Re: [bfcpbis] Stephen Farrell's No Objection on draft-ietf-bfcpbis-bfcp-websocket-14: (with COMMENT)

"Ram Mohan R (rmohanr)" <rmohanr@cisco.com> Mon, 30 January 2017 15:20 UTC

Return-Path: <rmohanr@cisco.com>
X-Original-To: bfcpbis@ietfa.amsl.com
Delivered-To: bfcpbis@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89547129500; Mon, 30 Jan 2017 07:20:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.72
X-Spam-Level:
X-Spam-Status: No, score=-17.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8WN4vWgBpdTD; Mon, 30 Jan 2017 07:20:15 -0800 (PST)
Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3E7E1294C0; Mon, 30 Jan 2017 07:13:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4394; q=dns/txt; s=iport; t=1485789210; x=1486998810; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=iCGLo80U2bHJM2FTRBq9F2ulrXxjKeePPhCjwcRa0sM=; b=a5rawGERqPT6RlOssm52AiDFPt753Qi9moqZl6Q7QWTW2NxeL5RZe5d1 X+HL9YexixEK0uSBBIl8hUYYbiP7wlO4cBjpf0y/o8VxyPRCfVMu/Ggcj Bn1TgpZB753VLblaMYZF8bCoQgSAemqDnSS4pllmYJ4ZPFtm8I5vSSts9 o=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0CDAQAXV49Y/4gNJK1dGQEBAQEBAQEBAQEBBwEBAQEBg1NhgQkHg06KCZFlH4gJixqCD4IMKoV4AhqCAz8YAQIBAQEBAQEBYiiEaQEBAQQjEUUMBAIBCBEDAQIDAiYCAgIfERUICAIEAQ0FiUkDFQ6qZ4IlhywNgzoBAQEBAQEBAQEBAQEBAQEBAQEBAQEYBYELh0UIgmKCUYFKEQEGHTECgkwugjEFiQKSGjgBhmaHA4QRgXmFFYlpiieIVwEfOHZVFUsBhCscGYFIdQGGBIEhgQwBAQE
X-IronPort-AV: E=Sophos;i="5.33,312,1477958400"; d="scan'208";a="377203736"
Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 30 Jan 2017 15:13:29 +0000
Received: from XCH-RTP-017.cisco.com (xch-rtp-017.cisco.com [64.101.220.157]) by alln-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id v0UFDSUl002915 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 30 Jan 2017 15:13:29 GMT
Received: from xch-rtp-017.cisco.com (64.101.220.157) by XCH-RTP-017.cisco.com (64.101.220.157) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 30 Jan 2017 10:13:28 -0500
Received: from xch-rtp-017.cisco.com ([64.101.220.157]) by XCH-RTP-017.cisco.com ([64.101.220.157]) with mapi id 15.00.1210.000; Mon, 30 Jan 2017 10:13:28 -0500
From: "Ram Mohan R (rmohanr)" <rmohanr@cisco.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, The IESG <iesg@ietf.org>
Thread-Topic: Stephen Farrell's No Objection on draft-ietf-bfcpbis-bfcp-websocket-14: (with COMMENT)
Thread-Index: AQHSclPLj7Olf4czeU6xdHTDtvBr4KFR4iuA
Date: Mon, 30 Jan 2017 15:13:27 +0000
Message-ID: <06251372-30D2-4BAF-B11E-6E356671D88A@cisco.com>
References: <148483073216.10382.9377294000590118868.idtracker@ietfa.amsl.com>
In-Reply-To: <148483073216.10382.9377294000590118868.idtracker@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/f.1a.0.160910
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.65.75.132]
Content-Type: text/plain; charset="utf-8"
Content-ID: <94816DD11F3F8048879704A658B775CD@emea.cisco.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/bfcpbis/KZRmWvGhWL5_dJCKSeHo6d3oiJc>
Cc: "bfcpbis@ietf.org" <bfcpbis@ietf.org>, "draft-ietf-bfcpbis-bfcp-websocket@ietf.org" <draft-ietf-bfcpbis-bfcp-websocket@ietf.org>, "Charles Eckel (eckelcu)" <eckelcu@cisco.com>, "bfcpbis-chairs@ietf.org" <bfcpbis-chairs@ietf.org>
Subject: Re: [bfcpbis] Stephen Farrell's No Objection on draft-ietf-bfcpbis-bfcp-websocket-14: (with COMMENT)
X-BeenThere: bfcpbis@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: BFCPBIS working group discussion list <bfcpbis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/bfcpbis>, <mailto:bfcpbis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/bfcpbis/>
List-Post: <mailto:bfcpbis@ietf.org>
List-Help: <mailto:bfcpbis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/bfcpbis>, <mailto:bfcpbis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 30 Jan 2017 15:20:16 -0000

