From nobody Mon Oct 3 14:14:34 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7143129575 for ; Mon, 3 Oct 2016 14:14:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fjW6JRNYGx8w for ; Mon, 3 Oct 2016 14:14:29 -0700 (PDT) Received: from linzer.ki.iif.hu (linzer.ki.iif.hu [193.224.163.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED527129572 for ; Mon, 3 Oct 2016 14:14:22 -0700 (PDT) Received: from cirkusz.lvs.iif.hu (cirkusz.lvs.iif.hu [193.225.14.182]) by linzer.ki.iif.hu (Postfix) with ESMTP id A849C4060CA for ; Mon, 3 Oct 2016 23:14:20 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at cirkusz.lvs.iif.hu Received: from linzer.ki.iif.hu ([IPv6:::ffff:193.224.163.7]) by cirkusz.lvs.iif.hu (cirkusz.lvs.iif.hu [::ffff:193.225.14.72]) (amavisd-new, port 10024) with ESMTP id etN38rgQ5gcQ for ; Mon, 3 Oct 2016 23:14:19 +0200 (CEST) Received: from [10.10.10.50] (business-178-48-31-65.business.broadband.hu [178.48.31.65]) by linzer.ki.iif.hu (Postfix) with ESMTPSA id DE3904060C5 for ; Mon, 3 Oct 2016 23:14:19 +0200 (CEST) From: =?UTF-8?B?TcOpc3rDoXJvcyBNaWjDoWx5?= To: tram@ietf.org Message-ID: <1511b118-e8de-51f6-01ef-a6cb92976bfe@niif.hu> Date: Mon, 3 Oct 2016 23:14:18 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------65FBF6BE66C7927CF8E40895" Archived-At: Subject: [tram] RFC7635 questions/issues X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Oct 2016 21:14:32 -0000 This is a multi-part message in MIME format. --------------65FBF6BE66C7927CF8E40895 Content-Type: text/plain; charset=iso-8859-2 Content-Transfer-Encoding: quoted-printable Hi, I have some questions/issues regarding RFC7635. Give me some information and advice why was RFC7635 designed that way, that all OAuth related parameter should stored inside STUN/TURN client, instead of storing all these in informations in the application's OAuth modul? =20 IMHO the application should store OAuth parameters, and take care about token renewal, and only pass down informations to STUN client that it really needs. See my extended version of the figure 2 from RFC7635, so Third Party Auth in case of WebRTC. +---------------+ | =20 =3D*******+ +------------->+ Authorization + * | | server =20 | * | +----------+(WebRTC server)| * AS+RS, | | | =20 | * AUTH keys (1) | | =20 +---------------+ * (0) Access | |=20 (2) * Token | | Access Token * request | | =20 + * | | Session Key * | =20 + * | =20 V * +---------------Web-Browser---------+---+-------+ = =20 * | | =20 | * | | =20 | * | | OAuth =20 | * | +--------> client =20 | * | Web Application | | modul =20 | * | | | =20 | * | | =20 +------+----+ * | | | =20 | * | STUN/TURN| | =20 | * | Supported| | =20 | * | HMAC Algs| kid| =20 | * | | mac_key| =20 | * | | access_token| =20 | * | | | =20 | * | | | =20 | * +-------------WebRTC API------------------------+ V | | | | =20 +-----+=3D+----+ | | | | (3) =20 | | | | +-------------v----+ TURN request + Access | | | WebRTC Stack +-+ | Token =20 | TURN | | | STUN/TURN =20 +----------------------^+ server | | | | Allocate response (4) | | | =20 +-------------------<----------------------+ | +-----------------------------------------------+ =20 +------------+ I think the process should work the following way: (It has some differences with the actual RFC, RFC7635!) 1. In my view WebRTC PC must have a read-only field, about the supported HMAC alg. This information is provided by the STUN/TURN modul of the WebRTC sta= ck. 2. and only 3 parameters: the kid, the mac_key and the access_token must passed to the (ICE agent) STUN/TURN client. 3. The application should take care about token expiry and renew it. And after it pass the new kid, mac_key and access_token credentials thorough WebRTC PC interface to the stun client.. 1. RFC7635 says that STUN client should store all OAuth related informations, but I don't see and understand the reasons behind it. I don't see what are the reasons, and why we should push down all OAuth related parameters to STUN client. I believe we shouldn't pass all OAuth parameters up and down through webRTC interface, because it adds multiple issues, darwbacks e.g. * The number of such OAuth parameters may vary. To design the WebRTC PC API it is much easier if we have fix number of paramete= rs. * OAuth parameters over the kid,mac_key,access_token AFAIU are almost useless for STUN client. * It adds complexity to WebRTC PC interface, and despite these are mostly opaque and useless informations for the STUN/TURN client. The client need to store these informations. * It adds complexity in STUN client and also WebRTC PC, if token renewal should be implemented in STUN client level, and also it needs a bigger change in STUN/TURN client implementations. 2. The RFC is mentioning multiple time session key and mac_key terms, in Appendix B in example there is this in attribute "key", for me it is written in confusing way. AFAIU it speaks from the same thing but confusing to use two or three term on it. Maybe only mac_key should be used everywhere in the text, to make it little bit less confusing for me at least. All in all could you please shade light on the reasons why the "STUN/TURN client" should store OAuth parameters and do the access token renewal. If there is reason, then why it is not good if the OAuth client modul takes care about renewing the access_token? As I have mentioned, I think the Web Application OAuth client mudul should take care about renewal of access_token before token expiry, and so it needs only to store and deal with All OAuth related parameters. So my proposal that only a subset of these parameters, parameters that really used by STUN client should be passed to STUN/TURN client through the WebRTC PC interface. I am wondering is there any strong reason to pass and store all OAuth informations in STUN/TURN client, and trigger renewal from STUN, rather then leave this for the application OAuth client part? Please correct me if I am wrong somewhere.. Any comment or correction or advice to my proposed changes will be highly appreciated. Thanks, Misi --------------65FBF6BE66C7927CF8E40895 Content-Type: text/html; charset=iso-8859-2 Content-Transfer-Encoding: 8bit Hi,

I have some questions/issues regarding  RFC7635.

Give me some information and advice why was RFC7635 designed that way,
that all OAuth related parameter should stored inside STUN/TURN client,
instead of storing all these in informations in the application's OAuth modul?
 
IMHO the application should store OAuth parameters, and take care about token renewal, and only pass down informations to STUN client that it really needs.

See my extended version of the figure 2 from RFC7635, so Third Party Auth in case of WebRTC.


                                                       +---------------+
                                                       |               =*******+
                                        +------------->+ Authorization +       *
                                        |              | server        |       *
                                        |   +----------+(WebRTC server)|       *  AS+RS,
                                        |   |          |               |       *  AUTH keys
                               (1)      |   |          +---------------+       *   (0)
                               Access   |   |  (2)                             *
                               Token    |   | Access Token                     *
                               request  |   |    +                             *
                                        |   | Session Key                      *
                                        |   +                                  *
                                        |   V                                  *
+---------------Web-Browser---------+---+-------+                              *
|                                   |           |                              *
|                                   |           |                              *
|                                   | OAuth     |                              *
|                          +--------> client    |                              *
|     Web Application      |        | modul     |                              *
|                          |        |           |                              *
|                          |        +------+----+                              *
|                          |               |    |                              *
|                 STUN/TURN|               |    |                              *
|                 Supported|               |    |                              *
|                 HMAC Algs|            kid|    |                              *
|                          |        mac_key|    |                              *
|                          |   access_token|    |                              *
|                          |               |    |                              *
|                          |               |    |                              *
+-------------WebRTC API------------------------+                              V
|                          |               |    |                       +-----+=+----+
|                          |               |    |         (3)           |            |
|                          | +-------------v----+ TURN request + Access |            |
|    WebRTC Stack          +-+                  | Token                 | TURN       |
|                            |    STUN/TURN     +----------------------^+ server     |
|                            |                  | Allocate response (4) |            |
|                            +-------------------<----------------------+            |
+-----------------------------------------------+                       +------------+


I think the process should work the following way: (It has some differences with the actual RFC, RFC7635!)

  1. In my view WebRTC PC must have a read-only field, about the supported HMAC alg.
    This information is provided by the STUN/TURN modul of the WebRTC stack.
  2. and only 3 parameters: the kid, the mac_key and the access_token must passed to the (ICE agent) STUN/TURN client.
  3. The application should take care about token expiry and renew it. And after it pass the new kid, mac_key and access_token credentials thorough WebRTC PC interface to the stun client..


  1. RFC7635 says that STUN client should store all OAuth related informations, but I don't see and understand the reasons behind it.
    I don't see what are the reasons, and why we should push down all OAuth related parameters to STUN client.

    I believe we shouldn't pass all OAuth parameters up and down through webRTC interface, because it adds multiple issues, darwbacks
    e.g.
    • The number of such OAuth parameters may vary. To design the WebRTC PC API it is much easier if we have fix number of parameters.
    • OAuth parameters over the kid,mac_key,access_token AFAIU are almost useless for STUN client.
    • It adds complexity to WebRTC PC interface, and despite these are mostly opaque and useless informations for the STUN/TURN client. The client need to store these informations.
    • It adds complexity in STUN client and also WebRTC PC, if token renewal should be implemented in STUN client level, and also
      it needs a bigger change in STUN/TURN client implementations.

  2. The RFC is mentioning multiple time session key and mac_key terms, in Appendix B in example there is this in attribute "key", for me it is written in confusing way. AFAIU it speaks from the same thing but confusing to use two or three term on it. Maybe only mac_key should be used everywhere in the text, to make it little bit less confusing for me at least.
All in all could you please shade light on the reasons why the "STUN/TURN client" should store OAuth parameters and do the access token renewal. If there is reason, then why it is not good if the OAuth client modul takes care about renewing the access_token?
As I have mentioned, I think the Web Application OAuth client mudul should take care about renewal of access_token before token expiry, and so it needs only to store and deal with All OAuth related parameters. So my proposal that only a subset of these parameters, parameters that really used by STUN client should be passed to STUN/TURN client through the WebRTC PC interface.

I am wondering is there any strong reason to pass and store all OAuth informations in STUN/TURN client, and trigger renewal from STUN,
rather then leave this for the application OAuth client part?

Please correct me if I am wrong somewhere..
Any comment or correction or advice to my proposed changes will be highly appreciated.

Thanks,
Misi



--------------65FBF6BE66C7927CF8E40895-- From nobody Wed Oct 5 14:55:14 2016 Return-Path: X-Original-To: tram@ietf.org Delivered-To: tram@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CF3312949A; Wed, 5 Oct 2016 14:55:10 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.34.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147570451050.28098.15643335162669015197.idtracker@ietfa.amsl.com> Date: Wed, 05 Oct 2016 14:55:10 -0700 Archived-At: Cc: tram@ietf.org Subject: [tram] I-D Action: draft-ietf-tram-turn-server-discovery-10.txt X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Oct 2016 21:55:10 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the TURN Revised and Modernized of the IETF. Title : TURN Server Auto Discovery Authors : Prashanth Patil Tirumaleswar Reddy Dan Wing Filename : draft-ietf-tram-turn-server-discovery-10.txt Pages : 15 Date : 2016-10-05 Abstract: Current Traversal Using Relays around NAT (TURN) server discovery mechanisms are relatively static and limited to explicit configuration. These are usually under the administrative control of the application or TURN service provider, and not the enterprise, ISP, or the network in which the client is located. Enterprises and ISPs wishing to provide their own TURN servers need auto discovery mechanisms that a TURN client could use with no or minimal configuration. This document describes three such mechanisms for TURN server discovery. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discovery/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tram-turn-server-discovery-10 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tram-turn-server-discovery-10 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Oct 5 14:58:25 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E7E31294BA for ; Wed, 5 Oct 2016 14:58:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.517 X-Spam-Level: X-Spam-Status: No, score=-17.517 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.996, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HLSAwIaWWnbw for ; Wed, 5 Oct 2016 14:58:20 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B10FA12949A for ; Wed, 5 Oct 2016 14:58:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3006; q=dns/txt; s=iport; t=1475704700; x=1476914300; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=JdKMMFH/Q2CACnuRxsdnQExGUcRp1/LfELu1IUC+gt4=; b=gogSpwkP69NEjvAMSPHMqUV4laHR7FWaGcuE2X6YgZvkw3SZBwxT+PzR ZY+d0SU57EyOiQGzBbHFtpzQsZgV2vG139YdcvgQnNQJdaZSChWwx6CUk sEMkztHIUN0BKWirP0/CrJ+VL3LwqF8xdKUSGsQ4kKJpzc6rao6h1Jopo M=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B8AQAId/VX/5xdJa1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgz0BAQEBAR5XfAeNK6soggkbDYV4AhyBWTgUAQIBAQEBAQEBXhwLhGI?= =?us-ascii?q?BAQQBAQEgETobAgEIGgImAgICJQsVEAIEE4hODq9mjHEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEdgQeFNYF9CIJQhCMOFoMEK4IvBZl6AYYmiVCBbk6EGIkfjHODfQE?= =?us-ascii?q?eNkuEWXKGB4EvgQABAQE?= X-IronPort-AV: E=Sophos;i="5.31,451,1473120000"; d="scan'208";a="154848224" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Oct 2016 21:58:19 +0000 Received: from XCH-RTP-014.cisco.com (xch-rtp-014.cisco.com [64.101.220.154]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id u95LwJhv029033 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Wed, 5 Oct 2016 21:58:19 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-014.cisco.com (64.101.220.154) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 5 Oct 2016 17:58:18 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1210.000; Wed, 5 Oct 2016 17:58:18 -0400 From: "Prashanth Patil (praspati)" To: "tram@ietf.org" Thread-Topic: [tram] I-D Action: draft-ietf-tram-turn-server-discovery-10.txt Thread-Index: AQHSH1OUSyVjDlCP/kCaDhv24Pu37w== Date: Wed, 5 Oct 2016 21:58:18 +0000 Message-ID: <6FCBCD5E-6838-4922-80BA-B4C0C7E4B3D1@cisco.com> References: <147570451050.28098.15643335162669015197.idtracker@ietfa.amsl.com> In-Reply-To: <147570451050.28098.15643335162669015197.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.84.240] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [tram] I-D Action: draft-ietf-tram-turn-server-discovery-10.txt X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Oct 2016 21:58:22 -0000 VGhpcyByZXZpc2lvbiBhZGRyZXNzZXMgY29tbWVudHMgZnJvbSBJRVNHIHJldmlldy4NCg0KLVBy YXNoYW50aA0KDQpPbiAxMC81LzE2LCAyOjU1IFBNLCAidHJhbSBvbiBiZWhhbGYgb2YgaW50ZXJu ZXQtZHJhZnRzQGlldGYub3JnIiA8dHJhbS1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBp bnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc+IHdyb3RlOg0KDQogICAgDQogICAgQSBOZXcgSW50ZXJu ZXQtRHJhZnQgaXMgYXZhaWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRzIGRp cmVjdG9yaWVzLg0KICAgIFRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhlIFRVUk4gUmV2 aXNlZCBhbmQgTW9kZXJuaXplZCBvZiB0aGUgSUVURi4NCiAgICANCiAgICAgICAgICAgIFRpdGxl ICAgICAgICAgICA6IFRVUk4gU2VydmVyIEF1dG8gRGlzY292ZXJ5DQogICAgICAgICAgICBBdXRo b3JzICAgICAgICAgOiBQcmFzaGFudGggUGF0aWwNCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIFRpcnVtYWxlc3dhciBSZWRkeQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRGFu IFdpbmcNCiAgICAJRmlsZW5hbWUgICAgICAgIDogZHJhZnQtaWV0Zi10cmFtLXR1cm4tc2VydmVy LWRpc2NvdmVyeS0xMC50eHQNCiAgICAJUGFnZXMgICAgICAgICAgIDogMTUNCiAgICAJRGF0ZSAg ICAgICAgICAgIDogMjAxNi0xMC0wNQ0KICAgIA0KICAgIEFic3RyYWN0Og0KICAgICAgIEN1cnJl bnQgVHJhdmVyc2FsIFVzaW5nIFJlbGF5cyBhcm91bmQgTkFUIChUVVJOKSBzZXJ2ZXIgZGlzY292 ZXJ5DQogICAgICAgbWVjaGFuaXNtcyBhcmUgcmVsYXRpdmVseSBzdGF0aWMgYW5kIGxpbWl0ZWQg dG8gZXhwbGljaXQNCiAgICAgICBjb25maWd1cmF0aW9uLiAgVGhlc2UgYXJlIHVzdWFsbHkgdW5k ZXIgdGhlIGFkbWluaXN0cmF0aXZlIGNvbnRyb2wgb2YNCiAgICAgICB0aGUgYXBwbGljYXRpb24g b3IgVFVSTiBzZXJ2aWNlIHByb3ZpZGVyLCBhbmQgbm90IHRoZSBlbnRlcnByaXNlLA0KICAgICAg IElTUCwgb3IgdGhlIG5ldHdvcmsgaW4gd2hpY2ggdGhlIGNsaWVudCBpcyBsb2NhdGVkLiAgRW50 ZXJwcmlzZXMgYW5kDQogICAgICAgSVNQcyB3aXNoaW5nIHRvIHByb3ZpZGUgdGhlaXIgb3duIFRV Uk4gc2VydmVycyBuZWVkIGF1dG8gZGlzY292ZXJ5DQogICAgICAgbWVjaGFuaXNtcyB0aGF0IGEg VFVSTiBjbGllbnQgY291bGQgdXNlIHdpdGggbm8gb3IgbWluaW1hbA0KICAgICAgIGNvbmZpZ3Vy YXRpb24uICBUaGlzIGRvY3VtZW50IGRlc2NyaWJlcyB0aHJlZSBzdWNoIG1lY2hhbmlzbXMgZm9y DQogICAgICAgVFVSTiBzZXJ2ZXIgZGlzY292ZXJ5Lg0KICAgIA0KICAgIA0KICAgIFRoZSBJRVRG IGRhdGF0cmFja2VyIHN0YXR1cyBwYWdlIGZvciB0aGlzIGRyYWZ0IGlzOg0KICAgIGh0dHBzOi8v ZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtdHJhbS10dXJuLXNlcnZlci1kaXNj b3ZlcnkvDQogICAgDQogICAgVGhlcmUncyBhbHNvIGEgaHRtbGl6ZWQgdmVyc2lvbiBhdmFpbGFi bGUgYXQ6DQogICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdHJhbS10 dXJuLXNlcnZlci1kaXNjb3ZlcnktMTANCiAgICANCiAgICBBIGRpZmYgZnJvbSB0aGUgcHJldmlv dXMgdmVyc2lvbiBpcyBhdmFpbGFibGUgYXQ6DQogICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvcmZj ZGlmZj91cmwyPWRyYWZ0LWlldGYtdHJhbS10dXJuLXNlcnZlci1kaXNjb3ZlcnktMTANCiAgICAN CiAgICANCiAgICBQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0 ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uDQogICAgdW50aWwgdGhlIGh0bWxpemVkIHZl cnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZy4NCiAgICANCiAg ICBJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxhYmxlIGJ5IGFub255bW91cyBGVFAgYXQ6 DQogICAgZnRwOi8vZnRwLmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8NCiAgICANCiAgICBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgIHRyYW0gbWFp bGluZyBsaXN0DQogICAgdHJhbUBpZXRmLm9yZw0KICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vdHJhbQ0KICAgIA0KDQo= From nobody Thu Oct 6 18:26:07 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 420BC1294E2; Thu, 6 Oct 2016 18:26:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UdCLXQDCzVzx; Thu, 6 Oct 2016 18:26:00 -0700 (PDT) Received: from mail-yw0-x234.google.com (mail-yw0-x234.google.com [IPv6:2607:f8b0:4002:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE7311294E0; Thu, 6 Oct 2016 18:25:59 -0700 (PDT) Received: by mail-yw0-x234.google.com with SMTP id u124so23786000ywg.3; Thu, 06 Oct 2016 18:25:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=qb9FsoBgeu88y16s9vnpGLzUlQpI1SW99jRKDaihsVw=; b=QIcZAaILhZ9+X9kn1qlR8CHyRxstCHkCYQ4OTbbs8mPxNFi8PyulsaSpnKVQWNlrBd kmi1FVUOg3gSaZy3mAZy8l9q/Nx9ieiPRO05z9JtxQywN43E0hYblMazuqAO8xZqK6UJ iH7wDPG2qNhpifLsdWoDpfHGaVOJKwOieBKVE/T3HgEZ6KzODC7xKaKgB5kmMA6SH/lh zGJ1sq0CQL+1+hzqX4Uqqlu7b6VGmIKPYBS0rq3JETpR9N4LC+oUQTuQhb0t6Sfj9r7G e05v7azyJlyG+Sb9b2HyHMJJUMuKSUdeDi5brw/NAozZ1/hcD9VMjIRqZykAiy4u+ltL /JUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=qb9FsoBgeu88y16s9vnpGLzUlQpI1SW99jRKDaihsVw=; b=FlyiYt3VjidWQP8t9TVC+IIm2pseghtvyrKBg68iiiAikbYNk6Rex2UA6GlWWGZmEp 5V6rYUJV+TsZQfDyodwNqPFXpLirYh2FUTBrwbohKXcq6RouBGUT0eTCewdd9JKiUqeS es3oYET0qsZcVCJVPSYmrIeq0QmYqk7nyfeQzJ+bg8A4YZSHwZwcopSNrikdDby9Ov8c VV+Mi9e3RGpux1Vc5s7bAeoMMd/GYMCy0obKXB3ZnfyvCtyw+hLb2g6RkYLNlxfCDeWI wZmIt/D1geG8X8YQxOu2RCGEakkoQrjCSp8u12kzYJL3zd6Z9qJo5mMAIk8ypDF9+H/t I01w== X-Gm-Message-State: AA6/9RkY0gJvRsmjwyLAmjbpA/rAMY1eWBStv/e3unMmz/+t7oYMj6VBOE73+O3HwFFBi0q0UxcvlVEdjLeZVg== X-Received: by 10.129.77.84 with SMTP id a81mr12861772ywb.19.1475803559134; Thu, 06 Oct 2016 18:25:59 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.24.86 with HTTP; Thu, 6 Oct 2016 18:25:58 -0700 (PDT) In-Reply-To: References: <147260615677.23780.12323446975574787038.idtracker@ietfa.amsl.com> From: Spencer Dawkins at IETF Date: Thu, 6 Oct 2016 20:25:58 -0500 Message-ID: To: "Tirumaleswar Reddy (tireddy)" Content-Type: multipart/alternative; boundary=001a1140b7ace68b12053e3c4afb Archived-At: Cc: "tram-chairs@ietf.org" , "tram@ietf.org" , "draft-ietf-tram-turn-server-discovery@ietf.org" , "sperreault@jive.com" , The IESG , Terry Manderson Subject: Re: [tram] Terry Manderson's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 01:26:02 -0000 --001a1140b7ace68b12053e3c4afb Content-Type: text/plain; charset=UTF-8 Hi, Terry, On Wed, Aug 31, 2016 at 1:36 AM, Tirumaleswar Reddy (tireddy) < tireddy@cisco.com> wrote: > > -----Original Message----- > > From: Terry Manderson [mailto:terry.manderson@icann.org] > > Sent: Wednesday, August 31, 2016 6:46 AM > > To: The IESG > > Cc: draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault > > ; tram-chairs@ietf.org; sperreault@jive.com; > > tram@ietf.org > > Subject: Terry Manderson's Discuss on draft-ietf-tram-turn-server- > discovery- > > 09: (with DISCUSS) > > > > Terry Manderson has entered the following ballot position for > > draft-ietf-tram-turn-server-discovery-09: Discuss > > > > When responding, please keep the subject line intact and reply to all > email > > addresses included in the To and CC lines. (Feel free to cut this > introductory > > paragraph, however.) > > > > > > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria. > html > > for more information about IESG DISCUSS and COMMENT positions. > > > > > > The document, along with other ballot positions, can be found here: > > https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discovery/ > > > > > > > > ---------------------------------------------------------------------- > > DISCUSS: > > ---------------------------------------------------------------------- > > > > in requesting special use assignments, please read the registries and > provide > > guidance on the scope of the allocations i.e. > > > > o Source - A boolean value indicating whether an address from the > > allocated special-purpose address block is valid when used as the > > source address of an IP datagram that transits two devices. > > > > o Destination - A boolean value indicating whether an address from > > the allocated special-purpose address block is valid when used as > > the destination address of an IP datagram that transits two > > devices. > > > > o Forwardable - A boolean value indicating whether a router may > > forward an IP datagram whose destination address is drawn from the > > allocated special-purpose address block between external > > interfaces. > > > > o Global - A boolean value indicating whether an IP datagram whose > > destination address is drawn from the allocated special-purpose > > address block is forwardable beyond a specified administrative > > domain. > > Thanks, updated draft. > > Cheers, > -Tiru It looks to me that -10 should address this Discuss. Could you take a look and let us know? Thanks, Spencer --001a1140b7ace68b12053e3c4afb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi, Terry,

On Wed, Aug 31, 2016 at 1:36 AM, Tirumaleswar Reddy (tireddy) <t= ireddy@cisco.com> wrote:
> -----Original Message-----
> From: Terry Manderson [mailto:terry.manderson@icann.org]
> Sent: Wednesday, August 31, 2016 6:46 AM
> To: The IESG <iesg@ietf.org>= ;
> Cc: = draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault > <sperreault@jive.com>= ; tram-chairs@ietf.org; sperreault@jive.com;
> tram@ietf.org
> Subject: Terry Manderson's Discuss on draft-ietf-tram-turn-server-= discovery-
> 09: (with DISCUSS)
>
> Terry Manderson has entered the following ballot position for
> draft-ietf-tram-turn-server-discovery-09: Discuss
>
> When responding, please keep the subject line intact and reply to all = email
> addresses included in the To and CC lines. (Feel free to cut this intr= oductory
> paragraph, however.)
>
>
> Please refer to https://www.ietf.org/i= esg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here: > https://datatracker.ietf= .org/doc/draft-ietf-tram-turn-server-discovery/
>
>
>
> ------------------------------------------------------------= ----------
> DISCUSS:
> ------------------------------------------------------------= ----------
>
> in requesting special use assignments, please read the registries and = provide
> guidance on the scope of the allocations i.e.
>
>=C2=A0 =C2=A0 o=C2=A0 Source - A boolean value indicating whether an ad= dress from the
>=C2=A0 =C2=A0 =C2=A0 =C2=A0allocated special-purpose address block is v= alid when used as the
>=C2=A0 =C2=A0 =C2=A0 =C2=A0source address of an IP datagram that transi= ts two devices.
>
>=C2=A0 =C2=A0 o=C2=A0 Destination - A boolean value indicating whether = an address from
>=C2=A0 =C2=A0 =C2=A0 =C2=A0the allocated special-purpose address block = is valid when used as
>=C2=A0 =C2=A0 =C2=A0 =C2=A0the destination address of an IP datagram th= at transits two
>=C2=A0 =C2=A0 =C2=A0 =C2=A0devices.
>
>=C2=A0 =C2=A0 o=C2=A0 Forwardable - A boolean value indicating whether = a router may
>=C2=A0 =C2=A0 =C2=A0 =C2=A0forward an IP datagram whose destination add= ress is drawn from the
>=C2=A0 =C2=A0 =C2=A0 =C2=A0allocated special-purpose address block betw= een external
>=C2=A0 =C2=A0 =C2=A0 =C2=A0interfaces.
>
>=C2=A0 =C2=A0 o=C2=A0 Global - A boolean value indicating whether an IP= datagram whose
>=C2=A0 =C2=A0 =C2=A0 =C2=A0destination address is drawn from the alloca= ted special-purpose
>=C2=A0 =C2=A0 =C2=A0 =C2=A0address block is forwardable beyond a specif= ied administrative
>=C2=A0 =C2=A0 =C2=A0 =C2=A0domain.

Thanks, updated draft.

Cheers,
-Tiru

It looks to me that -10 should addres= s this Discuss. Could you take a look and let us know?

=
Thanks,

Spencer
--001a1140b7ace68b12053e3c4afb-- From nobody Thu Oct 6 18:44:58 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9142F1294F6; Thu, 6 Oct 2016 18:44:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fhQLAoKFE1NG; Thu, 6 Oct 2016 18:44:48 -0700 (PDT) Received: from mail-yw0-x233.google.com (mail-yw0-x233.google.com [IPv6:2607:f8b0:4002:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD2991294E0; Thu, 6 Oct 2016 18:44:47 -0700 (PDT) Received: by mail-yw0-x233.google.com with SMTP id u124so23975926ywg.3; Thu, 06 Oct 2016 18:44:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=gvhjVidgPTmuUUdxqd1uJ8oAmL4gaDOxm2/laUmTx3k=; b=ou2do8tvnfZSp7HbU4eqCAEfXUiZFuB1NoQsAWIfcDUaBF/WE72EaJ+wLoOjyOS8Wq nO+nk0wc9bpZwGtlZ0RrQItDBgEOI4GLQapwYT+fw3Ybci0mYIVJGCffhh532EJLp7Hi 3Pzi1zGlsLrAse/6BiggHpn4b+fVxCrgLjjxt0dFZ+AD66OnbiLbZEnzIDYiCV5s6+X5 bKf6vmg456yKpnJCEQ2WgE1G3Y7Hxh7keT6gBqlmCYLG5MaSzmM/L3Is+cUqYThkJZbb +Nv+08eBUdXOwHoKn2BylBS3hv/a0gapDnmBvi/vAAshySB6U2Ma+JXP1Prclq9ZLqMA mwSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=gvhjVidgPTmuUUdxqd1uJ8oAmL4gaDOxm2/laUmTx3k=; b=D9G693AAqL2GknQxeUxUPRGVyH9VDyagzgP55F7GszMebCdEGzD9FsP0mFCZNK3DIR BsDJMaI3m0fitDwVQBlR9UJ1oaWLHyDEkTCJ8kBwmPWNu9fy3KFHukyFglFEG8UkFjPH b0SWWsi5nPEjDIRDxF/TOP8zp+XLi58pTPmK1PebEvIVyyqUF2VlIilTpdVrp53Sunxa 36KbLvI0yaGIri9z+RKWrWrwDut+ViiCKBqErCe1MT4YM0O0CxQUdhVRwmyF1etel4Wc n9PWo0YvtUxD8Gtf9N3bFRJCxQvGWIIrhtWwDd7qdXRauROg4H3xWnF71prZAnDlHhye 1pKQ== X-Gm-Message-State: AA6/9Rl4v77pd05EI+ii69700gZFZRgNmr94pUHEAjyCbjU6wkR4oQpMVD/3Co76AIJFumVa9118czFz8SgXDQ== X-Received: by 10.13.204.139 with SMTP id o133mr13307275ywd.61.1475804686986; Thu, 06 Oct 2016 18:44:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.24.86 with HTTP; Thu, 6 Oct 2016 18:44:46 -0700 (PDT) In-Reply-To: <2675d94d58264487b5d2a5ecb6c5f03e@XCH-RCD-017.cisco.com> References: <147247859789.14154.18257109792324801465.idtracker@ietfa.amsl.com> <5D9A0F6D-DFEF-4C65-8EC6-219FB9A32C58@gmail.com> <2675d94d58264487b5d2a5ecb6c5f03e@XCH-RCD-017.cisco.com> From: Spencer Dawkins at IETF Date: Thu, 6 Oct 2016 20:44:46 -0500 Message-ID: To: "Tirumaleswar Reddy (tireddy)" Content-Type: multipart/alternative; boundary=001a114f00282034a7053e3c8e0e Archived-At: Cc: "tram-chairs@ietf.org" , "tram@ietf.org" , "draft-ietf-tram-turn-server-discovery@ietf.org" , Simon Perreault , "kathleen.moriarty.ietf@gmail.com" , The IESG Subject: Re: [tram] Kathleen Moriarty's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 01:44:50 -0000 --001a114f00282034a7053e3c8e0e Content-Type: text/plain; charset=UTF-8 Hi, Kathleen, On Wed, Sep 7, 2016 at 9:22 PM, Tirumaleswar Reddy (tireddy) < tireddy@cisco.com> wrote: > > -----Original Message----- > > From: kathleen.moriarty.ietf@gmail.com > > [mailto:kathleen.moriarty.ietf@gmail.com] > > Sent: Thursday, September 8, 2016 7:09 AM > > To: Tirumaleswar Reddy (tireddy) > > Cc: The IESG ; draft-ietf-tram-turn-server- > discovery@ietf.org; > > Simon Perreault ; tram-chairs@ietf.org; > tram@ietf.org > > Subject: Re: Kathleen Moriarty's Discuss on draft-ietf-tram-turn-server- > > discovery-09: (with DISCUSS) > > > > Hi Tiru, > > > > > > Sent from my iPhone > > > > On Sep 6, 2016, at 11:27 PM, Tirumaleswar Reddy (tireddy) > > wrote: > > > > >> -----Original Message----- > > >> From: kathleen.moriarty.ietf@gmail.com > > >> [mailto:kathleen.moriarty.ietf@gmail.com] > > >> Sent: Thursday, September 1, 2016 5:37 PM > > >> To: Tirumaleswar Reddy (tireddy) > > >> Cc: The IESG ; > > >> draft-ietf-tram-turn-server-discovery@ietf.org; > > >> Simon Perreault ; tram-chairs@ietf.org; > > >> tram@ietf.org > > >> Subject: Re: Kathleen Moriarty's Discuss on > > >> draft-ietf-tram-turn-server- > > >> discovery-09: (with DISCUSS) > > >> > > >> > > >> > > >> Sent from my iPhone > > >> > > >> On Aug 31, 2016, at 3:02 AM, Tirumaleswar Reddy (tireddy) > > >> wrote: > > >> > > >>>> -----Original Message----- > > >>>> From: Kathleen Moriarty [mailto:Kathleen.Moriarty.ietf@gmail.com] > > >>>> Sent: Monday, August 29, 2016 7:20 PM > > >>>> To: The IESG > > >>>> Cc: draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault > > >>>> ; tram-chairs@ietf.org; sperreault@jive.com; > > >>>> tram@ietf.org > > >>>> Subject: Kathleen Moriarty's Discuss on > > >>>> draft-ietf-tram-turn-server-discovery- > > >>>> 09: (with DISCUSS) > > >>>> > > >>>> Kathleen Moriarty has entered the following ballot position for > > >>>> draft-ietf-tram-turn-server-discovery-09: Discuss > > >>>> > > >>>> When responding, please keep the subject line intact and reply to > > >>>> all email addresses included in the To and CC lines. (Feel free to > > >>>> cut this introductory paragraph, however.) > > >>>> > > >>>> > > >>>> Please refer to > > >>>> https://www.ietf.org/iesg/statement/discuss-criteria.html > > >>>> for more information about IESG DISCUSS and COMMENT positions. > > >>>> > > >>>> > > >>>> The document, along with other ballot positions, can be found here: > > >>>> https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discov > > >>>> er > > >>>> y/ > > >>>> > > >>>> > > >>>> > > >>>> ------------------------------------------------------------------- > > >>>> -- > > >>>> - > > >>>> DISCUSS: > > >>>> ------------------------------------------------------------------- > > >>>> -- > > >>>> - > > >>>> > > >>>> This should be easy to resolve. In reading the draft, it doesn't > > >>>> cover any mechanism for the TURN server to limit what clients can > > >> discover it. > > >>>> For the second and third method, it seems like there are possible > > >>>> ways to do this. Could these be added to the security > > >>>> considerations? You'd need to state that this isn't possible with > > >>>> the first method. If there is a reason why it is always okay to > > >>>> discover a TURN server, please let me know why this is not > > >>>> appropriate to > > >> add. Thanks. > > >>> > > >>> I don't see a reason why TURN server discovery should be restricted > > >>> only to > > >> specific clients. Please explain the scenarios for imposing such > restrictions. > > >> > > >> Hello Tiru, > > >> > > >> Are there any cases where some domains or addresses should be > > restricted? > > > > > > Yes. > > > > > >> When you have open services, it's possible to attack them. It could > > >> be from a design or implementation problem that makes an exploit > > >> possible or it might just be for network reconnaissance. Is there > > >> something different about TURN servers that makes this point moot. > > > > > > Restricting access to use the TURN server seems more important than > > discovering the TURN server; will add more details that TURN servers > > deployed in DMZ must only process STUN requests from the trusted network > > and not from the external network. Similarly TURN server in access > network > > must only process STUN requests only its subscribers. Access control can > be > > provided by access-control lists, firewalls and/or by user > authentication to the > > TURN server. We can also discuss other recommendations like > per-subscriber > > quota limit, ingress filtering. > > > > > > Please share any other mechanisms you would like to use to discuss in > the > > WG and include in the draft. > > > > That sounds good, thank you. Since this draft is about discovery, the > > restrictions you are going to add would also prevent reconnaissance, so > you > > might want to mention that as well. > > Sure. > > > > > If the other recommendations are in another draft, a punter to that > would be > > good. If not, adding them might be helpful and you can point to this > text in the > > future. > > Other TURN drafts are not discussing the above restrictions, we will > update the draft. > > -Tiru > > > > > Thank you, > > Kathleen > > > > > > -Tiru > > > > > >> > > >> Thank you, > > >> Kathleen > > >>> > > >>> Cheers, > > >>> -Tiru > > >>> > > >>> > Could you confirm that the additions to the Security Considerations section in -10 address your Discuss? Thanks! Spencer --001a114f00282034a7053e3c8e0e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi, Kathleen,

On Wed, Sep 7, 2016 at 9:22 PM, Tirumaleswar Reddy (tireddy) <= span dir=3D"ltr"><tireddy@cisco.com> wrote:
= > -----Original Message-----
> From: kathleen.mor= iarty.ietf@gmail.com
> [mailto:kathleen.m= oriarty.ietf@gmail.com]
> Sent: Thursday, September 8, 2016 7:09 A= M
> To: Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
> Cc: The IESG <iesg@ietf.org>= ;; draft-= ietf-tram-turn-server-discovery@ietf.org;
> Simon Perreault <sperreault@= jive.com>; tram-chairs@ietf.= org; tram@ietf.org
> Subject: Re: Kathleen Moriarty's Discuss on draft-ietf-tram-turn-s= erver-
> discovery-09: (with DISCUSS)
>
> Hi Tiru,
>
>
> Sent from my iPhone
>
> On Sep 6, 2016, at 11:27 PM, Tirumaleswar Reddy (tireddy)
> <tireddy@cisco.com> wro= te:
>
> >> -----Original Message-----
> >> From: kat= hleen.moriarty.ietf@gmail.com
> >> [mailto:k= athleen.moriarty.ietf@gmail.com]
> >> Sent: Thursday, September 1, 2016 5:37 PM
> >> To: Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
> >> Cc: The IESG <iesg@ietf.o= rg>;
> >> draft-ietf-tram-turn-server-discovery@ietf.org;
> >> Simon Perreault <sp= erreault@jive.com>; tram-cha= irs@ietf.org;
> >> tram@ietf.org
> >> Subject: Re: Kathleen Moriarty's Discuss on
> >> draft-ietf-tram-turn-server-
> >> discovery-09: (with DISCUSS)
> >>
> >>
> >>
> >> Sent from my iPhone
> >>
> >> On Aug 31, 2016, at 3:02 AM, Tirumaleswar Reddy (tireddy)
> >> <tireddy@cisco.com> wrote:
> >>
> >>>> -----Original Message-----
> >>>> From: Kathleen Moriarty [mailto:Kathleen.Moriarty.ietf@gmail.com] > >>>> Sent: Monday, August 29, 2016 7:20 PM
> >>>> To: The IESG <ies= g@ietf.org>
> >>>> Cc: draft-ietf-tram-turn-server-discovery@ietf.org; S= imon Perreault
> >>>> <sperreault= @jive.com>; tram-chairs@ietf= .org; sperreault@jive.com; > >>>> tram@ietf.org > >>>> Subject: Kathleen Moriarty's Discuss on
> >>>> draft-ietf-tram-turn-server-discovery-
> >>>> 09: (with DISCUSS)
> >>>>
> >>>> Kathleen Moriarty has entered the following ballot po= sition for
> >>>> draft-ietf-tram-turn-server-discovery-09: Discus= s
> >>>>
> >>>> When responding, please keep the subject line intact = and reply to
> >>>> all email addresses included in the To and CC lines. = (Feel free to
> >>>> cut this introductory paragraph, however.)
> >>>>
> >>>>
> >>>> Please refer to
> >>>> https://www.ietf.org/= iesg/statement/discuss-criteria.html
> >>>> for more information about IESG DISCUSS and COMMENT p= ositions.
> >>>>
> >>>>
> >>>> The document, along with other ballot positions, can = be found here:
> >>>> https://dat= atracker.ietf.org/doc/draft-ietf-tram-turn-server-discov
> >>>> er
> >>>> y/
> >>>>
> >>>>
> >>>>
> >>>> ------------------------------------------------= -------------------
> >>>> --
> >>>> -
> >>>> DISCUSS:
> >>>> ------------------------------------------------= -------------------
> >>>> --
> >>>> -
> >>>>
> >>>> This should be easy to resolve.=C2=A0 In reading the = draft, it doesn't
> >>>> cover any mechanism for the TURN server to limit what= clients can
> >> discover it.
> >>>> For the second and third method, it seems like there = are possible
> >>>> ways to do this.=C2=A0 Could these be added to the se= curity
> >>>> considerations?=C2=A0 You'd need to state that th= is isn't possible with
> >>>> the first method.=C2=A0 If there is a reason why it i= s always okay to
> >>>> discover a TURN server, please let me know why this i= s not
> >>>> appropriate to
> >> add.=C2=A0 Thanks.
> >>>
> >>> I don't see a reason why TURN server discovery should= be restricted
> >>> only to
> >> specific clients. Please explain the scenarios for imposing s= uch restrictions.
> >>
> >> Hello Tiru,
> >>
> >> Are there any cases where some domains or addresses should be=
> restricted?
> >
> > Yes.
> >
> >> When you have open services, it's possible to attack them= .=C2=A0 It could
> >> be from a design or implementation problem that makes an expl= oit
> >> possible or it might just be for network reconnaissance.=C2= =A0 Is there
> >> something different about TURN servers that makes this point = moot.
> >
> > Restricting access to use the TURN server seems more important th= an
> discovering the TURN server; will add more details that TURN servers > deployed in DMZ must only process STUN requests from the trusted netwo= rk
> and not from the external network. Similarly TURN server in access net= work
> must only process STUN requests only its subscribers. Access control c= an be
> provided by access-control lists, firewalls and/or by user authenticat= ion to the
> TURN server. We can also discuss other recommendations like per-subscr= iber
> quota limit, ingress filtering.
> >
> > Please share any other mechanisms you would like to use to discus= s in the
> WG and include in the draft.
>
> That sounds good, thank you.=C2=A0 Since this draft is about discovery= , the
> restrictions you are going to add would also prevent reconnaissance, s= o you
> might want to mention that as well.

Sure.

>
> If the other recommendations are in another draft, a punter to that wo= uld be
> good.=C2=A0 If not, adding them might be helpful and you can point to = this text in the
> future.

Other TURN drafts are not discussing the above restrictions, we will= update the draft.

-Tiru

>
> Thank you,
> Kathleen
> >
> > -Tiru
> >
> >>
> >> Thank you,
> >> Kathleen
> >>>
> >>> Cheers,
> >>> -Tiru
> >>>
> >>>

Could you= confirm that the additions to the Security Considerations section in -10 a= ddress your Discuss?

Thanks!

<= div>Spencer=C2=A0
--001a114f00282034a7053e3c8e0e-- From nobody Thu Oct 6 18:48:26 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2EF8129508; Thu, 6 Oct 2016 18:48:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HwsjAcxRKsNw; Thu, 6 Oct 2016 18:48:19 -0700 (PDT) Received: from mail-yw0-x235.google.com (mail-yw0-x235.google.com [IPv6:2607:f8b0:4002:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EA861294FA; Thu, 6 Oct 2016 18:48:19 -0700 (PDT) Received: by mail-yw0-x235.google.com with SMTP id t193so24025637ywc.2; Thu, 06 Oct 2016 18:48:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=8xR5rDp+YjrmMvvHCL9+tanl/Hfxo4nYLx2gWr1d4Fg=; b=bG6nxnbv2iyVuxcpYSuz49wQ83csA7apvZIMUxDkwi71SYw4a6FkXLyIavbsHFmfMV pIbSmcOCoENcg9H6W9XSqZVTSsH8OOd0GX2I5RtUHHQAlOtF4VGeCoCw5kzgQ37IN2a2 2R10CLxhCUeuwxpjG91VNOf3aD+n4TImTpCj2zRpGzoOakkajwdWzaFmnOF0AQGOXRX5 3lSeCAg8WirOLN+rzXS9cg0p2a0+IRFfmiYHUoAhBqtv0ahbhnVRhJh8pNe3anOjirJi Ul0YNedgc5QC6L1UY14FdQ7FM4sxKFsMuTntYdt8+MLGBgRwAx+2Alc+BOHwo3+GSPFn gR0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=8xR5rDp+YjrmMvvHCL9+tanl/Hfxo4nYLx2gWr1d4Fg=; b=ZI2TO2m73WjMLeueSYBgf9nOqDIiCHYJGzlHueNhCgwy1IzryFx+TbUULvddVAynke c3KgEZlDD85fpReCnBs0b9LviG3qGvpx59w0LT1VSBYMfxTdjs4lMTR9BOW5j7/qVgRt 96sOeos+dmxMN6dlSmICxduUgC/wHXPF6x1kVjokLiGFUith3gVa1dlDD2Djo4YVQuiz Xm5jA3/aXui+zQca6gzGpw61znNc3GbjP+9Sruoi75Q1DbgFeZtNz1Nx7zxUOPnYABSK Q/8BUFuSMrqjCStc9hqGavoC3NHOAhLEw+irq4Cqn++uOCvepJ2kmvtahH+ywZJR4bS1 S9eA== X-Gm-Message-State: AA6/9Rk1mEaHIKfNqekw3s/KS/GDFuVtmLxvEaBOsH3VKOw+beMSAnRyNd0bxSML3onpvOASHekv3qeNSYonsA== X-Received: by 10.13.214.12 with SMTP id y12mr13541962ywd.152.1475804898581; Thu, 06 Oct 2016 18:48:18 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.24.86 with HTTP; Thu, 6 Oct 2016 18:48:18 -0700 (PDT) In-Reply-To: References: <147270350795.31961.8306227467315681365.idtracker@ietfa.amsl.com> From: Spencer Dawkins at IETF Date: Thu, 6 Oct 2016 20:48:18 -0500 Message-ID: To: Suresh Krishnan Content-Type: multipart/alternative; boundary=94eb2c073bbcbce2fa053e3c9a8c Archived-At: Cc: "Prashanth Patil \(praspati\)" , "tram-chairs@ietf.org" , "tram@ietf.org" , "draft-ietf-tram-turn-server-discovery@ietf.org" , Simon Perreault , The IESG Subject: Re: [tram] Suresh Krishnan's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 01:48:20 -0000 --94eb2c073bbcbce2fa053e3c9a8c Content-Type: text/plain; charset=UTF-8 Hi, Suresh, On Fri, Sep 9, 2016 at 5:20 AM, Suresh Krishnan < suresh.krishnan@ericsson.com> wrote: > Hi Prashanth, > > On 09/07/2016 11:27 PM, Prashanth Patil (praspati) wrote: > >>> Does following text address your concerns? > >>> > >>> .. > >>> DHCP can be used to determine the domain name related to an > >>> interface's point of network attachment. Network operators may > >>> provide the domain name to be used for service discovery within an > >>> access network using DHCP. Sections 3.2 and 3.3 of [RFC5986] define > >>> DHCP IPv4 and IPv6 access network domain name options, > >>> OPTION_V4_ACCESS_DOMAIN and OPTION_V6_ACCESS_DOMAIN respectively, to > >>> identify a domain name that is suitable for service discovery within > >>> the access network. > >>> > >>> For IPv4, the discovery procedure MUST request for an access network > >>> domain name option in a Parameter Request List option, as described > >>> in [RFC2131]. [RFC2132] defines the DHCP IPv4 domain name option; > >>> while this option is less suitable, a client MAY request for it if > >>> the access network domain name defined in [RFC5986] is not > available. > >>> > >>> For IPv6, the discovery procedure MUST request for an access network > >>> domain name option in an Options Request Option (ORO), as described > >>> in [RFC3315]. > >>> > >>> If neither option can be retrieved the procedure fails for this > >>> interface. If a result can be retrieved it will be used as input > >>> for S-NAPTR resolution. > >> > >> Thank you. That certainly addresses one part of my DISCUSS but it still > >> needs > >> additional text on the DHCPv6 side to specify which message exchange > will > >> be > >> used. > > > > Sorry, missed that one. > > > >> Did you intend to use the stateful exchange or the stateless exchange? > > > > We intend to use stateless. Will update the draft accordingly. > > Sounds good. I will clear when the new revision posts. Could you take a look at -10 and see if it addresses all of your Discuss? Thanks! Spencer --94eb2c073bbcbce2fa053e3c9a8c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi, Suresh,

On Fri, Sep 9, 2016 at 5:20 AM, Suresh Krishnan <sur= esh.krishnan@ericsson.com> wrote:
Hi Prashanth,

On 09/07/2016 11:27 PM, Prashanth Patil (praspati) wrote:
>>> Does following text address your concerns?
>>>
>>> ..
>>>=C2=A0 =C2=A0 DHCP can be used to determine the domain name rel= ated to an
>>>=C2=A0 =C2=A0 interface's point of network attachment.=C2= =A0 Network operators may
>>>=C2=A0 =C2=A0 provide the domain name to be used for service di= scovery within an
>>>=C2=A0 =C2=A0 access network using DHCP.=C2=A0 Sections 3.2 and= 3.3 of [RFC5986] define
>>>=C2=A0 =C2=A0 DHCP IPv4 and IPv6 access network domain name opt= ions,
>>>=C2=A0 =C2=A0 OPTION_V4_ACCESS_DOMAIN and OPTION_V6_ACCESS_DOMA= IN respectively, to
>>>=C2=A0 =C2=A0 identify a domain name that is suitable for servi= ce discovery within
>>>=C2=A0 =C2=A0 the access network.
>>>
>>>=C2=A0 =C2=A0 For IPv4, the discovery procedure MUST request fo= r an access network
>>>=C2=A0 =C2=A0 domain name option in a Parameter Request List op= tion, as described
>>>=C2=A0 =C2=A0 in [RFC2131].=C2=A0 [RFC2132] defines the DHCP IP= v4 domain name option;
>>>=C2=A0 =C2=A0 while this option is less suitable, a client MAY = request for it if
>>>=C2=A0 =C2=A0 the access network domain name defined in [RFC598= 6] is not available.
>>>
>>>=C2=A0 =C2=A0 For IPv6, the discovery procedure MUST request fo= r an access network
>>>=C2=A0 =C2=A0 domain name option in an Options Request Option (= ORO), as described
>>>=C2=A0 =C2=A0 in [RFC3315].
>>>
>>>=C2=A0 =C2=A0 If neither option can be retrieved the procedure = fails for this
>>>=C2=A0 =C2=A0 interface.=C2=A0 If a result can be retrieved it = will be used as input
>>>=C2=A0 =C2=A0 for S-NAPTR resolution.
>>
>> Thank you. That certainly addresses one part of my DISCUSS but it = still
>> needs
>> additional text on the DHCPv6 side to specify which message exchan= ge will
>> be
>> used.
>
> Sorry, missed that one.
>
>> Did you intend to use the stateful exchange or the stateless excha= nge?
>
> We intend to use stateless. Will update the draft accordingly.

Sounds good. I will clear when the new revision posts.

Could you take a look at -10 and see if it addresse= s all of your Discuss?

Thanks!

