Time out every connection, and scope --allow-invalid-certs

Conversation 0 Commits 2 Files Changed 23

+734 -235

2 Commits

Author	SHA1	Message	Date
jcoffey-dev	234b3203d7	Scope --allow-invalid-certs to the server the user named ci / test (pull_request) Skipped Details github/ci (branch) GitHub Actions Details ci / github (pull_request) Successful in 2m33s Details ci / announce (pull_request) Skipped Details The flag switched certificate checks off for every connection in the run. That included the Microsoft sign-in endpoints, so a user passing it for a self-signed source also sent refresh tokens, device codes and EWS client secrets over unverified TLS. It also covered the export target, and any host a server redirected to or named for its API, uploads or downloads. It now applies only where the user pointed it: the host of --url, for the source of an import or the target of an export. For an Exchange import with no --url, it covers the mailbox's own domain, where on-premises Autodiscover looks, and then only the EWS endpoint Autodiscover finds. The Microsoft and Google sign-in and cloud hosts are always verified, with or without the flag. Each HTTP client keeps a verifying agent and, only when the flag applies, a second one that accepts invalid certificates, and picks per request by host. The sign-in modules no longer take the flag at all. Autodiscover v2, which is Microsoft's own service, is always verified.	2026-09-30 11:31:44 -07:00
jcoffey-dev	eb38603dbc	Time out every HTTP connection instead of waiting forever No ureq agent set a timeout, and ureq sets none by default, so a connection dropped silently mid-transfer (a NAT or load-balancer idle drop) hung a JMAP, DAV, EWS or Graph run, or an export, with no error, and the retry logic never got a chance to run. IMAP and ManageSieve already had read timeouts. Every agent now takes its settings from a new net module: 30s to connect, 60s to send the request headers, 5 minutes for the server's first byte, and 30 minutes for a whole response body, which ureq counts as one budget for the body rather than per read: enough for the 512 MiB limit at about 300 KB/s. A JMAP upload's send budget grows with its size, from a 2 minute floor at an assumed 64 KiB/s worst case. A timeout is a transport error, and every client already retries those, so a stalled transfer is now abandoned and retried. Tests pin that down for each client. The TLS setup the seven agents repeated moves to one helper.	2026-09-30 11:25:34 -07:00

Author

SHA1

Message

Date

jcoffey-dev

234b3203d7

Scope --allow-invalid-certs to the server the user named

ci / test (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 2m33s

Details

ci / announce (pull_request) Skipped

Details

The flag switched certificate checks off for every connection in the run.
That included the Microsoft sign-in endpoints, so a user passing it for a
self-signed source also sent refresh tokens, device codes and EWS client
secrets over unverified TLS. It also covered the export target, and any host
a server redirected to or named for its API, uploads or downloads.

It now applies only where the user pointed it: the host of --url, for the
source of an import or the target of an export. For an Exchange import with
no --url, it covers the mailbox's own domain, where on-premises Autodiscover
looks, and then only the EWS endpoint Autodiscover finds. The Microsoft and
Google sign-in and cloud hosts are always verified, with or without the flag.

Each HTTP client keeps a verifying agent and, only when the flag applies, a
second one that accepts invalid certificates, and picks per request by host.
The sign-in modules no longer take the flag at all. Autodiscover v2, which is
Microsoft's own service, is always verified.

2026-09-30 11:31:44 -07:00

jcoffey-dev

eb38603dbc

Time out every HTTP connection instead of waiting forever

No ureq agent set a timeout, and ureq sets none by default, so a connection
dropped silently mid-transfer (a NAT or load-balancer idle drop) hung a JMAP,
DAV, EWS or Graph run, or an export, with no error, and the retry logic never
got a chance to run. IMAP and ManageSieve already had read timeouts.

Every agent now takes its settings from a new net module: 30s to connect,
60s to send the request headers, 5 minutes for the server's first byte, and
30 minutes for a whole response body, which ureq counts as one budget for the
body rather than per read: enough for the 512 MiB limit at about 300 KB/s.
A JMAP upload's send budget grows with its size, from a 2 minute floor at an
assumed 64 KiB/s worst case.

A timeout is a transport error, and every client already retries those, so a
stalled transfer is now abandoned and retried. Tests pin that down for each
client. The TLS setup the seven agents repeated moves to one helper.

2026-09-30 11:25:34 -07:00

Time out every connection, and scope --allow-invalid-certs #6