Subject: [tram] STUN Origin Open Issue: Size of Attribute

From: Alan Johnston <[email-masked]>
Date: Fri, 1 Aug 2014 10:02:32 -0500

draft-ietf-tram-stun-origin-00 currently says this about the size of the
Origin:

   It MUST contain a
   UTF-8 [RFC3629] encoded sequence of characters less than 268 bytes.
   The value of 268 is chosen to be larger than the maximum 253
   character domain name plus 8 characters for the URI scheme plus 5
   characters for the port number.  Senders MAY include multiple ORIGIN
   attributes in a request, and receivers MUST support parsing and
   receiving multiple ORIGIN attributes.

In Toronto, we discussed changing these guidelines.  Here is some proposed
text:

It MUST contain a UTF-8 [RFC3629] encoded sequence of characters.  Senders
MAY include multiple ORIGIN attributes in a request, and receivers MUST
support parsing and receiving multiple ORIGIN attributes.  The length and
number of ORIGINs included in a STUN message can have a major impact on the
size of a STUN packet, and could potentially cause UDP fragmentation.  HTTP
origins are 266 characters or smaller (the maximum 253 character domain
name plus 8 characters for the URI scheme plus 5 characters for the port
number).  It is RECOMMENDED that ORIGIN attributes larger than this not be
used, or be truncated.

Comments and suggestions most welcome, especially about truncation.

- Alan -

---

From: Justin Uberti <[email-masked]>
Date: Fri, 1 Aug 2014 15:58:54 -0700

> number).  It is RECOMMENDED that ORIGIN attributes larger than this not be

267 including the colon between domain and port. (272 with type and length
and padding).

> Comments and suggestions most welcome, especially about truncation.

Truncating origins seems like dangerous advice; I don't know what a server
would do with a truncated origin. I would recommend that we say that the
total size of ORIGIN attributes SHOULD not be more than 272 bytes, and
implementations should drop ORIGINs as needed in order to stay under this
limit, possibly sending none at all. The TURN server may fail the request
as a result, but that's at least a deterministic failure.

>
> - Alan -
>
>
>
> _______________________________________________
> tram mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tram
>
>

---

From: Alan Johnston <[email-masked]>
Date: Mon, 11 Aug 2014 10:54:41 -0500

Justin,

Thanks for the feedback.  I'll fix the 272 and replace the truncation text
with your suggested text.

- Alan -

On Fri, Aug 1, 2014 at 5:58 PM, Justin Uberti <[email-masked]> wrote:

>> In Toronto, we discussed changing these guidelines.  Here is some
>> proposed text:
>>
>> It MUST contain a UTF-8 [RFC3629] encoded sequence of characters.
>>  Senders MAY include multiple ORIGIN attributes in a request, and receivers
>> MUST support parsing and receiving multiple ORIGIN attributes.  The length
>> and number of ORIGINs included in a STUN message can have a major impact on
>> the size of a STUN packet, and could potentially cause UDP fragmentation.
>>  HTTP origins are 266 characters or smaller (the maximum 253 character
>> domain name plus 8 characters for the URI scheme plus 5 characters for the
>> port number).  It is RECOMMENDED that ORIGIN attributes larger than this
>> not be used, or be truncated.
>>
>