From 97d67fbb7f7d0e4f1d968d8462fb93ad1d2315c8 Mon Sep 17 00:00:00 2001 From: Ben Dyer Date: Fri, 16 Jun 2023 23:29:18 +1000 Subject: [PATCH] Resend EHLO after STARTTLS Fixes https://github.com/KumoCorp/kumomta/issues/61 RFC 3207 suggests clients MUST forget the EHLO capabilities obtained prior to STARTTLS, and SHOULD re-send an EHLO after TLS negotiation completes (https://datatracker.ietf.org/doc/html/rfc3207#section-4.2). Some SMTP servers seem to _require_ an EHLO after STARTTLS so this ensures we send one. --- crates/kumod/src/smtp_dispatcher.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/crates/kumod/src/smtp_dispatcher.rs b/crates/kumod/src/smtp_dispatcher.rs index dbe358a0..b0d3aa68 100644 --- a/crates/kumod/src/smtp_dispatcher.rs +++ b/crates/kumod/src/smtp_dispatcher.rs @@ -194,10 +194,10 @@ impl QueueDispatcher for SmtpDispatcher { .with_context(|| connect_context.clone())?; // Say EHLO - let caps = client.ehlo(&ehlo_name).await.context("EHLO")?; + let pretls_caps = client.ehlo(&ehlo_name).await.context("EHLO")?; // Use STARTTLS if available. - let has_tls = caps.contains_key("STARTTLS"); + let has_tls = pretls_caps.contains_key("STARTTLS"); let tls_enabled = match (enable_tls, has_tls) { (Tls::Required | Tls::RequiredInsecure, false) => { anyhow::bail!("tls policy is {enable_tls:?} but STARTTLS is not advertised",); @@ -216,6 +216,8 @@ impl QueueDispatcher for SmtpDispatcher { if let Some(handshake_error) = client.starttls(enable_tls.allow_insecure()).await? { client.send_command(&rfc5321::Command::Quit).await.ok(); anyhow::bail!("TLS handshake failed: {handshake_error}"); + } else { + client.ehlo(&ehlo_name).await.context("EHLO")?; } true }