Closed radfish closed 1 year ago
Hi @radfish
Thanks a lot for your patch. I am checking the pull-requests and this patch is for the next
branch. This branch is too old (python 2 code), but this patch probably could be used in the master branch. We should include it in the master branch?
I am closing the next
branch, and this patch will be closed. We can continue commenting here of if you think we should include in master, please, open a new pull-request.
Best regards, kix
Problem: The user might configure a proxy, but this this proxy is silently bypassed in the cases listed below. This breaks the user's privacy, since the connection to the IMAP server is leaked with the user's IP (confirmed leak with
netstat
showing connection to IMAP server, no connection to the proxy at all). The proxy is pypassed when:Cause for case 1: The code in imaplibutil.py in open_socket() (overriden imaplib2.IMPA4) that follows two different paths depending on the protocol (AF_UNSET vs AF_INIT or AF_INET6). In case of AF_UNSET, the code calls rfc6555.create_connection() which creates a new socket instead of using the existing proxied socket that was passed by the caller, thus bypassing the proxy.
Fix: raise an error in all cases when the proxy would not be honored, for Case 1 check the AF_UNSET, for Cases 2 and 3 change the warnings into errors fatal to that account processing.
Also, explain the requirement to set ipv6 option in the documentation for the proxy option in the config template file. Also, add some extra information about remote DNS request via proxy and that only IPv4 supported for proxy address. Also, change option values from True/False to yes/no for consistency with other options. Also, change example port to 1080, which is the standard port for a SOCKS proxy.
This commit does not fix the DNS request leaks from getaddrinfo() calls, tracked in Issue #189.
This PR
References
Related Issue #189
Additional information
Tested cases:
Note:
next
branch is broken for me for unrelated reasons. I was able to test these specific error code paths on that branch, but the sync does not complete due to unrelated exceptions.