Content-Type: multipart/signed;
 boundary="Apple-Mail=_1F4FC48B-2C42-4B9B-A09F-838E4C7BB53A";
 protocol="application/pkcs7-signature"; micalg=sha1
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\))
From: Lance Stout <lance@andyet.net>
In-Reply-To: <53b587f5.09d5440a.44eb.2126@mx.google.com>
Date: Thu, 3 Jul 2014 19:30:43 -0700
Message-Id: <46B2A4E0-236E-4B1C-8060-C8641E0CA012@andyet.net>
References: <CADajj4YJVxE8fh1iuZQ0qTPGrvnF_N_ywYBsouifN2jv-UqJZQ@mail.gmail.com>
 <53b587f5.09d5440a.44eb.2126@mx.google.com>
To: "iesg@ietf.org" <iesg@ietf.org>
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/WzVzvcZb7m286xYFg_f9-K81xvs
Cc: ops-dir@ietf.org, "secdir@ietf.org" <secdir@ietf.org>,
 ops-ads@tools.ietf.org, "gen-art@ietf.org" <gen-art@ietf.org>, "Romascanu,
 Dan \(Dan\)" <dromasca@avaya.com>,
 draft-ietf-xmpp-websocket.all@tools.ietf.org,
 "draft-ietf-xmpp-websocket@tools.ietf.org"
 <draft-ietf-xmpp-websocket@tools.ietf.org>
Subject: Re: [secdir] Reviews of draft-ietf-xmpp-websocket-07
Precedence: list


--Apple-Mail=_1F4FC48B-2C42-4B9B-A09F-838E4C7BB53A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=windows-1252

Closing in on the end of LC for draft-ietf-xmpp-websocket-07, so =
replying to the
feedback generated so far. We'll publish a -08 draft addressing these =
issues,
which have all been minor or editorial points.




On Jul 3, 2014, at 9:39 AM, <magnusn@gmail.com> <magnusn@gmail.com> =
wrote:

> Should =93when TLS is used, it MUST be enabled the WebSocket layer =94 =
have read
> =93when TLS is used, it MUST be enabled at the WebSocket layer =94 ?


Yes, that is the intended wording.




On Jul 2, 2014, at 6:00 AM, Romascanu, Dan (Dan) <dromasca@avaya.com> =
wrote:

> 1. In order to accommodate the Websocket binding this document =
describes several
> deviations from RFC6120. For example, in Section 3.3 it says: The =
WebSocket
> XMPP sub-protocol deviates from the standard method of constructing =
and using
> XML streams as defined in [RFC6120] by adopting the message framing =
provided by
> WebSocket to delineate the stream open and close headers, stanzas, and =
other
> top-level stream elements. I am wondering whether it would not be =
appropriate to
> reflect this in the document header by adding Updates RFC6120


This is a separate binding from the TCP binding defined in RFC6120, so I =
don't
think saying Updates RFC6120 would be accurate. Nothing in RFC6120 is =
modified
by this document.


> 2. In Section 3.6.1:
>=20
>    If the server wishes at any point to instruct the client to move to =
a
>    different WebSocket endpoint (e.g. for load balancing purposes), =
the server
>    MAY send a <close/> element and set the "see-other-uri" attribute =
to the
>    URI of the new connection endpoint (which MAY be for a different =
transport
>    method, such as BOSH (see [XEP-0124] and [XEP-0206]).
>=20
>         I do not understand the usage of MAY in this paragraph. Is =
there another
> method to move to a different Web socket endpoint that is described =
here or some
> other place? In not, why is not the first MAY at least a SHOULD? The =
second
> usage seems to describe a state of facts, so it needs not be =
capitalized at all.

That is the only method, so I agree that can be a SHOULD, and also agree =
on the
second point.


> In Section 3.1 I believe that the example should be preceded by some =
text
> that indicates that this is an example, such as: =91An example of a =
successful
> handshake and start of session follows:=92

+1, will add that.





On Jun 25, 2014, at 11:55 PM, Juergen Schoenwaelder
<j.schoenwaelder@jacobs-university.de> wrote:

> - Sec 1: The term 'raw socket' can be potentially mis-understood, =
perhaps simply
> remove 'over row sockets' completely (I think the message of the =
sentence
> remains intact without these words).

+1 will change

> - Sec 3.1: The text says that both client and server MUST have |xmpp| =
in the
> list of protocols for the |Sec-WebSocket-Protocol| header. The text =
does not
> detail what happens if this is not the case. Is there be a defined =
behavior if
> this protocol negotiation fails?

Good catch, RFC6455 doesn't describe what to do in that case, so we'll =
need to
address it.