Hi Stephen,

Thanks for your feedback. Please see inline <Ram>

-----Original Message-----
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Date: Thursday, 19 January 2017 at 6:28 PM
To: The IESG <iesg@ietf.org>
Cc: "draft-ietf-bfcpbis-bfcp-websocket@ietf.org" <draft-ietf-bfcpbis-bfcp-websocket@ietf.org>, "Charles Eckel (eckelcu)" <eckelcu@cisco.com>, "bfcpbis-chairs@ietf.org" <bfcpbis-chairs@ietf.org>, "Charles Eckel (eckelcu)" <eckelcu@cisco.com>, "bfcpbis@ietf.org" <bfcpbis@ietf.org>
Subject: Stephen Farrell's No Objection on draft-ietf-bfcpbis-bfcp-websocket-14: (with COMMENT)
Resent-From: <alias-bounces@ietf.org>
Resent-To: <anton.roman@quobis.com>, <stephane.cazeaux@orange.com>, <gsalguei@cisco.com>, <sergio.garcia.murillo@gmail.com>, <rmohanr@cisco.com>, <victor.pascual.avila@oracle.com>
Resent-Date: Thursday, 19 January 2017 at 6:28 PM

    Stephen Farrell has entered the following ballot position for
    draft-ietf-bfcpbis-bfcp-websocket-14: No Objection
    
    When responding, please keep the subject line intact and reply to all
    email addresses included in the To and CC lines. (Feel free to cut this
    introductory paragraph, however.)
    
    
    Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
    for more information about IESG DISCUSS and COMMENT positions.
    
    
    The document, along with other ballot positions, can be found here:
    https://datatracker.ietf.org/doc/draft-ietf-bfcpbis-bfcp-websocket/
    
    
    
    ----------------------------------------------------------------------
    COMMENT:
    ----------------------------------------------------------------------
    
    
    - I support Ben's discuss and hope the discussion about the
    gen-art review continues and reaches a good conclusion.

 <Ram> I will reply to this in the thread with Ben.
 
    - WRT Kathleen's comment, while I think it'd be a fine thing
    were HOBA usable with ws/wss, I doubt that browsers will do
    that, so adding the reference may be misleading.
<Ram> I looked around and don’t see any mentioned of browsers supporting HOBA. That said is this text a reasonable addition or do you have any suggestions to refine it ?

EXISTING:
         If the status code received from the server is not 101,
          the WebSocket client stack handles the response per HTTP
          [RFC7230] procedures, in particular the
          client might perform authentication if it receives 401
          status code.
NEW:
        If the status code received from the server is not 101,
          the WebSocket client stack handles the response per HTTP
          [RFC7230] procedures, in particular the
          client might perform authentication if it receives 401
          status code.  The WebSocket clients are vulnerable to the attacks
         of basic authentication (mentioned in Section 4 of [RFC7617]) and 
        digest authentication (mentioned in Section 5 of [RFC7616]). To overcome
        some of these weakness, the WebSocket clients can use HTTP Origin-Bound Authentication (HOBA)
        mechanism mentioned in [RFC7486].

Regards,
Ram