Subject: [tram] I-D Action: draft-ietf-tram-stunbis-09.txt

From: [email-masked]
Date: Wed, 14 Dec 2016 03:06:21 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the TURN Revised and Modernized of the IETF.

        Title           : Session Traversal Utilities for NAT (STUN)
        Authors         : Marc Petit-Huguenin
                          Gonzalo Salgueiro
                          Jonathan Rosenberg
                          Dan Wing
                          Rohan Mahy
                          Philip Matthews
	Filename        : draft-ietf-tram-stunbis-09.txt
	Pages           : 65
	Date            : 2016-12-14

Abstract:
   Session Traversal Utilities for NAT (STUN) is a protocol that serves
   as a tool for other protocols in dealing with Network Address
   Translator (NAT) traversal.  It can be used by an endpoint to
   determine the IP address and port allocated to it by a NAT.  It can
   also be used to check connectivity between two endpoints, and as a
   keep-alive protocol to maintain NAT bindings.  STUN works with many
   existing NATs, and does not require any special behavior from them.

   STUN is not a NAT traversal solution by itself.  Rather, it is a tool
   to be used in the context of a NAT traversal solution.

   This document obsoletes RFC 5389.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-tram-stunbis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-tram-stunbis-09

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-tram-stunbis-09

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Wed, 14 Dec 2016 03:15:59 -0800

This new version incorporates the modifications proposed following the protocol analysis of RFC 5389 and discussions with Jonathan Lennox.  We are working on -10 that will contain the remaining modifications following the discussions in Berlin and reviews received then.  It will be published in a couple of weeks.

Changelog:

-  Packets discarded in a reliable or unreliable transaction triggers
   an attack error instead of a timeout error.  An attack error on a
   reliable transport is signaled immediately instead of waiting for
   the timeout.
-  Explicitly state that a received 400 response without
   authentication will be dropped until timeout.
-  Clarify the SHOULD omit/include rules in LTCM.
-  If the nonce and the hmac are both invalid, then a 401 is sent
   instead of a 438.
-  The 401 and 438 error response to subsequent requests may use the
   previous NONCE/password to authenticate, if they are still
   available.
-  Change "401 Unauthorized" to "401 Unauthenticated"
-  Makes clear that in some cases it is impossible to add a MI or MI2
   even if the text says SHOULD NOT.

-- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: https://marc.petit-huguenin.org
Profile: https://www.linkedin.com/in/petithug