Subject: Re: [stir] For the sake of implementers, please verify errata in a timely manner: ppt= with/without quotes

From: Christer Holmberg <[email-masked]>
Date: Thu, 8 Apr 2021 18:16:49 +0000

Hi,

...

>5. https://www.rfc-editor.org/errata/eid6499
>
>I disagree with that -- wrong examples, especially from another SDO, should not change normative text.   In itself adding quotes around a token is puzzling.  An additional unintended consequence is that quoted strings are case-sensitive, whereas tokens are case >insensitive, so that may create an additional interop issue.

Note that ppt= is used with quotes also in RFC 8443 and RFC 8946, so it is not just "from another SDO".

(In draft-ietf-stir-passport-rcd-11 ppt= is used without quotes, but that can easily be changed as the document hasn't been published.)

Regards,

Christer

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Thu, 8 Apr 2021 11:29:05 -0700

> Note that ppt= is used with quotes also in RFC 8443 and RFC 8946, so it is not just "from another SDO".

Right.  Still, that's changing the normative part (ABNF) because the informative part (examples) is wrong.  Should that be the other way around?

-- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: https://marc.petit-huguenin.org
Profile: https://www.linkedin.com/in/petithug

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 8 Apr 2021 19:44:19 +0000

Hi,

>>> 5. https://protect2.fireeye.com/v1/url?k=7fd536e0-204e0fdc-7fd5767b-86b1886cfa64-26b897891e272008&q=1&e=dcc3cd11-966a-4e58-8216-7894ec032d39&u=https%3A%2F%2Fwww.rfc-editor.org%2Ferrata%2Feid6499
>>>
>>> I disagree with that -- wrong examples, especially from another SDO, should not change normative text.   In itself adding quotes around a token is puzzling.  An additional
>>> unintended consequence is that quoted strings are case-sensitive, whereas tokens are case >insensitive, so that may create an additional interop issue.
>> 

There is the perfect world, and there is the real world :)

I think the question is: what (if any) has been deployed?

Regards,

Christer

-- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: https://protect2.fireeye.com/v1/url?k=483301f4-17a838c8-4833416f-86b1886cfa64-a0f0871310e1b5ba&q=1&e=dcc3cd11-966a-4e58-8216-7894ec032d39&u=https%3A%2F%2Fmarc.petit-huguenin.org%2F
Profile: https://www.linkedin.com/in/petithug

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Thu, 8 Apr 2021 12:54:53 -0700

> I think the question is: what (if any) has been deployed?

Well, people at my $dayjob are currently testing a STIR/SHAKEN solution, and the value of the ppt parameter is not quoted.  My (separate) implementation does not quote either, but it will never be deployed in production, so I suppose that does not count.

---

From: Roman Shpount <[email-masked]>
Date: Thu, 8 Apr 2021 22:41:48 -0400

The reason I have reported this is that I saw the quoted from a couple of
different vendors. I did a bit more research, and this is what I see in the
field:

Ribbon SBCs are putting the ppt= value in quotes.

Opensips and it stir_shaken module in (
https://github.com/OpenSIPS/opensips/blob/master/modules/stir_shaken/stir_shaken.h
line 72) is using the quoted value.

Metaswitch is using unquoted value.

Kamailio and anything else using https://github.com/asipto/secsipidx are
using unquoted value.

If needed, I can research this further and check what is being generated by
more carriers and equipment vendors. In any case, both forms were
implemented.
_____________
Roman Shpount

On Thu, Apr 8, 2021 at 3:44 PM Christer Holmberg <christer.holmberg=
[email-masked]> wrote:

> Hi,
>
> >>> 5.
> https://protect2.fireeye.com/v1/url?k=7fd536e0-204e0fdc-7fd5767b-86b1886cfa64-26b897891e272008&q=1&e=dcc3cd11-966a-4e58-8216-7894ec032d39&u=https%3A%2F%2Fwww.rfc-editor.org%2Ferrata%2Feid6499
> >>>
> >>> I disagree with that -- wrong examples, especially from another SDO,
> should not change normative text.   In itself adding quotes around a token
> is puzzling.  An additional
> >>> unintended consequence is that quoted strings are case-sensitive,
> whereas tokens are case >insensitive, so that may create an additional
> interop issue.
> >>
> > Right.  Still, that's changing the normative part (ABNF) because the
> informative part (examples) is wrong.  Should that be the other way around?
>
> Blog:
> https://protect2.fireeye.com/v1/url?k=483301f4-17a838c8-4833416f-86b1886cfa64-a0f0871310e1b5ba&q=1&e=dcc3cd11-966a-4e58-8216-7894ec032d39&u=https%3A%2F%2Fmarc.petit-huguenin.org%2F
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir
>

---

From: Paul Kyzivat <[email-masked]>
Date: Thu, 8 Apr 2021 23:20:00 -0400

On 4/8/21 10:41 PM, Roman Shpount wrote:
> The reason I have reported this is that I saw the quoted from a 
> couple of different vendors. I did a bit more research, and this is what 
> I see in the field:
> 
> Opensips and it stir_shaken module in 
> (https://github.com/OpenSIPS/opensips/blob/master/modules/stir_shaken/stir_shaken.h 
> <https://github.com/OpenSIPS/opensips/blob/master/modules/stir_shaken/stir_shaken.h> 
> Kamailio and anything else using https://github.com/asipto/secsipidx 
> <https://github.com/asipto/secsipidx> are using unquoted value.
> 
> If needed, I can research this further and check what is being generated 
> by more carriers and equipment vendors. In any case, both forms were 
> implemented.

And so some people will take a hit regardless of which decision is made.

ISTM that gives license to "do the right thing", whatever that is.

	Thanks,
	Paul

---

From: Roman Shpount <[email-masked]>
Date: Thu, 8 Apr 2021 23:45:50 -0400

You can also specify that both quoted and unquoted versions are acceptable.

But, in general, I think it should be a token, and examples in other
documents should be fixed.
_____________
Roman Shpount

On Thu, Apr 8, 2021 at 11:20 PM Paul Kyzivat <[email-masked]> wrote:

> > (
> > <
> https://github.com/OpenSIPS/opensips/blob/master/modules/stir_shaken/stir_shaken.h>
>

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 9 Apr 2021 09:42:05 -0400

> You can also specify that both quoted and unquoted versions are acceptable.

That just means that *all* implementations will have to be updated.

> On Thu, Apr 8, 2021 at 11:20 PM Paul Kyzivat <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
>     <https://github.com/OpenSIPS/opensips/blob/master/modules/stir_shaken/stir_shaken.h
>     <https://github.com/OpenSIPS/opensips/blob/master/modules/stir_shaken/stir_shaken.h>>
> 
>     <https://github.com/asipto/secsipidx>
>      > <https://github.com/asipto/secsipidx
>     <https://github.com/asipto/secsipidx>> are using unquoted value.
>      >
>     [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/stir>
>