Spencer=C2=A0
--94eb2c073bbcbce2fa053e3c9a8c-- From nobody Thu Oct 6 19:40:24 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C73251294F3; Thu, 6 Oct 2016 19:40:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id INwuf5WYiSNr; Thu, 6 Oct 2016 19:40:15 -0700 (PDT) Received: from mail-yw0-x235.google.com (mail-yw0-x235.google.com [IPv6:2607:f8b0:4002:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9680129440; Thu, 6 Oct 2016 19:40:14 -0700 (PDT) Received: by mail-yw0-x235.google.com with SMTP id t193so24545026ywc.2; Thu, 06 Oct 2016 19:40:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=xnXhzEmAjINFpztKZo63uimGPx9QQlL3hS3mDEdQzGU=; b=pKVoHfTgS7SLJSzB2m7c0g5F2WSAiW1Nx9QCnxVSFrn4fKLM/jCRybHamTkCYKDCqo zCdJPLkxN99ULienVakTcYKws+kN9I4nz5klMv6nTcQfDeUNXvDqzsTt1fV2+SUyTLPv KJsS3JtuolkyGBFHq2yMtG/D5K7eoPJcrbBhzs88nLAsr4DDyy8fapG4Tnc1ntl4ZZw1 52p0AjFPu7sX4rYGo3dEzGNLmuQuBkzl56d3kpsVmoRV7P9ApeN3+PuJQV8zyOvg+DEo V4/xUSRdqkQZy682fAV8Qm/2d75rphmffRz3TAuR8FDThWTDhG6iiNuaC8nX4kbyOFj3 2vFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=xnXhzEmAjINFpztKZo63uimGPx9QQlL3hS3mDEdQzGU=; b=MczV+LfW6wJeYetIgF/eiAlLEmBhfSl/KiK1DesjggC1ll0Qd3JeTXWZhmltT6cKUQ /klMFSkpzIZh6K85xeLPZa0PwPpr6lFMjCHHVEzIgQPZ3x92KmiMYq3M5BoQP4WrModU yEf/QK7FEaoTKO+72ycExY4Ii7mnHglSnD42MOUtT6FMT8X+8mAq6qayuDL9E2XmIyWI uu9kH+t4VDi7ug5VbU86D3IhcjRbo2GT1EHO8WIlzM12Y+91rIE9jkCTDmeca0U2BzG+ cYpmaaV5vwF0p/k8iuT/x9BfGi4t330wIGcpPSDKyK/n2y6gSBf5O29xWxsoOILgXwXF 80Pw== X-Gm-Message-State: AA6/9RnAr2DBk5pB+WWVfLLQMX6XgA+2inzgRpA8VQ+ltSXPoE/GCy3HaeIcF1Qm/A59ctvi8iS808cmRnQOrg== X-Received: by 10.129.99.2 with SMTP id x2mr13316993ywb.106.1475808014197; Thu, 06 Oct 2016 19:40:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.24.86 with HTTP; Thu, 6 Oct 2016 19:40:13 -0700 (PDT) In-Reply-To: <9b0692f895bc497f8f0aa2b63ed5be27@XCH-RCD-017.cisco.com> References: <147265807396.13320.16720268350417791956.idtracker@ietfa.amsl.com> <21b2559f2a234c64b47595eb4615c661@XCH-RCD-017.cisco.com> <932002F5-18BA-46E7-9C71-EC985A0FCFDC@fastmail.fm> <12ED9DC3-7950-4517-A005-2B29F5D08C09@fastmail.fm> <9b0692f895bc497f8f0aa2b63ed5be27@XCH-RCD-017.cisco.com> From: Spencer Dawkins at IETF Date: Thu, 6 Oct 2016 21:40:13 -0500 Message-ID: To: "Tirumaleswar Reddy (tireddy)" Content-Type: multipart/alternative; boundary=001a1141b8cc718b1e053e3d54d9 Archived-At: Cc: "tram-chairs@ietf.org" , "tram@ietf.org" , Alexey Melnikov , "draft-ietf-tram-turn-server-discovery@ietf.org" , Simon Perreault , The IESG Subject: Re: [tram] Alexey Melnikov's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 02:40:18 -0000 --001a1141b8cc718b1e053e3d54d9 Content-Type: text/plain; charset=UTF-8 Hi, Alexey, On Mon, Sep 5, 2016 at 9:05 PM, Tirumaleswar Reddy (tireddy) < tireddy@cisco.com> wrote: > > -----Original Message----- > > From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > > Sent: Friday, September 2, 2016 2:02 PM > > To: Tirumaleswar Reddy (tireddy) > > Cc: The IESG ; draft-ietf-tram-turn-server-di > scovery@ietf.org; > > Simon Perreault ; tram-chairs@ietf.org; > tram@ietf.org > > Subject: Re: Alexey Melnikov's Discuss on draft-ietf-tram-turn-server- > > discovery-09: (with DISCUSS) > > > > Hi, > > > > On 2 Sep 2016, at 04:02, Tirumaleswar Reddy (tireddy) > > > wrote: > > > > >> -----Original Message----- > > >> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > > >> Sent: Thursday, September 1, 2016 12:49 PM > > >> To: Tirumaleswar Reddy (tireddy) > > >> Cc: The IESG ; > > >> draft-ietf-tram-turn-server-discovery@ietf.org; > > >> Simon Perreault ; tram-chairs@ietf.org; > > >> tram@ietf.org > > >> Subject: Re: Alexey Melnikov's Discuss on > > >> draft-ietf-tram-turn-server- > > >> discovery-09: (with DISCUSS) > > >> > > >> Hi, > > >> > > >> On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy) > > >> > > >> wrote: > > >> > > >>>> -----Original Message----- > > >>>> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > > >>>> Sent: Wednesday, August 31, 2016 9:11 PM > > >>>> To: The IESG > > >>>> Cc: draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault > > >>>> ; tram-chairs@ietf.org; sperreault@jive.com; > > >>>> tram@ietf.org > > >>>> Subject: Alexey Melnikov's Discuss on > > >>>> draft-ietf-tram-turn-server-discovery- > > >>>> 09: (with DISCUSS) > > >>>> > > >>>> Alexey Melnikov has entered the following ballot position for > > >>>> draft-ietf-tram-turn-server-discovery-09: Discuss > > >>>> > > >>>> When responding, please keep the subject line intact and reply to > > >>>> all email addresses included in the To and CC lines. (Feel free to > > >>>> cut this introductory paragraph, however.) > > >>>> > > >>>> > > >>>> Please refer to > > >>>> https://www.ietf.org/iesg/statement/discuss-criteria.html > > >>>> for more information about IESG DISCUSS and COMMENT positions. > > >>>> > > >>>> > > >>>> The document, along with other ballot positions, can be found here: > > >>>> https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discov > > >>>> er > > >>>> y/ > > >>>> > > >>>> > > >>>> > > >>>> ------------------------------------------------------------------- > > >>>> -- > > >>>> - > > >>>> DISCUSS: > > >>>> ------------------------------------------------------------------- > > >>>> -- > > >>>> - > > >>>> > > >>>> In Section 9: > > >>>> > > >>>> o For certificate-based authentication, a pre-populated trust > anchor > > >>>> store [RFC6024] allows a TURN client to perform path validation > > >>>> for the server certificate obtained during the (D)TLS handshake. > > >>>> > > >>>> If the client used a domain name to discover the TURN server, > that > > >>>> domain name also provides a mechanism for validation of the TURN > > >>>> server. The client MUST use the rules and guidelines given in > > >>>> section 6 of [RFC6125] to validate the TURN server identity. > > >>>> > > >>>> I am glad that you are referencing RFC 6125, but unfortunately you > > >>>> don't provide enough details. Please add details as specified in > > >>>> Section 3 of RFC > > >>>> 6125 to your document. > > >>> > > >>> Sure, will add the following lines: > > >>> Certification authorities that issue TURN server certificates SHOULD > > >>> support > > >> the DNS-ID and SRV-ID identifier types. TURN service providers SHOULD > > >> include the DNS-ID and SRV-ID identifier types in certificate > requests. > > >> > > >> What about use of CN-IDs and URI-IDs? > > > > > > Yes, added. > > > > Just to clarify: you can pick which ones of the 4 types you want to use, > you can > > disallow some. You just have to be explicit. > > Okay. > > > > > > >> Wildcards ? > > > > > > I don't think wildcards are required. > > > > Please say so in the document. > > Sure, will update. > > -Tiru > It looks to me as if -10 should address your Discuss. Could you take a look and confirm that? Thanks! Spencer --001a1141b8cc718b1e053e3d54d9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi, Alexey,

On Mon, Sep 5, 2016 at 9:05 PM, Tirumaleswar Reddy (tireddy) <t= ireddy@cisco.com> wrote:
> -----Original Message-----
> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]
> Sent: Friday, Septe= mber 2, 2016 2:02 PM
> To: Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
> Cc: The IESG <ie= sg@ietf.org>; draft-ietf-tram-turn-server-discovery@ie= tf.org;
> Simon Perreault <sperreault@jive.com>; tram-chairs@ietf.org; tram@ietf.org
> Subject: Re: Alexey Melnikov's Discuss on draft-ietf-tram-turn-ser= ver-
> discovery-09: (with DISCUSS)
>
> Hi,
>
> On 2 Sep 2016, at 04:02, Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
> wrote:
>
> >> -----Original Message-----
> >> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]
> >> Sent: Thursday, September 1, 2016 12:49 PM
> >> To: Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
> >> Cc: The IESG <iesg@ietf.org>;
> >> draft-ietf-tram-turn-server-discovery@ietf.org<= /a>;
> >> Simon Perreault <sperreault@jive.com>; tram-chairs@ietf.org;
> >> tram@ietf.= org
> >> Subject: Re: Alexey Melnikov's Discuss on
> >> draft-ietf-tram-turn-server-
> >> discovery-09: (with DISCUSS)
> >>
> >> Hi,
> >>
> >> On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy)
> >> <ti= reddy@cisco.com>
> >> wrote:
> >>
> >>>> -----Original Message-----
> >>>> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]
> >>>> Sent: Wednesday, August 31, 2016 9:11 PM
> >>>> To: The IESG <iesg@ietf.org>
> >>>> Cc: draft-ietf-tram-turn-server-discove= ry@ietf.org; Simon Perreault
> >>>> <sperreault@jive.com>; tram-chairs@ietf.org; sperreault@jive.com;
> >>>> tr= am@ietf.org
> >>>> Subject: Alexey Melnikov's Discuss on
> >>>> draft-ietf-tram-turn-server-discovery-
> >>>> 09: (with DISCUSS)
> >>>>
> >>>> Alexey Melnikov has entered the following ballot posi= tion for
> >>>> draft-ietf-tram-turn-server-discovery-09: Discus= s
> >>>>
> >>>> When responding, please keep the subject line intact = and reply to
> >>>> all email addresses included in the To and CC lines. = (Feel free to
> >>>> cut this introductory paragraph, however.)
> >>>>
> >>>>
> >>>> Please refer to
> >>>> https://www.ietf.org/= iesg/statement/discuss-criteria.html
> >>>> for more information about IESG DISCUSS and COMMENT p= ositions.
> >>>>
> >>>>
> >>>> The document, along with other ballot positions, can = be found here:
> >>>> https://dat= atracker.ietf.org/doc/draft-ietf-tram-turn-server-discov
> >>>> er
> >>>> y/
> >>>>
> >>>>
> >>>>
> >>>> ------------------------------------------------= -------------------
> >>>> --
> >>>> -
> >>>> DISCUSS:
> >>>> ------------------------------------------------= -------------------
> >>>> --
> >>>> -
> >>>>
> >>>> In Section 9:
> >>>>
> >>>> o=C2=A0 For certificate-based authentication, a pre-p= opulated trust anchor
> >>>>=C2=A0 =C2=A0 =C2=A0store [RFC6024] allows a TURN clie= nt to perform path validation
> >>>>=C2=A0 =C2=A0 =C2=A0for the server certificate obtaine= d during the (D)TLS handshake.
> >>>>
> >>>>=C2=A0 =C2=A0 =C2=A0If the client used a domain name t= o discover the TURN server, that
> >>>>=C2=A0 =C2=A0 =C2=A0domain name also provides a mechan= ism for validation of the TURN
> >>>>=C2=A0 =C2=A0 =C2=A0server.=C2=A0 The client MUST use = the rules and guidelines given in
> >>>>=C2=A0 =C2=A0 =C2=A0section 6 of [RFC6125] to validate= the TURN server identity.
> >>>>
> >>>> I am glad that you are referencing RFC 6125, but unfo= rtunately you
> >>>> don't provide enough details. Please add details = as specified in
> >>>> Section 3 of RFC
> >>>> 6125 to your document.
> >>>
> >>> Sure, will add the following lines:
> >>> Certification authorities that issue TURN server certific= ates SHOULD
> >>> support
> >> the DNS-ID and SRV-ID identifier types. TURN service provider= s SHOULD
> >> include the DNS-ID and SRV-ID identifier types in certificate= requests.
> >>
> >> What about use of CN-IDs and URI-IDs?
> >
> > Yes, added.
>
> Just to clarify: you can pick which ones of the 4 types you want to us= e, you can
> disallow some. You just have to be explicit.

Okay.

> >
> >> Wildcards ?
> >
> > I don't think wildcards are required.
>
> Please say so in the document.

Sure, will update.

-Tiru

It looks to me as if -10 should a= ddress your Discuss. Could you take a look and confirm that?

=
Thanks!

Spencer=C2=A0
=
--001a1141b8cc718b1e053e3d54d9-- From nobody Thu Oct 6 20:22:42 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0F24129444; Thu, 6 Oct 2016 20:22:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dnhxFV8cZk2z; Thu, 6 Oct 2016 20:22:41 -0700 (PDT) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDB0B129415; Thu, 6 Oct 2016 20:22:40 -0700 (PDT) X-AuditID: c6180641-e73ff70000000a0b-f5-57f6c09a3662 Received: from EUSAAHC001.ericsson.se (Unknown_Domain [147.117.188.75]) by (Symantec Mail Security) with SMTP id E4.F9.02571.A90C6F75; Thu, 6 Oct 2016 23:22:35 +0200 (CEST) Received: from EUSAAMB107.ericsson.se ([147.117.188.124]) by EUSAAHC001.ericsson.se ([147.117.188.75]) with mapi id 14.03.0319.002; Thu, 6 Oct 2016 23:22:38 -0400 From: Suresh Krishnan To: Spencer Dawkins at IETF Thread-Topic: Suresh Krishnan's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) Thread-Index: AQHSBAfnnle9TS+moUifmMZPWr6O+Q== Date: Fri, 7 Oct 2016 03:22:38 +0000 Message-ID: References: <147270350795.31961.8306227467315681365.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.12] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmplkeLIzCtJLcpLzFFi42KZXLrHW3f2gW/hBj+vCll8WhdtMePPRGaL 7p1HGS2WTdnDbHH9SqjF8p8r2Sw+rL3A5sDuMeX3RlaPnbPusnssWfKTyePfnKfMASxRXDYp qTmZZalF+nYJXBlLNp9jKbjPVHFq+h62BsapTF2MHBwSAiYSx+7HdDFycQgJbGCUmPDtMSOE s4xR4vr8ByxdjJwcbEBFG3Z+ZgKxRQSsJbb0dbKBFDELbGSS6F/5kxEkISyQIjH55Ax2iKJU ibZ5ixkhbD2Jdw13wWwWARWJR82TGUE28wr4SvRs94RY9opJYsnjRrBljAJiEt9PrQFbxiwg LnHryXwwW0JAQGLJnvPMELaoxMvH/1ghbCWJOa+vMUPU60gs2P2JDcLWlli28DVYnFdAUOLk zCcsExhFZiEZOwtJyywkLbOQtCxgZFnFyFFaXJCTm25kuIkRGDnHJNgcdzDu7fU8xCjAwajE w7tA4Vu4EGtiWXFl7iFGCQ5mJRFeN6Hv4UK8KYmVValF+fFFpTmpxYcYpTlYlMR5r4fcDxcS SE8sSc1OTS1ILYLJMnFwSjUwln1fX7z2zr1TDWIPRXXvhi9KO771dVBOYM2J/UfjraezPeV3 ykjdXeJ6Zt4mvvaa0/17aoM3PW3r70jaGiD+qoAnfe3Z0m3ZkgbSnbU+pqJJCRIh/Z/cJqV0 339k4bT0hnZ6+ZcnuslfKj594/Wxczn5aoHwujaX6akGJnHG/IL1DfpNWo+VWIozEg21mIuK EwGikqfsmAIAAA== Archived-At: Cc: "Prashanth Patil \(praspati\)" , "tram-chairs@ietf.org" , "tram@ietf.org" , "draft-ietf-tram-turn-server-discovery@ietf.org" , Simon Perreault , The IESG Subject: Re: [tram] Suresh Krishnan's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 03:22:42 -0000 Hi Spencer,=0A= =0A= On 10/06/2016 09:48 PM, Spencer Dawkins at IETF wrote:=0A= > Could you take a look at -10 and see if it addresses all of your Discuss?= =0A= =0A= Yes. I did went through version -10 and it addressed all the issues in my = =0A= DISCUSS. I cleared this morning before the BoF call.=0A= =0A= Regards=0A= Suresh=0A= =0A= From nobody Fri Oct 7 00:13:49 2016 Return-Path: X-Original-To: tram@ietf.org Delivered-To: tram@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C1C4129515; Fri, 7 Oct 2016 00:13:47 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "Alexey Melnikov" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.34.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147582442759.8967.11481680716907661064.idtracker@ietfa.amsl.com> Date: Fri, 07 Oct 2016 00:13:47 -0700 Archived-At: Cc: sperreault@jive.com, draft-ietf-tram-turn-server-discovery@ietf.org, tram@ietf.org, tram-chairs@ietf.org Subject: [tram] Alexey Melnikov's No Objection on draft-ietf-tram-turn-server-discovery-10: (with COMMENT) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 07:13:47 -0000 Alexey Melnikov has entered the following ballot position for draft-ietf-tram-turn-server-discovery-10: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discovery/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thank you for addressing my DISCUSS. From nobody Fri Oct 7 06:15:56 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 405F6129599; Fri, 7 Oct 2016 06:15:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uLVFuLn9s9cl; Fri, 7 Oct 2016 06:15:49 -0700 (PDT) Received: from mail-yb0-x22c.google.com (mail-yb0-x22c.google.com [IPv6:2607:f8b0:4002:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC43C1279EB; Fri, 7 Oct 2016 06:15:48 -0700 (PDT) Received: by mail-yb0-x22c.google.com with SMTP id 184so16001203yby.2; Fri, 07 Oct 2016 06:15:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=6zO3o8AtT07n+sMOJpexb4nHVsFTlpKxZfBkESNg4E4=; b=jPLNzbcX0Z6Ye7Tmcudk67/uhn6EMXzBGjiQM26KAEyABIBRxvklapOgB6nabq1qTN +yCS/hXLhuWmSvb2790uiBJGQ93E1iVHs7C6s4EAtb6eIwzyHrSb5I48G8MS5rnKgDcK a/alAEPO/uyfZhLJ/kSZqyRXZXLYUxQ2q7SsXQCWCC4PZkTT4iE36saij1poJPWDbd0Y HBwYApzb8muMwDKvs6sRwgqmW5srBi13y7ZEqkSa00JPXP64tpp1wNo6L2NliMVQIUzN Re4x39ijGv64zdNLy+mWRVV2VuA213zedhuXqgnYDboXYKmIeDso5mgWNvUOP4ofd0f/ uTiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=6zO3o8AtT07n+sMOJpexb4nHVsFTlpKxZfBkESNg4E4=; b=EeGbU93xWXYnx5Wt/CXo1I8hjP3uGamrt1klkWrQHjIuKy1MqtoraxBTAmgtyKdGz8 N/pHP3PJdlkDbJBMWe28b+FMvxz6vzjoxvi/nSvKxunMGwltLaF6Pi8yUg6cEattHVHR EuuXLUh/QK/TyIgKke0zHVNaLQC3xWtOPPHfG1VGEpQ41S41rkNmUY+91UzXkLSgIpxy 99u2Bs/FItL/l93woB95P/GXFNsa6DvNhIgaJSs0Jtja24Vepu6O9VpCBluxsvHqkqtN 4mf7d/Ie8KhTkfpPBAXoz+WYW2Q1I55WFQswzWTcy8yDxB3N2DABsTXc9FBwi0NYoMDS tq3w== X-Gm-Message-State: AA6/9RlEjtX1PxqvjTVDP5UCbSUScOQVQ2EFWbVo9sUe93t1hbojn68wDa/GL/bmjeysu006TYkABjk3rMnnTg== X-Received: by 10.37.70.196 with SMTP id t187mr15335147yba.121.1475846147994; Fri, 07 Oct 2016 06:15:47 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.24.86 with HTTP; Fri, 7 Oct 2016 06:15:47 -0700 (PDT) In-Reply-To: References: <147270350795.31961.8306227467315681365.idtracker@ietfa.amsl.com> From: Spencer Dawkins at IETF Date: Fri, 7 Oct 2016 08:15:47 -0500 Message-ID: To: Suresh Krishnan Content-Type: multipart/alternative; boundary=001a113f453c64fd1e053e4635a9 Archived-At: Cc: "Prashanth Patil \(praspati\)" , "tram-chairs@ietf.org" , "tram@ietf.org" , "draft-ietf-tram-turn-server-discovery@ietf.org" , Simon Perreault , The IESG Subject: Re: [tram] Suresh Krishnan's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 13:15:50 -0000 --001a113f453c64fd1e053e4635a9 Content-Type: text/plain; charset=UTF-8 Hi, Suresh, On Thu, Oct 6, 2016 at 10:22 PM, Suresh Krishnan < suresh.krishnan@ericsson.com> wrote: > Hi Spencer, > > On 10/06/2016 09:48 PM, Spencer Dawkins at IETF wrote: > > Could you take a look at -10 and see if it addresses all of your Discuss? > > Yes. I did went through version -10 and it addressed all the issues in my > DISCUSS. I cleared this morning before the BoF call. Thank you! Spencer --001a113f453c64fd1e053e4635a9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi, Suresh,

On Thu, Oct 6, 2016 at 10:22 PM, Suresh Krishnan <su= resh.krishnan@ericsson.com> wrote:
Hi Spencer,

On 10/06/2016 09:48 PM, Spencer Dawkins at IETF wrote:
> Could you take a look at -10 and see if it addresses all of your Discu= ss?

Yes. I did went through version -10 and it addressed all the issues = in my
DISCUSS. I cleared this morning before the BoF call.

<= /div>
Thank you!

Spencer=C2=A0
--001a113f453c64fd1e053e4635a9-- From nobody Fri Oct 7 06:59:03 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C74B1295FA; Fri, 7 Oct 2016 06:59:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.902 X-Spam-Level: X-Spam-Status: No, score=-0.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_MULTIPLE_AT=1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ingate.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id baNBoB7O2rCN; Fri, 7 Oct 2016 06:58:59 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0075.outbound.protection.outlook.com [104.47.1.75]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FD921295EB; Fri, 7 Oct 2016 06:58:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ingate.onmicrosoft.com; s=selector1-ingate-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=xxO/Ep9b4MWgCvll4S3Z656X2jRebWQrZXyaNt8deI8=; b=aHzhSYCfaHVj0wnJB9X2E8O6XIDfSmeMvb++cN9RbPQY92R9JmHtk/eZDCdZHcW8fPJ+VaNiqdOaUO8BcP/MwxRyRlDzDGz1PE3eVFuqVj4egCE6p2X/xTQHgREgIoguST1qsPBY45E4OEgyKU1YdbD6jKgNyIWvP914cYsJqZI= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=karl@ingate.com; Received: from Kallei7 (90.227.80.227) by HE1PR01MB1834.eurprd01.prod.exchangelabs.com (10.165.228.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.649.16; Fri, 7 Oct 2016 13:58:53 +0000 From: Karl Stahl To: 'Spencer Dawkins at IETF' , "'Tirumaleswar Reddy (tireddy)'" References: <147265807396.13320.16720268350417791956.idtracker@ietfa.amsl.com> <21b2559f2a234c64b47595eb4615c661@XCH-RCD-017.cisco.com> <932002F5-18BA-46E7-9C71-EC985A0FCFDC@fastmail.fm> <12ED9DC3-7950-4517-A005-2B29F5D08C09@fastmail.fm> <9b0692f895bc497f8f0aa2b63ed5be27@XCH-RCD-017.cisco.com> In-Reply-To: Date: Fri, 7 Oct 2016 15:58:44 +0200 Message-ID: <05aa01d220a2$ee812ec0$cb838c40$@stahl@ingate.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_05AB_01D220B3.B209FEC0" X-Priority: 1 (Highest) X-MSMail-Priority: High X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AdIgRCgcWDNdnLuISReJejZqndrE5gAQQbJA Content-Language: sv Importance: High X-Originating-IP: [90.227.80.227] X-ClientProxiedBy: DB5PR06CA0040.eurprd06.prod.outlook.com (10.162.165.50) To HE1PR01MB1834.eurprd01.prod.exchangelabs.com (10.165.228.24) X-MS-Office365-Filtering-Correlation-Id: ed65de60-053d-4f0f-9eda-08d3eeba1346 X-Microsoft-Exchange-Diagnostics: 1; HE1PR01MB1834; 2:jYNduOIL+sI8+5gZtTmH05pYZSTtKdWsCLOmFInGtGCb8spRaNzazA/+C4DznLgIpomJnZH+TN1PD3yzCgO8dAr0MplVm5ca2PagS6H/gXfYAfIiFgeU9nKtwbJhFLIHOliHyv2Urzs6smDMiF8Qf7a0BdGiUFrIqNeuvagti/P02Hb47HvihFJ2qKe9R5zSI15kzLgCE+1c3eqHyWcQSA==; 3:hiWUJWAc2lKUdfTS09v+5Zryt17vm5z2Qa/pDlKg7tzePa+bzsl5krPLw9s7FVaO3f+Rkfm8Md7NKaCYTlF7Dh2AH5XNDhhB75Yu8WM8n2Wua1/81DyePRl+pTqc5Yu+DI4dA+5jhytNlG8WUJAD+A== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HE1PR01MB1834; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; HE1PR01MB1834; 25:Z5k8sBA1rOKCxjmS3NFCidSDj6lXV8sBwK0aN1YCv?= =?us-ascii?Q?qEVtQT9r7iXvHNiEOlljvMWnMoDJYc2ItRhFtDmSsWO5EXVtfyVTTRCxi5Ck?= =?us-ascii?Q?8nLY2Vtd8tAX43jE3AgwvLAAFfak+McPqoWSoTXNxBIQjCEwuImZcAcZA2fR?= =?us-ascii?Q?LVma5HEUMFrmgj4VkOoqDehBM8ja1lfyjn1sU7msWvkL+BipqvS70pNl1sx0?= =?us-ascii?Q?vcV5lh27rU/FGapJf2ICxxbDimnKGqFWzLw8JESMh4VucUSH29OLMLXwAuYC?= =?us-ascii?Q?5dZM1MD3kftxPDhx8TiKOvBiH+DIWHFJZnTO67t0BA3kNWcdAIWsov6Ljzcg?= =?us-ascii?Q?geT1QpBieptQgUm2IUiKT5rtTUEbOKIInh2R/Hskmd/ed1VDrDsHXpmyuHZa?= =?us-ascii?Q?3vdJ/uxUZdscrVc4QuDeLphfdysXXCufVpHEBVAHvvaCKhzeBBHUEPTg9Shr?= =?us-ascii?Q?IDBt2X/LF2wAZzOotb3U1HcApl7Pq283hTdbqWd5oUXa8mgbwf7Cot3ua9V1?= =?us-ascii?Q?RktWsZN0RVLGYjJwDuUtn09HaLqSBzgDN2Z92bWvY9KnAeUha7I/F95nQi61?= =?us-ascii?Q?EbNvGVsnMM4/nXDuhUjgVoPt8C7+OchG615aYILq9NBdLiNNay/ITyhw3Isw?= =?us-ascii?Q?kBuXIQ45glZkEs6qcF6ZOhjlh5Afdkh4hxL4YPOfkiMu0tl4Eq+UD60CtaJz?= =?us-ascii?Q?Rbh1/ISzgwBjAmsc38N0jBpTXy4koCpx/3+/IgbKmIPqrwHxVL0/hCh3rZWC?= =?us-ascii?Q?q1VLS2lyfVDv9GPtxAomoMaIaGNCDueooGlFPssX0TUjig0ImnT2ynZxTEmM?= =?us-ascii?Q?BDNG9YosKh2NGMxiCRowItn0UbBQCZc5s3gSTFPTxNzy8T63xQKV0E64U9z0?= =?us-ascii?Q?pGuntAScHXCjLtXovKqKsUO722TOOvyhYsuR5+OtwlcDl8X95ydg4zbhC5yG?= =?us-ascii?Q?UAn0n6712hvFUIM6Q+T+B7NFWIV0S2o/KqI6r9z76BPeBst1nONq+a8600Ve?= =?us-ascii?Q?kwmq5pUieTbfeAf4tK5w6SYl8TxnC4dmrGgrMStu4duMA=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; HE1PR01MB1834; 31:z0DdYW3gJxoXy8Q0+Ufld8sw8JgElJMGSIVsTSRLbq0+ryNKmDucHA36ZOvROaCFDl/67TzxlvpdMDl2HKcOiEK+P8OcNcRgNi98oIAgYyVmnbIJ0ZtJfWmJ7u2+6AF1UjcvoenVCey6tTeAK5eqkeW66czrYKi4cV4l2ouc/ihtoYRboS2CHDuJ6htKDYyysabkrwXNRi4vxbmOGM+Q+ya+avJKP2jmH81G3/TgHlEYXacsUzOioEWo3WLHpMQK+feJtWGgKCBfQX1JKRko/A==; 4:nNTfehYtnZtSHgmJoyUBFLcHO3CcRb8XVXJTtzZy7yl/6WpWmOHG7hKUr26dIz4hMjBn/dbJER3ac7vLRQmyid23sXzU6GP2I4vzH+PO3KBGKW4WmJPxFjihZxq6U6VJY5WDHLdQ/nH3le1oudKP6TQM5Ph4nKl9SFt+BYc9BCfQgWB9YSwx/UKRGsgmd6yn91WZkcacJwMOZ3bF6L8AD5UyEdwJmg4VDc1hEvmUj7KVhg13QdAze3wIar2U1ELZgRnhPz55JYOPEdPFCiFTkYKPWNIgGAOWiTJzKmUNMCtBok5urwJ7UKfP3w2YrdJgJHRo16EzKxij0HpH0K75r2wDvXAxeuydeT22drq/51NjnQ/9JO7TNYLzTgM2Wc3a6n82DI+Z4gd4wA0F7CcuDyzBblksCSrou8vYzpSo6r/lVqCf5NILJnUhCwupx6V57IOKW086RF6UylW5tis0me41y26IrnHDo6sqjEp9P0XmS4ZUhNZSGoX9b3JmSl4dJiKYhrlLWIsAJJwMn8jxGdsMLvglFLoxF3EgWzeGsUhJx1AdQiMbNyGdRJzQia8XBfAFtlpXOqK9dyPJuY7DxnhbAHvIkHPxdZ1ucfPWueRSnlrLGgzbGz6KWqLskziA X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(120809045254105)(192374486261705)(95692535739014)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6043046)(6042046); SRVR:HE1PR01MB1834; BCL:0; PCL:0; RULEID:; SRVR:HE1PR01MB1834; X-Forefront-PRVS: 0088C92887 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(7916002)(13464003)(24454002)(189002)(199003)(377454003)(4326007)(19617315012)(8676002)(189998001)(36756003)(18717965001)(2950100002)(33646002)(81166006)(81156014)(6666003)(9686002)(84326002)(1420700001)(50226002)(6116002)(15975445007)(68736007)(102836003)(71636004)(586003)(5660300001)(77096005)(14726001)(3846002)(84116002)(790700001)(8666005)(61296003)(7846002)(42186005)(7826002)(230783001)(7736002)(229853001)(16236675004)(106356001)(76176999)(7906003)(512874002)(81686999)(93886004)(105586002)(96836002)(50986999)(101416001)(5001770100001)(19580405001)(19580395003)(551544002)(2906002)(92566002)(97736004)(66066001)(19625215002)(19300405004)(7059030); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR01MB1834; H:Kallei7; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: ingate.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; HE1PR01MB1834; 23:coao1vBEHYHQj8RpV3pQZS5A+cmXu12fcfAugAZG3?= =?us-ascii?Q?d/aeF/lH6X3dasp+oywlTZqAsajRV+j4GZdDKzh5h9en62pBG84QwEcQCyWc?= =?us-ascii?Q?Z94p8nrqdNH/kz5+1ywP8POg63jo9PwZ/03rGfVDQ+XQc9TwboA4rqmjR3eu?= =?us-ascii?Q?hejC5F9CbeAl+EAMAXZeFjjbFtkUzSTc735ZIQ6qHknHcf1onW/KcAATDYD4?= =?us-ascii?Q?ySlW07UY0YM4OrBxhR988OCfptwprUXPMVBIktltnZ4baYyv/7F8xOvNjsD+?= =?us-ascii?Q?8UbJa9YFzbGhNLl+ZMNeHqQhzZWygT/3kFfDlFvyOfRWTMkWJmeMl97dBz1J?= =?us-ascii?Q?tzERlWrm8hhEeebczEGPTKGgvaMLxvbVmmhX2A+xBvBhIz55/M6Dlc3faXGZ?= =?us-ascii?Q?gNr7308eTl4K+dLdVTxyjlodnPS3tuFpbCfa57vOYdnRBVzbPGsTrRUWnoQO?= =?us-ascii?Q?31VdEyhI09LtZ///yyA0eboSCuHS+dEwRaHPPjhHfGvBvuSerFHhu4h+wemU?= =?us-ascii?Q?HYilVdkAlEDqohTeJjcWGlZs10JupIZhUbLluzr6Np8jtCyXkGTzfgaojmZ2?= =?us-ascii?Q?fPxnSZow4MiFkwPEwtYbOe5JBtmW++qkhcmaUA2HDDiEAFh2rxL2SLYn00Ov?= =?us-ascii?Q?kBLKMJjP5pmJ5bZg2CrZwu4RIydLHYB5u1ducsZro9y3KdThi9XHxuQ+/QRw?= =?us-ascii?Q?vR8c0bksT7/tBAQGtW/oDhMtp1EDuiNUSApZQCU9XLj+AB+x1Qahrl+hGPSp?= =?us-ascii?Q?EFkJOiq+evfLFj45vR+Nah4EPD86eOXehIQsDp/YW2ORSttB+9tR0vKQrU/1?= =?us-ascii?Q?+A55lD/hOkdYT0SRgw39H04akCDSDwThfX4dpQzo5vKGx1kz/UrPhjEiXoOM?= =?us-ascii?Q?f0QaOXsY7+rmJga+TEV+AxC2FLRu+Y48/C4wbkn230p+c77zivbUCWPqULy4?= =?us-ascii?Q?qEuGkJZ3F3iOpmvedp18QtR8OjjiQmbpHyyYHkRGgVaycxMPUCdGiXnemBvB?= =?us-ascii?Q?QXQF4zHY/wYKLCoA/O/lJJbEKDymdB7+CSYKEQnIDIIncal6apjkf85NK1Fu?= =?us-ascii?Q?ol282bciFg8ZI+wGGz55LmYm+fK7Ez1sKKfMPL/1aljrPt3NhLEoXb5fQGUt?= =?us-ascii?Q?zrbSaIXlfEIHbgLqLBTgX5REj+J8Y6EaeEcLdivWbInR2QKO3392LZcrtHrS?= =?us-ascii?Q?JiEzQ2c5dwJWPdcZ4j5qUDUMMWo9lTQ3bc9liqOQenmgyb9vEUyUy6DfhHgl?= =?us-ascii?Q?Gp39glF8hFbOQXwsAV/DSG9YnUVdOqWh8nrYtHyU3YjsFG2Mv5AENabTwsTx?= =?us-ascii?Q?OOSFWhY+JZc5c5I2YS/veNUhWFIHf5JL1IRNBwKv5hVQ9aVhNp4xVlzcHnCr?= =?us-ascii?Q?wxdpzgf7K2VHOf0AnLQ8FBQxUXhxNGT7Dz8FUrCMpv0t77cztAmuOMxw8Qoy?= =?us-ascii?Q?ovm0uHBbVz6MbVHh+sUF68vxxu6khJM71p/lI0qgC4l28JhKml31SdNfYlP+?= =?us-ascii?Q?XjwjNKmvCne2zPKtwaSpAfKQ6m38EKx2sISTGIULTY6qt0ZKT2ov01t?= X-Microsoft-Exchange-Diagnostics: 1; HE1PR01MB1834; 6:Q3z8jKp85ELzHRtobm/v5HOla+QvKErcpyZ64O/aF3NA58/BJRRwTQlyZTCktHRJSHI+bK5z3a4HBa991FXQwnlkn615RWJORLMUYqTkVgCX3lT3JcDjJkgki3u0nEJAAIO8cdKamiAoKZlKzCUll0mRdh0zlBbLn20sA2mt82IRRn7mNkadtwVLxZM3PEi8f0GHhexyuXn8t4bxTHRx1zezp7pNwnicS6haek7gi44dulfcR9z83H/aej8O2f8lE6C444T8j7CqM0yf9Bl+Str6Yc5kQeFEvnnX3NxQJ8kN1o8JTrC36/uXesS5w91l58lvdDDmZTuyil0CfyzCcw==; 5:jkS31Ew0OZN1pKcwAMVswd9uGz3nKVdvunnDkLJNnwQBr4X2CfBiMODd/vUGcyohpvW+nJ/2/KzNgea2Ajiy9DfSk5e0TyO2Us6+i5317zXUF7ES96iol16+qlKJ011+XM9krI926/QqRqVLEJFmors9EPwC3qJzY1lwiBxcfwY=; 24:dN79KQJaJWuhRnkVPxBSFwj82vgrKTczwRRshY+Ii8yfmSmvSsZGUeYzrZcT2oCHSk5D3h17/kFEaqPUcEE/LQg4cCi5Gg55f6IuIq9mYyY= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; HE1PR01MB1834; 7:JjqzN3G2g7+6NB3W62i2n+gqW82CyC7r+l4Lq7czV9SpHGmAaLPJLEdCmkMbf37s9lCmGXaoyNXmr6rvey+InUyU1C+k7EvzsOjpYegLZIdNa7FnveE8EPKahwNkYXM1YH+K2nS2hKlLpgSceZhOZGT70+9YJk22ymT208B6EjY20MOfomBIR7/HOcORD9Aeahz/Znhmao/q/eg0PlCR0UygVeUpxPZo6FwAi5qAx/ZXh6nwtfl0DeK9kP+f+xsCUzaIBxqNSDENRooeDwOyOI+fGJVtFA+NEmjbxycdfEZWoXzin75s7Yy6sIBWJBU7s7yqgwD5Z6FYVI/E/7EmSQ== X-OriginatorOrg: ingate.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Oct 2016 13:58:53.2935 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR01MB1834 Archived-At: Cc: tram-chairs@ietf.org, tram@ietf.org, 'Alexey Melnikov' , draft-ietf-tram-turn-server-discovery@ietf.org, 'Simon Perreault' , 'The IESG' Subject: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 13:59:02 -0000 ------=_NextPart_000_05AB_01D220B3.B209FEC0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Two things in this draft -10 needs to fixed! =20 1) As pointed out during the DISCUSS=20 https://www.ietf.org/mail-archive/web/tram/current/msg02144.html=20 and two times earlier (during WG discussions, but not addressed or = responded to by the authors): = https://www.ietf.org/mail-archive/web/tram/current/msg02081.html and=20 https://www.ietf.org/mail-archive/web/tram/current/msg01976.html=20 =20 The Anycast method does not work with RFC5766 TURN servers! That has not been addressed at all. =20 A TURN server doesn't react one way (answering 300 Try Alternate) when addressed by an anycast address and another way (accepting the Allocate request) when addressed by its unicast address, does it?=20 =20 I suggested this modification: =20 "When a client requires TURN services, it sends a STUN binding request = to the assigned anycast address. The STUN server responds with a 300 (Try Alternate) error as described in [RFC5389]; = The response contains a unicast address in the ALTERNATE-SERVER attribute, = which the client compares with the source address of the response and if the addresses are the same, it is an indication to use the TURN server at = that address.=20 =20 For subsequent communication with the TURN server, the client uses that responding server's unicast address." =20 This proposed change has important advantages for security and = usefulness for draft-ietf-rtcweb-return-01 also.=E2=80=9D =20 With the current text for the anycast method (and we do need an anycast = method since it is the only method proposed that can be easily deployed = and on any network), would the consequence not be that it has to be = spelled out that *RFC5766 is updated* so that TURN servers to be = provided by the network and discovered MUST respond with =E2=80=9C300 = Try Alternate=E2=80=9D for an allocate request when addressed by the = anycast address, (but NOT if addressed by its unicast addressed)? =20 =20 2) The introduction in this draft -10 of =E2=80=9CI think we can = mandate (D)TLS *if* STUN authentication or third-party authorization is = not used=E2=80=9D=20 during the DISCUSS, was protested against (but has still been = introduced). I said: =20 [Karl] We cannot mandate a higher security or trust level for a TURN = server provided by the network, paralleling the firewall/access = router/default gateway, when the client want to place its real-time = traffic through the turn server path, than through the default gateway = path. =20 And, shall this *discovery* specification really mandate *usage*? I am e.g. thinking about the WebRTC browser use case of = draft-ietf-rtcweb-return-01. It must be up to that RETURN draft to = define the *usage*, not up to a discovery draft. =20 The use cases I have in mind (and I don't see that TURN D(TLS) can fit) = are: The "autoconfiguration" of RFC 7478 (Web Real-Time Communication Use Cases and Requirements) 2.3.5.1. or more generally: =E2=80=9CYou need be able to use WebRTC everywhere you can surf and for = firewall traversal and quality, you need to parallel the local = firewall/access router/default gateway with a TURN server=E2=80=9D =20 This must work generally (for all services) on a LAN, Internet Caf=C3=A9 = or GoGo WiFi, where the network provider offers us a better path for = real-time traffic (through the TURN server). =20 It seem like it is forgotten that a protocol like WebRTC (which really = needs this specification to finally deal with the old NAT/Firewall = traversal problem that has been plaguing the real-time communication = over the Internet for 15 years now), provides security and trust in = itself for the media exchanged between endpoints =E2=80=93 It does not = have to be added by the TURN server. And specifically, for the network = provided TURN server, where the purpose of the TURN server is to offer a = better working path for the real-time media than through the default = gateway (where media otherwise has to pass) =E2=80=93 you cannot/must = not expect that it also gives you some higher trust or security level = that when it goes through the default gateway.=20 =20 Also remember that DISCOVERY, in itself is about making a service = available to a client without the client having to be specifically = configured for it =E2=80=93 and we cannot then specify that it should do = some authentication or validation based on password or certificate = checking that has to be configured somehow. =20 Such idea blocks the very purpose of this draft, and has been discussed = in various forms several times during the WG draft and can therefore = *not be introduced now*. Again, it seems like the main use case for this = draft - to be able to use good WebRTC communication wherever you can = surf =E2=80=93 is forgotten.=20 =20 I suggest everything related to =E2=80=9CA TURN client MUST use (D)TLS = in the absence of STUN long-term credential mechanism=E2=80=9D under 9. Security Considerations is = deleted. If we really want anything of this in this specification, a compromise = could be this change: =20 A TURN client NOT using encryption of the media stream that passes = through the TURN server (WebRTC even mandates DTLS-SRPT) may=20 use (D)TLS in the absence of STUN long-term credential mechanism =20 /Karl =20 =20 Fr=C3=A5n: tram [mailto:tram-bounces@ietf.org] F=C3=B6r Spencer Dawkins = at IETF Skickat: den 7 oktober 2016 04:40 Till: Tirumaleswar Reddy (tireddy) Kopia: tram-chairs@ietf.org; tram@ietf.org; Alexey Melnikov; = draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault; The = IESG =C3=84mne: Re: [tram] Alexey Melnikov's Discuss on = draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) =20 Hi, Alexey, =20 On Mon, Sep 5, 2016 at 9:05 PM, Tirumaleswar Reddy (tireddy) = wrote: > -----Original Message----- > From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > Sent: Friday, September 2, 2016 2:02 PM > To: Tirumaleswar Reddy (tireddy) > Cc: The IESG ; = draft-ietf-tram-turn-server-discovery@ietf.org; > Simon Perreault ; tram-chairs@ietf.org; = tram@ietf.org > Subject: Re: Alexey Melnikov's Discuss on draft-ietf-tram-turn-server- > discovery-09: (with DISCUSS) > > Hi, > > On 2 Sep 2016, at 04:02, Tirumaleswar Reddy (tireddy) = > wrote: > > >> -----Original Message----- > >> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > >> Sent: Thursday, September 1, 2016 12:49 PM > >> To: Tirumaleswar Reddy (tireddy) > >> Cc: The IESG ; > >> draft-ietf-tram-turn-server-discovery@ietf.org; > >> Simon Perreault ; tram-chairs@ietf.org; > >> tram@ietf.org > >> Subject: Re: Alexey Melnikov's Discuss on > >> draft-ietf-tram-turn-server- > >> discovery-09: (with DISCUSS) > >> > >> Hi, > >> > >> On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy) > >> > >> wrote: > >> > >>>> -----Original Message----- > >>>> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > >>>> Sent: Wednesday, August 31, 2016 9:11 PM > >>>> To: The IESG > >>>> Cc: draft-ietf-tram-turn-server-discovery@ietf.org; Simon = Perreault > >>>> ; tram-chairs@ietf.org; sperreault@jive.com; > >>>> tram@ietf.org > >>>> Subject: Alexey Melnikov's Discuss on > >>>> draft-ietf-tram-turn-server-discovery- > >>>> 09: (with DISCUSS) > >>>> > >>>> Alexey Melnikov has entered the following ballot position for > >>>> draft-ietf-tram-turn-server-discovery-09: Discuss > >>>> > >>>> When responding, please keep the subject line intact and reply to > >>>> all email addresses included in the To and CC lines. (Feel free = to > >>>> cut this introductory paragraph, however.) > >>>> > >>>> > >>>> Please refer to > >>>> https://www.ietf.org/iesg/statement/discuss-criteria.html > >>>> for more information about IESG DISCUSS and COMMENT positions. > >>>> > >>>> > >>>> The document, along with other ballot positions, can be found = here: > >>>> = https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discov > >>>> er > >>>> y/ > >>>> > >>>> > >>>> > >>>> = ------------------------------------------------------------------- > >>>> -- > >>>> - > >>>> DISCUSS: > >>>> = ------------------------------------------------------------------- > >>>> -- > >>>> - > >>>> > >>>> In Section 9: > >>>> > >>>> o For certificate-based authentication, a pre-populated trust = anchor > >>>> store [RFC6024] allows a TURN client to perform path = validation > >>>> for the server certificate obtained during the (D)TLS = handshake. > >>>> > >>>> If the client used a domain name to discover the TURN server, = that > >>>> domain name also provides a mechanism for validation of the = TURN > >>>> server. The client MUST use the rules and guidelines given = in > >>>> section 6 of [RFC6125] to validate the TURN server identity. > >>>> > >>>> I am glad that you are referencing RFC 6125, but unfortunately = you > >>>> don't provide enough details. Please add details as specified in > >>>> Section 3 of RFC > >>>> 6125 to your document. > >>> > >>> Sure, will add the following lines: > >>> Certification authorities that issue TURN server certificates = SHOULD > >>> support > >> the DNS-ID and SRV-ID identifier types. TURN service providers = SHOULD > >> include the DNS-ID and SRV-ID identifier types in certificate = requests. > >> > >> What about use of CN-IDs and URI-IDs? > > > > Yes, added. > > Just to clarify: you can pick which ones of the 4 types you want to = use, you can > disallow some. You just have to be explicit. Okay. > > > >> Wildcards ? > > > > I don't think wildcards are required. > > Please say so in the document. Sure, will update. -Tiru =20 It looks to me as if -10 should address your Discuss. Could you take a = look and confirm that? =20 Thanks! =20 Spencer=20 ------=_NextPart_000_05AB_01D220B3.B209FEC0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Tw= o things in this draft -10 needs to fixed!

 

1)= As pointed out during the DISCUSS

https://www.ietf.org/mail-archive/web/tram/current/msg02144.html =

an= d two times earlier (during WG discussions, but not addressed or = responded to by the authors):

https://www.ietf.org/mail-archive/web/tram/current/msg02081.= html and

https://www.ietf.org/mail-archive/web/tram/current/msg01976.html =

 

The Anycast method does not work with RFC5766 TURN servers! = That has not

been addressed at all.

 

A TURN server doesn't react one = way (answering 300 Try Alternate) when

addressed by an anycast address = and another way (accepting the Allocate

request) when addressed by its = unicast address, does it?

 

I suggested this = modification:

 

"When a client requires TURN services, it sends a STUN = binding request to

the assigned anycast address.=C2=A0 The STUN = server

responds with a 300 (Try Alternate) error as described in = [RFC5389];=C2=A0 The

response contains a unicast address in the ALTERNATE-SERVER = attribute, which

the client compares with the source address of the response = and if the

addresses are the same, it is an indication to use the TURN = server at that

address.

 

For subsequent communication = with the TURN server, the client uses that

responding server's unicast = address."

 

This proposed change has important advantages for security = and usefulness

for draft-ietf-rtcweb-return-01 = also.=E2=80=9D

 

Wi= th the current text for the anycast method (and we do need an anycast = method since it is the only method proposed that can be easily deployed = and on any network), would the consequence not be that it has to be = spelled out that *RFC5766 is updated* so that TURN servers to be = provided by the network and discovered MUST respond with = =E2=80=9C300 Try = Alternate=E2=80=9D = for an allocate request when addressed by the anycast address, (but NOT = if addressed by its unicast addressed)?

 

 

2)= The =C2=A0introduction in this draft -10 of =E2=80=9CI think we can mandate (D)TLS *if* STUN authentication or = third-party authorization is not used=E2=80=9D

du= ring the DISCUSS, was protested against (but has still been introduced). = I said:

 

[Karl] We cannot mandate a higher security or trust level = for a TURN server provided by the network, paralleling the = firewall/access router/default gateway, when the client want to place = its real-time traffic through the turn server path, than through the = default gateway path.

 

And, shall this *discovery* specification really mandate = *usage*?

I am e.g. thinking about the WebRTC browser use case of = draft-ietf-rtcweb-return-01. It must be up to that RETURN draft to = define the *usage*, not up to a discovery draft.

 

The use cases I have in mind = (and I don't see that TURN D(TLS) can fit) are:

The = "autoconfiguration" of RFC 7478 (Web Real-Time Communication = Use

Cases and Requirements) 2.3.5.1. or more = generally:

=E2=80=9CYou need be able to use WebRTC everywhere you can = surf and for firewall traversal and quality, you need to parallel the = local firewall/access router/default gateway with a TURN = server=E2=80=9D

 

This must work generally (for all services) on a LAN, = Internet Caf=C3=A9 or GoGo WiFi, where the network provider offers us a = better path for real-time traffic (through the TURN = server).

 

It= seem like it is forgotten that a protocol like WebRTC (which really = needs this specification to finally deal with the old NAT/Firewall = traversal problem that has been plaguing the real-time communication = over the Internet for 15 years now), provides security and trust in = itself for the media exchanged between endpoints =E2=80=93 It does not = have to be added by the TURN server. And specifically, for the network = provided TURN server, where the purpose of the TURN server is to offer a = better working path for the real-time media than through the default = gateway (where media otherwise has to pass) =E2=80=93 you cannot/must = not expect that it also gives you some higher trust or security level = that when it goes through the default gateway.

 

Al= so remember that DISCOVERY, in itself is about making =C2=A0a service = available to a client without the client having to be specifically = configured for it =E2=80=93 and we cannot then specify that it should do = some authentication or validation based on password or certificate = checking that has to be configured somehow.

 

Su= ch idea blocks the very purpose of this draft, and has been discussed in = various forms several times during the WG draft and can therefore *not = be introduced now*. Again, it seems like the main use case for this = draft - to be able to use good WebRTC communication wherever you can = surf =E2=80=93 is forgotten.

 

I = suggest everything related to =E2=80=9CA TURN client MUST use (D)TLS in the = absence of STUN long-term

=C2=A0=C2=A0 = credential mechanism=E2= =80=9D under 9. Security Considerations is = deleted.

=

If= we really want anything of this in this specification, a compromise = could be this change:

 

=C2=A0=C2=A0 A TURN = client = =C2=A0NOT using encryption of the media stream that passes through the = TURN server (WebRTC even mandates DTLS-SRPT) may =

=C2=A0use (D)TLS in the absence of = STUN long-term credential mechanism

 

/K= arl

 

 

Fr=C3=A5n: tram = [mailto:tram-bounces@ietf.org] F=C3=B6r Spencer Dawkins at = IETF
Skickat: den 7 oktober 2016 04:40
Till: = Tirumaleswar Reddy (tireddy)
Kopia: tram-chairs@ietf.org; = tram@ietf.org; Alexey Melnikov; = draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault; The = IESG
=C3=84mne: Re: [tram] Alexey Melnikov's Discuss on = draft-ietf-tram-turn-server-discovery-09: (with = DISCUSS)

 

Hi, = Alexey,

 

On Mon, = Sep 5, 2016 at 9:05 PM, Tirumaleswar Reddy (tireddy) <tireddy@cisco.com> wrote:

> -----Original Message-----
> From: Alexey = Melnikov [mailto:aamelnikov@fastmail.fm]

> Sent: Friday, = September 2, 2016 2:02 PM
> To: Tirumaleswar Reddy (tireddy) = <tireddy@cisco.com>
> Cc: The IESG <iesg@ietf.org>; = draft-ietf-tram-turn-server-discovery@ietf.org;
= > Simon Perreault <sperreault@jive.com>; tram-chairs@ietf.org; tram@ietf.org
> Subject: Re: Alexey = Melnikov's Discuss on draft-ietf-tram-turn-server-
> discovery-09: = (with DISCUSS)
>
> Hi,
>
> On 2 Sep 2016, at = 04:02, Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
> = wrote:
>
> >> -----Original Message-----
> = >> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]
> >> Sent: = Thursday, September 1, 2016 12:49 PM
> >> To: Tirumaleswar = Reddy (tireddy) <tireddy@cisco.com>
> >> Cc: The = IESG <iesg@ietf.org>;
> >> draft-ietf-tram-turn-server-discovery@ietf.org;
= > >> Simon Perreault <sperreault@jive.com>; tram-chairs@ietf.org;
> >> tram@ietf.org
> >> Subject: Re: Alexey = Melnikov's Discuss on
> >> = draft-ietf-tram-turn-server-
> >> discovery-09: (with = DISCUSS)
> >>
> >> Hi,
> >>
> = >> On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy)
> = >> <tireddy@cisco.com>
> >> = wrote:
> >>
> >>>> -----Original = Message-----
> >>>> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]
> >>>> = Sent: Wednesday, August 31, 2016 9:11 PM
> >>>> To: = The IESG <iesg@ietf.org>
> >>>> Cc: draft-ietf-tram-turn-server-discovery@ietf.org; = Simon Perreault
> >>>> <sperreault@jive.com>; tram-chairs@ietf.org; sperreault@jive.com;
> >>>> tram@ietf.org
> >>>> Subject: = Alexey Melnikov's Discuss on
> >>>> = draft-ietf-tram-turn-server-discovery-
> >>>> 09: = (with DISCUSS)
> >>>>
> >>>> Alexey = Melnikov has entered the following ballot position for
> = >>>> draft-ietf-tram-turn-server-discovery-09: = Discuss
> >>>>
> >>>> When = responding, please keep the subject line intact and reply to
> = >>>> all email addresses included in the To and CC lines. = (Feel free to
> >>>> cut this introductory paragraph, = however.)
> >>>>
> >>>>
> = >>>> Please refer to
> >>>> https://www.ietf.org/iesg/statement/discuss-criteria.ht= ml
> >>>> for more information about IESG DISCUSS = and COMMENT positions.
> >>>>
> = >>>>
> >>>> The document, along with other = ballot positions, can be found here:
> >>>> https://datatracker.ietf.org/doc/draft-ietf-tram-turn-s= erver-discov
> >>>> er
> >>>> = y/
> >>>>
> >>>>
> = >>>>
> >>>> = -------------------------------------------------------------------
&g= t; >>>> --
> >>>> -
> = >>>> DISCUSS:
> >>>> = -------------------------------------------------------------------
&g= t; >>>> --
> >>>> -
> = >>>>
> >>>> In Section 9:
> = >>>>
> >>>> o  For certificate-based = authentication, a pre-populated trust anchor
> = >>>>     store [RFC6024] allows a TURN client = to perform path validation
> >>>>    =  for the server certificate obtained during the (D)TLS = handshake.
> >>>>
> >>>>  =    If the client used a domain name to discover the TURN = server, that
> >>>>     domain name = also provides a mechanism for validation of the TURN
> = >>>>     server.  The client MUST use = the rules and guidelines given in
> >>>>    =  section 6 of [RFC6125] to validate the TURN server = identity.
> >>>>
> >>>> I am glad = that you are referencing RFC 6125, but unfortunately you
> = >>>> don't provide enough details. Please add details as = specified in
> >>>> Section 3 of RFC
> = >>>> 6125 to your document.
> >>>
> = >>> Sure, will add the following lines:
> >>> = Certification authorities that issue TURN server certificates = SHOULD
> >>> support
> >> the DNS-ID and = SRV-ID identifier types. TURN service providers SHOULD
> >> = include the DNS-ID and SRV-ID identifier types in certificate = requests.
> >>
> >> What about use of CN-IDs and = URI-IDs?
> >
> > Yes, added.
>
> Just to = clarify: you can pick which ones of the 4 types you want to use, you = can
> disallow some. You just have to be = explicit.

Okay.

> >
> >> Wildcards = ?
> >
> > I don't think wildcards are = required.
>
> Please say so in the document.

Sure, = will update.

-Tiru

 

It looks to me as if -10 should address your Discuss. = Could you take a look and confirm that?

 

Thanks!

