pfSense » pfSense Packages

It was not removed, it's supposed to be used automatically when you tick SSL and the mailserver is advertising STARTTLS. If it doesn't work, then there's some bug with phpmailer or the mailserver behaves in a non-standard way.

Hi!

Well, that is kind of strange way to treat the issue, let's not jump to conclusions that fast.

I had a bit more time to look at this today and I can confirm that this is a bug in mail_reports.inc

First - I tested with openssl - all perfect. Then I tested with Gmail - same issue.
Finally, I looked up "Opportunistic TLS" (https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting#opportunistic-tls) - it clearly states that automatic STARTTLS will work by default, unless it is disabled with:

$mail->SMTPAutoTLS = false;

And that is exactly what version 3.1 does - it disables handling of STARTTLS if STARTTLS checkbox is set (else part):

    if (isset($config['notifications']['smtp']['ssl'])) {
        $mail->SMTPSecure =  "ssl";
        $mail->SMTPAutoTLS = true;
    } else {
        $mail->SMTPSecure =  "";
        $mail->SMTPAutoTLS = false;
    }

Obviously, this change was not tested properly.

This can be fixed by removing SMTPAutoTLS from both parts of if statement or, much better - having another check box to toggle "Opportunistic TLS".

So please - reopen this bug.

Dmitry Gromov wrote:

And that is exactly what version 3.1 does - it disables handling of STARTTLS if STARTTLS checkbox is set (else part):

Erm, no, that's not what it does. It disables STARTTLS when you uncheck "Enable SMTP over SSL/TLS". Just don't do that.

Are we looking at different codebases?

There are two checkboxes on /usr/local/www/system_advanced_notifications.php - "Enable SMTP over SSL/TLS" and "Enable STARTTLS"
First one sets $config['notifications']['smtp'] to 'ssl', second one sets it to 'tls'

In the if statement from mail_reports.inc I quoted above only 'ssl' value is handled. If it is set to 'tls', else part executes, effectively disabling STARTTLS.

The old code in 3.01 handled both and worked properly:

    if ((isset($config['notifications']['smtp']['ssl']) && $config['notifications']['smtp']['ssl'] != "unchecked") || $config['notifications']['smtp']['ssl'] == "checked")
        $mail->SMTPSecure =  "ssl";

    if ((isset($config['notifications']['smtp']['tls']) && $config['notifications']['smtp']['tls'] != "unchecked") || $config['notifications']['smtp']['tls'] == "checked")
        $mail->SMTPSecure =  "tls";

I must be speaking Chinese. Tick the "Enable SMTP over SSL/TLS" and it will work. Simple. (The "Enable STARTTLS" thing does not even exist any more on 2.4.)

I am glad it works for you in 2.4, but last I checked 2.3.3-RELEASE-p1 is the current release and it does NOT work there.
There is a difference between SMTPS (Enable SMTP over SSL/TLS) which is usually used on port 465 and STARTTLS (usually on 25/587).
You can't simply autodetect between them.
SMTPS on port 465 works, o course, but so did STARTTLS on port 587 until this change - and it is easy to test against Gmail SMTP server in pfSensse 2.3.3

It works just fine on 2.3.3 when you tick the checkbox that you stubbornly refuse to tick for god knows what reason. Have a nice day.

Hi!

It looks like you do not understand the difference between SMTPS and STARTTLS.

If I check "Enable SMTP over SSL/TLS" AND change port to 465 - it will work with SMTPS, I do not dispute that.
However, STARTTLS over port 587 DOES NOT WORK. And it cannot work - because php mailer's property SMTPSecure explicitly specifies which protocol to use - if you set it to 'ssl' it will only use SMTPS and will not use STARTTLS.

I would suggest that you understand the difference between SMTPS and STARTTLS and how they are configured in php mailer and how and when they are used.

Once again - there is no issue with SMTPS - it works fine with Google or FastMail on port 465.
The issue (as per subject) is with STARTTLS - it does NOT work for this package version only after the recent update.
STARTTLS works perfectly fine for pfSense notifications.

I'm telling you what to tick so that you have the mail reports working with STARTTLS without any changes needed in the package or anywhere else, but it's apparently hopeless.

Is it possible delete or replace attachment here?
Seems like I can edit message, but not delete or replace attached files...

I just spent some time, installed pfSense 2.4 in Hyper-V and tested.

Yes, there is no STARTTLS setting anymore, which might be OK but not recommended from compatibility point of view - using "Opportunistic TLS" works in most cases, but I bet there are instances which require explicit setting - see "Authentication failures" in "Troubleshooting PHPMailer Problems" as mentioned earlier.

HOWEVER - and this is the entire point of this bug report - mailreports package fails when port is set to 587 and automatic STARTTLS is required, but package explicitly disables it.

Please, re-open and assign this bug report properly, so it can be fixed.

In my opinion, it is better to set SMTPAutoTLS to TRUE because :

1 - if both actors (client and server) can use STARTTLS, the TLS will be initiated,
BUT if we specifiy explicitly SMTPAutoTLS to false, even if server can operate with TLS our client (pfsense) will never initiate TLS connection, and the server could only accept TLS.
It can result in an error as Dmitry describe.

2 - after reading the phpmailer class, it is suggested to let the default SMTPAutoTLS value to true "_even if `SMTPSecure` is not set to 'tls'_":

 /**
     * Whether to enable TLS encryption automatically *if a server supports it,
     * even if `SMTPSecure` is not set to 'tls'.*
     * Be aware that in PHP >= 5.6 this requires that the server's certificates are valid.
     * @var boolean
     */
    public $SMTPAutoTLS = true;

And all of this, whatever the port you use.

Pull request created : https://github.com/pfsense/FreeBSD-ports/pull/600