Subject: GSS-IDUP final_pidu_buffer usage in idup

From: [email-masked]
Date: Wed, 5 Nov 1997 14:16:37 +0000

The idup_start_unprotect call has the following prototype:

OM_uint32 idup_start_unprotect (
    idup_env_id_t                  env_handle,
    IDUP_Mech_Specific_Info        Mech_Specific_Info,
    gss_buffer_t                   single_pidu_buffer,
    gss_buffer_t                   partial_pidu_buffer,
    gss_buffer_t                   final_pidu_buffer,
    IDUP_Special_Conditions        Special_Conditions,
    OM_uint32 *                    minor_status,
    gss_buffer_t                   single_idu_buffer,
    IDUP_Services_To_Receive       Services_to_Receive,
    IDUP_Prot_Information          Prot_Information,
    gss_buffer_t                   initial_idu_buffer,
    IDUP_Service_Verification_Info Service_Verification_Info,
    gss_buffer_t                   service_verification_info_id
);

The draft standard and C binding indicate the single_pidu_buffer parameter
is there to allow the user to unprotect the whole P-IDU in one go. 
Alternatively the
partial_pidu_buffer parameter is there to contain a fragment of the P-IDU
to start the unprotect process with.

My question is, what is the final_pidu_buffer for?

The only use for final_pidu_buffer I can think of is, if 
idup_start_unprotect
could be called multiple times on the same P-IDU. Each call it would consume
a different P-IDU fragment in its partial_pidu_buffer parameter until it
got to the last one. This last fragment would then go into the 
final_pidu_buffer
parameter on the last call to idup_start_unprotect. But this would seem to 
make the
idup_unprotect call redundant.

Can anyone clarify the purpose of the final_pidu_buffer parameter in
idup_start_unprotect.

Graham Bland
--
Zergo Limited, The Square, Basing View, Basingstoke, Hants. RG21 4EG, UK
Tel: + 44 (0) 1442 342 600    Fax: +44 (0) 1256 812 901
Website:  http://www.zergo.com

---

From: Carlisle Adams <[email-masked]>
Date: Wed, 5 Nov 1997 10:37:35 -0500

Hi Graham,

>----------
>From: 	[email-masked][SMTP:[email-masked]]
>Sent: 	Wednesday, November 05, 1997 9:16 AM
>To: 	[email-masked]
>Subject: 	GSS-IDUP final_pidu_buffer usage in idup
>
>The only use for final_pidu_buffer I can think of is, if idup_start_unprotect

What you have above is exactly right.  Essentially, the application is
going to input the PIDU a piece at a time until the underlying mechanism
has enough "stuff" to start the unprotection process with.  However, it
could happen (possibly due to corruption of the PIDU before the receiver
got it) that the mechanism *never* thinks it has all the data it needs
(i.e., it keeps returning MORE_PIDU_NEEDED).  The parameter
final_pidu_buffer is the way for the application to signal to the
mechanism that "after this, there's no more" (i.e., "if you still think
you need more PIDU after this, there's an error and we should just give
up").

Early on in our implementation we ran into precisely this situation once
with corrupted input and discovered that we needed this functionality in
the interface...

--------------------------------------------
Carlisle Adams
Entrust Technologies
[email-masked]
--------------------------------------------