 

Spencer 

------=_NextPart_000_05AB_01D220B3.B209FEC0-- From nobody Fri Oct 7 07:33:30 2016 Return-Path: X-Original-To: tram@ietf.org Delivered-To: tram@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D0565129639; Fri, 7 Oct 2016 07:33:28 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "Kathleen Moriarty" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.34.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147585080881.8951.3906742969699373476.idtracker@ietfa.amsl.com> Date: Fri, 07 Oct 2016 07:33:28 -0700 Archived-At: Cc: sperreault@jive.com, draft-ietf-tram-turn-server-discovery@ietf.org, tram@ietf.org, tram-chairs@ietf.org Subject: [tram] Kathleen Moriarty's No Objection on draft-ietf-tram-turn-server-discovery-10: (with COMMENT) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2016 14:33:29 -0000 Kathleen Moriarty has entered the following ballot position for draft-ietf-tram-turn-server-discovery-10: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discovery/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thank you for adding in the text on restricting access to the turn server to address my prior discuss. I think this is helpful. From nobody Sun Oct 9 02:04:11 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36C89129497 for ; Sun, 9 Oct 2016 02:04:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.221 X-Spam-Level: X-Spam-Status: No, score=-104.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFRMtdBYpJmj for ; Sun, 9 Oct 2016 02:04:07 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DB8D127058 for ; Sun, 9 Oct 2016 02:04:06 -0700 (PDT) X-AuditID: c1b4fb3a-ab7ff7000000099a-b2-57fa0804af1c Received: from ESESSHC011.ericsson.se (Unknown_Domain [153.88.183.51]) by (Symantec Mail Security) with SMTP id 94.27.02458.4080AF75; Sun, 9 Oct 2016 11:04:04 +0200 (CEST) Received: from [100.94.11.43] (153.88.183.153) by smtp.internal.ericsson.com (153.88.183.53) with Microsoft SMTP Server id 14.3.319.2; Sun, 9 Oct 2016 11:04:03 +0200 To: "Gonzalo Salgueiro (gsalguei)" References: <3d8524a8-95bb-d63e-0c97-9e56140fde9b@ericsson.com> <9338c4b8-3664-83a2-8e8f-d72f0ecac034@ericsson.com> <50E8BB5D-43D3-48A9-8D4A-1334065DB006@cisco.com> <524fafa7-df36-e6de-20e3-fd825ab921af@ericsson.com> <1864E897-0889-40DA-B7D4-E273DB243003@cisco.com> From: Gonzalo Camarillo Message-ID: <6cf7d550-c635-e2a4-70f3-d2af74c83724@ericsson.com> Date: Sun, 9 Oct 2016 12:04:03 +0300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <1864E897-0889-40DA-B7D4-E273DB243003@cisco.com> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrLLMWRmVeSWpSXmKPExsUyM2K7sS4Lx69wgxlntCzmTvGzuH4l1OLD 2gtsDsweU35vZPVYsuQnk8e/OU+ZA5ijuGxSUnMyy1KL9O0SuDK6rzxjLegWqjh86xhbA+N1 vi5GDg4JAROJw91AJheHkMB6RonvM3czQjgrGSVuXX/H3sXIySEs4Ctxuu0yG4gtImAused3 CxtE0XEmie+df8ASzAI+El82TWUBsdkELCS23LoPZvMK2Eu0vm8Es1kEVCQu9V5hBbFFBWIk 9s+ayQxRIyhxcuYTsBpOAVuJ1Vf6WSBmGkgcWTSHFcKWl9j+dg5YvZCAtsTyZy0sExgFZiFp n4WkZRaSlgWMzKsYRYtTi4tz042M9FKLMpOLi/Pz9PJSSzYxAgP14JbfVjsYDz53PMQowMGo xMP74M7PcCHWxLLiytxDjBIczEoivN+YfoUL8aYkVlalFuXHF5XmpBYfYpTmYFES5zVbeT9c SCA9sSQ1OzW1ILUIJsvEwSnVwJga+mKqo4/HEr3+jP3i4iWdKgEyvfnllmapt5jv6KqujhVt af1Q9+mQWPuMK/JHN/1t5a5rvV16oVxgvpLWmcc9f16adJ/7EqIhLfPx0SGNr+FPpQrVin0+ WPvanM624OkSEF96c05qKzMv9xO5zp+rHCYs9VvtfLb7yK4t88LKNrkvlw51UWIpzkg01GIu Kk4EAIk4IQxQAgAA Archived-At: Cc: Simon Perreault , tram mailing list Subject: Re: [tram] Dedicated reviewers needed for draft-ietf-tram-stun-pmtud X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Oct 2016 09:04:09 -0000 Hi Gonzalo, what is the current ETA? Thanks, Gonzalo On 19/09/2016 8:52 PM, Gonzalo Salgueiro (gsalguei) wrote: > Apologies, but recent travel schedules and day jobs got in the way of our getting together to address these reviews. We hope to get to this shortly. > > Thanks, > > Gonzalo > > >> On Sep 19, 2016, at 2:44 AM, Gonzalo Camarillo wrote: >> >> Hi Gonzalo, >> >> do you have an ETA for the revision? >> >> Thanks, >> >> Gonzalo >> >> On 01/09/2016 4:48 PM, Gonzalo Salgueiro (gsalguei) wrote: >>> Thanks for the reviews. We will try and get a new version out shortly addressing these comments. >>> >>> Thanks, >>> >>> Gonzalo >>> >>> >>>> On Sep 1, 2016, at 2:45 AM, Gonzalo Camarillo wrote: >>>> >>>> Tiru, Ram: thanks for your reviews! >>>> >>>> Marc, Gonzalo: could you please address the comments you have received? >>>> >>>> Cheers, >>>> >>>> Gonzalo >>>> >>>> On 26/07/2016 7:58 PM, Gonzalo Camarillo wrote: >>>>> Hi, >>>>> >>>>> per our session in Berlin, we are still looking for volunteers to review >>>>> this draft. Please, contact the chairs if you would like to volunteer. >>>>> >>>>> Thanks, >>>>> >>>>> Gonzalo >>>>> >>>>> On 07/07/2016 9:06 AM, Gonzalo Camarillo wrote: >>>>>> Folks, >>>>>> >>>>>> we would like to get the following draft in a good-enough shape so that >>>>>> we can start its WGLC in the near future. For that, we need at least two >>>>>> dedicated reviewers: >>>>>> >>>>>> https://datatracker.ietf.org/doc/draft-ietf-tram-stun-pmtud/ >>>>>> >>>>>> If you would like to volunteer to review this draft, please let the >>>>>> chairs know. >>>>>> >>>>>> We are after a general review of the draft. In addition, we would like >>>>>> the dedicated reviewers to provide input on the two proposed Probing >>>>>> Mechanisms (Simple and Complete). >>>>>> >>>>>> Thanks, >>>>>> >>>>>> Gonzalo >>>>>> >>>>>> _______________________________________________ >>>>>> tram mailing list >>>>>> tram@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/tram >>>>>> >>>>> >>>> >>>> _______________________________________________ >>>> tram mailing list >>>> tram@ietf.org >>>> https://www.ietf.org/mailman/listinfo/tram >>> > From nobody Sun Oct 9 10:55:20 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F233112959B for ; Sun, 9 Oct 2016 10:55:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.517 X-Spam-Level: X-Spam-Status: No, score=-17.517 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.996, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gt8kbJhXg2Rd for ; Sun, 9 Oct 2016 10:55:17 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA3A4129595 for ; Sun, 9 Oct 2016 10:55:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3680; q=dns/txt; s=iport; t=1476035716; x=1477245316; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=eo2KsiJZzrZ/wqdRE+Owr81OcqI7JdSp4dV6IpI2+n8=; b=M/9CCeUqJF0LfdcGKCXPcadN4N/WviDoHEe9LrbPy9EnkO4srkk1zMvV ILbq8lBRPHLlSWqljayCpG97bAzA9LcVQ94IATCBJahXUayHjIUxfMIrs 1qg0vEcZQEGg8pgMosyX2pu/56l34Sbhb12Bk2DEqgkHMCp3MZ0oePnOI g=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A6AQBxg/pX/4ENJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgzwBAQEBAR1XfAeNLJcClDGCCxsLhXoCGoFgOBQBAgEBAQEBAQF?= =?us-ascii?q?eJ4RhAQEBAwEBAQEgEToLBQsCAQgYAgImAgICJQsVEAIEDgWISAgOs3aMaQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBARgFgQeFNoF9gliEXiOCSiyCLwWZfwGGJolWgW6?= =?us-ascii?q?EZ4kfhw+FaIN+AR42S4RacocBgQABAQE?= X-IronPort-AV: E=Sophos;i="5.31,467,1473120000"; d="scan'208";a="160144074" Received: from alln-core-9.cisco.com ([173.36.13.129]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 09 Oct 2016 17:55:15 +0000 Received: from XCH-ALN-007.cisco.com (xch-aln-007.cisco.com [173.36.7.17]) by alln-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id u99HtFLO017585 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 9 Oct 2016 17:55:16 GMT Received: from xch-aln-009.cisco.com (173.36.7.19) by XCH-ALN-007.cisco.com (173.36.7.17) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sun, 9 Oct 2016 12:55:15 -0500 Received: from xch-aln-009.cisco.com ([173.36.7.19]) by XCH-ALN-009.cisco.com ([173.36.7.19]) with mapi id 15.00.1210.000; Sun, 9 Oct 2016 12:55:15 -0500 From: "Gonzalo Salgueiro (gsalguei)" To: Gonzalo Camarillo Thread-Topic: [tram] Dedicated reviewers needed for draft-ietf-tram-stun-pmtud Thread-Index: AQHSBByEBVEeJMqD6kW/sNkqomYyJKBk+rcAgBvTYQCAALqLAIAe2x+AgACUaQA= Date: Sun, 9 Oct 2016 17:55:15 +0000 Message-ID: References: <3d8524a8-95bb-d63e-0c97-9e56140fde9b@ericsson.com> <9338c4b8-3664-83a2-8e8f-d72f0ecac034@ericsson.com> <50E8BB5D-43D3-48A9-8D4A-1334065DB006@cisco.com> <524fafa7-df36-e6de-20e3-fd825ab921af@ericsson.com> <1864E897-0889-40DA-B7D4-E273DB243003@cisco.com> <6cf7d550-c635-e2a4-70f3-d2af74c83724@ericsson.com> In-Reply-To: <6cf7d550-c635-e2a4-70f3-d2af74c83724@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.82.171.199] Content-Type: text/plain; charset="utf-8" Content-ID: <940E1C76E7CF484F88ABD377024F132C@emea.cisco.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: Simon Perreault , tram mailing list Subject: Re: [tram] Dedicated reviewers needed for draft-ietf-tram-stun-pmtud X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Oct 2016 17:55:19 -0000 SGktIA0KDQpXZSBhcmUgZGVsYXllZCBkdWUgdG8gb3RoZXIgd29yayBwcmlvcml0aWVzLiAgSeKA mWxsIHVwZGF0ZSB0aGUgbGlzdCBvbmNlIHdlIGhhdmUgYSBjbGVhcmVyIHNjaGVkdWxlIHRvIGFk ZHJlc3MgdGhpcy4NCg0KQ2hlZXJzLA0KDQpHb256YWxvDQoNCg0KPiBPbiBPY3QgOSwgMjAxNiwg YXQgNTowNCBBTSwgR29uemFsbyBDYW1hcmlsbG8gPEdvbnphbG8uQ2FtYXJpbGxvQGVyaWNzc29u LmNvbT4gd3JvdGU6DQo+IA0KPiBIaSBHb256YWxvLA0KPiANCj4gd2hhdCBpcyB0aGUgY3VycmVu dCBFVEE/DQo+IA0KPiBUaGFua3MsDQo+IA0KPiBHb256YWxvDQo+IA0KPiBPbiAxOS8wOS8yMDE2 IDg6NTIgUE0sIEdvbnphbG8gU2FsZ3VlaXJvIChnc2FsZ3VlaSkgd3JvdGU6DQo+PiBBcG9sb2dp ZXMsIGJ1dCByZWNlbnQgdHJhdmVsIHNjaGVkdWxlcyBhbmQgZGF5IGpvYnMgZ290IGluIHRoZSB3 YXkgb2Ygb3VyIGdldHRpbmcgdG9nZXRoZXIgdG8gYWRkcmVzcyB0aGVzZSByZXZpZXdzLiAgV2Ug aG9wZSB0byBnZXQgdG8gdGhpcyBzaG9ydGx5Lg0KPj4gDQo+PiBUaGFua3MsDQo+PiANCj4+IEdv bnphbG8NCj4+IA0KPj4gDQo+Pj4gT24gU2VwIDE5LCAyMDE2LCBhdCAyOjQ0IEFNLCBHb256YWxv IENhbWFyaWxsbyA8R29uemFsby5DYW1hcmlsbG9AZXJpY3Nzb24uY29tPiB3cm90ZToNCj4+PiAN Cj4+PiBIaSBHb256YWxvLA0KPj4+IA0KPj4+IGRvIHlvdSBoYXZlIGFuIEVUQSBmb3IgdGhlIHJl dmlzaW9uPw0KPj4+IA0KPj4+IFRoYW5rcywNCj4+PiANCj4+PiBHb256YWxvDQo+Pj4gDQo+Pj4g T24gMDEvMDkvMjAxNiA0OjQ4IFBNLCBHb256YWxvIFNhbGd1ZWlybyAoZ3NhbGd1ZWkpIHdyb3Rl Og0KPj4+PiBUaGFua3MgZm9yIHRoZSByZXZpZXdzLiAgV2Ugd2lsbCB0cnkgYW5kIGdldCBhIG5l dyB2ZXJzaW9uIG91dCBzaG9ydGx5IGFkZHJlc3NpbmcgdGhlc2UgY29tbWVudHMuDQo+Pj4+IA0K Pj4+PiBUaGFua3MsDQo+Pj4+IA0KPj4+PiBHb256YWxvDQo+Pj4+IA0KPj4+PiANCj4+Pj4+IE9u IFNlcCAxLCAyMDE2LCBhdCAyOjQ1IEFNLCBHb256YWxvIENhbWFyaWxsbyA8R29uemFsby5DYW1h cmlsbG9AZXJpY3Nzb24uY29tPiB3cm90ZToNCj4+Pj4+IA0KPj4+Pj4gVGlydSwgUmFtOiB0aGFu a3MgZm9yIHlvdXIgcmV2aWV3cyENCj4+Pj4+IA0KPj4+Pj4gTWFyYywgR29uemFsbzogY291bGQg eW91IHBsZWFzZSBhZGRyZXNzIHRoZSBjb21tZW50cyB5b3UgaGF2ZSByZWNlaXZlZD8NCj4+Pj4+ IA0KPj4+Pj4gQ2hlZXJzLA0KPj4+Pj4gDQo+Pj4+PiBHb256YWxvDQo+Pj4+PiANCj4+Pj4+IE9u IDI2LzA3LzIwMTYgNzo1OCBQTSwgR29uemFsbyBDYW1hcmlsbG8gd3JvdGU6DQo+Pj4+Pj4gSGks DQo+Pj4+Pj4gDQo+Pj4+Pj4gcGVyIG91ciBzZXNzaW9uIGluIEJlcmxpbiwgd2UgYXJlIHN0aWxs IGxvb2tpbmcgZm9yIHZvbHVudGVlcnMgdG8gcmV2aWV3DQo+Pj4+Pj4gdGhpcyBkcmFmdC4gUGxl YXNlLCBjb250YWN0IHRoZSBjaGFpcnMgaWYgeW91IHdvdWxkIGxpa2UgdG8gdm9sdW50ZWVyLg0K Pj4+Pj4+IA0KPj4+Pj4+IFRoYW5rcywNCj4+Pj4+PiANCj4+Pj4+PiBHb256YWxvDQo+Pj4+Pj4g DQo+Pj4+Pj4gT24gMDcvMDcvMjAxNiA5OjA2IEFNLCBHb256YWxvIENhbWFyaWxsbyB3cm90ZToN Cj4+Pj4+Pj4gRm9sa3MsDQo+Pj4+Pj4+IA0KPj4+Pj4+PiB3ZSB3b3VsZCBsaWtlIHRvIGdldCB0 aGUgZm9sbG93aW5nIGRyYWZ0IGluIGEgZ29vZC1lbm91Z2ggc2hhcGUgc28gdGhhdA0KPj4+Pj4+ PiB3ZSBjYW4gc3RhcnQgaXRzIFdHTEMgaW4gdGhlIG5lYXIgZnV0dXJlLiBGb3IgdGhhdCwgd2Ug bmVlZCBhdCBsZWFzdCB0d28NCj4+Pj4+Pj4gZGVkaWNhdGVkIHJldmlld2VyczoNCj4+Pj4+Pj4g DQo+Pj4+Pj4+IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtdHJh bS1zdHVuLXBtdHVkLw0KPj4+Pj4+PiANCj4+Pj4+Pj4gSWYgeW91IHdvdWxkIGxpa2UgdG8gdm9s dW50ZWVyIHRvIHJldmlldyB0aGlzIGRyYWZ0LCBwbGVhc2UgbGV0IHRoZQ0KPj4+Pj4+PiBjaGFp cnMga25vdy4NCj4+Pj4+Pj4gDQo+Pj4+Pj4+IFdlIGFyZSBhZnRlciBhIGdlbmVyYWwgcmV2aWV3 IG9mIHRoZSBkcmFmdC4gSW4gYWRkaXRpb24sIHdlIHdvdWxkIGxpa2UNCj4+Pj4+Pj4gdGhlIGRl ZGljYXRlZCByZXZpZXdlcnMgdG8gcHJvdmlkZSBpbnB1dCBvbiB0aGUgdHdvIHByb3Bvc2VkIFBy b2JpbmcNCj4+Pj4+Pj4gTWVjaGFuaXNtcyAoU2ltcGxlIGFuZCBDb21wbGV0ZSkuDQo+Pj4+Pj4+ IA0KPj4+Pj4+PiBUaGFua3MsDQo+Pj4+Pj4+IA0KPj4+Pj4+PiBHb256YWxvDQo+Pj4+Pj4+IA0K Pj4+Pj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K Pj4+Pj4+PiB0cmFtIG1haWxpbmcgbGlzdA0KPj4+Pj4+PiB0cmFtQGlldGYub3JnDQo+Pj4+Pj4+ IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdHJhbQ0KPj4+Pj4+PiANCj4+ Pj4+PiANCj4+Pj4+IA0KPj4+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCj4+Pj4+IHRyYW0gbWFpbGluZyBsaXN0DQo+Pj4+PiB0cmFtQGlldGYub3Jn DQo+Pj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RyYW0NCj4+Pj4g DQo+PiANCg0K From nobody Mon Oct 10 22:59:15 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD7D512963A for ; Mon, 10 Oct 2016 06:57:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.598 X-Spam-Level: X-Spam-Status: No, score=-105.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.996, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Jz15sbtNTk5 for ; Mon, 10 Oct 2016 06:57:13 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E499129481 for ; Mon, 10 Oct 2016 06:57:13 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 27BF0B8112F; Mon, 10 Oct 2016 06:57:13 -0700 (PDT) To: tireddy@cisco.com, praspati@cisco.com, rmohanr@cisco.com, justin@uberti.name, spencerdawkins.ietf@gmail.com, ietf@kuehlewind.net, gonzalo.camarillo@ericsson.com, sperreault@jive.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Message-Id: <20161010135713.27BF0B8112F@rfc-editor.org> Date: Mon, 10 Oct 2016 06:57:13 -0700 (PDT) Archived-At: X-Mailman-Approved-At: Mon, 10 Oct 2016 22:59:13 -0700 Cc: rfc-editor@rfc-editor.org, tram@ietf.org, bakfitty@gmail.com Subject: [tram] [Technical Errata Reported] RFC7635 (4826) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Oct 2016 13:57:15 -0000 The following errata report has been submitted for RFC7635, "Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=7635&eid=4826 -------------------------------------- Type: Technical Reported by: Mihály Mészáros Section: 8. Original Text ------------- 8. STUN Client Behavior o The client looks for the MESSAGE-INTEGRITY attribute in the response. If MESSAGE-INTEGRITY is absent or the value computed for message integrity using mac_key does not match the contents of the MESSAGE-INTEGRITY attribute, then the response MUST be discarded. o If the access token expires, then the client MUST obtain a new token from the authorization server and use it for new STUN requests. Corrected Text -------------- 8. STUN Client Behavior o The client looks for the MESSAGE-INTEGRITY attribute in the response. If MESSAGE-INTEGRITY is absent or the value computed for message integrity using mac_key does not match the contents of the MESSAGE-INTEGRITY attribute, then the response MUST be discarded. 9. Application (OAuth Client) Behavior o If the access token expires, then the Application (OAuth client) MUST obtain a new token from the authorization server, and update STUN client to use it for new STUN requests. o Application SHOULD pass only a subset of the received OAuth parameters to the STUN client. Only parameters SHOULD be passed that will be really needed and used by the STUN Client. In this way, only the kid, the mac_key, and the access_token parameters SHOULD be passed to the STUN client. ... Renumber the sections ... Notes ----- 1. Remove from STUN client behaviour the access_token renewal function, and move this function up to application level. 2. Pass to STUN only that subset of the OAuth parameters, that will be really used by STUN Client. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC7635 (draft-ietf-tram-turn-third-party-authz-16) -------------------------------------- Title : Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization Publication Date : August 2015 Author(s) : T. Reddy, P. Patil, R. Ravindranath, J. Uberti Category : PROPOSED STANDARD Source : TURN Revised and Modernized Area : Transport Stream : IETF Verifying Party : IESG From nobody Tue Oct 11 00:01:24 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF43812945A; Tue, 11 Oct 2016 00:01:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.517 X-Spam-Level: X-Spam-Status: No, score=-17.517 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.996, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OIOujeBaA5_s; Tue, 11 Oct 2016 00:01:21 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B7D5129489; Tue, 11 Oct 2016 00:01:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1912; q=dns/txt; s=iport; t=1476169281; x=1477378881; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Hyd/eUNMfhff64inBHp7BNunWh16kZYU/mqvWdRZbSI=; b=CuYo0GWRvhbXfYRhAVAfOn2rhU6rBbXhw8h2qvffKSiDBmkLn06Zi5ZF 4ZfPsMBDjGVKrhQkhoizZvakegfv1iFGlxQ1jHIlee75qvlvHcxRap3aQ PRBIxF3uqPwzUjN+gwY6Sas5ELL6pEhnRSIdr6OK0CW7metdCz08d8Nq5 s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AYAQAKjvxX/5xdJa1TCRkBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYM8AQEBAQEdV3wHjSyXA5QzggsbC4V6AoF0OBQBAgEBAQEBAQF?= =?us-ascii?q?eJ4RhAQEBBAEBATc0CwwEAgEIEQQBAQEeBQQHJwsUCQgCBAENBQiISA7CGwEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBARgFhj2EVYQgEYV1BZoAAYYmiU+BdYRniSCMeYN?= =?us-ascii?q?+AR42TIMlgTpyhyKBAAEBAQ?= X-IronPort-AV: E=Sophos;i="5.31,476,1473120000"; d="scan'208";a="156240963" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Oct 2016 07:01:20 +0000 Received: from XCH-RCD-015.cisco.com (xch-rcd-015.cisco.com [173.37.102.25]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id u9B71KFa029338 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 11 Oct 2016 07:01:20 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-RCD-015.cisco.com (173.37.102.25) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 11 Oct 2016 02:01:19 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Tue, 11 Oct 2016 02:01:19 -0500 From: "Tirumaleswar Reddy (tireddy)" To: Ben Campbell , "Prashanth Patil (praspati)" Thread-Topic: [tram] Ben Campbell's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and COMMENT) Thread-Index: AQHSA++YaICpZPYmxkqQAN2wEDY0faBvTHIAgAEkJQCACEw5gIAAy8IAgAG7UACACCKogIAAApMAgB+oMxA= Date: Tue, 11 Oct 2016 07:01:19 +0000 Message-ID: <06a5626c99c54b95864158677435fe79@XCH-RCD-017.cisco.com> References: <147269306853.31916.11958166980739260630.idtracker@ietfa.amsl.com> <362B7B05-81DA-49D7-8452-9BA21F991D00@nostrum.com> <94397E90-8765-4AAE-81C2-49B8C5B39132@nostrum.com> <23373C96-0D5F-4C0B-82EA-B93CE91ABA0F@nostrum.com> In-Reply-To: <23373C96-0D5F-4C0B-82EA-B93CE91ABA0F@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.232.20.168] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: Simon Perreault , "tram-chairs@ietf.org" , "draft-ietf-tram-turn-server-discovery@ietf.org" , The IESG , "tram@ietf.org" Subject: Re: [tram] Ben Campbell's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and COMMENT) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Oct 2016 07:01:24 -0000 Hi Ben, Updated draft https://tools.ietf.org/html/draft-ietf-tram-turn-server-disco= very-10 to address your comments, Please have a look. Thanks and Regards, -Tiru > -----Original Message----- > From: tram [mailto:tram-bounces@ietf.org] On Behalf Of Ben Campbell > Sent: Wednesday, September 21, 2016 4:00 AM > To: Prashanth Patil (praspati) > Cc: The IESG ; tram-chairs@ietf.org; draft-ietf-tram-turn- > server-discovery@ietf.org; tram@ietf.org; Simon Perreault > > Subject: Re: [tram] Ben Campbell's Discuss on draft-ietf-tram-turn-server= - > discovery-09: (with DISCUSS and COMMENT) >=20 > On 20 Sep 2016, at 17:21, Ben Campbell wrote: >=20 > > To be clear, I think that discussion is incomplete. RFC 5766 discusses > >>> several security considerations that explicitly mention > >>> authentication as a mitigating factor. For example, 17.1.1, 17.1.3, > >>> 17.1.7, and 17.2.1. > >>> > >>> Those paragraphs (and the bullet list before them) also seem to > >>> depend on (D)TLS to mitigate some of the issues. But even that is > >>> only a SHOULD. > > > >> > >> Right, I think we can mandate (D)TLS *if* STUN authentication or > >> third-party authorization is not used. > > > > I think that would help. >=20 > Oops, I meant to type a bit more... >=20 > Even with that addition, I still think the draft needs to address the > impact on the issues discussed in the aforementioned sections of 5766. > If (D)TLS solves the same issues, it would be good to say that. If there > are things not addressed by TLS (likely true for some of the issues > mitigated by knowing the client identity), then the draft should mention > those, too. >=20 > Thanks! >=20 > Ben. >=20 > _______________________________________________ > tram mailing list > tram@ietf.org > https://www.ietf.org/mailman/listinfo/tram From nobody Tue Oct 11 13:43:14 2016 Return-Path: X-Original-To: tram@ietf.org Delivered-To: tram@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 55F8112959A; Tue, 11 Oct 2016 13:43:13 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "Ben Campbell" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.34.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147621859330.31935.2744378814001632730.idtracker@ietfa.amsl.com> Date: Tue, 11 Oct 2016 13:43:13 -0700 Archived-At: Cc: sperreault@jive.com, draft-ietf-tram-turn-server-discovery@ietf.org, tram@ietf.org, tram-chairs@ietf.org Subject: [tram] Ben Campbell's No Objection on draft-ietf-tram-turn-server-discovery-10: (with COMMENT) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Oct 2016 20:43:13 -0000 Ben Campbell has entered the following ballot position for draft-ietf-tram-turn-server-discovery-10: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discovery/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thanks, this version helps, and I am clearing my DISCUSS. (I assume Spencer will figure out the Right Thing to do to make sure the update to 5766 gets the right review.) I have a few minor comments on the resulting text. None of these are showstoppers: - Absrtact: Please mention that this draft updates 5766 to relax the requirement for authentication in certain cases in the abstract. - 9, 2nd paragraph, "Making STUN authentication OPTIONAL ..." Since you already used a 2119 MAY in the previous paragraph, there's no need for the 2119 OPTIONAL here. (In general, 2119 keywords should be used to state requirements, not talk about existing requirements) -9, third paragraph: I saw a comment on my DISCUSS email thread from Karl Stahl, stating that DTLS could not be mandated. Has that input been considered? (I don't have an opinion; I just want to make sure people noticed the comment.) -9, 9th paragraph: "Instead, with an explicit administrator choice, a TURN client SHOULD fall-back to encryption-only (D)TLS when (D)TLS authentication is not available." I’m not sure what SHOULD means after adding the explicit choice part. Does that means the administrator SHOULD make that choice? Is the point that you can fall back, but MUST NOT do so without explicit choice? -9, 10th paragraph: -- The first sentence is now redundant with the previous paragraph. -- is the point of the first part of the second sentence that you MUST NOT fall back without explicit choice? (similar to for server authentication?) From nobody Tue Oct 11 14:08:14 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10F0A129566; Tue, 11 Oct 2016 14:08:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.895 X-Spam-Level: X-Spam-Status: No, score=-4.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-2.996] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yy9xNbSdVJI5; Tue, 11 Oct 2016 14:08:06 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12A46129561; Tue, 11 Oct 2016 14:08:05 -0700 (PDT) Received: from [10.0.1.21] (cpe-66-25-7-22.tx.res.rr.com [66.25.7.22]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id u9BL7xvw011941 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Tue, 11 Oct 2016 16:07:59 -0500 (CDT) (envelope-from ben@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host cpe-66-25-7-22.tx.res.rr.com [66.25.7.22] claimed to be [10.0.1.21] From: "Ben Campbell" To: "Tirumaleswar Reddy" Date: Tue, 11 Oct 2016 16:07:59 -0500 Message-ID: <555D599A-12DE-4C73-870A-48597910EED2@nostrum.com> In-Reply-To: <06a5626c99c54b95864158677435fe79@XCH-RCD-017.cisco.com> References: <147269306853.31916.11958166980739260630.idtracker@ietfa.amsl.com> <362B7B05-81DA-49D7-8452-9BA21F991D00@nostrum.com> <94397E90-8765-4AAE-81C2-49B8C5B39132@nostrum.com> <23373C96-0D5F-4C0B-82EA-B93CE91ABA0F@nostrum.com> <06a5626c99c54b95864158677435fe79@XCH-RCD-017.cisco.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_MailMate_8D1BB61A-7518-4AAC-9913-A3D85D7477DD_=" Content-Transfer-Encoding: 8bit X-Mailer: MailMate (1.9.5r5263) Archived-At: Cc: Prashanth Patil , "tram-chairs@ietf.org" , "tram@ietf.org" , "draft-ietf-tram-turn-server-discovery@ietf.org" , Simon Perreault , The IESG Subject: Re: [tram] Ben Campbell's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and COMMENT) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Oct 2016 21:08:08 -0000 --=_MailMate_8D1BB61A-7518-4AAC-9913-A3D85D7477DD_= Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi, This version helps, and I will clear my DISCUSS. I assume Spencer will figure out the Right Thing to do to make sure the update to 5766 gets the right review. I have a few minor comments on the resulting text. None of these are showstoppers: - Absrtact: Please mention that this draft updates 5766 to relax the requirement for authentication in certain cases in the abstract. - 9, 2nd paragraph, "Making STUN authentication OPTIONAL ..." Since you already used a 2119 MAY in the previous paragraph, there's no need for the 2119 OPTIONAL here. (In general, 2119 keywords should be used to state requirements, not talk about existing requirements) -9, third paragraph: I saw a comment on my DISCUSS email thread from Karl Stahl, stating that DTLS could not be mandated. Has that input been considered? (I don't have an opinion; I just want to make sure people noticed the comment.) -9, 9th paragraph: "Instead, with an explicit administrator choice, a TURN client SHOULD fall-back to encryption-only (D)TLS when (D)TLS authentication is not available." I’m not sure what SHOULD means after adding the explicit choice part. Does that means the administrator SHOULD make that choice? Is the point that you can fall back, but MUST NOT do so without explicit choice? -9, 10th paragraph: -- The first sentence is now redundant with the previous paragraph. -- is the point of the first part of the second sentence that you MUST NOT fall back without explicit choice? (similar to for server authentication?) On 11 Oct 2016, at 2:01, Tirumaleswar Reddy (tireddy) wrote: > Hi Ben, > > Updated draft > https://tools.ietf.org/html/draft-ietf-tram-turn-server-discovery-10 > to address your comments, Please have a look. > > Thanks and Regards, > -Tiru > >> -----Original Message----- >> From: tram [mailto:tram-bounces@ietf.org] On Behalf Of Ben Campbell >> Sent: Wednesday, September 21, 2016 4:00 AM >> To: Prashanth Patil (praspati) >> Cc: The IESG ; tram-chairs@ietf.org; >> draft-ietf-tram-turn- >> server-discovery@ietf.org; tram@ietf.org; Simon Perreault >> >> Subject: Re: [tram] Ben Campbell's Discuss on >> draft-ietf-tram-turn-server- >> discovery-09: (with DISCUSS and COMMENT) >> >> On 20 Sep 2016, at 17:21, Ben Campbell wrote: >> >>> To be clear, I think that discussion is incomplete. RFC 5766 >>> discusses >>>>> several security considerations that explicitly mention >>>>> authentication as a mitigating factor. For example, 17.1.1, >>>>> 17.1.3, >>>>> 17.1.7, and 17.2.1. >>>>> >>>>> Those paragraphs (and the bullet list before them) also seem to >>>>> depend on (D)TLS to mitigate some of the issues. But even that is >>>>> only a SHOULD. >>> >>>> >>>> Right, I think we can mandate (D)TLS *if* STUN authentication or >>>> third-party authorization is not used. >>> >>> I think that would help. >> >> Oops, I meant to type a bit more... >> >> Even with that addition, I still think the draft needs to address the >> impact on the issues discussed in the aforementioned sections of >> 5766. >> If (D)TLS solves the same issues, it would be good to say that. If >> there >> are things not addressed by TLS (likely true for some of the issues >> mitigated by knowing the client identity), then the draft should >> mention >> those, too. >> >> Thanks! >> >> Ben. >> >> _______________________________________________ >> tram mailing list >> tram@ietf.org >> https://www.ietf.org/mailman/listinfo/tram > --=_MailMate_8D1BB61A-7518-4AAC-9913-A3D85D7477DD_= Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Hi,

This version helps, and I will clear my DISCUSS. I assume= Spencer will figure out the Right Thing to do to make sure the update to= 5766 gets the right review.

I have a few minor comments on the resulting text. None o= f these are showstoppers:

  • Absrtact: Please mention that this draft updates 5766= to relax the requirement for authentication in certain cases in the abst= ract.

  • 9, 2nd paragraph, "Making STUN authentication OPTIONA= L ..."

Since you already used a 2119 MAY in the previous paragr= aph, there's no need for the 2119 OPTIONAL here. (In general, 2119 keywor= ds should be used to state requirements, not talk about existing requirem= ents)

-9, third paragraph:
I saw a comment on my DISCUSS email thread from Karl Stahl, stating that = DTLS could not be mandated. Has that input been considered? (I don't have= an opinion; I just want to make sure people noticed the comment.)

-9, 9th paragraph: "Instead, with an explicit administrat= or choice, a TURN client SHOULD fall-back to encryption-only (D)TLS when = (D)TLS authentication is not available."
I=E2=80=99m not sure what SHOULD means after adding the explicit choice p= art. Does that means the administrator SHOULD make that choice? Is the po= int that you can fall back, but MUST NOT do so without explicit choice?

-9, 10th paragraph:
-- The first sentence is now redundant with the previous paragraph.
-- is the point of the first part of the second sentence that you MUST NO= T fall back without explicit choice? (similar to for server authenticatio= n?)

On 11 Oct 2016, at 2:01, Tirumaleswar Reddy (tireddy) wro= te:

