users@javamail.java.net

Issue with TLS

From: Gilles Gaillard <gillouxGaillard_at_wanadoo.fr>
Date: Thu, 06 Jan 2011 21:40:12 +0100

Hi,

We're using javamail in an application that occasionally needs to send e-mails and it's usually just working fine.

However, there's one case where connecting to the smtp server fails with javamail although sending the mail
succeeds with another app (EmailTest.exe)

Debugging the situation with wireShark shows the following steps - with the successful application (c is the
client, s is the server):

1. c -> connect
2. s <- 220
3. c -> EHLO
4. s <- 250-mx.., 250-SIZE, 250-8BIMIME, 250-STARTTLS, 150 ENHANCEDSTATUSCODES
5. c -> STARTTLS
6. s <- 220 2.0.0 Ready to start TLS
       Here the SSL handshake and key exchange: Note that seems incomplete.
7. c -> Client Hello
8. s <- Server Hello
9. s <- Certificate. Server Hello Done.
10. c -> Client Key exchange
11. c -> Change cipher spec, Encrypted Handshake message
12. s <- 220 mx-..
13. c -> EHLO
14. s <- 250-mx.., 250-SIZE, 250-8BIMIME, 250-STARTTLS, 150 ENHANCEDSTATUSCODES
15. c -> STARTTLS
16. s <- 220 2.0.0 Ready to start TLS
       Then the SSL handshake again
17. c -> Client Hello
18. s <- Server Hello
19. s <- Certificate. Server Hello Done.
20. c -> Client Key exchange
21. c -> Change cipher spec, Encrypted Handshake message
22. s <- Change cipher spec, Encrypted Handshake message
23. Then the data transmission.

Connecting to the same mail server with javamail gives the following:
- connecting from the same machine:
  at step 15, instead of starting the TLSS, javamail just send 'mail from' which causes the server to refuse.
  c -> MAIL FROM:<xxx_at_yy>
  s <- 539 5.7.0 Must issue a STARTTLS first
  c -> RSET
- connecting from another machine: works fine. Steps 12 to 21 do not show.

My current guessing is that the TLS handshake failed which the successful application worked around by
restarting the 'protocol connection'.
I imagine that would be equivalent to calling again SMTPTransport.protocolConnect another time.
On the other hand it seems that javamail just goes on without detecting the issue in the SSL handshake.

Any idea ?
Thanks,
-- Gilles