If the server does not reply with 'xmpp' in the Sec-WebSocket-Protocol =
handshake
reply, then the client MUST close the connection.


> - Sec 3.6.1: There is a closing parenthesis missing at the end of the =
first
> paragraph.

Noted, will fix.




- Lance



--Apple-Mail=_1F4FC48B-2C42-4B9B-A09F-838E4C7BB53A
Content-Disposition: attachment;
	filename=smime.p7s
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIM5jCCBjQw
ggQcoAMCAQICASAwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0
Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn
BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDI1NVoX
DTE3MTAyNDIxMDI1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw
KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy
dENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAMsohUWcASz7GfKrpTOMKqANy9BV7V0igWdGxA8IU77L3aTxErQ+
fcxtDYZ36Z6GH0YFn7fq5RADteP0AYzrCA+EQTfi8q1+kA3m0nwtwXG94M5sIqsvs7lRP1aycBke
/s5g9hJHryZ2acScnzczjBCAo7X1v5G3yw8MDP2m2RCye0KfgZ4nODerZJVzhAlOD9YejvAXZqHk
sw56HzElVIoYSZ3q4+RJuPXXfIoyby+Y2m1E+YzX5iCZXBx05gk6MKAW1vaw4/v2OOLy6FZH3XHH
tOkzUreG//CsFnB9+uaYSlR65cdGzTsmoIK8WH1ygoXhRBm98SD7Hf/r3FELNvUCAwEAAaOCAa0w
ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSuVYNv7DHKufcd
+q9rMfPIHeOsuzAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa
MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh
aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6
Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j
b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0
dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu
c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBADqpJw3I07QW
ke9plNBpxUxcffc7nUrIQpJHDci91DFG7fVhHRkMZ1J+BKg5UNUxIFJ2Z9B90Micc/NXcs7kPBRd
n6XGO/vPc87Y6R+cWS9Nc9+fp3Enmsm94OxOwI9wn8qnr/6o3mD4noP9JphwUPTXwHovjavRnhUQ
HLfo/i2NG0XXgTHXS2Xm0kVUozXqpYpAdumMiB/vezj1QHQJDmUdPYMcp+reg9901zkyT3fDW/iv
JVv6pWtkh6Pw2ytZT7mvg7YhX3V50Nv860cV11mocUVcqBLv0gcT+HBDYtbuvexNftwNQKD5193A
7zN4vG7CTYkXxytSjKuXrpEatEiFPxWgb84nVj25SU5q/r1Xhwby6mLhkbaXslkVtwEWT3Van49r
KjlK4XrUKYYWtnfzq6aSak5u0Vpxd1rY79tWhD3EdCvOhNz/QplNa+VkIsrcp7+8ZhP1l1b2U6Ma
xIVteuVMD3X0vziIwr7jxYae9FZjbxlpUemqXjcC0QaFfN7qI0JsQMALL7iGRBg7K0CoOBzECdD3
fuZil5kU/LP9cr1BK31U0Uy651bFnAMMMkqhAChIbn0ei72VnbpSsrrSdF0BAGYQ8vyHae5aCg+H
75dVCV33K6FuxZrf09yTz+Vx/PkdRUYkXmZz/OTfyJXsUOUXrym6KvI2rYpccSk5MIIGqjCCBZKg
AwIBAgICL6UwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv
bSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYD
VQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTAeFw0x
MzAzMTQwNTM1MTJaFw0xNTAzMTUyMjMyMzZaMIGMMRkwFwYDVQQNExBQTDAxbVhKMjhha3BBRzVj
MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjESMBAGA1UEBxMJS2VubmV3aWNrMRQw
EgYDVQQDEwtMYW5jZSBTdG91dDEjMCEGCSqGSIb3DQEJARYUbGFuY2VzdG91dEBnbWFpbC5jb20w
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCr0XNL4SLaoBR9y72zNo3eAefV7vk1UaEx
xML9TqPKZHV9gGxA/XO5YilACUU/l5In+8akri5djy/haORYEm5HwsR/R1vxhOK7cBEyXMCY41Vg
