Subject: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)

From: "Alexey Melnikov" <[email-masked]>
Date: Fri, 13 Jan 2017 14:19:24 -0800

Alexey Melnikov has entered the following ballot position for
draft-ietf-bfcpbis-sdp-ws-uri-08: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-bfcpbis-sdp-ws-uri/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This is generally a well written document, but I have a small list of
issues that I would like to discuss before recommending its approval:

1) Are a=ws-uri and a=wss-uri mutually exclusive? (Section 4.3 is a good
place to mention what to do if both are specified).

Why not a single attribute, considering that both ws: and wss: URIs are
possible?

2) In Section 6: how is Websocket TLS server identity verified?

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Is S/MIME protection with SIP actually deployed?

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Mon, 16 Jan 2017 06:09:28 +0000

Hi Alexey,

Thanks for your feedback. Please see inline <Ram>

-----Original Message-----
From: bfcpbis <[email-masked]> on behalf of Alexey Melnikov <[email-masked]>
Date: Saturday, 14 January 2017 at 3:49 AM
To: The IESG <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)

    

<Ram> Yes kind of. In a given media line (m= line) we will either have a=ws-uri or a=wss-uri. That said a response from a BFCP server using webSocket as a transport can
have two media lines one with ws and other with wss. Something like:

Answer (server):
   m=application 50000 TCP/WSS/BFCP *
   a=setup:passive
   a=connection:new
   a=wss-uri:wss://bfcp-ws.example.com?token=3170449312
   m=application 50000 TCP/WS/BFCP *
   a=setup:passive
   a=connection:new
   a=ws-uri:ws://bfcp-ws.example.com?token=3170449312

<Ram> I would still prefer two attributes. We just followed the convention / approach that was used in [RFC6455].  

 [rfc7525] which is referred in this draft has some text (in Section 6) on how server certs can be verified. Do you see a need to anything specific in this draft?

<Ram> I have not seen many deployments. Perhaps none. That said, I will defer to someone who has more experience than me to correct if I am wrong here.

    _______________________________________________
    bfcpbis mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/bfcpbis

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 16 Jan 2017 14:27:42 +0000

Hi Ram,

On Mon, Jan 16, 2017, at 06:09 AM, Ram Mohan R (rmohanr) wrote:
> Cc: "[email-masked]"
> <[email-masked]>, "[email-masked]"
> <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>,
> "[email-masked]" <[email-masked]>
> Subject: [bfcpbis] Alexey Melnikov's Discuss on
> draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)
> 

> <Ram> Yes kind of. In a given media line (m= line) we will either have
> a=ws-uri or a=wss-uri. That said a response from a BFCP server using
> webSocket as a transport can

[Alexey]: This is exactly my problem, you should specify how a recipient
should handle your example above. If you only have 1 attribute, the
problem goes away entirely.

> <Ram> I would still prefer two attributes. We just followed the
> convention / approach that was used in [RFC6455].

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Mon, 16 Jan 2017 14:49:01 +0000

Hi Alexey,

Please see inline <Ram>

-----Original Message-----
From: Alexey Melnikov <[email-masked]>
Date: Monday, 16 January 2017 at 7:57 PM
To: "Ram Mohan R (rmohanr)" <[email-masked]>, The IESG <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)

    Hi Ram,

    

<Ram> in the above case, they are still two different m= lines. The receiver (after offer/answer is done) of this SDP connects to the URI mentioned in that m= line. 
Note I just re-used the same URL/port in the example above. If there are multiple m=application media lines (they will be for different applications) being negotiated in SDP, one application may use secure WS and other application may use non-secure WS. The client after it receives the answer SDP will just setup the connection to the URI specified in the attribute.  

I don’t see any problem in here.  

Regards,
Ram

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 16 Jan 2017 14:55:27 +0000

Hi Ram,

On Mon, Jan 16, 2017, at 02:49 PM, Ram Mohan R (rmohanr) wrote:
> Subject: Re: [bfcpbis] Alexey Melnikov's Discuss on
> <Ram> in the above case, they are still two different m= lines. The
> receiver (after offer/answer is done) of this SDP connects to the URI
> mentioned in that m= line. 
> Note I just re-used the same URL/port in the example above. If there are
> multiple m=application media lines (they will be for different
> applications) being negotiated in SDP, one application may use secure WS
> and other application may use non-secure WS. The client after it receives
> the answer SDP will just setup the connection to the URI specified in the
> attribute.  

Sorry, I was thinking about different example:

You have 2 conflicting URIs for the same m= line. Is this possible?

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Mon, 16 Jan 2017 15:09:28 +0000

Hi Alexey,

-----Original Message-----
From: Alexey Melnikov <[email-masked]>
Date: Monday, 16 January 2017 at 8:25 PM
To: "Ram Mohan R (rmohanr)" <[email-masked]>, The IESG <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)

    Hi Ram,

    

<Ram> No this is not possible. If the transport is TCP/WSS/BFCP we should have only a=wss-uri. If transport is TCP/WS/BFCP we should have only a=ws-uri.

Regards,
  Ram

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 17 Jan 2017 09:37:22 -0500

Alexey, would the following changes clarify things?

Section 4.1
OLD
the server side, which could be either
   the offerer or answerer, MUST add an "a=ws-uri" or "a=wss-uri"
   attribute in the media section
NEW
the server side, which could be either
   the offerer or answerer, MUST add an "a=ws-uri" or "a=wss-uri”
   attribute (but not both) in the media section

Section 4.3
OLD
If the answers assigns SDP "setup" attribute with "passive", then it
   MUST have a URI in either "a=ws-uri" or "a=wss-uri" attribute
   depending on whether the application uses WebSocket or
   secureWebSocket.
NEW
If the answers assigns SDP "setup" attribute with "passive", then it
   MUST have a URI in either "a=ws-uri" or "a=wss-uri" attribute
   (but not both) in the media section, depending on whether the application uses WebSocket or
   secureWebSocket.

