Subject: [ldapext] Kerberos Integrity behavior

From: John McMeeking <[email-masked]>
Date: Fri, 12 Nov 2004 12:39:33 -0600

I've been asked a question about the correctness of a particular server's
behavior with respect to LDAP messages and GSSAPI messages when Kerberos
integrity and confidentiality is used.  Can anyone comment on this?

A particular server appears to be sending both search response and
completion messages (i.e. multiple LDAP messages) in a single GSSAPI
message.  Other servers we have tested send a single LDAP message in each
GSSAPI message.

Are both of these behaviors correct?

Thanks,

John  McMeeking

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "David Boreham" <[email-masked]>
Date: Fri, 12 Nov 2004 11:11:01 -0800

> Are both of these behaviors correct?

I suspect so. I've implemented the server side of the SASL/GSSAPI
encryption for LDAP (I think you're really talking about SASL here, but one 
of the
few SASL mechanisms that supports encryption is GSSAPI).

In my implementation I allowed for all the unaligned PDU combinations
(two or more LDAP PDUs in a SASL PDU; one LDAP PDU that
is larger than a SASL PDU; LDAP PDUs that straddle the beginning
and end of the SASL PDU). When I read the RFCs, I concluded that
there was insufficient detail to completely guide an implementation,
so I opted to handle all the resonable cases I could think of.

Coalescing the search result and the search result done PDUs
into a single TCP segment is a common optimization in LDAP
servers: it improves performance quite a bit for searches that
only yield one entry. In a server with that optimization, I wouldn't
be surprised if it were to send the two PDUs in one SASL message,
especially if the SASL encryption was done as a layer underneath
the existing I/O.

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 15 Nov 2004 14:58:21 +0000

>> Are both of these behaviors correct?
Yes.

> encryption for LDAP (I think you're really talking about SASL here, 
> but one of the

> and end of the SASL PDU).

Yes, SASL security layer works in the same way as TCP packet 
fragmentation does. So all the mentioned cases has to be handled.

> When I read the RFCs, I concluded that

I am wondering if RFC 2222bis (SASL) has to be clarified in this area?

> especially if the SASL encryption was done as a layer underneath

Alexey

---

From: "David Boreham" <[email-masked]>
Date: Mon, 15 Nov 2004 07:38:26 -0800

> I am wondering if RFC 2222bis (SASL) has to be clarified in this area?

It says "is processed by the security layer into buffers of protected data."

I think it would be reasonable to add something to the effect that
the buffering can be done without regard to any PDU, packet,
message or other delimiters present in the protocol stream.