Merge ~kstenerud/ubuntu/+source/fetchmail:disco-fetchmail-gmailssl-1798786 into ubuntu/+source/fetchmail:ubuntu/disco-devel

[Karl Stenerud]

Disco version of https://code.launchpad.net/~kstenerud/ubuntu/+source/fetchmail/+git/fetchmail/+merge/357802

Applied upstream patch to set hostname for SNI when using TLS. Without this, fetchmail fails to verify the SSL certificate using TLS 1.2.

Upstream patch: https://gitlab.com/fetchmail/fetchmail/commit/9b8b634312f169fab872f3580c2febe5af031615

PPA: ppa:kstenerud/cosmic-fetchmail-gmailssl-1798786

Steps to test:

# lxc launch ubuntu-daily:disco tester
# lxc exec tester bash
# apt update
# apt dist-upgrade -y
# apt install -y fetchmail
# echo "set postmaster \"root\"
poll pop.gmail.com with proto POP3
   user '<email address hidden>' there with password 'any-password' is root here options ssl
" > ~/.fetchmailrc
# chmod 700 ~/.fetchmailrc
# fetchmail -d0 -vk --sslcertck pop.gmail.com
...
fetchmail: Server certificate:
fetchmail: Unknown Organization
fetchmail: Issuer CommonName: invalid2.invalid
fetchmail: Subject CommonName: invalid2.invalid
fetchmail: Server CommonName mismatch: invalid2.invalid != pop.gmail.com
fetchmail: Server certificate verification error: self signed certificate
...

# add-apt-repository -y ppa:kstenerud/cosmic-fetchmail-gmailssl-1798786
# apt update
# apt dist-upgrade -y
# fetchmail -d0 -vk --sslcertck pop.gmail.com
...
fetchmail: Server certificate:
fetchmail: Issuer Organization: Google Trust Services
fetchmail: Issuer CommonName: Google Internet Authority G3
fetchmail: Subject CommonName: pop.gmail.com
fetchmail: Subject Alternative Name: pop.gmail.com
...

Package Tests:

There are no package tests in fetchmail.

[Christian Ehrhardt  (paelzer)]

Note: I wondered if we should bug report to Debian as well.
But since the fix is upstream for a year already and Debian has 6.4 beta already they will get it once upstream finalizes 6.4

Only in case we would be afraid that this would take quite a while we'd need to ping them.
If we see this on the next cycles merge still not being droppable lets make sure to open a bug/PR with Debian.

[Christian Ehrhardt  (paelzer)]

LGTM as well.

@Andreas - did you check if disco is open now so you could upload this along the SRU version of it that you acked?
I still only saw the IRC chan say "open" but no mail - also as usual images missing still.

review: Approve

[Christian Ehrhardt  (paelzer)]

A test build in disco would be nice since you never know what has changed.

[Andreas Hasenack (ahasenack)]

It's open, uploads are going through, but I also haven't seen an announcement email.

[Andreas Hasenack (ahasenack)]

Can you please squash the two changelog commits into one?

[Karl Stenerud (kstenerud)]

Done. PPA upload is https://launchpad.net/~kstenerud/+archive/ubuntu/disco-fetchmail-gmailssl-1798786

[Andreas Hasenack (ahasenack)]

Thanks, +1

review: Approve

[Andreas Hasenack (ahasenack)]

Tagged and uploaded

diff --git a/debian/changelog b/debian/changelog
index ab94753..10ac2ff 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+fetchmail (6.3.26-3ubuntu1) disco; urgency=medium
+
+  * d/p/sni-support.patch: TLS: set hostname for SNI. Thanks to Matthias
+    Andree <[e-mail]> (LP: #1798786)
+
+ -- Karl Stenerud <[e-mail]>  Wed, 24 Oct 2018 05:12:24 -0700
+
 fetchmail (6.3.26-3build1) bionic; urgency=high
 
   * No change rebuild against openssl1.1.
diff --git a/debian/patches/series b/debian/patches/series
index 6739ab6..4df8704 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
 01_fetchmailconf.patch
 02_remove_SSLv3.patch
+sni-support.patch
diff --git a/debian/patches/sni-support.patch b/debian/patches/sni-support.patch
new file mode 100644
index 0000000..b170947
--- /dev/null
+++ b/debian/patches/sni-support.patch
@@ -0,0 +1,32 @@
+Description: TLS: set hostname for SNI.
+Author: Matthias Andree <[e-mail]>
+Origin: upstream, https://gitlab.com/fetchmail/fetchmail/commit/9b8b634312f169fab872f3580c2febe5af031615
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/fetchmail/+bug/1798786
+Last-Update: 2018-10-24
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/socket.c b/socket.c
+index 58a8e15..6aef911 100644
+--- a/socket.c
++++ b/socket.c
+@@ -986,6 +986,20 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck
+ 	_verify_ok = 1;
+ 	_prev_err = -1;
+ 
++	/*
++	 * Support SNI, some servers (googlemail) appear to require it.
++	 */
++	{
++	    long r;
++	    r = SSL_set_tlsext_host_name(_ssl_context[sock], servercname);
++
++	    if (0 == r) {
++		/* handle error */
++		report(stderr, GT_("Warning: SSL_set_tlsext_host_name(%p, \"%s\") failed (code %#lx), trying to continue.\n"), _ssl_context[sock], servercname, r);
++		ERR_print_errors_fp(stderr);
++	    }
++	}
++
+ 	if( mycert || mykey ) {
+ 
+ 	/* Ok...  He has a certificate file defined, so lets declare it.  If