SMTP Protocols - TLS connections > 1.1 missing

[addison74]

Inspecting this issue reported here #2169 I found the following:

Magento-SMTP-Pro-Email-Extension
Unfortunately the extension has not been maintained for 5 years although there is activity. Those who still use it should immediately merge some absolutely essential PR's to correct the reported and confirmed issues. Most likely there are updated forks that have already been merged but I didn't have time to look for them.

SMTP Protocols - TLS Connections > 1.1
When I tested the extension I received errors connecting to the local server that uses the SMTP TLS 1.2 protocol. I initially thought that the extension had an issue but I found from the errors reported on its page that it is a known issue among its users. Unfortunately OpenMage inherits an outdated version of ZF, at least in terms of SMTP protocols. The solution proposed by the users was to modify this file /lib/Zend/Mail/Protocol/Smtp.php.

STREAM_CRYPTO_METHOD_TLS_CLIENT = which is for TLS1.0, and change it to

STREAM_CRYPTO_METHOD_ANY_CLIENT = which Includes all protocols, SSL and TLS.

Based on this proposal I took a look at the following repository https://github.com/Shardj/zf1-future and found in the same file the following change starting with line 193:

        // If a TLS session is required, start negotiation
        if ($ this -> _ secure == 'tls') {
            $ this -> _ send ('STARTTLS');
            $ this -> _ expect (220, 180);
            if (! stream_socket_enable_crypto (
                $ this -> _ socket,
                true,
                STREAM_CRYPTO_METHOD_TLS_CLIENT | STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT | STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
            )) {
                / **
                 * @see Zend_Mail_Protocol_Exception
                 * /
                require_once 'Zend / Mail / Protocol / Exception.php';
                throw new Zend_Mail_Protocol_Exception ('Unable to connect via TLS');
            }
            $ this -> _ ehlo ($ host);
        }

STREAM_CRYPTO_METHOD_TLS_CLIENT | STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT | STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT included all TLS protocols, but excluded SSL, which is a necessary security measure.

As a conclusion we must migrate to ZF1-Future as soon as possible. I haven't made a comparison between /lib/Zend (OpenMage) and /lib/Zend (ZF1-Future) directories yet but I will do it soon. I found that in /app/code/core there is a directory called Zend, most likely a customization of ZF1 made by the Magento team.

Some of you have deepened this beneficial change to ZF1 and proposed PR's in this regard. Any opinion is welcome.

[fballiano]

can't wait to migrate to zf1-future

[sreichel]

As a conclusion we must migrate to ZF1-Future as soon as possible.y opinion is welcome.

Here we go #2827

[addison74]

"The Eagle has landed"