Subject: [drinks] review of draft-ietf-drinks-sppp-over-soap-04

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 20 Jul 2011 16:52:21 -0600

I've been asked to take a look at draft-ietf-drinks-sppp-over-soap. 
Overall I think it is in fine shape. Here are a few comments.

1. The document needs to be edited for clarity. For example, some of the 
sentences don't parse (e.g., the third sentence of Section 1).

2. There's a normative reference to W3C Note NOTE-wsdl-20010315, which 
says "This document is a NOTE made available by the W3C for discussion 
only. Publication of this Note by W3C indicates no endorsement by W3C or 
the W3C Team, or any W3C Members. W3C has had no editorial control over 
the preparation of this Note. This document is a work in progress and 
may be updated, replaced, or rendered obsolete by other documents at any 
time." Thus the phrase "WSDL is a widely standardized and adopted 
technology" in this I-D is not accurate, at least with regard to 
standarization. Furthermore, no published RFCs contain a normative 
reference to the WSDL document, which also is not in the downref 
registry. This will need to be called out during IETF Last Call.

3. Section 3 states "SOAP faults are not used by the SPPP SOAP mapping." 
It would be good to define how an application is supposed to handle SOAP 
faults if they occur for other reasons, or reference the SOAP 
specification on this point.

4. Transport security is a bit unclear to me. The spec says:

    All SOAP and HTTP SPPP Clients and Servers MUST support Transport
    Layer Security (TLS) as defined in [RFC5246] as the secure transport
    mechanism.

Does that mean supporting HTTP Over TLS (RFC 2818) except using the most 
up-to-date version of TLS, or using TLS directly over TCP?

5. I am not a WSDL expert, but the definition looks fine to me (even if 
hard to read). This seems a bit odd:

  xmlns:sppps="urn:ietf:params:xml:ns:sppp:soap:1"
  targetNamespace="urn:ietf:params:xml:ns:sppp:soap:1"

Why define the same namespace in two ways?

6. Section 7 says "The identity of the server should also be 
authenticated by the client." However, no guidance is provided about how 
to do that. A reference to RFC 2818 seems necessary.

7. Section 7.3 states:

    Some deployments of SPPP over SOAP may choose to use transports
    without encryption.  This presents vulnerabilities but may be
    selected for deployments involving closed networks or debugging
    scenarios.

Do you mean "MAY"? Is encryption truly optional? Please clarify that you 
mean MUST-implement and SHOULD-deploy or somesuch (where your "may" here 
really means "here's why a deployment might have a good reason to 
violate the SHOULD-deploy").

8. The IANA considerations seem a bit thin. Please see RFC 3688 for the 
template. I know there are a few examples in Section 14 of RFC 6120, so 
feel free to borrow from there. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Cartwright, Ken" <[email-masked]>
Date: Thu, 21 Jul 2011 09:41:46 -0400

Thank you for the review.  We will evaluate and incorporate your comments and send a follow up to the list.

Ken

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Saint-Andre
Sent: Wednesday, July 20, 2011 6:52 PM
To: [email-masked]
Subject: [drinks] review of draft-ietf-drinks-sppp-over-soap-04

7. Section 7.3 states:

Peter

--
Peter Saint-Andre
https://stpeter.im/

_______________________________________________
drinks mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/drinks

This e-mail message is for the sole use of the intended recipient(s)and may
contain confidential and privileged information of Transaction Network Services.
Any unauthorised review, use, disclosure or distribution is prohibited. If you
are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

---

From: "Zhang, Ning" <[email-masked]>
Date: Tue, 26 Jul 2011 13:04:27 -0400

As a practitioner, I was asked to take a look at this draft. IMHO, it is in a good shape. The following are a few comments:

1. I extracted the base SPPP schema as well as the WSDL from the drafts and run various checking tools, including my own, and no issues were found.

2. I run CXF java code generator and construct a dummy server and it works as expected.

3. Section 5 or Section 7 should mention RFC 2716 for Digest authentication (Section 4) related security issues.
 
4. Some actual SOAP message examples and a separate zip package including XSD/WSDL/XML messages would be very helpful.

Thanks,
-Ning

---

From: "Cartwright, Ken" <[email-masked]>
Date: Tue, 26 Jul 2011 15:58:59 -0400

Thanks for these comments Ning.  We will address these.

ken
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Zhang, Ning [[email-masked]]
Sent: Tuesday, July 26, 2011 1:04 PM
To: [email-masked]
Subject: Re: [drinks] review of draft-ietf-drinks-sppp-over-soap-04

Thanks,
-Ning