Subject: malformed messages (Re: draft-ietf-sasl-anon-01.txt)

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 03 Oct 2003 06:41:43 -0700

Simon raised this issue to me privately... but I think it needs
broader discussion (given that it is a technical issue).

At 02:19 PM 10/2/2003, Simon Josefsson wrote:
>* The document doesn't mandate any specific action when the client
>  send an invalid string (e.g., one that is rejected by string
>  processing).

That is, what should the implementation do if the message it receives
is malformed?

I note that this issue is likely not unique to ANONYMOUS.  So, maybe
it should be dealt with in base SASL specification.

I'm thinking a malformed message should be treated as a protocol
error in the application protocol.

Comments?

Kurt

---

From: Lyndon Nerenberg <[email-masked]>
Date: Fri, 03 Oct 2003 01:39:46 -0600

>>  processing)
[...]
> That is, what should the implementation do if the message it receives

In the absence of a very compelling reason to do otherwise, the 
application should immediately fail the transaction. "Be liberal in what 
you accept" has no place here. However, I'm more concerned about protocol 
parser state machines getting out of sync (see the recent spate of -- 
again -- ASN.1 parser bugs) than applications misinterpreting bogus realm 
strings.

> it should be dealt with in base SASL specification.
[...]
> error in the application protocol.

[Son-of-]2222 is a framework document, so I'm not sure if we can mandate 
that sort of behaviour in it. But that cannot stop us from suggesting 
some extremely rude behaviour towards authors of deviant software in the 
Security Considerations section.

--lyndon

---

From: Sam Hartman <[email-masked]>
Date: Fri, 03 Oct 2003 13:59:57 -0400

>>>>> "Kurt" == Kurt D Zeilenga <[email-masked]> writes:

    Kurt> I'm thinking a malformed message should be treated as a
    Kurt> protocol error in the application protocol.

    Kurt> Comments?

This seems reasonable during the authentication phase, but I think we
may need to say something more specific about security layers.

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 18 Oct 2003 21:10:36 +0100

>error in the application protocol.
I agree. However, can you be more specific what do you want me to add to 
the base spec.

Alexey

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 03 Oct 2003 06:41:43 -0700

Comments?

Kurt

---

From: Lyndon Nerenberg <[email-masked]>
Date: Fri, 03 Oct 2003 01:39:46 -0600

[...]

[...]

--lyndon

---

From: Sam Hartman <[email-masked]>
Date: Fri, 03 Oct 2003 13:59:57 -0400

Kurt> Comments?

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 18 Oct 2003 21:10:36 +0100

Alexey