..026bcbc 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -69,6 +69,8 @@ git send-email [options] \n --smtp-pass * Password for SMTP-AUTH; not necessary.\n --smtp-encryption * tls or ssl; anything else disables.\n --smtp-ssl * Deprecated. Use '--smtp-encryption ssl'.\n+ --smtp-ssl-cert-path * Path to ca-certificates. Defaults to\n+ /etc/ssl/certs.\n --smtp-domain * The domain name sent to HELO/EHLO handshake\n --smtp-debug <0|1> * Disable, enable Net::SMTP debug.\n \n@@ -195,6 +197,7 @@ my ($thread, $chain_reply_to, $suppress_from, $signed_off_by_cc);\n my ($to_cmd, $cc_cmd);\n my ($smtp_server, $smtp_server_port, @smtp_server_options);\n my ($smtp_authuser, $smtp_encryption);\n+my ($smtp_ssl_cert_path);\n my ($identity, $aliasfiletype, @alias_files, $smtp_domain);\n my ($validate, $confirm);\n my (@suppress_cc);\n@@ -220,6 +223,7 @@ my %config_settings = (\n \"smtpserveroption\" => \\@smtp_server_options,\n \"smtpuser\" => \\$smtp_authuser,\n \"smtppass\" => \\$smtp_authpass,\n+ \"smtpsslcertpath\" => \\$smtp_ssl_cert_path,\n \"smtpdomain\" => \\$smtp_domain,\n \"to\" => \\@initial_to,\n \"tocmd\" => \\$to_cmd,\n@@ -1193,13 +1197,23 @@ X-Mailer: git-send-email $gitversion\n \t\t\t\t\t\t Debug => $debug_net_smtp);\n \t\t\tif ($smtp_encryption eq 'tls' && $smtp) {\n \t\t\t\trequire Net::SMTP::SSL;\n-\t\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_NONE);\n+\t\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n \t\t\t\t$smtp->command('STARTTLS');\n \t\t\t\t$smtp->response();\n \t\t\t\tif ($smtp->code == 220) {\n-\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n-\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n-\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n+\t\t\t\t\t# Attempt to use a ca-certificate by default\n+\t\t\t\t\t$smtp_ssl_cert_path |= \"/etc/ssl/certs\";\n+\t\t\t\t\tif (-d $smtp_ssl_cert_path) {\n+\t\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n+\t\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_PEER,\n+\t\t\t\t\t\t\t\t\t\t SSL_ca_path => $smtp_ssl_cert_path)\n+\t\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n+\t\t\t\t\t} else {\n+\t\t\t\t\t\tprint STDERR \"warning: Using SSL_VERIFY_NONE. See sendemail.smtpsslcertpath.\\n\";\n+\t\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n+\t\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n+\t\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n+\t\t\t\t\t}\n \t\t\t\t\t$smtp_encryption = '';\n \t\t\t\t\t# Send EHLO again to receive fresh\n \t\t\t\t\t# supported commands\n-- \n1.8.3.2.723.gad7967b.dirty\n"},{"id":"222632","messageId":"CAPig+cReC8TnU0P3-qgeXGeyV=tHaHpa1Cz6r3AAZDw2ZH6B_A@mail.gmail.com","threadId":"34355","inReplyTo":"1373025947-26495-3-git-send-email-artagnon@gmail.com","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2013-07-05T12:33:26Z","receivedAt":"2013-07-05T12:33:26Z","isPatch":true,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Fri, Jul 5, 2013 at 8:05 AM, Ramkumar Ramachandra wrote:\n> Use the ca-certificates in /etc/ssl/certs by default (that's where most\n> distributions put it). SSL_VERIFY_NONE is now the fallback mode.\n>\n> Signed-off-by: Ramkumar Ramachandra \n> ---\n> diff --git a/git-send-email.perl b/git-send-email.perl\n> index 758100d..026bcbc 100755\n> --- a/git-send-email.perl\n> +++ b/git-send-email.perl\n> @@ -1193,13 +1197,23 @@ X-Mailer: git-send-email $gitversion\n> Debug => $debug_net_smtp);\n> if ($smtp_encryption eq 'tls' && $smtp) {\n> require Net::SMTP::SSL;\n> - use IO::Socket::SSL qw(SSL_VERIFY_NONE);\n> + use IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n> $smtp->command('STARTTLS');\n> $smtp->response();\n> if ($smtp->code == 220) {\n> - $smtp = Net::SMTP::SSL->start_SSL($smtp,\n> - SSL_verify_mode => SSL_VERIFY_NONE)\n> - or die \"STARTTLS failed! \".$smtp->message;\n> + # Attempt to use a ca-certificate by default\n> + $smtp_ssl_cert_path |= \"/etc/ssl/certs\";\n\nYou're going to want to use logical ||= here. Bitwise |= on a string\ndoes not do what you expect[1]:\n\n my $s = '/usr/local/etc/ssl/certs';\n $s |= '/etc/ssl/certs';\n print $s, \"\\n\";\n\nOutputs: /uws/oooowts/ssl/certs\n\n[1]: http://perldoc.perl.org/perlop.html#Bitwise-String-Operators\n\n> + if (-d $smtp_ssl_cert_path) {\n> + $smtp = Net::SMTP::SSL->start_SSL($smtp,\n> + SSL_verify_mode => SSL_VERIFY_PEER,\n> + SSL_ca_path => $smtp_ssl_cert_path)\n> + or die \"STARTTLS failed! \".$smtp->message;\n> + } else {\n> + print STDERR \"warning: Using SSL_VERIFY_NONE. See sendemail.smtpsslcertpath.\\n\";\n> + $smtp = Net::SMTP::SSL->start_SSL($smtp,\n> + SSL_verify_mode => SSL_VERIFY_NONE)\n> + or die \"STARTTLS failed! \".$smtp->message;\n> + }\n> $smtp_encryption = '';\n> # Send EHLO again to receive fresh\n> # supported commands\n"},{"id":"222633","messageId":"CALkWK0kfp3RWqm+v4zwKxSF=GxVJ0Bpw0-Qidc7u7-NDKUKu0A@mail.gmail.com","threadId":"34355","inReplyTo":"CAPig+cReC8TnU0P3-qgeXGeyV=tHaHpa1Cz6r3AAZDw2ZH6B_A@mail.gmail.com","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Ramkumar Ramachandra","fromEmail":"artagnon@gmail.com","sentAt":"2013-07-05T12:36:46Z","receivedAt":"2013-07-05T12:36:46Z","isPatch":true,"sender":{"key":"r@artagnon.com","avatar":"https://avatars.githubusercontent.com/u/37226?v=4"},"body":"Eric Sunshine wrote:\n>> + $smtp_ssl_cert_path |= \"/etc/ssl/certs\";\n>\n> You're going to want to use logical ||= here. Bitwise |= on a string\n> does not do what you expect[1]:\n>\n> my $s = '/usr/local/etc/ssl/certs';\n> $s |= '/etc/ssl/certs';\n> print $s, \"\\n\";\n>\n> Outputs: /uws/oooowts/ssl/certs\n\nThanks; much appreciated. My Perl is quite weak.\n"},{"id":"222634","messageId":"20130705124536.GU862789@vauxhall.crustytoothpaste.net","threadId":"34355","inReplyTo":"1373025947-26495-3-git-send-email-artagnon@gmail.com","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2013-07-05T12:45:37Z","receivedAt":"2013-07-05T12:45:37Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Fri, Jul 05, 2013 at 05:35:47PM +0530, Ramkumar Ramachandra wrote:\n> @@ -1193,13 +1197,23 @@ X-Mailer: git-send-email $gitversion\n> \t\t\t\t\t\t Debug => $debug_net_smtp);\n> \t\t\tif ($smtp_encryption eq 'tls' && $smtp) {\n> \t\t\t\trequire Net::SMTP::SSL;\n> -\t\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_NONE);\n> +\t\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n> \t\t\t\t$smtp->command('STARTTLS');\n> \t\t\t\t$smtp->response();\n> \t\t\t\tif ($smtp->code == 220) {\n> -\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n> -\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n> -\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n> +\t\t\t\t\t# Attempt to use a ca-certificate by default\n> +\t\t\t\t\t$smtp_ssl_cert_path |= \"/etc/ssl/certs\";\n> +\t\t\t\t\tif (-d $smtp_ssl_cert_path) {\n> +\t\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n> +\t\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_PEER,\n> +\t\t\t\t\t\t\t\t\t\t SSL_ca_path => $smtp_ssl_cert_path)\n> +\t\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n> +\t\t\t\t\t} else {\n> +\t\t\t\t\t\tprint STDERR \"warning: Using SSL_VERIFY_NONE. See sendemail.smtpsslcertpath.\\n\";\n> +\t\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n> +\t\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n> +\t\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n> +\t\t\t\t\t}\n\nYou've covered the STARTTLS case, but not the SSL one right above it.\nSomeone using smtps on port 465 will still see the warning. You can\npass SSL_verify_mode to Net::SMTP::SSL->new just like you pass it to\nstart_SSL.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"222636","messageId":"CALkWK0nbib0G4w6X4sy56X4KixFqpqQ2GEJ-uSOqxVoH8M7C5g@mail.gmail.com","threadId":"34355","inReplyTo":"20130705124536.GU862789@vauxhall.crustytoothpaste.net","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Ramkumar Ramachandra","fromEmail":"artagnon@gmail.com","sentAt":"2013-07-05T12:53:58Z","receivedAt":"2013-07-05T12:53:58Z","isPatch":true,"sender":{"key":"r@artagnon.com","avatar":"https://avatars.githubusercontent.com/u/37226?v=4"},"body":"brian m. carlson wrote:\n> You've covered the STARTTLS case, but not the SSL one right above it.