Subject: Re: "connections" (Was: protocol-22 comments)

From: "Jim Sermersheim" <[email-masked]>
Date: Fri, 16 Apr 2004 18:58:01 -0600

Currently (from section 2):
The terms "connection" and "LDAP connection" both refer to the
underlying transport protocol connection between two protocol peers.
The term "TLS connection" refers to a [TLS]-protected LDAP connection.
The terms "association" and "LDAP association" both refer to the
association of the LDAP connection and its current authentication and
authorization state.

I propose we:
/s/LDAP connection/connection
/s/TLS connection/TLS layer (yes I know layer is redundant)
/s/association/LDAP association

This, at least is how I see it. There is the physical connection
(connection) and the LDAP association. Sometimes there is a TLS layer
protecting the LDAP messages on the connection.

Are these terms sufficient?

Jim

>>> "Kurt D. Zeilenga" <[email-masked]> 3/12/04 11:03:49 AM >>>
I've been thinking a bit more about the different uses of
"connections"
in the document. It seems that "LDAP connection" is used both to
refer to the underlying transport connection as well as the LDAP-level
connection (e.g., the layer in which LDAP messages are exchanged),
and that this is causing some confusion in the specification.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 16 Apr 2004 19:15:34 -0700

I prefer layer over connection for TLS, because starting
and stopping TLS does not close either LDAP "connection"
or transport (TCP) "connection".   I also prefer to say
that a TLS closure event causes the layer to be deinstalled
as it reflects better that the LDAP and transport connections
are still established.

>association of the LDAP connection and its current authentication and

What I really disliked in the current document is
defining TLS connection to mean a TLS-protected LDAP
connection but then saying that StartTLS establish
TLS on a LDAP connection.  It would be okay to say
StartTLS establishes TLS protection for a LDAP connection.

>/s/association/LDAP association

I suggest:
   "stream" to refer to the underlying transport layer.
   "connection" to the LDAP layer (where LDAP PDUs are exchanged)
        (and used without regard to whether protective-layers are
        or are not in place).
   "TLS layer" to refer to layer inserted between the stream
        and the connection that utilizes TLS to protect
        exchanged LDAP PDUs.
   "SASL layer" to refer to layer inserted between the stream
        and the connection that utilizes SASL to protect
        exchanged LDAP PDUs.
   "protective layer" to refer to either a TLS or SASL layer
   "protected connection" to refer to a connection protected
        by a protective layer
   "TLS-protected connection" to refer to a connection protected
        by a TLS-layer
   "SASL-protected connection" to refer to a connection protected
        by a SASL-layer
   "unprotected connection" to refer to a connection not
        protected by a protective layer

   (LDAP) association refers to the authentication and authorization
   state (generally of the client at the server) of a connection.

I suggest also adding a picture.

 +------------+                       |
 | connection |                       |
 +------------+ > LDAP PDU            |
 +------------+ < data                | 
 | SASL layer |                       | 
 +------------+ > SASL-protected data | 
 +------------+ < data                | 
 | TLS layer  |                       |
 +------------+ > TLS-protected data  | Application
 +------------+ < data                +------------
 |   stream   |                       | Transport 
 +------------+ 

Note that I don't include the association in this picture as
that refers to a state.

---

From: Hallvard B Furuseth <[email-masked]>
Date: Sat, 17 Apr 2004 20:48:11 +0200

>         (and used without regard to whether protective-layers are

I thought "connection" usually meant something close to what you call
"stream".  E.g. to "close the connection" means that the communication
is torn down completely.

How about "connection" for your "stream", and "LDAP <layer? stream?>"
for your "connection"?

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 17 Apr 2004 14:17:07 -0700

>How about "connection" for your "stream", and "LDAP <layer? stream?>"

I did consider that, but will "connection" could easily
refer to either level of communication, the term "stream"
seemed not to apply well at the LDAP level.

>Or e.g. IPsec, I hope.

No.  While IPsec offers data security services, those servers
are below the transport (and hence not factored into these
terms).  Here I am using "protective layer" to refer to those
kinds of data security services which can be inserted, as a
layer, between the LDAP exchange of messages and the underlying
transport protocol.

