Subject: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

From: Alissa Cooper <[email-masked]>
Date: Fri, 9 Dec 2016 14:38:25 -0500

I have reviewed this document in preparation for IETF last call. I have a couple of comments to discuss before issuing the last call. I’ve also included some nits below that should be resolved together this IETF LC comments.

Substantive comments:

= Section 1 =

"In most cases it is not viable for certificates signed by well known
   authorities."

I don't understand what this sentence means.

= Section 5 =

"If there are
   multiple records returned for the connection URI in the "a=wss-uri"
   or "a=ws-uri" then the clients MAY use procedures in Section 4 of
   [RFC6555] to attempt the connection towards the server."

I'm confused about this. Why would there be multiple URIs? This isn't explained anywhere in the document. (Furthermore, I don't understand the comment from Dan Wing that was the origin of this text, I think. I thought the point of all of this work is to take advantage of the underlying WebSocket to send BFCP messages, so wouldn't DNS resolution be handled by the HTTP stack on the client?)

= Section 6 =

"Consequently, it is strongly
RECOMMENDED that integrity protection be applied to the SDP session
descriptions. For session descriptions carried in SIP [RFC3261], S/
MIME is the natural choice to provide such end-to-end integrity
protection."

Is this just suggesting S/MIME to have nice words in the text, or do you expect to see implementations using S/MIME to protect their SDP bodies?

Nits:

= Section 1 =

OLD
As defined in Section 3 of [RFC2818], when using Secure WebSockets
   the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
   [RFC6101] certificate MUST match the WebSocket connection URI host.

NEW
When using Secure WebSockets
   the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
   [RFC6101] certificate MUST match the WebSocket connection URI host (see Section 3 of [RFC2818]).
   
= Section 5 =

s/on Internet/on the Internet/   

s/ports (80 or 443)/port (80 or 443)/

= Section 6 =

s/it is strongly RECOMMENDED/it is RECOMMENDED/

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Wed, 21 Dec 2016 06:51:00 +0000

Hi Alissa,

Thanks for your feedback. Please see inline

-----Original Message-----
From: bfcpbis <[email-masked]> on behalf of Alissa Cooper <[email-masked]>
Date: Saturday, 10 December 2016 at 1:08 AM
To: "[email-masked]" <[email-masked]>
Subject: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

    Substantive comments:
    
    = Section 1 =

<Ram> This text was added to indicate that it is not always possible to get the certificates signed by well known authorities. 

    = Section 5 =
    
    "If there are

<Ram> Yes this text was added based on feedback from SDP directorate. I think you have a valid point that the DNS resolution may be taken care at HTTP stack and the procedures in RFC6555 may be used at that level.   In that case this text may not fit well in here.   Do you want me to remove this from the doc  ?
    
    = Section 6 =

    
<Ram> I have not seen many implementations use S/MIME. Most of them use SIP over TLS (even though it may not provide e2e security) in case they need to protect the SIP/SDP
    
Will take care of the NITS below.

Thanks,
Ram

    Nits:
    
    = Section 1 =
    
    OLD
    
    NEW
       
    = Section 5 =

    
    = Section 6 =

    _______________________________________________
    bfcpbis mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/bfcpbis

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 21 Dec 2016 10:51:48 -0500

Hi Ram,

> On Dec 21, 2016, at 1:51 AM, Ram Mohan R (rmohanr) <[email-masked]> wrote:
> 
> Hi Alissa,
> 

Your response says the same thing that the document says, which doesn’t explain why this claim is being made or why it is even being discussed in this paragraph. I actually don’t really understand what the first half of the this paragraph has to do with the second half. It would make sense to me if the paragraph started with “For applications that use Session Description Protocol (SDP) …” without the first three sentences. To go through sentence by sentence:

"As defined in Section 3 of [RFC2818], when using Secure WebSockets
   the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
   [RFC6101] certificate MUST match the WebSocket connection URI host.”

First, nothing about the WebSocket connection URI is defined in RFC 2818, so that citation is misplaced. Also, why is this document stating a normative requirement about all secure websockets?

   authorities.”

