Forum Discussion

kraigk_52257's avatar
kraigk_52257
Icon for Nimbostratus rankNimbostratus
Apr 23, 2011

SMTP STARTTLS iRule

I need help with getting a STARTTLS iRule working for SMTP on our 1600's. We are on version 10.2.1. And to be clear it is working but there are a few tweaks I can't figure out. The main issue is that when I telnet to the VIP I can't do an SMTP conversation. It throws "530 Must issue a STARTTLS command first". If I fire up Outlook Express I am able to use port 25/TLS just fine and the smtp.log with Outlook Express shows a normal conversation. How to get the conversation to work? Here is the code:

 

 

when CLIENT_ACCEPTED {

 

SSL::disable

 

}

 

when SERVER_CONNECTED {

 

TCP::collect

 

}

 

when CLIENT_DATA {

 

set lcpayload [string tolower [TCP::payload]]

 

if { $lcpayload starts_with "ehlo" } {

 

TCP::respond "250-STARTTLS\r\n250 OK\r\n"

 

TCP::payload replace 0 [TCP::payload length] ""

 

TCP::release

 

TCP::collect

 

} elseif { $lcpayload starts_with "starttls" } {

 

TCP::respond "220 Ready to start TLS\r\n"

 

TCP::payload replace 0 [TCP::payload length] ""

 

TCP::release

 

SSL::enable

 

} else {

 

TCP::respond "530 Must issue a STARTTLS command first\r\n"

 

TCP::payload replace 0 [TCP::payload length] ""

 

TCP::release

 

TCP::collect

 

}

 

}

 

when SERVER_DATA {

 

TCP::release

 

clientside { TCP::collect }

 

}