Re: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

[Alissa Cooper <[e-mail]>]

> On Dec 21, 2016, at 11:49 AM, Ram Mohan R (rmohanr) <[e-mail]> wrote:
> 
>    I will modify the last para of section 1 to below. Will remove some of the text that is not really relevant.
> 
> EXISTING:
>   As defined in Section 3 of [RFC2818], when using Secure WebSockets
>   the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
>   [RFC6101] certificate MUST match the WebSocket connection URI host.
>   In most cases it is not viable for certificates signed by well known
>   authorities.  Thus, there is a need to indicate the connection URI
>   for the WebSocket Client.  For applications that use Session
>   Description Protocol (SDP) [RFC4566] to negotiate, the connection URI
>   can be indicated by means of an SDP attribute.  This specification
>   defines new SDP attributes to indicate the connection URI for the
>   WebSocket client.  Applications that use SDP for negotiation and
>   WebSocket as a transport protocol can use this specification to
>   advertise the WebSocket client connection URI.
> 
> 
> NEW:
> When WebSocket sub-protocol is used as a transport mechanism between a server and client, 
> there needs to be a way to indicate the connection URI from the Server to the 
> WebSocket Client. For applications that use Session Description Protocol (SDP) [RFC4566] 
> to negotiate, the connection URI can be indicated by means of an SDP attribute.  
> This specification defines new SDP attributes to indicate the connection URI for the
>   WebSocket client.  Applications that use SDP for negotiation and
>   WebSocket as a transport protocol can use this specification to
>   advertise the WebSocket client connection URI.
> 
>    Is this better?

Yes, thanks.
Alissa

> 
>> 
>>   I don't understand what this sentence means.
>> 
>>   = Section 5 =
>> 
>>   "If there are
>>      multiple records returned for the connection URI in the "a=wss-uri"
>>      or "a=ws-uri" then the clients MAY use procedures in Section 4 of
>>      [RFC6555] to attempt the connection towards the server."
>> 
>>   I'm confused about this. Why would there be multiple URIs? This isn't explained anywhere in the document. (Furthermore, I don't understand the comment from Dan Wing that was the origin of this text, I think. I thought the point of all of this work is to take advantage of the underlying WebSocket to send BFCP messages, so wouldn't DNS resolution be handled by the HTTP stack on the client?)
>> 
>> <Ram> Yes this text was added based on feedback from SDP directorate. I think you have a valid point that the DNS resolution may be taken care at HTTP stack and the procedures in 
>> RFC6555 may be used at that level.   In that case this text may not fit well in here.   Do you want me to remove this from the doc  ?
> 
>> If the text stays in, it needs to be clarified. Or if you think you don’t need it, it can be taken out.
> 
> Yes. Will remove this line.
> 
>> 
>>   = Section 6 =
>> 
>>   "Consequently, it is strongly
>>   RECOMMENDED that integrity protection be applied to the SDP session
>>   descriptions. For session descriptions carried in SIP [RFC3261], S/
>>   MIME is the natural choice to provide such end-to-end integrity
>>   protection."
>> 
>>   Is this just suggesting S/MIME to have nice words in the text, or do you expect to see implementations using S/MIME to protect their SDP bodies?
>> 
>> <Ram> I have not seen many implementations use S/MIME. Most of them use SIP over TLS (even though it may not provide e2e security) in case they need to protect the SIP/SDP
> 
>>   Then I would suggest s/is the natural choice/is available/
> 
> Thanks, will fix it
> 
> Regards,
> Ram
> 
>> Thanks,
>> Alissa
> 
>> 
>> Will take care of the NITS below.
>> 
>> Thanks,
>> Ram
>> 
>>   Nits:
>> 
>>   = Section 1 =
>> 
>>   OLD
>>   As defined in Section 3 of [RFC2818], when using Secure WebSockets
>>      the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
>>      [RFC6101] certificate MUST match the WebSocket connection URI host.
>> 
>>   NEW
>>   When using Secure WebSockets
>>      the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
>>      [RFC6101] certificate MUST match the WebSocket connection URI host (see Section 3 of [RFC2818]).
>> 
>>   = Section 5 =
>> 
>>   s/on Internet/on the Internet/   
>> 
>>   s/ports (80 or 443)/port (80 or 443)/
>> 
>>   = Section 6 =
>> 
>>   s/it is strongly RECOMMENDED/it is RECOMMENDED/
>> 
>> 
>>   _______________________________________________
>>   bfcpbis mailing list
>>   [e-mail]
>>   https://www.ietf.org/mailman/listinfo/bfcpbis
>> 
>> 
> 
> 
>