\n> Someone using smtps on port 465 will still see the warning. You can\n> pass SSL_verify_mode to Net::SMTP::SSL->new just like you pass it to\n> start_SSL.\n\nThanks. On a related note, how do I find out about all these things? I tried\n\n $ perldoc Net::SMTP::SSL\n\nbut it was completely useless. The only reason I got this far is\nbecause you literally told me what to do. Do I have to resort to\nreading the sources? If so, how do I bring up the relevant functions\nquickly? (I'm looking for something like the elisp M-x find-function).\n"},{"id":"222637","messageId":"20130705130101.GV862789@vauxhall.crustytoothpaste.net","threadId":"34355","inReplyTo":"CALkWK0nbib0G4w6X4sy56X4KixFqpqQ2GEJ-uSOqxVoH8M7C5g@mail.gmail.com","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2013-07-05T13:01:02Z","receivedAt":"2013-07-05T13:01:02Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Fri, Jul 05, 2013 at 06:23:58PM +0530, Ramkumar Ramachandra wrote:\n> Thanks. On a related note, how do I find out about all these things? I tried\n> \n> $ perldoc Net::SMTP::SSL\n> \n> but it was completely useless. The only reason I got this far is\n> because you literally told me what to do. Do I have to resort to\n> reading the sources? If so, how do I bring up the relevant functions\n> quickly? (I'm looking for something like the elisp M-x find-function).\n\nSince Net::SMTP::SSL inherits from IO::Socket::SSL, you can do \"perldoc\nIO::Socket::SSL\", which is significantly more helpful. If you're\nlooking for the source of a module, use \"perldoc -lm Net::SMTP::SSL\";\nthat will print the .pm file for the module.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"222640","messageId":"7vobag7wl0.fsf@alter.siamese.dyndns.org","threadId":"34355","inReplyTo":"20130705124536.GU862789@vauxhall.crustytoothpaste.net","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-07-05T17:20:11Z","receivedAt":"2013-07-05T17:20:11Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"brian m. carlson\" writes:\n\n> You've covered the STARTTLS case, but not the SSL one right above it.\n> Someone using smtps on port 465 will still see the warning. You can\n> pass SSL_verify_mode to Net::SMTP::SSL->new just like you pass it to\n> start_SSL.\n\nOK, will a fix-up look like this on top of 1/2 and 2/2?\n\n git-send-email.perl | 39 +++++++++++++++++++++++----------------\n 1 file changed, 23 insertions(+), 16 deletions(-)\n\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex 52028ba..3b80340 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -1093,6 +1093,25 @@ sub smtp_auth_maybe {\n \treturn $auth;\n }\n \n+# Helper to come up with SSL/TLS certification validation params\n+# and warn when doing no verification\n+sub ssl_verify_params {\n+\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n+\n+\tif (!defined $smtp_ssl_cert_path) {\n+\t\t$smtp_ssl_cert_path = \"/etc/ssl/certs\";\n+\t}\n+\n+\tif (-d $smtp_ssl_cert_path) {\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n+\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n+\t} else {\n+\t\tprint STDERR \"warning: Using SSL_VERIFY_NONE. \" .\n+\t\t \"See sendemail.smtpsslcertpath.\\n\";\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE);\n+\t}\n+}\n+\n # Returns 1 if the message was sent, and 0 otherwise.\n # In actuality, the whole program dies when there\n # is an error sending a message.\n@@ -1195,12 +1214,11 @@ sub send_message {\n \t\tif ($smtp_encryption eq 'ssl') {\n \t\t\t$smtp_server_port ||= 465; # ssmtp\n \t\t\trequire Net::SMTP::SSL;\n-\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_NONE);\n \t\t\t$smtp_domain ||= maildomain();\n \t\t\t$smtp ||= Net::SMTP::SSL->new($smtp_server,\n \t\t\t\t\t\t Hello => $smtp_domain,\n \t\t\t\t\t\t Port => $smtp_server_port,\n-\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE);\n+\t\t\t\t\t\t ssl_verify_params());\n \t\t}\n \t\telse {\n \t\t\trequire Net::SMTP;\n@@ -1210,23 +1228,12 @@ sub send_message {\n \t\t\t\t\t\t Debug => $debug_net_smtp);\n \t\t\tif ($smtp_encryption eq 'tls' && $smtp) {\n \t\t\t\trequire Net::SMTP::SSL;\n-\t\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n \t\t\t\t$smtp->command('STARTTLS');\n \t\t\t\t$smtp->response();\n \t\t\t\tif ($smtp->code == 220) {\n-\t\t\t\t\t# Attempt to use a ca-certificate by default\n-\t\t\t\t\t$smtp_ssl_cert_path ||= \"/etc/ssl/certs\";\n-\t\t\t\t\tif (-d $smtp_ssl_cert_path) {\n-\t\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n-\t\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_PEER,\n-\t\t\t\t\t\t\t\t\t\t SSL_ca_path => $smtp_ssl_cert_path)\n-\t\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n-\t\t\t\t\t} else {\n-\t\t\t\t\t\tprint STDERR \"warning: Using SSL_VERIFY_NONE. See sendemail.smtpsslcertpath.\\n\";\n-\t\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n-\t\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n-\t\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n-\t\t\t\t\t}\n+\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n+\t\t\t\t\t\t\t\t\t ssl_verify_params())\n+\t\t\t\t\t or die \"STARTTLS failed! \".$smtp->message;\n \t\t\t\t\t$smtp_encryption = '';\n \t\t\t\t\t# Send EHLO again to receive fresh\n \t\t\t\t\t# supported commands\n"},{"id":"222641","messageId":"20130705174730.GM9161@serenity.lan","threadId":"34355","inReplyTo":"7vobag7wl0.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"John Keeping","fromEmail":"john@keeping.me.uk","sentAt":"2013-07-05T17:47:30Z","receivedAt":"2013-07-05T17:47:30Z","isPatch":true,"sender":{"key":"john@keeping.me.uk","avatar":"https://avatars.githubusercontent.com/u/1702081?v=4"},"body":"On Fri, Jul 05, 2013 at 10:20:11AM -0700, Junio C Hamano wrote:\n> \"brian m. carlson\" writes:\n> \n> > You've covered the STARTTLS case, but not the SSL one right above it.\n> > Someone using smtps on port 465 will still see the warning. You can\n> > pass SSL_verify_mode to Net::SMTP::SSL->new just like you pass it to\n> > start_SSL.\n> \n> OK, will a fix-up look like this on top of 1/2 and 2/2?\n\nAccording to IO::Socket::SSL [1], if neither SSL_ca_file nor SSL_ca_path\nis specified then builtin defaults will be used, so I wonder if we\nshould pass SSL_VERIFY_PEER regardless (possibly with a switch for\nSSL_VERIFY_NONE if people really need that).\n\n[1] http://search.cpan.org/~sullr/IO-Socket-SSL-1.951/lib/IO/Socket/SSL.pm\n\n> git-send-email.perl | 39 +++++++++++++++++++++++----------------\n> 1 file changed, 23 insertions(+), 16 deletions(-)\n> \n> diff --git a/git-send-email.perl b/git-send-email.perl\n> index 52028ba..3b80340 100755\n> --- a/git-send-email.perl\n> +++ b/git-send-email.perl\n> @@ -1093,6 +1093,25 @@ sub smtp_auth_maybe {\n> \treturn $auth;\n> }\n> \n> +# Helper to come up with SSL/TLS certification validation params\n> +# and warn when doing no verification\n> +sub ssl_verify_params {\n> +\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n> +\n> +\tif (!defined $smtp_ssl_cert_path) {\n> +\t\t$smtp_ssl_cert_path = \"/etc/ssl/certs\";\n> +\t}\n> +\n> +\tif (-d $smtp_ssl_cert_path) {\n> +\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n> +\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n> +\t} else {\n> +\t\tprint STDERR \"warning: Using SSL_VERIFY_NONE. \" .\n> +\t\t \"See sendemail.smtpsslcertpath.\\n\";\n> +\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE);\n> +\t}\n> +}\n> +\n"},{"id":"222644","messageId":"7vehbc7tcc.fsf@alter.siamese.dyndns.org","threadId":"34355","inReplyTo":"20130705174730.GM9161@serenity.lan","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-07-05T18:30:11Z","receivedAt":"2013-07-05T18:30:11Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"John Keeping writes:\n\n> On Fri, Jul 05, 2013 at 10:20:11AM -0700, Junio C Hamano wrote:\n>> \"brian m. carlson\" writes:\n>> \n>> > You've covered the STARTTLS case, but not the SSL one right above it.