Subject: Re: [MMUSIC] RTSP From header issue

From: Magnus Westerlund <[email-masked]>
Date: Tue, 03 Mar 2009 16:47:31 +0100

Ingemar Johansson S skrev:
> Hi
> 
> Going through the syntax of the parts that handles URI's I found a possible issue with the syntax of the From header. 
> 1) In section 16.23 in RTSP 2.0 there is only a reference section 14.22 in RFC2616 which contains a rather simple definition.
>        From   = "From" ":" mailbox
> Section 20.2.3 in RTSP 2.0 however contains a much more elaborate definition with extensions (from-param). 
> Isn't it better to specify something in section 16.23 like "The From header is defined in in [H14.22] but is extended in this specification" ?

I hope Martin Fixes this if we are keeping the header.

> 
> 2) Looking at the syntax I see a risk that occasional ";" in the URI can clash with URI's that precedes each optional from-param, making parsing complicated.
> The ABNF for the From header is
>    From           =  "From" HCOLON from-spec
>    from-spec      =  ( name-addr / addr-spec ) *( SEMI from-param )
>    name-addr      =  [ display-name ] LAQUOT addr-spec RAQUOT
>    addr-spec      =  RTSP-URI / absolute-URI
>    absolute-URI   =  < As defined in RFC 3986>
>    display-name   =  *(token LWS) / quoted-string
>    from-param     =  tag-param / generic-param
>    tag-param      =  "tag" EQUAL token
> 
> Here I would suggest to change the addr-spec definition to 
>    addr-spec      =  DQ ( RTSP-URI / absolute-URI ) DQ
> As a comparision, Accept-Credentials, which has some similarities with the >From header, use DQ around the URI.

Please note that the usage of addr-spec in this has quotes using < >
around it so no issue with unquoted usage. I changed this sometime back
in history, I think the definition is taken from somewhere else but
seems correct for inclusion of a single address.

> 
> 3) In general. The idea to use DQ around URI's in some cases and in some cases not may cause some headache for the implementor. Sure, one should read the ABNF but I would say that it would be more consistent to always use DQ around URI's in headers regardless if they are needed or not.
> 

They are used in all cases except for headers that only consist of a
single URI at the end of the line.

On the question if one should keep it or not. RFC 2616 says:

   This header field MAY be used for logging purposes and as a means for
   identifying the source of invalid or unwanted requests. It SHOULD NOT
   be used as an insecure form of access protection. The interpretation
   of this field is that the request is being performed on behalf of the
   person given, who accepts responsibility for the method performed. In
   particular, robot agents SHOULD include this header so that the
   person responsible for running the robot can be contacted if problems
   occur on the receiving end.

   The Internet e-mail address in this field MAY be separate from the
   Internet host which issued the request. For example, when a request
   is passed through a proxy the original issuer's address SHOULD be
   used.

   The client SHOULD NOT send the From header field without the user's
   approval, as it might conflict with the user's privacy interests or
   their site's security policy. It is strongly recommended that the
   user be able to disable, enable, and modify the value of this field
   at any time prior to a request.

I still think it makes sense for certain type of RTSP clients to have a
contact address in the requests. So I would suggest to keep it as an
optional field.

I think the HTTP definition can be incorporated with minimal changes. It
is not like this is causing an issue.

Cheers

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: [email-masked]
----------------------------------------------------------------------

---

From: "Martin Stiemerling" <[email-masked]>
Date: Wed, 4 Mar 2009 11:40:52 +0100

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Magnus Westerlund
> Sent: Tuesday, March 03, 2009 4:48 PM
> To: Ingemar Johansson S
> Cc: [email-masked]
> Subject: Re: [MMUSIC] RTSP From header issue
> 
> > Going through the syntax of the parts that handles URI's I found a
> possible issue with the syntax of the From header.
> > 1) In section 16.23 in RTSP 2.0 there is only a reference section
> 14.22 in RFC2616 which contains a rather simple definition.
> > Isn't it better to specify something in section 16.23 like "The From
> header is defined in in [H14.22] but is extended in this specification"
> ?
> 

There is now more text taken from H14.22 in the From section of RTSP. 

However, the "From" ABNF definition of RTSP does not include the H14.22 mailbox part anymore (at least from my reading):
"The From request-header field, if given, SHOULD contain an Internet e-mail address for the human user who controls the requesting user agent. The address SHOULD be machine-usable, as defined by "mailbox" in RFC 1123.

addr-spec      =  RTSP-REQ-URI / absolute-URI

even though there is the generic-param. 

Shall "mailbox" be included again?

  Martin

> 
> >
> > 2) Looking at the syntax I see a risk that occasional ";" in the URI
> can clash with URI's that precedes each optional from-param, making
> parsing complicated.
> > As a comparision, Accept-Credentials, which has some similarities
> with the >From header, use DQ around the URI.
> 
> > 3) In general. The idea to use DQ around URI's in some cases and in
> some cases not may cause some headache for the implementor. Sure, one
> should read the ABNF but I would say that it would be more consistent
> to always use DQ around URI's in headers regardless if they are needed
> or not.
> >
> 
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mmusic

---

From: Magnus Westerlund <[email-masked]>
Date: Wed, 04 Mar 2009 13:19:14 +0100

> Shall "mailbox" be included again?

Hmm, I thought that mail address was still possible through the regular
URI scheme. But that is absolute, which do requires a schema. So my
answer would be yes. Also, if we are still going to have RTSP URIs in
there, then it should actually be RTSP IRI that should be included.

Cheers

Magnus Westerlund

---

From: "Martin Stiemerling" <[email-masked]>
Date: Mon, 9 Mar 2009 13:05:08 +0100

> > However, the "From" ABNF definition of RTSP does not include the
> H14.22 mailbox part anymore (at least from my reading):
> > "The From request-header field, if given, SHOULD contain an Internet
> e-mail address for the human user who controls the requesting user
> agent. The address SHOULD be machine-usable, as defined by "mailbox" in
> RFC 1123.
> >

Just checked, URIs can be email addresses, e.g., mailto:[email-masked] works.

> there, then it should actually be RTSP IRI that should be included.

Let's do this after the IETF deadline, i.e., fixing other issues first.

  Martin

---

From: Magnus Westerlund <[email-masked]>
Date: Mon, 09 Mar 2009 14:03:10 +0100

> Just checked, URIs can be email addresses, e.g., mailto:[email-masked] works.

Yes, but I now question if there is a point to having a URI in there, or
if we simply should use the mailbox format. I have totally lost the
context why this looks like it does. But it has obviously been changed
in the process.

> Let's do this after the IETF deadline, i.e., fixing other issues first.

Ok

Magnus Westerlund