This sentence is provided without qualification — why is this the case?

"Thus, there is a need to indicate the connection URI
   for the WebSocket Client.”

This doesn’t follow from the previous sentence. If it is true that certificates to be used for secure websockets are not signed by well-known authorities, why would that imply a need to express the connection URI some other way? A self-signed cert would still give a CNAME, wouldn’t it?

> <Ram> Yes this text was added based on feedback from SDP directorate. I think you have a valid point that the DNS resolution may be taken care at HTTP stack and the procedures in RFC6555 may be use…

If the text stays in, it needs to be clarified. Or if you think you don’t need it, it can be taken out.

> <Ram> I have not seen many implementations use S/MIME. Most of them use SIP over TLS (even though it may not provide e2e security) in case they need to protect the SIP/SDP

Then I would suggest s/is the natural choice/is available/

Thanks,
Alissa

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Wed, 21 Dec 2016 16:49:40 +0000

Hi Alissa,

Thanks for your response. Please see inline.

-----Original Message-----
From: Alissa Cooper <[email-masked]>
Date: Wednesday, 21 December 2016 at 9:21 PM
To: "Ram Mohan R (rmohanr)" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

    Hi Ram,

   > Your response says the same thing that the document says, which doesn’t explain why this claim is being made or why it is even being discussed in this paragraph. I actually don’t really >understand what the first half of the this paragraph has to do with the second half. It would make sense to me if the paragraph started with “For applications that use Session Description >Protocol (SDP) …” without the first three sentences. To go through sentence by sentence:

  > First, nothing about the WebSocket connection URI is defined in RFC 2818, so that citation is misplaced. Also, why is this document stating a normative requirement about all secure >websockets?

    
    
   > This doesn’t follow from the previous sentence. If it is true that certificates to be used for secure websockets are not signed by well-known authorities, why would that imply a need to 
   > express the connection URI some other way? A self-signed cert would still give a CNAME, wouldn’t it?

    I will modify the last para of section 1 to below. Will remove some of the text that is not really relevant.

EXISTING:
   As defined in Section 3 of [RFC2818], when using Secure WebSockets
   the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
   [RFC6101] certificate MUST match the WebSocket connection URI host.
   In most cases it is not viable for certificates signed by well known
   authorities.  Thus, there is a need to indicate the connection URI
   for the WebSocket Client.  For applications that use Session
   Description Protocol (SDP) [RFC4566] to negotiate, the connection URI
   can be indicated by means of an SDP attribute.  This specification
   defines new SDP attributes to indicate the connection URI for the
   WebSocket client.  Applications that use SDP for negotiation and
   WebSocket as a transport protocol can use this specification to
   advertise the WebSocket client connection URI.

NEW:
 When WebSocket sub-protocol is used as a transport mechanism between a server and client, 
there needs to be a way to indicate the connection URI from the Server to the 
WebSocket Client. For applications that use Session Description Protocol (SDP) [RFC4566] 
to negotiate, the connection URI can be indicated by means of an SDP attribute.  
This specification defines new SDP attributes to indicate the connection URI for the
   WebSocket client.  Applications that use SDP for negotiation and
   WebSocket as a transport protocol can use this specification to
   advertise the WebSocket client connection URI.
    
    Is this better?

    > <Ram> Yes this text was added based on feedback from SDP directorate. I think you have a valid point that the DNS resolution may be taken care at HTTP stack and the procedures in 
   > RFC6555 may be used at that level.   In that case this text may not fit well in here.   Do you want me to remove this from the doc  ?
    
>  If the text stays in, it needs to be clarified. Or if you think you don’t need it, it can be taken out.
    
Yes. Will remove this line.

>    Then I would suggest s/is the natural choice/is available/

Thanks, will fix it

Regards,
Ram

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 21 Dec 2016 12:37:55 -0500

> On Dec 21, 2016, at 11:49 AM, Ram Mohan R (rmohanr) <[email-masked]> wrote:
> 

Yes, thanks.
Alissa