KyqnQPJlidJ0L5PMinz1cwo0wyLlh8WhxIBHBjgLbA8XAoDC7FL6KzDq+qoJdsBbehu4W9fVscRr
T7XeM41zHjc7FqJOD8I2n9Z5CIlEeWwaIEZO0HpxOlcbD5EGVaC7Wbji/nEOuQ1OI6iGId/7Xakg
JrGfjSg1wQ5dXIBMzbSZmw3B6WmDdNgpCzHYL+QrCLrFenO0u2D6ZR/dZQgIkPRhL6I7PqniJ3FN
0hJpAgMBAAGjggMSMIIDDjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEF
BQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFFggdjTZDgsglI1DBpZiCB24Ub+ZMB8GA1UdIwQYMBaA
FK5Vg2/sMcq59x36r2sx88gd46y7MFcGA1UdEQRQME6BFGxhbmNlc3RvdXRAZ21haWwuY29tgRRs
YW5jZXN0b3V0QGdtYWlsLmNvbYEObGFuY2VAbGFuY2UuaW2BEGxhbmNlQGFuZHlldC5uZXQwggFM
BgNVHSAEggFDMIIBPzCCATsGCysGAQQBgbU3AQIDMIIBKjAuBggrBgEFBQcCARYiaHR0cDovL3d3
dy5zdGFydHNzbC5jb20vcG9saWN5LnBkZjCB9wYIKwYBBQUHAgIwgeowJxYgU3RhcnRDb20gQ2Vy
dGlmaWNhdGlvbiBBdXRob3JpdHkwAwIBARqBvlRoaXMgY2VydGlmaWNhdGUgd2FzIGlzc3VlZCBh
Y2NvcmRpbmcgdG8gdGhlIENsYXNzIDIgVmFsaWRhdGlvbiByZXF1aXJlbWVudHMgb2YgdGhlIFN0
YXJ0Q29tIENBIHBvbGljeSwgcmVsaWFuY2Ugb25seSBmb3IgdGhlIGludGVuZGVkIHB1cnBvc2Ug
aW4gY29tcGxpYW5jZSBvZiB0aGUgcmVseWluZyBwYXJ0eSBvYmxpZ2F0aW9ucy4wNgYDVR0fBC8w
LTAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNzbC5jb20vY3J0dTItY3JsLmNybDCBjgYIKwYBBQUH
AQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczIv
Y2xpZW50L2NhMEIGCCsGAQUFBzAChjZodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIu
Y2xhc3MyLmNsaWVudC5jYS5jcnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20v
MA0GCSqGSIb3DQEBBQUAA4IBAQALnAVqIrddlyGYqOAb4TfJ25u3sOtC352yAF7VaQdhkV/Z7Rum
OPpsEN7rwLfHOphYhafI4IxKy39NZbFBjzzcW8Kx6OJ1L/eDEW5Dbt1XzaBF4VVM1/DZyg/l3C0N
9/YrumhcgdSUgxLL2d/GzEk1dNTcZLpLJABf6L1W5RszU4HSPyVppLzYVVq5yLwmKnlIcnDjEdMr
jmsFq8b0Duk1j05IE2KBiWNy/Q0H9Hj/943/rvQOx7464jzuEGkWYO8AU7Nmq3h2DLoo8GECFwxy
e7rSL0o3KFkAQHC0YE/8GbaT05Jo7xnF/9X/IOWd0rSvBmTVkreGARQywViv35eCMYIDbDCCA2gC
AQEwgZMwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJT
ZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFz
cyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQQICL6UwCQYFKw4DAhoFAKCCAa0wGAYJ
KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTQwNzA0MDIzMDQzWjAjBgkq
hkiG9w0BCQQxFgQUkbx6X4tfYC99lLwhqpYUkY0sFEAwgaQGCSsGAQQBgjcQBDGBljCBkzCBjDEL
MAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdp
dGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFy
eSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgIvpTCBpgYLKoZIhvcNAQkQAgsxgZaggZMwgYwxCzAJ
BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRh
bCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkg
SW50ZXJtZWRpYXRlIENsaWVudCBDQQICL6UwDQYJKoZIhvcNAQEBBQAEggEAjQ/OkfnnRD2+JIBt
3XaU9fOUds0kL5YiFB2U5d3aPrLOmNy0CaA55xabQ0NkK3yUAj1praxKUF4xBNelCcQxFhFT+xBJ
Pdn+Mm6ViVCGP9sAd8pFOyuKOrASXPIKsp2FJkBiJrZBDAZrgcliOAHypIHapIx9VZlyp0/Y+4Gu
O6iWmOXJ9OR3XdrEHRfgPd8BK+wVmjczicX4u68vcv1drrtIEKMvZlkkD+MVIGkAR8huHKb9TITu
Spvd8BfvT8Q81X2guo34bdQKN0YNMBxt0l46FwRF/lOEZsGH+PZlUt5O+8x6VGDb25eltcqOIoJU
kasLZEMTPLU+jTDQIfbIWgAAAAAAAA==

--Apple-Mail=_1F4FC48B-2C42-4B9B-A09F-838E4C7BB53A--