Subject: Re: Checksum flags field (section 4.1.1.1) in gssapi-cfx-04

From: Sam Hartman <[email-masked]>
Date: Mon, 01 Dec 2003 08:44:30 -0500

The anonymous flag is not currently supported by this mechanism.
There's currently no way to do that with Kerberos, so it is not
reasonable for an implementation of this mechanism to send that flag.

The prot_ready flag need not be sent over the wire to be useful.

---

From: Wyllys Ingersoll <[email-masked]>
Date: Mon, 01 Dec 2003 09:54:10 -0500

This is a nit,but section 5.1.1 is titled "Non-Kerberos Specific Codes"
but all of the codes defined are named "GSS_KRB5_S_G_***".
If they are "non-kerberos-specific", should the "_KRB5_" bit of those
names be dropped?

-Wyllys Ingersoll

---

From: Martin Rex <[email-masked]>
Date: Mon, 1 Dec 2003 20:55:12 +0100 (MET)

Simon Josefsson wrote:
> 
> RFC 2744 define the following flags as well:
> 
>    #define GSS_C_ANON_FLAG       64
>    #define GSS_C_PROT_READY_FLAG 128
>    #define GSS_C_TRANS_FLAG      256
> 
> Are these allowed to be set by implementations that support them?
> Are receivers forced to ignore them if they are set?

GSS_C_TRANS_FLAG and GSS_PROT_READY_FLAG are only relevant for the
local implementation, both peers have to *locally* and *independently*
decide whether they support this feature at the API level or not.

GSS_C_TRANS_FLAG is an indicator that the optional
gss_export_sec_context()/gss_import_sec_context() facility is
available for use with a security context (usually to transfer
the security context to another process).

GSS_C_PROT_READY may be used to indicate that message protection
services are available for use before a security context is
fully established (i.e. before the context establishment call
gss_init_sec_context or gss_accept_sec_context has returned
GSS_S_COMPLETE (and so far it is the only flag that an application
can evaluate *before* the context establishment call returns
GSS_S_COMPLETE).

-Martin

---

From: Sam Hartman <[email-masked]>
Date: Tue, 02 Dec 2003 11:51:21 -0500

>>>>> "Wyllys" == Wyllys Ingersoll <[email-masked]> writes:

    Wyllys> This is a nit,but section 5.1.1 is titled "Non-Kerberos Specific Codes"
    Wyllys> but all of the codes defined are named "GSS_KRB5_S_G_***".
    Wyllys> If they are "non-kerberos-specific", should the "_KRB5_" bit of those
    Wyllys> names be dropped?

No.  These error codes are specific to the krb5 GSSAPI mechanism even
though they represent more general problems than a kerberos problem.