Re: WG Last Call: draft-ietf-sasl-gs2-02.txt

[Simon Josefsson <jas@xxxxxxxxxxx>]

Alexey Melnikov <alexey.melnikov@xxxxxxxxx> writes:

> Please keep them, for the reasons that Nico and I stated.

Yup.

>>>If someone find them useful, I suggest adding that the value '0', when
>>>integrity/privacy layers are installed, means that the peer that sends
>>>that value does not have any limit on the maximum packet size.
>>>
> This would be inconsistent with several other SASL mechanisms (GS1 and
> DIGEST-MD5).
> Cyrus implementation is using 0xFFFFFF in this case.

A maxbuf value of 0 has weird semantics -- it is a error-state, and
authentication using a maxbuf=0 value with security layers should not
succeed.

It seems simpler to use it to signal something else (i.e., no buffer
size limit) than to use 0xFFFFFF for the same thing on the wire AND
ALSO describe the behaviour for the error state.

Effectively, my approach removes an error-state.

Also, Cyrus should have no problem in mapping a 0-value on the wire to
a maxbuf value of 0xFFFFFF internally, right?  My implementation uses
SIZE_MAX to signal the same in the APIs.

Thanks,
Simon