Subject: Re: [sasl] RFC4752 (SASL/GSSAPI) interop problem

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 01 Dec 2009 10:40:54 -0500

--On Monday, November 30, 2009 06:26:34 PM -0600 Nicolas Williams 
<[email-masked]> wrote:

> For example, Microsoft's Active Directory requires that clients send '6'
> when the server is configured to require "LDAP signing and sealing".  So
> does the Perl CPAN RFC4752 implementation.  Whereas Cyrus SASL and
> derivative implementations, for example, require '4'.  (GNU SASL doesn't
> support security layers, therefore it is not affected by this interop
> bug.)

So, you're saying implementations like Cyrus reject '6' as invalid?
That just seems bogus.

> Clients cannot tell which interpretation a server uses.  They can only
> know a priori or try first one way, then the other.

Which means that clients that want to work around this will have to provide 
some sort of knob to know which to try.

> No, I'm not interested in an update to RFC4752 -- SASL/GS2 should just
> replace it, but the WG should be aware of this issue.

And in the meantime, we can just all use '1' and TLS, which seems to be 
what ~everyone does anyway.

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 1 Dec 2009 11:57:59 -0600

> So, you're saying implementations like Cyrus reject '6' as invalid?

Yes.  Think though: how could '6' be legal??  That commits the client
(and server) to setting conf_flag == FALSE and conf_flag == TRUE at the
same time.

Making the server accept 6 as equivalent to 4 is trivial.  It should be
done.

NOTE: I've sent e-mail to the Cyrus SASL list separately.

> some sort of knob to know which to try.

Yup.  See the e-mail I've sent to the Cyrus SASL list.

> what ~everyone does anyway.

Yes.

Nico
--