\n>> > Someone using smtps on port 465 will still see the warning. You can\n>> > pass SSL_verify_mode to Net::SMTP::SSL->new just like you pass it to\n>> > start_SSL.\n>> \n>> OK, will a fix-up look like this on top of 1/2 and 2/2?\n>\n> According to IO::Socket::SSL [1], if neither SSL_ca_file nor SSL_ca_path\n> is specified then builtin defaults will be used, so I wonder if we\n> should pass SSL_VERIFY_PEER regardless (possibly with a switch for\n> SSL_VERIFY_NONE if people really need that).\n>\n> [1] http://search.cpan.org/~sullr/IO-Socket-SSL-1.951/lib/IO/Socket/SSL.pm\n\nInteresting. That frees us from saying \"we assume /etc/ssl/cacerts\nis the default location, and let the users override it\".\n\nTo help those \"I do not want verification because I know my server\ndoes not present valid certificate, I know my server is internal and\ntrustable, and I do not bother to fix it\" people, we can let them\nspecify an empty string (or any non-directory) as the CACertPath,\nand structure the code like so?\n\n if (defined $smtp_ssl_cert_path && -d $smtp_ssl_cert_path) {\n return (SSL_verify_mode => SSL_VERIFY_PEER,\n SSL_ca_path => $smtp_ssl_cert_path);\n } elsif (defined $smtp_ssl_cert_path) {\n return (SSL_verify_mode => SSL_VERIFY_NONE);\n } else {\n return (SSL_verify_mode => SSL_VERIFY_PEER);\n }\n"},{"id":"222647","messageId":"20130705184333.GN9161@serenity.lan","threadId":"34355","inReplyTo":"7vehbc7tcc.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"John Keeping","fromEmail":"john@keeping.me.uk","sentAt":"2013-07-05T18:43:33Z","receivedAt":"2013-07-05T18:43:33Z","isPatch":true,"sender":{"key":"john@keeping.me.uk","avatar":"https://avatars.githubusercontent.com/u/1702081?v=4"},"body":"On Fri, Jul 05, 2013 at 11:30:11AM -0700, Junio C Hamano wrote:\n> John Keeping writes:\n> \n> > On Fri, Jul 05, 2013 at 10:20:11AM -0700, Junio C Hamano wrote:\n> >> \"brian m. carlson\" writes:\n> >> \n> >> > You've covered the STARTTLS case, but not the SSL one right above it.\n> >> > Someone using smtps on port 465 will still see the warning. You can\n> >> > pass SSL_verify_mode to Net::SMTP::SSL->new just like you pass it to\n> >> > start_SSL.\n> >> \n> >> OK, will a fix-up look like this on top of 1/2 and 2/2?\n> >\n> > According to IO::Socket::SSL [1], if neither SSL_ca_file nor SSL_ca_path\n> > is specified then builtin defaults will be used, so I wonder if we\n> > should pass SSL_VERIFY_PEER regardless (possibly with a switch for\n> > SSL_VERIFY_NONE if people really need that).\n> >\n> > [1] http://search.cpan.org/~sullr/IO-Socket-SSL-1.951/lib/IO/Socket/SSL.pm\n> \n> Interesting. That frees us from saying \"we assume /etc/ssl/cacerts\n> is the default location, and let the users override it\".\n> \n> To help those \"I do not want verification because I know my server\n> does not present valid certificate, I know my server is internal and\n> trustable, and I do not bother to fix it\" people, we can let them\n> specify an empty string (or any non-directory) as the CACertPath,\n> and structure the code like so?\n> \n> if (defined $smtp_ssl_cert_path && -d $smtp_ssl_cert_path) {\n> return (SSL_verify_mode => SSL_VERIFY_PEER,\n> SSL_ca_path => $smtp_ssl_cert_path);\n> } elsif (defined $smtp_ssl_cert_path) {\n> return (SSL_verify_mode => SSL_VERIFY_NONE);\n> } else {\n> return (SSL_verify_mode => SSL_VERIFY_PEER);\n> }\n\nI'd rather have '$smtp_ssl_cert_path ne \"\"' in the first if condition\n(instead of the '-d $smtp_ssl_cert_path') but that seems reasonable and\nagrees with my reading of the documentation.\n\nPerhaps a complete solution could allow CA files as well:\n\n\tif (defined $smtp_ssl_cert_path) {\n\t\tif ($smtp_ssl_cert_path eq \"\") {\n\t\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE);\n\t\t} elsif (-f $smtp_ssl_cert_path) {\n\t\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n\t\t\t\tSSL_ca_file => $smtp_ssl_cert_path);\n\t\t} else {\n\t\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n\t\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n\t\t}\n\t} else {\n\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER);\n\t}\n"},{"id":"222651","messageId":"20130705202948.GW862789@vauxhall.crustytoothpaste.net","threadId":"34355","inReplyTo":"7vobag7wl0.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2013-07-05T20:29:48Z","receivedAt":"2013-07-05T20:29:48Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Fri, Jul 05, 2013 at 10:20:11AM -0700, Junio C Hamano wrote:\n> +# Helper to come up with SSL/TLS certification validation params\n> +# and warn when doing no verification\n> +sub ssl_verify_params {\n> +\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n\nYou might as well put this at the top of the file, because all use\nstatements happen at compile time anyway, regardless of their location.\nIf you want to lazy-load this, you need to do:\n\nrequire IO::Socket::SSL;\nIO::Socket::SSL->import(qw(SSL_VERIFY_PEER SSL_VERIFY_NONE));\n\nwhich is equivalent to \"use\" except that it happens at runtime.\n\nOtherwise, it looks fine.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"222666","messageId":"7v1u7c6w7z.fsf@alter.siamese.dyndns.org","threadId":"34355","inReplyTo":"20130705184333.GN9161@serenity.lan","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-07-06T06:25:36Z","receivedAt":"2013-07-06T06:25:36Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"John Keeping writes:\n\n> I'd rather have '$smtp_ssl_cert_path ne \"\"' in the first if condition\n> (instead of the '-d $smtp_ssl_cert_path') ...\n\nI agree. The signal for \"no certs\" should be an explicit \"nonsense\"\nvalue like an empty string, not just a string that does not name an\nexpected filesystem object. Otherwise people can misspell paths and\ndisable the validation by accident.\n\n> Perhaps a complete solution could allow CA files as well.\n\nYes, that would be a good idea. Care to roll into a \"fixup!\" patch\nagainst [2/2]?\n\n> \tif (defined $smtp_ssl_cert_path) {\n> \t\tif ($smtp_ssl_cert_path eq \"\") {\n> \t\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE);\n> \t\t} elsif (-f $smtp_ssl_cert_path) {\n> \t\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n> \t\t\t\tSSL_ca_file => $smtp_ssl_cert_path);\n> \t\t} else {\n> \t\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n> \t\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n> \t\t}\n> \t} else {\n> \t\treturn (SSL_verify_mode => SSL_VERIFY_PEER);\n> \t}\n\nTwo things that worry me a bit are:\n\n (1) At the end user UI level, it may look nice to accept some form\n of --no-option-name to say \"I have been using SSL against my\n server with handrolled cert, and I want to keep using the\n verify-none option\"; \"--ssl-cert-path=\" looks somewhat ugly.\n The same goes for [sendemail] ssl_cert_path = \"\" config.\n\n (2) How loudly does the new code barf when no configuration is done\n (i.e. we just pass SSL_VERIFY_PEER and let the system default\n CA path to take effect) and the server cert does not validate?\n The warning that triggered this thread, if we had the\n configuration mechanism we have been designing together, would\n have been a good reminder for the user to use it, but would we\n give a similar (less noisy is fine, as long as it is clear)\n diagnostic message?\n"},{"id":"222670","messageId":"20130706114600.GP9161@serenity.lan","threadId":"34355","inReplyTo":"7v1u7c6w7z.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"John Keeping","fromEmail":"john@keeping.me.uk","sentAt":"2013-07-06T11:46:00Z","receivedAt":"2013-07-06T11:46:00Z","isPatch":true,"sender":{"key":"john@keeping.me.uk","avatar":"https://avatars.githubusercontent.com/u/1702081?v=4"},"body":"On Fri, Jul 05, 2013 at 11:25:36PM -0700, Junio C Hamano wrote:\n> John Keeping writes:\n> \n> > I'd rather have '$smtp_ssl_cert_path ne \"\"' in the first if condition\n> > (instead of the '-d $smtp_ssl_cert_path') ...