Re: [lemonade] Re: PIPELINING, AUTH, and CHUNKING

Tony Finch wrote on 2/23/06 12:56 +0000:

> On Wed, 22 Feb 2006, Chris Newman wrote:
>> Tony Finch wrote on 2/22/06 0:54 +0000:
>>
>> > Current securely authenticated message submission requires at least
>> > eleven round trips (including TCP startup and shutdown). BURL can
>> > reduce this to nine.
>>
>> I'm glad someone noticed that little feature I slipped into BURL :-)
>
> Yes it is nice, but on reflection I think the way it is specified isn't
> ideal. In particular, to quote that bit from RFC 2920 again:
>
>    Additional commands added by other SMTP extensions may only appear as
>    the last command in a group unless otherwise specified by the
>    extensions that define the commands.
>
> So I think the BURL spec is wrong to talk about pipelining AUTH, and if
> you want to allow pipelined AUTH it should be specified as an update to
> RFC 2554.
>
> Furthermore, it isn't safe in all situations for a client to pipeline a
> single round-trip AUTH. For example, it's common to have dual-purpose MSA
> and MX servers which operate in MSA mode after AUTH and MX mode otherwise.
> If the client pipelines an AUTH and an intended submission, but the auth
> fails, bad things will happen - recipients will be rejected that would
> have been OK, an incomplete message will suffer an anti-spam penalty
> instead of being fixed up, etc.

Well, if a server advertises all of BURL, PIPELINING, and AUTH PLAIN/EXTERNAL, 
then it must permit AUTH PLAIN/EXTERNAL to be pipelined in order to comply with 
the BURL spec.  A bit convoluted, but that's what the specs say.  Yes, this 
would probably be better done in an RFC 2554 update, but I don't have time to 
write one.

> Pipelined AUTH is OK if the server is going to reject any un-authenticated
> submissions, in which case the server should explicitly say so, perhaps by
> using an EHLO keyword line such as 250 PIPEAUTH PLAIN EXTERNAL.

BURL is a submit-only extension with a normative reference to 
draft-gellens-submit-bis-02 which requires authentication.  So it's safe for 
clients to assume authentication is required if both BURL and AUTH are 
advertised.

                - Chris

_______________________________________________
lemonade mailing list
lemonade@ietf.org
https://www1.ietf.org/mailman/listinfo/lemonade