Hi Ben,
Updated draft https:= //tools.ietf.org/html/draft-ietf-tram-turn-server-discovery-10 to add= ress your comments, Please have a look.
Thanks and Regards,
-Tiru
---= --Original Message-----
From: tram [mailto:tram-bounces@ietf.org] On Behalf Of B= en Campbell
Sent: Wednesday, September 21, 2016 4:00 AM
To: Prashanth Patil (praspati) <praspati@cisco= =2Ecom>
Cc: The IESG <iesg@ietf.org>; tram-chairs@i= etf.org; draft-ietf-tram-turn-
server-discovery@ietf.org; tram@ietf.org; Simon P= erreault
<sperreault@jive.com>
Subject: Re: [tram] Ben Campbell's Discuss on dra= ft-ietf-tram-turn-server-
discovery-09: (with DISCUSS and COMMENT)
On 20 Sep 2016, at 17:21, Ben Campbell wrote:
To = be clear, I think that discussion is incomplete. RFC 5766 discusses
several security consideration= s that explicitly mention
authentication as a mitigating factor. For exampl= e, 17.1.1, 17.1.3,
17.1.7, and 17.2.1.
Those paragraphs (and the bullet list before them= ) also seem to
depend on (D)TLS to mitigate some of the issues. = But even that is
only a SHOULD.
Right, I think we can mandate (D)TLS *if* STUN au= thentication or
third-party authorization is not used.
I think that would help.
Oops, I meant to type a bit more...
Even with that addition, I still think the draft = needs to address the
impact on the issues discussed in the aforementio= ned sections of 5766.
If (D)TLS solves the same issues, it would be goo= d to say that. If there
are things not addressed by TLS (likely true for = some of the issues
mitigated by knowing the client identity), then t= he draft should mention
those, too.
Thanks!
Ben.
_______________________________________________
tram mailing list
tram@ietf.org
--=_MailMate_8D1BB61A-7518-4AAC-9913-A3D85D7477DD_=-- From nobody Fri Oct 14 13:21:11 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6B2E129572; Fri, 14 Oct 2016 13:21:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.517 X-Spam-Level: X-Spam-Status: No, score=-17.517 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.996, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wYeSE_-vtuR1; Fri, 14 Oct 2016 13:21:03 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 782FF1293DF; Fri, 14 Oct 2016 13:21:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=18924; q=dns/txt; s=iport; t=1476476463; x=1477686063; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=je3zpR3HAiLPScgrqHq/G+o5JLDFl5CPagpE+3nQbBo=; b=DT3HbEKs06TPR91PXGbNoL/BNVDKBGGgB6LQs11rmQ5aR/Er5fnXUI/A jqHWJW2yiuNY+POukmEwIukiX6q/sv34HsehJH8B0px74dD1VGu9E/5dK u2q966vE+uQy6mIW2MODGoJE25+UXQXqKCHolAg4zLYXhCj17Iqy7xOso g=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AfAQDUPAFY/51dJa1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgwc1AQEBAQEdV3wHjS2mKYMFgg+CCIYiAhqBfTgUAQIBAQEBAQE?= =?us-ascii?q?BXieEYgEBBCMKTBACAQg7BAMCAgIwFBECBAENBYhStgmNDQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAR2GPYF9CIJQhBkRAQaDGiyCLwWaBgGPf4FuhGeJIIcQiWcBHjY?= =?us-ascii?q?bN4J1OoE6coYVgSCBAAEBAQ?= X-IronPort-AV: E=Sophos;i="5.31,346,1473120000"; d="scan'208,217";a="335960286" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 14 Oct 2016 20:21:02 +0000 Received: from XCH-RTP-017.cisco.com (xch-rtp-017.cisco.com [64.101.220.157]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id u9EKL13D019931 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 14 Oct 2016 20:21:02 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-017.cisco.com (64.101.220.157) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 14 Oct 2016 16:21:01 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1210.000; Fri, 14 Oct 2016 16:21:01 -0400 From: "Prashanth Patil (praspati)" To: Ben Campbell , "Tirumaleswar Reddy (tireddy)" Thread-Topic: [tram] Ben Campbell's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and COMMENT) Thread-Index: AQHSChJSaICpZPYmxkqQAN2wEDY0faB5KI5ngAnd7BOAAEWaAIAf/V6AgADsjoCABDSFAA== Date: Fri, 14 Oct 2016 20:21:01 +0000 Message-ID: <5D00EE58-C578-490E-8744-C574DBF0654C@cisco.com> References: <147269306853.31916.11958166980739260630.idtracker@ietfa.amsl.com> <362B7B05-81DA-49D7-8452-9BA21F991D00@nostrum.com> <94397E90-8765-4AAE-81C2-49B8C5B39132@nostrum.com> <23373C96-0D5F-4C0B-82EA-B93CE91ABA0F@nostrum.com> <06a5626c99c54b95864158677435fe79@XCH-RCD-017.cisco.com> <555D599A-12DE-4C73-870A-48597910EED2@nostrum.com> In-Reply-To: <555D599A-12DE-4C73-870A-48597910EED2@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.85.197] Content-Type: multipart/alternative; boundary="_000_5D00EE58C578490E8744C574DBF0654Cciscocom_" MIME-Version: 1.0 Archived-At: Cc: "tram@ietf.org" , Simon Perreault , "draft-ietf-tram-turn-server-discovery@ietf.org" , The IESG , "tram-chairs@ietf.org" Subject: Re: [tram] Ben Campbell's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and COMMENT) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Oct 2016 20:21:10 -0000 --_000_5D00EE58C578490E8744C574DBF0654Cciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzLCBCZW4uDQpJbmxpbmUuLg0KDQpPbiAxMC8xMS8xNiwgMjowNyBQTSwgIkJlbiBDYW1w YmVsbCIgPGJlbkBub3N0cnVtLmNvbTxtYWlsdG86YmVuQG5vc3RydW0uY29tPj4gd3JvdGU6DQoN Cg0KSGksDQoNClRoaXMgdmVyc2lvbiBoZWxwcywgYW5kIEkgd2lsbCBjbGVhciBteSBESVNDVVNT LiBJIGFzc3VtZSBTcGVuY2VyIHdpbGwgZmlndXJlIG91dCB0aGUgUmlnaHQgVGhpbmcgdG8gZG8g dG8gbWFrZSBzdXJlIHRoZSB1cGRhdGUgdG8gNTc2NiBnZXRzIHRoZSByaWdodCByZXZpZXcuDQoN CkkgaGF2ZSBhIGZldyBtaW5vciBjb21tZW50cyBvbiB0aGUgcmVzdWx0aW5nIHRleHQuIE5vbmUg b2YgdGhlc2UgYXJlIHNob3dzdG9wcGVyczoNCg0KwrcgICAgICAgICBBYnNydGFjdDogUGxlYXNl IG1lbnRpb24gdGhhdCB0aGlzIGRyYWZ0IHVwZGF0ZXMgNTc2NiB0byByZWxheCB0aGUgcmVxdWly ZW1lbnQgZm9yIGF1dGhlbnRpY2F0aW9uIGluIGNlcnRhaW4gY2FzZXMgaW4gdGhlIGFic3RyYWN0 Lg0KDQrCtyAgICAgICAgIDksIDJuZCBwYXJhZ3JhcGgsICJNYWtpbmcgU1RVTiBhdXRoZW50aWNh dGlvbiBPUFRJT05BTCAuLi4iDQoNClNpbmNlIHlvdSBhbHJlYWR5IHVzZWQgYSAyMTE5IE1BWSBp biB0aGUgcHJldmlvdXMgcGFyYWdyYXBoLCB0aGVyZSdzIG5vIG5lZWQgZm9yIHRoZSAyMTE5IE9Q VElPTkFMIGhlcmUuIChJbiBnZW5lcmFsLCAyMTE5IGtleXdvcmRzIHNob3VsZCBiZSB1c2VkIHRv IHN0YXRlIHJlcXVpcmVtZW50cywgbm90IHRhbGsgYWJvdXQgZXhpc3RpbmcgcmVxdWlyZW1lbnRz KQ0KDQpBZ3JlZWQuIFdpbGwgdXBkYXRlIGFjY29yZGluZ2x5Lg0KDQotOSwgdGhpcmQgcGFyYWdy YXBoOg0KSSBzYXcgYSBjb21tZW50IG9uIG15IERJU0NVU1MgZW1haWwgdGhyZWFkIGZyb20gS2Fy bCBTdGFobCwgc3RhdGluZyB0aGF0IERUTFMgY291bGQgbm90IGJlIG1hbmRhdGVkLiBIYXMgdGhh dCBpbnB1dCBiZWVuIGNvbnNpZGVyZWQ/IChJIGRvbid0IGhhdmUgYW4gb3BpbmlvbjsgSSBqdXN0 IHdhbnQgdG8gbWFrZSBzdXJlIHBlb3BsZSBub3RpY2VkIHRoZSBjb21tZW50LikNCg0KWWVzLCBJ IGJlbGlldmUgdGhpcyBoYXMgYWxyZWFkeSBiZWVuIGRpc2N1c3NlZC4gQXMgc3VnZ2VzdGVkIGlu IHRoZSBsYXN0IHBhcmFncmFwaCBvZiB0aGUgc2VjdGlvbiwgbm90IG1hbmRhdGluZyBEVExTIG9w ZW5zIHVwIG1hbi1pbi10aGUtbWlkZGxlIGF0dGFja3MgYW5kIG9uLXBhdGggcGFja2V0IGluamVj dGlvbi4NCg0KLTksIDl0aCBwYXJhZ3JhcGg6ICJJbnN0ZWFkLCB3aXRoIGFuIGV4cGxpY2l0IGFk bWluaXN0cmF0b3IgY2hvaWNlLCBhIFRVUk4gY2xpZW50IFNIT1VMRCBmYWxsLWJhY2sgdG8gZW5j cnlwdGlvbi1vbmx5IChEKVRMUyB3aGVuIChEKVRMUyBhdXRoZW50aWNhdGlvbiBpcyBub3QgYXZh aWxhYmxlLiINCknigJltIG5vdCBzdXJlIHdoYXQgU0hPVUxEIG1lYW5zIGFmdGVyIGFkZGluZyB0 aGUgZXhwbGljaXQgY2hvaWNlIHBhcnQuIERvZXMgdGhhdCBtZWFucyB0aGUgYWRtaW5pc3RyYXRv ciBTSE9VTEQgbWFrZSB0aGF0IGNob2ljZT8gSXMgdGhlIHBvaW50IHRoYXQgeW91IGNhbiBmYWxs IGJhY2ssIGJ1dCBNVVNUIE5PVCBkbyBzbyB3aXRob3V0IGV4cGxpY2l0IGNob2ljZT8NCg0KSXQg d2FzIHRoZSBsYXR0ZXIgaWUgTVVTVCBOT1QgZG8gc28gd2l0aG91dCBleHBsaWNpdCBjaG9pY2Uu DQoNCk5ldyB0ZXh0OiDigJxBIFRVUk4gY2xpZW50IGNvdWxkIGZhbGwgYmFjayB0byBlbmNyeXB0 aW9uLW9ubHkgKEQpVExTIHdoZW4gKEQpVExTIGF1dGhlbnRpY2F0aW9uIGlzIG5vdCBhdmFpbGFi bGUsIGJ1dCBNVVNUIE5PVCBmYWxsIGJhY2sgd2l0aG91dCBleHBsaWNpdCBhZG1pbmlzdHJhdG9y IGNob2ljZS7igJ0NCg0KLTksIDEwdGggcGFyYWdyYXBoOg0KLS0gVGhlIGZpcnN0IHNlbnRlbmNl IGlzIG5vdyByZWR1bmRhbnQgd2l0aCB0aGUgcHJldmlvdXMgcGFyYWdyYXBoLg0KDQpZZXMsIHdp bGwgcmVtb3ZlIGl0Lg0KDQotLSBpcyB0aGUgcG9pbnQgb2YgdGhlIGZpcnN0IHBhcnQgb2YgdGhl IHNlY29uZCBzZW50ZW5jZSB0aGF0IHlvdSBNVVNUIE5PVCBmYWxsIGJhY2sgd2l0aG91dCBleHBs aWNpdCBjaG9pY2U/IChzaW1pbGFyIHRvIGZvciBzZXJ2ZXIgYXV0aGVudGljYXRpb24/KQ0KDQpZ ZXMsIHRoYXQgd2FzIHRoZSBpbnRlbnRpb24uIE5ldyB0ZXh0OiDigJxBIFRVUk4gY2xpZW50IGNv dWxkIGZhbGwgYmFjayB0byBjbGVhciB0ZXh0IGlmIGl0IGRvZXMgbm90IHN1cHBvcnQgdW5hdXRo ZW50aWNhdGVkIChEKVRMUywgYnV0IE1VU1QgTk9UIGZhbGwgYmFjayB3aXRob3V0IGV4cGxpY2l0 IGFkbWluaXN0cmF0b3IgY2hvaWNlLiBGYWxsYmFjayB0byBjbGVhciB0ZXh0IGlzIE5PVCBSRUNP TU1FTkRFRCBiZWNhdXNlIGl0IG1ha2VzIHRoZSBjbGllbnQgbW9yZSBzdXNjZXB0aWJsZSB0byBt YW4taW4tdGhlLW1pZGRsZSBhdHRhY2tzIGFuZCBvbi1wYXRoIHBhY2tldCBpbmplY3Rpb24u4oCd DQoNCi1QcmFzaGFudGgNCg== --_000_5D00EE58C578490E8744C574DBF0654Cciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0K CXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250 LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAz IDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6 bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9y OmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNv SHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBs ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvUGxhaW5UZXh0LCBsaS5Nc29Q bGFpblRleHQsIGRpdi5Nc29QbGFpblRleHQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1z by1zdHlsZS1saW5rOiJQbGFpbiBUZXh0IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTt9 DQpwDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdp bi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6 IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTou MDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpzcGFuLmFwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtc3R5bGUtc3Bh bjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsN Cglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5QbGFpblRl eHRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJQbGFpbiBUZXh0IENoYXIiOw0KCW1zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCI7DQoJZm9udC1mYW1pbHk6 Q2FsaWJyaTt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJI VE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0 eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHls ZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQou TXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6 MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJn aW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldv cmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlz dC1pZDoxNzU4NDgwMjcxOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotNzQ3NjI2ODMyO30NCkBs aXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1z aXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1s ZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBs MDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDps ZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4t Ym90dG9tOjBpbjt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUi IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9Ildv cmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5UaGFua3MsIEJlbi48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj5JbmxpbmUuLiA8bzpwPg0KPC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+T24gMTAvMTEvMTYsIDI6MDcgUE0sICZxdW90 O0JlbiBDYW1wYmVsbCZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJlbkBub3N0cnVtLmNvbSI+ YmVuQG5vc3RydW0uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkhpLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpDYWxpYnJpIj5UaGlzIHZlcnNpb24gaGVscHMsIGFuZCBJIHdpbGwgY2xlYXIg bXkgRElTQ1VTUy4gSSBhc3N1bWUgU3BlbmNlciB3aWxsIGZpZ3VyZSBvdXQgdGhlIFJpZ2h0IFRo aW5nIHRvIGRvIHRvIG1ha2Ugc3VyZSB0aGUgdXBkYXRlIHRvIDU3NjYgZ2V0cyB0aGUgcmlnaHQg cmV2aWV3LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5JIGhh dmUgYSBmZXcgbWlub3IgY29tbWVudHMgb24gdGhlIHJlc3VsdGluZyB0ZXh0LiBOb25lIG9mIHRo ZXNlIGFyZSBzaG93c3RvcHBlcnM6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZv MSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6U3ltYm9sIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7CtzxzcGFuIHN0 eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bh bj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+QWJzcnRhY3Q6IFBsZWFzZSBtZW50aW9uIHRoYXQgdGhpcyBkcmFmdCB1cGRhdGVzIDU3 NjYgdG8gcmVsYXggdGhlIHJlcXVpcmVtZW50IGZvciBhdXRoZW50aWNhdGlvbiBpbiBjZXJ0YWlu IGNhc2VzIGluIHRoZSBhYnN0cmFjdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0i bWFyZ2luLWxlZnQ6MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBs Zm8xIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTpTeW1ib2wiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsK3PHNwYW4g c3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj45LCAybmQgcGFyYWdyYXBoLCAmcXVvdDtNYWtpbmcgU1RVTiBhdXRoZW50aWNhdGlv biBPUFRJT05BTCAuLi4mcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+U2luY2UgeW91IGFscmVhZHkgdXNlZCBhIDIxMTkgTUFZIGluIHRoZSBwcmV2aW91 cyBwYXJhZ3JhcGgsIHRoZXJlJ3Mgbm8gbmVlZCBmb3IgdGhlIDIxMTkgT1BUSU9OQUwgaGVyZS4g KEluIGdlbmVyYWwsIDIxMTkga2V5d29yZHMgc2hvdWxkIGJlIHVzZWQgdG8gc3RhdGUgcmVxdWly ZW1lbnRzLCBub3QgdGFsaw0KIGFib3V0IGV4aXN0aW5nIHJlcXVpcmVtZW50cyk8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj5BZ3JlZWQuIFdpbGwgdXBkYXRlIGFjY29yZGluZ2x5Lg0KPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi05LCB0aGlyZCBwYXJhZ3JhcGg6PGJy Pg0KSSBzYXcgYSBjb21tZW50IG9uIG15IERJU0NVU1MgZW1haWwgdGhyZWFkIGZyb20gS2FybCBT dGFobCwgc3RhdGluZyB0aGF0IERUTFMgY291bGQgbm90IGJlIG1hbmRhdGVkLiBIYXMgdGhhdCBp bnB1dCBiZWVuIGNvbnNpZGVyZWQ/IChJIGRvbid0IGhhdmUgYW4gb3BpbmlvbjsgSSBqdXN0IHdh bnQgdG8gbWFrZSBzdXJlIHBlb3BsZSBub3RpY2VkIHRoZSBjb21tZW50Lik8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmkiPlllcywgSSBiZWxpZXZlIHRoaXMgaGFzIGFscmVhZHkgYmVlbiBkaXNjdXNzZWQu IEFzIHN1Z2dlc3RlZCBpbiB0aGUgbGFzdCBwYXJhZ3JhcGggb2YgdGhlIHNlY3Rpb24sIG5vdCBt YW5kYXRpbmcgRFRMUyA8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPm9wZW5zIHVwIG1hbi1pbi10 aGUtbWlkZGxlIGF0dGFja3MgYW5kIG9uLXBhdGggcGFja2V0IGluamVjdGlvbi48bzpwPjwvbzpw Pjwvc3Bhbj48L3NwYW4+PC9wcmU+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+LTksIDl0aCBwYXJh Z3JhcGg6ICZxdW90O0luc3RlYWQsIHdpdGggYW4gZXhwbGljaXQgYWRtaW5pc3RyYXRvciBjaG9p Y2UsIGEgVFVSTiBjbGllbnQgU0hPVUxEIGZhbGwtYmFjayB0byBlbmNyeXB0aW9uLW9ubHkgKEQp VExTIHdoZW4gKEQpVExTIGF1dGhlbnRpY2F0aW9uIGlzIG5vdCBhdmFpbGFibGUuJnF1b3Q7PGJy Pg0KSeKAmW0gbm90IHN1cmUgd2hhdCBTSE9VTEQgbWVhbnMgYWZ0ZXIgYWRkaW5nIHRoZSBleHBs aWNpdCBjaG9pY2UgcGFydC4gRG9lcyB0aGF0IG1lYW5zIHRoZSBhZG1pbmlzdHJhdG9yIFNIT1VM RCBtYWtlIHRoYXQgY2hvaWNlPyBJcyB0aGUgcG9pbnQgdGhhdCB5b3UgY2FuIGZhbGwgYmFjaywg YnV0IE1VU1QgTk9UIGRvIHNvIHdpdGhvdXQgZXhwbGljaXQgY2hvaWNlPzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPkl0IHdhcyB0aGUgbGF0dGVyIGllIE1VU1QgTk9UIGRvIHNvIHdpdGhvdXQgZXhwbGlj aXQgY2hvaWNlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPk5ldyB0ZXh0OiA8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkNhbGlicmkiPuKAnDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5BIFRVUk4gY2xpZW50IGNvdWxkIGZhbGwgYmFj ayB0byBlbmNyeXB0aW9uLW9ubHkgKEQpVExTIHdoZW4gKEQpVExTIGF1dGhlbnRpY2F0aW9uIGlz IG5vdCBhdmFpbGFibGUsDQogYnV0IE1VU1QgTk9UIGZhbGwgYmFjayB3aXRob3V0IGV4cGxpY2l0 IGFkbWluaXN0cmF0b3IgY2hvaWNlLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2Fs aWJyaSI+4oCdPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4t OSwgMTB0aCBwYXJhZ3JhcGg6PGJyPg0KLS0gVGhlIGZpcnN0IHNlbnRlbmNlIGlzIG5vdyByZWR1 bmRhbnQgd2l0aCB0aGUgcHJldmlvdXMgcGFyYWdyYXBoLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlll cywgd2lsbCByZW1vdmUgaXQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPjxicj4NCi0tIGlzIHRoZSBwb2ludCBvZiB0aGUgZmlyc3QgcGFydCBvZiB0aGUgc2Vj b25kIHNlbnRlbmNlIHRoYXQgeW91IE1VU1QgTk9UIGZhbGwgYmFjayB3aXRob3V0IGV4cGxpY2l0 IGNob2ljZT8gKHNpbWlsYXIgdG8gZm9yIHNlcnZlciBhdXRoZW50aWNhdGlvbj8pPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHA+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6Q2FsaWJyaSI+WWVzLCB0aGF0IHdhcyB0aGUgaW50ZW50aW9uLiBOZXcgdGV4dDoNCjwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSI+4oCcPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkEgVFVSTiBjbGllbnQgY291 bGQgZmFsbCBiYWNrIHRvIGNsZWFyIHRleHQgaWYgaXQgZG9lcyBub3Q8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkNhbGlicmkiPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPnN1cHBvcnQgdW5hdXRoZW50aWNhdGVkIChEKVRM UywgYnV0IE1VU1QgTk9UIGZhbGwgYmFjayB3aXRob3V0IGV4cGxpY2l0IGFkbWluaXN0cmF0b3Ig Y2hvaWNlLiBGYWxsYmFjayB0byBjbGVhciB0ZXh0IGlzIE5PVDwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6Q2FsaWJyaSI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+UkVDT01NRU5ERUQgYmVjYXVzZSBpdCBtYWtlcyB0aGUg Y2xpZW50IG1vcmUgc3VzY2VwdGlibGUgdG8gbWFuLWluLXRoZS1taWRkbGUgYXR0YWNrcyBhbmQg b24tcGF0aCBwYWNrZXQgaW5qZWN0aW9uLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 Q2FsaWJyaSI+4oCdPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPi1QcmFzaGFudGg8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjNzc3Nzc3IDEuNXB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNC4wcHQ7bWFyZ2luLWxlZnQ6MGluO21hcmdpbi1yaWdodDowaW47bWFy Z2luLWJvdHRvbTozLjc1cHQiPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkICM5OTk5OTkgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdDttYXJn aW4tbGVmdDowaW47bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjMuNzVwdCI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjojOTk5OTk5Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_5D00EE58C578490E8744C574DBF0654Cciscocom_-- From nobody Mon Oct 17 01:15:12 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 594801295BE; Mon, 17 Oct 2016 01:15:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.921 X-Spam-Level: X-Spam-Status: No, score=-0.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_MULTIPLE_AT=1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ingate.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id id0jfkyFVCKl; Mon, 17 Oct 2016 01:15:07 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40051.outbound.protection.outlook.com [40.107.4.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D19E6129591; Mon, 17 Oct 2016 01:15:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ingate.onmicrosoft.com; s=selector1-ingate-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=72OgObKCwfrlhc+Ec3LZNDEFrJRD1s4u1tfahw3dKYk=; b=IKPZEOZQwxLvDVu7rrbJnKpwtKegY3nVk34rLXFBt1a32UIZ55V4bN5RHYz5qFBH6qKIc46tSWuZmh4TNZicEnGPMQMqWRHlCdEznVI1jqJsRdwdq2Vc5eeQAFxk2O5nrtS79f79xog7lL7dRtWLvMa5WZOjYpl5AsXiBr13/IE= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=karl@ingate.com; Received: from Kallei7 (90.227.80.227) by AM4PR01MB1827.eurprd01.prod.exchangelabs.com (10.167.85.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.16; Mon, 17 Oct 2016 08:15:02 +0000 From: Karl Stahl To: "'Prashanth Patil (praspati)'" , 'Ben Campbell' , "'Tirumaleswar Reddy (tireddy)'" , 'Spencer Dawkins at IETF' References: <147269306853.31916.11958166980739260630.idtracker@ietfa.amsl.com> <362B7B05-81DA-49D7-8452-9BA21F991D00@nostrum.com> <94397E90-8765-4AAE-81C2-49B8C5B39132@nostrum.com> <23373C96-0D5F-4C0B-82EA-B93CE91ABA0F@nostrum.com> <06a5626c99c54b95864158677435fe79@XCH-RCD-017.cisco.com> <555D599A-12DE-4C73-870A-48597910EED2@nostrum.com> <5D00EE58-C578-490E-8744-C574DBF0654C@cisco.com> In-Reply-To: <5D00EE58-C578-490E-8744-C574DBF0654C@cisco.com> Date: Mon, 17 Oct 2016 10:14:59 +0200 Message-ID: <02b701d2284e$8fd421d0$af7c6570$@stahl@ingate.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_02B8_01D2285F.535CF1D0" X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AQHSChJSaICpZPYmxkqQAN2wEDY0faB5KI5ngAnd7BOAAEWaAIAf/V6AgADsjoCABDSFAIABB+Yg Content-Language: sv X-Originating-IP: [90.227.80.227] X-ClientProxiedBy: AM5PR0501CA0028.eurprd05.prod.outlook.com (10.164.187.38) To AM4PR01MB1827.eurprd01.prod.exchangelabs.com (10.167.85.25) X-MS-Office365-Filtering-Correlation-Id: b81fa8f6-0948-4270-fb6e-08d3f665b1e6 X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1827; 2:kCTkaB6LCWlUnVcEy6S6yXpmNWyV7rL3S3q8xvTwV0j8r0E6v4tkvZDtyr7fcq+nDyPRsWPb/EAoLLyk75sv3Zy+5O/XM9eRiDjD3IrL+P0LjgGpVnanvYkLSq4reSuiVmp2gCRZjaQVbAuER15TCMOziMmuvH4Yv3GUSiO7pYYhCAY+mslCFD/3KI0ZwhHhWfzfkaJwJgehJRLuZ5Ml0A==; 3:QcyeavL2XHTFogmSomwWMqHTuhDCTQT8rplfVZ/jUbUJ5QNY9LE0aA4Lx8X7v5hrAmccDlm3Ec0OIBBj6A6KdreZICCfgY/ALshS1PsKj+EZjUJS/mcVgi1FPw3yvfmchp6tQ0rZQe9Xtk+xCltGtw==; 25:WnPtE9w24PZPP2AHfkhHgP//8t3t8QvUK9CB42MHoRftAy1WfqObp7wXkgVUOXua6Tm3P3mYGNUkYOnXIS6alugP4ceOKG8M1a6crg8zQMh9veYxv5PuJWxq2y7NAd4fFVGjG6HxEhW4n4cbXfvtY4SrVkA1TkJU8C6oaxnfuazCeD3BP2dSk2ICmU7Fksj7x0OwnR9j5/PU/LG/B0QxToV4n1nv0zV/xKHHrHqApy+3OMqzx7Ah00S+1/OetbM6q2epe1Jkz0T4jaLbam/m0Jv50z2E635qbtdapfA6CpN0/kSN2A2wmKTMMSWZLGMPH8hctF3eXZ/YKPDwWfVHhqQcj8xWwenlsZkfi6TcpR3kpY0+sFe3Df/emoEzq/8tZEzvP5i/AYw+QzM/r9ZpDppmQCYqDPuUE7HgLPxNLKO3UazL4N6u9U6MHPr2TmiD X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:AM4PR01MB1827; X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1827; 31:uQbQPVA1ZICZOKNdvhbhClTZZtaOR+3nNGqdiKesGgEN//8Ub7bwY4MYlJceprz5wCdUMQ2MdzzueJTs8/eUn5PvaRysyElFfdUCASA+UqgRKlHafshXjzEvM8QX83JDBD+FeAAPmKEs/784S9m9GviK1LL3wsSHvGbXhjCy6gJ60EPzILyXJLJRi2MNDcGFRzbq9v+4TsZUxRGTGFh3Xkwkj2bfJMqnXeyxoxdXxBn6Fq99LU/1llgTcJ0JV5ZV; 4:8+yxyKx+Qp7F79fBP6G5RNBDwfv7eVIEKVw/IT6GdB7F1ZWy8XJIDnfYkHPRlh9h0GCaGBtddeMXRkSTUNphmMcFV7Nrfwa4ORY5jYHyYrPzVnGnFpq0DR0BJvxZqVv1l/0yFIIPQSPeBOurjNtNTkBULPVu2kiCSTZcEsiv997Ku16fhV0TCQiq5QyxPx3y8vHWNYYPqa+u9tLXMRzQdsBbKm9CEJf428GK3MhYslMz/zWwXtJTtmBK//KFtwPS+TAF5KP3tUaM151yTXQGlhnF+xQW4+8g0wdTX+qSwn6TUQD8uc1I3UVs2/Nsh2uGyoVH5kTF3V7onHOI+iR6WBP8uMNxry3Dq2eplyzK62qtJ9IKOxh6vQ8PieBSZUcB9qjIYLgQMUjfl/vZdp7z4TmryIXwkPhDnkmumNnMH779uVAwsLjNR6JTmK8g9C/mNHqdDWODe+pCFq3Dp60HW/4tmexsYUUmUmCocKr3S3l+SF+VnaI46+7rAY58WSnIvIHu5izj7nv5af/xaq03sNfdsABOjoWgCyDZCo0vvyU= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(192374486261705)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6043046)(6042046); SRVR:AM4PR01MB1827; BCL:0; PCL:0; RULEID:; SRVR:AM4PR01MB1827; X-Forefront-PRVS: 0098BA6C6C X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(7916002)(199003)(24454002)(189002)(377454003)(7826002)(15975445007)(106356001)(586003)(9686002)(7846002)(66066001)(16236675004)(81156014)(512874002)(7906003)(18717965001)(14726001)(8676002)(36756003)(71636004)(97736004)(7736002)(5001770100001)(19625215002)(5660300001)(19580395003)(19580405001)(92566002)(42186005)(101416001)(84326002)(33646002)(2950100002)(1420700001)(96836002)(19617315012)(2906002)(81166006)(93886004)(19300405004)(4326007)(6666003)(50986999)(102836003)(3846002)(6116002)(230783001)(76176999)(84116002)(68736007)(50226002)(790700001)(106116001)(61296003)(77096005)(105586002)(189998001)(229853001); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR01MB1827; H:Kallei7; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: None (protection.outlook.com: ingate.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; AM4PR01MB1827; 23:BQdZkIGCWJXuX6Mia/EQ2ix/QT1drZiQ0I29/BPtl?= =?us-ascii?Q?11YLSr8qC+zMds2/CpD+V/fM2eBSapdWBpkS3bW1Om8jxud6KkwRN0j3r8Ro?= =?us-ascii?Q?CC/zHw1oIcKHI8zHld6ZAyju9uuPJ/kcPs7POoepSOMYQS0i+QJVQcQFGnoC?= =?us-ascii?Q?/YnpluhRtIbFSqUTAzfCfiVBooxR+i83s7jLgBrG/SU4G6HbfR7wDHx34t0V?= =?us-ascii?Q?rWjuxgrU0aHlvleNBO2lEEZjP/J+q7CCMqdxRvaAzH0+FNcwfy24U6Y6uFzt?= =?us-ascii?Q?LejrOzMKJ9p9CPvxRC3XGWbblWYj9UrdgpaNwNJr6B45XohPYNIynRzhfiYF?= =?us-ascii?Q?W5AwXVL1yB8FdXBy9mGeKpKaf12YGhQ/pX7pgVDkEU1PGBOuI2KqL/C45Rau?= =?us-ascii?Q?JFEsrnuvlPuw/WNW3eTbdAkCvrjNz0sHtgj/H9lfOKkv9p+I8OKCOr+Xo+N1?= =?us-ascii?Q?pPyw7asumfXLAufs4tvrXJivffRU4DefrVxi1JEZL+7oH6ACZfUOPGhalE0F?= =?us-ascii?Q?CY6Pc1JPIuLC9iLxsfYmKFKURV2u+G+bgtcgbWzwr72b7DK60qMZCsGB/Ket?= =?us-ascii?Q?k0LMWAxV0deILC3aIcwu1r9Rl4gfG3tonx2+IjCDY/4k2Ko7en2nn2ktF0he?= =?us-ascii?Q?KMvskFUram5jfALigpmfwbbrqNQgBurN9NRXlB62V9DPvBhE8ER2lXULVoxI?= =?us-ascii?Q?0A3hXsib7OYrp4o7yy4jP9yjtHxlHzoRtSPU1cXGqSUjYpLjBpPZsPlJxVjS?= =?us-ascii?Q?LW9U4UdwijkN+JSMoDLBeDDDnAL//LDuL/1MZn7gEQdRdmItdAM2QVM2WUAR?= =?us-ascii?Q?v48YrlwKtu5p7sjGJq+NsIviw2AWyuv9OSuxi2hHqBFX2KCAedVFh/uqxWAM?= =?us-ascii?Q?KuOnR//33y+2B4T/mgVMLBWfaAtIOqUHL/pgDRyG3QaIoRRBpaWoIhpTd/O/?= =?us-ascii?Q?QJ1CClV2U3hz/K8mY0J6hwC3eGLHcq3IWIT446hf318BZTTRtSWbw7wJy3+l?= =?us-ascii?Q?bVQ9ddOIQGxoOWGqU/b820Z8j32R8HUN+LCrPxrciN5sw4SHNZxScRF6zRxu?= =?us-ascii?Q?9NXwSqW8ppJdIRufv970VUsi5PCw32Osb1k4jJj2ToYAyyM+d0o5aCJpAUPg?= =?us-ascii?Q?lbiBevy26fAdcthaDOQ2dkPW06QxvynWPH7TQmEm4CQlmPH5LLGHy4oPc0xU?= =?us-ascii?Q?oyzG+3SeIh6zQqGHmsfijpsxZuMMAQvItE/fQzJjFT2uNdZ/hA2Va1WEh8iR?= =?us-ascii?Q?gR4Lj6dNgN8jDc+WcpZTWOMXO4E+rct5tEv+lXywxznijy2Xq1KKiGGbyLG/?= =?us-ascii?Q?PG/XAhkMirONkyuNLwlEZ7jiRAX+U4pP8w03/ut+sMlRM8+6FRWsep1Y8cgh?= =?us-ascii?Q?vg6zLXDisp1g4kpb4J1scxs/V+SdDaEonb+UENhPNESArakoJ3IDwBQ0fskZ?= =?us-ascii?Q?jxGO+iyqqBX5RIEJHQRfWc7SbPoOv0cj00ZkO2W7/qQG3eE0Dft?= X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1827; 6:FK1UkCDosbWhT0/AbEd8UxeQDiEnASwwWQlJ74ryW7XblPxnz5pamx5ad8XTysCRnfTmSHIjE5/27EMthc0SXrlgLXF3j3lx2+y17R5GJI7IDmZ3gC8D0gBkX3lNcYh/7GCMSvhlXUaydAy+P0vgGlUgYzB7t5WBsxvjWEx2QW0ScDs4pJjUTgrJJyRoeJjoXMdLuPRZrGIY09KCxdPPlHoYPB43nqaWYFx343cpSoauaxN6a81Rugta1KdlZiTxOFzoevY3Lq2InqQySR4tbimSfBm4NqBr9aufXX7vCQ0P9ESJjJC7KTU59+B/Lu6xH+X0jEJfelEY4x4YI6nfTw==; 5:/sGnqwKKkL36g+Pdl+TtCBVfy/p5bkXXQ3aWa5ywzpTmpQKu9pd7rBHT8WPb/A++O188tzQzZGdS+EeNUQDPADhspN6pjNwAcZTfTELTiDEefrlch8T42hKgY8WuvPK768gIszo3xRLol9z8wTquGw==; 24:hy7GobUsj+g8IeHdsp9QI/bDiBLPtpuiu+L4QP3vrgboo7mX/3+txAGrqiSQ8bu8oU6/UJztuTj0QIUrPY6qi+sOebYj5wM9nidFjOMiRTA= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1827; 7:FSgC2UvPwpQYo1RhVMEhCQ/cs2rkapJ2U8hU/oUR2WJyc4C2KMprp48ItajRAOHW6eOAaJ0UX7OXAW4EPYbL4AwPaVrB4gDrwV4HsxyY31+o6JnprWRzswHhBQooj16AHejxh25McGP7efCNFQI/fPD62IkvFxHK56LfaG3Pxuzbk+Un+zVrXQWfnxqOH4eEAazxIne7OUhr+Rw9sZJTYCdytkYP8tbYVkOsFwMCQibLwvLuo6B4KduSFfT763TfS4q5MjPgerkBLAu98qcyR4TtfMIh+uPo71oT1/lPayjlbdxF5hzrJtvrzDu1up7Onw884pKEvGvhIb23FfF2dKAWn6OfrM/aSjOBSgNBlKs= X-OriginatorOrg: ingate.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Oct 2016 08:15:02.1112 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR01MB1827 Archived-At: Cc: tram-chairs@ietf.org, 'Simon Perreault' , draft-ietf-tram-turn-server-discovery@ietf.org, tram@ietf.org, 'The IESG' Subject: Re: [tram] Ben Campbell's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and COMMENT) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Oct 2016 08:15:09 -0000 ------=_NextPart_000_02B8_01D2285F.535CF1D0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Prashanth, =20 You have not addressed that (D)TLS cannot be mandated (as introduced = during this discuss), which Ben asked about. See inline below. =20 Please also address the first point in = https://www.ietf.org/mail-archive/web/tram/current/msg02191.html=20 which has not been handled since first highlighted February 10 during = version -06 of this draft. =20 Thanks, Karl =20 Fr=C3=A5n: tram [mailto:tram-bounces@ietf.org] F=C3=B6r Prashanth Patil = (praspati) Skickat: den 14 oktober 2016 22:21 Till: Ben Campbell; Tirumaleswar Reddy (tireddy) Kopia: tram@ietf.org; Simon Perreault; = draft-ietf-tram-turn-server-discovery@ietf.org; The IESG; = tram-chairs@ietf.org =C3=84mne: Re: [tram] Ben Campbell's Discuss on = draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and COMMENT) =20 Thanks, Ben. Inline..=20 =20 On 10/11/16, 2:07 PM, "Ben Campbell" wrote: =20 Hi, This version helps, and I will clear my DISCUSS. I assume Spencer will = figure out the Right Thing to do to make sure the update to 5766 gets = the right review. I have a few minor comments on the resulting text. None of these are = showstoppers: =C2=B7 Absrtact: Please mention that this draft updates 5766 to = relax the requirement for authentication in certain cases in the = abstract. =C2=B7 9, 2nd paragraph, "Making STUN authentication OPTIONAL = ..." Since you already used a 2119 MAY in the previous paragraph, there's no = need for the 2119 OPTIONAL here. (In general, 2119 keywords should be = used to state requirements, not talk about existing requirements) Agreed. Will update accordingly.=20 -9, third paragraph: I saw a comment on my DISCUSS email thread from Karl Stahl, stating that = DTLS could not be mandated. Has that input been considered? (I don't = have an opinion; I just want to make sure people noticed the comment.) Yes, I believe this has already been discussed.=20 [Karl] But the input has NOT BEEN CONSIDERED (Which is what Ben = questions.)=20 Please read = https://www.ietf.org/mail-archive/web/tram/current/msg02191.html=20 Throwing in the DTLS mandate has now (with the text in version -10 of = the draft) destroyed this draft, making unusable for its main purpose. =20 As suggested in the last paragraph of the section, not mandating DTLS = opens up man-in-the-middle attacks and on-path packet injection. [Karl] With a network provided turn server, the turn client is seeking a = better path for the real-time traffic than through the default gateway. = You cannot put any higher requirements or ideas of protection on sending = the real-time traffic to that network provided turn than to the default = gateway. =20 And also: =20 [Karl] In = = https://www.ietf.org/mail-archive/web/tram/current/msg02191.html I = pointed out: It seem like it is forgotten that a protocol like WebRTC (which really = needs this specification to finally deal with the old NAT/Firewall = traversal problem that has been plaguing the real-time communication = over the Internet for 15 years now), provides security and trust in = itself for the media exchanged between endpoints =E2=80=93 It does not = have to be added by the TURN server. And specifically, for the network = provided TURN server, where the purpose of the TURN server is to offer a = better working path for the real-time media than through the default = gateway (where media otherwise has to pass) =E2=80=93 you cannot/must = not expect that it also gives you some higher trust or security level = that when it goes through the default gateway. =20 Please read complete = = https://www.ietf.org/mail-archive/web/tram/current/msg02191.html and = address! -9, 9th paragraph: "Instead, with an explicit administrator choice, a = TURN client SHOULD fall-back to encryption-only (D)TLS when (D)TLS = authentication is not available." I=E2=80=99m not sure what SHOULD means after adding the explicit choice = part. Does that means the administrator SHOULD make that choice? Is the = point that you can fall back, but MUST NOT do so without explicit = choice? It was the latter ie MUST NOT do so without explicit choice. New text: =E2=80=9CA TURN client could fall back to encryption-only = (D)TLS when (D)TLS authentication is not available, but MUST NOT fall = back without explicit administrator choice.=E2=80=9D [Karl] This is also a showstopper making this draft unusable for its = main purpose. Simply take it away. Again, is it really up to a discovery = draft to specify usage? -9, 10th paragraph: -- The first sentence is now redundant with the previous paragraph. Yes, will remove it. -- is the point of the first part of the second sentence that you MUST = NOT fall back without explicit choice? (similar to for server = authentication?) Yes, that was the intention. New text: =E2=80=9CA TURN client could fall = back to clear text if it does not support unauthenticated (D)TLS, but = MUST NOT fall back without explicit administrator choice. Fallback to = clear text is NOT RECOMMENDED because it makes the client more = susceptible to man-in-the-middle attacks and on-path packet = injection.=E2=80=9D [Karl] No, again see above and read complete = https://www.ietf.org/mail-archive/web/tram/current/msg02191.html and = address! -Prashanth =20 ------=_NextPart_000_02B8_01D2285F.535CF1D0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Pr= ashanth,

 

Yo= u have not addressed that (D)TLS cannot be mandated (as introduced = during this discuss), which Ben asked about. See inline = below.

 

Pl= ease also address the first point in https://www.ietf.org/mail-archive/web/tram/current/msg02191.html =

wh= ich has not been handled since first highlighted February 10 during = version -06 of this draft.

 

Th= anks,

Ka= rl

 

Fr=C3=A5n: tram = [mailto:tram-bounces@ietf.org] F=C3=B6r Prashanth Patil = (praspati)
Skickat: den 14 oktober 2016 22:21
Till: = Ben Campbell; Tirumaleswar Reddy (tireddy)
Kopia: = tram@ietf.org; Simon Perreault; = draft-ietf-tram-turn-server-discovery@ietf.org; The IESG; = tram-chairs@ietf.org
=C3=84mne: Re: [tram] Ben Campbell's = Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and = COMMENT)

 

Thanks, = Ben.

Inline.. =

 =

On 10/11/16, 2:07 PM, "Ben Campbell" <ben@nostrum.com> = wrote:

 =

Hi,

This = version helps, and I will clear my DISCUSS. I assume Spencer will figure = out the Right Thing to do to make sure the update to 5766 gets the right = review.

I have a = few minor comments on the resulting text. None of these are = showstoppers:

=C2=B7        = ; Absrtact: = Please mention that this draft updates 5766 to relax the requirement for = authentication in certain cases in the abstract.

=C2=B7        = ; 9, 2nd = paragraph, "Making STUN authentication OPTIONAL = ..."

Since you = already used a 2119 MAY in the previous paragraph, there's no need for = the 2119 OPTIONAL here. (In general, 2119 keywords should be used to = state requirements, not talk about existing = requirements)

Agreed. = Will update accordingly.

-9, third = paragraph:
I saw a comment on my DISCUSS email thread from Karl = Stahl, stating that DTLS could not be mandated. Has that input been = considered? (I don't have an opinion; I just want to make sure people = noticed the comment.)

Yes, I =
believe this has already been discussed. 
[Karl] But the =
input has NOT BEEN CONSIDERED (Which is what Ben questions.) =

Please read https://www.ietf.org/mail-archive/web/tram/current/msg02191.html =

Throwing in the =
DTLS mandate has now (with the text in version -10 of the draft) =
destroyed this draft, making unusable for its main =
purpose.
 =

As =
suggested in the last paragraph of the section, not mandating DTLS opens up man-in-the-middle attacks and on-path =
packet injection.
[Karl] With a =
network provided turn server, the turn client is seeking a better path =
for the real-time traffic than through the default gateway. You cannot =
put any higher requirements or ideas of protection on sending the =
real-time traffic to that network provided turn than to the default =
gateway.
 
And =
also:
 
[Karl] In =
https://www.ietf.org/mail-archive/web/tram/current/msg02191.=
html I pointed out:
It =
seem like it is forgotten that a protocol like WebRTC (which really =
needs this specification to finally deal with the old NAT/Firewall =
traversal problem that has been plaguing the real-time communication =
over the Internet for 15 years now), provides security and trust in =
itself for the media exchanged between endpoints =E2=80=93 It does not =
have to be added by the TURN server. And specifically, for the network =
provided TURN server, where the purpose of the TURN server is to offer a =
better working path for the real-time media than through the default =
gateway (where media otherwise has to pass) =E2=80=93 you cannot/must =
not expect that it also gives you some higher trust or security level =
that when it goes through the default =
gateway.
 
Please read =
complete https://www.ietf.org/mail-archive/web/tram/current/msg02191.=
html and =
address!

-9, 9th = paragraph: "Instead, with an explicit administrator choice, a TURN = client SHOULD fall-back to encryption-only (D)TLS when (D)TLS = authentication is not available."
I=E2=80=99m not sure what = SHOULD means after adding the explicit choice part. Does that means the = administrator SHOULD make that choice? Is the point that you can fall = back, but MUST NOT do so without explicit = choice?

It was the = latter ie MUST NOT do so without explicit = choice.

New text: = =E2=80=9CA TURN = client could fall back to encryption-only (D)TLS when (D)TLS = authentication is not available, but MUST NOT fall back without explicit = administrator choice.=E2=80=9D<= /p>

[K= arl] This is also a showstopper making this draft unusable for its main = purpose. Simply take it away. Again, is it really up to a discovery = draft to specify usage?

-9, 10th = paragraph:
-- The first sentence is now redundant with the previous = paragraph.

Yes, will = remove it.


-- is = the point of the first part of the second sentence that you MUST NOT = fall back without explicit choice? (similar to for server = authentication?)

Yes, that = was the intention. New text: =E2=80=9CA TURN = client could fall back to clear text if it does not support = unauthenticated (D)TLS, but MUST NOT fall back without explicit = administrator choice. Fallback to clear text is NOT RECOMMENDED= because it makes the client more susceptible to man-in-the-middle = attacks and on-path packet injection.=E2=80=9D<= /p>

[K= arl] No, again see above and read complete https://www.ietf.org/mail-archive/web/tram/current/msg02191.html = and address!

-Prashanth

 

------=_NextPart_000_02B8_01D2285F.535CF1D0-- From nobody Mon Oct 17 01:15:55 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6278D129591; Mon, 17 Oct 2016 01:15:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.921 X-Spam-Level: X-Spam-Status: No, score=-0.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_MULTIPLE_AT=1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ingate.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QzSbhfkOb2hu; Mon, 17 Oct 2016 01:15:47 -0700 (PDT) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20070.outbound.protection.outlook.com [40.107.2.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BCE7D1295BF; Mon, 17 Oct 2016 01:15:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ingate.onmicrosoft.com; s=selector1-ingate-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=dG68vuR7z/qjfHJ9yYt1BzjXjjBdfCNksFqAfq2hd4Q=; b=Kq+Zulovm1Rm3WXlC6XbjHpk0ME5X44dfrTyoN9nbkhMrqPrcz3NSWbCruD1s7mKBUw+Lf5Phr+MlO+EKEOjn35W+ruLRdKyCwJEtilCvyA+msI9156Qqt0rGvSVmMo0Ahgh8IPz/u4iFKhDsxMyYZYP/wxBK+OvcOdq6mxdo7k= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=karl@ingate.com; Received: from Kallei7 (90.227.80.227) by HE1PR01MB1834.eurprd01.prod.exchangelabs.com (10.165.228.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.659.11; Mon, 17 Oct 2016 08:15:32 +0000 From: Karl Stahl To: 'Spencer Dawkins at IETF' , 'The IESG' , References: <147265807396.13320.16720268350417791956.idtracker@ietfa.amsl.com> <21b2559f2a234c64b47595eb4615c661@XCH-RCD-017.cisco.com> <932002F5-18BA-46E7-9C71-EC985A0FCFDC@fastmail.fm> <12ED9DC3-7950-4517-A005-2B29F5D08C09@fastmail.fm> <9b0692f895bc497f8f0aa2b63ed5be27@XCH-RCD-017.cisco.com> <05aa01d220a2$ee812ec0$cb838c40$@stahl@ingate.com> In-Reply-To: <05aa01d220a2$ee812ec0$cb838c40$@stahl@ingate.com> Date: Mon, 17 Oct 2016 10:15:30 +0200 Message-ID: <02bc01d2284e$a25fe780$e71fb680$@stahl@ingate.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_02BD_01D2285F.65E8B780" X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AdIgRCgcWDNdnLuISReJejZqndrE5gAQQbJAAZM/9mA= Content-Language: sv X-Originating-IP: [90.227.80.227] X-ClientProxiedBy: AM5PR0501CA0017.eurprd05.prod.outlook.com (10.164.187.27) To HE1PR01MB1834.eurprd01.prod.exchangelabs.com (10.165.228.24) X-MS-Office365-Filtering-Correlation-Id: a682c9a6-f373-4cdb-a87c-08d3f665c46c X-Microsoft-Exchange-Diagnostics: 1; HE1PR01MB1834; 2:Esv9j6N64zW64XWn/ZacZ29qa7BZ8nio0urLDouQgMS022ybQIXaJIAWpPHsYMcn3f50nP0OE6tbXX7nqSm/NukdKKUzkav2go0ZdiWICkc9XcbQapm9seT5nt/JJUBOp+0bsY3Ae2mqZro+Ms+bPFGlDYevjmNujSNqg03uxytcdk1Otv8wdbW5pwmzF8inDq0FdD0WJa8jk/IRYtYpjg==; 3:OQT4hXhIFlrxct+iE9XadI5404Xg0hrbsxPl+T9vB6FynYGoAhztt9RcLInK3FPSfN4BNtw0nlwfiKfh1g9p18VynWJtNCpAByRZMiv60XP+Pd385Flz9L0dkRmH+ydEP4VOhygJiWjgLm044R8obw== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HE1PR01MB1834; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; HE1PR01MB1834; 25:MIrbSTeyDb22vRV4150QP5OQmXiFiNOshI2mu8jjJ?= =?us-ascii?Q?8LsIw4KJhQP/BrtBu89Q8faYdWQg6716gOaXmicfHthwck8MjvCi3Ku/6Da4?= =?us-ascii?Q?qolMAI2itIpEddE651powrNzwnPYEnYSvclPz4MpHXm1iSihXhxXloJPL05a?= =?us-ascii?Q?YcXKeQxOyvfc3WTAYOilVCfn789ZjrUmptzPwvF12wVwhBqAm32yZ8xo2D97?= =?us-ascii?Q?pQLzV/tRJxoDxBbspBoENo/wXmCrINWXU0Qhy5nFCe83Ru5g9WAC5MylgdGq?= =?us-ascii?Q?4BQEV3nl1DtJLlNAVjRMZQqp/Beq9Ptz5avbdpUGJyHLsKInavhETQhZ691e?= =?us-ascii?Q?Rzevu7b//3EejucN5TeM91r4emK7pZc717J7DbPtrklNkZ5qzZIFMTR7Ugcp?= =?us-ascii?Q?YcmQDsBknta+7CqshrsCwy4e6+nPiAgziKpX8PxEn8sihMoMmhxzUuEWpYVA?= =?us-ascii?Q?bCT5E6iF0gVPQy/GFjmPbZxh5TVg16rSgf0S1EO2csDmzdE5pl8UkUlpxwxl?= =?us-ascii?Q?eRAHBU5zsxemLVaVnBtsWzOTAoqxx8xu+1athP+GrpCKfUfl2O/xbwSeLCgH?= =?us-ascii?Q?04qKPgxC7vYQ624O0qMpwQDs4VqsC4kqY7tTkIfLldhvqSge9QVyOxJaOMV4?= =?us-ascii?Q?ejykp2NyI5tBtUP3CT/Dtk9CZFsGH9OO80ZUKBozGMJU+8gCGqUOq8WFsjp/?= =?us-ascii?Q?X0sJzVSOY5yuekN1PbbsJoKVsW3zBhoZzB0fd9+U6iS39hyIzzfNGK3GmNup?= =?us-ascii?Q?ux51sSY9k80TCT+74Xu2I7OD4b/k2+XTyD1euI3T1UbF9h0rnijUPDC6xn/E?= =?us-ascii?Q?LgTCjIc0B9XfOZN6fTAJO0kk+vXLJMBq/p8lG5qPUEAJ5ryjovW24HH51jdp?= =?us-ascii?Q?Bzhgm+EexMq6yo3wp68X+IdLqq7sBpm56ekP17HG/Bc/nqqxPi74o3FS8myY?= =?us-ascii?Q?b3Q/zZYjMaxHAyV3U/j5FirDCaN+uC+KIXOJwnOn90V7QcrEq7k0JWzy+Xxj?= =?us-ascii?Q?g3TVfSohZwQvSaZ8bGUVWskf02pRpyOfu/kddTOEUx3P2p8AOo5Tqv5bUHmt?= =?us-ascii?Q?Q/LTMJsBBvrCfXHS0MA50GnO+PN?= X-Microsoft-Exchange-Diagnostics: 1; HE1PR01MB1834; 31:bO9+q7+ce4Rwn9QHpI8US7jATHY5Pm1VpXN2O7GADeHZj5sHGpLLC5J7DL1/YIKresesYJUMRnm7SLHZmXZ4XrN/lm74/D+cN0IPO+zBFJ7l06yDFoFetZo5jqgQ+HZ14JKOqjXICF+0Nu0iAVHSiT/ym5Q04JyrL+OIe2gMj324xCddM0SV7IvfEgdfnTfcMECUIrLUSgjoZt5cI3OJj+eeQKm6hrzbApxbfjYczzuvMa/LjT0AYL6+3iX0LB1v; 4:vZJcU9GJ4yjaJAN3eNm8rZdujZ10nSHaR3FwDNAWb/3QXwloO6uDvKmdC0SQPz+e21rUOk3MCAogIgKy55PtZoalIXve27UGcCeWfPkoMzX71amycIiLglqWnWq9LEyUJ8zbiV+pXMG4rz937yefcjdUn1AQou/QkxEp6y8F0GuYVmmGyU6pNioNIKmtSrRTkSvRFIgshFtSPSi1ny3nyN8ngNoWNQJsj7oLbzywqjsIXfkKobSsnCDfO7cCcVCUNIYfWJtf+UXCwd4i0pBTb8F/AxRBwYVrSxg+zmmvK2zLmi+pk3EwGRTthpm3qRmcLAvJQZw28kXMf+A+1+/+cMbyViSNsybU2Alz2vtzEZ/5ejnOpIdyRWxdyKHjzoR7PNLglKTX6SVUbDBe1VdhyxpQUQph4EhUps0UVM1OpDZlQK8jJ+CF1yes/kvTIOUffRcmt5kRIuFVZ1veWf2JbnuL47xStaOf/51gdf/NFO7InFsOz31jmuw7n0CymD61p8zxTHZ8X7kQ5e8WmyFF6P4hXheQxzMrqn2zKn/kWAXKfOMa8shGI7wmS97maa1Lkt1i7+w8Eqqiqb7X7xsrDDgPNfu1XcTRuaIou4dUbicCTqx8vSBnhrFhFEgrLGBH X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(120809045254105)(192374486261705)(95692535739014)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6043046)(6042046); SRVR:HE1PR01MB1834; BCL:0; PCL:0; RULEID:; SRVR:HE1PR01MB1834; X-Forefront-PRVS: 0098BA6C6C X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(7916002)(189002)(377454003)(13464003)(24454002)(199003)(19580395003)(19617315012)(551544002)(14726001)(33646002)(8676002)(93886004)(9686002)(19300405004)(16236675004)(68736007)(230783001)(81166006)(97736004)(7906003)(512874002)(84116002)(189998001)(790700001)(6116002)(102836003)(3846002)(105586002)(106356001)(586003)(19625215002)(61296003)(2950100002)(1420700001)(5660300001)(42186005)(7826002)(71636004)(66066001)(101416001)(7736002)(5001770100001)(76176999)(81156014)(7846002)(84326002)(19580405001)(15975445007)(92566002)(4326007)(2906002)(18717965001)(50986999)(36756003)(77096005)(8666005)(96836002)(50226002)(229853001)(7059030)(579004); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR01MB1834; H:Kallei7; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: ingate.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; HE1PR01MB1834; 23:OFcMDaeRe4neDWi4DK4lC6y4sZzIER9bzSao/qPVP?= =?us-ascii?Q?lZmy9XjF1IqsH/T5pheBQkiDMLjdnr8bwm6+RJSD45A1FTSLRPs4xnOQ/GGy?= =?us-ascii?Q?dUFiCWTyQIdc1oUqRo/u6ai89u4XQH7b6cuFgZrNNwZr+Fr+nax0W5QdLbLh?= =?us-ascii?Q?EbvCVcrCVC9Sk69msdfKbaDdFJbsn7lMIjSPGp+TJLyUTZSVXrh6eiXn6Ye1?= =?us-ascii?Q?v+wQFbOIYL9I5d4MaKoIftIx1NCihec0okaASSsuRIyEWlW2EwaOVK3GmzHg?= =?us-ascii?Q?GEZawNJjbvr0a7dmZHP1g7FjL2gVlg8FIGUqvp6uXlCux/1kXZfRxsPRz+xy?= =?us-ascii?Q?OYwIqV/rV/5V3UPm14RvNQI82muUQLMaobMrW9hAeUthkhIUt61RtkIA+Cp2?= =?us-ascii?Q?hsDZvSCk1Y0rny2TdjOrQIISO5Evt6QIHQOo/XOfJKjV3YBkkYN7MXswMzNl?= =?us-ascii?Q?HDzAUhtb46RUr04EUsdJTihMTynEVA+mk2/pZc3GCIfhvCarPB27SJQN16ZM?= =?us-ascii?Q?AmCt7yCpg8q6MezvydRFaPlaJniVS/kuUHAuiBFiFsc2zKs8k7Wv8H6vOvXB?= =?us-ascii?Q?oagGd7IYbzO/dBhmZmuVz9shOQZiL13R5iVvhtzxYFQUTsyPtoumq7rKHdY8?= =?us-ascii?Q?Ye0p15yOrqJdfLIHKD+xoPSz2s26kTjOxzbbIIH6AKFWaHvG2zl5sYRqi8MR?= =?us-ascii?Q?zH2tk42qHpc0Pz97Er/hu8TiH5SjC5BHJZtFGw0PYoYxXf76zaTZwLQEM31l?= =?us-ascii?Q?jPQV/+7tBdiVA1Sj2G1WVXtxKEHhLRkDz/SIiA11WLwNwu7QMm+o+13wiOGE?= =?us-ascii?Q?r3xMPIycG7lNDoB4gcVHAIzHrJBjJ19HiDRjTxwa1fwPiiIF9/A8Q8kg8/DM?= =?us-ascii?Q?BDTd99Lujq8EmMHhV+TFRSlk1w5UWQ3hAD3nsYzkcDoxMCbP0YIQjiz8SitE?= =?us-ascii?Q?Q/Tfn9we81ys+OQPTJqw9Z7jqIiIiSoKbyNM1RmTfGZxrf/pmUHfCSTFiVxt?= =?us-ascii?Q?mj4RavROMoRIAnHPGanf1W/1m4YAI0oMivJbxnZ8hCfxBf839UimuznEOux/?= =?us-ascii?Q?Q748ANQBHs85Np8Cd1SEIw3udaxKMh0Fasgf1pv0dGFnZTyUdH343rAkvlKt?= =?us-ascii?Q?619fiQpqogeiiI1FL5GGcpBu0Xk52nzkzRfvPtIo+ZCtjmIwRjww4p+khFOM?= =?us-ascii?Q?unmDEEd30nS2eTTJV641xOZOxwmmRscvnUgN+zeDiPwDNBiLJOiXZTjwQjVb?= =?us-ascii?Q?GduXxQlQC9UNnqKCflPe4pKevWTbKORoYqxXmW5zFDIWqpKK27rkNIa35N0r?= =?us-ascii?Q?oORq13jAfdMDryZZOci2k4M07cBpz8xqZspHJ2g9oaAc0iAXiX8KGAyZZb++?= =?us-ascii?Q?cHG1Fuloh+AH8RxwxjoduKASChL2M7SfXO8jU9dB8ybVFYayu9F/l3VmMkQq?= =?us-ascii?Q?wAtWOcbxe7rc+bsvKOJe3UoLskvejQb9z2zTLT3ZXqVTZKDySZC6+BhvkUiW?= =?us-ascii?Q?i/D+bdDEAz4AMl5R2Dz8NVCHQ4zWU7qMXE=3D?= X-Microsoft-Exchange-Diagnostics: 1; HE1PR01MB1834; 6:lb49sIX11IH8Qbiw+mLchPdHi6TdhsD7NJFoz5PqVhqlw9DjdE/FzFbwcCqov2qZGCmMXjwB4wp8qKIOSC6R1hTL9XcQ+pTHo45VA+BEUsizSvRVQDizhWGFrhrVlwO2Pe5qkng2xuwF2RolFMm2U4a4L28g/K9aCzJIHdXGyxpGfINtQcYPY9If/3l5jFahAOHwd2MdytBUR0NAPJp0547hgw+xvHQLP9NiEux3JkPnLfs9UEMzXXniMJ6AwW+rS+x7piXxMJN0eghrsFueAUlRAQPPK3xHs9dmyXcBe+nZ8uqxoTW0DcuSULyeTvFzkHFdcDf3RGc77aZtiNvTTQ==; 5:BZyeLVC+ZNkIGQpTiLM2t6vdLZJudZuW5xiQm++VBuUb01crZk35p3S5zeb04ZpV2w78K/2W380VNcusvdtjH3lDE+x7HltrHN7YdCo2mLYlRMZfOVgesEsSWyV2xSsbG1yVSkVb5EHENYSYVwk1Ag==; 24:XBUTRcOny7Ij/NRifdzhDVrA3x8tPifTpapcDbiVzaEamBzCCIoiAllQYKfGBjYnHRAztAPin5GfdDFLli+YGilPQ0PoP4f//5L3KDpABOo= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; HE1PR01MB1834; 7:Jmw8X+inEUZZv1gtPZKh5OL5yZuNGDEDN/kF7wiB8gUiDHSr7ilIkbJ2IFwjRfRFCH05SnaQ/qyLZWxT0ssHFwwTMSvBf7z0KZfXqvofJZmSV7WzbleDzEqqhw04RnlAu4oMTtqIkYB6ytdLOoUERhJzSl19rDDVsPrKuFae5eMkLB6fS4u1TjegHI08jQPLs2KNr2Z5F+deEYMOEsDl8EMN24EXQcaFaXlnzB4PLZYGvUo/AcuK1L5XapgLuggWGJu5MgxHV4r19mtX7WF0hg7BcAQwMCcO4pHeiurVf+X1ljUexi+nvkFroJna2x023lMXw52Xx4XQQMR8y/FfGTuHlvJqEZwJah6MN0+2slA= X-OriginatorOrg: ingate.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Oct 2016 08:15:32.9701 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR01MB1834 Archived-At: Cc: 'Simon Perreault' , draft-ietf-tram-turn-server-discovery@ietf.org, tram@ietf.org, "'Tirumaleswar Reddy \(tireddy\)'" , 'Alexey Melnikov' Subject: Re: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Oct 2016 08:15:50 -0000 ------=_NextPart_000_02BD_01D2285F.65E8B780 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Spencer, =20 Can the authors of this discovery draft =E2=80=9Cbe ordered=E2=80=9D to = address the two points below? =20 Point 2) was (unnecessarily) introduced during the DISCUSS (I just highlighted to the WG list that it is NOT addressed, in spite of = what is said by an author.) =20 Point 1) has repeatedly been pointed out on this WG list since version = -06 of the draft, but ignored by the authors. =20 =20 As the text is in this version -10 of the draft now is, it does NOT = fulfill its purpose to discover a network provided TURN server to allow = real-time communication, in situations where it otherwise is not = possible or bad. - It does not provide a method suitable for draft-ietf-rtcweb-return-01 - It does not meet the autoconfiguration of RFC 7478 (Web Real-Time = Communication Use Cases and Requirements) 2.3.5.1.=20 =20 More generally (regarding the mandating of (D)TLS, suddenly introduced = during the DISCUSS): We should be able to use WebRTC everywhere we can and do surf, and for = firewall/NAT traversal and quality it is in many cases necessary to = parallel the local firewall/access router/default gateway with a TURN = server, to get a good media path. The automatic discovery of such = network provided turn server should be given by this draft, but it = should NOT set up restrictions for it usage (especially when it is = unnecessary and blocks the general usage e.g. such as specified in = draft-ietf-rtcweb-return-01).=20 =20 The authors of this draft seem to have some other use case in mind, but = that must not block the usage for which this discovery specification was = required.=20 As written in this version -10 of the draft, it is a showstopper. =20 /Karl =20 =20 Fr=C3=A5n: tram [mailto:tram-bounces@ietf.org] F=C3=B6r Karl Stahl Skickat: den 7 oktober 2016 15:59 Till: 'Spencer Dawkins at IETF'; 'Tirumaleswar Reddy (tireddy)' Kopia: tram-chairs@ietf.org; tram@ietf.org; 'Alexey Melnikov'; = draft-ietf-tram-turn-server-discovery@ietf.org; 'Simon Perreault'; 'The = IESG' =C3=84mne: [tram] Need to be fixed! Discuss on = draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) Prioritet: H=C3=B6g =20 Two things in this draft -10 needs to fixed! =20 1) As pointed out during the DISCUSS=20 https://www.ietf.org/mail-archive/web/tram/current/msg02144.html=20 and two times earlier (during WG discussions, but not addressed or = responded to by the authors): = https://www.ietf.org/mail-archive/web/tram/current/msg02081.html and=20 https://www.ietf.org/mail-archive/web/tram/current/msg01976.html=20 =20 The Anycast method does not work with RFC5766 TURN servers! That has not been addressed at all. =20 A TURN server doesn't react one way (answering 300 Try Alternate) when addressed by an anycast address and another way (accepting the Allocate request) when addressed by its unicast address, does it?=20 =20 I suggested this modification: =20 "When a client requires TURN services, it sends a STUN binding request = to the assigned anycast address. The STUN server responds with a 300 (Try Alternate) error as described in [RFC5389]; = The response contains a unicast address in the ALTERNATE-SERVER attribute, = which the client compares with the source address of the response and if the addresses are the same, it is an indication to use the TURN server at = that address.=20 =20 For subsequent communication with the TURN server, the client uses that responding server's unicast address." =20 This proposed change has important advantages for security and = usefulness for draft-ietf-rtcweb-return-01 also.=E2=80=9D =20 With the current text for the anycast method (and we do need an anycast = method since it is the only method proposed that can be easily deployed = and on any network), would the consequence not be that it has to be = spelled out that *RFC5766 is updated* so that TURN servers to be = provided by the network and discovered MUST respond with =E2=80=9C300 = Try Alternate=E2=80=9D for an allocate request when addressed by the = anycast address, (but NOT if addressed by its unicast addressed)? =20 =20 2) The introduction in this draft -10 of =E2=80=9CI think we can = mandate (D)TLS *if* STUN authentication or third-party authorization is = not used=E2=80=9D=20 during the DISCUSS, was protested against (but has still been = introduced). I said: =20 [Karl] We cannot mandate a higher security or trust level for a TURN = server provided by the network, paralleling the firewall/access = router/default gateway, when the client want to place its real-time = traffic through the turn server path, than through the default gateway = path. =20 And, shall this *discovery* specification really mandate *usage*? I am e.g. thinking about the WebRTC browser use case of = draft-ietf-rtcweb-return-01. It must be up to that RETURN draft to = define the *usage*, not up to a discovery draft. =20 The use cases I have in mind (and I don't see that TURN D(TLS) can fit) = are: The "autoconfiguration" of RFC 7478 (Web Real-Time Communication Use Cases and Requirements) 2.3.5.1. or more generally: =E2=80=9CYou need be able to use WebRTC everywhere you can surf and for = firewall traversal and quality, you need to parallel the local = firewall/access router/default gateway with a TURN server=E2=80=9D =20 This must work generally (for all services) on a LAN, Internet Caf=C3=A9 = or GoGo WiFi, where the network provider offers us a better path for = real-time traffic (through the TURN server). =20 It seem like it is forgotten that a protocol like WebRTC (which really = needs this specification to finally deal with the old NAT/Firewall = traversal problem that has been plaguing the real-time communication = over the Internet for 15 years now), provides security and trust in = itself for the media exchanged between endpoints =E2=80=93 It does not = have to be added by the TURN server. And specifically, for the network = provided TURN server, where the purpose of the TURN server is to offer a = better working path for the real-time media than through the default = gateway (where media otherwise has to pass) =E2=80=93 you cannot/must = not expect that it also gives you some higher trust or security level = that when it goes through the default gateway.=20 =20 Also remember that DISCOVERY, in itself is about making a service = available to a client without the client having to be specifically = configured for it =E2=80=93 and we cannot then specify that it should do = some authentication or validation based on password or certificate = checking that has to be configured somehow. =20 Such idea blocks the very purpose of this draft, and has been discussed = in various forms several times during the WG draft and can therefore = *not be introduced now*. Again, it seems like the main use case for this = draft - to be able to use good WebRTC communication wherever you can = surf =E2=80=93 is forgotten.=20 =20 I suggest everything related to =E2=80=9CA TURN client MUST use (D)TLS = in the absence of STUN long-term credential mechanism=E2=80=9D under 9. Security Considerations is = deleted. =20 If we really want anything of this in this specification, a compromise = could be this change: =20 A TURN client NOT using encryption of the media stream that passes = through the TURN server (WebRTC even mandates DTLS-SRPT) may=20 use (D)TLS in the absence of STUN long-term credential mechanism =20 /Karl =20 =20 Fr=C3=A5n: tram [mailto:tram-bounces@ietf.org] F=C3=B6r Spencer Dawkins = at IETF Skickat: den 7 oktober 2016 04:40 Till: Tirumaleswar Reddy (tireddy) Kopia: tram-chairs@ietf.org; tram@ietf.org; Alexey Melnikov; = draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault; The = IESG =C3=84mne: Re: [tram] Alexey Melnikov's Discuss on = draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) =20 Hi, Alexey, =20 On Mon, Sep 5, 2016 at 9:05 PM, Tirumaleswar Reddy (tireddy) = wrote: > -----Original Message----- > From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > Sent: Friday, September 2, 2016 2:02 PM > To: Tirumaleswar Reddy (tireddy) > Cc: The IESG ; = draft-ietf-tram-turn-server-discovery@ietf.org; > Simon Perreault ; tram-chairs@ietf.org; = tram@ietf.org > Subject: Re: Alexey Melnikov's Discuss on draft-ietf-tram-turn-server- > discovery-09: (with DISCUSS) > > Hi, > > On 2 Sep 2016, at 04:02, Tirumaleswar Reddy (tireddy) = > wrote: > > >> -----Original Message----- > >> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > >> Sent: Thursday, September 1, 2016 12:49 PM > >> To: Tirumaleswar Reddy (tireddy) > >> Cc: The IESG ; > >> draft-ietf-tram-turn-server-discovery@ietf.org; > >> Simon Perreault ; tram-chairs@ietf.org; > >> tram@ietf.org > >> Subject: Re: Alexey Melnikov's Discuss on > >> draft-ietf-tram-turn-server- > >> discovery-09: (with DISCUSS) > >> > >> Hi, > >> > >> On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy) > >> > >> wrote: > >> > >>>> -----Original Message----- > >>>> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > >>>> Sent: Wednesday, August 31, 2016 9:11 PM > >>>> To: The IESG > >>>> Cc: draft-ietf-tram-turn-server-discovery@ietf.org; Simon = Perreault > >>>> ; tram-chairs@ietf.org; sperreault@jive.com; > >>>> tram@ietf.org > >>>> Subject: Alexey Melnikov's Discuss on > >>>> draft-ietf-tram-turn-server-discovery- > >>>> 09: (with DISCUSS) > >>>> > >>>> Alexey Melnikov has entered the following ballot position for > >>>> draft-ietf-tram-turn-server-discovery-09: Discuss > >>>> > >>>> When responding, please keep the subject line intact and reply to > >>>> all email addresses included in the To and CC lines. (Feel free = to > >>>> cut this introductory paragraph, however.) > >>>> > >>>> > >>>> Please refer to > >>>> https://www.ietf.org/iesg/statement/discuss-criteria.html > >>>> for more information about IESG DISCUSS and COMMENT positions. > >>>> > >>>> > >>>> The document, along with other ballot positions, can be found = here: > >>>> = https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discov > >>>> er > >>>> y/ > >>>> > >>>> > >>>> > >>>> = ------------------------------------------------------------------- > >>>> -- > >>>> - > >>>> DISCUSS: > >>>> = ------------------------------------------------------------------- > >>>> -- > >>>> - > >>>> > >>>> In Section 9: > >>>> > >>>> o For certificate-based authentication, a pre-populated trust = anchor > >>>> store [RFC6024] allows a TURN client to perform path = validation > >>>> for the server certificate obtained during the (D)TLS = handshake. > >>>> > >>>> If the client used a domain name to discover the TURN server, = that > >>>> domain name also provides a mechanism for validation of the = TURN > >>>> server. The client MUST use the rules and guidelines given = in > >>>> section 6 of [RFC6125] to validate the TURN server identity. > >>>> > >>>> I am glad that you are referencing RFC 6125, but unfortunately = you > >>>> don't provide enough details. Please add details as specified in > >>>> Section 3 of RFC > >>>> 6125 to your document. > >>> > >>> Sure, will add the following lines: > >>> Certification authorities that issue TURN server certificates = SHOULD > >>> support > >> the DNS-ID and SRV-ID identifier types. TURN service providers = SHOULD > >> include the DNS-ID and SRV-ID identifier types in certificate = requests. > >> > >> What about use of CN-IDs and URI-IDs? > > > > Yes, added. > > Just to clarify: you can pick which ones of the 4 types you want to = use, you can > disallow some. You just have to be explicit. Okay. > > > >> Wildcards ? > > > > I don't think wildcards are required. > > Please say so in the document. Sure, will update. -Tiru =20 It looks to me as if -10 should address your Discuss. Could you take a = look and confirm that? =20 Thanks! =20 Spencer=20 ------=_NextPart_000_02BD_01D2285F.65E8B780 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Sp= encer,

 

Ca= n the authors of this discovery draft =E2=80=9Cbe ordered=E2=80=9D to = address the two points below?

