[ietf-nntp] AUTHINFO draft 01

[Russ Allbery]

Clive D W Feather <clive at demon.net> writes:

> No. However, I do think I should add text explaining what's going on
> here in the syntax. Here's what I'm planning:

>    The non-terminals "command-line", "command-continuation", and
>    "response" between them specify the text that flows between client
>    and server.  For each command, the sequence is:
>    o  the client sends an instance of "command-line";
>    o  the server sends an instance of "response";
>    o  while the latest response is one that indicates more is required
>       (in general, a 3xx response):
>       *  the client sends an instance of "command-continuation";
>       *  the server sends an instance of "response".

> This reminds me. The meaning of 3xx response codes has traditionally
> (SMTP, POST, IHAVE) been "you now need to send me more material as part
> of this command". For AUTHINFO USER, 382 is being used to mean "you need
> to invoke another command now". I don't think this meets the letter of:

>       3xx - Command OK so far; send the rest of it.

> and I'm sure it doesn't meet the spirit. I can see two fixes:
> (1) Replace the 382 response with a 2xx code.
> (2) Define AUTHINFO PASS as being continuation text to AUTHINFO USER,
> rather than as a separate command.

Bleh.  I don't like either of those options; this is a code in widespread
use and I don't think we should fiddle with it, and AUTHINFO PASS is
treated like a command in every NNTP implementation I'm aware of.  Can't
we just allow this within the meaning of 3xx for NNTP?  I know it's not
particularly clean, but then what is, when it comes to NNTP codes?

> Russ: I can't recall; does the base document require text pointing at
> the AUTHINFO and TLSSTART documents?

It shouldn't require that, no, unless the IESG specifically asks for it.
I don't *think* they were specifically asking for it, but now I can't
remember for sure.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>