Subject: Re: malformed messages (Re: draft-ietf-sasl-anon-01.txt)

From: Hallvard B Furuseth <[email-masked]>
Date: Mon, 3 Nov 2003 04:03:48 +0100

Kurt D. Zeilenga writes:
> I note that this issue is likely not unique to ANONYMOUS.  So, maybe
> it should be dealt with in base SASL specification.
> 
> I'm thinking a malformed message should be treated as a protocol
> error in the application protocol.

How detailed should the checking for malformed messages be?  For
example, is it a protocol error to send a latin-1 string when the
protocol requires UTF-8?  How about sending an invalid UTF-8-like
sequence, e.g. "\xC0\x80" which would encode '\0' if it was valid?

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 02 Nov 2003 20:09:39 -0800

>> error in the application protocol.

Note that application protocols generally give great freedom in
how protocol errors are treated.   And, the principle of "be liberal
in what you accept but strict in what your send" applies as well.

>How detailed should the checking for malformed messages be?

I think, in general, protocol peers should check each component
of the PDU which they make use of and then some.  For ANONYMOUS,
a server which uses the message should check that it is properly
encoded UTF-8 but a server which didn't make use of the message
could simply ignore the message.

>For example, is it a protocol error to send a latin-1 string when the
>protocol requires UTF-8?

Yes.

>How about sending an invalid UTF-8-like

Yes.

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Mon, 3 Nov 2003 04:03:48 +0100

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 02 Nov 2003 20:09:39 -0800

Yes.

Yes.

Kurt