 

Po= int 2) was (unnecessarily) introduced during the = DISCUSS

(I= just highlighted to the WG list that it is NOT addressed, in spite of = what is said by an author.)

 

Po= int 1) has repeatedly been pointed out on this WG list since version -06 = of the draft, but ignored by the authors. =C2=A0

 

As= the text is in this version -10 of the draft now is, it does NOT = fulfill its purpose to discover a network provided TURN server to allow = real-time communication, in situations where it otherwise is not = possible or bad.

- = It does not provide a method suitable for draft-ietf-rtcweb-return-01

- = It does not meet the autoconfiguration of RFC 7478 (Web Real-Time = Communication Use Cases and Requirements) 2.3.5.1. =

 

Mo= re generally (regarding the mandating of (D)TLS, suddenly introduced = during the DISCUSS):

We= should be able to use WebRTC everywhere we can and do surf, and for = firewall/NAT traversal and quality it is in many cases necessary to = parallel the local firewall/access router/default gateway with a TURN = server, to get a good media path. The automatic discovery of such = network provided turn server should be given by this draft, but it = should NOT set up restrictions for it usage (especially when it is = unnecessary and blocks the general usage e.g. such as specified in = draft-ietf-rtcweb-return-01).=

 

Th= e authors of this draft seem to have some other use case in mind, but = that must not block the usage for which this discovery specification was = required.

As= written in this version -10 of the draft, it is a = showstopper.

 

/K= arl

 

 

Fr=C3=A5n: tram = [mailto:tram-bounces@ietf.org] F=C3=B6r Karl = Stahl
Skickat: den 7 oktober 2016 15:59
Till: = 'Spencer Dawkins at IETF'; 'Tirumaleswar Reddy = (tireddy)'
Kopia: tram-chairs@ietf.org; tram@ietf.org; 'Alexey = Melnikov'; draft-ietf-tram-turn-server-discovery@ietf.org; 'Simon = Perreault'; 'The IESG'
=C3=84mne: [tram] Need to be fixed! = Discuss on draft-ietf-tram-turn-server-discovery-10: (with = DISCUSS)
Prioritet: = H=C3=B6g

 

Tw= o things in this draft -10 needs to fixed!

 

1)= As pointed out during the DISCUSS

https://www.ietf.org/mail-archive/web/tram/current/msg02144.html =

an= d two times earlier (during WG discussions, but not addressed or = responded to by the authors):

https://www.ietf.org/mail-archive/web/tram/current/msg02081.= html and

https://www.ietf.org/mail-archive/web/tram/current/msg01976.html =

 

The Anycast method does not work with RFC5766 TURN servers! = That has not

been addressed at all.

 

A TURN server doesn't react one = way (answering 300 Try Alternate) when

addressed by an anycast address = and another way (accepting the Allocate

request) when addressed by its = unicast address, does it?

 

I suggested this = modification:

 

"When a client requires TURN services, it sends a STUN = binding request to

the assigned anycast address.  The STUN = server

responds with a 300 (Try Alternate) error as described in = [RFC5389];  The

response contains a unicast address in the ALTERNATE-SERVER = attribute, which

the client compares with the source address of the response = and if the

addresses are the same, it is an indication to use the TURN = server at that

address.

 

For subsequent communication = with the TURN server, the client uses that

responding server's unicast = address."

 

This proposed change has important advantages for security = and usefulness

for draft-ietf-rtcweb-return-01 = also.=E2=80=9D

 

Wi= th the current text for the anycast method (and we do need an anycast = method since it is the only method proposed that can be easily deployed = and on any network), would the consequence not be that it has to be = spelled out that *RFC5766 is updated* so that TURN servers to be = provided by the network and discovered MUST respond with = =E2=80=9C300 Try = Alternate=E2=80=9D = for an allocate request when addressed by the anycast address, (but NOT = if addressed by its unicast addressed)?

 

 

2)= The  introduction in this draft -10 of =E2=80=9CI think we can mandate (D)TLS *if* STUN authentication or = third-party authorization is not used=E2=80=9D

du= ring the DISCUSS, was protested against (but has still been introduced). = I said:

 

[Karl] We cannot mandate a higher security or trust level = for a TURN server provided by the network, paralleling the = firewall/access router/default gateway, when the client want to place = its real-time traffic through the turn server path, than through the = default gateway path.

 

And, shall this *discovery* specification really mandate = *usage*?

I am e.g. thinking about the WebRTC browser use case of = draft-ietf-rtcweb-return-01. It must be up to that RETURN draft to = define the *usage*, not up to a discovery draft.

 

The use cases I have in mind = (and I don't see that TURN D(TLS) can fit) are:

The = "autoconfiguration" of RFC 7478 (Web Real-Time Communication = Use

Cases and Requirements) 2.3.5.1. or more = generally:

=E2=80=9CYou need be able to use WebRTC everywhere you can = surf and for firewall traversal and quality, you need to parallel the = local firewall/access router/default gateway with a TURN = server=E2=80=9D

 

This must work generally (for all services) on a LAN, = Internet Caf=C3=A9 or GoGo WiFi, where the network provider offers us a = better path for real-time traffic (through the TURN = server).

 

It= seem like it is forgotten that a protocol like WebRTC (which really = needs this specification to finally deal with the old NAT/Firewall = traversal problem that has been plaguing the real-time communication = over the Internet for 15 years now), provides security and trust in = itself for the media exchanged between endpoints =E2=80=93 It does not = have to be added by the TURN server. And specifically, for the network = provided TURN server, where the purpose of the TURN server is to offer a = better working path for the real-time media than through the default = gateway (where media otherwise has to pass) =E2=80=93 you cannot/must = not expect that it also gives you some higher trust or security level = that when it goes through the default gateway.

 

Al= so remember that DISCOVERY, in itself is about making  a service = available to a client without the client having to be specifically = configured for it =E2=80=93 and we cannot then specify that it should do = some authentication or validation based on password or certificate = checking that has to be configured somehow.

 

Su= ch idea blocks the very purpose of this draft, and has been discussed in = various forms several times during the WG draft and can therefore *not = be introduced now*. Again, it seems like the main use case for this = draft - to be able to use good WebRTC communication wherever you can = surf =E2=80=93 is forgotten.

 

I = suggest everything related to =E2=80=9CA TURN client MUST use (D)TLS in the = absence of STUN long-term

   = credential mechanism=E2= =80=9D under 9. Security Considerations is = deleted.

 

If= we really want anything of this in this specification, a compromise = could be this change:

 

   A TURN = client =  NOT using encryption of the media stream that passes through the = TURN server (WebRTC even mandates DTLS-SRPT) may =

 use (D)TLS in the absence of = STUN long-term credential mechanism

 

/K= arl

 

 

Fr=C3=A5n: tram [mailto:tram-bounces@ietf.org] = F=C3=B6r Spencer Dawkins at IETF
Skickat: den 7 oktober = 2016 04:40
Till: Tirumaleswar Reddy (tireddy)
Kopia: = tram-chairs@ietf.org; tram@ietf.org; Alexey Melnikov; draft-ietf= -tram-turn-server-discovery@ietf.org; Simon Perreault; The = IESG
=C3=84mne: Re: [tram] Alexey Melnikov's Discuss on = draft-ietf-tram-turn-server-discovery-09: (with = DISCUSS)

 

Hi, = Alexey,

 

On Mon, = Sep 5, 2016 at 9:05 PM, Tirumaleswar Reddy (tireddy) <tireddy@cisco.com> wrote:

> -----Original Message-----
> From: Alexey = Melnikov [mailto:aamelnikov@fastmail.fm]

> Sent: Friday, = September 2, 2016 2:02 PM
> To: Tirumaleswar Reddy (tireddy) = <tireddy@cisco.com>
> Cc: The IESG <iesg@ietf.org>; = draft-ietf-tram-turn-server-discovery@ietf.org;
= > Simon Perreault <sperreault@jive.com>; tram-chairs@ietf.org; tram@ietf.org
> Subject: Re: Alexey = Melnikov's Discuss on draft-ietf-tram-turn-server-
> discovery-09: = (with DISCUSS)
>
> Hi,
>
> On 2 Sep 2016, at = 04:02, Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
> = wrote:
>
> >> -----Original Message-----
> = >> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]
> >> Sent: = Thursday, September 1, 2016 12:49 PM
> >> To: Tirumaleswar = Reddy (tireddy) <tireddy@cisco.com>
> >> Cc: The = IESG <iesg@ietf.org>;
> >> draft-ietf-tram-turn-server-discovery@ietf.org;
= > >> Simon Perreault <sperreault@jive.com>; tram-chairs@ietf.org;
> >> tram@ietf.org
> >> Subject: Re: Alexey = Melnikov's Discuss on
> >> = draft-ietf-tram-turn-server-
> >> discovery-09: (with = DISCUSS)
> >>
> >> Hi,
> >>
> = >> On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy)
> = >> <tireddy@cisco.com>
> >> = wrote:
> >>
> >>>> -----Original = Message-----
> >>>> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]
> >>>> = Sent: Wednesday, August 31, 2016 9:11 PM
> >>>> To: = The IESG <iesg@ietf.org>
> >>>> Cc: draft-ietf-tram-turn-server-discovery@ietf.org; = Simon Perreault
> >>>> <sperreault@jive.com>; tram-chairs@ietf.org; sperreault@jive.com;
> >>>> tram@ietf.org
> >>>> Subject: = Alexey Melnikov's Discuss on
> >>>> = draft-ietf-tram-turn-server-discovery-
> >>>> 09: = (with DISCUSS)
> >>>>
> >>>> Alexey = Melnikov has entered the following ballot position for
> = >>>> draft-ietf-tram-turn-server-discovery-09: = Discuss
> >>>>
> >>>> When = responding, please keep the subject line intact and reply to
> = >>>> all email addresses included in the To and CC lines. = (Feel free to
> >>>> cut this introductory paragraph, = however.)
> >>>>
> >>>>
> = >>>> Please refer to
> >>>> https://www.ietf.org/iesg/statement/discuss-criteria.ht= ml
> >>>> for more information about IESG DISCUSS = and COMMENT positions.
> >>>>
> = >>>>
> >>>> The document, along with other = ballot positions, can be found here:
> >>>> https://datatracker.ietf.org/doc/draft-ietf-tram-turn-s= erver-discov
> >>>> er
> >>>> = y/
> >>>>
> >>>>
> = >>>>
> >>>> = -------------------------------------------------------------------
&g= t; >>>> --
> >>>> -
> = >>>> DISCUSS:
> >>>> = -------------------------------------------------------------------
&g= t; >>>> --
> >>>> -
> = >>>>
> >>>> In Section 9:
> = >>>>
> >>>> o  For certificate-based = authentication, a pre-populated trust anchor
> = >>>>     store [RFC6024] allows a TURN client = to perform path validation
> >>>>    =  for the server certificate obtained during the (D)TLS = handshake.
> >>>>
> >>>>  =    If the client used a domain name to discover the TURN = server, that
> >>>>     domain name = also provides a mechanism for validation of the TURN
> = >>>>     server.  The client MUST use = the rules and guidelines given in
> >>>>    =  section 6 of [RFC6125] to validate the TURN server = identity.
> >>>>
> >>>> I am glad = that you are referencing RFC 6125, but unfortunately you
> = >>>> don't provide enough details. Please add details as = specified in
> >>>> Section 3 of RFC
> = >>>> 6125 to your document.
> >>>
> = >>> Sure, will add the following lines:
> >>> = Certification authorities that issue TURN server certificates = SHOULD
> >>> support
> >> the DNS-ID and = SRV-ID identifier types. TURN service providers SHOULD
> >> = include the DNS-ID and SRV-ID identifier types in certificate = requests.
> >>
> >> What about use of CN-IDs and = URI-IDs?
> >
> > Yes, added.
>
> Just to = clarify: you can pick which ones of the 4 types you want to use, you = can
> disallow some. You just have to be = explicit.

Okay.

> >
> >> Wildcards = ?
> >
> > I don't think wildcards are = required.
>
> Please say so in the document.

Sure, = will update.

-Tiru

 

It looks to me as if -10 should address your Discuss. = Could you take a look and confirm that?

 

Thanks!

 

Spencer 

------=_NextPart_000_02BD_01D2285F.65E8B780-- From nobody Mon Oct 17 19:17:06 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED34C1294F3; Mon, 17 Oct 2016 19:16:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7xMg_aFBnLS1; Mon, 17 Oct 2016 19:16:54 -0700 (PDT) Received: from mail-yb0-x22f.google.com (mail-yb0-x22f.google.com [IPv6:2607:f8b0:4002:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79F52129498; Mon, 17 Oct 2016 19:16:54 -0700 (PDT) Received: by mail-yb0-x22f.google.com with SMTP id x128so17268046ybg.1; Mon, 17 Oct 2016 19:16:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=lwEXgM9CKoBPJs57zxVNgSDrfH6SzNiH6b/DMWr5B24=; b=sXkwe1/H5iq46cE7vpUufQyPJrfhp6DX+MwhM4XvtcDD5kwnJ5MatV2GvAM5DPrhro OYZx+OX1kx+gK3kGz6LW45lwwi5nDaCbPSgCyJOynoHN/muQ5lUG+1xCc/Kj/Al1ZumE OMqVkvNrWIF2e6Kx2GYORwDmf8jTOeBm0QDCzHl1m5h4DjTrh0E/7IE6BC/HOS7yuBWa 2YKv9alPPKdaVyXnJUcz6uuIISbN+yuqq3pYSw3lq97cDOC14HWb2dRgLO6ckymwHkI7 GqT2p8jGa6u2bjChFqKfiB2oviXipHh4lDPw0KvHHKk0KVzXLblFejiskNTqSsG2m0+N OHpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=lwEXgM9CKoBPJs57zxVNgSDrfH6SzNiH6b/DMWr5B24=; b=mxHyVcGbwyXRESWP3NNYoH8A1hbhGt6fuMNbh5HrluKsF2DnjAHp+0JH11iYp6RHC0 WEfeB9I2ucoOCBQGpRcVUEcXNljcpTUSOXxZeY+gUYAfdmXIZXmtGzEqjk/V/MAR3NPZ xEH8245iKnMKjGCgW8GqdhwWSQHJImdkzZilkwXdlFKNfujY/yzAyBAnW/kkLp9SONJC ldppskoNd5M/DxIzUyYDNnX1wyHHd3a8wZWCXfqIixcVAUuo28USmVGyVpBlLkKm7Qh0 nJABVkboiLVespiIQpaXoErwwrZzxy0M0gk46+I5+doxGM13LNISFnG3fMSVhdcoRN3P Z8mQ== X-Gm-Message-State: AA6/9RkXNj+ESYM0JyP0XWkRyWucbhQ8gAM/11uq+rZmymtkFyK/9iQGHCH3fsr9KMVVFPkgPX9Rz/JFpgF4gA== X-Received: by 10.37.70.196 with SMTP id t187mr477729yba.121.1476757013601; Mon, 17 Oct 2016 19:16:53 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.92.67 with HTTP; Mon, 17 Oct 2016 19:16:52 -0700 (PDT) In-Reply-To: <580488ba.0718430a.1bdd4.f89aSMTPIN_ADDED_BROKEN@mx.google.com> References: <147265807396.13320.16720268350417791956.idtracker@ietfa.amsl.com> <21b2559f2a234c64b47595eb4615c661@XCH-RCD-017.cisco.com> <932002F5-18BA-46E7-9C71-EC985A0FCFDC@fastmail.fm> <12ED9DC3-7950-4517-A005-2B29F5D08C09@fastmail.fm> <9b0692f895bc497f8f0aa2b63ed5be27@XCH-RCD-017.cisco.com> <580488ba.0718430a.1bdd4.f89aSMTPIN_ADDED_BROKEN@mx.google.com> From: Spencer Dawkins at IETF Date: Mon, 17 Oct 2016 21:16:52 -0500 Message-ID: To: Karl Stahl Content-Type: multipart/alternative; boundary=001a113f453c3746c4053f1a493a Archived-At: Cc: "tram-chairs@ietf.org" , "tram@ietf.org" , Alexey Melnikov , draft-ietf-tram-turn-server-discovery@ietf.org, "Tirumaleswar Reddy \(tireddy\)" , Simon Perreault , The IESG Subject: Re: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2016 02:16:58 -0000 --001a113f453c3746c4053f1a493a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi, Karl, On Mon, Oct 17, 2016 at 3:15 AM, Karl Stahl wrote: > Spencer, > > > > Can the authors of this discovery draft =E2=80=9Cbe ordered=E2=80=9D to a= ddress the two > points below? > > > > Point 2) was (unnecessarily) introduced during the DISCUSS > > (I just highlighted to the WG list that it is NOT addressed, in spite of > what is said by an author.) > > > > Point 1) has repeatedly been pointed out on this WG list since version -0= 6 > of the draft, but ignored by the authors. > Just so you know, I've added this draft to the IESG informal telechat agenda for this week, to talk about what we should do next. Ideally, that resolution will make sense to you. Just in case it doesn't, you might want to take a look at https://tools.ietf.org/html/rfc2026#section-6.5 on "Conflict Resolution and Appeals". Given that we're still talking about how to handle the draft, my suggestion is to wait until some version is actually approved, which is an action you can actually appeal. We're in the part of the process that's rather formal now. We'll all need to follow the steps defined in IETF consensus BCPs so that what we do next isn't the subject of a successful appeal (which gets us right back here, after wasting time). Thanks for your understanding and patience. Spencer As the text is in this version -10 of the draft now is, it does NOT fulfill > its purpose to discover a network provided TURN server to allow real-time > communication, in situations where it otherwise is not possible or bad. > > - It does not provide a method suitable for draft-ietf-rtcweb-return-01 > > - It does not meet the autoconfiguration of RFC 7478 (Web Real-Time > Communication Use Cases and Requirements) 2.3.5.1. > > > > More generally (regarding the mandating of (D)TLS, suddenly introduced > during the DISCUSS): > > We should be able to use WebRTC everywhere we can and do surf, and for > firewall/NAT traversal and quality it is in many cases necessary to > parallel the local firewall/access router/default gateway with a TURN > server, to get a good media path. The automatic discovery of such network > provided turn server should be given by this draft, but it should NOT set > up restrictions for it usage (especially when it is unnecessary and block= s > the general usage e.g. such as specified in draft-ietf-rtcweb-return-01). > > > > The authors of this draft seem to have some other use case in mind, but > that must not block the usage for which this discovery specification was > required. > > As written in this version -10 of the draft, it is a showstopper. > > > > /Karl > > > > > > *Fr=C3=A5n:* tram [mailto:tram-bounces@ietf.org] *F=C3=B6r *Karl Stahl > *Skickat:* den 7 oktober 2016 15:59 > *Till:* 'Spencer Dawkins at IETF'; 'Tirumaleswar Reddy (tireddy)' > *Kopia:* tram-chairs@ietf.org; tram@ietf.org; 'Alexey Melnikov'; > draft-ietf-tram-turn-server-discovery@ietf.org; 'Simon Perreault'; 'The > IESG' > *=C3=84mne:* [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-ser= ver-discovery-10: > (with DISCUSS) > *Prioritet:* H=C3=B6g > > > > Two things in this draft -10 needs to fixed! > > > > 1) As pointed out during the DISCUSS > > https://www.ietf.org/mail-archive/web/tram/current/msg02144.html > > and two times earlier (during WG discussions, but not addressed or > responded to by the authors): > > https://www.ietf.org/mail-archive/web/tram/current/msg02081.html and > > https://www.ietf.org/mail-archive/web/tram/current/msg01976.html > > > > The Anycast method does not work with RFC5766 TURN servers! That has not > > been addressed at all. > > > > A TURN server doesn't react one way (answering 300 Try Alternate) when > > addressed by an anycast address and another way (accepting the Allocate > > request) when addressed by its unicast address, does it? > > > > I suggested this modification: > > > > "When a client requires TURN services, it sends a STUN binding request to > > the assigned anycast address. The STUN server > > responds with a 300 (Try Alternate) error as described in [RFC5389]; The > > response contains a unicast address in the ALTERNATE-SERVER attribute, > which > > the client compares with the source address of the response and if the > > addresses are the same, it is an indication to use the TURN server at tha= t > > address. > > > > For subsequent communication with the TURN server, the client uses that > > responding server's unicast address." > > > > This proposed change has important advantages for security and usefulness > > for draft-ietf-rtcweb-return-01 also.=E2=80=9D > > > > With the current text for the anycast method (and we do need an anycast > method since it is the only method proposed that can be easily deployed a= nd > on any network), would the consequence not be that it has to be spelled o= ut > that *RFC5766 is updated* so that TURN servers to be provided by the > network and discovered MUST respond with =E2=80=9C300 Try Alternate=E2=80= =9D for an > allocate request when addressed by the anycast address, (but NOT if > addressed by its unicast addressed)? > > > > > > 2) The introduction in this draft -10 of =E2=80=9CI think we can mandate= (D)TLS > *if* STUN authentication or third-party authorization is not used=E2=80= =9D > > during the DISCUSS, was protested against (but has still been introduced)= . > I said: > > > > [Karl] We cannot mandate a higher security or trust level for a TURN > server provided by the network, paralleling the firewall/access > router/default gateway, when the client want to place its real-time traff= ic > through the turn server path, than through the default gateway path. > > > > And, shall this *discovery* specification really mandate *usage*? > > I am e.g. thinking about the WebRTC browser use case of > draft-ietf-rtcweb-return-01. It must be up to that RETURN draft to define > the *usage*, not up to a discovery draft. > > > > The use cases I have in mind (and I don't see that TURN D(TLS) can fit) > are: > > The "autoconfiguration" of RFC 7478 (Web Real-Time Communication Use > > Cases and Requirements) 2.3.5.1. or more generally: > > =E2=80=9CYou need be able to use WebRTC everywhere you can surf and for f= irewall > traversal and quality, you need to parallel the local firewall/access > router/default gateway with a TURN server=E2=80=9D > > > > This must work generally (for all services) on a LAN, Internet Caf=C3=A9 = or > GoGo WiFi, where the network provider offers us a better path for real-ti= me > traffic (through the TURN server). > > > > It seem like it is forgotten that a protocol like WebRTC (which really > needs this specification to finally deal with the old NAT/Firewall > traversal problem that has been plaguing the real-time communication over > the Internet for 15 years now), provides security and trust in itself for > the media exchanged between endpoints =E2=80=93 It does not have to be ad= ded by the > TURN server. And specifically, for the network provided TURN server, wher= e > the purpose of the TURN server is to offer a better working path for the > real-time media than through the default gateway (where media otherwise h= as > to pass) =E2=80=93 you cannot/must not expect that it also gives you some= higher > trust or security level that when it goes through the default gateway. > > > > Also remember that DISCOVERY, in itself is about making a service > available to a client without the client having to be specifically > configured for it =E2=80=93 and we cannot then specify that it should do = some > authentication or validation based on password or certificate checking th= at > has to be configured somehow. > > > > Such idea blocks the very purpose of this draft, and has been discussed i= n > various forms several times during the WG draft and can therefore *not be > introduced now*. Again, it seems like the main use case for this draft - = to > be able to use good WebRTC communication wherever you can surf =E2=80=93 = is > forgotten. > > > > I suggest everything related to =E2=80=9CA TURN client MUST use (D)TLS in= the > absence of STUN long-term > > credential mechanism=E2=80=9D under 9. Security Considerations is dele= ted. > > > > If we really want anything of this in this specification, a compromise > could be this change: > > > > A TURN client NOT using encryption of the media stream that passes > through the TURN server (WebRTC even mandates DTLS-SRPT) may > > use (D)TLS in the absence of STUN long-term credential mechanism > > > > /Karl > > > > > > *Fr=C3=A5n:* tram [mailto:tram-bounces@ietf.org ] = *F=C3=B6r *Spencer > Dawkins at IETF > *Skickat:* den 7 oktober 2016 04:40 > *Till:* Tirumaleswar Reddy (tireddy) > *Kopia:* tram-chairs@ietf.org; tram@ietf.org; Alexey Melnikov; > draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault; The IESG > *=C3=84mne:* Re: [tram] Alexey Melnikov's Discuss on > draft-ietf-tram-turn-server-discovery-09: (with DISCUSS) > > > > Hi, Alexey, > > > > On Mon, Sep 5, 2016 at 9:05 PM, Tirumaleswar Reddy (tireddy) < > tireddy@cisco.com> wrote: > > > -----Original Message----- > > From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > > > Sent: Friday, September 2, 2016 2:02 PM > > To: Tirumaleswar Reddy (tireddy) > > Cc: The IESG ; draft-ietf-tram-turn-server- > discovery@ietf.org; > > Simon Perreault ; tram-chairs@ietf.org; > tram@ietf.org > > Subject: Re: Alexey Melnikov's Discuss on draft-ietf-tram-turn-server- > > discovery-09: (with DISCUSS) > > > > Hi, > > > > On 2 Sep 2016, at 04:02, Tirumaleswar Reddy (tireddy) > > > wrote: > > > > >> -----Original Message----- > > >> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > > >> Sent: Thursday, September 1, 2016 12:49 PM > > >> To: Tirumaleswar Reddy (tireddy) > > >> Cc: The IESG ; > > >> draft-ietf-tram-turn-server-discovery@ietf.org; > > >> Simon Perreault ; tram-chairs@ietf.org; > > >> tram@ietf.org > > >> Subject: Re: Alexey Melnikov's Discuss on > > >> draft-ietf-tram-turn-server- > > >> discovery-09: (with DISCUSS) > > >> > > >> Hi, > > >> > > >> On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy) > > >> > > >> wrote: > > >> > > >>>> -----Original Message----- > > >>>> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm] > > >>>> Sent: Wednesday, August 31, 2016 9:11 PM > > >>>> To: The IESG > > >>>> Cc: draft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreaul= t > > >>>> ; tram-chairs@ietf.org; sperreault@jive.com; > > >>>> tram@ietf.org > > >>>> Subject: Alexey Melnikov's Discuss on > > >>>> draft-ietf-tram-turn-server-discovery- > > >>>> 09: (with DISCUSS) > > >>>> > > >>>> Alexey Melnikov has entered the following ballot position for > > >>>> draft-ietf-tram-turn-server-discovery-09: Discuss > > >>>> > > >>>> When responding, please keep the subject line intact and reply to > > >>>> all email addresses included in the To and CC lines. (Feel free to > > >>>> cut this introductory paragraph, however.) > > >>>> > > >>>> > > >>>> Please refer to > > >>>> https://www.ietf.org/iesg/statement/discuss-criteria.html > > >>>> for more information about IESG DISCUSS and COMMENT positions. > > >>>> > > >>>> > > >>>> The document, along with other ballot positions, can be found here= : > > >>>> https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-disco= v > > >>>> er > > >>>> y/ > > >>>> > > >>>> > > >>>> > > >>>> ------------------------------------------------------------------= - > > >>>> -- > > >>>> - > > >>>> DISCUSS: > > >>>> ------------------------------------------------------------------= - > > >>>> -- > > >>>> - > > >>>> > > >>>> In Section 9: > > >>>> > > >>>> o For certificate-based authentication, a pre-populated trust > anchor > > >>>> store [RFC6024] allows a TURN client to perform path validatio= n > > >>>> for the server certificate obtained during the (D)TLS handshak= e. > > >>>> > > >>>> If the client used a domain name to discover the TURN server, > that > > >>>> domain name also provides a mechanism for validation of the TU= RN > > >>>> server. The client MUST use the rules and guidelines given in > > >>>> section 6 of [RFC6125] to validate the TURN server identity. > > >>>> > > >>>> I am glad that you are referencing RFC 6125, but unfortunately you > > >>>> don't provide enough details. Please add details as specified in > > >>>> Section 3 of RFC > > >>>> 6125 to your document. > > >>> > > >>> Sure, will add the following lines: > > >>> Certification authorities that issue TURN server certificates SHOUL= D > > >>> support > > >> the DNS-ID and SRV-ID identifier types. TURN service providers SHOUL= D > > >> include the DNS-ID and SRV-ID identifier types in certificate > requests. > > >> > > >> What about use of CN-IDs and URI-IDs? > > > > > > Yes, added. > > > > Just to clarify: you can pick which ones of the 4 types you want to use= , > you can > > disallow some. You just have to be explicit. > > Okay. > > > > > > >> Wildcards ? > > > > > > I don't think wildcards are required. > > > > Please say so in the document. > > Sure, will update. > > -Tiru > > > > It looks to me as if -10 should address your Discuss. Could you take a > look and confirm that? > > > > Thanks! > > > > Spencer > > _______________________________________________ > tram mailing list > tram@ietf.org > https://www.ietf.org/mailman/listinfo/tram > > --001a113f453c3746c4053f1a493a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi, Karl,

On Mon, Oct 17, 2016 at 3:15 AM, Karl Stahl <= karl.stahl@ingat= e.com> wrote:
=

Spencer,

=C2=A0

Can = the authors of this discovery draft =E2=80=9Cbe ordered=E2=80=9D to address= the two points below?

=C2=A0

Poin= t 2) was (unnecessarily) introduced during the DISCUSS=

(I just highlighted to the WG list th= at it is NOT addressed, in spite of what is said by an author.)

=C2=A0<= /p>

Point 1) has repeatedly been pointed o= ut on this WG list since version -06 of the draft, but ignored by the autho= rs. =C2=A0


Just so you know, I've added this draft to the IESG informal telecha= t agenda for this week, to talk about what we should do next.
Ideally, that resolution will make sense to you. Just in case i= t doesn't, you might want to take a look at=C2=A0https://tools.ietf.org/html/rfc2026#s= ection-6.5 on "Conflict Resolution and Appeals".
Given that we're still talking about how to handle the dra= ft, my suggestion is to wait until some version is actually approved, which= is an action you can actually appeal.

We'= re in the part of the process that's rather formal now. We'll all n= eed to follow the steps defined in IETF consensus BCPs so that what we do n= ext isn't the subject of a successful appeal (which gets us right back = here, after wasting time).

Thanks for your underst= anding and patience.

Spencer

<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">

As the text is in this version -1= 0 of the draft now is, it does NOT fulfill its purpose to discover a networ= k provided TURN server to allow real-time communication, in situations wher= e it otherwise is not possible or bad.

- It does not provide a method suitable for draft-ietf-rtcweb-return-01

=

- It does not meet the autoconfiguration = of RFC 7478 (Web Real-Time Communication Use Cases and Requirements) 2.3.5.= 1.

=C2=A0=

More generally (regardi= ng the mandating of (D)TLS, suddenly introduced during the DISCUSS):=

We should be able to us= e WebRTC everywhere we can and do surf, and for firewall/NAT traversal and = quality it is in many cases necessary to parallel the local firewall/access= router/default gateway with a TURN server, to get a good media path. The a= utomatic discovery of such network provided turn server should be given by = this draft, but it should NOT set up restrictions for it usage (especially = when it is unnecessary and blocks the general usage e.g. such as specified = in draft-ietf-rtcweb-return-01).

=C2= =A0

The authors of this = draft seem to have some other use case in mind, but that must not block the= usage for which this discovery specification was required. <= /span>

As written in this version -10 = of the draft, it is a showstopper.

=C2=A0

/Karl

= =C2=A0

=C2=A0=

=

Fr=C3=A5n: tram [mailto:tram-bounces@ietf.org] F=C3=B6r Karl Stahl
<= b>Skickat: den 7 oktober 2016 15:59
Till: 'Spencer Dawkin= s at IETF'; 'Tirumaleswar Reddy (tireddy)'
Kopia: tram-chairs@ietf.org= ; tram@ietf.org;= 'Alexey Melnikov'; draft-ietf-tram-turn-server-disco= very@ietf.org; 'Simon Perreault'; 'The IESG'
=C3= =84mne: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server= -discovery-10: (with DISCUSS)
Prioritet: H=C3=B6g<= /u>

=C2=A0

Two things in this draft -10 needs to fixed= !

=C2=A0

1) As pointed out during = the DISCUSS

https://www.ietf.org/mail-archive/web/tram/current/msg02144.html

and two times earlier (during WG discussions, but not addressed or resp= onded to by the authors):

https:= //www.ietf.org/mail-archive/web/tram/current/msg02081.html= and

h= ttps://www.ietf.org/mail-archive/web/tram/current/msg01976.html

=C2=A0

The Anycast method= does not work with RFC5766 TURN servers! That has not=

been addressed at all.

=C2=A0

A TURN server doesn't react one way (answering 300 Try Alternate) w= hen

addressed by an anycast address and another way = (accepting the Allocate

request) when addressed by i= ts unicast address, does it?

=C2=A0

I suggested this modification:

=C2=A0=

"When a client requires TURN services, it sends a STU= N binding request to

the assigned anycast address.= =C2=A0 The STUN server

responds with a 300 (Try Alte= rnate) error as described in [RFC5389];=C2=A0 The

<= p class=3D"gmail-m_6452009946686525158MsoPlainText">re= sponse contains a unicast address in the ALTERNATE-SERVER attribute, which<= u>

the client compares with the source address of the r= esponse and if the

addresses are the same, it is an = indication to use the TURN server at that

address. =

=C2=A0

For subsequent commun= ication with the TURN server, the client uses that

=

r= esponding server's unicast address."

=C2=A0

This proposed change has important advantages for s= ecurity and usefulness

for draft-ietf-rtcweb-return-= 01 also.=E2=80=9D

=C2=A0

With the curre= nt text for the anycast method (and we do need an anycast method since it i= s the only method proposed that can be easily deployed and on any network),= would the consequence not be that it has to be spelled out that *RFC5766 i= s updated* so that TURN servers to be provided by the network and discovere= d MUST respond with =E2=80=9C300 Try Alternate= =E2=80=9D for an allocate request when addressed by the a= nycast address, (but NOT if addressed by its unicast addressed)?<= /u>

=C2=A0

=C2=A0

2) The =C2=A0introduction in thi= s draft -10 of =E2=80=9CI think we can mandate = (D)TLS *if* STUN authentication or third-party authorization is not used=E2= =80=9D

during th= e DISCUSS, was protested against (but has still been introduced). I said:

=C2=A0

[Karl] We cannot mandate a higher security or trust level for a= TURN server provided by the network, paralleling the firewall/access route= r/default gateway, when the client want to place its real-time traffic thro= ugh the turn server path, than through the default gateway path.<= /u>

=C2=A0

And, shall this *discovery* spec= ification really mandate *usage*?

I am e.g. thinking= about the WebRTC browser use case of draft-ietf-rtcweb-return-01. It must = be up to that RETURN draft to define the *usage*, not up to a discovery dra= ft.

=C2=A0

The use cases I ha= ve in mind (and I don't see that TURN D(TLS) can fit) are:

The "autoconfiguration" of RFC 7478 (Web Real-Time Com= munication Use

Cases and Requirements) 2.3.5.1. or m= ore generally:

=E2=80=9CYou need be able to use WebR= TC everywhere you can surf and for firewall traversal and quality, you need= to parallel the local firewall/access router/default gateway with a TURN s= erver=E2=80=9D

=C2=A0

This mu= st work generally (for all services) on a LAN, Internet Caf=C3=A9 or GoGo W= iFi, where the network provider offers us a better path for real-time traff= ic (through the TURN server).

=C2=A0

It seem like it is forgotten that a protocol like WebRTC (which really n= eeds this specification to finally deal with the old NAT/Firewall traversal= problem that has been plaguing the real-time communication over the Intern= et for 15 years now), provides security and trust in itself for the media e= xchanged between endpoints =E2=80=93 It does not have to be added by the TU= RN server. And specifically, for the network provided TURN server, where th= e purpose of the TURN server is to offer a better working path for the real= -time media than through the default gateway (where media otherwise has to = pass) =E2=80=93 you cannot/must not expect that it also gives you some high= er trust or security level that when it goes through the default gateway. <= u>

=C2=A0

Also remember that DISCOV= ERY, in itself is about making =C2=A0a service available to a client withou= t the client having to be specifically configured for it =E2=80=93 and we c= annot then specify that it should do some authentication or validation base= d on password or certificate checking that has to be configured somehow.=

=C2=A0

Such idea blocks the very pur= pose of this draft, and has been discussed in various forms several times d= uring the WG draft and can therefore *not be introduced now*. Again, it see= ms like the main use case for this draft - to be able to use good WebRTC co= mmunication wherever you can surf =E2=80=93 is forgotten.

=C2=A0

I suggest eve= rything related to =E2=80=9CA TURN client MUST use (D)TLS in the absence of = STUN long-term

=C2= =A0=C2=A0 credential mechanism=E2=80=9D under 9. Security= Considerations is deleted.

= =C2=A0

If we really want anything of this in this specification, a compromise cou= ld be this change:

=C2=A0

=C2=A0=C2=A0 A T= URN client =C2=A0NOT using encryption of the media stream= that passes through the TURN server (WebRTC even mandates DTLS-SRPT) may <= u>

=C2=A0= use (D)TLS in the absence of STUN long-term credential mechanism

= =C2=A0

/Karl=

=C2=A0

=C2=A0

F= r=C3=A5n: tram [mailto:tram-bounces@ietf.org] F=C3=B6r Spencer Dawki= ns at IETF
Skickat: den 7 oktober 2016 04:40
Till: Tiru= maleswar Reddy (tireddy)
Kopia: tram-chairs@ietf.org; tram@ietf.org; Alexey Melnikov; dra= ft-ietf-tram-turn-server-discovery@ietf.org; Simon Perreault; The = IESG
=C3=84mne: Re: [tram] Alexey Melnikov's Discuss on draft= -ietf-tram-turn-server-discovery-09: (with DISCUSS)

=C2=A0

Hi, Alexey,

<= p class=3D"MsoNormal">=C2=A0

O= n Mon, Sep 5, 2016 at 9:05 PM, Tirumaleswar Reddy (tireddy) <tireddy@cisco.com> wrote= :

> -----Original Message-----> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]

> Sent: Frida= y, September 2, 2016 2:02 PM
> To: Tirumaleswar Reddy (tireddy) <<= a href=3D"mailto:tireddy@cisco.com" target=3D"_blank">tireddy@cisco.com= >
> Cc: The IESG <iesg@ietf.org>; draft-ietf-tram-turn-server-disc= overy@ietf.org;
> Simon Perreault <sperreault@jive.com>; tram-chairs@ietf.org; tram@ietf.org
> Subje= ct: Re: Alexey Melnikov's Discuss on draft-ietf-tram-turn-server-
&g= t; discovery-09: (with DISCUSS)
>
> Hi,
>
> On 2 Se= p 2016, at 04:02, Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
> wrote:
= >
> >> -----Original Message-----
> >> From: Ale= xey Melnikov [mailto:aamelnikov@fastmail.fm]
> >> Sent: Thursday, Sep= tember 1, 2016 12:49 PM
> >> To: Tirumaleswar Reddy (tireddy) &= lt;tireddy@cisco.com= >
> >> Cc: The IESG <iesg@ietf.org>;
> >> draft-i= etf-tram-turn-server-discovery@ietf.org;
> >> Simon Pe= rreault <sperre= ault@jive.com>; tram-chairs@ietf.org;
> >> tram@ietf.org
> >> Subject: Re: Al= exey Melnikov's Discuss on
> >> draft-ietf-tram-turn-server= -
> >> discovery-09: (with DISCUSS)
> >>
> &g= t;> Hi,
> >>
> >> On 1 Sep 2016, at 04:48, Tirum= aleswar Reddy (tireddy)
> >> <tireddy@cisco.com>
> >> wrote:<= br>> >>
> >>>> -----Original Message-----
>= ; >>>> From: Alexey Melnikov [mailto:aamelnikov@fastmail.fm]
> = >>>> Sent: Wednesday, August 31, 2016 9:11 PM
> >>&= gt;> To: The IESG <iesg@ietf.org>
> >>>> Cc: draft-ietf-tra= m-turn-server-discovery@ietf.org; Simon Perreault
> >>= >> <sperr= eault@jive.com>; tram-chairs@ietf.org; sperreault@jive.com;
> >>>> tram@ietf.org
> >>= >> Subject: Alexey Melnikov's Discuss on
> >>>>= draft-ietf-tram-turn-server-discovery-
> >>>> 09: (= with DISCUSS)
> >>>>
> >>>> Alexey Meln= ikov has entered the following ballot position for
> >>>>= draft-ietf-tram-turn-server-discovery-09: Discuss
> >>>= ;>
> >>>> When responding, please keep the subject lin= e intact and reply to
> >>>> all email addresses included= in the To and CC lines. (Feel free to
> >>>> cut this in= troductory paragraph, however.)
> >>>>
> >>&g= t;>
> >>>> Please refer to
> >>>> https://www.ietf.org/iesg/statement/discuss-criteria.= html
> >>>> for more information about IESG DISCUSS a= nd COMMENT positions.
> >>>>
> >>>>
= > >>>> The document, along with other ballot positions, can = be found here:
> >>>> https://data= tracker.ietf.org/doc/draft-ietf-tram-turn-server-discov
&g= t; >>>> er
> >>>> y/
> >>>>=
> >>>>
> >>>>
> >>>>= ----------------------------------------------------------------= ---
> >>>> --
> >>>> -
> >>= >> DISCUSS:
> >>>> -------------------------------------------------------------------
> >>>> --> >>>> -
> >>>>
> >>>>= In Section 9:
> >>>>
> >>>> o=C2=A0 Fo= r certificate-based authentication, a pre-populated trust anchor
> &g= t;>>>=C2=A0 =C2=A0 =C2=A0store [RFC6024] allows a TURN client to p= erform path validation
> >>>>=C2=A0 =C2=A0 =C2=A0for the = server certificate obtained during the (D)TLS handshake.
> >>&g= t;>
> >>>>=C2=A0 =C2=A0 =C2=A0If the client used a dom= ain name to discover the TURN server, that
> >>>>=C2=A0 = =C2=A0 =C2=A0domain name also provides a mechanism for validation of the TU= RN
> >>>>=C2=A0 =C2=A0 =C2=A0server.=C2=A0 The client MUS= T use the rules and guidelines given in
> >>>>=C2=A0 =C2= =A0 =C2=A0section 6 of [RFC6125] to validate the TURN server identity.
&= gt; >>>>
> >>>> I am glad that you are refere= ncing RFC 6125, but unfortunately you
> >>>> don't pr= ovide enough details. Please add details as specified in
> >>&g= t;> Section 3 of RFC
> >>>> 6125 to your document.
= > >>>
> >>> Sure, will add the following lines:<= br>> >>> Certification authorities that issue TURN server certi= ficates SHOULD
> >>> support
> >> the DNS-ID and= SRV-ID identifier types. TURN service providers SHOULD
> >> in= clude the DNS-ID and SRV-ID identifier types in certificate requests.
&g= t; >>
> >> What about use of CN-IDs and URI-IDs?
> = >
> > Yes, added.
>
> Just to clarify: you can pick= which ones of the 4 types you want to use, you can
> disallow some. = You just have to be explicit.

Okay.

> >
> >> Wildcards ?
> >
= > > I don't think wildcards are required.
>
> Please = say so in the document.

Sure, will update.

-Tiru

=C2=A0

It looks to me as if -10 should address your Discuss. Could= you take a look and confirm that?

=C2=A0

Thanks= !

=C2=A0

Spencer=C2=A0


______________________________<= wbr>_________________
tram mailing list
tram@ietf.org
https://www.ietf.org/mailman/listinfo/tram


