Subject: [rtcweb] I-D Action: draft-ietf-rtcweb-stun-consent-freshness-10.txt

From: [email-masked]
Date: Sun, 14 Dec 2014 19:43:05 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Real-Time Communication in WEB-browsers Working Group of the IETF.

        Title           : STUN Usage for Consent Freshness
        Authors         : Muthu Arul Mozhi Perumal
                          Dan Wing
                          Ram Mohan Ravindranath
                          Tirumaleswar Reddy
                          Martin Thomson
	Filename        : draft-ietf-rtcweb-stun-consent-freshness-10.txt
	Pages           : 9
	Date            : 2014-12-14

Abstract:
   To prevent sending excessive traffic to an endpoint, periodic consent
   needs to be obtained from that remote endpoint.

   This document describes a consent mechanism using a new Session
   Traversal Utilities for NAT (STUN) usage.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-rtcweb-stun-consent-freshness/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-rtcweb-stun-consent-freshness-10

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-rtcweb-stun-consent-freshness-10

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 15 Dec 2014 13:24:33 +0000

Hi,

Thank you very much for addressing my comments! :)

However, I still have an issue with the text saying:

  	"A WebRTC implementation [I-D.ietf-rtcweb-overview], which implements
   	full ICE, MUST perform consent freshness test using STUN request/
   	response as described below:"

First, I question whether this document should make normative requirements on WebRTC? Shouldn't some WebRTC document instead mandate the usage?

Second, what if a non-WebRTC implementation wants to use the mechanism? The procedures are described below the text above, so the way I read it they only apply to WebRTC implementations.

Third, *IF* the scope of the mechanism is only WebRTC (perhaps it is, and I have misunderstood), I think we need to have some explicit text indicating that.

Fourth, if you want to use terminology from [I-D.ietf-rtcweb-overview] you need to make sure it's aligned with that draft. I don't think "WebRTC implementation" exists in draft-rtcweb-overview-13, so you would have to define that as a browser, non-browser or compatible endpoint (or, use those terminologies).

Thanks!

Regards,

Christer

-----Original Message-----
From: rtcweb [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: 15. joulukuuta 2014 5:43
To: [email-masked]
Cc: [email-masked]
Subject: [rtcweb] I-D Action: draft-ietf-rtcweb-stun-consent-freshness-10.txt

Abstract:

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

_______________________________________________
rtcweb mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/rtcweb

---

From: Harald Alvestrand <[email-masked]>
Date: Mon, 15 Dec 2014 14:43:50 +0100

> First, I question whether this document should make normative requirements on WebRTC? Shouldn't some WebRTC document instead mandate the usage?

I think this sentence, suitably massaged, belongs in -overview. I'll
make sure it gets there.

> Fourth, if you want to use terminology from [I-D.ietf-rtcweb-overview] you need to make sure it's aligned with that draft. I don't think "WebRTC implementation" exists in draft-rtcweb-overview-13,…

The correct nomenclature at the moment is "WebRTC endpoint", which
contains both browsers and non-browsers.

---

From: Simon Perreault <[email-masked]>
Date: Mon, 15 Dec 2014 08:45:24 -0500

On Mon, Dec 15, 2014 at 8:24 AM, Christer Holmberg <
[email-masked]> wrote:
> First, I question whether this document should make normative requirements
> on WebRTC? Shouldn't some WebRTC document instead mandate the usage?
>
> Second, what if a non-WebRTC implementation wants to use the mechanism?
> The procedures are described below the text above, so the way I read it
> they only apply to WebRTC implementations.
>
> Third, *IF* the scope of the mechanism is only WebRTC (perhaps it is, and
> I have misunderstood), I think we need to have some explicit text
> indicating that.
>
> Fourth, if you want to use terminology from [I-D.ietf-rtcweb-overview] you
> need to make sure it's aligned with that draft. I don't think "WebRTC
> implementation" exists in draft-rtcweb-overview-13, so you would have to
> define that as a browser, non-browser or compatible endpoint (or, use those
> terminologies).
>

Fully agreed.

Fifth issue: The rtcweb-overview reference would need to be normative (it
is currently informative).

I suggest to simply remove the whole paragraph and the reference.

Simon

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 15 Dec 2014 13:49:27 +0000

Hi,

>I suggest to simply remove the whole paragraph and the reference.

That is my suggestion also :)

As Harald indicated he will add text to the overview document about the usage, nothing is "lost".

Regards,

Christer

---

From: Muthu Arul Mozhi Perumal <[email-masked]>
Date: Mon, 15 Dec 2014 20:22:06 +0530

We discussed this earlier in the WG:
http://www.ietf.org/mail-archive/web/rtcweb/current/msg13020.html

In fact, -08 had the following non-normative text:
   A WebRTC implementation [I-D.ietf-rtcweb-overview], which implements
   full ICE, performs consent freshness test using STUN request/response
   as described below:

I think the text in -10 can be replaced with:
   A full ICE implementation performs consent freshness test using STUN
   request/response as described below:

And the security-arch / overview documents can specify how it applies to
WebRTC.

Muthu

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Wed, 17 Dec 2014 03:54:57 +0000

Proposed text looks good to me. I will go ahead and incorporate this if others have no issues.

Ram

From: Muthu Arul Mozhi Perumal <[email-masked]<mailto:[email-masked]>>
Date: Monday, 15 December 2014 8:22 pm
To: Christer Holmberg <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [rtcweb] I-D Action: draft-ietf-rtcweb-stun-consent-freshness-10.txt

And the security-arch / overview documents can specify how it applies to WebRTC.

Muthu

On Mon, Dec 15, 2014 at 7:19 PM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

Regards,

Christer

_______________________________________________
rtcweb mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/rtcweb