\n> \n> I agree. The signal for \"no certs\" should be an explicit \"nonsense\"\n> value like an empty string, not just a string that does not name an\n> expected filesystem object. Otherwise people can misspell paths and\n> disable the validation by accident.\n> \n> > Perhaps a complete solution could allow CA files as well.\n> \n> Yes, that would be a good idea. Care to roll into a \"fixup!\" patch\n> against [2/2]?\n\nHere's a patch that should do that. However, when testing this I\ncouldn't get the \"SSL_verify_mode\" warning to disappear and\ngit-send-email kept connecting to my untrusted server - this was using\nthe SSL code path not the TLS upgrade one.\n\nI think this is caused by the SSL_verify_mode argument not getting all\nthe way down to the configure_SSL function in IO::Socket::SSL but I\ncan't see what the code in git-send-email is doing wrong. Can any Perl\nexperts point out what's going wrong?\n\nAlso, I tried Brian's \"IO::Socket::SSL->import(qw(SSL_VERIFY_PEER\nSSL_VERIFY_NONE));\" but that produced a warning message about the uses\nof SSL_VERIFY_PEER and SSL_VERIFY_NONE following that statement, so I\nended up qualifying each use in the code below.\n\n-- >8 --\ndiff --git a/Documentation/git-send-email.txt b/Documentation/git-send-email.txt\nindex 605f263..b56c215 100644\n--- a/Documentation/git-send-email.txt\n+++ b/Documentation/git-send-email.txt\n@@ -198,6 +198,10 @@ must be used for each option.\n --smtp-ssl::\n \tLegacy alias for '--smtp-encryption ssl'.\n \n+--smtp-ssl-verify::\n+--no-smtp-ssl-verify::\n+\tEnable SSL certificate verification. Defaults to on.\n+\n --smtp-ssl-cert-path::\n \tPath to ca-certificates. Defaults to `/etc/ssl/certs`, or\n \t'sendemail.smtpsslcertpath'.\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex 3b80340..cbe85aa 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -69,8 +69,10 @@ git send-email [options] \n --smtp-pass * Password for SMTP-AUTH; not necessary.\n --smtp-encryption * tls or ssl; anything else disables.\n --smtp-ssl * Deprecated. Use '--smtp-encryption ssl'.\n+ --[no-]smtp-ssl-verify * Enable SSL certificate verification.\n+ Default on.\n --smtp-ssl-cert-path * Path to ca-certificates. Defaults to\n- /etc/ssl/certs.\n+ a platform-specific value.\n --smtp-domain * The domain name sent to HELO/EHLO handshake\n --smtp-debug <0|1> * Disable, enable Net::SMTP debug.\n \n@@ -197,7 +199,7 @@ my ($thread, $chain_reply_to, $suppress_from, $signed_off_by_cc);\n my ($to_cmd, $cc_cmd);\n my ($smtp_server, $smtp_server_port, @smtp_server_options);\n my ($smtp_authuser, $smtp_encryption);\n-my ($smtp_ssl_cert_path);\n+my ($smtp_ssl_verify, $smtp_ssl_cert_path);\n my ($identity, $aliasfiletype, @alias_files, $smtp_domain);\n my ($validate, $confirm);\n my (@suppress_cc);\n@@ -214,6 +216,7 @@ my %config_bool_settings = (\n \"suppressfrom\" => [\\$suppress_from, undef],\n \"signedoffbycc\" => [\\$signed_off_by_cc, undef],\n \"signedoffcc\" => [\\$signed_off_by_cc, undef], # Deprecated\n+ \"smtpsslverify\" => [\\$smtp_ssl_verify, 1],\n \"validate\" => [\\$validate, 1],\n \"multiedit\" => [\\$multiedit, undef],\n \"annotate\" => [\\$annotate, undef]\n@@ -306,6 +309,8 @@ my $rc = GetOptions(\"h\" => \\$help,\n \t\t \"smtp-pass:s\" => \\$smtp_authpass,\n \t\t \"smtp-ssl\" => sub { $smtp_encryption = 'ssl' },\n \t\t \"smtp-encryption=s\" => \\$smtp_encryption,\n+\t\t \"smtp-ssl-cert-path=s\" => \\$smtp_ssl_cert_path,\n+\t\t \"smtp-ssl-verify!\" => \\$smtp_ssl_verify,\n \t\t \"smtp-debug:i\" => \\$debug_net_smtp,\n \t\t \"smtp-domain:s\" => \\$smtp_domain,\n \t\t \"identity=s\" => \\$identity,\n@@ -1096,19 +1101,18 @@ sub smtp_auth_maybe {\n # Helper to come up with SSL/TLS certification validation params\n # and warn when doing no verification\n sub ssl_verify_params {\n-\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n-\n-\tif (!defined $smtp_ssl_cert_path) {\n-\t\t$smtp_ssl_cert_path = \"/etc/ssl/certs\";\n+\tif ($smtp_ssl_verify == 0) {\n+\t\treturn (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_NONE);\n \t}\n \n-\tif (-d $smtp_ssl_cert_path) {\n-\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n-\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n+\tif (! defined $smtp_ssl_cert_path) {\n+\t\treturn (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_PEER);\n+\t} elsif (-f $smtp_ssl_cert_path) {\n+\t\treturn (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_PEER,\n+\t\t\tSSL_ca_file => $smtp_ssl_cert_path);\n \t} else {\n-\t\tprint STDERR \"warning: Using SSL_VERIFY_NONE. \" .\n-\t\t \"See sendemail.smtpsslcertpath.\\n\";\n-\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE);\n+\t\treturn (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_PEER,\n+\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n \t}\n }\n \n-- 8< --\n\n> > \tif (defined $smtp_ssl_cert_path) {\n> > \t\tif ($smtp_ssl_cert_path eq \"\") {\n> > \t\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE);\n> > \t\t} elsif (-f $smtp_ssl_cert_path) {\n> > \t\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n> > \t\t\t\tSSL_ca_file => $smtp_ssl_cert_path);\n> > \t\t} else {\n> > \t\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER,\n> > \t\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n> > \t\t}\n> > \t} else {\n> > \t\treturn (SSL_verify_mode => SSL_VERIFY_PEER);\n> > \t}\n> \n> Two things that worry me a bit are:\n> \n> (1) At the end user UI level, it may look nice to accept some form\n> of --no-option-name to say \"I have been using SSL against my\n> server with handrolled cert, and I want to keep using the\n> verify-none option\"; \"--ssl-cert-path=\" looks somewhat ugly.\n> The same goes for [sendemail] ssl_cert_path = \"\" config.\n> \n> (2) How loudly does the new code barf when no configuration is done\n> (i.e. we just pass SSL_VERIFY_PEER and let the system default\n> CA path to take effect) and the server cert does not validate?\n> The warning that triggered this thread, if we had the\n> configuration mechanism we have been designing together, would\n> have been a good reminder for the user to use it, but would we\n> give a similar (less noisy is fine, as long as it is clear)\n> diagnostic message?\n"},{"id":"222672","messageId":"51D82970.5070108@web.de","threadId":"34355","inReplyTo":"1373025947-26495-2-git-send-email-artagnon@gmail.com","subject":"Re: [PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"Torsten Bögershausen","fromEmail":"tboegi@web.de","sentAt":"2013-07-06T14:28:00Z","receivedAt":"2013-07-06T14:28:00Z","isPatch":true,"sender":{"key":"tboegi@web.de","avatar":"https://avatars.githubusercontent.com/u/7138363?v=4"},"body":"On 2013-07-05 14.05, Ramkumar Ramachandra wrote:\n> Due to a recent change in the Net::SMTP::SSL module, send-email emits\n> the following ugly warning everytime a email is sent via SSL:\n> \n> *******************************************************************\n> Using the default of SSL_verify_mode of SSL_VERIFY_NONE for client\n> is deprecated! Please set SSL_verify_mode to SSL_VERIFY_PEER\n> together with SSL_ca_file|SSL_ca_path for verification.\n> If you really don't want to verify the certificate and keep the\n> connection open to Man-In-The-Middle attacks please set\n> SSL_verify_mode explicitly to SSL_VERIFY_NONE in your application.\n> *******************************************************************\n> \n> Fix this by explicitly specifying SSL_verify_mode => SSL_VERIFY_NONE in\n> Net::SMTP::SSL->start_SSL().