Re: [Mailsec] Retaining CLIENTID type and token after successful AUTH ?

[Michael Peddemors <[e-mail]>]

On 2023-03-30 02:07, Andrew C Aitchison wrote:
> 
> The last of the restrictions in section 4 is:
>      Several SMTP service extensions such as [AUTH] require that an
>      SMTP session be reset to an initial state under conditions
>      such as after applying a security layer.  An SMTP server MUST
>      discard any CLIENTID information after such a reset.
> 
> This text appears to be saying that once the AUTH has succeeded
> the session MUST not have or make use of the CLIENTID information.
> 
> Does that mean that I cannot separately rate-limit messages or recipients
> between two sessions from the same user that have different CLIENTID 
> values ?
> 
> In fact it appears that the only signal I can use to block one clientid 
> but not another is CLIENTID and AUTH attempts. When I notice that
> clientid_1 is sending bad or too much mail, the AUTH has already happened
> so the clientid is not available to put a block on just clientid_1,
> so when the same user with clientid_2 attempts to send an email, they 
> will be blocked too ?
> 
> Or am I misreading that restriction ?
> 

Not quite.. Love having the extra pair of literal eyes.
Very poorly worded there, this is just meant to be a confirmation, that 
when a 'SESSION' is reset, CLIENTID information needs to be forgotten, 
just like any other AUTH information. It's to ensure that the CLIENTID 
is able to be resent if for example two different AUTH happen on the 
same connection.  Not that it is common for two AUTH to occur in the 
same connection, but some AUTH proxies might do that.

Typically, this COULD happen where during the same connection, another 
EHLO is issued, or a change in STARTTLS..

This doesn't apply to two different sessions at all, but a single 
session, where a given VERB is issued, that triggers a reset.

Thinking the terminology of 'session' throwing a mix in the works.

(Yes, we run separate rate limiters too)

But I should take a minute more to reread, just running into a meeting.

You would never have two CLIENTID's active in the same connection, but 
you can have subsequent 'sessions' in the same connection, is that 
clearer.. We should point to the definitions of those terms, as defined 
in other RFC's at that point.

-- 
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.