Re: POP handling commands given in wrong state

[Mykyta Yevstifeyev <[e-mail]>]

26.07.2011 11:12, Paul Smith wrote:
> On 26/07/2011 05:59, Mykyta Yevstifeyev wrote:
>
> [ . .  .]
>
> If the state was server defined, so that it may change on the server's 
> decision, rather than by purely bad coding in the client, then yes, an 
> extended response code may be useful, but when it is only bad coding 
> in the client which can make it happen - no.
Paul,

[Adding Alexey Melnikov to CC list; see below.]

I meant just the situation like this.  Eg., when one is using 
POP3-over-TLS whereas TLS connection is established before POP 
transaction starts, TLS negotiation may be used instead USER-PASS or 
AUTH authentication, entering the server into the TRANSACTION state; on 
the other hand, the server may require authentication under TLS layer, 
entering AUTHORIZATION state after establishing TLS connection.  I and 
Alexey Melnikov are currently working on the POP-over-TLS specification 
(https://datatracker.ietf.org/doc/draft-melnikov-pop3-over-tls/) and the 
problem is that the client don't know what state is the server in after 
TLS negotiation.  If the client tries giving USER and received -ERR, it 
may mean that the user name is unknown or that the user is authenticated 
already, and the client can't know for sure what does it mean.  Don't 
you have other idea of indicating the state?

<thinking>The user agent may allow the user to choose the authentication 
way for POP-over-TLS transaction.  Eg., Thunderbird allows me to set 
POP-over-TLS and then one of the following: (1) plain auth. under TLS, 
(2) use AUTH command, (3) use Kerberos, or (4) use TLS certificate.  I 
suppose if (4) is chosen, -ERR indicates that TLS certificate didn't 
lead to successful authentication and server is in AUTHORIZATION and +OK 
means that server is in TRANSACTION.  (1), (2) and (3) assume that the 
server enters the TRANSACTION state after TLS negotiation and requires 
additional authentication.  I don't know the situation with Outlook 
and/or something else, but I suppose it will be rather the same and this 
issue may be successfully resolved.  So what's your opinion, Alexey? 
(Comments from 3rd parties are welcome as well, of course.)</thinking>

Mykyta
> Just my 2p worth