Subject: [BEHAVE] Consensus call on Adding "Client" attribute to STUN

From: Magnus Westerlund <[email-masked]>
Date: Thu, 24 Apr 2008 19:31:25 +0200

This is a one week+ consensus call (until the 5th of May) if the WG 
thinks that STUN (draft-ietf-behave-rfc3489bis) shall be extended with 
an additional attribute "Client" before publication.

With the general description along the lines of:

    X.Y CLIENT

    The client attribute contains a textual description of the software
    being used by the client, including manufacturer and version number.
    The attribute has no impact on operation of the protocol, and serves
    only as a tool for diagnostic and debugging purposes.  The value of
    CLIENT is variable length.  It MUST be a UTF-8 [RFC3629] encoded
    sequence of less than 128 characters (which can be as long as 763
    bytes).

And some Security Considerations on the risk for targeted attacks 
against clients with this information. Plus other text needed to bring 
it in consistently

The text is open for wordsmithing by the editors of the STUN spec.

Please indicate your position on adding this or not.

Cheers

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Färögatan 6                | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: "Alfred E. Heggestad" <[email-masked]>
Date: Thu, 24 Apr 2008 23:43:23 +0200

Hi

I support adding the CLIENT attribute.

/alfred

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Fri, 25 Apr 2008 10:03:56 +0300

> an additional attribute "Client" before publication.
(...)
> Please indicate your position on adding this or not.

I support the addition.

-- 
Rémi Denis-Courmont

---

From: Bruce Lowekamp <[email-masked]>
Date: Fri, 25 Apr 2008 10:27:03 -0400

> Please indicate your position on adding this or not.

I support the addition as long as it is a comprehension-optional  
attribute.

Bruce

---

From: "Benny Prijono" <[email-masked]>
Date: Fri, 25 Apr 2008 16:09:19 +0100

>     sequence of less than 128 characters (which can be as long as 763

I support adding the CLIENT attribute. However I'm a bit concerned
with the requirement to include manufacturer and software version
number. Isn't that too restrictive, and may make the system more
vulnerable? I propose we remove the "including manufacturer and
version number" part of the sentence (and the same for SERVER
attribute as well). This then would be similar to what we have in
User-Agent header in SIP/RFC 3261:

 "20.41 User-Agent

   The User-Agent header field contains information about the UAC
   originating the request.  The semantics of this header field are
   defined in [H14.43].

   Revealing the specific software version of the user agent might allow
   the user agent to become more vulnerable to attacks against software
   that is known to contain security holes.  Implementers SHOULD make
   the User-Agent header field a configurable option.
 "

I also support the "The attribute has no impact on operation of the
protocol" sentence, which implies that server implementations must not
do anything differently based on the value of this attribute (such as
to allow/block access based on the this value, which what has been
originally proposed).

Cheers
 Benny