Re: protocol: closing SASL upon Unbind

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 08:50 AM 12/8/2004, Hallvard B Furuseth wrote:
>Kurt D. Zeilenga writes:
>> (...) while I have no
>> problem with removing the ordering aspect of the current
>> text, I'd like to indicate that Unbind/Notice of Disconnect
>> are intended to affect a graceful closure.
>>
>> Hence, I suggest:
>>
>>    The client, upon transmission of the UnbindRequest, and
>>    the server, upon receipt of the UnbindRequest are to
>>    gracefully close the LDAP session by ceasing exchange
>>    at the LDAP message layer, tearing down any SASL layer,
>>    tearing down any TLS layer, and closing the transport
>>    connection.
>>
>> I note that while the 4 actions the implementation might need
>> to take are stated in the order which the implementation likely
>> would need to affect graceful closure of the LDAP session,
>> the text does not actually prescribe a particular order, nor
>> does it imply that any exchange within the SASL and/or TLS
>> layer would been necessary.
>
>It still looks like a list of actions to take to me,

It looks like an unordered list of actions to me.

>so if it is supposed to be unordered I'd prefer to swap SASL and TLS so it fits [SASL] if one does take it to be ordered. 

I don't see how switching the order fits SASL.  If one
were to take it as being ordered, the order (I think) is
generally appropriately for LDAP (as SASL is layered above
TLS).  It would be not wise to tear down TLS before SASL
as tearing down SASL could additional cipher buffer output,
which should rightly be protected by TLS.  Note that
the cipher buffers I refer to could be the result of
yet fully transferred response PDUs present at the time
the Unbind request was received.

The list of actions are presented top-down.  If we were
to switch SASL and TLS, some readers might mistaken think
TLS is layered above SASL.  I prefer to list protocol
layers top-down (or bottom-up).

>That seems more important
>than listing it in the order which looks more graceful.
>
>
>BTW, just to have stated it publicly: I didn't quite understand your
>previous objection to "SASL and TLS layers" without comma, and as
>discussed privately I disagree with part of your previous message
>anyway, but hopefully that's irrelevant now.

My point was that we should avoid variants of defined terms
as there can be ambiguity as to whether the variant was
intended to be used in a fashion consistent with the defined
term, or used in some other fashion.

The defined terms are "SASL layer" and "TLS layer", hence
"SASL layer and TLS layer" should be used instead of
"SASL and TLS layers".

Kurt