MTA closing connection after 552 response

What is considered the proper thing for an MTA to do when a client
sends more than an allowed amount of content in the DATA portion of an
SMTP dialogue?

Assuming the ESMTP SIZE option is being used, then the client has
already been informed of the maximum allowable size, so if the client
exceeds the size, the MTA should have the right to assume the client is
either broken or malicious. Either way, it would be fair for the MTA to
close the connection. However, according to section 3.9 of RFC 2821:
=======================================
An SMTP server MUST NOT intentionally close the connection except:

- After receiving a QUIT command and responding with a 221 reply.

- After detecting the need to shut down the SMTP service and
returning a 421 response code. This response code can be issued
after the server receives any command or, if necessary,
asynchronously from command receipt (on the assumption that the
client will receive it after the next command is issued).
=======================================

So, if an MTA knows that a client has "broken the rules" and sent more
than it was allowed to send what safe thing can it do? If it continues
reading, looking for a QUIT or RSET, what if the client sends multiple
terabytes of data? This sounds like a denial of service attack that the
MTA MUST deal with...

Thanks,
-Eric

.

Relevant Pages

  • Re: Getting events from C++?
    ... Your object is not any different from a normal MTA client. ... > I'm building a MTA object on top of a STA object. ...
    (microsoft.public.vc.atl)
  • Re: About undisclosed recipient
    ... > As I indicated in my link to the RFC, any "white space", i.e., a blank space ... Same MTA, different clients connecting, different results. ... MTA "client aware", and inserting different results by client? ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: marshalling
    ... Are you sure that the server is an out-of-proc server? ... But now that the client is MTA, marshalling kicks ...
    (microsoft.public.vc.atl)
  • Re: Finalizer Queue
    ... The COM client which ... until the finalizer thread has run the "finalize" on the RCW. ... The most obvious solution is to le the client thread join the MTA ... you will have to implement deterministic destruction of the .NET object, ...
    (microsoft.public.dotnet.languages.csharp)
  • [REVS] Backdoor Spotcom Analysis
    ... Spotcom is a backdoor client application that allows a hacker to control ... The server IP address is hard-coded in ... msrsvp.exe accepts a couple of command line arguments. ... the packet payload. ...
    (Securiteam)