Subject: Re: FTP GSSAPI, Channel Bindings, and Windows 2000

From: Ken Raeburn <[email-masked]>
Date: 02 Sep 2000 06:27:45 -0400

> Jeffrey Altman <[email-masked]> writes:
> >> > RFC 2228 Appendix I says "should", not "must".  That suggests to me
> >> > that it could be omitted (but probably shouldn't be allowed to be
> >> > specified and incorrect, of course).
> >> In my reading of that paragraph it seems to apply the SHOULD only to
> >> the usage of GSS_C_AF_INET as the address type when channel bindings
> >> are used.  It does not say anything about whether channel bindings are
> >> MAY, SHOULD or MUST.   But the tone of the paragraph appears to
> >> indicate a MUST.  Obviously, a MUST will break on win2000.

That whole document appears not to be very strict on the
MAY/SHOULD/MUST terminology.  But I count three uses of the word
"should" in that paragreph, the first describing what the
chan_bindings arguments *should* be, not what they *must* be.

Marc Horowitz <[email-masked]> writes:
> It looks like when I went through the later drafts looking at
> may/should/must, I missed this.  For interoperability, the
> chan_bindings must either always be present, or never be present.

Because of the way the API is set up, it strikes me as difficult if
not impossible to make this an optional field in an application
protocol unless a given implementation makes it optional in all
protocols.  (Which, given the weak recommendations in RFC 1964 that
Martin pointed out on the ietf-krb-wg list only, may also be compliant
even if not "recommended".)  Aside from that little detail, I wouldn't
see much problem with allowing the channel bindings to be missing or
ignored in the case of a lame implementation.

It appears that the intent is that channel bindings be used, but as I
read it, it is not a requirement.

> If it is possible to "be liberal in what we accept" in order to work
> with the SSPI, this is fine with me, but not if it causes us no longer
> to be "conservative in what we send" (that is, conformant to the
> spec).

That's about what I'd suggest -- keep sending channel bindings, but
allow them to be missing on receipt if MS isn't going to fix this
soon.

> There is always the option of using a different GSSAPI library than
> the one provided with the SSPI.

Yep.

---

From: Marc Horowitz <[email-masked]>
Date: 02 Sep 2000 04:49:30 -0400

If win2k's krb5 SSPI doesn't have the ability to set chan_bindings,
then it would appear to be incompliant with the GSSAPI spec.  This
would seem to be par for the course for Microsoft,

		Marc

>> > Side question: Is GSS_C_AF_INET the correct value to use for IPv6
>> > addresses, or should a GSS_C_AF_INET6 be defined?  A quick Google
>> > search turns up that name in exactly one place, a ChangeLog file in
>> > Heimdal in the FreeBSD source tree mirrored on
>> > download.sourceforge.net.
>> 
>> I believe that GSS_C_AF_INET6 must be defined.

I agree.

		Marc

---

From: Jeffrey Altman <[email-masked]>
Date: Sat, 2 Sep 2000 1:40:05 EDT

Jeffrey Altman * Sr.Software Designer
                 The Kermit Project * Columbia University
               612 West 115th St * New York, NY * 10025 * USA
     http://www.kermit-project.org/ * [email-masked]