TLS Negotiation with ESMTP over Sockets

Question

I have a simple SMTP client to which I am trying to add TLS support. I'm not sure what happens after the client issues the "STARTTLS" command. Most sources (including the RFC itself) describe it as TLS session negotiation, but this is not particularly clear.

How can I do that? My client is written in Objective-C and uses Cocoa flow objects (a shell for sockets). Cocoa streams have the ability to designate TLS as a socket security system using the NSStream setProperty function.

It seems, however, that this should be done before the connection is open. If so, should the client disconnect after receiving 220 code from the server (in response to STARTTLS), and then reconnect when specifying TLS?

Or rather, is this just an NSStream limitation? Simple sockets renegotiate TLS or SSL without closing?

In addition, once STARTTLS has been released and subsequent negotiation is complete, is any other encoding / decoding expected from the client?

Sorry if these are simple questions. I find it difficult to find suitable examples.

Hooray!

Answer 1

, NSStream TLS TLS, kCFStreamSSLLevel . SMTP- smtp.gmail.com:25, ! NSStream/SMTP , - :

NSHost* host = [NSHost hostWithName:address];
[NSStream getStreamsToHost:host port:port inputStream:&is outputStream:&os];
[is setDelegate:self];
[os setDelegate:self];
[is scheduleInRunLoop:[NSRunLoop currentRunLoop] forMode:NSDefaultRunLoopMode];
[os scheduleInRunLoop:[NSRunLoop currentRunLoop] forMode:NSDefaultRunLoopMode];
[is open];
[os open];

SMTP- , STARTTLS, OK:

-> 220 mx.google.com ESMTP gb6sm4472052wbb.0
<- EHLO example.address.com
-> 250-mx.google.com at your service, [84.227.165.204]
-> 250-SIZE 35882577
-> 250-8BITMIME
-> 250-STARTTLS
-> 250 ENHANCEDSTATUSCODES
<- STARTTLS
-> 220 2.0.0 Ready to start TLS

, SSL:

NSMutableDictionary* settings = [NSMutableDictionary dictionary];
[settings setObject:NSStreamSocketSecurityLevelNegotiatedSSL forKey:(NSString*)kCFStreamSSLLevel];
[settings setObject:address forKey:(NSString*)kCFStreamSSLPeerName];
[is setProperty:settings forKey:(NSString*)kCFStreamPropertySSLSettings];
[os setProperty:settings forKey:(NSString*)kCFStreamPropertySSLSettings];
[is open];
[os open];

is os, . AUTH , .

<- EHLO example.address.com
-> 250-mx.google.com at your service, [84.227.165.204]
-> 250-SIZE 35882577
-> 250-8BITMIME
-> 250-AUTH LOGIN PLAIN XOAUTH
-> 250 ENHANCEDSTATUSCODES
<- AUTH PLAIN hIdDeNbAsE64dAtA
-> 235 2.7.0 Accepted
<- MAIL FROM: <[e-mail]>
-> 250 2.1.0 OK gb6sm4472052wbb.0
<- RCPT TO: <[e-mail]>
-> 250 2.1.5 OK gb6sm4472052wbb.0
<- DATA
<- From: =?UTF-8?B?QWxlc3NhbmRybyBWb2x6?= <[e-mail]>
<- To: =?UTF-8?B?QWxl?= <[e-mail]>
<- Subject: =?UTF-8?B?VGVzdA==?=
<- Mime-Version: 1.0;
<- Content-Type: text/html; charset="UTF-8";
<- Content-Transfer-Encoding: 7bit;
<- 
<- Ciao!
<- .
-> 354  Go ahead gb6sm4472052wbb.0
-> 250 2.0.0 OK 1307994916 gb6sm4472052wbb.0
<- QUIT
-> 221 2.0.0 closing connection gb6sm4472052wbb.0

, - ... Cheers,

Answer 2

, STARTTLS, , SSL/TLS . SSL/TLS. SMTP-, STARTTLS.

, SSL/TLS , , SMTP , . HELO/EHLO TLS, .

, , , NSStream SSL/TLS , . NSStream Apple:

SSL NSStream ( , NSStreamSocketSecurityLevelSSLv2). , setProperty: forKey: NSStreamSocketSecurityLevelKey, :

[IStream SetProperty: NSStreamSocketSecurityLevelTLSv1 forKey: NSStreamSocketSecurityLevelKey];

.

, Objective C/ Cocoa, , , , SMTP. SSL/TLS, , /. SMTP-, .