Subject: Re: FTP GSSAPI, Channel Bindings, and Windows 2000

From: Ken Raeburn <[email-masked]>
Date: 05 Sep 2000 12:35:33 -0400

"Matt Crawford" <[email-masked]> writes:
> Bear in mind that SHOULD has a formal meaning, and any omission of a
> SHOULD behavior MUST be justified ...

"SHOULD" does per RFC 2119, but does lower-case "should" when the
standard text specifying compliance with RFC 2119 is not used?

Even if so, it's not that hard to come up with a "justification", as
long as the behavior is allowed.  ("We're Microsoft, deal with it.")

> I see that the GSS_C_AF_* constants from RFC 2744 align with the AF_*
> constants in my systems <sys/socket.h>, so it would be consistent to
> continue that and #define GSS_C_AF_INET6 28.  (On the other hand,
> since the address is passed as type,length,contents there's no
> ambiguity if you use the same type.)

Clearly they do match up.  On the other hand, it's not specified that
way, leaving the overly pedantic reader uncertain whether to follow
the AF_* lead or just file IPv6 addresses under "Internet address
type".  I'd certainly be inclined to go with GSS_C_AF_INET6, but then
I wouldn't be surprised to have someone complain about using a value
that's not defined by any spec.

> Note that the sockets API debate is not quite over concerning exactly
> when a socket bound to an IPv6 address should receive IPv4 packets as
> well.

(grumble)

I need to catch up on that discussion...  not that I really have
anything invested in any particular outcome, but it'd be good to
familiarize myself with the existing and proposed schemes, if I want
to have half a chance of making the MIT KDC talk IPv6 properly.

Ken

---

From: "Matt Crawford" <[email-masked]>
Date: Tue, 05 Sep 2000 10:46:36 -0500

> RFC 2228 Appendix I says "should", not "must".  That suggests to me
> that it could be omitted (but probably shouldn't be allowed to be
> specified and incorrect, of course).

RFC 2119:
    3. SHOULD   This word, or the adjective "RECOMMENDED", mean that there
       may exist valid reasons in particular circumstances to ignore a
       particular item, but the full implications must be understood and
       carefully weighed before choosing a different course.

> Side question: Is GSS_C_AF_INET the correct value to use for IPv6
> addresses, or should a GSS_C_AF_INET6 be defined?

				Matt

---

From: Ken Raeburn <[email-masked]>
Date: 01 Sep 2000 20:15:12 -0400

Side question: Is GSS_C_AF_INET the correct value to use for IPv6
addresses, or should a GSS_C_AF_INET6 be defined?  A quick Google
search turns up that name in exactly one place, a ChangeLog file in
Heimdal in the FreeBSD source tree mirrored on
download.sourceforge.net.

Ken

---

From: Martin Rex <[email-masked]>
Date: Fri, 1 Sep 2000 17:34:59 +0200 (METDST)

Jeffrey Altman wrote:
> 
> Martin Rex has pointed out to me that the Windows 2000 Kerberos 5 SSPI
> does not support the functionality necessary for implementing Channel
> Bindings in GSSAPI-KRB5.

This issue raises another interesting question:
My GSSAPI v2 wrapper for W2K Kerberos silently ignored the channel
bindings.  Is that ok, or should my wrapper rather fail upfront in
gss_init_sec_context() and gss_accept_sec_context() when the
application tries to pass real channel bindings?

-Martin