{"thread":{"id":"38293","subject":"[PATCH] imap-send.c: set CURLOPT_USE_SSL to CURLUSESSL_TRY","startedAt":"2015-01-06T11:20:37Z","lastAt":"2015-01-06T20:19:12Z","messageCount":2,"participants":["Kyle J. McKay","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"254329","messageId":"31f38398d53bcfb1d659cd248db522e@74d39fa044aa309eaea14b9f57fe79c","threadId":"38293","inReplyTo":null,"subject":"[PATCH] imap-send.c: set CURLOPT_USE_SSL to CURLUSESSL_TRY","fromName":"Kyle J. McKay","fromEmail":"mackyle@gmail.com","sentAt":"2015-01-06T11:20:37Z","receivedAt":"2015-01-06T11:20:37Z","isPatch":true,"sender":{"key":"mackyle@gmail.com","avatar":"https://avatars.githubusercontent.com/u/813346?v=4"},"body":"According to the cURL documentation for the CURLOPT_USE_SSL option,\nit is only used with plain text protocols that get upgraded to SSL\nusing the STARTTLS command.\n\nThe server.use_ssl variable is only set when we are using a protocol\nthat is already SSL/TLS (i.e. imaps), so setting CURLOPT_USE_SSL\nwhen the server.use_ssl variable is set has no effect whatsoever.\n\nInstead, set CURLOPT_USE_SSL to CURLUSESSL_TRY when the server.use_ssl\nvariable is NOT set so that cURL will attempt to upgrade the plain\ntext connection to SSL/TLS using STARTTLS in that case.\n\nThis much more closely matches the behavior of the non-cURL code path.\n\nSigned-off-by: Kyle J. McKay <mackyle@gmail.com>\n---\n\n*** PATCH IS AGAINST NEXT ***\n\nIn particular, this patch requires br/imap-send-via-libcurl\n\n\n imap-send.c | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/imap-send.c b/imap-send.c\nindex 4dfe4c25..5251b750 100644\n--- a/imap-send.c\n+++ b/imap-send.c\n@@ -1421,8 +1421,8 @@ static CURL *setup_curl(struct imap_server_conf *srvc)\n \t\tstrbuf_release(&auth);\n \t}\n \n-\tif (server.use_ssl)\n-\t\tcurl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL);\n+\tif (!server.use_ssl)\n+\t\tcurl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_TRY);\n \n \tcurl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, server.ssl_verify);\n \tcurl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, server.ssl_verify);\n-- \n2.1.4\n"},{"id":"254369","messageId":"xmqqiogjoe67.fsf@gitster.dls.corp.google.com","threadId":"38293","inReplyTo":"31f38398d53bcfb1d659cd248db522e@74d39fa044aa309eaea14b9f57fe79c","subject":"Re: [PATCH] imap-send.c: set CURLOPT_USE_SSL to CURLUSESSL_TRY","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-01-06T20:19:12Z","receivedAt":"2015-01-06T20:19:12Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Kyle J. McKay\" <mackyle@gmail.com> writes:\n\n> According to the cURL documentation for the CURLOPT_USE_SSL option,\n> it is only used with plain text protocols that get upgraded to SSL\n> using the STARTTLS command.\n>\n> The server.use_ssl variable is only set when we are using a protocol\n> that is already SSL/TLS (i.e. imaps), so setting CURLOPT_USE_SSL\n> when the server.use_ssl variable is set has no effect whatsoever.\n>\n> Instead, set CURLOPT_USE_SSL to CURLUSESSL_TRY when the server.use_ssl\n> variable is NOT set so that cURL will attempt to upgrade the plain\n> text connection to SSL/TLS using STARTTLS in that case.\n>\n> This much more closely matches the behavior of the non-cURL code path.\n>\n> Signed-off-by: Kyle J. McKay <mackyle@gmail.com>\n> ---\n\nIt sounds sensible from the description of the approach but I'd\nprefer independent opinion to sanity-check me.  Will queue while\nwaiting for others to speak up.\n\nThanks.\n\n>\n> *** PATCH IS AGAINST NEXT ***\n>\n> In particular, this patch requires br/imap-send-via-libcurl\n>\n>\n>  imap-send.c | 4 ++--\n>  1 file changed, 2 insertions(+), 2 deletions(-)\n>\n> diff --git a/imap-send.c b/imap-send.c\n> index 4dfe4c25..5251b750 100644\n> --- a/imap-send.c\n> +++ b/imap-send.c\n> @@ -1421,8 +1421,8 @@ static CURL *setup_curl(struct imap_server_conf *srvc)\n>  \t\tstrbuf_release(&auth);\n>  \t}\n>  \n> -\tif (server.use_ssl)\n> -\t\tcurl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL);\n> +\tif (!server.use_ssl)\n> +\t\tcurl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_TRY);\n>  \n>  \tcurl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, server.ssl_verify);\n>  \tcurl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, server.ssl_verify);\n"}]}