Subject: SMTP and authentication - almost

From: Karsten Ballueder <[email-masked]>
Date: Fri, 2 Jun 2000 17:09:15 +0100 (GMT)

I eventually got it all to work and with the help of strace and netscape (which
works fine with my ISP) was able to trace down the problems:

- mm_login() gets called and must return validk password and userid

- and: I had to patch smtp.c to not send the "RSET" command to the server before
  sending the mail, otherwise it would forget the authentification. With the stock
  4.7 c-client code, the user is first authenticated, then RSET is send and then
  the mail.
  With my ISP's server this caused the authentification to be invalidated.

Is there any *good* reason for the extra RSET ? Seems rather unneeded to me.
--
 Karsten Ballüder  http://Ballueder.home.dhs.org/  mailto:[email-masked]
 Physics Department, Heriot-Watt University, Edinburgh, EH14 4AS, Scotland
                     Tel. +44-(0)-131-4513068  Fax. +44-(0)-131-4513136
            "In a world without fences, who needs Gates?"  

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Fri, 2 Jun 2000 15:44:46 -0700 (PDT)

On Fri, 2 Jun 2000 17:09:15 +0100 (GMT), Karsten Ballueder wrote:
> - and: I had to patch smtp.c to not send the "RSET" command to the server
> before sending the mail, otherwise it would forget the authentification.
> With the stock 4.7 c-client code, the user is first authenticated, then RSET
> is send and then the mail.

Well....

Historically, I had problems with servers (I forget which ones) which could
let you connect and be in other than in initial state.  I think that they were
multi-threaded and a thread from a previous session could get reused without
being fully reinitialized.

The other issue is when using an SMTP session to send more than one message.
It's good form to do a RSET between each message, to be sure that you're back
to the initial state; and of course you have to do a RSET if you don't
complete the previous message to a successful DATA transaction.

I think that the server is non-compliant.  I don't see anything in RFC 2554
which permits a server to drop authentication status because of a RSET.