Subject: [P2PSIP] I-D Action: draft-ietf-p2psip-base-22.txt

From: [email-masked]
Date: Mon, 16 Jul 2012 14:47:14 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Peer-to-Peer Session Initiation Protocol Working Group of the IETF.

	Title           : REsource LOcation And Discovery (RELOAD) Base Protocol
	Author(s)       : Cullen Jennings
                          Bruce B. Lowekamp
                          Eric Rescorla
                          Salman A. Baset
                          Henning Schulzrinne
	Filename        : draft-ietf-p2psip-base-22.txt
	Pages           : 167
	Date            : 2012-07-16

Abstract:
   This specification defines REsource LOcation And Discovery (RELOAD),
   a peer-to-peer (P2P) signaling protocol for use on the Internet.  A
   P2P signaling protocol provides its clients with an abstract storage
   and messaging service between a set of cooperating peers that form
   the overlay network.  RELOAD is designed to support a P2P Session
   Initiation Protocol (P2PSIP) network, but can be utilized by other
   applications with similar requirements by defining new usages that
   specify the kinds of data that must be stored for a particular
   application.  RELOAD defines a security model based on a certificate
   enrollment service that provides unique identities.  NAT traversal is
   a fundamental service of the protocol.  RELOAD also allows access
   from "client" nodes that do not need to route traffic or store data
   for others.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-p2psip-base

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-p2psip-base-22

A diff from previous version is available at:
http://tools.ietf.org/rfcdiff?url2=draft-ietf-p2psip-base-22

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Mon, 16 Jul 2012 16:17:50 -0700

"  Certificate processing errors should result in a HTTP return code of
   403 "Forbidden" along with a body of type "text/plain" and body that
   consists of one of the tokens defined in the following list:

   failed_authentication  The user name and password combination was not
      correct.

   username_not_available  The requested userName for the certificate
      was not acceptable.

   Node-IDs_not_available  The number of Node-IDs requested was not
      acceptable.

   bad_CSR  There was a problem with the CSR.

   If the client receives an unknown token in the body, it SHOULD treat
   it as a failure for an unknown reasons."

What was the reason for passing the username and password as form parameter
instead of using an Authorization headers?  Using Authorization would have
permit to return 401 for a failed authorization and would have permit to use
other authentication methods.

Nits:
====

s/along with a body of type "text/plain" and body that consists/along with a
body of type "text/plain" that consists/

s/userName/username/

(and yes, I am well aware that my insistence in sending reviews and nits that
are consistently ignored by the authors fits very well Einstein's definition
of insanity)

- -- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: http://blog.marc.petit-huguenin.org
Profile: http://www.linkedin.com/in/petithug