--001a113f453c3746c4053f1a493a-- From nobody Mon Oct 17 19:38:27 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 45A6512952B; Mon, 17 Oct 2016 19:38:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.952 X-Spam-Level: X-Spam-Status: No, score=-14.952 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.431, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D7V39lH7Pr8u; Mon, 17 Oct 2016 19:38:18 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00CA9129461; Mon, 17 Oct 2016 19:38:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=18648; q=dns/txt; s=iport; t=1476758297; x=1477967897; h=from:to:cc:subject:date:message-id:mime-version; bh=lPlNiCz0BgvME1hWv5XBkp7CEcU6YnzINzQ4jJyCvss=; b=ezgt/GWN/1H3oJdEcpOaH8Ka2ZZ8aFYDUAS7aWAyUGwDFlMUBsa2veTb 1U/cGNoad7cJQdH85v12m6f+SODhg8tHELGcTlvB/8nK6o1DABgVrH/xE Ld5AA12WWDIHbqdgUS1orOlwlHqlkIay6ra1ds0RCN7+0h2MftY7FCioV Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0C2AQCziQVY/5hdJa1bGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgwc1AQEBAQEdV3wHjS2mKoMFgg+CCIYiHIFQOBQBAgEBAQEBAQFeJ4R?= =?us-ascii?q?iAgQjVhIBCDsEAwIEMBQTBAENBYhStV+MawEBAQEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?R2GPYF9CIJQhDGDGiyCLwWaBgGQA491kHoBHjZSgn4cGYE6codWgQABAQE?= X-IronPort-AV: E=Sophos;i="5.31,359,1473120000"; d="scan'208,217";a="164494745" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Oct 2016 02:38:16 +0000 Received: from XCH-RTP-016.cisco.com (xch-rtp-016.cisco.com [64.101.220.156]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id u9I2cGL0007253 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 18 Oct 2016 02:38:16 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-016.cisco.com (64.101.220.156) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 17 Oct 2016 22:38:15 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1210.000; Mon, 17 Oct 2016 22:38:15 -0400 From: "Prashanth Patil (praspati)" To: Karl Stahl , "'Spencer Dawkins at IETF'" , "'The IESG'" , "tram-chairs@ietf.org" Thread-Topic: SV: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) Thread-Index: AQHSKOitEytLyEcx9kiLJcOGEY6/sA== Date: Tue, 18 Oct 2016 02:38:15 +0000 Message-ID: <71821247-F6F8-4C8D-925D-DF503A6B4643@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.95.228] Content-Type: multipart/alternative; boundary="_000_71821247F6F84C8D925DDF503A6B4643ciscocom_" MIME-Version: 1.0 Archived-At: Cc: 'Simon Perreault' , "draft-ietf-tram-turn-server-discovery@ietf.org" , "tram@ietf.org" , "Tirumaleswar Reddy \(tireddy\)" , 'Alexey Melnikov' Subject: Re: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2016 02:38:20 -0000 --_000_71821247F6F84C8D925DDF503A6B4643ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCk9uIDEwLzE3LzE2LCAxOjE1IEFNLCAiS2FybCBTdGFobCIgPGthcmwuc3RhaGxAaW5nYXRl LmNvbTxtYWlsdG86a2FybC5zdGFobEBpbmdhdGUuY29tPj4gd3JvdGU6DQoNClNwZW5jZXIsDQoN CkNhbiB0aGUgYXV0aG9ycyBvZiB0aGlzIGRpc2NvdmVyeSBkcmFmdCDigJxiZSBvcmRlcmVk4oCd IHRvIGFkZHJlc3MgdGhlIHR3byBwb2ludHMgYmVsb3c/DQoNCjotKQ0KDQpQb2ludCAyKSB3YXMg KHVubmVjZXNzYXJpbHkpIGludHJvZHVjZWQgZHVyaW5nIHRoZSBESVNDVVNTDQooSSBqdXN0IGhp Z2hsaWdodGVkIHRvIHRoZSBXRyBsaXN0IHRoYXQgaXQgaXMgTk9UIGFkZHJlc3NlZCwgaW4gc3Bp dGUgb2Ygd2hhdCBpcyBzYWlkIGJ5IGFuIGF1dGhvci4pDQoNClBvaW50IDEpIGhhcyByZXBlYXRl ZGx5IGJlZW4gcG9pbnRlZCBvdXQgb24gdGhpcyBXRyBsaXN0IHNpbmNlIHZlcnNpb24gLTA2IG9m IHRoZSBkcmFmdCwgYnV0IGlnbm9yZWQgYnkgdGhlIGF1dGhvcnMuDQoNCldlIGludGVuZCB0byBh ZGQgdGhlIGZvbGxvd2luZyB0byBleHBsYWluIHNlcnZlciBiZWhhdmlvciBhIGxpdHRsZSBiZXR0 ZXI6DQrigJxBIFRVUk4gYW55Y2FzdCBzZXJ2ZXIgcGVyZm9ybXMgY2hlY2tzIDEgdG8gNyBkaXNj dXNzZWQgaW4gU2VjdGlvbiA2LjIgb2YgUkZDNTc2Ni4gSWYgYWxsIGNoZWNrcyBwYXNzLCB0aGUg VFVSTiBhbnljYXN0IHNlcnZlciBNVVNUIHJlc3BvbmQgd2l0aCBhIDMwMCAoVHJ5IEFsdGVybmF0 ZSkgZXJyb3IgYXMgZGVzY3JpYmVkIGluIFtSRkM1NzY2XTvigJ0NCg0KQXMgdGhlIHRleHQgaXMg aW4gdGhpcyB2ZXJzaW9uIC0xMCBvZiB0aGUgZHJhZnQgbm93IGlzLCBpdCBkb2VzIE5PVCBmdWxm aWxsIGl0cyBwdXJwb3NlIHRvIGRpc2NvdmVyIGEgbmV0d29yayBwcm92aWRlZCBUVVJOIHNlcnZl ciB0byBhbGxvdyByZWFsLXRpbWUgY29tbXVuaWNhdGlvbiwgaW4gc2l0dWF0aW9ucyB3aGVyZSBp dCBvdGhlcndpc2UgaXMgbm90IHBvc3NpYmxlIG9yIGJhZC4NCi0gSXQgZG9lcyBub3QgcHJvdmlk ZSBhIG1ldGhvZCBzdWl0YWJsZSBmb3IgZHJhZnQtaWV0Zi1ydGN3ZWItcmV0dXJuLTAxDQotIEl0 IGRvZXMgbm90IG1lZXQgdGhlIGF1dG9jb25maWd1cmF0aW9uIG9mIFJGQyA3NDc4IChXZWIgUmVh bC1UaW1lIENvbW11bmljYXRpb24gVXNlIENhc2VzIGFuZCBSZXF1aXJlbWVudHMpIDIuMy41LjEu DQoNCk1vcmUgZ2VuZXJhbGx5IChyZWdhcmRpbmcgdGhlIG1hbmRhdGluZyBvZiAoRClUTFMsIHN1 ZGRlbmx5IGludHJvZHVjZWQgZHVyaW5nIHRoZSBESVNDVVNTKToNCldlIHNob3VsZCBiZSBhYmxl IHRvIHVzZSBXZWJSVEMgZXZlcnl3aGVyZSB3ZSBjYW4gYW5kIGRvIHN1cmYsIGFuZCBmb3IgZmly ZXdhbGwvTkFUIHRyYXZlcnNhbCBhbmQgcXVhbGl0eSBpdCBpcyBpbiBtYW55IGNhc2VzIG5lY2Vz c2FyeSB0byBwYXJhbGxlbCB0aGUgbG9jYWwgZmlyZXdhbGwvYWNjZXNzIHJvdXRlci9kZWZhdWx0 IGdhdGV3YXkgd2l0aCBhIFRVUk4gc2VydmVyLCB0byBnZXQgYSBnb29kIG1lZGlhIHBhdGguIFRo ZSBhdXRvbWF0aWMgZGlzY292ZXJ5IG9mIHN1Y2ggbmV0d29yayBwcm92aWRlZCB0dXJuIHNlcnZl ciBzaG91bGQgYmUgZ2l2ZW4gYnkgdGhpcyBkcmFmdCwgYnV0IGl0IHNob3VsZCBOT1Qgc2V0IHVw IHJlc3RyaWN0aW9ucyBmb3IgaXQgdXNhZ2UgKGVzcGVjaWFsbHkgd2hlbiBpdCBpcyB1bm5lY2Vz c2FyeSBhbmQgYmxvY2tzIHRoZSBnZW5lcmFsIHVzYWdlIGUuZy4gc3VjaCBhcyBzcGVjaWZpZWQg aW4gZHJhZnQtaWV0Zi1ydGN3ZWItcmV0dXJuLTAxKS4NCg0KTm90IG1hbmRhdGluZyBEVExTIG9w ZW5zIHVwIHRoZSBjbGllbnQvc2VydmVyIHRvIGEgaG9zdCBvZiBhdHRhY2tzIHN1Y2ggYXMgYW4g YXR0YWNrZXIgc2VuZGluZyBmYWtlIHJlcXVlc3RzL3Jlc3BvbnNlcy4gVGhlIGRyYWZ0IGlzIG1l YW50IGZvciBnZW5lcmFsIHB1cnBvc2UgVFVSTiBzZXJ2ZXIgZGlzY292ZXJ5LCBub3Qgc3BlY2lm aWMgdG8gV2ViUlRDLCBhbmQgaGVuY2UsIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGhhdmUgdG8g YmUgYnJvYWQuDQoNCi1QcmFzaGFudGgNCg0KVGhlIGF1dGhvcnMgb2YgdGhpcyBkcmFmdCBzZWVt IHRvIGhhdmUgc29tZSBvdGhlciB1c2UgY2FzZSBpbiBtaW5kLCBidXQgdGhhdCBtdXN0IG5vdCBi bG9jayB0aGUgdXNhZ2UgZm9yIHdoaWNoIHRoaXMgZGlzY292ZXJ5IHNwZWNpZmljYXRpb24gd2Fz IHJlcXVpcmVkLg0KQXMgd3JpdHRlbiBpbiB0aGlzIHZlcnNpb24gLTEwIG9mIHRoZSBkcmFmdCwg aXQgaXMgYSBzaG93c3RvcHBlci4NCg0KL0thcmwNCg0KDQo= --_000_71821247F6F84C8D925DDF503A6B4643ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6QXJpYWw7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAy IDIgMiAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglw YW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6VGFob21hOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDMg NSA0IDQgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNv Tm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAw MXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7 fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJ Y29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bh bi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29QbGFpblRleHQsIGxp Lk1zb1BsYWluVGV4dCwgZGl2Lk1zb1BsYWluVGV4dA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJbXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjVwdDsNCglmb250LWZhbWlseTpDb25z b2xhczt9DQpwLk1zb0FjZXRhdGUsIGxpLk1zb0FjZXRhdGUsIGRpdi5Nc29BY2V0YXRlDQoJe21z by1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiQmFsbG9vbiBUZXh0IENoYXIi Ow0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZTo4LjBw dDsNCglmb250LWZhbWlseTpUYWhvbWE7fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1z dHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5QbGFpblRleHRDaGFyDQoJe21zby1z dHlsZS1uYW1lOiJQbGFpbiBUZXh0IENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCglt c28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCI7DQoJZm9udC1mYW1pbHk6Q291cmllcjt9DQpzcGFu LkJhbGxvb25UZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiQmFsbG9vbiBUZXh0IENoYXIiOw0K CW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiQmFsbG9vbiBUZXh0IjsN Cglmb250LWZhbWlseTpDYWxpYnJpO30NCnAuT2Zvcm1hdGVyYWR0ZXh0LCBsaS5PZm9ybWF0ZXJh ZHRleHQsIGRpdi5PZm9ybWF0ZXJhZHRleHQNCgl7bXNvLXN0eWxlLW5hbWU6Ik9mb3JtYXRlcmFk IHRleHQiOw0KCW1zby1zdHlsZS1saW5rOiJPZm9ybWF0ZXJhZCB0ZXh0IENoYXIiOw0KCW1hcmdp bjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0Kc3Bhbi5PZm9ybWF0ZXJhZHRleHRDaGFyDQoJ e21zby1zdHlsZS1uYW1lOiJPZm9ybWF0ZXJhZCB0ZXh0IENoYXIiOw0KCW1zby1zdHlsZS1wcmlv cml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiT2Zvcm1hdGVyYWQgdGV4dCI7DQoJZm9udC1mYW1p bHk6Q29uc29sYXM7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjQNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWw7DQoJZm9udC1mYW1pbHk6QXJpYWw7DQoJY29sb3I6Ymx1ZTt9DQpzcGFuLkVtYWlsU3R5bGUy NQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseTpBcmlhbDsNCgljb2xv cjpibHVlO30NCnAuQmFsbG9uZ3RleHQsIGxpLkJhbGxvbmd0ZXh0LCBkaXYuQmFsbG9uZ3RleHQN Cgl7bXNvLXN0eWxlLW5hbWU6QmFsbG9uZ3RleHQ7DQoJbXNvLXN0eWxlLWxpbms6IkJhbGxvbmd0 ZXh0IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0Kc3Bhbi5CYWxs b25ndGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkJhbGxvbmd0ZXh0IENoYXIiOw0KCW1zby1z dHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazpCYWxsb25ndGV4dDsNCglmb250LWZh bWlseTpUYWhvbWE7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNw YW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHlsZS1uYW1l OiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQouTXNvQ2hw RGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0 O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46NzAu ODVwdCA3MC44NXB0IDcwLjg1cHQgNzAuODVwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0 ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2Nv bG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrIj5PbiAxMC8xNy8xNiwgMToxNSBBTSwgJnF1b3Q7S2Fy bCBTdGFobCZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmthcmwuc3RhaGxAaW5nYXRlLmNvbSI+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5rYXJsLnN0YWhsQGluZ2F0ZS5jb208L3NwYW4+PC9h PiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj5T cGVuY2VyLDwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+ Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj5D YW4gdGhlIGF1dGhvcnMgb2YgdGhpcyBkaXNjb3ZlcnkgZHJhZnQg4oCcYmUgb3JkZXJlZOKAnSB0 byBhZGRyZXNzIHRoZSB0d28gcG9pbnRzIGJlbG93PzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6YmxhY2siPjotKTwvc3Bhbj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj5Qb2ludCAyKSB3YXMgKHVu bmVjZXNzYXJpbHkpIGludHJvZHVjZWQgZHVyaW5nIHRoZSBESVNDVVNTPC9zcGFuPjxzcGFuIHN0 eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj4oSSBqdXN0IGhpZ2hsaWdodGVkIHRv IHRoZSBXRyBsaXN0IHRoYXQgaXQgaXMgTk9UIGFkZHJlc3NlZCwgaW4gc3BpdGUgb2Ygd2hhdCBp cyBzYWlkIGJ5IGFuIGF1dGhvci4pPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFs O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7 Y29sb3I6YmxhY2siPlBvaW50IDEpIGhhcyByZXBlYXRlZGx5IGJlZW4gcG9pbnRlZCBvdXQgb24g dGhpcyBXRyBsaXN0IHNpbmNlIHZlcnNpb24gLTA2IG9mIHRoZSBkcmFmdCwgYnV0IGlnbm9yZWQg YnkgdGhlIGF1dGhvcnMuICZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6YmxhY2siPldlIGludGVuZCB0byBhZGQgdGhl IGZvbGxvd2luZyB0byBleHBsYWluIHNlcnZlciBiZWhhdmlvciBhIGxpdHRsZSBiZXR0ZXI6PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+4oCcQSBUVVJO IGFueWNhc3Qgc2VydmVyIHBlcmZvcm1zIGNoZWNrcyAxIHRvIDcgZGlzY3Vzc2VkIGluIFNlY3Rp b24gNi4yIG9mIFJGQzU3NjYuIElmIGFsbCBjaGVja3MgcGFzcywgdGhlIFRVUk4gYW55Y2FzdCBz ZXJ2ZXIgTVVTVCByZXNwb25kIHdpdGggYSAzMDAgKFRyeSBBbHRlcm5hdGUpIGVycm9yDQogYXMg ZGVzY3JpYmVkIGluIFtSRkM1NzY2XTvigJ08L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 QXJpYWw7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpB cmlhbDtjb2xvcjpibGFjayI+QXMgdGhlIHRleHQgaXMgaW4gdGhpcyB2ZXJzaW9uIC0xMCBvZiB0 aGUgZHJhZnQgbm93IGlzLCBpdCBkb2VzIE5PVCBmdWxmaWxsIGl0cyBwdXJwb3NlIHRvIGRpc2Nv dmVyIGEgbmV0d29yayBwcm92aWRlZCBUVVJOIHNlcnZlciB0byBhbGxvdyByZWFsLXRpbWUNCiBj b21tdW5pY2F0aW9uLCBpbiBzaXR1YXRpb25zIHdoZXJlIGl0IG90aGVyd2lzZSBpcyBub3QgcG9z c2libGUgb3IgYmFkLjwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpi bGFjayI+LSBJdCBkb2VzIG5vdCBwcm92aWRlIGEgbWV0aG9kIHN1aXRhYmxlIGZvcg0KPC9zcGFu PjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ZHJhZnQtaWV0Zi1ydGN3ZWItcmV0dXJuLTAxPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFs O2NvbG9yOmJsYWNrIj4tIEl0IGRvZXMgbm90IG1lZXQgdGhlIGF1dG9jb25maWd1cmF0aW9uIG9m IFJGQyA3NDc4IChXZWIgUmVhbC1UaW1lIENvbW11bmljYXRpb24gVXNlIENhc2VzIGFuZCBSZXF1 aXJlbWVudHMpIDIuMy41LjEuDQo8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7 Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtj b2xvcjpibGFjayI+TW9yZSBnZW5lcmFsbHkgKHJlZ2FyZGluZyB0aGUgbWFuZGF0aW5nIG9mIChE KVRMUywgc3VkZGVubHkgaW50cm9kdWNlZCBkdXJpbmcgdGhlIERJU0NVU1MpOjwvc3Bhbj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+V2Ugc2hvdWxkIGJlIGFibGUg dG8gdXNlIFdlYlJUQyBldmVyeXdoZXJlIHdlIGNhbiBhbmQgZG8gc3VyZiwgYW5kIGZvciBmaXJl d2FsbC9OQVQgdHJhdmVyc2FsIGFuZCBxdWFsaXR5IGl0IGlzIGluIG1hbnkgY2FzZXMgbmVjZXNz YXJ5IHRvIHBhcmFsbGVsIHRoZQ0KIGxvY2FsIGZpcmV3YWxsL2FjY2VzcyByb3V0ZXIvZGVmYXVs dCBnYXRld2F5IHdpdGggYSBUVVJOIHNlcnZlciwgdG8gZ2V0IGEgZ29vZCBtZWRpYSBwYXRoLiBU aGUgYXV0b21hdGljIGRpc2NvdmVyeSBvZiBzdWNoIG5ldHdvcmsgcHJvdmlkZWQgdHVybiBzZXJ2 ZXIgc2hvdWxkIGJlIGdpdmVuIGJ5IHRoaXMgZHJhZnQsIGJ1dCBpdCBzaG91bGQgTk9UIHNldCB1 cCByZXN0cmljdGlvbnMgZm9yIGl0IHVzYWdlIChlc3BlY2lhbGx5IHdoZW4gaXQgaXMNCiB1bm5l Y2Vzc2FyeSBhbmQgYmxvY2tzIHRoZSBnZW5lcmFsIHVzYWdlIGUuZy4gc3VjaCBhcyBzcGVjaWZp ZWQgaW4gPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ZHJhZnQtaWV0Zi1ydGN3ZWIt cmV0dXJuLTAxPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OkFyaWFsO2NvbG9yOmJsYWNrIj4pLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5Ob3QgbWFuZGF0aW5nIERUTFMgb3BlbnMgdXAg dGhlIGNsaWVudC9zZXJ2ZXIgdG8gYSBob3N0IG9mIGF0dGFja3Mgc3VjaCBhcyBhbiBhdHRhY2tl ciBzZW5kaW5nIGZha2UgcmVxdWVzdHMvcmVzcG9uc2VzLiBUaGUgZHJhZnQgaXMgbWVhbnQgZm9y IGdlbmVyYWwgcHVycG9zZSBUVVJOIHNlcnZlciBkaXNjb3ZlcnksIG5vdA0KIHNwZWNpZmljIHRv IFdlYlJUQywgYW5kIGhlbmNlLCBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBoYXZlIHRvIGJlIGJy b2FkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi1QcmFzaGFudGg8L3NwYW4+PHNwYW4gc3R5 bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+VGhlIGF1dGhvcnMgb2YgdGhpcyBkcmFm dCBzZWVtIHRvIGhhdmUgc29tZSBvdGhlciB1c2UgY2FzZSBpbiBtaW5kLCBidXQgdGhhdCBtdXN0 IG5vdCBibG9jayB0aGUgdXNhZ2UgZm9yIHdoaWNoIHRoaXMgZGlzY292ZXJ5IHNwZWNpZmljYXRp b24gd2FzIHJlcXVpcmVkLg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2Nv bG9yOmJsYWNrIj5BcyB3cml0dGVuIGluIHRoaXMgdmVyc2lvbiAtMTAgb2YgdGhlIGRyYWZ0LCBp dCBpcyBhIHNob3dzdG9wcGVyLjwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtj b2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2Nv bG9yOmJsYWNrIj4vS2FybDwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xv cjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286 cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_71821247F6F84C8D925DDF503A6B4643ciscocom_-- From nobody Tue Oct 18 06:20:23 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 736C8129643; Tue, 18 Oct 2016 06:20:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.921 X-Spam-Level: X-Spam-Status: No, score=-0.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_MULTIPLE_AT=1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ingate.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gkWVA25CN_CP; Tue, 18 Oct 2016 06:20:12 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-he1eur01on0055.outbound.protection.outlook.com [104.47.0.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0762312942F; Tue, 18 Oct 2016 06:20:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ingate.onmicrosoft.com; s=selector1-ingate-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=7rg+C1JXfOeRieF+SFlbWY8AdMAk8vqlaHW07WZ9tvk=; b=w+kvP/s5vbW+yGMfmShA3etwQL2jZm5ptwHdskxK9hKVhlriEQ5Y7vD9zXBxkrj212PMsiWKqb3jXqRUfsS9dgwX7k2QWSPblwnWcHq6QY5yFG9v6Xi59ROXImL++Ct6oVbfXjIPKQp91EiKWc3Srp+5CwPOrsemS33AhOcxRJg= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=karl@ingate.com; Received: from Kallei7 (90.227.80.227) by AM4PR01MB1826.eurprd01.prod.exchangelabs.com (10.167.85.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.12; Tue, 18 Oct 2016 13:20:07 +0000 From: Karl Stahl To: "'Prashanth Patil (praspati)'" , 'Spencer Dawkins at IETF' , 'The IESG' , References: <71821247-F6F8-4C8D-925D-DF503A6B4643@cisco.com> In-Reply-To: <71821247-F6F8-4C8D-925D-DF503A6B4643@cisco.com> Date: Tue, 18 Oct 2016 15:20:04 +0200 Message-ID: <048301d22942$58d6acd0$0a840670$@stahl@ingate.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0484_01D22953.1C5F7CD0" X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AQHSKOitEytLyEcx9kiLJcOGEY6/sKCt2NrA Content-Language: sv X-Originating-IP: [90.227.80.227] X-ClientProxiedBy: DB6PR0501CA0002.eurprd05.prod.outlook.com (10.172.232.140) To AM4PR01MB1826.eurprd01.prod.exchangelabs.com (10.167.85.24) X-MS-Office365-Filtering-Correlation-Id: 84c079ef-ec48-42e2-76f2-08d3f7597b30 X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1826; 2:AuLLiRNWWEYnqY8pzSFRJmsuHyj34uI1uBoa0RlWiwSXzyh9sXaVuRhaORenpqN1PB7umSpwXA18Ycl+bezJfb45wpB79wjm/2PWNQpacNt4SRDeu70Y3Pb9DcfkWwQ8l4NXvqNy50c+k7LIztLF1huFzMQVonjCnsiWrW49FloRdj17SSMXWyJIey5OEaS1fexyrSPPdprvdRT6g3/KNw==; 3:hl+cfAdo9pJNA/u6Vq1y0E++2+7HHLpuc4rodzUsz6+vpaISwQeF7QIQHZj6NvzFXTOBj2/2NNtVTiA8HUCXkkv+GHXlbk27UQbIbuK/mprSGGBidZwlKhRaRjiq7GgkrGooAd33p2XoXqN7UveBWg==; 25:lnm5vkb6U2/6aa7JvIPxfokJcH4sTDWOrowNaLN3HXlp6wZ/4MYtHsVh/YBALJkfP61IGxiTOlwYdNK805KdFtAXaDiV35RAFw64f9YCP30xpl3j4zWcA2TBosk2cEaWeyMIujluQDrpADWCF/4x5Z5wCo27j5FVapLJfFcq6S1G1DBetdD6LX45jpMwTb4+K5Iql9zAh7RrYsULaZKIxK+jceI5kYukLv4Gb8o3ai6sZl0chjZq0LyDd9TC0N1jTvWCKuKG/O+I3QM4b5JvC9hHuP4ZJ0D+7YN2xDuLCoP2LKPFCd2yWpv38SOCq3KR4fM4P0AeLbUVH2Rx5lyeqbdYYqwy+hygC8Ykx4TCBapW4lmnIPix6pLXmr/krQq7pBDIyGzL/awvj/q+oZ1gnLGlk8CrFpwx/3obbPh7EUjEsphiaSQR1Ds5GWal9gYp X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:AM4PR01MB1826; X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1826; 31:nwTs7USeomr0HYiWIYt6kjliRVngl+CKv+Yqpa1DtEkvMRv9gv6cUwYFPFNfS/S/0HEeizoOcRW4PuSwLdzLPBouJ7Z+5WSfEHNrH1gu7+bZCOlaL0DkbazXkPzwjsdUqGoQakj2fVmNB86Xjd8DNwFBe94AWd3NnRLhGNUqRa0/Gi8GmcNWjw7qRdiPBG3VblkhmDuV+TzEpiX3tmJaRaBV/GxN1hgxl3p3MRHuhkcegOEQk5bqfSzC5ZG+nlrHUcaDvQ2zUelE+I382/ZSbw==; 4:c9xTmLCm8QtMI7D1UFhriZuMHLF9z7H9uZZzfhBCqFyKmRGryGKfljQp1BzhyHXpTCKH2zRKABfU0dClJvx823R7PQ1rdKabwMt4lExZ9F1qcNJbuuZywOOy3sSU671rkmxdfaHhvcPMAcL0drTUad147CgCam0lbrj4QepqWxad1hbZH+daJrpXZxhIeHnRn/Ihqzp73+JwUQTW0nlzu06NGB+5nZ50awttypxXqo4sxTUMatLwTVhkElH1NxyT+x8MRdpopMaiGJLp+xcPRALT11rAmE3yZiuDVj7lo6pPfQbZMwEumSGl4MZFoSn7lbzsoO2Jssa/AvNnqmgbFaDq51hVXA89Y27w0FWerhU1RzAKVBgrBYjosZg/rpYT9Mbxd9jK29OfEd6ffCSRzccy51D2W3VkjgbQeJ9/Prf1MdleDywcuGGsBB7IeUxtXI2IMTjpBlLFLYROuCo3aro2YqEInh1KXpa/xsXHB/2TIu7E4+U7sCgJbm8v36nCgKAlFgarm8126YG6V9ohZ6yWW/d7hKwVzr4mIh6JsPXZcsv4nfeGVAp9Lnoc/7C3m5Es4+/+e6Nb0R26W7y/Ig== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(192374486261705)(95692535739014)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6043046)(6042046); SRVR:AM4PR01MB1826; BCL:0; PCL:0; RULEID:; SRVR:AM4PR01MB1826; X-Forefront-PRVS: 00997889E7 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(7916002)(189002)(377454003)(24454002)(199003)(790700001)(14726001)(66066001)(6116002)(102836003)(3846002)(71636004)(101416001)(50986999)(16236675004)(76176999)(84326002)(6666003)(105586002)(230783001)(8666005)(84116002)(36756003)(18717965001)(5001770100001)(97736004)(19580405001)(19580395003)(5660300001)(189998001)(9686002)(229853001)(7846002)(7826002)(19300405004)(7736002)(92566002)(68736007)(4326007)(81156014)(2950100002)(2906002)(15975445007)(8676002)(42186005)(19625215002)(33646002)(512874002)(81166006)(1420700001)(50226002)(106356001)(106116001)(96836002)(77096005)(561944003)(586003)(61296003)(7059030); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR01MB1826; H:Kallei7; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: ingate.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; AM4PR01MB1826; 23:V9RhJds4NM8I5l99pBwuYP8m4VL1v1C7w/hFvXeJO?= =?us-ascii?Q?gRGTl3fo3j5wDnF1047MzEcdSJxkh1F3KrF96Dv8tbrox4PyYT7/sreP2jVn?= =?us-ascii?Q?q6MQM81051daJJQlxyoZobTVDEHbuS7JC9Ky9g96KPZU2npmHywMumiq3k0C?= =?us-ascii?Q?cJ/0I73z1VGx6zO0kRN5PSVbcMlIZIJSCkbCdrcrqpPyG7VfFxkNZ5XDLKOp?= =?us-ascii?Q?tFSV8uCSS52qbtvxrvEhzLCLIkOxfIIJlLfkCcYL/YyyBi6Aw3Xdpt06qFK0?= =?us-ascii?Q?q2fFBAmR9ewSxKeU4OLMZtOmA7yhvzAfZbpsOTIRg0Ukp/X/qF+X9O2ciKvE?= =?us-ascii?Q?NDnv1b7aK0G21eDj4iMoF6alx5D4X/7OmLvolRYJ0awiDjwvQ5Io9/EZoDg9?= =?us-ascii?Q?kebQ1pC4SnhWzw3kijxVWOEgHK+m+ea0jhZRvxJVrDprSMBjfCeX/+vAPhf9?= =?us-ascii?Q?AaRuQCJRpSf8cnzcz6SBN8lWHTRO0efuBlUszmBaLPseV8grNYIW6wiJijvx?= =?us-ascii?Q?RVHe01rbpTGCTjCkczYxtOxOsSN9E6bLY0IgsBGqs2d3O+2Tfugj9r7IQBif?= =?us-ascii?Q?+Q31Tyj6ZcmmbhhA+ZH6ZEaAt1uQJZiJ3EsuFMuiWt0FK7/U4wu/DBSE/69x?= =?us-ascii?Q?eWObUoPCaCS69JJpiEz/G9Rv6jfdjVc+Ocw02riWhIcP+XXkRyRjXwjywKq/?= =?us-ascii?Q?rZfP4pdlpis17z62bdNy5iJa+uXdQcthKEWITSUo38vI9ly6Kt12euj6BgfQ?= =?us-ascii?Q?RVe4Q+5JCQ0F2PO4DAqDGgg2W/XG8TFVNKc6Y8TxKqTIkEEkcVPaAEiD7dki?= =?us-ascii?Q?6DTYYKlXoqHh7rDjRUPoxEpW1J2xxJhF7bsULeyqnRE75JvtkNMKcVrFp3+o?= =?us-ascii?Q?LIXpyY0LIS6gCcucGOk9NaKCCyngcpEuqAc4PewAGMAFw2tWkE8A043TDjmq?= =?us-ascii?Q?nXMOYmLyUUgKX5qzGJ8mC03BysuwOlFA/aKhwJocKW7zqX/+lKM2nSnnsuUg?= =?us-ascii?Q?2qPufoX6L6kdFMNwJS9sBY6wrn+bxPPXiagVG9DNycE8/hR3anxI6kxh3hE0?= =?us-ascii?Q?Hx2Auo8VnDJgA+dMfnjrjznDNx/NtK3WYwpAQ/b0DxuBB/tAUKxpn4OluP65?= =?us-ascii?Q?jItoUtCoRr7+k+vx+BaEgNrX3nn6ttN1XolY4VNkTxVYJA7dYdNFBjJkj4gX?= =?us-ascii?Q?8M3x+bebcodduOsl5VEh0BlqQ8lRKnbm65g/DoIcAqpIhVWjc0f8OPtSpGOe?= =?us-ascii?Q?gAWV/uV4k8paifDcbGwq6x77PFhXG9s3vn+ezFAZPr1cCpPz/VS5EOaI8KVW?= =?us-ascii?Q?8rzVV4AOIk4gxuA/KtgYyoLjn8LQQJz/tGLnf4w4gzh5BXdWtFmvpiRbyytU?= =?us-ascii?Q?uAdc5Oq/EMY5QR3c349kJBlMg2Qz6W1LF/veSo09SgVwQZvjgyyrjczZu7ro?= =?us-ascii?Q?LesxY30GT1ajU6Xk6zyXkt2P06eNHU=3D?= X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1826; 6:anT4QruEPgOmbDwTmq3T55SbLW7pyWWbhbDBPUuPN85tVJALq6e+OxX5aptUZcNJRRY3WPoJgehxFq/3I2kegyrL6LSQiUaFdRTENlbf7HlrVTztfHTPcRYZGs9kpxHNatTmmie+ZOkzPh3vPQcmxnUD+yE71G5c5kX8/sSFX0NTjH9GcYCEgpiJHhUl8Dwse4zVothUa+wjXQ74Bv6Bya9UtB9S2HpdZOhkDkaSQmHqxhLRoaWMzoAp2G7Uu+sbRn7/jmaUvy8NI4GSr/UfRR/pYQyYFSOj/Y4oUYTBzaFglI7jE5xeZgQ4aFQPulyjXBB1i+RBglfsK7gjel4p3g==; 5:ONIqYpcTgJHbuax55w5Iw0Xr4FQ0WOiYqctSACB7GNwnwuzdyTzloJMYT/IstYkmA1f/66dSy0UFKT7DNcBCu/oe6A9Ln/2hmNnfMVdTupp02lQPYf2JFDnt5Xbdqs/06d4ee0bqIuFz3LIzn02nzstRFDlWkZsovgoZN17YT0Y=; 24:mkIaXb4fE1/L4FeGR15wofGzNPYs1voOulrKvlMqv1n3+wtmcJJsLEqqhevbRDOeLvBqP5xlqgYUUqbA5wWrKu6Sk85XfqQ6b5v3s0OxCwY= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1826; 7:5D5abmhtTJaAk9prXs8fCBcJsSl6yZzxLKW27M/8AAvlmP5fWXLNG4qiOqTzXpTLk5hYAn/OpeWNO/BbJF5Fr4hi6ST/RVdBmdmXhMxYJtIlqZu/lId8vLwlqQJ+Z8V6jOXm8d/gd3CEZOGXpvgknWbw15J58VdMtUXPUR3Y3aX8g0jvKtNNzNK0tGIsZ2pTRKsDjJjJlM9Syei3RaDLkEtpuzL3q7Ys1X8V2M/9clV6NuHgCdSE6uKYze8boKuBFB/Hp/9lCgeu+4sFfgw969atQaGGXWESVciMzSQxhdf2sYo83Nu34i24kOIleinTetUMXU8ADF9R7jntnTKT69dEcCky8njJUH6gP11ArJM= X-OriginatorOrg: ingate.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Oct 2016 13:20:07.1258 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR01MB1826 Archived-At: Cc: 'Simon Perreault' , draft-ietf-tram-turn-server-discovery@ietf.org, tram@ietf.org, "'Tirumaleswar Reddy \(tireddy\)'" , 'Alexey Melnikov' Subject: Re: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2016 13:20:15 -0000 ------=_NextPart_000_0484_01D22953.1C5F7CD0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Spencer (and authors), =20 We need the long awaited discovery draft and the anycast method, and = don=E2=80=99t want an =E2=80=9Cappeal (which gets us right back here, = after wasting time).=E2=80=9D=20 It must work for discovery of a network provided turn server, that the = provider of the local network (LAN) has made available for all his users = to run real-time traffic through (rather than through a data crowded or = blocked default gateway path).=20 =20 This draft cannot/must not (thrown in during the DISCUSS!) block such = general usage by under 9 mandating (D)TLS, requiring a new = infrastructure to be established by: A TURN client MUST use (D)TLS =E2=80=A6 one of the following techniques with (D)TLS to validate the TURN server: o For certificate-based authentication, a pre-populated trust anchor store=E2=80=A6 o Certification authorities that issue TURN server = certificates=E2=80=A6 =20 especially when the release of authentication of such turn servers have = been specified in the draft. =20 =20 Ben Campebell did not clear his DISCUSS unconditionally, he said: =E2=80=9C-9, third paragraph: I saw a comment on my DISCUSS email thread from Karl Stahl, stating that = DTLS could not be mandated. Has that input been considered? (I don't = have an opinion; I just want to make sure people noticed the = comment.)=E2=80=9D That input has NOT been considered. =20 >From below it seems like the authors will issue a version -11 of the = draft =20 =20 Prashanth, =20 Please, then remove the (D)TLS mandating. Your comment: Not mandating DTLS opens up the client/server to a host of attacks such = as an attacker sending fake requests/responses. The draft is meant for = general purpose TURN server discovery, not specific to WebRTC, and = hence, security considerations have to be broad. is irrelevant for turn server allocations on the LAN, where everything = is as open as it is: You cannot/should not expect the real-time traffic = to have better security by sending it through the turn server path than = through the default gateway path. In addition, WebRTC has DTLS-SRTP of = the real-time traffic mandated in itself! =20 And regarding: > The draft is meant for general purpose TURN server discovery, not = specific to WebRTC Network provided turn servers for WebRTC usage was actually the main = purpose: Specifically that must not be blocked now (thrown in during = discuss phase)! =20 SEE FURTHER INLINE BELOW, regarding the issue repeatedly = ignored/unanswered during the WG stage (since highlighted in version -06 = of this draft). =20 /Karl =20 Fr=C3=A5n: Prashanth Patil (praspati) [mailto:praspati@cisco.com]=20 Skickat: den 18 oktober 2016 04:38 Till: Karl Stahl; 'Spencer Dawkins at IETF'; 'The IESG'; = tram-chairs@ietf.org Kopia: tram@ietf.org; 'Alexey Melnikov'; = draft-ietf-tram-turn-server-discovery@ietf.org; 'Simon Perreault'; = Tirumaleswar Reddy (tireddy) =C3=84mne: Re: SV: [tram] Need to be fixed! Discuss on = draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) =20 =20 =20 On 10/17/16, 1:15 AM, "Karl Stahl" < = karl.stahl@ingate.com> wrote: =20 Spencer, =20 Can the authors of this discovery draft =E2=80=9Cbe ordered=E2=80=9D to = address the two points below? =20 :-) =20 Point 2) was (unnecessarily) introduced during the DISCUSS (I just highlighted to the WG list that it is NOT addressed, in spite of = what is said by an author.) =20 Point 1) has repeatedly been pointed out on this WG list since version = -06 of the draft, but ignored by the authors. =20 =20 We intend to add the following to explain server behavior a little = better: =E2=80=9CA TURN anycast server performs checks 1 to 7 discussed in = Section 6.2 of RFC5766. If all checks pass, the TURN anycast server MUST = respond with a 300 (Try Alternate) error as described in = [RFC5766];=E2=80=9D [Karl] That must be an update of RFC5766. Or does =E2=80=9CTURN anycast = server=E2=80=9D imply that there ALSO is a =E2=80=9CTURN unicast = server=E2=80=9D at the same interface accepting the Allocate request? =20 My proposal is better (in several aspects) and don=E2=80=99t need to = update RFC5766 turn server behavior. =20 As the text is in this version -10 of the draft now is, it does NOT = fulfill its purpose to discover a network provided TURN server to allow = real-time communication, in situations where it otherwise is not = possible or bad. - It does not provide a method suitable for draft-ietf-rtcweb-return-01 - It does not meet the autoconfiguration of RFC 7478 (Web Real-Time = Communication Use Cases and Requirements) 2.3.5.1.=20 =20 More generally (regarding the mandating of (D)TLS, suddenly introduced = during the DISCUSS): We should be able to use WebRTC everywhere we can and do surf, and for = firewall/NAT traversal and quality it is in many cases necessary to = parallel the local firewall/access router/default gateway with a TURN = server, to get a good media path. The automatic discovery of such = network provided turn server should be given by this draft, but it = should NOT set up restrictions for it usage (especially when it is = unnecessary and blocks the general usage e.g. such as specified in = draft-ietf-rtcweb-return-01).=20 =20 Not mandating DTLS opens up the client/server to a host of attacks such = as an attacker sending fake requests/responses. The draft is meant for = general purpose TURN server discovery, not specific to WebRTC, and = hence, security considerations have to be broad. =20 -Prashanth =20 The authors of this draft seem to have some other use case in mind, but = that must not block the usage for which this discovery specification was = required.=20 As written in this version -10 of the draft, it is a showstopper. =20 /Karl =20 =20 ------=_NextPart_000_0484_01D22953.1C5F7CD0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Sp= encer (and authors),

 

We= need the long awaited discovery draft and the anycast method, and = don=E2=80=99t want an =E2=80=9Cappeal (which = gets us right back here, after wasting time).=E2= =80=9D

It= must work for discovery of a network provided turn server, that the = provider of the local network (LAN) has made available for all his users = to run real-time traffic through (rather than through a data crowded or = blocked default gateway path).

 

Th= is draft cannot/must not (thrown in during the DISCUSS!) block such = general usage by under 9 mandating (D)TLS, requiring a new = infrastructure to be established by:

A TURN client MUST use (D)TLS =E2=80=A6

=C2=A0=C2=A0 one of the following techniques with (D)TLS to = validate the TURN

=C2=A0=C2=A0 = server:

=C2=A0=C2=A0 o=C2=A0 For = certificate-based authentication, a pre-populated trust = anchor

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 = store=E2=80=A6

=C2=A0=C2=A0 o=C2=A0 = Certification authorities that issue TURN server = certificates=E2=80=A6

 

es= pecially when the release of authentication of such turn servers have = been specified in the draft.

 

 

Be= n Campebell did not clear his DISCUSS unconditionally, he = said:

=E2=80=9C-9, third = paragraph:
I saw a comment on my DISCUSS email thread from Karl = Stahl, stating that DTLS could not be mandated. Has that input been = considered? (I don't have an opinion; I just want to make sure people = noticed the comment.)=E2=80=9D

Th= at input has NOT been considered.

 

Fr= om below it seems like the authors will issue a version -11 of the = draft

 

 

Pr= ashanth,

 

Pl= ease, then remove the (D)TLS mandating.

Yo= ur comment:

Not = mandating DTLS opens up the client/server to a host of attacks such as = an attacker sending fake requests/responses. =C2= =A0The draft = is meant for general purpose TURN server discovery, not specific to = WebRTC, and hence, security considerations have to be = broad.

is= irrelevant for turn server allocations on the LAN, where everything is = as open as it is: You cannot/should not expect the real-time traffic to = have better security by sending it through the turn server path than = through the default gateway path. In addition, WebRTC has DTLS-SRTP of = the real-time traffic mandated in itself!

 

An= d regarding:

&g= t; The draft = is meant for general purpose TURN server discovery, not specific to = WebRTC

Ne= twork provided turn servers for WebRTC usage was actually the main = purpose: Specifically that must not be blocked now (thrown in during = discuss phase)!

 

SE= E FURTHER INLINE BELOW, regarding the issue repeatedly = ignored/unanswered during the WG stage (since highlighted in version -06 = of this draft).

 

/K= arl

 

Fr=C3=A5n: Prashanth = Patil (praspati) [mailto:praspati@cisco.com]
Skickat: den 18 = oktober 2016 04:38
Till: Karl Stahl; 'Spencer Dawkins at = IETF'; 'The IESG'; tram-chairs@ietf.org
Kopia: tram@ietf.org; = 'Alexey Melnikov'; draft-ietf-tram-turn-server-discovery@ietf.org; = 'Simon Perreault'; Tirumaleswar Reddy (tireddy)
=C3=84mne: Re: = SV: [tram] Need to be fixed! Discuss on = draft-ietf-tram-turn-server-discovery-10: (with = DISCUSS)

 

 

 

On 10/17/16, = 1:15 AM, "Karl Stahl" <karl.stahl@ingate.com> = wrote:

 

S= pencer,

&= nbsp;

C= an the authors of this discovery draft =E2=80=9Cbe ordered=E2=80=9D to = address the two points below?

<= o:p> 

:= -)

&= nbsp;

P= oint 2) was (unnecessarily) introduced during the DISCUSS

(= I just highlighted to the WG list that it is NOT addressed, in spite of = what is said by an author.)

&= nbsp;

P= oint 1) has repeatedly been pointed out on this WG list since version = -06 of the draft, but ignored by the authors. =  

<= o:p> 

We intend to add the = following = to explain server behavior a little better:

=E2=80=9CA TURN anycast server performs checks 1 to 7 discussed in = Section 6.2 of RFC5766. If all checks pass, the TURN anycast server MUST = respond with a 300 (Try Alternate) error as described in = [RFC5766];=E2=80=9D

[K= arl] That must be an update of RFC5766. Or does =E2=80=9CTURN anycast server=E2= =80=9D imply that there ALSO is a =E2=80=9CTURN unicast server=E2=80=9D = at the same interface accepting the Allocate request? = =C2=A0

My= proposal is better (in several aspects) and don=E2=80=99t need to = update RFC5766 turn server behavior.

&= nbsp;

A= s the text is in this version -10 of the draft now is, it does NOT = fulfill its purpose to discover a network provided TURN server to allow = real-time communication, in situations where it otherwise is not = possible or bad.

-= It does not provide a method suitable for draft-ietf-rtcweb-return-01

-= It does not meet the autoconfiguration of RFC 7478 (Web Real-Time = Communication Use Cases and Requirements) 2.3.5.1.

&= nbsp;

M= ore generally (regarding the mandating of (D)TLS, suddenly introduced = during the DISCUSS):

W= e should be able to use WebRTC everywhere we can and do surf, and for = firewall/NAT traversal and quality it is in many cases necessary to = parallel the local firewall/access router/default gateway with a TURN = server, to get a good media path. The automatic discovery of such = network provided turn server should be given by this draft, but it = should NOT set up restrictions for it usage (especially when it is = unnecessary and blocks the general usage e.g. such as specified in = draft-ietf-rtcweb-return-01)= .

<= o:p> 

Not = mandating DTLS opens up the client/server to a host of attacks such as = an attacker sending fake requests/responses. The draft is meant for = general purpose TURN server discovery, not specific to WebRTC, and = hence, security considerations have to be broad.

 =

-Prashanth<= /span>

&= nbsp;

T= he authors of this draft seem to have some other use case in mind, but = that must not block the usage for which this discovery specification was = required.

A= s written in this version -10 of the draft, it is a = showstopper.

&= nbsp;

/= Karl

&= nbsp;

 