\n> \n> Helped-by: brian m. carlson \n> Signed-off-by: Ramkumar Ramachandra \n> ---\n> git-send-email.perl | 4 +++-\n> 1 file changed, 3 insertions(+), 1 deletion(-)\n> \n> diff --git a/git-send-email.perl b/git-send-email.perl\n> index ecbf56f..758100d 100755\n> --- a/git-send-email.perl\n> +++ b/git-send-email.perl\n> @@ -1193,10 +1193,12 @@ X-Mailer: git-send-email $gitversion\n> \t\t\t\t\t\t Debug => $debug_net_smtp);\n> \t\t\tif ($smtp_encryption eq 'tls' && $smtp) {\n> \t\t\t\trequire Net::SMTP::SSL;\n> +\t\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_NONE);\n> \t\t\t\t$smtp->command('STARTTLS');\n> \t\t\t\t$smtp->response();\n> \t\t\t\tif ($smtp->code == 220) {\n> -\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp)\n> +\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n> +\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n> \t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n> \t\t\t\t\t$smtp_encryption = '';\n> \t\t\t\t\t# Send EHLO again to receive fresh\n> \nHm, this doesn't work on my system, and t9001 fails:\n\n\"SSL_VERIFY_PEER\" is not exported by the IO::Socket::SSL module\n \"SSL_VERIFY_NONE\" is not exported by the IO::Socket::SSL module\nCan't continue after import errors at /Users/tb/projects/git/git.pu/git-send-email line 1090\n/Torsten\n"},{"id":"222673","messageId":"20130706143256.GX862789@vauxhall.crustytoothpaste.net","threadId":"34355","inReplyTo":"51D82970.5070108@web.de","subject":"Re: [PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2013-07-06T14:32:56Z","receivedAt":"2013-07-06T14:32:56Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Sat, Jul 06, 2013 at 04:28:00PM +0200, Torsten Bögershausen wrote:\n> On 2013-07-05 14.05, Ramkumar Ramachandra wrote:\n> > Due to a recent change in the Net::SMTP::SSL module, send-email emits\n> > the following ugly warning everytime a email is sent via SSL:\n> > \n> > *******************************************************************\n> > Using the default of SSL_verify_mode of SSL_VERIFY_NONE for client\n> > is deprecated! Please set SSL_verify_mode to SSL_VERIFY_PEER\n> > together with SSL_ca_file|SSL_ca_path for verification.\n> > If you really don't want to verify the certificate and keep the\n> > connection open to Man-In-The-Middle attacks please set\n> > SSL_verify_mode explicitly to SSL_VERIFY_NONE in your application.\n> > *******************************************************************\n> > \n> > Fix this by explicitly specifying SSL_verify_mode => SSL_VERIFY_NONE in\n> > Net::SMTP::SSL->start_SSL().\n> > \n> > Helped-by: brian m. carlson \n> > Signed-off-by: Ramkumar Ramachandra \n> > ---\n> > git-send-email.perl | 4 +++-\n> > 1 file changed, 3 insertions(+), 1 deletion(-)\n> > \n> > diff --git a/git-send-email.perl b/git-send-email.perl\n> > index ecbf56f..758100d 100755\n> > --- a/git-send-email.perl\n> > +++ b/git-send-email.perl\n> > @@ -1193,10 +1193,12 @@ X-Mailer: git-send-email $gitversion\n> > \t\t\t\t\t\t Debug => $debug_net_smtp);\n> > \t\t\tif ($smtp_encryption eq 'tls' && $smtp) {\n> > \t\t\t\trequire Net::SMTP::SSL;\n> > +\t\t\t\tuse IO::Socket::SSL qw(SSL_VERIFY_NONE);\n> > \t\t\t\t$smtp->command('STARTTLS');\n> > \t\t\t\t$smtp->response();\n> > \t\t\t\tif ($smtp->code == 220) {\n> > -\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp)\n> > +\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n> > +\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n> > \t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n> > \t\t\t\t\t$smtp_encryption = '';\n> > \t\t\t\t\t# Send EHLO again to receive fresh\n> > \n> Hm, this doesn't work on my system, and t9001 fails:\n> \n> \"SSL_VERIFY_PEER\" is not exported by the IO::Socket::SSL module\n> \"SSL_VERIFY_NONE\" is not exported by the IO::Socket::SSL module\n> Can't continue after import errors at /Users/tb/projects/git/git.pu/git-send-email line 1090\n\nWhat version of IO::Socket::SSL do you have, and what source did you get\nit from?\n\nperl -MIO::Socket::SSL -e 'print \"$IO::Socket::SSL::VERSION\\n\";'\n\nThis should be available in 1.31 or later. It might end up that we need\nto adjust the use/require statement to require 1.31.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"222675","messageId":"51D83C7E.8000902@web.de","threadId":"34355","inReplyTo":"20130706143256.GX862789@vauxhall.crustytoothpaste.net","subject":"Re: [PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"Torsten Bögershausen","fromEmail":"tboegi@web.de","sentAt":"2013-07-06T15:49:18Z","receivedAt":"2013-07-06T15:49:18Z","isPatch":true,"sender":{"key":"tboegi@web.de","avatar":"https://avatars.githubusercontent.com/u/7138363?v=4"},"body":"On 2013-07-06 16.32, brian m. carlson wrote:\n> perl -MIO::Socket::SSL -e 'print \"$IO::Socket::SSL::VERSION\\n\";'\n\nMac OS X, 10.6:\n(I think this perl we use for git:)\n/usr/bin/perl -MIO::Socket::SSL -e 'print \"$IO::Socket::SSL::VERSION\\n\";'\n1.22\n\n(And this is in my path:)\n which perl\n/opt/local/bin/perl\n\nperl -MIO::Socket::SSL -e 'print \"$IO::Socket::SSL::VERSION\\n\";'\nCan't locate IO/Socket/SSL.pm in @INC (@INC contains: /sw/lib/perl5 /sw/lib/perl5/darwin /opt/local/lib/perl5/site_perl/5.8.9/darwin-2level /opt/local/lib/perl5/site_perl/5.8.9 /opt/local/lib/perl5/site_perl /opt/local/lib/perl5/vendor_perl/5.8.9/darwin-2level /opt/local/lib/perl5/vendor_perl/5.8.9 /opt/local/lib/perl5/vendor_perl /opt/local/lib/perl5/5.8.9/darwin-2level /opt/local/lib/perl5/5.8.9 .).\n\n/Torsten\n"},{"id":"222697","messageId":"7vppuv57ps.fsf@alter.siamese.dyndns.org","threadId":"34355","inReplyTo":"20130706114600.GP9161@serenity.lan","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-07-07T04:12:31Z","receivedAt":"2013-07-07T04:12:31Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"John Keeping writes:\n\n> @@ -1096,19 +1101,18 @@ sub smtp_auth_maybe {\n> # Helper to come up with SSL/TLS certification validation params\n> # and warn when doing no verification\n> sub ssl_verify_params {\n> -\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n> -\n> -\tif (!defined $smtp_ssl_cert_path) {\n> -\t\t$smtp_ssl_cert_path = \"/etc/ssl/certs\";\n> +\tif ($smtp_ssl_verify == 0) {\n> +\t\treturn (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_NONE);\n\nI do not see any \"use IO::Socket::SSL\" anywhere after applying this\npatch. Is this expected to work?\n"},{"id":"222702","messageId":"20130707055438.GA1730@sigill.intra.peff.net","threadId":"34355","inReplyTo":"20130705202948.GW862789@vauxhall.crustytoothpaste.net","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-07-07T05:54:38Z","receivedAt":"2013-07-07T05:54:38Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Jul 05, 2013 at 08:29:48PM +0000, brian m. carlson wrote:\n\n> On Fri, Jul 05, 2013 at 10:20:11AM -0700, Junio C Hamano wrote:\n> > +# Helper to come up with SSL/TLS certification validation params\n> > +# and warn when doing no verification\n> > +sub ssl_verify_params {\n> > +\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n> \n> You might as well put this at the top of the file, because all use\n> statements happen at compile time anyway, regardless of their location.\n> If you want to lazy-load this, you need to do:\n> \n> require IO::Socket::SSL;\n> IO::Socket::SSL->import(qw(SSL_VERIFY_PEER SSL_VERIFY_NONE));\n> \n> which is equivalent to \"use\" except that it happens at runtime.\n\nI think we _must_ lazy load this, or else we are breaking git-send-email\nusers on platforms that do not have IO::Socket::SSL (and do not plan on\nusing SSL themselves).\n\nThe same goes for the \"use\" in patch 1/2.\n\n-Peff\n"},{"id":"222727","messageId":"20130707090200.GQ9161@serenity.lan","threadId":"34355","inReplyTo":"7vppuv57ps.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"John Keeping","fromEmail":"john@keeping.me.uk","sentAt":"2013-07-07T09:02:01Z","receivedAt":"2013-07-07T09:02:01Z","isPatch":true,"sender":{"key":"john@keeping.me.uk","avatar":"https://avatars.githubusercontent.com/u/1702081?v=4"},"body":"On Sat, Jul 06, 2013 at 09:12:31PM -0700, Junio C Hamano wrote:\n> John Keeping writes:\n> \n> > @@ -1096,19 +1101,18 @@ sub smtp_auth_maybe {\n> > # Helper to come up with SSL/TLS certification validation params\n> > # and warn when doing no verification\n> > sub ssl_verify_params {\n> > -\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n> > -\n> > -\tif (!defined $smtp_ssl_cert_path) {\n> > -\t\t$smtp_ssl_cert_path = \"/etc/ssl/certs\";\n> > +\tif ($smtp_ssl_verify == 0) {\n> > +\t\treturn (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_NONE);\n> \n> I do not see any \"use IO::Socket::SSL\" anywhere after applying this\n> patch. Is this expected to work?