MBOX-Line: From mrc+imap at panda.com  Tue Mar  8 15:00:28 2011
To: imap-protocol@u.washington.edu
From: Mark Crispin <mrc+imap@panda.com>
Date: Fri Jun  8 12:34:45 2018
Subject: [Imap-protocol] Pipelined commands before completion of STARTTLS
In-Reply-To: <alpine.BSO.2.00.1103081341530.1958@morgaine.smi.sendmail.com>
References: <4D7690AE.8020003@andrew.cmu.edu>
	<alpine.BSO.2.00.1103081341530.1958@morgaine.smi.sendmail.com>
Message-ID: <alpine.OSX.2.00.1103081424060.791@hsinghsing.panda.com>

On Tue, 8 Mar 2011, Philip Guenther wrote:
>> 1. Send a BAD response if a command is pipelined after STARTTLS.
>>
>> 2. Ignore the pipelined cleartext commands.
>
> 3. immediately close the connection
>
> 4. Treat data after the CRLF as data for the TLS handshake (i.e., to shave
>   an RTT off in the success case).

My observation of all of this:

Behavior 1 is difficult to do consistently, especially if the TLS
handshake starts with client data (no initial server data).

Behavior 2 is the expected implementation today.

Behavior 3 is a natural and expected consequence of the TLS handshake
being invalid.  However, behavior 3 may have the effect of making an MITM
attack become a DOS.

Behavior 4 can not be deployed in a reliable way without some negotiated
capability, due to behavior 2.


My recommendations follow.

Clients:
 	MUST NOT pipeline or otherwise transmit anything after STARTTLS
 	until such time as it is permitted to transmit a TLS handshake.

 	MUST NOT assume any behavior on the part of the server, until
 	such time as there is a negotiated extension for behavior 4.

Servers:
 	MUST NOT implement behavior 1.

 	MUST implement behavior 2 or 4, at the server's option.  Note
 	that, due to timing, behavior 2 is actually a special case of
 	behavior 4.

 	MUST NOT implement behavior 3, except as a consequence of an
 	invalid TLS handshake in a behavior 4 implementation.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

