Subject: Protocol: Controls & multi-message operations

From: Hallvard B Furuseth <[email-masked]>
Date: Wed, 23 Feb 2005 16:39:06 +0100

Maybe something like this should be to [Protocol] section 4.1.11
(Controls) or 6 (Security Considerations):

  The Bind requests in a multi-step SASL Bind can have different
  sets of controls.  So can multiple LDAP messages returned in
  response to a single LDAP request.  Such control combinations
  over multiple LDAPMessages may be inconsistent.  Protocol peers
  may need to verify that they make sense instead of just trusting
  the controls of some of the received LDAPMessages.

At least I imagine one could attack a sloppy server or client by
sending such inconsistent control combinations, though I can't
come up with a concrete example at the moment.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 23 Feb 2005 08:34:19 -0800

>come up with a concrete example at the moment.

I fail to see a security consideration here, or are you
just saying that a client or server might send malformed
messages to a peer to attack it?  If so, I don't see why
we should single out malformed combinations of controls
as an example of such an attack, considering you (nor I)
have a concrete example of such an attack.

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Wed, 23 Feb 2005 18:03:27 +0100

Kurt D. Zeilenga writes:
> messages to a peer to attack it?

No, I was thinking of messages that are fine in isolation, but with
controls modify the messages to be processed differently in some way.

Like the server attaching something like a SignedResult control to the
final response and the client notices that it is signed, forgetting to
check if each result entry was signed.  Except that control doesn't work
that way as far as I can tell, so it's not a valid example:-)
Maybe if one could sign Bind messages...

Anyway, I have no objection to dropping the idea.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 23 Feb 2005 10:00:16 -0800

>Anyway, I have no objection to dropping the idea.

I rather drop this, namely because I rather not imply that it
appropriate for a control specification to state that
the request control(s) can be attached to only some of the
bind requests of a multi-step SASL bind.  While certainly
the protocol doesn't preclude that, generally that would be
unwise.  Some of this was discussed when RFC 3829 was
being discussed.  That discussion lead to the requirement
(for that request control)
   In a multi-step bind operation, the client
   MUST provide the control with each bind request.

That is, extending Bind operation with controls, in general,
comes with a significant security and other considerations.
However, I don't view these as a [Protocol] issues, but an
extension design issue.... something more suitable for a
document detailing extension practices (e.g.,
draft-zeilenga-ldap-ext or the like).

Kurt