\n\nI don't get any errors about unknown variables when running it. Do we\nget IO::Socket::SSL imported through Net::SMTP::SSL, which extends it?\n"},{"id":"222733","messageId":"7vfvvq6647.fsf@alter.siamese.dyndns.org","threadId":"34355","inReplyTo":"20130707055438.GA1730@sigill.intra.peff.net","subject":"Re: [PATCH v2 2/2] send-email: introduce sendemail.smtpsslcertpath","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-07-07T10:01:44Z","receivedAt":"2013-07-07T10:01:44Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jeff King writes:\n\n> On Fri, Jul 05, 2013 at 08:29:48PM +0000, brian m. carlson wrote:\n>\n>> On Fri, Jul 05, 2013 at 10:20:11AM -0700, Junio C Hamano wrote:\n>> > +# Helper to come up with SSL/TLS certification validation params\n>> > +# and warn when doing no verification\n>> > +sub ssl_verify_params {\n>> > +\tuse IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n>> \n>> You might as well put this at the top of the file, because all use\n>> statements happen at compile time anyway, regardless of their location.\n>> If you want to lazy-load this, you need to do:\n>> \n>> require IO::Socket::SSL;\n>> IO::Socket::SSL->import(qw(SSL_VERIFY_PEER SSL_VERIFY_NONE));\n>> \n>> which is equivalent to \"use\" except that it happens at runtime.\n>\n> I think we _must_ lazy load this, or else we are breaking git-send-email\n> users on platforms that do not have IO::Socket::SSL (and do not plan on\n> using SSL themselves).\n>\n> The same goes for the \"use\" in patch 1/2.\n\nA very good point. Thanks.\n\nAlso it appears that people seem to be seeing different behaviours\ndepending on the versions of IO::Socket::SSL they have; we may need\nto conditionalize what our code does depending on $PACKAGE::Version\nafter we do that lazy loading.\n"},{"id":"223323","messageId":"CALkWK0kAfZLqyCO+e+0PH0-MmjMYX1nJmit5Qb5L3Qf6nyhC9Q@mail.gmail.com","threadId":"34355","inReplyTo":"51D83C7E.8000902@web.de","subject":"Re: [PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"Ramkumar Ramachandra","fromEmail":"artagnon@gmail.com","sentAt":"2013-07-14T13:49:10Z","receivedAt":"2013-07-14T13:49:10Z","isPatch":true,"sender":{"key":"r@artagnon.com","avatar":"https://avatars.githubusercontent.com/u/37226?v=4"},"body":"Torsten Bögershausen wrote:\n> /usr/bin/perl -MIO::Socket::SSL -e 'print \"$IO::Socket::SSL::VERSION\\n\";'\n> 1.22\n\nThis is ancient! (I have 1.84). Is it not possible to do an\nssl-verify-peer in older versions (is it exported as something else)?\nThe older versions don't display the warning anyway, and this series\nis about squelching the warning in newer versions. Does\n\n require IO::Socket::SSL qw(SSL_VERIFY_NONE SSL_VERIFY_PEER) or print\n\"warning: not using SSL_VERIFY_PEER due to outdated IO::Socket::SSL\"\n\nsound reasonable?\n"},{"id":"223337","messageId":"20130714170316.GE11097@vauxhall.crustytoothpaste.net","threadId":"34355","inReplyTo":"CALkWK0kAfZLqyCO+e+0PH0-MmjMYX1nJmit5Qb5L3Qf6nyhC9Q@mail.gmail.com","subject":"Re: [PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2013-07-14T17:03:16Z","receivedAt":"2013-07-14T17:03:16Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Sun, Jul 14, 2013 at 07:19:10PM +0530, Ramkumar Ramachandra wrote:\n> Torsten Bögershausen wrote:\n> > /usr/bin/perl -MIO::Socket::SSL -e 'print \"$IO::Socket::SSL::VERSION\\n\";'\n> > 1.22\n> \n> This is ancient! (I have 1.84). Is it not possible to do an\n> ssl-verify-peer in older versions (is it exported as something else)?\n> The older versions don't display the warning anyway, and this series\n> is about squelching the warning in newer versions. Does\n> \n> require IO::Socket::SSL qw(SSL_VERIFY_NONE SSL_VERIFY_PEER) or print\n> \"warning: not using SSL_VERIFY_PEER due to outdated IO::Socket::SSL\"\n\nrequire doesn't take a list of symbols to import, and the import dies if\nit fails. You need:\n\nrequire IO::Socket::SSL;\neval {\n\tIO::Socket::SSL->import(qw(SSL_VERIFY_NONE SSL_VERIFY_PEER));\n};\nif ($@) {\n\twarn \"Not using SSL_VERIFY_PEER due to outdated IO::Socket::SSL\\n\";\n\t# Do something different here.\n}\n\nI didn't stick the require in the eval because git-send-email will fail\nin this case anyway if you don't have it, since Net::SMTP::SSL requires\nit. Let me know if you want a patch for this on top of the existing two\nin this series and I'll provide one.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"223359","messageId":"CALkWK0k_up65K_i+Y+kj3vqWPoC_ti5FtPUffkPwVnJqBcdReA@mail.gmail.com","threadId":"34355","inReplyTo":"20130714170316.GE11097@vauxhall.crustytoothpaste.net","subject":"Re: [PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"Ramkumar Ramachandra","fromEmail":"artagnon@gmail.com","sentAt":"2013-07-14T21:49:46Z","receivedAt":"2013-07-14T21:49:46Z","isPatch":true,"sender":{"key":"r@artagnon.com","avatar":"https://avatars.githubusercontent.com/u/37226?v=4"},"body":"brian m. carlson wrote:\n> I didn't stick the require in the eval because git-send-email will fail\n> in this case anyway if you don't have it, since Net::SMTP::SSL requires\n> it. Let me know if you want a patch for this on top of the existing two\n> in this series and I'll provide one.\n\nYeah, that'd be nice. I'm not enjoying this Perl-wrestling very much.\n"},{"id":"223365","messageId":"51E3677D.6040903@web.de","threadId":"34355","inReplyTo":"20130714170316.GE11097@vauxhall.crustytoothpaste.net","subject":"Re: [PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"Torsten Bögershausen","fromEmail":"tboegi@web.de","sentAt":"2013-07-15T03:07:41Z","receivedAt":"2013-07-15T03:07:41Z","isPatch":true,"sender":{"key":"tboegi@web.de","avatar":"https://avatars.githubusercontent.com/u/7138363?v=4"},"body":"On 2013-07-14 19.03, brian m. carlson wrote:\n> On Sun, Jul 14, 2013 at 07:19:10PM +0530, Ramkumar Ramachandra wrote:\n>> Torsten Bögershausen wrote:\n>>> /usr/bin/perl -MIO::Socket::SSL -e 'print \"$IO::Socket::SSL::VERSION\\n\";'\n>>> 1.22\n>>\n>> This is ancient! (I have 1.84). Is it not possible to do an\n>> ssl-verify-peer in older versions (is it exported as something else)?\n>> The older versions don't display the warning anyway, and this series\n>> is about squelching the warning in newer versions. Does\n>>\n>> require IO::Socket::SSL qw(SSL_VERIFY_NONE SSL_VERIFY_PEER) or print\n>> \"warning: not using SSL_VERIFY_PEER due to outdated IO::Socket::SSL\"\n> \n> require doesn't take a list of symbols to import, and the import dies if\n> it fails. You need:\n> \n> require IO::Socket::SSL;\n> eval {\n> \tIO::Socket::SSL->import(qw(SSL_VERIFY_NONE SSL_VERIFY_PEER));\n> };\n> if ($@) {\n> \twarn \"Not using SSL_VERIFY_PEER due to outdated IO::Socket::SSL\\n\";\n> \t# Do something different here.\n> }\n> \n> I didn't stick the require in the eval because git-send-email will fail\n> in this case anyway if you don't have it, since Net::SMTP::SSL requires\n> it. Let me know if you want a patch for this on top of the existing two\n> in this series and I'll provide one.\n> \nPlease send a patch if possible.\nI can volonteer to test it here, but it can take a couple of days to respond.\n"},{"id":"223372","messageId":"7vvc4ce9wh.fsf@alter.siamese.dyndns.org","threadId":"34355","inReplyTo":"51E3677D.6040903@web.de","subject":"Re: [PATCH v2 1/2] send-email: squelch warning from Net::SMTP::SSL","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-07-15T04:15:26Z","receivedAt":"2013-07-15T04:15:26Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Torsten Bögershausen writes:\n\n>> I didn't stick the require in the eval because git-send-email will fail\n>> in this case anyway if you don't have it, since Net::SMTP::SSL requires\n>> it. Let me know if you want a patch for this on top of the existing two\n>> in this series and I'll provide one.\n>> \n> Please send a patch if possible.\n> I can volonteer to test it here, but it can take a couple of days to respond.\n\nThanks all.