Subject: [MMUSIC] RFC 5245: ice-ufrags of length 256 vs stun maximum username length of 512 bytes

From: Philipp Hancke <[email-masked]>
Date: Wed, 14 Aug 2013 08:54:23 +0200

It seems that there is a minor inconsistency between the maximum 
username length in STUN and the way ice-ufrag is defined...

5245 allows ufrags of up to 256 characters:
	-- http://tools.ietf.org/html/rfc5245#section-15.4

The STUN username is formed as RFRAG:LFRAG
	http://tools.ietf.org/html/rfc5245#section-7.1.2.3

If both sides use 256 characters for their ufrags this would result in a 
513 byte STUN username. However, 5389 says the username has to be "less 
than 513 bytes".
	-- http://tools.ietf.org/html/rfc5389#section-15.3

Off by one?

For ice-pwd this isn't a problem, right?

---

From: Martin Thomson <[email-masked]>
Date: Wed, 14 Aug 2013 17:10:48 +0100

> Off by one?

Maybe.  It certainly looks like an off-by-one error in the specs,
though you could technically argue that both sets of length
restrictions apply, since they are independent.  After all, not all
users of the STUN username attribute are also doing ICE.

> For ice-pwd this isn't a problem, right?

This doesn't transit the network in STUN packets.  In SDP, the maximum
size is 256 characters, but that's not a limit that other signaling
protocols need to respect.

---

From: Philipp Hancke <[email-masked]>
Date: Fri, 16 Aug 2013 09:48:27 +0200 (CEST)

> users of the STUN username attribute are also doing ICE.

Right. I'd actually hope that implementations don't send anything longer 
than 512 bytes. I am not so sure about the comparison on the receiving 
end.
It's probably a good idea to mention this explicitly in 5245bis or
draft-ietf-mmusic-ice-sip-sdp though.

> protocols need to respect.

phew :-)

---

From: Martin Thomson <[email-masked]>
Date: Fri, 16 Aug 2013 09:13:03 -0700

> draft-ietf-mmusic-ice-sip-sdp though.

Mention, or just fix.

I'm guessing that this has never really been tested in practice, so
fixing is probably quite feasible.