Subject: Re: [Extra] AD review of draft-ietf-extra-imap-unauth-00.txt

From: Barry Leiba <[email-masked]>
Date: Fri, 1 Jun 2018 10:43:25 -0400

> 3.  UNAUTHENTICATE Command
>
>    Arguments:  None
>
>    Responses:  no specific response for this command
>
>    Result:     OK - completed, now in not authenticated state
>                BAD - command unknown or arguments invalid
>
>    This command directs the server to reset all connection state, except
>    for state at the TLS [RFC5465] layer.  Upon completion, the server
>    connection is placed in not authenticated state.  This represents
>    transition 7 in the State Machine Diagram (Section 5).
>
>    If a mailbox was selected, the mailbox ceases to be selected but no
>    expunge event is generated.  If a SASL [RFC4422] security layer was
>    active, it terminates immediately after the server sends the CRLF
>    following the OK response.  For the client, it terminates immediately
>    after the CRLF following the UNAUTHENTICATE command.
>
> Does this mean that the SASL security layer ends for the client even if
> the server returns BAD? I understand that this is very unlikely. Maybe
> you should clarify that the server MUST NOT return BAD response to the
> client if it advertises this extension.

I don't think that's viable.  If the client sends "UNAUTHENTICATE
FLARB", the correct response is BAD.  And a response of BAD in IMAP
always means that the command was not done.

On the other hand, according to general IMAP rules, if the command is
properly formed, "UNAUTHENTICATE" with no bogus parameters, then BAD
is never a proper response if support has been advertised.  And this
already says that NO isn't a valid response.

I'm not sure what you're really looking for.  Maybe this?:

<<
BAD - command unknown or arguments invalid; nothing has been done and
the session's state is unchanged

Barry

---

From: "Chris Newman" <[email-masked]>
Date: Fri, 01 Jun 2018 10:33:58 -0700

There's already text about why "NO" is disallowed. I can add text to 
specify that a BAD response is only permitted if the command syntax is 
incorrect, the protocol is in the wrong state, or the extension is not 
advertised.

		- Chris