Ram, would you be okay with those clarifications?

Alissa

> On Jan 16, 2017, at 10:09 AM, Ram Mohan R (rmohanr) <[email-masked]> wrote:
> 
> Hi Alexey,
>

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Tue, 17 Jan 2017 14:40:42 +0000

Alissa,

I am fine with the proposed text.

Thanks,
Ram

-----Original Message-----
From: Alissa Cooper <[email-masked]>
Date: Tuesday, 17 January 2017 at 8:07 PM
To: Alexey Melnikov <[email-masked]>
Cc: The IESG <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>, "Ram Mohan R (rmohanr)" <[email-masked]>
Subject: Re: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)

    Section 4.1
    OLD
    
    Section 4.3
    OLD

    Alissa

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 18 Jan 2017 15:28:27 -0500

Hi Ram,

I had some further conversation with Alexey on the side and wanted to come back to a question he posed: is there a reason why a=ws-uri and a=wss-uri both need to be specified? Why can’t a single label be specified, say a=websocket-uri, and then have normative language requiring the scheme in the URI itself to match what’s in the associated m-line (ws:// for TCP/WS/BFCP and wss:// for TCP/WSS/BFCP)? Won’t it be more efficient for implementations to grab the URI itself anyway and check that the scheme matches the m-line?

Thanks,
Alissa

> On Jan 17, 2017, at 9:40 AM, Ram Mohan R (rmohanr) <[email-masked]> wrote:
> 
> Alissa,
>

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Thu, 19 Jan 2017 04:00:11 +0000

Hi Alissa,

I don’t have a strong opinion on this. Either way (having a single attribute or two different SDP attributes) would work.

Implementations can still retrieve the value (URI) of that attribute and based on the proto line (TCP/WS/BFCP or TCP/WSS/BFCP) match the URI against ws or wss schema defined in RFC6455.  I would expect such a validation to happen across layers.
The SDP stack parser to look at the proto line transport value (TCP/WS/BFCP or TCP/WSS/BFCP) and check for presence of a=websocket-uri attribute. The value of this attribute (ws or wss schema) can be passed *as is* to the application (in this case BFCP client application) which will validate it against the schema in RFC 6455.

I am OK to incorporate this comment to have a single SDP attribute. 

Regards,
Ram

-----Original Message-----
From: Alissa Cooper <[email-masked]>
Date: Thursday, 19 January 2017 at 1:58 AM
To: "Ram Mohan R (rmohanr)" <[email-masked]>
Cc: Alexey Melnikov <[email-masked]>, The IESG <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)
Resent-From: <[email-masked]>
Resent-To: <[email-masked]>, <[email-masked]>
Resent-Date: Thursday, 19 January 2017 at 1:58 AM

    Hi Ram,

    Thanks,
    Alissa

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 19 Jan 2017 14:01:26 +0000

Hi Ram,

>  [rfc7525] which is referred in this draft has some text (in Section 6)
>  on how server certs can be verified. Do you see a need to anything
>  specific in this draft?

As hostname verification is often omitted in naive implementations, I
would rather this was called out explicitly. For example:

6.  Security Considerations

   The WebSocket clients have to initiate the TCP connection to the
   WebSocket server identified by the FQDN in a=ws/a=wss-uri.  Further
   as with any other web connection, the clients will verify the servers
   certificate.  The WebSocket client MUST follow the procedures in
   [RFC7525] while setting up TLS connection with webSocket server.

I would insert "(including hostname verification as per section 6.1 in
[RFC7525])" after "[RFC7525]" above.

Best Regards,
Alexey

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Thu, 19 Jan 2017 14:18:38 +0000

Hi Alexy,

I will incorporate the below suggestion from you. 

Thanks,
Ram

-----Original Message-----
From: Alexey Melnikov <[email-masked]>
Date: Thursday, 19 January 2017 at 7:31 PM
To: "Ram Mohan R (rmohanr)" <[email-masked]>, The IESG <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)

    Hi Ram,

    

    
    
    Best Regards,
    Alexey

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Mon, 30 Jan 2017 05:30:22 +0000

Hi Alexey/all,

Please find the diffs with the changes to use single attribute. This diff also has other comments from Ben, Kathleen incorporated.

Regards,
Ram

-----Original Message-----
From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Thursday, 19 January 2017 at 9:30 AM
To: Alissa Cooper <[email-masked]>
Cc: Alexey Melnikov <[email-masked]>, The IESG <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)

    Hi Alissa,

    
    
    Regards,
    Ram
    
    -----Original Message-----
    From: Alissa Cooper <[email-masked]>
    Date: Thursday, 19 January 2017 at 1:58 AM
    To: "Ram Mohan R (rmohanr)" <[email-masked]>
    Cc: Alexey Melnikov <[email-masked]>, The IESG <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
    Subject: Re: [bfcpbis] Alexey Melnikov's Discuss on draft-ietf-bfcpbis-sdp-ws-uri-08: (with DISCUSS and COMMENT)
    Resent-From: <[email-masked]>
    Resent-To: <[email-masked]>, <[email-masked]>
    Resent-Date: Thursday, 19 January 2017 at 1:58 AM
    
        Hi Ram,

        Thanks,
        Alissa