Re: [kitten] GSS_GetMIC and iovs

[Nico Williams <[e-mail]>]

On Tue, Sep 3, 2013 at 1:26 PM, Chris Newman <[e-mail]> wrote:
> I would recommend not adding any iovec-related APIs to a security interface.
> My experience with such APIs in real-world SSL usage is that they are a
> common source of serious and hard to diagnose bugs. These APIs tend to be
> rarely used interfaces so they get inadequate testing, code review and
> real-world use. I inherited and maintain code that made heavy use of iovecs
> and I'm busy removing them whenever I can. My experience is that the
> maintenance, complexity and associated negative security cost of these
> interfaces far exceeds any potential performance benefit.

But there really are apps that care about performance...  NFS (the app
in question here, via RPCSEC_GSS) is one such app.

Mind you, RPCSEC_GSS if a bit of a performance disaster anyways
because it requires two per-message token function calls per-RPC (when
protecting the data, not just the RPC header), and should be re-done
(maybe) so it at most does one GSS per-message token call per-RPC.
But that wouldn't make RPCSEC_GSS not need iovec GSS calls.

Nico
--