[Top] [All Lists]

Re: STARTTLS & EHLO: Errata text?

2009-02-01 16:02:20

--On Sunday, February 01, 2009 20:35 +0000 Tony Finch
<dot(_at_)dotat(_dot_)at> wrote:

On Sun, 1 Feb 2009, Hector Santos wrote:

I was thinking of 3207 with text similar to:

    The secured SMTP client MUST resend the EHLO command and
    the secured SMTP server MUST be prepared to issue an 503
    for any out of sequence commands by legacy 3207 clients.

What's wrong with the text I suggested?

   Upon completion of the TLS handshake, the SMTP protocol is
reset to    the initial state (the state in SMTP after a
server issues a 220    service ready greeting).  The
requirement in [RFC5321] that "a client    MUST issue HELO or
EHLO before starting a mail transaction" also    applies to
this fresh state.

Tony, repeating my disclaimer about not feeling qualified to
have an opinion about whether more text is needed in 3207, I
think you are specifying the client behavior (which I believe to
be necessary) while Hector is trying to specify the server
behavior if the client doesn't do what is expected of it.  We
don't often take that step, precisely to permit servers to be
more permissive if they want to, but maybe it would be useful in
this case.  Or maybe not.

If one did want to say something about the server response to
the client's sending something besides EHLO, another alternative
would be to take either Hector's text or my possible
alternatives to it and preface it with some of the type of "if
the server decides to check, then..." language we've used
elsewhere.  My own instinct is to avoid going down that path,
but Y (or Hector's) MMD and I claim no expertise about 3207 here.