Re: Fwd: SMTP TLS

Rajko Albrecht a écrit :

Hello,

I forgot to reply to that a while back, but :

> >> Maybe I have to read document again but I thought that TLS session
> >> could work only if the serveur was ESMTP (start using ehlo),
> >> helo is for SMTP only, then I have to try ehlo before fallback on
> >> helo when the server is SMTP only (then, with no TLS).
> 
> No, thats right. Thats not the problem.
> the problem is, that some MTA are configured that way, that them haven't
>   the AUTH capability when not in secure-mode. Means, a ehlo before
> starttls will give a list without AUTH but with STARTTLS and when setup
> a secure connection then ehlo will give a list with AUTH but without
> STARTTLS. So them make sure, that users just authorize if connection is
> crypted and don't sending plain passwords.

That's a perfectly valid server behavior.

> So the question means, if there is another trick possible to get
> libetpan sending the AUTH without sending a ehlo again after starttls
> 'cause mailsmtp_auth looks for the AUTH flag set inside the structures
> of smtp.

RFC 2487, which describes STARTTLS says (part 5.2) :

   Upon completion of the TLS handshake, the SMTP protocol is reset to
   the initial state (the state in SMTP after a server issues a 220
   service ready greeting). The server MUST discard any knowledge
   obtained from the client, such as the argument to the EHLO command,
   which was not obtained from the TLS negotiation itself. The client
   MUST discard any knowledge obtained from the server, such as the list
   of SMTP service extensions, which was not obtained from the TLS
   negotiation itself. The client SHOULD send an EHLO command as the
   first command after a successful TLS negotiation.

   The list of SMTP service extensions returned in response to an EHLO
   command received after the TLS handshake MAY be different than the
   list returned before the TLS handshake. For example, an SMTP server
   might not want to advertise support for a particular SASL mechanism
   [SASL] unless a client has sent an appropriate client certificate
   during a TLS handshake.

It is pretty clear you have to resend EHLO (well, you SHOULD ;).

Gaël.

-- 
Gaël Roualland -+- [email protected]


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click