Unix FD Passing

[Lennart Poettering]

On Sat, 25.04.09 21:27, Havoc Pennington (hp at pobox.com) wrote:

> 
> Hi,
> 
> On Sat, Apr 25, 2009 at 6:49 PM, Lennart Poettering <mzqohf at 0pointer.de> wrote:
> >> But, this does raise the question, how does the client know whether an
> >> AGREE is coming; is there a DISAGREE?
> >
> > No, but there is ERROR. The server has to respond either AGREE or ERROR
> > on each NEGOTIATE. The number of NEGOTIATEs and ERRORs/AGREEs must
> > match up. Hence issuing multiple NEGOTIATEs at the same time should be
> > perfectly safe.
> 
> Sounds good. The spec probably has to be clear that there is only one
> ERROR per NEGOTIATE sent, and that errors may not be sent
> spontaneously; basically an
> exactly-1-ERROR-or-AGREE-per-NEGOTIATE-sent rule, explicitly to allow
> a batch of NEGOTIATE. Also I guess the replies and errors must be in
> the same order as the NEGOTIATE.

Yes, of course. 

We'd be well advised if all commands exchanged during the auth
protocol would follow the one-request/one-response rule.

> Also maybe requiring some explicit language is whether the client has
> to wait for replies to all NEGOTIATE before firing off the AUTH.
> Perhaps there is no reason to require that.

I don't think there needs to be a rule for this.

We should optimize for fast implementations, hence waiting for
responses should only be necessary where it is required by the
higher-level logic and never beyond that. Even more we probably should
add a few lines to the spec that encourage implementors to send as
many commands at once as they can.

Lennart

-- 
Lennart Poettering                        Red Hat, Inc.
lennart [at] poettering [dot] net         ICQ# 11060553
http://0pointer.net/lennart/           GnuPG 0x1A015CC4