Re: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

Hi Alissa,

Thanks for your response. Please see inline.

-----Original Message-----
From: Alissa Cooper <alissa@cooperw.in>
Date: Wednesday, 21 December 2016 at 9:21 PM
To: "Ram Mohan R (rmohanr)" <rmohanr@cisco.com>
Cc: "bfcpbis@ietf.org" <bfcpbis@ietf.org>
Subject: Re: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

    Hi Ram,

    > On Dec 21, 2016, at 1:51 AM, Ram Mohan R (rmohanr) <rmohanr@cisco.com> wrote:
    > 
    > Hi Alissa,
    > 
    > Thanks for your feedback. Please see inline
    > 
    > -----Original Message-----
    > From: bfcpbis <bfcpbis-bounces@ietf.org> on behalf of Alissa Cooper <alissa@cooperw.in>
    > Date: Saturday, 10 December 2016 at 1:08 AM
    > To: "bfcpbis@ietf.org" <bfcpbis@ietf.org>
    > Subject: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06
    > 
    >    I have reviewed this document in preparation for IETF last call. I have a couple of comments to discuss before issuing the last call. I’ve also included some nits below that should be resolved together this IETF LC comments.
    > 
    >    Substantive comments:
    > 
    >    = Section 1 =
    > 
    >    "In most cases it is not viable for certificates signed by well known
    >       authorities."
    > 
    > <Ram> This text was added to indicate that it is not always possible to get the certificates signed by well known authorities. 

   > Your response says the same thing that the document says, which doesn’t explain why this claim is being made or why it is even being discussed in this paragraph. I actually don’t really >understand what the first half of the this paragraph has to do with the second half. It would make sense to me if the paragraph started with “For applications that use Session Description >Protocol (SDP) …” without the first three sentences. To go through sentence by sentence:

  >  "As defined in Section 3 of [RFC2818], when using Secure WebSockets
  >    the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
  >     [RFC6101] certificate MUST match the WebSocket connection URI host.”

  > First, nothing about the WebSocket connection URI is defined in RFC 2818, so that citation is misplaced. Also, why is this document stating a normative requirement about all secure >websockets?

  >  "In most cases it is not viable for certificates signed by well known
  >    authorities.”

  >  This sentence is provided without qualification — why is this the case?

  > "Thus, there is a need to indicate the connection URI
  >     for the WebSocket Client.”

   > This doesn’t follow from the previous sentence. If it is true that certificates to be used for secure websockets are not signed by well-known authorities, why would that imply a need to 
   > express the connection URI some other way? A self-signed cert would still give a CNAME, wouldn’t it?

    I will modify the last para of section 1 to below. Will remove some of the text that is not really relevant.

EXISTING:
   As defined in Section 3 of [RFC2818], when using Secure WebSockets
   the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
   [RFC6101] certificate MUST match the WebSocket connection URI host.
   In most cases it is not viable for certificates signed by well known
   authorities.  Thus, there is a need to indicate the connection URI
   for the WebSocket Client.  For applications that use Session
   Description Protocol (SDP) [RFC4566] to negotiate, the connection URI
   can be indicated by means of an SDP attribute.  This specification
   defines new SDP attributes to indicate the connection URI for the
   WebSocket client.  Applications that use SDP for negotiation and
   WebSocket as a transport protocol can use this specification to
   advertise the WebSocket client connection URI.

NEW:
 When WebSocket sub-protocol is used as a transport mechanism between a server and client, 
there needs to be a way to indicate the connection URI from the Server to the 
WebSocket Client. For applications that use Session Description Protocol (SDP) [RFC4566] 
to negotiate, the connection URI can be indicated by means of an SDP attribute.  
This specification defines new SDP attributes to indicate the connection URI for the
   WebSocket client.  Applications that use SDP for negotiation and
   WebSocket as a transport protocol can use this specification to
   advertise the WebSocket client connection URI.

    Is this better?

    > 
    >    I don't understand what this sentence means.
    > 
    >    = Section 5 =
    > 
    >    "If there are
    >       multiple records returned for the connection URI in the "a=wss-uri"
    >       or "a=ws-uri" then the clients MAY use procedures in Section 4 of
    >       [RFC6555] to attempt the connection towards the server."
    > 
    >    I'm confused about this. Why would there be multiple URIs? This isn't explained anywhere in the document. (Furthermore, I don't understand the comment from Dan Wing that was the origin of this text, I think. I thought the point of all of this work is to take advantage of the underlying WebSocket to send BFCP messages, so wouldn't DNS resolution be handled by the HTTP stack on the client?)
    > 
    > <Ram> Yes this text was added based on feedback from SDP directorate. I think you have a valid point that the DNS resolution may be taken care at HTTP stack and the procedures in 
   > RFC6555 may be used at that level.   In that case this text may not fit well in here.   Do you want me to remove this from the doc  ?

>  If the text stays in, it needs to be clarified. Or if you think you don’t need it, it can be taken out.

Yes. Will remove this line.

    > 
    >    = Section 6 =
    > 
    >    "Consequently, it is strongly
    >    RECOMMENDED that integrity protection be applied to the SDP session
    >    descriptions. For session descriptions carried in SIP [RFC3261], S/
    >    MIME is the natural choice to provide such end-to-end integrity
    >    protection."
    > 
    >    Is this just suggesting S/MIME to have nice words in the text, or do you expect to see implementations using S/MIME to protect their SDP bodies?
    > 
    > <Ram> I have not seen many implementations use S/MIME. Most of them use SIP over TLS (even though it may not provide e2e security) in case they need to protect the SIP/SDP

>    Then I would suggest s/is the natural choice/is available/

Thanks, will fix it

Regards,
Ram

   > Thanks,
   > Alissa

    > 
    > Will take care of the NITS below.
    > 
    > Thanks,
    > Ram
    > 
    >    Nits:
    > 
    >    = Section 1 =
    > 
    >    OLD
    >    As defined in Section 3 of [RFC2818], when using Secure WebSockets
    >       the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
    >       [RFC6101] certificate MUST match the WebSocket connection URI host.
    > 
    >    NEW
    >    When using Secure WebSockets
    >       the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
    >       [RFC6101] certificate MUST match the WebSocket connection URI host (see Section 3 of [RFC2818]).
    > 
    >    = Section 5 =
    > 
    >    s/on Internet/on the Internet/   
    > 
    >    s/ports (80 or 443)/port (80 or 443)/
    > 
    >    = Section 6 =
    > 
    >    s/it is strongly RECOMMENDED/it is RECOMMENDED/
    > 
    > 
    >    _______________________________________________
    >    bfcpbis mailing list
    >    bfcpbis@ietf.org
    >    https://www.ietf.org/mailman/listinfo/bfcpbis
    > 
    > 