Subject: [BEHAVE] Updated rfc3489bis submitted

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 02 Jul 2008 11:44:49 -0400

I've submitted an update to rfc3489bis:
http://www.ietf.org/internet-drafts/draft-ietf-behave-rfc3489bis-16.txt

This primarily addresses the remaining discuss comments from Cullen, and 
also incorporates the new CLIENT attribute per list discussion. Here are 
the specific set of diffs:

* fixed stray '10 seconds' to '40 seconds' based on new transaction
   timeout values.

* Changed text on server closing of connections to read:

	<t>At the server end, the server SHOULD keep the connection
	open, and let the client close it, unless the server has
	determined that the connection has timed out (for example, due
	to the client disconnecting from the network).  Bindings

this deals with Cullen's discuss comment which we discussed in Philly.

* Replaced IANA Guidlines reference from RFC 2434 to recently
   published RFC 5226.

* changed methods and attribute registries from IETF Consensus for top
   half to IETF Review for the top half, based on RFC 5226 (just a
   terminology change)

* changed the vendor-proprietary range of the method and attribute
   registries from FCFS to Designated Expert. Defined rules for expert
   review, which says:

	<t>STUN methods in the range 0x000 - 0x1FF
           are assigned by IETF Review <xref target="RFC5226"/>.
           STUN methods in the range 0x200 - 0x3FF are assigned by
          Designated Expert <xref target="RFC5226"/>. The
           responsibility of the expert is to verify that the selected
           codepoint(s) are not in use, and that the request is not for
           an abnormally large number of codepoints. Technical review
           of the extension itself is outside the scope of the
           designated expert responsibility.</t>
       </section>

* added IANA reservations for the RFC3489 attributes no longer used in
   RFC3489bis, except for CHANGE-REQUEST which is defined in
   behavior-discovery. These are marked as Reserved.

* Reworked section on backwards compatibility for RFC3489bis clients
   talking to RFC3489 servers. Based on agreement in Philly, this needs
   to warn clients to ignore the old mandatory attributes. Text says:

<t> A client that wants to interoperate with a
<xref target="RFC3489"/> server SHOULD send a request message that
uses the Binding method, contains no attributes, and uses UDP as the
transport protocol to the server. If successful, the success response
received from the server will contain a MAPPED-ADDRESS attribute
rather than an XOR-MAPPED-ADDRESS attribute. A client seeking to
interoperate with an older server MUST be prepared to receive
either. Furthermore, the client MUST ignore any Reserved
comprehension-required attributes which might appear in the
response. Of the Reserved attributes in in
<xref target="sec-iana-atts"/>, 0x0002,0x0004,0x0005 and 0x000B may
appear in Binding Responses from a server compliant to RFC 3489. Other
than this change, the processing of the response is identical to the
procedures described above.</t>

* clarified that, the username input to the message integrity
   computation will have already had saslprep if you take it from the
   USERNAME attribute:

<t>That is, the 16 byte key is formed by taking the MD5 hash of the
result of concatenating the following five fields: (1) The username,
with any quotes and trailing nulls removed, as taken from the USERNAME
attribute (in which case SASLPrep has already been applied) (2) A
single colon, (3) The realm, with any quotes and trailing nulls

* when describing TLS authorization on the client, text now handles case
where client is using a configured set of trusted providers:

Alternatively, a client MAY be configured with a set
    of domains or IP addresses that are trusted; if a certificate is
    received that identifies one of those domains or IP addresses, the
    client considers the identity of the server to be verified.

* made the amount of time to wait after the last retransmit, before
   considering the transaction failed, configurable rather than hard
   coded at 16*RTO.

* transaction timeout failure for TCP changed from a hard-coded 39.5s to
configurable timer with default 39.5.

* there were two instances of the table defining the STUN attribute
   values. This has been consolidated to a single instance, in the IANA
   considerations section.

* Added CLIENT attribute per list consensus, with 0x8030 assigned for
   it. Made inclusion of manufacturer and version a SHOULD. Added text
   in security considerations section making usage of them configurable
   due to possible attacks against known weaknesses in specific
   software versions.

* section on MTU constraints talked about requests and responses but
   not indications. Rewrote to talk generally about messages, which
   includes indications

* section 9 previously said that, if stun over tls is used and there
   is no srv, transaction fails. This is no longer true given we now
   have a default port for stun over tls. Text now reads:

         For usages that require TLS, the client connects to
         one of the IP addresses using the default STUN over TLS port.

Hopefully this is now ready to go.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   499 Thornall St.
Cisco Fellow                                   Edison, NJ 08837
Cisco, Voice Technology Group
[email-masked]
http://www.jdrosen.net                         PHONE: (408) 902-3084
http://www.cisco.com
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave