Re: [Extra] draft-ietf-extra-imap4rev2-04 review

[Alexey Melnikov <[e-mail]>]

On 26/03/2019 15:42, Chris Newman wrote:

> On 26 Mar 2019, at 15:13, Ned Freed wrote:
>>> On 25 Mar 2019, at 13:04, Timo Sirainen wrote:
>>> >> 3.4.  Logout State
>>> >>
>>> >
>>> >>    A server MUST NOT unilaterally close the connection without
>>> >> sending
>>> >>    an untagged BYE response that contains the reason for having done
>>> >> so.
>>> >
>>> > Also already in RFC 3501, but this MUST NOT has to be violated
>>> > sometimes. For example otherwise it would allow client to FETCH a
>>> > large message and keep reading it very very slowly over days, and
>>> > server wouldn't be allowed to disconnect it, because it can't send 
>>> BYE
>>> > in the middle of the large mail literal.
>>
>>> Another example is if a client gets hung up (or goes silently offline)
>>> during a TLS negotiation. The server has to eventually timeout the
>>> connection but it would be semantically wrong to send a "* BYE" since
>>> there's no data channel. One case where this happened was when our SSL
>>> stack dropped support for an SSLv2-compatible hello (allowed by RFC
>>> 6176), but some very old client kept sending such a hello 
>>> (prohibited by
>>> RFC 6176). Incidentally, SSLv2 is completely incompatible with SSLv3 so
>>> the client sends something that's not sufficient to complete an SSLv3
>>> packet so both ends get stuck waiting until one side hangs up.
>>
>> There was a suggestion (I think) during the meeting that this should 
>> be handled
>> by sending the TLS equivalent of "* BYE". Which sounds fine in 
>> theory, but as
>> said at the time, I'm skeptical that many/most TLS implementations 
>> provide
>> implementors with the means to conveniently do that.
>
> I didn't hear such a suggestion. I made the observation that a wedged 
> TLS negotiation is a scenario where sending "* BYE" shouldn't be done. 
> It was suggested that example be mentioned in the document. I did not 
> mention the fact that TLS has it's own alert syntax that could be used 
> instead of "* BYE" -- I agree discussing that would be a bad idea.

To followup on this: I've changed "MUST NOT unilaterally close the 
connection without sending BYE" to "SHOULD NOT ...". Do people think 
this is sufficient?

Best Regards,

Alexey