\n"},{"id":"223493","messageId":"20130716001506.GG11097@vauxhall.crustytoothpaste.net","threadId":"34355","inReplyTo":"51E3677D.6040903@web.de","subject":"[PATCH] send-email: improve SSL certificate verification","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2013-07-16T00:15:06Z","receivedAt":"2013-07-16T00:15:06Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"The SSL and TLS code for SMTP is non-trivial, so refactor it into a separate\nfunction for ease of use. Handle both files and directories as sources for CA\ncertificates. Also add handling for older version of IO::Socket::SSL that do\nnot support the SSL_VERIFY_PEER and SSL_VERIFY_NONE constants; in this case,\nprint a warning and inform the user of this fact.\n\nSigned-off-by: brian m. carlson \n---\n\nThis is completely untested. I used perl -c, but that's it.\n\n git-send-email.perl | 50 ++++++++++++++++++++++++++++++++++++--------------\n 1 file changed, 36 insertions(+), 14 deletions(-)\n\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex 095b6fb..11fb2d0 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -1083,6 +1083,37 @@ sub smtp_auth_maybe {\n \treturn $auth;\n }\n \n+sub ssl_verify_params {\n+\trequire IO::Socket::SSL;\n+\teval {\n+\t\tIO::Socket::SSL->import(qw/SSL_VERIFY_PEER SSL_VERIFY_NONE/);\n+\t};\n+\tif ($@) {\n+\t\tprint STDERR \"Not using SSL_VERIFY_PEER due to out-of-date IO::Socket::SSL.\\n\";\n+\t\treturn;\n+\t}\n+\n+\tif (!defined $smtp_ssl_cert_path) {\n+\t\t$smtp_ssl_cert_path ||= \"/etc/ssl/certs\";\n+\t}\n+\n+\tif (!$smtp_ssl_cert_path) {\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE());\n+\t}\n+\telsif (-d $smtp_ssl_cert_path) {\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER(),\n+\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n+\t}\n+\telsif (-f $smtp_ssl_cert_path) {\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER(),\n+\t\t\tSSL_ca_file => $smtp_ssl_cert_path);\n+\t}\n+\telse {\n+\t\tprint STDERR \"Not using SSL_VERIFY_PEER because the CA path does not exist.\\n\";\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE());\n+\t}\n+}\n+\n # Returns 1 if the message was sent, and 0 otherwise.\n # In actuality, the whole program dies when there\n # is an error sending a message.\n@@ -1187,7 +1218,8 @@ X-Mailer: git-send-email $gitversion\n \t\t\t$smtp_domain ||= maildomain();\n \t\t\t$smtp ||= Net::SMTP::SSL->new($smtp_server,\n \t\t\t\t\t\t Hello => $smtp_domain,\n-\t\t\t\t\t\t Port => $smtp_server_port);\n+\t\t\t\t\t\t Port => $smtp_server_port,\n+\t\t\t\t\t\t\t ssl_verify_params());\n \t\t}\n \t\telse {\n \t\t\trequire Net::SMTP;\n@@ -1203,19 +1235,9 @@ X-Mailer: git-send-email $gitversion\n \t\t\t\t$smtp->command('STARTTLS');\n \t\t\t\t$smtp->response();\n \t\t\t\tif ($smtp->code == 220) {\n-\t\t\t\t\t# Attempt to use a ca-certificate by default\n-\t\t\t\t\t$smtp_ssl_cert_path |= \"/etc/ssl/certs\";\n-\t\t\t\t\tif (-d $smtp_ssl_cert_path) {\n-\t\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n-\t\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_PEER,\n-\t\t\t\t\t\t\t\t\t\t SSL_ca_path => $smtp_ssl_cert_path)\n-\t\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n-\t\t\t\t\t} else {\n-\t\t\t\t\t\tprint STDERR \"warning: Using SSL_VERIFY_NONE. See sendemail.smtpsslcertpath.\\n\";\n-\t\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n-\t\t\t\t\t\t\t\t\t\t SSL_verify_mode => SSL_VERIFY_NONE)\n-\t\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n-\t\t\t\t\t}\n+\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n+\t\t\t\t\t\t\t\t\t ssl_verify_params())\n+\t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n \t\t\t\t\t$smtp_encryption = '';\n \t\t\t\t\t# Send EHLO again to receive fresh\n \t\t\t\t\t# supported commands\n-- \n1.8.3.2.923.g2a18ff8.dirty\n\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"223496","messageId":"51E4B113.8000009@web.de","threadId":"34355","inReplyTo":"20130716001506.GG11097@vauxhall.crustytoothpaste.net","subject":"Re: [PATCH] send-email: improve SSL certificate verification","fromName":"Torsten Bögershausen","fromEmail":"tboegi@web.de","sentAt":"2013-07-16T02:33:55Z","receivedAt":"2013-07-16T02:33:55Z","isPatch":true,"sender":{"key":"tboegi@web.de","avatar":"https://avatars.githubusercontent.com/u/7138363?v=4"},"body":"[snip]\nI wasn't sure where to apply the patch, so I manually copy/paste it\non top of pu:\ncommit 6b1ca0f4d443ee8716857b871b0513ae85c9f112\nMerge: bce90ab f351fcf\n\nThanks, t9001 passes on Mac OS X 10.6.\nTo be sure I didn't messed it up, please see the diff below.\nWhen it shows up on pu, I can re-test of course.\n\n\n\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex a9a6661..a965b8e 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -28,7 +28,7 @@ use File::Temp qw/ tempdir tempfile /;\n use File::Spec::Functions qw(catfile);\n use Error qw(:try);\n use Git;\n-use IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n+#use IO::Socket::SSL qw(SSL_VERIFY_PEER SSL_VERIFY_NONE);\n \n Getopt::Long::Configure qw/ pass_through /;\n \n@@ -1092,19 +1092,34 @@ sub smtp_auth_maybe {\n # Helper to come up with SSL/TLS certification validation params\n # and warn when doing no verification\n sub ssl_verify_params {\n- if ($smtp_ssl_verify == 0) {\n- return (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_NONE);\n+ require IO::Socket::SSL;\n+ eval {\n+ IO::Socket::SSL->import(qw/SSL_VERIFY_PEER SSL_VERIFY_NONE/);\n+ };\n+ if ($@) {\n+ print STDERR \"Not using SSL_VERIFY_PEER due to out-of-date IO::Socket::SSL.\\n\";\n+ return;\n }\n \n- if (! defined $smtp_ssl_cert_path) {\n- return (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_PEER);\n- } elsif (-f $smtp_ssl_cert_path) {\n- return (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_PEER,\n- SSL_ca_file => $smtp_ssl_cert_path);\n- } else {\n- return (SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_PEER,\n+ if (!defined $smtp_ssl_cert_path) {\n+ $smtp_ssl_cert_path ||= \"/etc/ssl/certs\";\n+ }\n+\n+ if (!$smtp_ssl_cert_path) {\n+ return (SSL_verify_mode => SSL_VERIFY_NONE());\n+ }\n+ elsif (-d $smtp_ssl_cert_path) {\n+ return (SSL_verify_mode => SSL_VERIFY_PEER(),\n SSL_ca_path => $smtp_ssl_cert_path);\n }\n+ elsif (-f $smtp_ssl_cert_path) {\n+ return (SSL_verify_mode => SSL_VERIFY_PEER(),\n+ SSL_ca_file => $smtp_ssl_cert_path);\n+ }\n+ else {\n+ print STDERR \"Not using SSL_VERIFY_PEER because the CA path does not exist.\\n\";\n+ return (SSL_verify_mode => SSL_VERIFY_NONE());\n+ }\n }\n \n # Returns 1 if the message was sent, and 0 otherwise.\n@@ -1229,13 +1244,8 @@ X-Mailer: git-send-email $gitversion\n if ($smtp->code == 220) {\n $smtp = Net::SMTP::SSL->start_SSL($smtp,\n ssl_verify_params())\n- or die \"STARTTLS failed! \".$smtp->message;\n- $smtp_encryption = '';\n- # Send EHLO again to receive fresh\n- # supported commands\n- $smtp->hello($smtp_domain);\n- } else {\n- die \"Server does not support STARTTLS! \".$smtp->message;\n+ or die \"STARTTLS failed! \".$smtp->message;\n+\n }\n }\n }\n"},{"id":"223497","messageId":"20130716023549.GH11097@vauxhall.crustytoothpaste.net","threadId":"34355","inReplyTo":"51E4B113.8000009@web.de","subject":"Re: [PATCH] send-email: improve SSL certificate verification","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2013-07-16T02:35:49Z","receivedAt":"2013-07-16T02:35:49Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Tue, Jul 16, 2013 at 04:33:55AM +0200, Torsten Bögershausen wrote:\n> [snip]\n> I wasn't sure where to apply the patch, so I manually copy/paste it\n> on top of pu:\n> commit 6b1ca0f4d443ee8716857b871b0513ae85c9f112\n> Merge: bce90ab f351fcf\n> \n> Thanks, t9001 passes on Mac OS X 10.6.\n> To be sure I didn't messed it up, please see the diff below.\n> When it shows up on pu, I can re-test of course.\n\nYeah, that looks fine.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"223656","messageId":"7vd2qf4xoo.fsf_-_@alter.siamese.dyndns.org","threadId":"34355","inReplyTo":"51E4B113.8000009@web.de","subject":"Re* [PATCH] send-email: improve SSL certificate verification","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-07-18T16:53:11Z","receivedAt":"2013-07-18T16:53:11Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Torsten Bögershausen writes:\n\n> I wasn't sure where to apply the patch, so I manually copy/paste it\n> on top of pu:\n> commit 6b1ca0f4d443ee8716857b871b0513ae85c9f112\n> Merge: bce90ab f351fcf\n>\n> Thanks, t9001 passes on Mac OS X 10.6.