------=_NextPart_000_0484_01D22953.1C5F7CD0-- From nobody Tue Oct 18 10:36:26 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE5D812979D; Tue, 18 Oct 2016 10:36:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.951 X-Spam-Level: X-Spam-Status: No, score=-14.951 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hAz4SZbxiMqd; Tue, 18 Oct 2016 10:36:21 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD62D12975C; Tue, 18 Oct 2016 10:36:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=39492; q=dns/txt; s=iport; t=1476812170; x=1478021770; h=from:to:cc:subject:date:message-id:mime-version; bh=YjzBXnaScNV0RZs4Ll5qg2FemtQZDKjmzOsKwVnbCuk=; b=W2hJNkmYdKPJuTbyVZg2Vr0SpmHpF21TTHnAs7TMOAbl5saQ2JYuTsfp zlih1/5VRcyxqm+yx2ig1+pFllSxBOe1d1cFQ9Osr0WZFsbYUP5auSnFz CDHDb/Yy7XbFp3vJJw/5CFR7pbOqXO9mmfCqWog4gJhVUhNQtcZ5trCYI A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CCAQD6XAZY/5tdJa1cGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgwc1AQEBAQEdV3wHjS2XBZIpgg+CCIYhAhqBaTgUAQIBAQEBAQEBYie?= =?us-ascii?q?EYgEBAwEjUQUFDQEIOAECBAMCBDAUEwQBDQWISgi2NYx1AQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBHYY9gX0IglCEGREBBkyCTiyCLwWaCAGQBYFuhGmJIIcQhWuDfwE?= =?us-ascii?q?eNlSDBhwZgTpyhWwNFweBAoEAAQEB?= X-IronPort-AV: E=Sophos;i="5.31,362,1473120000"; d="scan'208,217";a="161140824" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Oct 2016 17:36:08 +0000 Received: from XCH-RTP-020.cisco.com (xch-rtp-020.cisco.com [64.101.220.160]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id u9IHa7AA027907 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 18 Oct 2016 17:36:08 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-020.cisco.com (64.101.220.160) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 18 Oct 2016 13:36:07 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1210.000; Tue, 18 Oct 2016 13:36:07 -0400 From: "Prashanth Patil (praspati)" To: Karl Stahl , "'Spencer Dawkins at IETF'" , "'The IESG'" , "tram-chairs@ietf.org" Thread-Topic: SV: SV: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) Thread-Index: AQHSKWYbxg8dpUhX9UqmGn2PA2CIXQ== Date: Tue, 18 Oct 2016 17:36:07 +0000 Message-ID: <419C3C64-AA08-4358-83BF-61421B8BF3EB@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.85.1] Content-Type: multipart/alternative; boundary="_000_419C3C64AA08435883BF61421B8BF3EBciscocom_" MIME-Version: 1.0 Archived-At: Cc: 'Simon Perreault' , "draft-ietf-tram-turn-server-discovery@ietf.org" , "tram@ietf.org" , "Tirumaleswar Reddy \(tireddy\)" , 'Alexey Melnikov' Subject: Re: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2016 17:36:26 -0000 --_000_419C3C64AA08435883BF61421B8BF3EBciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCk9uIDEwLzE4LzE2LCA2OjIwIEFNLCAiS2FybCBTdGFobCIgPGthcmwuc3RhaGxAaW5nYXRl LmNvbTxtYWlsdG86a2FybC5zdGFobEBpbmdhdGUuY29tPj4gd3JvdGU6DQoNClNwZW5jZXIgKGFu ZCBhdXRob3JzKSwNCg0KV2UgbmVlZCB0aGUgbG9uZyBhd2FpdGVkIGRpc2NvdmVyeSBkcmFmdCBh bmQgdGhlIGFueWNhc3QgbWV0aG9kLCBhbmQgZG9u4oCZdCB3YW50IGFuIOKAnGFwcGVhbCAod2hp Y2ggZ2V0cyB1cyByaWdodCBiYWNrIGhlcmUsIGFmdGVyIHdhc3RpbmcgdGltZSku4oCdDQpJdCBt dXN0IHdvcmsgZm9yIGRpc2NvdmVyeSBvZiBhIG5ldHdvcmsgcHJvdmlkZWQgdHVybiBzZXJ2ZXIs IHRoYXQgdGhlIHByb3ZpZGVyIG9mIHRoZSBsb2NhbCBuZXR3b3JrIChMQU4pIGhhcyBtYWRlIGF2 YWlsYWJsZSBmb3IgYWxsIGhpcyB1c2VycyB0byBydW4gcmVhbC10aW1lIHRyYWZmaWMgdGhyb3Vn aCAocmF0aGVyIHRoYW4gdGhyb3VnaCBhIGRhdGEgY3Jvd2RlZCBvciBibG9ja2VkIGRlZmF1bHQg Z2F0ZXdheSBwYXRoKS4NCg0KVGhpcyBkcmFmdCBjYW5ub3QvbXVzdCBub3QgKHRocm93biBpbiBk dXJpbmcgdGhlIERJU0NVU1MhKSBibG9jayBzdWNoIGdlbmVyYWwgdXNhZ2UgYnkgdW5kZXIgOSBt YW5kYXRpbmcgKEQpVExTLCByZXF1aXJpbmcgYSBuZXcgaW5mcmFzdHJ1Y3R1cmUgdG8gYmUgZXN0 YWJsaXNoZWQgYnk6DQoNCkEgVFVSTiBjbGllbnQgTVVTVCB1c2UgKEQpVExTIOKApg0KDQogICBv bmUgb2YgdGhlIGZvbGxvd2luZyB0ZWNobmlxdWVzIHdpdGggKEQpVExTIHRvIHZhbGlkYXRlIHRo ZSBUVVJODQoNCiAgIHNlcnZlcjoNCg0KICAgbyAgRm9yIGNlcnRpZmljYXRlLWJhc2VkIGF1dGhl bnRpY2F0aW9uLCBhIHByZS1wb3B1bGF0ZWQgdHJ1c3QgYW5jaG9yDQoNCiAgICAgIHN0b3Jl4oCm DQoNCiAgIG8gIENlcnRpZmljYXRpb24gYXV0aG9yaXRpZXMgdGhhdCBpc3N1ZSBUVVJOIHNlcnZl ciBjZXJ0aWZpY2F0ZXPigKYNCg0KZXNwZWNpYWxseSB3aGVuIHRoZSByZWxlYXNlIG9mIGF1dGhl bnRpY2F0aW9uIG9mIHN1Y2ggdHVybiBzZXJ2ZXJzIGhhdmUgYmVlbiBzcGVjaWZpZWQgaW4gdGhl IGRyYWZ0Lg0KDQoNCkJlbiBDYW1wZWJlbGwgZGlkIG5vdCBjbGVhciBoaXMgRElTQ1VTUyB1bmNv bmRpdGlvbmFsbHksIGhlIHNhaWQ6DQoNCuKAnC05LCB0aGlyZCBwYXJhZ3JhcGg6DQpJIHNhdyBh IGNvbW1lbnQgb24gbXkgRElTQ1VTUyBlbWFpbCB0aHJlYWQgZnJvbSBLYXJsIFN0YWhsLCBzdGF0 aW5nIHRoYXQgRFRMUyBjb3VsZCBub3QgYmUgbWFuZGF0ZWQuIEhhcyB0aGF0IGlucHV0IGJlZW4g Y29uc2lkZXJlZD8gKEkgZG9uJ3QgaGF2ZSBhbiBvcGluaW9uOyBJIGp1c3Qgd2FudCB0byBtYWtl IHN1cmUgcGVvcGxlIG5vdGljZWQgdGhlIGNvbW1lbnQuKeKAnQ0KVGhhdCBpbnB1dCBoYXMgTk9U IGJlZW4gY29uc2lkZXJlZC4NCg0KRnJvbSBiZWxvdyBpdCBzZWVtcyBsaWtlIHRoZSBhdXRob3Jz IHdpbGwgaXNzdWUgYSB2ZXJzaW9uIC0xMSBvZiB0aGUgZHJhZnQNCg0KDQpQcmFzaGFudGgsDQoN ClBsZWFzZSwgdGhlbiByZW1vdmUgdGhlIChEKVRMUyBtYW5kYXRpbmcuDQpZb3VyIGNvbW1lbnQ6 DQpOb3QgbWFuZGF0aW5nIERUTFMgb3BlbnMgdXAgdGhlIGNsaWVudC9zZXJ2ZXIgdG8gYSBob3N0 IG9mIGF0dGFja3Mgc3VjaCBhcyBhbiBhdHRhY2tlciBzZW5kaW5nIGZha2UgcmVxdWVzdHMvcmVz cG9uc2VzLiAgVGhlIGRyYWZ0IGlzIG1lYW50IGZvciBnZW5lcmFsIHB1cnBvc2UgVFVSTiBzZXJ2 ZXIgZGlzY292ZXJ5LCBub3Qgc3BlY2lmaWMgdG8gV2ViUlRDLCBhbmQgaGVuY2UsIHNlY3VyaXR5 IGNvbnNpZGVyYXRpb25zIGhhdmUgdG8gYmUgYnJvYWQuDQppcyBpcnJlbGV2YW50IGZvciB0dXJu IHNlcnZlciBhbGxvY2F0aW9ucyBvbiB0aGUgTEFOLA0KDQpUaGUgc2NvcGUgaXMgbW9yZSB0aGFu IGp1c3QgTEFOLg0KDQp3aGVyZSBldmVyeXRoaW5nIGlzIGFzIG9wZW4gYXMgaXQgaXM6IFlvdSBj YW5ub3Qvc2hvdWxkIG5vdCBleHBlY3QgdGhlIHJlYWwtdGltZSB0cmFmZmljIHRvIGhhdmUgYmV0 dGVyIHNlY3VyaXR5IGJ5IHNlbmRpbmcgaXQgdGhyb3VnaCB0aGUgdHVybiBzZXJ2ZXIgcGF0aCB0 aGFuIHRocm91Z2ggdGhlIGRlZmF1bHQgZ2F0ZXdheSBwYXRoLiBJbiBhZGRpdGlvbiwgV2ViUlRD IGhhcyBEVExTLVNSVFAgb2YgdGhlIHJlYWwtdGltZSB0cmFmZmljIG1hbmRhdGVkIGluIGl0c2Vs ZiENCg0KV2ViUlRDIGhhcyB0aGF0IHRvIHByb3RlY3QgYXBwbGljYXRpb24gZGF0YS4gSXQgaGFz IG5vdGhpbmcgdG8gZG8gd2l0aCBUVVJOLiBQcm90ZWN0aW9uIG9mIGFwcGxpY2F0aW9uIGRhdGEg ZG9lcyBub3QgaW1wbHkgVFVSTiBtZXNzYWdlcyBkb27igJl0IG5lZWQgc2VjdXJpdHkuIFRoZSBp bnRlbnQgaGVyZSBpcyB0byBjb25zaWRlciBhc3BlY3RzIG9mIHNlY3VyaXR5IHRoYXQgZGVhbCBk aXJlY3RseSB3aXRoIFRVUk4gbWVzc2FnZXMgYW5kIHRleHQgaW4gdGhlIGRyYWZ0IGFkZHJlc3Nl cyB0aG9zZSBhc3BlY3RzLg0KDQotUHJhc2hhbnRoDQoNCg0KQW5kIHJlZ2FyZGluZzoNCj4gVGhl IGRyYWZ0IGlzIG1lYW50IGZvciBnZW5lcmFsIHB1cnBvc2UgVFVSTiBzZXJ2ZXIgZGlzY292ZXJ5 LCBub3Qgc3BlY2lmaWMgdG8gV2ViUlRDDQpOZXR3b3JrIHByb3ZpZGVkIHR1cm4gc2VydmVycyBm b3IgV2ViUlRDIHVzYWdlIHdhcyBhY3R1YWxseSB0aGUgbWFpbiBwdXJwb3NlOiBTcGVjaWZpY2Fs bHkgdGhhdCBtdXN0IG5vdCBiZSBibG9ja2VkIG5vdyAodGhyb3duIGluIGR1cmluZyBkaXNjdXNz IHBoYXNlKSENCg0KU0VFIEZVUlRIRVIgSU5MSU5FIEJFTE9XLCByZWdhcmRpbmcgdGhlIGlzc3Vl IHJlcGVhdGVkbHkgaWdub3JlZC91bmFuc3dlcmVkIGR1cmluZyB0aGUgV0cgc3RhZ2UgKHNpbmNl IGhpZ2hsaWdodGVkIGluIHZlcnNpb24gLTA2IG9mIHRoaXMgZHJhZnQpLg0KDQovS2FybA0KDQpG csOlbjogUHJhc2hhbnRoIFBhdGlsIChwcmFzcGF0aSkgW21haWx0bzpwcmFzcGF0aUBjaXNjby5j b21dDQpTa2lja2F0OiBkZW4gMTggb2t0b2JlciAyMDE2IDA0OjM4DQpUaWxsOiBLYXJsIFN0YWhs OyAnU3BlbmNlciBEYXdraW5zIGF0IElFVEYnOyAnVGhlIElFU0cnOyB0cmFtLWNoYWlyc0BpZXRm Lm9yZw0KS29waWE6IHRyYW1AaWV0Zi5vcmc7ICdBbGV4ZXkgTWVsbmlrb3YnOyBkcmFmdC1pZXRm LXRyYW0tdHVybi1zZXJ2ZXItZGlzY292ZXJ5QGlldGYub3JnOyAnU2ltb24gUGVycmVhdWx0Jzsg VGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5KQ0Kw4RtbmU6IFJlOiBTVjogW3RyYW1dIE5lZWQg dG8gYmUgZml4ZWQhIERpc2N1c3Mgb24gZHJhZnQtaWV0Zi10cmFtLXR1cm4tc2VydmVyLWRpc2Nv dmVyeS0xMDogKHdpdGggRElTQ1VTUykNCg0KDQoNCk9uIDEwLzE3LzE2LCAxOjE1IEFNLCAiS2Fy bCBTdGFobCIgPGthcmwuc3RhaGxAaW5nYXRlLmNvbTxtYWlsdG86a2FybC5zdGFobEBpbmdhdGUu Y29tPj4gd3JvdGU6DQoNClNwZW5jZXIsDQoNCkNhbiB0aGUgYXV0aG9ycyBvZiB0aGlzIGRpc2Nv dmVyeSBkcmFmdCDigJxiZSBvcmRlcmVk4oCdIHRvIGFkZHJlc3MgdGhlIHR3byBwb2ludHMgYmVs b3c/DQoNCjotKQ0KDQpQb2ludCAyKSB3YXMgKHVubmVjZXNzYXJpbHkpIGludHJvZHVjZWQgZHVy aW5nIHRoZSBESVNDVVNTDQooSSBqdXN0IGhpZ2hsaWdodGVkIHRvIHRoZSBXRyBsaXN0IHRoYXQg aXQgaXMgTk9UIGFkZHJlc3NlZCwgaW4gc3BpdGUgb2Ygd2hhdCBpcyBzYWlkIGJ5IGFuIGF1dGhv ci4pDQoNClBvaW50IDEpIGhhcyByZXBlYXRlZGx5IGJlZW4gcG9pbnRlZCBvdXQgb24gdGhpcyBX RyBsaXN0IHNpbmNlIHZlcnNpb24gLTA2IG9mIHRoZSBkcmFmdCwgYnV0IGlnbm9yZWQgYnkgdGhl IGF1dGhvcnMuDQoNCldlIGludGVuZCB0byBhZGQgdGhlIGZvbGxvd2luZyB0byBleHBsYWluIHNl cnZlciBiZWhhdmlvciBhIGxpdHRsZSBiZXR0ZXI6DQrigJxBIFRVUk4gYW55Y2FzdCBzZXJ2ZXIg cGVyZm9ybXMgY2hlY2tzIDEgdG8gNyBkaXNjdXNzZWQgaW4gU2VjdGlvbiA2LjIgb2YgUkZDNTc2 Ni4gSWYgYWxsIGNoZWNrcyBwYXNzLCB0aGUgVFVSTiBhbnljYXN0IHNlcnZlciBNVVNUIHJlc3Bv bmQgd2l0aCBhIDMwMCAoVHJ5IEFsdGVybmF0ZSkgZXJyb3IgYXMgZGVzY3JpYmVkIGluIFtSRkM1 NzY2XTvigJ0NCltLYXJsXSBUaGF0IG11c3QgYmUgYW4gdXBkYXRlIG9mIFJGQzU3NjYuIE9yIGRv ZXMg4oCcVFVSTiBhbnljYXN0IHNlcnZlcuKAnSBpbXBseSB0aGF0IHRoZXJlIEFMU08gaXMgYSDi gJxUVVJOIHVuaWNhc3Qgc2VydmVy4oCdIGF0IHRoZSBzYW1lIGludGVyZmFjZSBhY2NlcHRpbmcg dGhlIEFsbG9jYXRlIHJlcXVlc3Q/DQpNeSBwcm9wb3NhbCBpcyBiZXR0ZXIgKGluIHNldmVyYWwg YXNwZWN0cykgYW5kIGRvbuKAmXQgbmVlZCB0byB1cGRhdGUgUkZDNTc2NiB0dXJuIHNlcnZlciBi ZWhhdmlvci4NCg0KQXMgdGhlIHRleHQgaXMgaW4gdGhpcyB2ZXJzaW9uIC0xMCBvZiB0aGUgZHJh ZnQgbm93IGlzLCBpdCBkb2VzIE5PVCBmdWxmaWxsIGl0cyBwdXJwb3NlIHRvIGRpc2NvdmVyIGEg bmV0d29yayBwcm92aWRlZCBUVVJOIHNlcnZlciB0byBhbGxvdyByZWFsLXRpbWUgY29tbXVuaWNh dGlvbiwgaW4gc2l0dWF0aW9ucyB3aGVyZSBpdCBvdGhlcndpc2UgaXMgbm90IHBvc3NpYmxlIG9y IGJhZC4NCi0gSXQgZG9lcyBub3QgcHJvdmlkZSBhIG1ldGhvZCBzdWl0YWJsZSBmb3IgZHJhZnQt aWV0Zi1ydGN3ZWItcmV0dXJuLTAxDQotIEl0IGRvZXMgbm90IG1lZXQgdGhlIGF1dG9jb25maWd1 cmF0aW9uIG9mIFJGQyA3NDc4IChXZWIgUmVhbC1UaW1lIENvbW11bmljYXRpb24gVXNlIENhc2Vz IGFuZCBSZXF1aXJlbWVudHMpIDIuMy41LjEuDQoNCk1vcmUgZ2VuZXJhbGx5IChyZWdhcmRpbmcg dGhlIG1hbmRhdGluZyBvZiAoRClUTFMsIHN1ZGRlbmx5IGludHJvZHVjZWQgZHVyaW5nIHRoZSBE SVNDVVNTKToNCldlIHNob3VsZCBiZSBhYmxlIHRvIHVzZSBXZWJSVEMgZXZlcnl3aGVyZSB3ZSBj YW4gYW5kIGRvIHN1cmYsIGFuZCBmb3IgZmlyZXdhbGwvTkFUIHRyYXZlcnNhbCBhbmQgcXVhbGl0 eSBpdCBpcyBpbiBtYW55IGNhc2VzIG5lY2Vzc2FyeSB0byBwYXJhbGxlbCB0aGUgbG9jYWwgZmly ZXdhbGwvYWNjZXNzIHJvdXRlci9kZWZhdWx0IGdhdGV3YXkgd2l0aCBhIFRVUk4gc2VydmVyLCB0 byBnZXQgYSBnb29kIG1lZGlhIHBhdGguIFRoZSBhdXRvbWF0aWMgZGlzY292ZXJ5IG9mIHN1Y2gg bmV0d29yayBwcm92aWRlZCB0dXJuIHNlcnZlciBzaG91bGQgYmUgZ2l2ZW4gYnkgdGhpcyBkcmFm dCwgYnV0IGl0IHNob3VsZCBOT1Qgc2V0IHVwIHJlc3RyaWN0aW9ucyBmb3IgaXQgdXNhZ2UgKGVz cGVjaWFsbHkgd2hlbiBpdCBpcyB1bm5lY2Vzc2FyeSBhbmQgYmxvY2tzIHRoZSBnZW5lcmFsIHVz YWdlIGUuZy4gc3VjaCBhcyBzcGVjaWZpZWQgaW4gZHJhZnQtaWV0Zi1ydGN3ZWItcmV0dXJuLTAx KS4NCg0KTm90IG1hbmRhdGluZyBEVExTIG9wZW5zIHVwIHRoZSBjbGllbnQvc2VydmVyIHRvIGEg aG9zdCBvZiBhdHRhY2tzIHN1Y2ggYXMgYW4gYXR0YWNrZXIgc2VuZGluZyBmYWtlIHJlcXVlc3Rz L3Jlc3BvbnNlcy4gVGhlIGRyYWZ0IGlzIG1lYW50IGZvciBnZW5lcmFsIHB1cnBvc2UgVFVSTiBz ZXJ2ZXIgZGlzY292ZXJ5LCBub3Qgc3BlY2lmaWMgdG8gV2ViUlRDLCBhbmQgaGVuY2UsIHNlY3Vy aXR5IGNvbnNpZGVyYXRpb25zIGhhdmUgdG8gYmUgYnJvYWQuDQoNCi1QcmFzaGFudGgNCg0KVGhl IGF1dGhvcnMgb2YgdGhpcyBkcmFmdCBzZWVtIHRvIGhhdmUgc29tZSBvdGhlciB1c2UgY2FzZSBp biBtaW5kLCBidXQgdGhhdCBtdXN0IG5vdCBibG9jayB0aGUgdXNhZ2UgZm9yIHdoaWNoIHRoaXMg ZGlzY292ZXJ5IHNwZWNpZmljYXRpb24gd2FzIHJlcXVpcmVkLg0KQXMgd3JpdHRlbiBpbiB0aGlz IHZlcnNpb24gLTEwIG9mIHRoZSBkcmFmdCwgaXQgaXMgYSBzaG93c3RvcHBlci4NCg0KL0thcmwN Cg0KDQo= --_000_419C3C64AA08435883BF61421B8BF3EBciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <9EC3C53B9D18994AB069B6A6DD3D9B4F@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6QXJpYWw7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAy IDIgMiAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCXBh bm9zZS0xOjIgNyAzIDkgMiAyIDUgMiA0IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToi Q2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZh Y2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCXBhbm9zZS0xOjIgMTEg NiA5IDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6UE1pbmdMaVU7DQoJ cGFub3NlLTE6MiAyIDUgMCAwIDAgMCAwIDAgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5 OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQovKiBTdHlsZSBEZWZp bml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXtt YXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxp bmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0 aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnAuTXNvUGxhaW5UZXh0LCBsaS5Nc29QbGFpblRleHQsIGRpdi5Nc29QbGFp blRleHQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFpbiBU ZXh0IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KcA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJp Z2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47 DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpw Lk1zb0FjZXRhdGUsIGxpLk1zb0FjZXRhdGUsIGRpdi5Nc29BY2V0YXRlDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiQmFsbG9vbiBUZXh0IENoYXIiOw0KCW1hcmdp bjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21z by1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5QbGFpblRleHRDaGFyDQoJe21z by1zdHlsZS1uYW1lOiJQbGFpbiBUZXh0IENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsN Cgltc28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCI7DQoJZm9udC1mYW1pbHk6Q291cmllcjt9DQpz cGFuLkJhbGxvb25UZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiQmFsbG9vbiBUZXh0IENoYXIi Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiQmFsbG9vbiBUZXh0 IjsNCglmb250LWZhbWlseTpDYWxpYnJpO30NCnAuT2Zvcm1hdGVyYWR0ZXh0LCBsaS5PZm9ybWF0 ZXJhZHRleHQsIGRpdi5PZm9ybWF0ZXJhZHRleHQNCgl7bXNvLXN0eWxlLW5hbWU6Ik9mb3JtYXRl cmFkIHRleHQiOw0KCW1zby1zdHlsZS1saW5rOiJPZm9ybWF0ZXJhZCB0ZXh0IENoYXIiOw0KCW1h cmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJ Zm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0Kc3Bhbi5PZm9ybWF0ZXJhZHRleHRDaGFy DQoJe21zby1zdHlsZS1uYW1lOiJPZm9ybWF0ZXJhZCB0ZXh0IENoYXIiOw0KCW1zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiT2Zvcm1hdGVyYWQgdGV4dCI7DQoJZm9udC1m YW1pbHk6Q29uc29sYXM7fQ0KcC5CYWxsb25ndGV4dCwgbGkuQmFsbG9uZ3RleHQsIGRpdi5CYWxs b25ndGV4dA0KCXttc28tc3R5bGUtbmFtZTpCYWxsb25ndGV4dDsNCgltc28tc3R5bGUtbGluazoi QmFsbG9uZ3RleHQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpz cGFuLkJhbGxvbmd0ZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiQmFsbG9uZ3RleHQgQ2hhciI7 DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOkJhbGxvbmd0ZXh0Ow0K CWZvbnQtZmFtaWx5OlRhaG9tYTt9DQpzcGFuLkVtYWlsU3R5bGUyNw0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbDsNCglmb250LWZhbWlseTpBcmlhbDsNCgljb2xvcjpibHVlO30NCnNwYW4uRW1h aWxTdHlsZTI4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OkFyaWFs Ow0KCWNvbG9yOmJsdWU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjkNCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWw7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4u RW1haWxTdHlsZTMwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OkFy aWFsOw0KCWNvbG9yOmJsdWU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMzENCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0ZXh0 O30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHls ZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQou TXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6 MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJn aW46NzAuODVwdCA3MC44NXB0IDcwLjg1cHQgNzAuODVwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJ e3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9y PSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9y OmJsYWNrIj5PbiAxMC8xOC8xNiwgNjoyMCBBTSwgJnF1b3Q7S2FybCBTdGFobCZxdW90OyAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmthcmwuc3RhaGxAaW5nYXRlLmNvbSI+a2FybC5zdGFobEBpbmdhdGUu Y29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUiPlNwZW5jZXIgKGFuZCBhdXRob3JzKSw8L3Nw YW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFy aWFsO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVlIj5XZSBuZWVkIHRoZSBsb25nIGF3 YWl0ZWQgZGlzY292ZXJ5IGRyYWZ0IGFuZCB0aGUgYW55Y2FzdCBtZXRob2QsIGFuZCBkb27igJl0 IHdhbnQgYW4g4oCcPC9zcGFuPmFwcGVhbCAod2hpY2ggZ2V0cyB1cyByaWdodCBiYWNrIGhlcmUs IGFmdGVyIHdhc3RpbmcgdGltZSkuPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6QXJpYWw7Y29sb3I6Ymx1ZSI+4oCdDQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6Ymx1ZSI+SXQgbXVzdCB3b3Jr IGZvciBkaXNjb3Zlcnkgb2YgYSBuZXR3b3JrIHByb3ZpZGVkIHR1cm4gc2VydmVyLCB0aGF0IHRo ZSBwcm92aWRlciBvZiB0aGUgbG9jYWwgbmV0d29yayAoTEFOKSBoYXMgbWFkZSBhdmFpbGFibGUg Zm9yIGFsbCBoaXMgdXNlcnMgdG8gcnVuDQogcmVhbC10aW1lIHRyYWZmaWMgdGhyb3VnaCAocmF0 aGVyIHRoYW4gdGhyb3VnaCBhIGRhdGEgY3Jvd2RlZCBvciBibG9ja2VkIGRlZmF1bHQgZ2F0ZXdh eSBwYXRoKS4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTpBcmlhbDtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6Ymx1ZSI+VGhpcyBkcmFm dCBjYW5ub3QvbXVzdCBub3QgKHRocm93biBpbiBkdXJpbmcgdGhlIERJU0NVU1MhKSBibG9jayBz dWNoIGdlbmVyYWwgdXNhZ2UgYnkgdW5kZXIgOSBtYW5kYXRpbmcgKEQpVExTLCByZXF1aXJpbmcg YSBuZXcgaW5mcmFzdHJ1Y3R1cmUgdG8gYmUgZXN0YWJsaXNoZWQNCiBieTo8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5BIFRV Uk4gY2xpZW50IE1VU1QgdXNlIChEKVRMUyDigKY8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsmbmJzcDsgb25lIG9m IHRoZSBmb2xsb3dpbmcgdGVjaG5pcXVlcyB3aXRoIChEKVRMUyB0byB2YWxpZGF0ZSB0aGUgVFVS Tjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPiZuYnNwOyZuYnNwOyBzZXJ2ZXI6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7Jm5ic3A7IG8mbmJz cDsgRm9yIGNlcnRpZmljYXRlLWJhc2VkIGF1dGhlbnRpY2F0aW9uLCBhIHByZS1wb3B1bGF0ZWQg dHJ1c3QgYW5jaG9yPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHN0b3Jl 4oCmPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+Jm5ic3A7Jm5ic3A7IG8mbmJzcDsgQ2VydGlmaWNhdGlvbiBhdXRob3JpdGll cyB0aGF0IGlzc3VlIFRVUk4gc2VydmVyIGNlcnRpZmljYXRlc+KApjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVlIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6QXJpYWw7Y29sb3I6Ymx1ZSI+ZXNwZWNpYWxseSB3aGVuIHRoZSByZWxlYXNlIG9mIGF1dGhl bnRpY2F0aW9uIG9mIHN1Y2ggdHVybiBzZXJ2ZXJzIGhhdmUgYmVlbiBzcGVjaWZpZWQgaW4gdGhl IGRyYWZ0Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTpBcmlhbDtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6Ymx1ZSI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2Nv bG9yOmJsdWUiPkJlbiBDYW1wZWJlbGwNCjxiPmRpZCBub3QgY2xlYXIgaGlzIERJU0NVU1MgdW5j b25kaTwvYj50aW9uYWxseSwgaGUgc2FpZDo8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsIj7igJwt OSwgdGhpcmQgcGFyYWdyYXBoOjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6UE1pbmdM aVUiPjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6QXJpYWwiPkkgc2F3IGEg Y29tbWVudCBvbiBteSBESVNDVVNTIGVtYWlsIHRocmVhZCBmcm9tIEthcmwgU3RhaGwsIHN0YXRp bmcgdGhhdCBEVExTIGNvdWxkIG5vdCBiZSBtYW5kYXRlZC4gSGFzIHRoYXQgaW5wdXQgYmVlbiBj b25zaWRlcmVkPyAoSSBkb24ndCBoYXZlIGFuIG9waW5pb247IEkganVzdCB3YW50IHRvIG1ha2Ug c3VyZSBwZW9wbGUgbm90aWNlZCB0aGUgY29tbWVudC4p4oCdPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUiPlRoYXQg aW5wdXQgaGFzIE5PVCBiZWVuIGNvbnNpZGVyZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtj b2xvcjpibHVlIj5Gcm9tIGJlbG93IGl0IHNlZW1zIGxpa2UgdGhlIGF1dGhvcnMgd2lsbCBpc3N1 ZSBhIHZlcnNpb24gLTExIG9mIHRoZSBkcmFmdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29s b3I6Ymx1ZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUiPlByYXNoYW50aCw8L3NwYW4+PC9iPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9y OmJsdWUiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVlIj5QbGVhc2UsIHRoZW4gcmVtb3ZlIHRoZSAoRClU TFMgbWFuZGF0aW5nLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVlIj5Zb3VyIGNvbW1lbnQ6PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPk5vdCBtYW5k YXRpbmcgRFRMUyBvcGVucyB1cCB0aGUgY2xpZW50L3NlcnZlciB0byBhIGhvc3Qgb2YgYXR0YWNr cyBzdWNoIGFzIGFuIGF0dGFja2VyIHNlbmRpbmcgZmFrZSByZXF1ZXN0cy9yZXNwb25zZXMuDQo8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29s b3I6Ymx1ZSI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPlRoZSBkcmFmdCBpcyBtZWFudCBmb3IgZ2VuZXJhbCBwdXJwb3NlIFRV Uk4gc2VydmVyIGRpc2NvdmVyeSwgbm90IHNwZWNpZmljIHRvIFdlYlJUQywgYW5kIGhlbmNlLCBz ZWN1cml0eSBjb25zaWRlcmF0aW9ucyBoYXZlIHRvIGJlDQogYnJvYWQuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUi PmlzIGlycmVsZXZhbnQgZm9yIHR1cm4gc2VydmVyIGFsbG9jYXRpb25zIG9uIHRoZSBMQU4sPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFs O2NvbG9yOmJsdWUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2Nv bG9yOmJsYWNrIj5UaGUgc2NvcGUgaXMgbW9yZSB0aGFuIGp1c3QgTEFOLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVl Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6QXJpYWw7Y29sb3I6Ymx1ZSI+d2hlcmUgZXZlcnl0aGluZyBpcyBhcyBvcGVuIGFzIGl0 IGlzOiBZb3UgY2Fubm90L3Nob3VsZCBub3QgZXhwZWN0IHRoZSByZWFsLXRpbWUgdHJhZmZpYyB0 byBoYXZlIGJldHRlciBzZWN1cml0eSBieSBzZW5kaW5nIGl0IHRocm91Z2ggdGhlIHR1cm4gc2Vy dmVyDQogcGF0aCB0aGFuIHRocm91Z2ggdGhlIGRlZmF1bHQgZ2F0ZXdheSBwYXRoLiBJbiBhZGRp dGlvbiwgV2ViUlRDIGhhcyBEVExTLVNSVFAgb2YgdGhlIHJlYWwtdGltZSB0cmFmZmljIG1hbmRh dGVkIGluIGl0c2VsZiE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6Ymx1ZSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQtYXV0b3NwYWNlOm5vbmUiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj5X ZWJSVEMgaGFzIHRoYXQgdG8gcHJvdGVjdCBhcHBsaWNhdGlvbiBkYXRhLiBJdCBoYXMgbm90aGlu ZyB0byBkbyB3aXRoIFRVUk4uIFByb3RlY3Rpb24gb2YgYXBwbGljYXRpb24gZGF0YSBkb2VzIG5v dCBpbXBseSBUVVJOIG1lc3NhZ2VzIGRvbuKAmXQgbmVlZA0KIHNlY3VyaXR5LiBUaGUgaW50ZW50 IGhlcmUgaXMgdG8gY29uc2lkZXIgYXNwZWN0cyBvZiBzZWN1cml0eSB0aGF0IGRlYWwgZGlyZWN0 bHkgd2l0aCBUVVJOIG1lc3NhZ2VzIGFuZCB0ZXh0IGluIHRoZSBkcmFmdCBhZGRyZXNzZXMgdGhv c2UgYXNwZWN0cy4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJ0ZXh0LWF1dG9zcGFjZTpub25lIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQtYXV0b3NwYWNlOm5vbmUiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNr Ij4tUHJhc2hhbnRoPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpi bHVlIj5BbmQgcmVnYXJkaW5nOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVlIj4mZ3Q7PC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiBUaGUgZHJhZnQgaXMgbWVh bnQgZm9yIGdlbmVyYWwgcHVycG9zZSBUVVJOIHNlcnZlciBkaXNjb3ZlcnksIG5vdCBzcGVjaWZp YyB0byBXZWJSVEM8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6QXJpYWw7Y29sb3I6Ymx1ZSI+TmV0d29yayBwcm92aWRlZCB0dXJuIHNlcnZlcnMg Zm9yIFdlYlJUQyB1c2FnZSB3YXMgYWN0dWFsbHkgdGhlIG1haW4gcHVycG9zZTogU3BlY2lmaWNh bGx5IHRoYXQgbXVzdCBub3QgYmUgYmxvY2tlZCBub3cgKHRocm93biBpbiBkdXJpbmcgZGlzY3Vz cyBwaGFzZSkhPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVlIj5TRUUgRlVSVEhF UiBJTkxJTkUgQkVMT1csIHJlZ2FyZGluZyB0aGUgaXNzdWUgcmVwZWF0ZWRseSBpZ25vcmVkL3Vu YW5zd2VyZWQgZHVyaW5nIHRoZSBXRyBzdGFnZSAoc2luY2UgaGlnaGxpZ2h0ZWQgaW4gdmVyc2lv biAtMDYgb2YgdGhpcyBkcmFmdCkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibHVl Ij4vS2FybDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTpBcmlhbDtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OlRhaG9tYSI+RnLDpW46PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTpUYWhvbWEiPiBQcmFzaGFudGggUGF0aWwgKHByYXNwYXRpKSBbbWFp bHRvOnByYXNwYXRpQGNpc2NvLmNvbV0NCjxicj4NCjxiPlNraWNrYXQ6PC9iPiBkZW4gMTggb2t0 b2JlciAyMDE2IDA0OjM4PGJyPg0KPGI+VGlsbDo8L2I+IEthcmwgU3RhaGw7ICdTcGVuY2VyIERh d2tpbnMgYXQgSUVURic7ICdUaGUgSUVTRyc7IHRyYW0tY2hhaXJzQGlldGYub3JnPGJyPg0KPGI+ S29waWE6PC9iPiB0cmFtQGlldGYub3JnOyAnQWxleGV5IE1lbG5pa292JzsgZHJhZnQtaWV0Zi10 cmFtLXR1cm4tc2VydmVyLWRpc2NvdmVyeUBpZXRmLm9yZzsgJ1NpbW9uIFBlcnJlYXVsdCc7IFRp cnVtYWxlc3dhciBSZWRkeSAodGlyZWRkeSk8YnI+DQo8Yj7DhG1uZTo8L2I+IFJlOiBTVjogW3Ry YW1dIE5lZWQgdG8gYmUgZml4ZWQhIERpc2N1c3Mgb24gZHJhZnQtaWV0Zi10cmFtLXR1cm4tc2Vy dmVyLWRpc2NvdmVyeS0xMDogKHdpdGggRElTQ1VTUyk8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2siPk9uIDEwLzE3LzE2LCAxOjE1 IEFNLCAmcXVvdDtLYXJsIFN0YWhsJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86a2FybC5zdGFo bEBpbmdhdGUuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPmthcmwuc3RhaGxAaW5nYXRl LmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlh bDtjb2xvcjpibGFjayI+U3BlbmNlciw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9y OmJsYWNrIj5DYW4gdGhlIGF1dGhvcnMgb2YgdGhpcyBkaXNjb3ZlcnkgZHJhZnQg4oCcYmUgb3Jk ZXJlZOKAnSB0byBhZGRyZXNzIHRoZSB0d28gcG9pbnRzIGJlbG93Pzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6YmxhY2si PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTpBcmlhbDtjb2xvcjpibGFjayI+Oi0pPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtj b2xvcjpibGFjayI+UG9pbnQgMikgd2FzICh1bm5lY2Vzc2FyaWx5KSBpbnRyb2R1Y2VkIGR1cmlu ZyB0aGUgRElTQ1VTUzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6YmxhY2siPihJIGp1c3QgaGlnaGxpZ2h0ZWQgdG8gdGhl IFdHIGxpc3QgdGhhdCBpdCBpcyBOT1QgYWRkcmVzc2VkLCBpbiBzcGl0ZSBvZiB3aGF0IGlzIHNh aWQgYnkgYW4gYXV0aG9yLik8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNr Ij5Qb2ludCAxKSBoYXMgcmVwZWF0ZWRseSBiZWVuIHBvaW50ZWQgb3V0IG9uIHRoaXMgV0cgbGlz dCBzaW5jZSB2ZXJzaW9uIC0wNiBvZiB0aGUgZHJhZnQsIGJ1dCBpZ25vcmVkIGJ5IHRoZSBhdXRo b3JzLiAmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6YmxhY2s7YmFja2dy b3VuZDp5ZWxsb3c7bXNvLWhpZ2hsaWdodDp5ZWxsb3ciPldlIGludGVuZCB0byBhZGQgdGhlIGZv bGxvd2luZzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpB cmlhbDtjb2xvcjpibGFjayI+IHRvIGV4cGxhaW4gc2VydmVyDQogYmVoYXZpb3IgYSBsaXR0bGUg YmV0dGVyOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj7igJxBIFRVUk4gYW55Y2FzdCBzZXJ2ZXIgcGVyZm9y bXMgY2hlY2tzIDEgdG8gNyBkaXNjdXNzZWQgaW4gU2VjdGlvbiA2LjIgb2YgUkZDNTc2Ni4gSWYg YWxsIGNoZWNrcyBwYXNzLCB0aGUgVFVSTiBhbnljYXN0IHNlcnZlciBNVVNUIHJlc3BvbmQgd2l0 aCBhIDMwMA0KIChUcnkgQWx0ZXJuYXRlKSBlcnJvciBhcyBkZXNjcmliZWQgaW4gW1JGQzU3NjZd O+KAnTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTpBcmlhbDtjb2xvcjpibHVlIj5bS2FybF0gVGhhdCBtdXN0IGJlIGFuIHVwZGF0ZSBvZiBSRkM1 NzY2LiBPciBkb2VzIOKAnDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5UVVJOIGFueWNhc3Qgc2VydmVyPC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsdWUi PuKAnQ0KIGltcGx5IHRoYXQgdGhlcmUgQUxTTyBpcyBhIOKAnFRVUk4gdW5pY2FzdCBzZXJ2ZXLi gJ0gYXQgdGhlIHNhbWUgaW50ZXJmYWNlIGFjY2VwdGluZyB0aGUgQWxsb2NhdGUgcmVxdWVzdD8g Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFt aWx5OkFyaWFsO2NvbG9yOmJsdWUiPk15IHByb3Bvc2FsIGlzIGJldHRlciAoaW4gc2V2ZXJhbCBh c3BlY3RzKSBhbmQgZG9u4oCZdCBuZWVkIHRvIHVwZGF0ZSBSRkM1NzY2IHR1cm4gc2VydmVyIGJl aGF2aW9yLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6QXJpYWw7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6QXJpYWw7Y29sb3I6YmxhY2siPkFzIHRoZSB0 ZXh0IGlzIGluIHRoaXMgdmVyc2lvbiAtMTAgb2YgdGhlIGRyYWZ0IG5vdyBpcywgaXQgZG9lcyBO T1QgZnVsZmlsbCBpdHMgcHVycG9zZSB0byBkaXNjb3ZlciBhIG5ldHdvcmsgcHJvdmlkZWQgVFVS TiBzZXJ2ZXIgdG8gYWxsb3cgcmVhbC10aW1lDQogY29tbXVuaWNhdGlvbiwgaW4gc2l0dWF0aW9u cyB3aGVyZSBpdCBvdGhlcndpc2UgaXMgbm90IHBvc3NpYmxlIG9yIGJhZC48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJs YWNrIj4tIEl0IGRvZXMgbm90IHByb3ZpZGUgYSBtZXRob2Qgc3VpdGFibGUgZm9yDQo8L3NwYW4+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5kcmFmdC1pZXRmLXJ0Y3dlYi1yZXR1cm4tMDE8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFs O2NvbG9yOmJsYWNrIj4tIEl0IGRvZXMgbm90IG1lZXQgdGhlIGF1dG9jb25maWd1cmF0aW9uIG9m IFJGQyA3NDc4IChXZWIgUmVhbC1UaW1lIENvbW11bmljYXRpb24gVXNlIENhc2VzIGFuZCBSZXF1 aXJlbWVudHMpIDIuMy41LjEuDQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJs YWNrIj5Nb3JlIGdlbmVyYWxseSAocmVnYXJkaW5nIHRoZSBtYW5kYXRpbmcgb2YgKEQpVExTLCBz dWRkZW5seSBpbnRyb2R1Y2VkIGR1cmluZyB0aGUgRElTQ1VTUyk6PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+ V2Ugc2hvdWxkIGJlIGFibGUgdG8gdXNlIFdlYlJUQyBldmVyeXdoZXJlIHdlIGNhbiBhbmQgZG8g c3VyZiwgYW5kIGZvciBmaXJld2FsbC9OQVQgdHJhdmVyc2FsIGFuZCBxdWFsaXR5IGl0IGlzIGlu IG1hbnkgY2FzZXMgbmVjZXNzYXJ5IHRvIHBhcmFsbGVsIHRoZQ0KIGxvY2FsIGZpcmV3YWxsL2Fj Y2VzcyByb3V0ZXIvZGVmYXVsdCBnYXRld2F5IHdpdGggYSBUVVJOIHNlcnZlciwgdG8gZ2V0IGEg Z29vZCBtZWRpYSBwYXRoLiBUaGUgYXV0b21hdGljIGRpc2NvdmVyeSBvZiBzdWNoIG5ldHdvcmsg cHJvdmlkZWQgdHVybiBzZXJ2ZXIgc2hvdWxkIGJlIGdpdmVuIGJ5IHRoaXMgZHJhZnQsIGJ1dCBp dCBzaG91bGQgTk9UIHNldCB1cCByZXN0cmljdGlvbnMgZm9yIGl0IHVzYWdlIChlc3BlY2lhbGx5 IHdoZW4gaXQgaXMNCiB1bm5lY2Vzc2FyeSBhbmQgYmxvY2tzIHRoZSBnZW5lcmFsIHVzYWdlIGUu Zy4gc3VjaCBhcyBzcGVjaWZpZWQgaW4gPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ ZHJhZnQtaWV0Zi1ydGN3ZWItcmV0dXJuLTAxPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj4pLg0KPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFj ayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPk5vdCBtYW5kYXRpbmcgRFRMUyBvcGVucyB1cCB0aGUgY2xpZW50L3Nl cnZlciB0byBhIGhvc3Qgb2YgYXR0YWNrcyBzdWNoIGFzIGFuIGF0dGFja2VyIHNlbmRpbmcgZmFr ZSByZXF1ZXN0cy9yZXNwb25zZXMuIFRoZSBkcmFmdCBpcyBtZWFudCBmb3IgZ2VuZXJhbCBwdXJw b3NlIFRVUk4NCiBzZXJ2ZXIgZGlzY292ZXJ5LCBub3Qgc3BlY2lmaWMgdG8gV2ViUlRDLCBhbmQg aGVuY2UsIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGhhdmUgdG8gYmUgYnJvYWQuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj4tUHJhc2hhbnRoPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGlu Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xvcjpi bGFjayI+VGhlIGF1dGhvcnMgb2YgdGhpcyBkcmFmdCBzZWVtIHRvIGhhdmUgc29tZSBvdGhlciB1 c2UgY2FzZSBpbiBtaW5kLCBidXQgdGhhdCBtdXN0IG5vdCBibG9jayB0aGUgdXNhZ2UgZm9yIHdo aWNoIHRoaXMgZGlzY292ZXJ5IHNwZWNpZmljYXRpb24gd2FzIHJlcXVpcmVkLg0KPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEu MGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpBcmlhbDtjb2xv cjpibGFjayI+QXMgd3JpdHRlbiBpbiB0aGlzIHZlcnNpb24gLTEwIG9mIHRoZSBkcmFmdCwgaXQg aXMgYSBzaG93c3RvcHBlci48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OkFyaWFsO2NvbG9yOmJsYWNr Ij4vS2FybDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6QXJpYWw7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_419C3C64AA08435883BF61421B8BF3EBciscocom_-- From nobody Tue Oct 18 12:26:43 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4533129416; Tue, 18 Oct 2016 12:26:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.902 X-Spam-Level: X-Spam-Status: No, score=-0.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_MULTIPLE_AT=1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ingate.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NU0JKfCqcvjn; Tue, 18 Oct 2016 12:26:39 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0066.outbound.protection.outlook.com [104.47.1.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96F95124281; Tue, 18 Oct 2016 12:26:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ingate.onmicrosoft.com; s=selector1-ingate-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=j86oSPUsow820ZAgA298ChxuK8WeYKWkhiDOkgrlpeU=; b=ZMilYVbpKixjrxf8keG//K96nzGKlQjO2NnoIeDA29SJBULI2XNS2twerVxZkYDt4qVIlhyB6eKYyVC9VpOgpeOnNl7lWFmTPs6rsweHHKLXg9TCQvN4TDPZophBpq1/qfAoeZ+7XW58o1VqCw6Hf9eUCtXTG50wCtP2DIz7ads= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=karl@ingate.com; Received: from Kallei7 (90.227.80.227) by AM4PR01MB1827.eurprd01.prod.exchangelabs.com (10.167.85.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.16; Tue, 18 Oct 2016 19:26:34 +0000 From: Karl Stahl To: "'Prashanth Patil (praspati)'" , 'Spencer Dawkins at IETF' , 'The IESG' , References: <419C3C64-AA08-4358-83BF-61421B8BF3EB@cisco.com> In-Reply-To: <419C3C64-AA08-4358-83BF-61421B8BF3EB@cisco.com> Date: Tue, 18 Oct 2016 21:26:30 +0200 Message-ID: <052401d22975$8a399e30$9eacda90$@stahl@ingate.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0525_01D22986.4DC26E30" X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AQHSKWYbxg8dpUhX9UqmGn2PA2CIXaCuhPFw Content-Language: sv X-Originating-IP: [90.227.80.227] X-ClientProxiedBy: DB5PR10CA0035.EURPRD10.PROD.OUTLOOK.COM (10.165.4.173) To AM4PR01MB1827.eurprd01.prod.exchangelabs.com (10.167.85.25) X-MS-Office365-Filtering-Correlation-Id: 4ef2c152-e2e9-471f-61ee-08d3f78cacae X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1827; 2:GrknH6k2k1mXeu1CRqFAIFkz3pMdGPMADDtE84IaA5Zbb1Bc609XJJVML+Yh9QCzfqFfPC30BguzMUM74koF+NYnTrOzxRQulJtY9ZDn04lZ3V1li4GcLmhLQgzsPPPoDs4JJBHFfzreSEXkACfzJDecTyI9gcitXpTx3yHFc9AMCfTYvY2xfCGrLC/9t3VEwt+yFMmqrLUeh7gqA/ONcA==; 3:UpQtcYFpbtfUxFhnFjoMmxCy6LBVeZ2cUrEBjbNEvd9MtD8atcQIhx2zMNPRXGt4KlYnSbkOe97ea5Z2qJccyEBHAU+aZoLjgHDzpxguy4W8wNENbbBWMmQvySoW4/8PKlUSC1bbKBDxK2t+GS2Kbw==; 25:I+n11YSlfjsWuYD3bAw7WwfdAIL3eMM/fzj3nNIAWgdmA6PB86eOXOT1/lrZtPjKsgBRJ6Njslfof9IvhVOh4OJjh+D5r9pgeUBMnYPJG9R+WApeH157N62yh3+F9PO94vXSMLljdlmaRLBmuuVIHS3T5oU+n0HW6AvAQR1q8B0hAanahZqcywLtxp/nDM5OpYtpyRiOCQCzE3bPRN0fVzi628TpQY3wVJuW2+n/Cxiv5gdAEBki2U4pyzyrMDPW6xU2E4KT7sfrJiAvsx9vY0hIYSq7dfAj4yFejOymlMsrl9UK4aC7MJ3NlH6giCZjatV0rnm8Pq6PE41oDhP+4zIzDCTaAKxyjJFm1T6Rqky4sv/1wIeWz+35vIJvLW2I6rusBrPaNCAKKcChSCAMwhHcaMSX8ir0Is63DXiJKZKyjFBLzBfcc3TogbOLx3Vd X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:AM4PR01MB1827; X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1827; 31:p43joeD99cO430e6+98pWYBYS2v27yQxrgIsbV7JWgG92Tcmtj2M/g+o5e8IADwtjSheEtTWaju7GBeEpqUHmHFzExGvAk8VHBOObrz/YhdWKXhio4YtwPhwRazXOC28BeTBxhhNCO6UiP/Yz2B5iVP7W10zJ3bLegyiE2QdRlQYW6BcBEWMpwo0GysXLA+YBImmp3AB/APeceLLMWrs4kyB6zfbvQ8uh69erws2SN4zWVFGKBup4r/uo5q+k+Iw; 4:d4l3nGiZxEaodHOobFMH9ruVDB+SO4DEohUoQtssu9ZA7kCClF570eF4G/uTtqDDpe5hUeBGrnLa5oGm8MiQTV5jCBLHVfwya/DBRjdskRdBEwAIJ70ZE6J/QtphXYSiKFNdfRl9Mr+TJ2ZiBWNFGw2ka3EsRNiZCs28bz7D2pvrETFQ7Im8jK7W+9FkeJnkQJ2UGvIc/PrrMe64r4cUokL8H4UzQ2JPA5xvEOMrWXIioTh1S6vRsStBF0hzS9lC7kP7/0paetw4TlxzRxcS2Q/y6chNF+J14whOOcsLEHdiKZcvdXchv407Bxl36Ca6rp5VosKxDes4RRHYs2+2F0km+i699NuZpddhVEH+1I7FV3EDT1ngTy4IHq78i0A9Cclie1bXNHmlV0/7Jawto4lre6qqgmf754uMn17SaXBzogP0plBKzPxw+IjnhBiAMvu1XIpJU7gAJ1TqV68Z9AQNLCmgJc0GoRu2pxy6imdDGl4ehYB3Mi+XQ3fp0/vKQcbnDhHPvrQRGkkGpxCeFSvS+3fPldsSmDfiB2YAf3Cjq/sXTRpgW0ZRTrcZ6e/4FHagti/Y5O8NmWV03ITFGQ== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(192374486261705)(95692535739014)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6043046)(6042046); SRVR:AM4PR01MB1827; BCL:0; PCL:0; RULEID:; SRVR:AM4PR01MB1827; X-Forefront-PRVS: 00997889E7 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(7916002)(377454003)(189002)(199003)(24454002)(2950100002)(2906002)(561944003)(33646002)(96836002)(6666003)(19300405004)(14726001)(81166006)(101416001)(84326002)(19580395003)(19580405001)(5660300001)(42186005)(92566002)(61296003)(4326007)(105586002)(230783001)(77096005)(106116001)(68736007)(3846002)(102836003)(84116002)(50986999)(50226002)(790700001)(6116002)(189998001)(76176999)(7846002)(16236675004)(586003)(8666005)(106356001)(66066001)(229853001)(1420700001)(9686002)(15975445007)(7826002)(7736002)(71636004)(512874002)(5001770100001)(19625215002)(36756003)(97736004)(81156014)(18717965001)(8676002)(7059030)(579004); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR01MB1827; H:Kallei7; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: ingate.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; AM4PR01MB1827; 23:Z5PF+KEACAOjULwjmsIGrEUmV8VY6me65eofnATXq?= =?us-ascii?Q?A8cYeT9HaKE0DSwcBYyseATAbyMrTfWK+i+0vbkUSzKZcXasfdRGuZomnnYK?= =?us-ascii?Q?lCuYI+1UXOeCtdyvYzVY3HvcnCTpI0LeIHeTGKySsCQ+VcXVVGzE+5x/t4L4?= =?us-ascii?Q?Fsh+Esi1H71mlyXkfkcOuXMeWSfpbeKA+bk4tFMpNv9vWgbkTJu8BfRHNO/v?= =?us-ascii?Q?nfmbNmDIU2w0ZEd6r+k2EszrHChEaxxokOrQjNabBrBgVjJUO3Yuutmbp9Lg?= =?us-ascii?Q?GYFSOHrO0PrcPqOGtj2Z1iI7ZsreOh68gjB7567n8gblzk+yO51uoIWFh6ir?= =?us-ascii?Q?M4RiIT1SsdtMUtExlMWigMitmylKtF2DAAftFGv9HAumYslcdtHfXit8CdFG?= =?us-ascii?Q?VAyAQwT3jA50EsBbf6je5+bjRAzlHBNLbPEs0BjhaD3jz0ecZzlqir2Diu0h?= =?us-ascii?Q?vrtsXNVasSD35gdYvKohOD1x8doxpBTOCej6gPUv6RI7Z9c6B8jq/yXsjkOZ?= =?us-ascii?Q?oMXu3zzkQ0D7GwHZ8G2uHlaLmWGeN2PuPhrhqibF6CZdV/CQ+RPlmv/c+2Xo?= =?us-ascii?Q?EoKI3QKjHgsmTZRmKRNAZHJsVBLmvPhBR4do7C2XplvKhkmQUSxcRWMBDM8D?= =?us-ascii?Q?YgK7iyTjy4t+O7OAGz9p9p76qnE9QuUw8MDOEoR4V9oc3ryLMBUpXiq8865u?= =?us-ascii?Q?bw0m5bSKoU2ISh6G+RbQAriGsov42MS5Gb0BpLWUR7n+uy/mTeYGbY/VVFKi?= =?us-ascii?Q?mZgwxUARITVgwWYWdwQwtPUfe3wq5+xxFoQ59CCO1tU/65cw/ZEcVFPHYFjF?= =?us-ascii?Q?RcUAEPPp5Wp7G4aNfC1FxVhmazUhQkJ+xb0HQZdffH0NMoP/AiQVUBCBOAqM?= =?us-ascii?Q?1qwMNF4kef+kW8HC5GoceIVtJ8YA6BCSjfIXhno0crcnBGc9xr1ijMIkkVQP?= =?us-ascii?Q?Q/1Za/b3C7j+bSCqCMQP58NqVsrzU+RvUtn9Hrz1FAUD0VTyeWA5k4A/ww3T?= =?us-ascii?Q?KBZMvDnPUKW0Dn8kCvUn6o7PfJkc62l6G17qOnycKlg39RwsAYlVZ8GLtH0R?= =?us-ascii?Q?gdguyVIBHUSVxAz3C08mV83dVQ+cFIF6KPfFRwZ+WABcnocdcx0PAN1HDYJG?= =?us-ascii?Q?GeNryLSJ9z0lii368Qk9Fixuj68zFRHMQ19/pATcrrnKgQ8cQZZiuemfJp00?= =?us-ascii?Q?STP6qd+MNKbk6fRr/gd6Kye6ZlXuzHNQ5Lzug3H0y1VAlC0ZOA/pYIA52l8S?= =?us-ascii?Q?ZOw1OSBx9Ylrqd9pgdvyywcudYxz08dB4HfEFpw8gXZ26PXjKw7OHMdQ0/8E?= =?us-ascii?Q?GmBJtm8DeBmv/bwWddp5eQjWh8AP7N3LMZ+ygX+pqwbxtkteXkeEfp287HZs?= =?us-ascii?Q?R6aYAAClO5edT9ZjPiZ1e/+zgd2TAhzxgMA3XcebPeDujub/dNJ3lvKQTrX/?= =?us-ascii?Q?QohRA9X2GDYpQ5G+sOsf9yJvmQt76b73ep3ZItxkJfyigv4I836?= X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1827; 6:xyPzil2ubIVyr1HO/WSL9Q9kMmLvj0PEqnrUB2NvNkShmigvCp7FuC13HZoiWsTDGZ6BuB25znQks9T+v78HMcLwbWrsaTv+0/5baZViucJdTQzvwYqwraVEOgWIwC8GTQrokuq+9EEXsHqDTf4SnFEkaLqNUkoty/nTdSuAd5eJrpTZj7D9fqRPyFP33l7zTRwZWUv+q+srZepbofVlgSE7D7w0yv7umgYy4U33UhYv4K5Dw+1vCAtsNf9SlYs39uTND/Sa9c0S/gD1QQGOuKrCcDvzuS8KE6CrrA8YEptYKlWulXoCk+r5c3O7bbGLdKKqYVp8ETRrFlzoRMBQNA==; 5:wso917tHQwcppTh/zDL3t5YCf6J/dLxGzkAoKfk74bYi4T4jcRP+8e9LavTwl8EQNi2elvS9ZWyI6qQjChNO15OIURsMY76Mana52idnMrcNGKPZIQDNJFUi1xE/0aVuj/CkvJ8sNgtFy9738Tuo1ikrwtWF+5AlC3N4TKwz4tw=; 24:ZIj7WIGlIQjae3tXFuHGupsZSJWzR5jCmSgQLQEPosEc90QE9CtcRfGrI2rh8hrbcM5djO+UxLhwm9d9PnWeY1bBZkuZCo0p5Biu36TuZHY= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; AM4PR01MB1827; 7:PsmJ7kKJTiG3GEPi0Onn+NEwKNZA8CLI890iwGjsWsGEt/VM795dLLzDU3Ta7GeaZNPSZF5JWGP7VHUSgkFyCK27ukQuaHfHtUprp8C7toYLcGWUYrQcbhurwBsxGj5qM6tVd6e6Ff+ZSELmrCr/DRkD+LFT9euapJMynueAweMN37kKpgii0cZvb7E+Bs3LgSQCzAkQHe+NKxIR37z7xZYroeJZdb6+5hSp7iTBqL3Bpw4sTRi72Bck5FptT8c1nF8oWB+QdKIaC8mCixaB0Npy/3uhKdEA/rTcOKoxyX00yZ1GIhTItGjz/peU4enuEe8cAgKP+Oap8pc0a2zgRmusYPIoc/szsYGShQhrcVo= X-OriginatorOrg: ingate.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Oct 2016 19:26:34.5046 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR01MB1827 Archived-At: Cc: 'Simon Perreault' , draft-ietf-tram-turn-server-discovery@ietf.org, tram@ietf.org, "'Tirumaleswar Reddy \(tireddy\)'" , 'Alexey Melnikov' Subject: Re: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2016 19:26:42 -0000 ------=_NextPart_000_0525_01D22986.4DC26E30 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable See [Karl] comments below =C3=A0 =20 Fr=C3=A5n: Prashanth Patil (praspati) [mailto:praspati@cisco.com]=20 Skickat: den 18 oktober 2016 19:36 Till: Karl Stahl; 'Spencer Dawkins at IETF'; 'The IESG'; = tram-chairs@ietf.org Kopia: tram@ietf.org; 'Alexey Melnikov'; = draft-ietf-tram-turn-server-discovery@ietf.org; 'Simon Perreault'; = Tirumaleswar Reddy (tireddy) =C3=84mne: Re: SV: SV: [tram] Need to be fixed! Discuss on = draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) =20 =20 =20 On 10/18/16, 6:20 AM, "Karl Stahl" wrote: =20 Spencer (and authors), =20 We need the long awaited discovery draft and the anycast method, and = don=E2=80=99t want an =E2=80=9Cappeal (which gets us right back here, = after wasting time).=E2=80=9D=20 It must work for discovery of a network provided turn server, that the = provider of the local network (LAN) has made available for all his users = to run real-time traffic through (rather than through a data crowded or = blocked default gateway path).=20 =20 This draft cannot/must not (thrown in during the DISCUSS!) block such = general usage by under 9 mandating (D)TLS, requiring a new = infrastructure to be established by: A TURN client MUST use (D)TLS =E2=80=A6 one of the following techniques with (D)TLS to validate the TURN server: o For certificate-based authentication, a pre-populated trust anchor store=E2=80=A6 o Certification authorities that issue TURN server = certificates=E2=80=A6 =20 especially when the release of authentication of such turn servers have = been specified in the draft. =20 =20 Ben Campebell did not clear his DISCUSS unconditionally, he said: =E2=80=9C-9, third paragraph: I saw a comment on my DISCUSS email thread from Karl Stahl, stating that = DTLS could not be mandated. Has that input been considered? (I don't = have an opinion; I just want to make sure people noticed the = comment.)=E2=80=9D That input has NOT been considered. =20 >From below it seems like the authors will issue a version -11 of the = draft =20 =20 Prashanth, =20 Please, then remove the (D)TLS mandating. Your comment: Not mandating DTLS opens up the client/server to a host of attacks such = as an attacker sending fake requests/responses. The draft is meant for = general purpose TURN server discovery, not specific to WebRTC, and = hence, security considerations have to be broad. is irrelevant for turn server allocations on the LAN, =20 The scope is more than just LAN. [Karl] Your (D)TLS mandating was introduced for: =E2=80=9C Use of Session Traversal Utilities for NAT (STUN) [RFC5389] authentication is OPTIONAL for TURN servers provided by the local network or by the access network. A network provided TURN server MAY be configured to accept Allocation requests without STUN authentication, and a TURN client MAY be configured to accept Allocation success responses without STUN authentication from a network provided TURN server. =E2=80=9D that is what I called LAN and IS the scope discussed. =20 Your sudden mandating of (D)TLS for this scope during the discuss = contradicts the very reason for this release of the MUST authenticate in = this specific scope. Please remove! =20 =20 where everything is as open as it is: You cannot/should not expect the = real-time traffic to have better security by sending it through the turn = server path than through the default gateway path. In addition, WebRTC = has DTLS-SRTP of the real-time traffic mandated in itself! =20 WebRTC has that to protect application data. It has nothing to do with = TURN. Protection of application data does not imply TURN messages = don=E2=80=99t need security. The intent here is to consider aspects of = security that deal directly with TURN messages and text in the draft = addresses those aspects.=20 =20 [Karl] Do you think we need to discover TURN servers for the pleasure of = doing =E2=80=9Csecurity that deal directly with TURN messages=E2=80=9D = in itself, and not for what they are supposed to do (relay = =E2=80=9Capplication data=E2=80=9D) and do you also think that is why a = network provider will deploy such TURN server for his users? Please do = not stop the purpose (by such phrases)! =20 - Again, should a discovery draft really specify usage? And (D)TLS is = NOT mandated when using other than discovered TURN servers in the = discussed scope (where it contradicts the purpose).. =20 =20 -Prashanth =20 =20 And regarding: > The draft is meant for general purpose TURN server discovery, not = specific to WebRTC Network provided turn servers for WebRTC usage was actually the main = purpose: Specifically that must not be blocked now (thrown in during = discuss phase)! =20 SEE FURTHER INLINE BELOW, regarding the issue repeatedly = ignored/unanswered during the WG stage (since highlighted in version -06 = of this draft). =20 /Karl =20 Fr=C3=A5n: Prashanth Patil (praspati) [mailto:praspati@cisco.com]=20 Skickat: den 18 oktober 2016 04:38 Till: Karl Stahl; 'Spencer Dawkins at IETF'; 'The IESG'; = tram-chairs@ietf.org Kopia: tram@ietf.org; 'Alexey Melnikov'; = draft-ietf-tram-turn-server-discovery@ietf.org; 'Simon Perreault'; = Tirumaleswar Reddy (tireddy) =C3=84mne: Re: SV: [tram] Need to be fixed! Discuss on = draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) =20 =20 =20 On 10/17/16, 1:15 AM, "Karl Stahl" < = karl.stahl@ingate.com> wrote: =20 Spencer, =20 Can the authors of this discovery draft =E2=80=9Cbe ordered=E2=80=9D to = address the two points below? =20 :-) =20 Point 2) was (unnecessarily) introduced during the DISCUSS (I just highlighted to the WG list that it is NOT addressed, in spite of = what is said by an author.) =20 Point 1) has repeatedly been pointed out on this WG list since version = -06 of the draft, but ignored by the authors. =20 =20 We intend to add the following to explain server behavior a little = better: =E2=80=9CA TURN anycast server performs checks 1 to 7 discussed in = Section 6.2 of RFC5766. If all checks pass, the TURN anycast server MUST = respond with a 300 (Try Alternate) error as described in = [RFC5766];=E2=80=9D [Karl] That must be an update of RFC5766. Or does =E2=80=9CTURN anycast = server=E2=80=9D imply that there ALSO is a =E2=80=9CTURN unicast = server=E2=80=9D at the same interface accepting the Allocate request? =20 My proposal is better (in several aspects) and don=E2=80=99t need to = update RFC5766 turn server behavior. =20 As the text is in this version -10 of the draft now is, it does NOT = fulfill its purpose to discover a network provided TURN server to allow = real-time communication, in situations where it otherwise is not = possible or bad. - It does not provide a method suitable for draft-ietf-rtcweb-return-01 - It does not meet the autoconfiguration of RFC 7478 (Web Real-Time = Communication Use Cases and Requirements) 2.3.5.1.=20 =20 More generally (regarding the mandating of (D)TLS, suddenly introduced = during the DISCUSS): We should be able to use WebRTC everywhere we can and do surf, and for = firewall/NAT traversal and quality it is in many cases necessary to = parallel the local firewall/access router/default gateway with a TURN = server, to get a good media path. The automatic discovery of such = network provided turn server should be given by this draft, but it = should NOT set up restrictions for it usage (especially when it is = unnecessary and blocks the general usage e.g. such as specified in = draft-ietf-rtcweb-return-01).=20 =20 Not mandating DTLS opens up the client/server to a host of attacks such = as an attacker sending fake requests/responses. The draft is meant for = general purpose TURN server discovery, not specific to WebRTC, and = hence, security considerations have to be broad. =20 -Prashanth =20 The authors of this draft seem to have some other use case in mind, but = that must not block the usage for which this discovery specification was = required.=20 As written in this version -10 of the draft, it is a showstopper. =20 /Karl =20 =20 ------=_NextPart_000_0525_01D22986.4DC26E30 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Se= e [Karl] comments below =C3=A0=

 

Fr=C3=A5n: Prashanth = Patil (praspati) [mailto:praspati@cisco.com]
Skickat: den 18 = oktober 2016 19:36
Till: Karl Stahl; 'Spencer Dawkins at = IETF'; 'The IESG'; tram-chairs@ietf.org
Kopia: tram@ietf.org; = 'Alexey Melnikov'; draft-ietf-tram-turn-server-discovery@ietf.org; = 'Simon Perreault'; Tirumaleswar Reddy (tireddy)
=C3=84mne: Re: = SV: SV: [tram] Need to be fixed! Discuss on = draft-ietf-tram-turn-server-discovery-10: (with = DISCUSS)

 

 =

 =

On 10/18/16, = 6:20 AM, "Karl Stahl" <karl.stahl@ingate.com> = wrote:

 

Sp= encer (and authors),

&n= bsp;

We= need the long awaited discovery draft and the anycast method, and = don=E2=80=99t want an =E2=80=9Cappeal (which = gets us right back here, after wasting time).=E2= =80=9D

It= must work for discovery of a network provided turn server, that the = provider of the local network (LAN) has made available for all his users = to run real-time traffic through (rather than through a data crowded or = blocked default gateway path).

&n= bsp;

Th= is draft cannot/must not (thrown in during the DISCUSS!) block such = general usage by under 9 mandating (D)TLS, requiring a new = infrastructure to be established by:

A TURN client MUST use (D)TLS = =E2=80=A6

   one of the following = techniques with (D)TLS to validate the TURN

   server:

   o  For = certificate-based authentication, a pre-populated trust = anchor

      = store=E2=80=A6

   o  Certification = authorities that issue TURN server certificates=E2=80=A6

&n= bsp;

es= pecially when the release of authentication of such turn servers have = been specified in the draft.

&n= bsp;

&n= bsp;

Be= n Campebell did not clear his DISCUSS unconditionally, he = said:

=E2=80=9C-9, third = paragraph:
I saw a comment on my DISCUSS = email thread from Karl Stahl, stating that DTLS could not be mandated. = Has that input been considered? (I don't have an opinion; I just want to = make sure people noticed the comment.)=E2=80=9D

Th= at input has NOT been considered.

&n= bsp;

Fr= om below it seems like the authors will issue a version -11 of the = draft

&n= bsp;

&n= bsp;

Pr= ashanth,

&n= bsp;

Pl= ease, then remove the (D)TLS mandating.

Yo= ur comment:

Not = mandating DTLS opens up the client/server to a host of attacks such as = an attacker sending fake requests/responses. &n= bsp;The draft = is meant for general purpose TURN server discovery, not specific to = WebRTC, and hence, security considerations have to be broad.

is= irrelevant for turn server allocations on the = LAN,

 

T= he scope is more than just LAN.

[K= arl] Your (D)TLS mandating was introduced for:

=E2= =80=9C=C2=A0=C2=A0 Use of Session Traversal Utilities for NAT (STUN) = [RFC5389]

=C2=A0=C2=A0 = authentication is OPTIONAL for TURN servers provided by the = local

=C2=A0=C2=A0 network or = by the access network.=C2=A0 A network provided TURN = server MAY

=C2=A0=C2=A0 be = configured to accept Allocation requests without = STUN

=C2=A0=C2=A0 authentication, and a = TURN client MAY be configured to accept

=C2=A0=C2=A0 Allocation success responses without STUN = authentication from a

=C2=A0=C2=A0 network = provided TURN server.

=E2= =80=9D

th= at is what I called LAN and IS the scope = discussed.

 

Yo= ur sudden mandating of (D)TLS for this scope during the discuss = contradicts the very reason for this release of the MUST authenticate in = this specific scope. Please remove!

 

 

wh= ere everything is as open as it is: You cannot/should not expect the = real-time traffic to have better security by sending it through the turn = server path than through the default gateway path. In addition, WebRTC = has DTLS-SRTP of the real-time traffic mandated in = itself!

 

W= ebRTC has that to protect application data. It has nothing to do with = TURN. Protection of application data does not imply TURN messages = don=E2=80=99t need security. The intent here is to consider aspects of = security that deal directly with TURN messages and text in the draft = addresses those aspects.

 

[K= arl] Do you think we need to discover TURN servers for the pleasure of = doing =E2=80=9Cs= ecurity that deal directly with TURN messages=E2= =80=9D in itself, and not for what they are supposed to do (relay = =E2=80=9Capplication data=E2=80=9D) and do you also think that is why a = network provider will deploy such TURN server for his users? Please do = not stop the purpose (by such phrases)!

 

- = Again, should a discovery draft really specify usage? And (D)TLS is NOT = mandated when using other than discovered TURN servers in the discussed = scope (where it contradicts the purpose)..

 

 

-= Prashanth

 

&n= bsp;

An= d regarding:

&g= t; The draft = is meant for general purpose TURN server discovery, not specific to = WebRTC

Ne= twork provided turn servers for WebRTC usage was actually the main = purpose: Specifically that must not be blocked now (thrown in during = discuss phase)!

&n= bsp;

SE= E FURTHER INLINE BELOW, regarding the issue repeatedly = ignored/unanswered during the WG stage (since highlighted in version -06 = of this draft).

&n= bsp;

/K= arl

&n= bsp;

Fr=C3=A5n: Prashanth = Patil (praspati) [mailto:praspati@cisco.com] =
Skickat: den 18 oktober 2016 04:38
Till: Karl = Stahl; 'Spencer Dawkins at IETF'; 'The IESG'; tram-chairs@ietf.org
Kopia= : tram@ietf.org; 'Alexey = Melnikov'; draft-ietf= -tram-turn-server-discovery@ietf.org; 'Simon Perreault'; = Tirumaleswar Reddy (tireddy)
=C3=84mne: Re: SV: [tram] Need to = be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with = DISCUSS)

 

 

 

On 10/17/16, = 1:15 AM, "Karl Stahl" <karl.stahl@ingate.com> = wrote:

 

S= pencer,

&= nbsp;

C= an the authors of this discovery draft =E2=80=9Cbe ordered=E2=80=9D to = address the two points below?

&= nbsp;

:= -)

&= nbsp;

P= oint 2) was (unnecessarily) introduced during the DISCUSS

(= I just highlighted to the WG list that it is NOT addressed, in spite of = what is said by an author.)

&= nbsp;

P= oint 1) has repeatedly been pointed out on this WG list since version = -06 of the draft, but ignored by the authors.  

&= nbsp;

We intend to add the = following = to explain server behavior a little better:

=E2=80=9CA TURN anycast server performs checks 1 to 7 discussed in = Section 6.2 of RFC5766. If all checks pass, the TURN anycast server MUST = respond with a 300 (Try Alternate) error as described in = [RFC5766];=E2=80=9D

[K= arl] That must be an update of RFC5766. Or does =E2=80=9CTURN anycast server=E2= =80=9D imply that there ALSO is a =E2=80=9CTURN unicast server=E2=80=9D = at the same interface accepting the Allocate request?  

My= proposal is better (in several aspects) and don=E2=80=99t need to = update RFC5766 turn server behavior.

&= nbsp;

A= s the text is in this version -10 of the draft now is, it does NOT = fulfill its purpose to discover a network provided TURN server to allow = real-time communication, in situations where it otherwise is not = possible or bad.

