KB Article #157485

TLS handshake fails if remote side does multiple writes to the socket

Problem

 

TLS connections fails after successfully negotiating the TLS ciphers with a remote relay. Events logged:

 

1947 Zero byte IO count exceeded

1003 IO error while connected to remote SMTP server

 

SMTP session run:

     EMF connects to a remote relay, does an EHLO, STARTTLS, and another EHLO after the SSL session has been established. At this point,if the remote relay is doing multiple writes to the socket for the second EHLO response, EMF will not be able to read it entirely and the session breaks.

 

Resolution

 

The described behavior resembles a known issue with EMF. It is caused by the fact that the remote relay makes multiple writes to the same socket which is not interpreted by EMF over TLS.

 

Solution I   

     Work with remote relay's administrator to disable the multiple writes to the socket for the EHLO response and do one write to the socket. That way, EMF will be able to do a single read and handle the response properly. This is why even though TLS negotiation and handshake is successful, the connection ends up with an I/O SMTP error and message falls in the Retry queue on EMF side.

 

 Mimecast

     It has been found that the SSL implementation in EMF has been impacted by a Java upgrade at Mimecast side. Further investigation suggested that the problem had been caused by an incompatibility between the latest version of Java, to which Mimecast recently upgraded.

     Mimecast has now rolled back to the previous version of Java which resolved the incompatibility and TLS communication with EMF servers is restored.

 

Solution II

     If the first solution is not possible, or out of reach due to policy constraints at remote end, an option is to consider using MailGate product (along side with EMF or completely replacing it) to handle the important TLS communication with the affected partner(s).

     MailGate uses advanced Mail Transfer Agent (MTA) which supports use of multiple socket writes. The opportunity to use MailGate to resolve this issue, should be discussed with your Account representative in Axway.