This should be submitted at http://pear.php.net/bugs/ as we don't 
maintain Net_Sieve.

The problem is in horde/pear/Net/Sieve.php as it does not fetch the 
CAPABILITY string send after STARTTLS:



  http://tools.ietf.org/html/draft-martin-managesieve-08#section-2.2



  "After the TLS layer is established, the server MUST re-issue the

      capability results, followed by an OK response. This is necessary to

      protect against man-in-the-middle attacks which alter the

      capabilities list prior to STARTTLS. This capability result MUST NOT

      include the STARTTLS capability."



This patch allows TLS working:

@@ -373,6 +373,11 @@

                  if (PEAR::isError($res = $this->_startTLS())) {

                      return $res;

                  }

+                               // Get STARTTLS capability and parse

+                if (PEAR::isError($res = $this->_doCmd())) {

+                    return $res;

+                }

+                               $this->_parseCapability($res);

              }

          }

So, whatever the outcome is, it seems to be Net_Sieve that has 
inconsistent behavior?

I'm using ManageSieve path with Dovecot v1.0.10.



The behavious is different, if I disable TLS in ./pear/Net/Sieve.php.

With TLS I see the output of LISTSCRIPTS.

Without TLS I see the contents of the active script.



I need to figure out, how to debug a TLS session.

Using ManageSieve you can "Show Active Script", which displays the 
output of the LISTSCRIPTS command. However, the script is not shown.



It would be good to display the contents of the active script as well, 
as it was in Ingo v1.1.4.



Moreover, it would good to have a state shown above, like "the server 
script matches the current Ingo script" or not.