\n> To be sure I didn't messed it up, please see the diff below.\n> When it shows up on pu, I can re-test of course.\n\nAs the history of rr/send-email-ssl-verify needs rewriting to squash\nthis change in, here is a single patch with which I would propose to\nreplace all the commits accumulated on that branch.\n\nRamkumar, as you will still be the primary author of the resulting\ncommit, I tentatively added a line for your sign-off even though you\nhaven't signed off _this_ version yet, so that I would not forget.\nIf this version looks good, please tell us you would.\n\nTorsten, I have Tested-by with your name, again so that I would not\nforget, but obviously this one hasn't been tested by you yet. If\nthis tests OK, please tell us so.\n\nThanks.\n\n-- >8 --\nFrom: Ramkumar Ramachandra \nSubject: send-email: be explicit with SSL certificate verification\n\nWhen initiating an SSL connection without explicitly specifying the\nSSL certificate verification mode, Net::SMTP::SSL defaults to no\nverification, but recent versions of the module gives a warning\nagainst this use of the default.\n\nEnable certificate verification by default, using /etc/ssl/certs as\nthe default path for certificates of certificate authorities. This\npath can be overriden by the --smtp-ssl-cert-path command line\noption and the sendemail.smtpSSLCertPath configuration variable.\n\nPassing an empty string as the path for CA certificates path disables\nthe SSL certificate verification explicitly, which does not trigger\nthe warning from recent versions of Net::SMTP::SSL.\n\n(PROVISO) Signed-off-by: Ramkumar Ramachandra \nHelped-by: Brian M. Carlson \n(PROVISO) Tested-by: Torsten Bögershausen \nSigned-off-by: Junio C Hamano \n---\n Documentation/config.txt | 4 ++++\n Documentation/git-send-email.txt | 6 ++++++\n git-send-email.perl | 41 +++++++++++++++++++++++++++++++++++++---\n 3 files changed, 48 insertions(+), 3 deletions(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex 6e53fc5..4de154c 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -2022,6 +2022,10 @@ sendemail.smtpencryption::\n sendemail.smtpssl::\n \tDeprecated alias for 'sendemail.smtpencryption = ssl'.\n \n+sendemail.smtpsslcertpath::\n+\tPath to ca-certificates (either a directory or a single file).\n+\tSet it to an empty string to disable certificate verification.\n+\n sendemail..*::\n \tIdentity-specific versions of the 'sendemail.*' parameters\n \tfound below, taking precedence over those when the this\ndiff --git a/Documentation/git-send-email.txt b/Documentation/git-send-email.txt\nindex 40a9a9a..f0e57a5 100644\n--- a/Documentation/git-send-email.txt\n+++ b/Documentation/git-send-email.txt\n@@ -198,6 +198,12 @@ must be used for each option.\n --smtp-ssl::\n \tLegacy alias for '--smtp-encryption ssl'.\n \n+--smtp-ssl-cert-path::\n+\tPath to ca-certificates (either a directory or a single file).\n+\tSet it to an empty string to disable certificate verification.\n+\tDefaults to the value set to the 'sendemail.smtpsslcertpath'\n+\tconfiguration variable, if set, or `/etc/ssl/certs` otherwise.\n+\n --smtp-user=::\n \tUsername for SMTP-AUTH. Default is the value of 'sendemail.smtpuser';\n \tif a username is not specified (with '--smtp-user' or 'sendemail.smtpuser'),\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex bd13cc8..60eaed3 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -69,6 +69,9 @@ sub usage {\n --smtp-pass * Password for SMTP-AUTH; not necessary.\n --smtp-encryption * tls or ssl; anything else disables.\n --smtp-ssl * Deprecated. Use '--smtp-encryption ssl'.\n+ --smtp-ssl-cert-path * Path to ca-certificates (either directory or file).\n+ Pass an empty string to disable certificate\n+ verification.\n --smtp-domain * The domain name sent to HELO/EHLO handshake\n --smtp-debug <0|1> * Disable, enable Net::SMTP debug.\n \n@@ -194,7 +197,7 @@ sub do_edit {\n my ($thread, $chain_reply_to, $suppress_from, $signed_off_by_cc);\n my ($to_cmd, $cc_cmd);\n my ($smtp_server, $smtp_server_port, @smtp_server_options);\n-my ($smtp_authuser, $smtp_encryption);\n+my ($smtp_authuser, $smtp_encryption, $smtp_ssl_cert_path);\n my ($identity, $aliasfiletype, @alias_files, $smtp_domain);\n my ($validate, $confirm);\n my (@suppress_cc);\n@@ -222,6 +225,7 @@ sub do_edit {\n \"smtpserveroption\" => \\@smtp_server_options,\n \"smtpuser\" => \\$smtp_authuser,\n \"smtppass\" => \\$smtp_authpass,\n+ \"smtpsslcertpath\" => \\$smtp_ssl_cert_path,\n \"smtpdomain\" => \\$smtp_domain,\n \"to\" => \\@initial_to,\n \"tocmd\" => \\$to_cmd,\n@@ -302,6 +306,7 @@ sub signal_handler {\n \t\t \"smtp-pass:s\" => \\$smtp_authpass,\n \t\t \"smtp-ssl\" => sub { $smtp_encryption = 'ssl' },\n \t\t \"smtp-encryption=s\" => \\$smtp_encryption,\n+\t\t \"smtp-ssl-cert-path\" => \\$smtp_ssl_cert_path,\n \t\t \"smtp-debug:i\" => \\$debug_net_smtp,\n \t\t \"smtp-domain:s\" => \\$smtp_domain,\n \t\t \"identity=s\" => \\$identity,\n@@ -1089,6 +1094,34 @@ sub smtp_auth_maybe {\n \treturn $auth;\n }\n \n+sub ssl_verify_params {\n+\teval {\n+\t\trequire IO::Socket::SSL;\n+\t\tIO::Socket::SSL->import(qw/SSL_VERIFY_PEER SSL_VERIFY_NONE/);\n+\t};\n+\tif ($@) {\n+\t\tprint STDERR \"Not using SSL_VERIFY_PEER due to out-of-date IO::Socket::SSL.\\n\";\n+\t\treturn;\n+\t}\n+\n+\tif (!defined $smtp_ssl_cert_path) {\n+\t\t$smtp_ssl_cert_path = \"/etc/ssl/certs\";\n+\t}\n+\n+\tif ($smtp_ssl_cert_path eq \"\") {\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE());\n+\t} elsif (-d $smtp_ssl_cert_path) {\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER(),\n+\t\t\tSSL_ca_path => $smtp_ssl_cert_path);\n+\t} elsif (-f $smtp_ssl_cert_path) {\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_PEER(),\n+\t\t\tSSL_ca_file => $smtp_ssl_cert_path);\n+\t} else {\n+\t\tprint STDERR \"Not using SSL_VERIFY_PEER because the CA path does not exist.\\n\";\n+\t\treturn (SSL_verify_mode => SSL_VERIFY_NONE());\n+\t}\n+}\n+\n # Returns 1 if the message was sent, and 0 otherwise.\n # In actuality, the whole program dies when there\n # is an error sending a message.\n@@ -1194,7 +1227,8 @@ sub send_message {\n \t\t\t$smtp_domain ||= maildomain();\n \t\t\t$smtp ||= Net::SMTP::SSL->new($smtp_server,\n \t\t\t\t\t\t Hello => $smtp_domain,\n-\t\t\t\t\t\t Port => $smtp_server_port);\n+\t\t\t\t\t\t Port => $smtp_server_port,\n+\t\t\t\t\t\t ssl_verify_params());\n \t\t}\n \t\telse {\n \t\t\trequire Net::SMTP;\n@@ -1207,7 +1241,8 @@ sub send_message {\n \t\t\t\t$smtp->command('STARTTLS');\n \t\t\t\t$smtp->response();\n \t\t\t\tif ($smtp->code == 220) {\n-\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp)\n+\t\t\t\t\t$smtp = Net::SMTP::SSL->start_SSL($smtp,\n+\t\t\t\t\t\t\t\t\t ssl_verify_params())\n \t\t\t\t\t\tor die \"STARTTLS failed! \".$smtp->message;\n \t\t\t\t\t$smtp_encryption = '';\n \t\t\t\t\t# Send EHLO again to receive fresh\n-- \n1.8.3.3-992-gf0e5e44\n"},{"id":"223665","messageId":"CALkWK0na9B2o-uBYHetCfpUsB6duY8==kWkVU8vAUS29OPwDdg@mail.gmail.com","threadId":"34355","inReplyTo":"7vd2qf4xoo.fsf_-_@alter.siamese.dyndns.org","subject":"Re: Re* [PATCH] send-email: improve SSL certificate verification","fromName":"Ramkumar Ramachandra","fromEmail":"artagnon@gmail.com","sentAt":"2013-07-18T17:36:33Z","receivedAt":"2013-07-18T17:36:33Z","isPatch":true,"sender":{"key":"r@artagnon.com","avatar":"https://avatars.githubusercontent.com/u/37226?v=4"},"body":"Junio C Hamano wrote:\n> Ramkumar, as you will still be the primary author of the resulting\n> commit, I tentatively added a line for your sign-off even though you\n> haven't signed off _this_ version yet, so that I would not forget.\n> If this version looks good, please tell us you would.\n\nYeah, it seems to work fine for me. Sign-off is fine.\n\nThanks for putting it together.\n"}]}