mirror/kumomta
1
0
Fork 0
mirror of https://github.com/mailscope/kumomta.git synced 2026-10-26 16:26:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

re-ehlo when using OpportunisticInsecure and STARTTLS failed

Browse Source 
We were previously only re-doing the EHLO in the success case, but there
are some receiving implementations that seem to roll the TLS failure
error forward, returning an error during MAIL FROM:

```
TLS connection failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher (#4.3.0)
```

we want that error to show up while we're considering the connection, so
that we can fail over to the next candidate in our list, rather than
having it generate a transient failure for the message and stopping
there.

refs: https://github.com/KumoCorp/kumomta/issues/67
This commit is contained in:
Wez Furlong
2023-06-21 07:03:11 -07:00
parent 1123324400
commit eaa5da6e9e
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/kumod/src/smtp_dispatcher.rs
+10 -3
View File
@@ -230,7 +230,9 @@ impl QueueDispatcher for SmtpDispatcher {
false
}
(Tls::OpportunisticInsecure, true) => {
if let Some(handshake_error) = client.starttls(enable_tls.allow_insecure()).await? {
let enabled = if let Some(handshake_error) =
client.starttls(enable_tls.allow_insecure()).await?
{
tracing::debug!(
"TLS handshake with {address:?}:{port} failed: \
{handshake_error}, but continuing in clear text because \
@@ -239,10 +241,15 @@ impl QueueDispatcher for SmtpDispatcher {
// We did not enable TLS
false
} else {
client.ehlo(&ehlo_name).await.context("EHLO")?;
// TLS is available
true
}
};
// Re-EHLO even if we didn't enable TLS, as some implementations
// incorrectly roll over failed TLS into the following command,
// and we want to consider those as connection errors rather than
// having them show up per-message in MAIL FROM
client.ehlo(&ehlo_name).await.context("EHLO")?;
enabled
}
(Tls::Opportunistic | Tls::Required | Tls::RequiredInsecure, true) => {
if let Some(handshake_error) = client.starttls(enable_tls.allow_insecure()).await? {