id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
26759	TLSv1-only SMTP servers not supported under Django 1.9.7 / Python 3.4.4 (win32) / OpenSSL 1.0.2d	Rudolf Cardinal	nobody	"Connecting to a Microsoft (E)SMTP mail server with the Django default e-mail backend (django.core.mail.backends.smtp.EmailBackend) and TLS can fail with the following error:

    ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:600)

This appears to occur with some (more recent) versions of Python's smtplib, ssl (and underlying OpenSSL) with servers that only support TLSv1. There is no option in Django to force the TLS protocol version that I can see.

The simplest illustration of failure is with:

    import smtplib
    s = smtplib.SMTP(host, port)  # port typically 587
    s.ehlo()
    s.starttls()  # fails with ssl.SSLEOFError as above

which succeeds (with such servers) with a small modification to force TLSv1:

    import smtplib
    import ssl
    s = smtplib.SMTP(host, port)
    c = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
    s.ehlo()
    s.starttls(context=c)  # works

There is a suggestion of a dependence on exact OpenSSL version in the docs at https://docs.python.org/3.4/library/ssl.html (""Which connections succeed will vary depending on the version of OpenSSL..."").

Therefore, a proposed framework alternative backend is one that enforces TLSv1 when required, e.g. as attached. This can be selected with Django's EMAIL_BACKEND setting, so can be added by users, but I'd have thought that continuing to support such servers is important for the Django core project as well.

Test software: Django 1.9.7; Python 3.4.4 (win32) using OpenSSL 1.0.2d (from ssl.OPENSSL_VERSION). Test server: Microsoft SMTP Server id 8.3.83.0 (from resulting e-mail headers).
"	Bug	closed	Core (Mail)	1.9	Normal	wontfix	email SMTP TLS SSL SSLEOFError TLSv1		Unreviewed	1	0	0	0	1	0