>Since you say:

I define the term "unprotected connection" without consideration
to whether the underlying transport is protected.  That is,
I exclude (in the terms, not in practice) protections that
might be offered at any layer in or below the underlying
transport protocol.  Such, while could be useful, is not
integral part of LDAP.

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Sat, 17 Apr 2004 23:50:34 +0200

> seemed not to apply well at the LDAP level.

Heh.  If you swapped "connection" and "stream" in that statement, I
would agree completely:-)  About the stream, maybe you think physical
stream and I data stream.  I must admit that I'm no expert at
networking and networking terms, though.

Anyway, "LDAP layer" seems to work anyway - fits nicely with the
TLS and SASL layers.

Also, we still need a term for "dropping/closing" the connection,
and I think that should refer to your "stream" layer.

> layer, between the LDAP exchange of messages and the underlying

OK, but then that should be clarified explicitly in the definition.
Though I kind of hope we won't need the term.
Perhaps "protective LDAP layer" is better, as a reminder that the layer
is part of the LDAP specification.  (BTW, I'm not sure if it would be
right to say SASL and TLS are part of the LDAP protocol or not?)

How about layers invoked by LDAP extensions, similar to StartTLS?

> transport protocol.  Such, while could be useful, is not

Then it's misleading to call it "unprotected".  Unless someone
comes up with a better term, maybe it's best to spell out
"<connection/stream/whatever> with no protective (LDAP) layer".

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 18 Apr 2004 09:58:21 -0700

At 02:50 PM 4/17/2004, Hallvard B Furuseth wrote:
>(BTW, I'm not sure if it would be

LDAP TS not only defines exchange of LDAP messages, but how
those messages are mapped onto the transport layer protocol,
and this may include processing of those messages through
SASL and/or TLS layers.  These layers may be independently
specified, but they are an integral part of LDAP's mapping
onto the transport protocol.

I note that used "stream" in this manner:
 From The Free On-line Dictionary of Computing (27 SEP 03) [foldoc]:
  stream
          1. <communications> An {abstraction} referring to any flow of
          data from a source (or sender, producer) to a single sink (or
          receiver, consumer).  A stream usually flows through a channel
          of some kind, as opposed to {packet}s which may be addressed
          and routed independently, possibly to multiple recipients.
          Streams usually require some mechanism for establishing a
          channel or a "{connection}" between the sender and receiver.

While I agree that "stream" could apply at the LDAP message level
as well, I think it better fits the transport protocol.  TCP is
often called a "stream-oriented protocol".  (Note that "channel"
might be used in some fashion here, but it might be better to
steer clear of it.)

I dislike the over use of layer and hence only used it when
referring to optional layers in the abbreviated stack.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 18 Apr 2004 10:31:55 -0700

>          channel or a "{connection}" between the sender and receiver. 

Another comment: one reason not to use "stream" to refer to
the exchange of LDAP messages is that LDAP messages are
addressed independently (by message id) and routed
independently to the directory operation executed at an
higher level.  That is, messages from multiple operations
(each a source) are multiplexed in the exchange.

I note that my primary interest is not which particular
terms are used where.  I am primarily interested in ensuring
that our terms are well-defined and used in an unambiguous
manner.  I wouldn't object to using "LDAP connection" and
"transport connection" as long as we never use the term
"connection" without qualification.

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 20 Apr 2004 13:12:34 +0200

> (each a source) are multiplexed in the exchange.

What of it?  The messages still arrive one after another, and
the order of their arrival is significant.  That might just
as well be an argument in favor of calling it a stream, as
a reminder of that ordering.

> manner.

Fine, but hopefully we can find terms which nobody considers
misleading.

> I wouldn't object to using "LDAP connection" and

"transport connection" is fine.
"LDAP connection" for the LDAP protocol layer/stream/whatever
still sounds dubious to me, but then we have votes against
all suggestions so far (*connection, LDAP layer, (LDAP) stream).

-- 
Hallvard