Subject: Re: [kitten] Some test registrations according to draft-ietf-kitten-gssapi-extensions-iana-08.txt

From: Shawn M Emery <[email-masked]>
Date: Thu, 16 Oct 2014 23:59:55 -0600

Could folks please review the example registry that we would like to 
include in the draft-ietf-kitten-gssapi-extensions-iana draft?

Thanks,

Shawn.
--
On 07/24/14 10:47 AM, Alexey Melnikov wrote:
> Shawn and I tried to register several items in the registry.
> Does this look reasonable (I am less sure about the last one, so 
> please double check)?
>
> Bindings: C
> Registration type: Instance
> Object Type: Function
> Symbol Name: gss_init_sec_context
> Binding of: GSS_Init_sec_context
> Constant Value/Range: N/A
> Description: Create a security context by initiator
> Registration Rules: N/A
> Reference: RFC 2744
> Expert Reviewer: Kitten WG
> Expert Review Notes:
> Status: Registered
> Obsoleting Reference: N/A
>
> Bindings: C
> Registration type: Instance
> Object Type: Function
> Symbol Name: gss_accept_sec_context
> Binding of: GSS_Accept_sec_context
> Constant Value/Range: N/A
> Description: Accept a security context from initiator
> Registration Rules: N/A
> Reference: RFC 2744
> Expert Reviewer: Kitten WG
> Expert Review Notes:
> Status: Registered
> Obsoleting Reference: N/A
>
> Bindings: C
> Registration type: Instance
> Object Type: Context-Flag
> Symbol Name: GSS_C_DELEG_FLAG
> Binding of: deleg_state or deleg_req_flag
> Constant Value/Range: 1
> Description: On output (if set): Delegated credentials are available
>              via the delegated_cred_handle
>              parameter of GSS_Accept_sec_context/GSS_Init_sec_context.
>              On input (if set): requests delegation of access rights.
> Registration Rules: N/A
> Reference: RFC 2744
> Expert Reviewer: Kitten WG
> Expert Review Notes:
> Status: Registered
> Obsoleting Reference: N/A
>
>
> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten
>

---

From: Greg Hudson <[email-masked]>
Date: Fri, 17 Oct 2014 11:02:49 -0400

> include in the draft-ietf-kitten-gssapi-extensions-iana draft?

I have looked at these and don't see any issues.  The correspondence of
GSS_C_DELEG_FLAG to RFC 2743 concepts is a little bit awkward to
describe in a formal way, but the example registration seems to do a
reasonable job of it.

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 26 Oct 2014 20:57:17 -0400 (EDT)

On Fri, 17 Oct 2014, Shawn M Emery wrote:

>
> Could folks please review the example registry that we would like to include
> in the draft-ietf-kitten-gssapi-extensions-iana draft?
>
> Thanks,
>
> Shawn.
> --

Er, GSS_Init_sec_context does not have a delegated_cred_handle argument.

Otherwise, these look fine to me.

-Ben

---

From: Shawn M Emery <[email-masked]>
Date: Wed, 29 Oct 2014 23:46:10 -0600

> Er, GSS_Init_sec_context does not have a delegated_cred_handle argument.

Yes, this is confusing, but there are trade-offs with using abbreviated 
text and being thorough in description.  Would something like the 
following make this more clear?:

Description: On output (if set): Delegated credentials are available
              via the delegated_cred_handle parameter of GSS_Accept_sec_context

              On input (if set): With the call to GSS_Init_sec_context,
	     delegate credentials to the acceptor

Note that I'm not aware of what field length constraints there are for 
registry entries.

> Otherwise, these look fine to me.

Thanks for your review.

Shawn.
--

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 30 Oct 2014 16:16:04 -0400 (EDT)

On Thu, 30 Oct 2014, Shawn M Emery wrote:

> > > include
> Yes, this is confusing, but there are trade-offs with using abbreviated text
> and being thorough in description.  Would something like the following make
> this more clear?:
>

That is more clear, yes.  There are still more subtleties that are not
covered by that text (the flag can be set on a GSS_S_CONTINUE_NEEDED
return of GSS_Accept_sec_context, can be set on the initiator's returned
flags, etc.), but those are probably overkill for a registry like this.

> Note that I'm not aware of what field length constraints there are for

IIRC the download links on the web are just XML files, but there is
probably some other internal representation.

-Ben