Subject: [Uta] draft-ietf-uta-email-deep-00 comments

From: Jeremy Harris <[email-masked]>
Date: Wed, 25 Feb 2015 19:25:56 +0000

5.3 refers to 7 for the DEEP status but the EHLO-time
    addition is not defined (only given as an example)
    by 7.3

7.1 Missing a definition for "name".

7.3 At what stage of an SMTP conversation is CLIENT valid?
    Are multiple uses per SMTP connection (EHLO to QUIT) valid?
    Per TLS connection?
    Per TCP connection?

    What action should an MSA take on receipt of a CLIENT command?

9.1.1 Seems to be only talking about MSA / MRA servers.
      Needs to be explicit if it does not apply to MTAs.

-- 
Regards,
   Jeremy

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 25 Feb 2015 20:40:33 +0000

>     Are multiple uses per SMTP connection (EHLO to QUIT) valid?

Good point.  Presumably (when used on either port 587 or port 25
with STARTTLS) the sequence is:

	S: 220 example.net
	C: EHLO client.example
	S: 250-example.net			-- DEEP is optional in the cleartext EHLO response.
	   250 STARTTLS
	C: STARTTLS
	S: 220 make my day
	C: <TLS CLIENT HELLO>
	S: <TLS SERVER HELLO>
	   ... reset of TLS handshake
	C: EHLO client.example
	S: 250-example.net			-- DEEP is taken from the TLS protected EHLO response.
	   250 DEEP ...
	C: CLIENT ...

And since this is a transport-security mechanism, not a message
security mechanism, CLIENT must precede the start of the "MAIL"
transaction, and can only be sent once.  I think it is OK to send
"AUTH" and "CLIENT" in either order.

With port 465 "smtps" (newly called "submissions" in the draft).

    $ pcregrep '\s465/tcp\s' /etc/services
    urd             465/tcp    # URL Rendesvous Directory for SSM
    smtps           465/tcp    # smtp protocol over TLS/SSL

the above sequence obviously starts with the TLS handshake.

With most MSAs using 587+STARTTLS, do we really need to ask users
who've mostly learned to switch from 25 to 587 to yet again switch
from 587 to 465?

>     What action should an MSA take on receipt of a CLIENT command?

Indeed.  Is this just for logging?

-- 
	Viktor.