Rfc 2487 non compliance - STARTTLS - 6.5.1

HCL Domino Domino Forum
1

I think I’ve discovered an ommission in the Domino implementation of RFC2487 - STARTTLS.

I would be interested if anyone else was experiencing similar results to the ones I get below.

We implemented SSL and starttls on our domino servers around 12 months ago. Back then they were running 5.0.12 and everything worked fine. Recently we upgraded to 6.5.1 and now we appear to have encountered some RFC compliance issues. These issues only occur when attempting to deliver mail to a receiving MTA that enforces strict rfc compliance. So far this means we only see the problem when delivering email to certain POSTFIX servers. We have a partner company running exchange 2000 with starttls and everything continues to work fine with them.

The rfc states… (section 5.2)

"Upon completion of the TLS handshake, the SMTP protocol is reset to

the initial state (the state in SMTP after a server issues a 220

service ready greeting). The server MUST discard any knowledge

obtained from the client, such as the argument to the EHLO command,

which was not obtained from the TLS negotiation itself. The client

MUST discard any knowledge obtained from the server, such as the list

of SMTP service extensions, which was not obtained from the TLS

negotiation itself. The client SHOULD send an EHLO command as the

first command after a successful TLS negotiation."

Compare that statement to the log output from my server when attempting to deliver email to a postfix server that advertises starttls.

04/06/2004 15:40:48 [03C4:0015-0D10] SMTPClient: Attempting to Connect: Host mail.global.frontbridge.COM, Port 25, SSL Port 0, Connecting Domain mail2.xxxxxxxxxxxx.co.uk

04/06/2004 15:40:48 [03C4:0015-0D10] SMTPClient: Connection successful

04/06/2004 15:40:48 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 220 mail52-ash.bigfish.com ESMTP Postfix EGGS and Butter

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: CommandEHLO: EHLO mail2.xxxxxxxxxxxx.co.uk

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 250-mail52-ash.bigfish.com

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 250-PIPELINING

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 250-SIZE 150000000

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 250-VRFY

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 250-ETRN

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 250-STARTTLS

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 250 8BITMIME

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: CommandSTARTTLS: STARTTLS

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 220 Ready to start TLS

04/06/2004 15:40:49 Router: [00000015] Transferring mail to domain FABERMAUNSELL.COM (host mail.global.frontbridge.COM [206.16.192.227]) via SMTP

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: Attempting to SubmitMessage:

04/06/2004 15:40:49 [03C4:0015-0D10] SMTPClient: CommandMAIL: MAIL FROM:Keir.Snelling@xxxxxxxxxxxx.co.uk

04/06/2004 15:40:50 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 503 Error: send HELO/EHLO first

04/06/2004 15:40:50 [03C4:0015-0D10] SMTPClient: CommandRSET:

04/06/2004 15:40:50 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 250 Ok

04/06/2004 15:40:50 [03C4:0015-0D10] SMTPClient: Attempting to Disconnect:

04/06/2004 15:40:50 [03C4:0015-0D10] SMTPClient: CommandQUIT:

04/06/2004 15:40:50 [03C4:0015-0D10] SMTPClient: ReceiveResponse: 221 Bye

04/06/2004 15:40:50 [03C4:0015-0D10] SMTPClient: Connection terminated successfully

04/06/2004 15:40:50 Router: No messages transferred to FABERMAUNSELL.COM (host mail.global.frontbridge.COM) via SMTP

04/06/2004 15:40:51 Router: Transfer to server FABERMAUNSELL.COM is ready with 1 messages

04/06/2004 15:40:51 Router: Transfer thread 00000015 searching for work

04/06/2004 15:40:51 Router: Error transferring message 004EB4B1 via SMTP to mail.global.frontbridge.COM;mail.uu.net OFD97F2FB9:B90A440F ON80256EA9:004EB4B1 503 Error: send HELO/EHLO first

04/06/2004 15:40:51 [03C4:0015-0D10] SMTPClient: Attempting to Connect: Host mail.global.frontbridge.COM, Port 25, SSL Port 0, Connecting Domain mail2.xxxxxxxxxxxx.co.uk

It is clear that we are not resending the EHLO after the STARTTLS as the rfc states we should.

2

Subject: rfc 2487 non compliance - STARTTLS - 6.5.1

I’ve just got off the phone to Lotus support and it appears that this is a known issue. It’s SPR is SEGN5V7JSL and apparently a hotfix is available. I’ve yet to receive the hotfix, so cannot confirm that my issues have been resolved, but it does look promising.

3

Subject: RE: rfc 2487 non compliance - STARTTLS - 6.5.1

So were do you download the Hot-Fix ? cant seem to see it>Thanks

4

Subject: RE: rfc 2487 non compliance - STARTTLS - 6.5.1

No you cannot download it. You have to request it from Domino Support.

5

Subject: RE: rfc 2487 non compliance - STARTTLS - 6.5.1

I tested the hotfix and it worked with the Postfix destination I was connecting to.RT

6

Subject: rfc 2487 non compliance - STARTTLS - 6.5.1

Good morning,

I have this issue but in V 5.0.11. I migrated my server in 5.0.13a but I continue to have the same symptom.

Have you implemented a hot fix in your 5.0.12 release ? You wrote this functionnality run correctly in V5.

I have only enabled on my configuration document the following parameter :

SSL negotiated over TCP/IP port: Enabled

and in server document port(SMTP outbound) :

25

Negotiated SSL

Rgds.