Bug #4583

EHLO after successful auth violates RFC-2554

Details

Submitted	2005-06-14 00:00 UTC
From	mpb dot mail at gmail dot com
Assigned	chagenbu
Status	Closed
Package	Net_SMTP
PHP Version	Irrelevant
OS	Irrelevant
Roadmaps	(Not assigned)

Comments

[2005-06-14 00:00 UTC] mpb dot mail at gmail dot com

Description:
------------
In SMTP.php around line 453:

/* RFC-2554 requires us to re-negotiate ESMTP after an AUTH. */
if (PEAR::isError($error = $this->_negotiate())) {
return $error;
}

RFC-2554 states:

"The client SHOULD send an EHLO command as the first command after a successful SASL negotiation WHICH RESULTS IN THE ENABLING OF A SECURITY LAYER [emphasis mine]."

However, SMTP.php is not enabling a security layer (such as SSL). SMTP.php is simply authenticating. Therefore, this call to $this->_negotiate() should be removed. The call causes AUTH problems when sending mail via ssl://smtp.gmail.com:465, and may cause problems sending mail to other servers as well.

Here is what happens when I try to send via ssl://smtp.gmail.com:465.

* The AUTH succeeds: DEBUG: Recv: 235 2.7.0 Accepted
* SMTP.php then issues an EHLO
* The EHLO causes gmail to (silently) forget the successful AUTH
* A MAIL-FROM is sent to gmail.
* Gmail reject the MAIL-FROM as follows: DEBUG: Recv: 530 5.7.0 Authentication Required

When I comment out the above call to _negotiate, gmail does not reject the subsequent MAIL-FROM.

Please contact me if you have any questions!

Thanks you for supporting PHP/PEAR.