Re: [kitten] I-D Action: draft-ietf-kitten-gss-loop-00.txt

[Benjamin Kaduk <[e-mail]>]

On Sun, 11 May 2014, [e-mail] wrote:

>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Common Authentication Technology Next Generation Working Group of the IETF.
>
>        Title           : Structure of the GSS Negotiation Loop
>        Author          : Benjamin Kaduk
> 	Filename        : draft-ietf-kitten-gss-loop-00.txt
> 	Pages           : 17
> 	Date            : 2014-05-08
>
> Abstract:
>   This document specifies the generic structure of the negotiation loop
>   to establish a GSS security context between initiator and acceptor.
>   The control flow of the loop is indicated for both parties, including
>   error conditions, and indications are given for where application-
>   specific behavior must be specified.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-kitten-gss-loop/
>
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-ietf-kitten-gss-loop-00

The only changes of note are in the C sample code.
The controversial comment about "safe to call gss_release_buffer twice on 
the same buffer" is removed, and the behavior changed slightly.  Inside 
the loop, the buffer is always released, which is safe.  Since 
gss_release_buffer is required to zero the length field, that is what is 
checked in the outer cleanup label to avoid calling gss_release_buffer 
twice.  I also made some style tweaks, inspired by Greg's comments, and 
changed the name of the "context_established" variable to reflect which 
side of the exchange was established.  I did not take Nico's suggestion of 
adding in a check in the acceptor for whether the authenticated initiator 
name was authorized, as that would be a fair amount of extra code and 
probably be mission creep.

-Ben