Re: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

Hi Ram,

> On Dec 21, 2016, at 1:51 AM, Ram Mohan R (rmohanr) <rmohanr@cisco.com> wrote:
> 
> Hi Alissa,
> 
> Thanks for your feedback. Please see inline
> 
> -----Original Message-----
> From: bfcpbis <bfcpbis-bounces@ietf.org> on behalf of Alissa Cooper <alissa@cooperw.in>
> Date: Saturday, 10 December 2016 at 1:08 AM
> To: "bfcpbis@ietf.org" <bfcpbis@ietf.org>
> Subject: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06
> 
>    I have reviewed this document in preparation for IETF last call. I have a couple of comments to discuss before issuing the last call. I’ve also included some nits below that should be resolved together this IETF LC comments.
> 
>    Substantive comments:
> 
>    = Section 1 =
> 
>    "In most cases it is not viable for certificates signed by well known
>       authorities."
> 
> <Ram> This text was added to indicate that it is not always possible to get the certificates signed by well known authorities. 

Your response says the same thing that the document says, which doesn’t explain why this claim is being made or why it is even being discussed in this paragraph. I actually don’t really understand what the first half of the this paragraph has to do with the second half. It would make sense to me if the paragraph started with “For applications that use Session Description Protocol (SDP) …” without the first three sentences. To go through sentence by sentence:

"As defined in Section 3 of [RFC2818], when using Secure WebSockets
   the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
   [RFC6101] certificate MUST match the WebSocket connection URI host.”

First, nothing about the WebSocket connection URI is defined in RFC 2818, so that citation is misplaced. Also, why is this document stating a normative requirement about all secure websockets?

"In most cases it is not viable for certificates signed by well known
   authorities.”

This sentence is provided without qualification — why is this the case?

"Thus, there is a need to indicate the connection URI
   for the WebSocket Client.”

This doesn’t follow from the previous sentence. If it is true that certificates to be used for secure websockets are not signed by well-known authorities, why would that imply a need to express the connection URI some other way? A self-signed cert would still give a CNAME, wouldn’t it?

> 
>    I don't understand what this sentence means.
> 
>    = Section 5 =
> 
>    "If there are
>       multiple records returned for the connection URI in the "a=wss-uri"
>       or "a=ws-uri" then the clients MAY use procedures in Section 4 of
>       [RFC6555] to attempt the connection towards the server."
> 
>    I'm confused about this. Why would there be multiple URIs? This isn't explained anywhere in the document. (Furthermore, I don't understand the comment from Dan Wing that was the origin of this text, I think. I thought the point of all of this work is to take advantage of the underlying WebSocket to send BFCP messages, so wouldn't DNS resolution be handled by the HTTP stack on the client?)
> 
> <Ram> Yes this text was added based on feedback from SDP directorate. I think you have a valid point that the DNS resolution may be taken care at HTTP stack and the procedures in RFC6555 may be used at that level.   In that case this text may not fit well in here.   Do you want me to remove this from the doc  ?

If the text stays in, it needs to be clarified. Or if you think you don’t need it, it can be taken out.

> 
>    = Section 6 =
> 
>    "Consequently, it is strongly
>    RECOMMENDED that integrity protection be applied to the SDP session
>    descriptions. For session descriptions carried in SIP [RFC3261], S/
>    MIME is the natural choice to provide such end-to-end integrity
>    protection."
> 
>    Is this just suggesting S/MIME to have nice words in the text, or do you expect to see implementations using S/MIME to protect their SDP bodies?
> 
> <Ram> I have not seen many implementations use S/MIME. Most of them use SIP over TLS (even though it may not provide e2e security) in case they need to protect the SIP/SDP

Then I would suggest s/is the natural choice/is available/

Thanks,
Alissa

> 
> Will take care of the NITS below.
> 
> Thanks,
> Ram
> 
>    Nits:
> 
>    = Section 1 =
> 
>    OLD
>    As defined in Section 3 of [RFC2818], when using Secure WebSockets
>       the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
>       [RFC6101] certificate MUST match the WebSocket connection URI host.
> 
>    NEW
>    When using Secure WebSockets
>       the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
>       [RFC6101] certificate MUST match the WebSocket connection URI host (see Section 3 of [RFC2818]).
> 
>    = Section 5 =
> 
>    s/on Internet/on the Internet/   
> 
>    s/ports (80 or 443)/port (80 or 443)/
> 
>    = Section 6 =
> 
>    s/it is strongly RECOMMENDED/it is RECOMMENDED/
> 
> 
>    _______________________________________________
>    bfcpbis mailing list
>    bfcpbis@ietf.org
>    https://www.ietf.org/mailman/listinfo/bfcpbis
> 
> 