Subject: SSL issue on Win2k

From: Jonathan Joseph Lamberson <[email-masked]>
Date: Tue, 9 Apr 2002 15:19:02 -0400 (EDT)

Hello,

I am writing a utility for the University of Michigan to transfer mail
from legacy Eudora mailboxes to a new Microsoft Exchange e-mail server.
It is being developed, and will be run on, Windows 2000 machines.  Much
of the code is taken from your imapcopy utility, along with some added
text parsing to clean up idiosyncrasies with the Eudora mailbox format.

My utility works just fine when I don't make an SSL connection to the
Exchange server, however when I do add /ssl to the server name, I am
witnessing some strange behavior.  When copying large mailboxes, it will
get about half way through the append (using the mail_append_multiple
function) and then the connection will close.  Here's a sample of the
output:

000002a4 OK [APPENDUID 98056 672] APPEND completed.
[[APPENDUID 98056 672] APPEND completed.]
000002a5 APPEND Eudora-Mailboxes/In.mbx () "14-Feb-2002 11:57:34 -0400" {2750}
+ Ready for additional command text.

[Winsock cleanup]
[[CLOSED] IMAP connection broken (server response)]
?[CLOSED] IMAP connection broken (server response)
?Can't append message to mailbox
{lsa-mp.lsa.adsroot.itcs.umich.edu:993/imap/ssl/novalidate-cert/user="jlambers-test"}Eudora-Mailboxes/In.mbx
-- aborting

It will reconnect when it moves on to the next mailbox.  Unfortunately, it
won't resume the append that was aborted, so the result is that only part
of the mailbox gets copied.

I was thinking that this looks similar to the FAQ on your website
(incomplete SecBuffer exceeds maximum buffer size), however I am building
with c-client 2001a, so I think that problem should be fixed, correct?

If you have any advice, or need any further info, please feel free to
contact me.

Jonathan Lamberson
LS&A Information Technology
The University of Michigan

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 9 Apr 2002 15:05:18 -0700 (Pacific Daylight Time)

The problem that you are reporting does not look like the Windows SSL
buffer size problem.  Your sample shows that the server does not offer
MULTIAPPEND, so each message is being appended individually.  The previous
message was appended successfully (the "APPEND completed" response).  It
then ran into trouble appending a 2750 byte message, which is much too
small to trigger the Windows SSL buffer size problem.

The Windows SSL buffer size problem is caused by receiving a SSL encrypted
block of greater than 16379 bytes (16K - 5 bytes).  SSL allows the block
to be a full 16K, but Microsoft's SSPI mistakenly counted the 5-byte
header against this total.

Your transcript indicates that, from c-client's point of view, the
Exchange server unilaterally closed the connection.  It sent the 2750
message bytes, and was waiting for an acknowledgement of completion when
instead it got an error reading from the server.  Perhaps the Exchange
server has logs related to the incident which may be of help in diagnosing
the problem further.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

"A single glass of champagne imparts a feeling of exhiliaration.  The
nerves are braced; the imagination is agreeably strirred; the wits become
more nimble.  A bottle produces a contrary effect.  Excess causes a
comatose insensibility.  So it is with war; and the quality of both is
best discovered by sipping."  -- Winston Churchill