[Solved] non-event driven Synapse lib. used to send Email via port 587
+ TLS?
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
devEric69 · 2021-10-09 10:05

Hello,

I've an internet provider, where I've created a business email
address.

Its specifications tell me to use its SMTP server to send emails via
port 587. The IANA documentation says that port 587 also supports TLS
(well, does it do or not, natively?), which means that I can send
mails securely: it's reassuring. I know that SSL <> TLS. Having said
that, I've coded a fonctionnality in order to send mail using my
email-account (id + pwd) and this port 587. For that, I had to remove
the "uses open_ssl;" in Synapse, in order to make it work: so, does
this means that my emails sent from my program are encrypted on the
internet (via this magical, wiz' TLS layer over my programm, although
not uses in my programm \ Synapse) or not?

Btw, which is the more theoretically secure: embedded SSL in my
programm or let TLS over my programm do the cryptographic work (if it
does so)?

Regards.

----------------------------------------------------------------------
devEric69 · 2021-10-09 13:54

Some tests after:
- "TSMTPSend.AutoTLS:= True;" with no "uses open_ssl;" ==> I've the
message: No SSL available: loading shared dynamic libs failed! The
SSL.LibName searched and found is ssl_none   .
- "TSMTPSend.AutoTLS:= True;" with "uses open_ssl;" ==> succes   .

Nevertheless, when I'm looking at the email's headers, I see some
security informations (like dmarc=pass dkim=pass spf=pass ...\...) but
no TLS information??! So, I've have traced the source code (step by
step): I go through the SSL layer (open_ssl). But, on the internet,
they say that I should see some TLS informations in the headers of the
email sent from my computer and received to my internet service
provider (where the receiving mailbox is located).

Any idea?

----------------------------------------------------------------------
devEric69 · 2021-10-10 15:04

Well, if I trace the Synapse code - step by step - in Lazarus, with
WireShark sniffing the data stream in parallel, in 2 different ways:
❶  talking through the port 587, without the explicit STARTTLS command
issued by the client\myself in the protocol dialog: the message is
sent and received.
→ WireShark shows me all here, everything\all the
commands\keywords\tokens are readable by a human, everything is
decrypted (except the already base64 (login+pwd) encrypted before by
myself), and each protocol line is associated to the simple SMTP
protocol.
❷  talking through the port 587, still, but with the explicit STARTTLS
command issued by the client\myself in the protocol dialog: the
message is sent and received, too.
→ On the other hand, here, WireShark shows me only some decrypted
exchanges until the 220 2.0.0 startTLS server's response included,
response to the previous STARTTLS client command. After, all the rest
of the conversation (the client commands AUTH PLAIN, MAIL FROM: <...>,
MAIL TO: <...>, DATA, ., are unreadable in WireSharp, i.e. all is
encrypted by SSL. And in front of each protocol line, WireShark
indicates that the protocol used has been transformed from SMTP toward
TLSv1.2 (just after the server's response 220 2.0.0 startTLS). So I
send an email through an crypted conversation from my computer.

That said, in all the email's headers received (❶ or ❷), "TLS" never
appears. But as said\read on the internet, often there could be a
front-end\outside mail server and then we could be delivered by
another back-end\inside mail server (so, behind the emails server(s),
the headers-emails may have suffered some kind of refection).
Anyway, AFAIK and concerned, I'm pretty sure to have a proof of
concept that Synapse converses in an encrypted way between my
connected writting socket TCP-IP interface and the so called front-
end\outside mail server (many thanks a lot to WireShark). Behind it
and up to my mailbox, it's a different story.

If anyone has a simpler method, or a doubt about the evidence, please
let me know.