Subject: Re: UW server and the name "inbox"

From: "Russ Atkind" <[email-masked]>
Date: Sun, 10 May 1998 01:52:48 -0400

Actually, although I didn't quite phrase it that way originally, I did
intend the two questions below as general IMAP protocol questions (I've now
reworded them).  It doesn't really bother me one way or the other about the
UW server, but I wanted to find out if the behaviors I mentioned were
intended to be permitted by the spec, or if they're bugs.  Your answer would
suggest that they're bugs, but I'm not sure if that applies to both of my
questions or only the "inbox" question, so could someone clarify?  Thanks.

Russ

Question #1:

> I got the following reactions from our UW 10.187 server:
> 
> a008 list "" "INBOX"
> * LIST (\NoInferiors) NIL INBOX
> a008 OK LIST completed
> a009 list "" "inbox"
> a009 OK LIST completed
> a010 list "" "Inbox"
> a010 OK LIST completed
> a011 logout
> * BYE pantheon-po03.its.yale.edu IMAP4rev1 server terminating connection
> a011 OK LOGOUT completed
> 
> 
> It would appear to me that the spec says that the response should be
> exactly the same regardless of the case of "inbox."  Am I right?

Question #2:

> I have noticed that the UW v10.187 server, at least as it configured at my
> site, drops the connection without issuing an untagged BYE if the client
> attempts to login with a non-existent username.  If the username does
exist
> but the wrong password is given, it gives a tagged BAD response and stays
on
> the line.
> 
> My question is, is this kosher IMAP behavoir?  I guess I
> don't recall seeing this restriction in the spec, but I had thought that
> dropping the connection on either side without any warning was not good
> etiquette.

---

From: Mark Crispin <[email-masked]>
Date: Sun, 10 May 1998 02:24:19 -0700 (PDT)

Both of the behaviors that you describe are bugs.  I vaguely remember the
INBOX list case-dependence bug from long ago.  I don't remember the dropping a
connection with a non-existant user name bug at all.

In general, though, it is better to contact the vendor or the vendor specific
mailing list (e.g. the info-cyrus list for questions about Cyrus, the c-client
list for questions about the UW/c-client server, etc.) of an implementation
first.

It's also better to make sure that you're testing against the most recent
version of the implementation.  If there is a newer version, there was a
reason why the old version was changed.  Sometimes it is "just" a new feature,
but other times a bug got fixed.  If you're trying to understand the protocol,
you are best off testing against newer, better debugged versions than against
older versions with known bugs.

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 11 May 1998 01:02:30 +0400

> > exactly the same regardless of the case of "inbox."  Am I right?

Yes. As Mark said, "Inbox" is case insensitive.

> > attempts to login with a non-existent username.  If the username does exist
> > but the wrong password is given, it gives a tagged BAD response and stays on
>
> > the line.
> >

My personal opinion that server should behave exactly the same way whether or
not user name is valid.
Otherwise it is security vulnerability and can be used for attacks.

BYE untagged response should be sent before disconnect.

Alexey Melnikov
------------------------------------------
SMTP/POP3/IMAP4/ACAP servers creation team
"ACAP Explorer" client
Imap Development Kit (my own product)

Epsylon Technologies, Russia
 http://www.demo.ru
------------------------------------------