IETF Logo Mail Archive

Re: [kitten] Negotiating "DCE style" -- a proposal and advice request

"Stefan (metze) Metzmacher" <metze@samba.org> Wed, 08 June 2011 21:14 UTC

Return-Path: <metze@samba.org>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C11C511E80CE for <kitten@ietfa.amsl.com>; Wed, 8 Jun 2011 14:14:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.577
X-Spam-Level:
X-Spam-Status: No, score=-3.577 tagged_above=-999 required=5 tests=[AWL=-1.022, BAYES_00=-2.599, DATE_IN_PAST_03_06=0.044]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iXkzEVNSDPko for <kitten@ietfa.amsl.com>; Wed, 8 Jun 2011 14:14:54 -0700 (PDT)
Received: from mo-p05-ob6.rzone.de (mo-p05-ob6.rzone.de [IPv6:2a01:238:20a:202:53f5::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7198F11E809E for <kitten@ietf.org>; Wed, 8 Jun 2011 14:14:52 -0700 (PDT)
X-RZG-AUTH: :IWkQb0WIdvqIIwNfJfyiKBgoQwjwJ7eL6yL6M6h8JiYXs/HrEl2yUn8V3w==
X-RZG-CLASS-ID: mo05
Received: from [172.30.123.11] (dvm01.metzemix.de [85.214.18.123]) by post.strato.de (mrclete mo60) (RZmta 25.18) with ESMTPA id x02b42n58JbKZO ; Wed, 8 Jun 2011 23:14:47 +0200 (MEST)
Message-ID: <4DEFB74D.5060402@samba.org>
Date: Wed, 08 Jun 2011 19:54:21 +0200
From: "Stefan (metze) Metzmacher" <metze@samba.org>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110516 Thunderbird/3.1.10
MIME-Version: 1.0
To: Nico Williams <nico@cryptonector.com>
References: <BANLkTi=amWmHMfrEO02WtNPDdeO1gNvhmg@mail.gmail.com> <BANLkTin8-TEdfGoRw+PiMzAak1qVcFjZrQ@mail.gmail.com> <BANLkTik9vdp0b9bDqb-WbmfJf1M=Zzai9g@mail.gmail.com> <4DEEF9BC.4040509@samba.org> <BANLkTi=fdzYPDYT2tLXTQrLnnVnRF38Jjg@mail.gmail.com>
In-Reply-To: <BANLkTi=fdzYPDYT2tLXTQrLnnVnRF38Jjg@mail.gmail.com>
X-Enigmail-Version: 1.1.2
OpenPGP: id=0E53083F
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="------------enigA5CE3EF3782761DCB8500965"
Cc: kitten@ietf.org, ietf-krb-wg@anl.gov
Subject: Re: [kitten] Negotiating "DCE style" -- a proposal and advice request
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 08 Jun 2011 21:14:54 -0000

Am 08.06.2011 07:30, schrieb Nico Williams:
> On Jun 7, 2011 11:25 PM, "Stefan (metze) Metzmacher" <metze@samba.org>
> wrote:
>> Am 08.06.2011 04:10, schrieb Nico Williams:
>>> To give you an idea of how simple this is, see the attached patch (not
>>> yet tested, written in the last 30 minutes).
>>
>>
>> +           if (ctx->flags & GSS_C_DCE_STYLE_OK) {
>> +               ctx->flags |= GSS_C_DCE_STYLE;
>> +               ctx->auth_context->flags |=
>> +                   KRB5_AUTH_CONTEXT_EXTRA_AP_PDU_REQUIRED;
>> +           }
>>
>> Please don't imply GSS_C_DCE_STYLE.
> 
> Why not?

Because the new feature should be completely unrelated to GSS_C_DCE_STYLE.

GSS_C_DCE_STYLE has more implications than just the 3 leg handshake.
E.g. it also changes the PDU layout!

I guess you don't want to force implementers of the new feature to also
implement the mircrosoft/DCERPC specific details.

I think it's fine if the application chooses to combine them, but the
library should
not enforce that.

metze

v2.46.0 | Report a Bug | By Email | System Status