-= It does not provide a method suitable for draft-ietf-rtcweb-return-01

-= It does not meet the autoconfiguration of RFC 7478 (Web Real-Time = Communication Use Cases and Requirements) 2.3.5.1.

&= nbsp;

M= ore generally (regarding the mandating of (D)TLS, suddenly introduced = during the DISCUSS):

W= e should be able to use WebRTC everywhere we can and do surf, and for = firewall/NAT traversal and quality it is in many cases necessary to = parallel the local firewall/access router/default gateway with a TURN = server, to get a good media path. The automatic discovery of such = network provided turn server should be given by this draft, but it = should NOT set up restrictions for it usage (especially when it is = unnecessary and blocks the general usage e.g. such as specified in = draft-ietf-rtcweb-return-01)= .

&= nbsp;

Not = mandating DTLS opens up the client/server to a host of attacks such as = an attacker sending fake requests/responses. The draft is meant for = general purpose TURN server discovery, not specific to WebRTC, and = hence, security considerations have to be broad.

 

-Prashanth<= /span>

&= nbsp;

T= he authors of this draft seem to have some other use case in mind, but = that must not block the usage for which this discovery specification was = required.

A= s written in this version -10 of the draft, it is a = showstopper.

&= nbsp;

/= Karl

&= nbsp;

 

<= /html> ------=_NextPart_000_0525_01D22986.4DC26E30-- From nobody Tue Oct 18 13:16:40 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A866C12947D; Tue, 18 Oct 2016 13:16:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.951 X-Spam-Level: X-Spam-Status: No, score=-14.951 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1vIZ4EyUjuXr; Tue, 18 Oct 2016 13:16:31 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12D631294D6; Tue, 18 Oct 2016 13:16:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=62098; q=dns/txt; s=iport; t=1476821791; x=1478031391; h=from:to:cc:subject:date:message-id:mime-version; bh=BQ/BV0o8oZ12EjZ2aaWHEmALXwXMgdhqtA4rgH9+Qx0=; b=V61gKSD481Er1V1wf1oK4ZBVEu9IIAWzH34lsaYxPmdn1i+EzeWtnvXP D0epbcEFVu10fzEcf1ttauDeztgzSKES39ne/0FO4CvvlLeS2OVlvMK3c YuBZ4io62u5SrES+AeDM5dYnZ2a9D9j1/XpKzlVujGCGMivfILE08L6Qm 4=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CCAQCTggZY/51dJa1cGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgwc1AQEBAQEdV3wHjS2XBZIpgg+CCCeFegIagWk4FAECAQEBAQEBAWI?= =?us-ascii?q?nhGIBAQMBI1EFBQ0BCDgBAgQDAgQwFBMEAQ0FiEoIDrZOjHoBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEYBYY9gX2CWIQZEQEGLR+CTiyCLwWULYVbAYYniV6BboRpiSC?= =?us-ascii?q?HEIVrg38BHjZUgwYcGYE6cgEBhWoNFweBAoEAAQEB?= X-IronPort-AV: E=Sophos;i="5.31,511,1473120000"; d="scan'208,217";a="161353987" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Oct 2016 20:16:29 +0000 Received: from XCH-RTP-016.cisco.com (xch-rtp-016.cisco.com [64.101.220.156]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id u9IKGT7Q003705 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 18 Oct 2016 20:16:29 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-016.cisco.com (64.101.220.156) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 18 Oct 2016 16:16:28 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1210.000; Tue, 18 Oct 2016 16:16:28 -0400 From: "Prashanth Patil (praspati)" To: Karl Stahl , "'Spencer Dawkins at IETF'" , "'The IESG'" , "tram-chairs@ietf.org" Thread-Topic: SV: SV: SV: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) Thread-Index: AQHSKXyCgC9aXamrT0CPR2l2lcuQjQ== Date: Tue, 18 Oct 2016 20:16:28 +0000 Message-ID: <5E483469-1E31-48C2-8D8F-D61DA6660776@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.0.160910 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.85.1] Content-Type: multipart/alternative; boundary="_000_5E4834691E3148C28D8FD61DA6660776ciscocom_" MIME-Version: 1.0 Archived-At: Cc: 'Simon Perreault' , "draft-ietf-tram-turn-server-discovery@ietf.org" , "tram@ietf.org" , "Tirumaleswar Reddy \(tireddy\)" , 'Alexey Melnikov' Subject: Re: [tram] Need to be fixed! Discuss on draft-ietf-tram-turn-server-discovery-10: (with DISCUSS) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2016 20:16:34 -0000 --_000_5E4834691E3148C28D8FD61DA6660776ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCk9uIDEwLzE4LzE2LCAxMjoyNiBQTSwgIkthcmwgU3RhaGwiIDxrYXJsLnN0YWhsQGluZ2F0 ZS5jb208bWFpbHRvOmthcmwuc3RhaGxAaW5nYXRlLmNvbT4+IHdyb3RlOg0KDQpTZWUgW0thcmxd IGNvbW1lbnRzIGJlbG93IMOgDQoNCkZyw6VuOiBQcmFzaGFudGggUGF0aWwgKHByYXNwYXRpKSBb bWFpbHRvOnByYXNwYXRpQGNpc2NvLmNvbV0NClNraWNrYXQ6IGRlbiAxOCBva3RvYmVyIDIwMTYg MTk6MzYNClRpbGw6IEthcmwgU3RhaGw7ICdTcGVuY2VyIERhd2tpbnMgYXQgSUVURic7ICdUaGUg SUVTRyc7IHRyYW0tY2hhaXJzQGlldGYub3JnDQpLb3BpYTogdHJhbUBpZXRmLm9yZzsgJ0FsZXhl eSBNZWxuaWtvdic7IGRyYWZ0LWlldGYtdHJhbS10dXJuLXNlcnZlci1kaXNjb3ZlcnlAaWV0Zi5v cmc7ICdTaW1vbiBQZXJyZWF1bHQnOyBUaXJ1bWFsZXN3YXIgUmVkZHkgKHRpcmVkZHkpDQrDhG1u ZTogUmU6IFNWOiBTVjogW3RyYW1dIE5lZWQgdG8gYmUgZml4ZWQhIERpc2N1c3Mgb24gZHJhZnQt aWV0Zi10cmFtLXR1cm4tc2VydmVyLWRpc2NvdmVyeS0xMDogKHdpdGggRElTQ1VTUykNCg0KDQoN Ck9uIDEwLzE4LzE2LCA2OjIwIEFNLCAiS2FybCBTdGFobCIgPGthcmwuc3RhaGxAaW5nYXRlLmNv bTxtYWlsdG86a2FybC5zdGFobEBpbmdhdGUuY29tPj4gd3JvdGU6DQoNClNwZW5jZXIgKGFuZCBh dXRob3JzKSwNCg0KV2UgbmVlZCB0aGUgbG9uZyBhd2FpdGVkIGRpc2NvdmVyeSBkcmFmdCBhbmQg dGhlIGFueWNhc3QgbWV0aG9kLCBhbmQgZG9u4oCZdCB3YW50IGFuIOKAnGFwcGVhbCAod2hpY2gg Z2V0cyB1cyByaWdodCBiYWNrIGhlcmUsIGFmdGVyIHdhc3RpbmcgdGltZSku4oCdDQpJdCBtdXN0 IHdvcmsgZm9yIGRpc2NvdmVyeSBvZiBhIG5ldHdvcmsgcHJvdmlkZWQgdHVybiBzZXJ2ZXIsIHRo YXQgdGhlIHByb3ZpZGVyIG9mIHRoZSBsb2NhbCBuZXR3b3JrIChMQU4pIGhhcyBtYWRlIGF2YWls YWJsZSBmb3IgYWxsIGhpcyB1c2VycyB0byBydW4gcmVhbC10aW1lIHRyYWZmaWMgdGhyb3VnaCAo cmF0aGVyIHRoYW4gdGhyb3VnaCBhIGRhdGEgY3Jvd2RlZCBvciBibG9ja2VkIGRlZmF1bHQgZ2F0 ZXdheSBwYXRoKS4NCg0KVGhpcyBkcmFmdCBjYW5ub3QvbXVzdCBub3QgKHRocm93biBpbiBkdXJp bmcgdGhlIERJU0NVU1MhKSBibG9jayBzdWNoIGdlbmVyYWwgdXNhZ2UgYnkgdW5kZXIgOSBtYW5k YXRpbmcgKEQpVExTLCByZXF1aXJpbmcgYSBuZXcgaW5mcmFzdHJ1Y3R1cmUgdG8gYmUgZXN0YWJs aXNoZWQgYnk6DQoNCkEgVFVSTiBjbGllbnQgTVVTVCB1c2UgKEQpVExTIOKApg0KDQogICBvbmUg b2YgdGhlIGZvbGxvd2luZyB0ZWNobmlxdWVzIHdpdGggKEQpVExTIHRvIHZhbGlkYXRlIHRoZSBU VVJODQoNCiAgIHNlcnZlcjoNCg0KICAgbyAgRm9yIGNlcnRpZmljYXRlLWJhc2VkIGF1dGhlbnRp Y2F0aW9uLCBhIHByZS1wb3B1bGF0ZWQgdHJ1c3QgYW5jaG9yDQoNCiAgICAgIHN0b3Jl4oCmDQoN CiAgIG8gIENlcnRpZmljYXRpb24gYXV0aG9yaXRpZXMgdGhhdCBpc3N1ZSBUVVJOIHNlcnZlciBj ZXJ0aWZpY2F0ZXPigKYNCg0KZXNwZWNpYWxseSB3aGVuIHRoZSByZWxlYXNlIG9mIGF1dGhlbnRp Y2F0aW9uIG9mIHN1Y2ggdHVybiBzZXJ2ZXJzIGhhdmUgYmVlbiBzcGVjaWZpZWQgaW4gdGhlIGRy YWZ0Lg0KDQoNCkJlbiBDYW1wZWJlbGwgZGlkIG5vdCBjbGVhciBoaXMgRElTQ1VTUyB1bmNvbmRp dGlvbmFsbHksIGhlIHNhaWQ6DQoNCuKAnC05LCB0aGlyZCBwYXJhZ3JhcGg6DQpJIHNhdyBhIGNv bW1lbnQgb24gbXkgRElTQ1VTUyBlbWFpbCB0aHJlYWQgZnJvbSBLYXJsIFN0YWhsLCBzdGF0aW5n IHRoYXQgRFRMUyBjb3VsZCBub3QgYmUgbWFuZGF0ZWQuIEhhcyB0aGF0IGlucHV0IGJlZW4gY29u c2lkZXJlZD8gKEkgZG9uJ3QgaGF2ZSBhbiBvcGluaW9uOyBJIGp1c3Qgd2FudCB0byBtYWtlIHN1 cmUgcGVvcGxlIG5vdGljZWQgdGhlIGNvbW1lbnQuKeKAnQ0KVGhhdCBpbnB1dCBoYXMgTk9UIGJl ZW4gY29uc2lkZXJlZC4NCg0KRnJvbSBiZWxvdyBpdCBzZWVtcyBsaWtlIHRoZSBhdXRob3JzIHdp bGwgaXNzdWUgYSB2ZXJzaW9uIC0xMSBvZiB0aGUgZHJhZnQNCg0KDQpQcmFzaGFudGgsDQoNClBs ZWFzZSwgdGhlbiByZW1vdmUgdGhlIChEKVRMUyBtYW5kYXRpbmcuDQpZb3VyIGNvbW1lbnQ6DQpO b3QgbWFuZGF0aW5nIERUTFMgb3BlbnMgdXAgdGhlIGNsaWVudC9zZXJ2ZXIgdG8gYSBob3N0IG9m IGF0dGFja3Mgc3VjaCBhcyBhbiBhdHRhY2tlciBzZW5kaW5nIGZha2UgcmVxdWVzdHMvcmVzcG9u c2VzLiAgVGhlIGRyYWZ0IGlzIG1lYW50IGZvciBnZW5lcmFsIHB1cnBvc2UgVFVSTiBzZXJ2ZXIg ZGlzY292ZXJ5LCBub3Qgc3BlY2lmaWMgdG8gV2ViUlRDLCBhbmQgaGVuY2UsIHNlY3VyaXR5IGNv bnNpZGVyYXRpb25zIGhhdmUgdG8gYmUgYnJvYWQuDQppcyBpcnJlbGV2YW50IGZvciB0dXJuIHNl cnZlciBhbGxvY2F0aW9ucyBvbiB0aGUgTEFOLA0KDQpUaGUgc2NvcGUgaXMgbW9yZSB0aGFuIGp1 c3QgTEFOLg0KW0thcmxdIFlvdXIgKEQpVExTIG1hbmRhdGluZyB3YXMgaW50cm9kdWNlZCBmb3I6 DQoNCuKAnCAgIFVzZSBvZiBTZXNzaW9uIFRyYXZlcnNhbCBVdGlsaXRpZXMgZm9yIE5BVCAoU1RV TikgW1JGQzUzODldDQoNCiAgIGF1dGhlbnRpY2F0aW9uIGlzIE9QVElPTkFMIGZvciBUVVJOIHNl cnZlcnMgcHJvdmlkZWQgYnkgdGhlIGxvY2FsDQoNCiAgIG5ldHdvcmsgb3IgYnkgdGhlIGFjY2Vz cyBuZXR3b3JrLiAgQSBuZXR3b3JrIHByb3ZpZGVkIFRVUk4gc2VydmVyIE1BWQ0KDQogICBiZSBj b25maWd1cmVkIHRvIGFjY2VwdCBBbGxvY2F0aW9uIHJlcXVlc3RzIHdpdGhvdXQgU1RVTg0KDQog ICBhdXRoZW50aWNhdGlvbiwgYW5kIGEgVFVSTiBjbGllbnQgTUFZIGJlIGNvbmZpZ3VyZWQgdG8g YWNjZXB0DQoNCiAgIEFsbG9jYXRpb24gc3VjY2VzcyByZXNwb25zZXMgd2l0aG91dCBTVFVOIGF1 dGhlbnRpY2F0aW9uIGZyb20gYQ0KDQogICBuZXR3b3JrIHByb3ZpZGVkIFRVUk4gc2VydmVyLg0K 4oCdDQp0aGF0IGlzIHdoYXQgSSBjYWxsZWQgTEFOIGFuZCBJUyB0aGUgc2NvcGUgZGlzY3Vzc2Vk Lg0KDQpZb3Ugc2VlbSB0byBoYXZlIGNvbnZlbmllbnRseSBkaXNjb3VudGVkIHRoZSBhY2Nlc3Mg bmV0d29yay4NCg0KWW91ciBzdWRkZW4gbWFuZGF0aW5nIG9mIChEKVRMUyBmb3IgdGhpcyBzY29w ZSBkdXJpbmcgdGhlIGRpc2N1c3MgY29udHJhZGljdHMgdGhlIHZlcnkgcmVhc29uIGZvciB0aGlz IHJlbGVhc2Ugb2YgdGhlIE1VU1QgYXV0aGVudGljYXRlIGluIHRoaXMgc3BlY2lmaWMgc2NvcGUu IFBsZWFzZSByZW1vdmUhDQoNCg0Kd2hlcmUgZXZlcnl0aGluZyBpcyBhcyBvcGVuIGFzIGl0IGlz OiBZb3UgY2Fubm90L3Nob3VsZCBub3QgZXhwZWN0IHRoZSByZWFsLXRpbWUgdHJhZmZpYyB0byBo YXZlIGJldHRlciBzZWN1cml0eSBieSBzZW5kaW5nIGl0IHRocm91Z2ggdGhlIHR1cm4gc2VydmVy IHBhdGggdGhhbiB0aHJvdWdoIHRoZSBkZWZhdWx0IGdhdGV3YXkgcGF0aC4gSW4gYWRkaXRpb24s IFdlYlJUQyBoYXMgRFRMUy1TUlRQIG9mIHRoZSByZWFsLXRpbWUgdHJhZmZpYyBtYW5kYXRlZCBp biBpdHNlbGYhDQoNCldlYlJUQyBoYXMgdGhhdCB0byBwcm90ZWN0IGFwcGxpY2F0aW9uIGRhdGEu IEl0IGhhcyBub3RoaW5nIHRvIGRvIHdpdGggVFVSTi4gUHJvdGVjdGlvbiBvZiBhcHBsaWNhdGlv biBkYXRhIGRvZXMgbm90IGltcGx5IFRVUk4gbWVzc2FnZXMgZG9u4oCZdCBuZWVkIHNlY3VyaXR5 LiBUaGUgaW50ZW50IGhlcmUgaXMgdG8gY29uc2lkZXIgYXNwZWN0cyBvZiBzZWN1cml0eSB0aGF0 IGRlYWwgZGlyZWN0bHkgd2l0aCBUVVJOIG1lc3NhZ2VzIGFuZCB0ZXh0IGluIHRoZSBkcmFmdCBh ZGRyZXNzZXMgdGhvc2UgYXNwZWN0cy4NCg0KW0thcmxdIERvIHlvdSB0aGluayB3ZSBuZWVkIHRv IGRpc2NvdmVyIFRVUk4gc2VydmVycyBmb3IgdGhlIHBsZWFzdXJlIG9mIGRvaW5nIOKAnHNlY3Vy aXR5IHRoYXQgZGVhbCBkaXJlY3RseSB3aXRoIFRVUk4gbWVzc2FnZXPigJ0gaW4gaXRzZWxmLCBh bmQgbm90IGZvciB3aGF0IHRoZXkgYXJlIHN1cHBvc2VkIHRvIGRvIChyZWxheSDigJxhcHBsaWNh dGlvbiBkYXRh4oCdKSBhbmQgZG8geW91IGFsc28gdGhpbmsgdGhhdCBpcyB3aHkgYSBuZXR3b3Jr IHByb3ZpZGVyIHdpbGwgZGVwbG95IHN1Y2ggVFVSTiBzZXJ2ZXIgZm9yIGhpcyB1c2Vycz8gUGxl YXNlIGRvIG5vdCBzdG9wIHRoZSBwdXJwb3NlIChieSBzdWNoIHBocmFzZXMpIQ0KDQpUVVJOIG1l c3NhZ2Ugc2VjdXJpdHkgaXMgY3JpdGljYWwgcmVnYXJkbGVzcyBvZiBhbnkgcHJvdGVjdGlvbiBv ZmZlcmVkIGJ5IHRoZSBhcHBsaWNhdGlvbiBwcm90b2NvbC4gVGhleeKAmXJlIG5vdCBtdXR1YWxs eSBleGNsdXNpdmUuIFNlZSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNTc2NiNzZWN0 aW9uLTE3LjEuNi4NCg0KLSBBZ2Fpbiwgc2hvdWxkIGEgZGlzY292ZXJ5IGRyYWZ0IHJlYWxseSBz cGVjaWZ5IHVzYWdlPyBBbmQgKEQpVExTIGlzIE5PVCBtYW5kYXRlZCB3aGVuIHVzaW5nIG90aGVy IHRoYW4gZGlzY292ZXJlZCBUVVJOIHNlcnZlcnMgaW4gdGhlIGRpc2N1c3NlZCBzY29wZSAod2hl cmUgaXQgY29udHJhZGljdHMgdGhlIHB1cnBvc2UpLi4NCg0KKEQpVExTIGlzIG9ubHkgbWFuZGF0 b3J5IGluIHRoZSBhYnNlbmNlIG9mIFNUVU4gYXV0aGVudGljYXRpb24uIFRoZSBkcmFmdCBtYW5k YXRlcyB0aGF0IG9uZSAoU1RVTiBhdXRoKSBvciB0aGUgb3RoZXIgKChEKVRMUykgaXMgbWFuZGF0 b3J5Lg0KDQotUHJhc2hhbnRoDQoNCg0KQW5kIHJlZ2FyZGluZzoNCj4gVGhlIGRyYWZ0IGlzIG1l YW50IGZvciBnZW5lcmFsIHB1cnBvc2UgVFVSTiBzZXJ2ZXIgZGlzY292ZXJ5LCBub3Qgc3BlY2lm aWMgdG8gV2ViUlRDDQpOZXR3b3JrIHByb3ZpZGVkIHR1cm4gc2VydmVycyBmb3IgV2ViUlRDIHVz YWdlIHdhcyBhY3R1YWxseSB0aGUgbWFpbiBwdXJwb3NlOiBTcGVjaWZpY2FsbHkgdGhhdCBtdXN0 IG5vdCBiZSBibG9ja2VkIG5vdyAodGhyb3duIGluIGR1cmluZyBkaXNjdXNzIHBoYXNlKSENCg0K U0VFIEZVUlRIRVIgSU5MSU5FIEJFTE9XLCByZWdhcmRpbmcgdGhlIGlzc3VlIHJlcGVhdGVkbHkg aWdub3JlZC91bmFuc3dlcmVkIGR1cmluZyB0aGUgV0cgc3RhZ2UgKHNpbmNlIGhpZ2hsaWdodGVk IGluIHZlcnNpb24gLTA2IG9mIHRoaXMgZHJhZnQpLg0KDQovS2FybA0KDQpGcsOlbjogUHJhc2hh bnRoIFBhdGlsIChwcmFzcGF0aSkgW21haWx0bzpwcmFzcGF0aUBjaXNjby5jb21dDQpTa2lja2F0 OiBkZW4gMTggb2t0b2JlciAyMDE2IDA0OjM4DQpUaWxsOiBLYXJsIFN0YWhsOyAnU3BlbmNlciBE YXdraW5zIGF0IElFVEYnOyAnVGhlIElFU0cnOyB0cmFtLWNoYWlyc0BpZXRmLm9yZzxtYWlsdG86 dHJhbS1jaGFpcnNAaWV0Zi5vcmc+DQpLb3BpYTogdHJhbUBpZXRmLm9yZzxtYWlsdG86dHJhbUBp ZXRmLm9yZz47ICdBbGV4ZXkgTWVsbmlrb3YnOyBkcmFmdC1pZXRmLXRyYW0tdHVybi1zZXJ2ZXIt ZGlzY292ZXJ5QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLXRyYW0tdHVybi1zZXJ2ZXItZGlz Y292ZXJ5QGlldGYub3JnPjsgJ1NpbW9uIFBlcnJlYXVsdCc7IFRpcnVtYWxlc3dhciBSZWRkeSAo dGlyZWRkeSkNCsOEbW5lOiBSZTogU1Y6IFt0cmFtXSBOZWVkIHRvIGJlIGZpeGVkISBEaXNjdXNz IG9uIGRyYWZ0LWlldGYtdHJhbS10dXJuLXNlcnZlci1kaXNjb3ZlcnktMTA6ICh3aXRoIERJU0NV U1MpDQoNCg0KDQpPbiAxMC8xNy8xNiwgMToxNSBBTSwgIkthcmwgU3RhaGwiIDxrYXJsLnN0YWhs QGluZ2F0ZS5jb208bWFpbHRvOmthcmwuc3RhaGxAaW5nYXRlLmNvbT4+IHdyb3RlOg0KDQpTcGVu Y2VyLA0KDQpDYW4gdGhlIGF1dGhvcnMgb2YgdGhpcyBkaXNjb3ZlcnkgZHJhZnQg4oCcYmUgb3Jk ZXJlZOKAnSB0byBhZGRyZXNzIHRoZSB0d28gcG9pbnRzIGJlbG93Pw0KDQo6LSkNCg0KUG9pbnQg Mikgd2FzICh1bm5lY2Vzc2FyaWx5KSBpbnRyb2R1Y2VkIGR1cmluZyB0aGUgRElTQ1VTUw0KKEkg anVzdCBoaWdobGlnaHRlZCB0byB0aGUgV0cgbGlzdCB0aGF0IGl0IGlzIE5PVCBhZGRyZXNzZWQs IGluIHNwaXRlIG9mIHdoYXQgaXMgc2FpZCBieSBhbiBhdXRob3IuKQ0KDQpQb2ludCAxKSBoYXMg cmVwZWF0ZWRseSBiZWVuIHBvaW50ZWQgb3V0IG9uIHRoaXMgV0cgbGlzdCBzaW5jZSB2ZXJzaW9u IC0wNiBvZiB0aGUgZHJhZnQsIGJ1dCBpZ25vcmVkIGJ5IHRoZSBhdXRob3JzLg0KDQpXZSBpbnRl bmQgdG8gYWRkIHRoZSBmb2xsb3dpbmcgdG8gZXhwbGFpbiBzZXJ2ZXIgYmVoYXZpb3IgYSBsaXR0 bGUgYmV0dGVyOg0K4oCcQSBUVVJOIGFueWNhc3Qgc2VydmVyIHBlcmZvcm1zIGNoZWNrcyAxIHRv IDcgZGlzY3Vzc2VkIGluIFNlY3Rpb24gNi4yIG9mIFJGQzU3NjYuIElmIGFsbCBjaGVja3MgcGFz cywgdGhlIFRVUk4gYW55Y2FzdCBzZXJ2ZXIgTVVTVCByZXNwb25kIHdpdGggYSAzMDAgKFRyeSBB bHRlcm5hdGUpIGVycm9yIGFzIGRlc2NyaWJlZCBpbiBbUkZDNTc2Nl074oCdDQpbS2FybF0gVGhh dCBtdXN0IGJlIGFuIHVwZGF0ZSBvZiBSRkM1NzY2LiBPciBkb2VzIOKAnFRVUk4gYW55Y2FzdCBz ZXJ2ZXLigJ0gaW1wbHkgdGhhdCB0aGVyZSBBTFNPIGlzIGEg4oCcVFVSTiB1bmljYXN0IHNlcnZl cuKAnSBhdCB0aGUgc2FtZSBpbnRlcmZhY2UgYWNjZXB0aW5nIHRoZSBBbGxvY2F0ZSByZXF1ZXN0 Pw0KTXkgcHJvcG9zYWwgaXMgYmV0dGVyIChpbiBzZXZlcmFsIGFzcGVjdHMpIGFuZCBkb27igJl0 IG5lZWQgdG8gdXBkYXRlIFJGQzU3NjYgdHVybiBzZXJ2ZXIgYmVoYXZpb3IuDQoNCkFzIHRoZSB0 ZXh0IGlzIGluIHRoaXMgdmVyc2lvbiAtMTAgb2YgdGhlIGRyYWZ0IG5vdyBpcywgaXQgZG9lcyBO T1QgZnVsZmlsbCBpdHMgcHVycG9zZSB0byBkaXNjb3ZlciBhIG5ldHdvcmsgcHJvdmlkZWQgVFVS TiBzZXJ2ZXIgdG8gYWxsb3cgcmVhbC10aW1lIGNvbW11bmljYXRpb24sIGluIHNpdHVhdGlvbnMg d2hlcmUgaXQgb3RoZXJ3aXNlIGlzIG5vdCBwb3NzaWJsZSBvciBiYWQuDQotIEl0IGRvZXMgbm90 IHByb3ZpZGUgYSBtZXRob2Qgc3VpdGFibGUgZm9yIGRyYWZ0LWlldGYtcnRjd2ViLXJldHVybi0w MQ0KLSBJdCBkb2VzIG5vdCBtZWV0IHRoZSBhdXRvY29uZmlndXJhdGlvbiBvZiBSRkMgNzQ3OCAo V2ViIFJlYWwtVGltZSBDb21tdW5pY2F0aW9uIFVzZSBDYXNlcyBhbmQgUmVxdWlyZW1lbnRzKSAy LjMuNS4xLg0KDQpNb3JlIGdlbmVyYWxseSAocmVnYXJkaW5nIHRoZSBtYW5kYXRpbmcgb2YgKEQp VExTLCBzdWRkZW5seSBpbnRyb2R1Y2VkIGR1cmluZyB0aGUgRElTQ1VTUyk6DQpXZSBzaG91bGQg YmUgYWJsZSB0byB1c2UgV2ViUlRDIGV2ZXJ5d2hlcmUgd2UgY2FuIGFuZCBkbyBzdXJmLCBhbmQg Zm9yIGZpcmV3YWxsL05BVCB0cmF2ZXJzYWwgYW5kIHF1YWxpdHkgaXQgaXMgaW4gbWFueSBjYXNl cyBuZWNlc3NhcnkgdG8gcGFyYWxsZWwgdGhlIGxvY2FsIGZpcmV3YWxsL2FjY2VzcyByb3V0ZXIv ZGVmYXVsdCBnYXRld2F5IHdpdGggYSBUVVJOIHNlcnZlciwgdG8gZ2V0IGEgZ29vZCBtZWRpYSBw YXRoLiBUaGUgYXV0b21hdGljIGRpc2NvdmVyeSBvZiBzdWNoIG5ldHdvcmsgcHJvdmlkZWQgdHVy biBzZXJ2ZXIgc2hvdWxkIGJlIGdpdmVuIGJ5IHRoaXMgZHJhZnQsIGJ1dCBpdCBzaG91bGQgTk9U IHNldCB1cCByZXN0cmljdGlvbnMgZm9yIGl0IHVzYWdlIChlc3BlY2lhbGx5IHdoZW4gaXQgaXMg dW5uZWNlc3NhcnkgYW5kIGJsb2NrcyB0aGUgZ2VuZXJhbCB1c2FnZSBlLmcuIHN1Y2ggYXMgc3Bl Y2lmaWVkIGluIGRyYWZ0LWlldGYtcnRjd2ViLXJldHVybi0wMSkuDQoNCk5vdCBtYW5kYXRpbmcg RFRMUyBvcGVucyB1cCB0aGUgY2xpZW50L3NlcnZlciB0byBhIGhvc3Qgb2YgYXR0YWNrcyBzdWNo IGFzIGFuIGF0dGFja2VyIHNlbmRpbmcgZmFrZSByZXF1ZXN0cy9yZXNwb25zZXMuIFRoZSBkcmFm dCBpcyBtZWFudCBmb3IgZ2VuZXJhbCBwdXJwb3NlIFRVUk4gc2VydmVyIGRpc2NvdmVyeSwgbm90 IHNwZWNpZmljIHRvIFdlYlJUQywgYW5kIGhlbmNlLCBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBo YXZlIHRvIGJlIGJyb2FkLg0KDQotUHJhc2hhbnRoDQoNClRoZSBhdXRob3JzIG9mIHRoaXMgZHJh ZnQgc2VlbSB0byBoYXZlIHNvbWUgb3RoZXIgdXNlIGNhc2UgaW4gbWluZCwgYnV0IHRoYXQgbXVz dCBub3QgYmxvY2sgdGhlIHVzYWdlIGZvciB3aGljaCB0aGlzIGRpc2NvdmVyeSBzcGVjaWZpY2F0 aW9uIHdhcyByZXF1aXJlZC4NCkFzIHdyaXR0ZW4gaW4gdGhpcyB2ZXJzaW9uIC0xMCBvZiB0aGUg ZHJhZnQsIGl0IGlzIGEgc2hvd3N0b3BwZXIuDQoNCi9LYXJsDQoNCg0K --_000_5E4834691E3148C28D8FD61DA6660776ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <64ED91C1FE75384BB38305A1EC0B0EA2@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6QXJpYWw7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAy IDIgMiAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCXBh bm9zZS0xOjIgNyAzIDkgMiAyIDUgMiA0IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToi Q2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZh Y2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCXBhbm9zZS0xOjIgMTEg NiA5IDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6UE1pbmdMaVU7DQoJ cGFub3NlLTE6MiAyIDUgMCAwIDAgMCAwIDAgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5 OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQovKiBTdHlsZSBEZWZp bml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXtt YXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxp bmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0 aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnAuTXNvUGxhaW5UZXh0LCBsaS5Nc29QbGFpblRleHQsIGRpdi5Nc29QbGFp blRleHQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFpbiBU ZXh0IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KcA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJp Z2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47 DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpw Lk1zb0FjZXRhdGUsIGxpLk1zb0FjZXRhdGUsIGRpdi5Nc29BY2V0YXRlDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiQmFsbG9vbiBUZXh0IENoYXIiOw0KCW1hcmdp bjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21z by1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5QbGFpblRleHRDaGFyDQoJe21z by1zdHlsZS1uYW1lOiJQbGFpbiBUZXh0IENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsN Cgltc28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCI7DQoJZm9udC1mYW1pbHk6Q291cmllcjt9DQpz cGFuLkJhbGxvb25UZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiQmFsbG9vbiBUZXh0IENoYXIi Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiQmFsbG9vbiBUZXh0 IjsNCglmb250LWZhbWlseTpDYWxpYnJpO30NCnAuT2Zvcm1hdGVyYWR0ZXh0LCBsaS5PZm9ybWF0 ZXJhZHRleHQsIGRpdi5PZm9ybWF0ZXJhZHRleHQNCgl7bXNvLXN0eWxlLW5hbWU6Ik9mb3JtYXRl cmFkIHRleHQiOw0KCW1zby1zdHlsZS1saW5rOiJPZm9ybWF0ZXJhZCB0ZXh0IENoYXIiOw0KCW1h cmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJ Zm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0Kc3Bhbi5PZm9ybWF0ZXJhZHRleHRDaGFy DQoJe21zby1zdHlsZS1uYW1lOiJPZm9ybWF0ZXJhZCB0ZXh0IENoYXIiOw0KCW1zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiT2Zvcm1hdGVyYWQgdGV4dCI7DQoJZm9udC1m YW1pbHk6Q29uc29sYXM7fQ0KcC5CYWxsb25ndGV4dCwgbGkuQmFsbG9uZ3RleHQsIGRpdi5CYWxs b25ndGV4dA0KCXttc28tc3R5bGUtbmFtZTpCYWxsb25ndGV4dDsNCgltc28tc3R5bGUtbGluazoi QmFsbG9uZ3RleHQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpz cGFuLkJhbGxvbmd0ZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiQmFsbG9uZ3RleHQgQ2hhciI7 DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOkJhbGxvbmd0ZXh0Ow0K CWZvbnQtZmFtaWx5OlRhaG9tYTt9DQpzcGFuLkVtYWlsU3R5bGUyNw0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbDsNCglmb250LWZhbWlseTpBcmlhbDsNCgljb2xvcjpibHVlO30NCnNwYW4uRW1h aWxTdHlsZTI4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OkFyaWFs Ow0KCWNvbG9yOmJsdWU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjkNCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWw7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4u RW1haWxTdHlsZTMwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OkFy aWFsOw0KCWNvbG9yOmJsdWU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMzENCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNw YW4uRW1haWxTdHlsZTMyDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5 OkFyaWFsOw0KCWNvbG9yOmJsdWU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMzMNCgl7bXNvLXN0eWxlLXR5 cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0 ZXh0O30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1z dHlsZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9 DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNp emU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCglt YXJnaW46NzAuODVwdCA3MC44NXB0IDcwLjg1cHQgNzAuODVwdDt9DQpkaXYuV29yZFNlY3Rpb24x DQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2Nv bG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRp diBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29s b3I6YmxhY2siPk9uIDEwLzE4LzE2LCAxMjoyNiBQTSwgJnF1b3Q7S2FybCBTdGFobCZxdW90OyAm bHQ7PGEgaHJlZj0ibWFpbHRvOmthcmwuc3RhaGxAaW5nYXRlLmNvbSI+a2FybC5zdGFobEBpbmdh dGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPlNlZSBbS2FybF0gY29tbWVudHMgYmVs b3cNCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpO2NvbG9yOmJsdWUiPsOgPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xp ZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkZyw6VuOjwvc3Bhbj48L2I+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+IFByYXNoYW50aCBQYXRp bCAocHJhc3BhdGkpIFttYWlsdG86cHJhc3BhdGlAY2lzY28uY29tXQ0KPGJyPg0KPGI+U2tpY2th dDo8L2I+IGRlbiAxOCBva3RvYmVyIDIwMTYgMTk6MzY8YnI+DQo8Yj5UaWxsOjwvYj4gS2FybCBT dGFobDsgJ1NwZW5jZXIgRGF3a2lucyBhdCBJRVRGJzsgJ1RoZSBJRVNHJzsgdHJhbS1jaGFpcnNA aWV0Zi5vcmc8YnI+DQo8Yj5Lb3BpYTo8L2I+IHRyYW1AaWV0Zi5vcmc7ICdBbGV4ZXkgTWVsbmlr b3YnOyBkcmFmdC1pZXRmLXRyYW0tdHVybi1zZXJ2ZXItZGlzY292ZXJ5QGlldGYub3JnOyAnU2lt b24gUGVycmVhdWx0JzsgVGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5KTxicj4NCjxiPsOEbW5l OjwvYj4gUmU6IFNWOiBTVjogW3RyYW1dIE5lZWQgdG8gYmUgZml4ZWQhIERpc2N1c3Mgb24gZHJh ZnQtaWV0Zi10cmFtLXR1cm4tc2VydmVyLWRpc2NvdmVyeS0xMDogKHdpdGggRElTQ1VTUyk8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5PbiAxMC8xOC8xNiwgNjoyMCBB TSwgJnF1b3Q7S2FybCBTdGFobCZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmthcmwuc3RhaGxA aW5nYXRlLmNvbSI+a2FybC5zdGFobEBpbmdhdGUuY29tPC9hPiZndDsgd3JvdGU6PC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGlu Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2Nv bG9yOmJsdWUiPlNwZW5jZXIgKGFuZCBhdXRob3JzKSw8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj4m bmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPldlIG5lZWQgdGhlIGxvbmcgYXdhaXRlZCBkaXNjb3Zl cnkgZHJhZnQgYW5kIHRoZSBhbnljYXN0IG1ldGhvZCwgYW5kIGRvbuKAmXQgd2FudCBhbiDigJw8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+ YXBwZWFsDQogKHdoaWNoIGdldHMgdXMgcmlnaHQgYmFjayBoZXJlLCBhZnRlciB3YXN0aW5nIHRp bWUpLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpO2NvbG9yOmJsdWUiPuKAnQ0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj5JdCBtdXN0IHdvcmsgZm9y IGRpc2NvdmVyeSBvZiBhIG5ldHdvcmsgcHJvdmlkZWQgdHVybiBzZXJ2ZXIsIHRoYXQgdGhlIHBy b3ZpZGVyIG9mIHRoZSBsb2NhbCBuZXR3b3JrIChMQU4pIGhhcyBtYWRlIGF2YWlsYWJsZSBmb3Ig YWxsIGhpcyB1c2VycyB0byBydW4NCiByZWFsLXRpbWUgdHJhZmZpYyB0aHJvdWdoIChyYXRoZXIg dGhhbiB0aHJvdWdoIGEgZGF0YSBjcm93ZGVkIG9yIGJsb2NrZWQgZGVmYXVsdCBnYXRld2F5IHBh dGgpLg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPlRoaXMg ZHJhZnQgY2Fubm90L211c3Qgbm90ICh0aHJvd24gaW4gZHVyaW5nIHRoZSBESVNDVVNTISkgYmxv Y2sgc3VjaCBnZW5lcmFsIHVzYWdlIGJ5IHVuZGVyIDkgbWFuZGF0aW5nIChEKVRMUywgcmVxdWly aW5nIGEgbmV3IGluZnJhc3RydWN0dXJlIHRvIGJlDQogZXN0YWJsaXNoZWQgYnk6PC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVm dDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+QSBUVVJOIGNsaWVudCBNVVNUIHVzZSAoRClUTFMg4oCmPC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7Jm5i c3A7IG9uZSBvZiB0aGUgZm9sbG93aW5nIHRlY2huaXF1ZXMgd2l0aCAoRClUTFMgdG8gdmFsaWRh dGUgdGhlIFRVUk48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDsmbmJzcDsgc2VydmVyOjwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZu YnNwOyZuYnNwOyBvJm5ic3A7IEZvciBjZXJ0aWZpY2F0ZS1iYXNlZCBhdXRoZW50aWNhdGlvbiwg YSBwcmUtcG9wdWxhdGVkIHRydXN0IGFuY2hvcjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyBzdG9yZeKApjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IENl cnRpZmljYXRpb24gYXV0aG9yaXRpZXMgdGhhdCBpc3N1ZSBUVVJOIHNlcnZlciBjZXJ0aWZpY2F0 ZXPigKY8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+ZXNwZWNp YWxseSB3aGVuIHRoZSByZWxlYXNlIG9mIGF1dGhlbnRpY2F0aW9uIG9mIHN1Y2ggdHVybiBzZXJ2 ZXJzIGhhdmUgYmVlbiBzcGVjaWZpZWQgaW4gdGhlIGRyYWZ0Ljwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+ Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPkJlbiBD YW1wZWJlbGwNCjxiPmRpZCBub3QgY2xlYXIgaGlzIERJU0NVU1MgdW5jb25kaTwvYj50aW9uYWxs eSwgaGUgc2FpZDo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij7igJwtOSwgdGhpcmQgcGFyYWdyYXBoOjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48YnI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SSBzYXcgYSBjb21tZW50IG9uIG15IERJ U0NVU1MgZW1haWwgdGhyZWFkIGZyb20gS2FybCBTdGFobCwgc3RhdGluZyB0aGF0IERUTFMgY291 bGQgbm90IGJlIG1hbmRhdGVkLiBIYXMgdGhhdCBpbnB1dCBiZWVuIGNvbnNpZGVyZWQ/IChJIGRv bid0IGhhdmUgYW4gb3BpbmlvbjsgSSBqdXN0IHdhbnQgdG8gbWFrZSBzdXJlIHBlb3BsZSBub3Rp Y2VkDQogdGhlIGNvbW1lbnQuKeKAnTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+VGhhdCBpbnB1dCBoYXMg Tk9UIGJlZW4gY29uc2lkZXJlZC48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29s b3I6Ymx1ZSI+RnJvbSBiZWxvdyBpdCBzZWVtcyBsaWtlIHRoZSBhdXRob3JzIHdpbGwgaXNzdWUg YSB2ZXJzaW9uIC0xMSBvZiB0aGUgZHJhZnQ8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmk7Y29sb3I6Ymx1ZSI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PGI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj5QcmFzaGFudGgsPC9z cGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmk7Y29sb3I6Ymx1ZSI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj5QbGVhc2UsIHRo ZW4gcmVtb3ZlIHRoZSAoRClUTFMgbWFuZGF0aW5nLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+WW91ciBj b21tZW50Ojwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPk5vdCBtYW5kYXRpbmcgRFRMUyBvcGVucyB1cCB0aGUgY2xpZW50L3Nl cnZlciB0byBhIGhvc3Qgb2YgYXR0YWNrcyBzdWNoIGFzIGFuIGF0dGFja2VyIHNlbmRpbmcgZmFr ZSByZXF1ZXN0cy9yZXNwb25zZXMuDQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhlIGRyYWZ0IGlzIG1l YW50IGZvciBnZW5lcmFsIHB1cnBvc2UgVFVSTiBzZXJ2ZXIgZGlzY292ZXJ5LCBub3Qgc3BlY2lm aWMgdG8gV2ViUlRDLCBhbmQgaGVuY2UsIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGhhdmUgdG8N CiBiZSBicm9hZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+aXMgaXJyZWxldmFudCBmb3IgdHVybiBzZXJ2 ZXIgYWxsb2NhdGlvbnMgb24gdGhlIExBTiw8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aTtjb2xvcjpibGFjayI+VGhlIHNjb3BlIGlzIG1vcmUgdGhhbiBqdXN0IExBTi48L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29s b3I6Ymx1ZSI+W0thcmxdIFlvdXIgKEQpVExTIG1hbmRhdGluZyB3YXMgaW50cm9kdWNlZCBmb3I6 PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpO2NvbG9yOmJsdWUiPuKAnDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDsmbmJzcDsgVXNlIG9mIFNlc3Npb24gVHJh dmVyc2FsIFV0aWxpdGllcyBmb3IgTkFUIChTVFVOKSBbUkZDNTM4OV08L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNw OyZuYnNwOyBhdXRoZW50aWNhdGlvbiBpcyBPUFRJT05BTA0KPHU+Zm9yIFRVUk4gc2VydmVycyBw cm92aWRlZCBieSB0aGUgbG9jYWw8L3U+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48dT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDsmbmJzcDsgbmV0d29y ayBvciBieSB0aGUgYWNjZXNzIG5ldHdvcms8L3NwYW4+PC91PjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi4mbmJzcDsgQSBuZXR3b3JrIHByb3ZpZGVk IFRVUk4gc2VydmVyIE1BWTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7Jm5ic3A7IGJlIGNvbmZpZ3VyZWQgdG8g YWNjZXB0IEFsbG9jYXRpb24gcmVxdWVzdHMgd2l0aG91dCBTVFVOPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDsm bmJzcDsgYXV0aGVudGljYXRpb24sIGFuZCBhIFRVUk4gY2xpZW50IE1BWSBiZSBjb25maWd1cmVk IHRvIGFjY2VwdDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7Jm5ic3A7IEFsbG9jYXRpb24gc3VjY2VzcyByZXNw b25zZXMgd2l0aG91dCBTVFVOIGF1dGhlbnRpY2F0aW9uIGZyb20gYTwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7 Jm5ic3A7IG5ldHdvcmsgcHJvdmlkZWQgVFVSTiBzZXJ2ZXIuPC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPuKA nTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaTtjb2xvcjpibHVlIj50aGF0IGlzIHdoYXQgSSBjYWxsZWQgTEFOIGFuZCBJUyB0aGUg c2NvcGUgZGlzY3Vzc2VkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPllvdSBzZWVtIHRvIGhhdmUgY29udmVu aWVudGx5IGRpc2NvdW50ZWQgdGhlIGFjY2VzcyBuZXR3b3JrLjwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7 Y29sb3I6Ymx1ZSI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPllvdXIgc3VkZGVuIG1hbmRh dGluZyBvZiAoRClUTFMgZm9yIHRoaXMgc2NvcGUgZHVyaW5nIHRoZSBkaXNjdXNzIGNvbnRyYWRp Y3RzIHRoZSB2ZXJ5IHJlYXNvbiBmb3IgdGhpcyByZWxlYXNlIG9mIHRoZSBNVVNUIGF1dGhlbnRp Y2F0ZSBpbiB0aGlzIHNwZWNpZmljDQogc2NvcGUuIFBsZWFzZSByZW1vdmUhPC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtj b2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpi bHVlIj53aGVyZSBldmVyeXRoaW5nIGlzIGFzIG9wZW4gYXMgaXQgaXM6IFlvdSBjYW5ub3Qvc2hv dWxkIG5vdCBleHBlY3QgdGhlIHJlYWwtdGltZSB0cmFmZmljIHRvIGhhdmUgYmV0dGVyIHNlY3Vy aXR5IGJ5IHNlbmRpbmcgaXQgdGhyb3VnaCB0aGUgdHVybiBzZXJ2ZXINCiBwYXRoIHRoYW4gdGhy b3VnaCB0aGUgZGVmYXVsdCBnYXRld2F5IHBhdGguIEluIGFkZGl0aW9uLCBXZWJSVEMgaGFzIERU TFMtU1JUUCBvZiB0aGUgcmVhbC10aW1lIHRyYWZmaWMgbWFuZGF0ZWQgaW4gaXRzZWxmITwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmk7Y29sb3I6Ymx1ZSI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO3RleHQtYXV0b3NwYWNlOm5vbmUiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymxh Y2siPldlYlJUQyBoYXMgdGhhdCB0byBwcm90ZWN0IGFwcGxpY2F0aW9uIGRhdGEuIEl0IGhhcyBu b3RoaW5nIHRvIGRvIHdpdGggVFVSTi4gUHJvdGVjdGlvbiBvZiBhcHBsaWNhdGlvbiBkYXRhIGRv ZXMgbm90IGltcGx5IFRVUk4NCiBtZXNzYWdlcyBkb27igJl0IG5lZWQgc2VjdXJpdHkuIFRoZSBp bnRlbnQgaGVyZSBpcyB0byBjb25zaWRlciBhc3BlY3RzIG9mIHNlY3VyaXR5IHRoYXQgZGVhbCBk aXJlY3RseSB3aXRoIFRVUk4gbWVzc2FnZXMgYW5kIHRleHQgaW4gdGhlIGRyYWZ0IGFkZHJlc3Nl cyB0aG9zZSBhc3BlY3RzLg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO3RleHQtYXV0b3NwYWNlOm5vbmUiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+ Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluO3RleHQtYXV0b3NwYWNlOm5vbmUiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+W0thcmxdIERvIHlv dSB0aGluayB3ZSBuZWVkIHRvIGRpc2NvdmVyIFRVUk4gc2VydmVycyBmb3IgdGhlIHBsZWFzdXJl IG9mIGRvaW5nIOKAnDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5zZWN1cml0eQ0KIHRoYXQgZGVhbCBkaXJlY3RseSB3 aXRoIFRVUk4gbWVzc2FnZXM8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj7igJ0gaW4gaXRzZWxmLCBhbmQgbm90IGZvciB3 aGF0IHRoZXkgYXJlIHN1cHBvc2VkIHRvIGRvIChyZWxheSDigJxhcHBsaWNhdGlvbiBkYXRh4oCd KSBhbmQgZG8geW91IGFsc28gdGhpbmsgdGhhdCBpcyB3aHkgYSBuZXR3b3JrIHByb3ZpZGVyIHdp bGwgZGVwbG95IHN1Y2gNCiBUVVJOIHNlcnZlciBmb3IgaGlzIHVzZXJzPyBQbGVhc2UgZG8gbm90 IHN0b3AgdGhlIHB1cnBvc2UgKGJ5IHN1Y2ggcGhyYXNlcykhPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47dGV4dC1hdXRv c3BhY2U6bm9uZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaTtjb2xvcjpibHVlIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0idGV4dC1hdXRvc3BhY2U6bm9uZSI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+VFVSTiBtZXNzYWdl IHNlY3VyaXR5IGlzIGNyaXRpY2FsIHJlZ2FyZGxlc3Mgb2YgYW55IHByb3RlY3Rpb24gb2ZmZXJl ZCBieSB0aGUgYXBwbGljYXRpb24gcHJvdG9jb2wuIFRoZXnigJlyZSBub3QgbXV0dWFsbHkgZXhj bHVzaXZlLiBTZWUNCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvcmZjNTc2NiNzZWN0aW9uLTE3LjEuNiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO3Rl eHQtZGVjb3JhdGlvbjpub25lIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNTc2NiNz ZWN0aW9uLTE3LjEuNjwvc3Bhbj48L2E+Ljwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjt0ZXh0LWF1 dG9zcGFjZTpub25lIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjt0ZXh0LWF1dG9zcGFjZTpub25l Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9y OmJsdWUiPi0gQWdhaW4sIHNob3VsZCBhIGRpc2NvdmVyeSBkcmFmdCByZWFsbHkgc3BlY2lmeSB1 c2FnZT8gQW5kIChEKVRMUyBpcyBOT1QgbWFuZGF0ZWQgd2hlbiB1c2luZyBvdGhlciB0aGFuIGRp c2NvdmVyZWQgVFVSTiBzZXJ2ZXJzDQogaW4gdGhlIGRpc2N1c3NlZCBzY29wZSAod2hlcmUgaXQg Y29udHJhZGljdHMgdGhlIHB1cnBvc2UpLi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjt0ZXh0LWF1dG9zcGFjZTpub25l Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9y OmJsdWUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJ0ZXh0LWF1dG9zcGFjZTpub25lIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4oRClUTFMgaXMgb25seSBtYW5kYXRv cnkgaW4gdGhlIGFic2VuY2Ugb2YgU1RVTiBhdXRoZW50aWNhdGlvbi4gVGhlIGRyYWZ0IG1hbmRh dGVzIHRoYXQgb25lIChTVFVOIGF1dGgpIG9yIHRoZSBvdGhlciAoKEQpVExTKSBpcyBtYW5kYXRv cnkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRl eHQtYXV0b3NwYWNlOm5vbmUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0LWF1dG9zcGFjZTpub25lIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4tUHJh c2hhbnRoPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmk7Y29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO3RleHQtYXV0b3NwYWNlOm5vbmUiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+ Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUi PkFuZCByZWdhcmRpbmc6PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj4mZ3Q7PC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiBUaGUgZHJhZnQgaXMgbWVh bnQgZm9yIGdlbmVyYWwgcHVycG9zZSBUVVJOIHNlcnZlciBkaXNjb3ZlcnksIG5vdCBzcGVjaWZp YyB0byBXZWJSVEM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Ymx1ZSI+TmV0d29yayBwcm92aWRlZCB0dXJuIHNlcnZl cnMgZm9yIFdlYlJUQyB1c2FnZSB3YXMgYWN0dWFsbHkgdGhlIG1haW4gcHVycG9zZTogU3BlY2lm aWNhbGx5IHRoYXQgbXVzdCBub3QgYmUgYmxvY2tlZCBub3cgKHRocm93biBpbiBkdXJpbmcgZGlz Y3VzcyBwaGFzZSkhPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUi PlNFRSBGVVJUSEVSIElOTElORSBCRUxPVywgcmVnYXJkaW5nIHRoZSBpc3N1ZSByZXBlYXRlZGx5 IGlnbm9yZWQvdW5hbnN3ZXJlZCBkdXJpbmcgdGhlIFdHIHN0YWdlIChzaW5jZSBoaWdobGlnaHRl ZCBpbiB2ZXJzaW9uIC0wNiBvZiB0aGlzIGRyYWZ0KS48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPiZuYnNw Ozwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmk7Y29sb3I6Ymx1ZSI+L0thcmw8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPiZuYnNwOzwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48Yj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5GcsOlbjo8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiBQcmFz aGFudGggUGF0aWwgKHByYXNwYXRpKSBbPGEgaHJlZj0ibWFpbHRvOnByYXNwYXRpQGNpc2NvLmNv bSI+bWFpbHRvOnByYXNwYXRpQGNpc2NvLmNvbTwvYT5dDQo8YnI+DQo8Yj5Ta2lja2F0OjwvYj4g ZGVuIDE4IG9rdG9iZXIgMjAxNiAwNDozODxicj4NCjxiPlRpbGw6PC9iPiBLYXJsIFN0YWhsOyAn U3BlbmNlciBEYXdraW5zIGF0IElFVEYnOyAnVGhlIElFU0cnOyA8YSBocmVmPSJtYWlsdG86dHJh bS1jaGFpcnNAaWV0Zi5vcmciPg0KdHJhbS1jaGFpcnNAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+S29w aWE6PC9iPiA8YSBocmVmPSJtYWlsdG86dHJhbUBpZXRmLm9yZyI+dHJhbUBpZXRmLm9yZzwvYT47 ICdBbGV4ZXkgTWVsbmlrb3YnOw0KPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtdHJhbS10dXJu LXNlcnZlci1kaXNjb3ZlcnlAaWV0Zi5vcmciPmRyYWZ0LWlldGYtdHJhbS10dXJuLXNlcnZlci1k aXNjb3ZlcnlAaWV0Zi5vcmc8L2E+OyAnU2ltb24gUGVycmVhdWx0JzsgVGlydW1hbGVzd2FyIFJl ZGR5ICh0aXJlZGR5KTxicj4NCjxiPsOEbW5lOjwvYj4gUmU6IFNWOiBbdHJhbV0gTmVlZCB0byBi ZSBmaXhlZCEgRGlzY3VzcyBvbiBkcmFmdC1pZXRmLXRyYW0tdHVybi1zZXJ2ZXItZGlzY292ZXJ5 LTEwOiAod2l0aCBESVNDVVNTKTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7 Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPk9uIDEwLzE3LzE2LCAxOjE1IEFNLCAmcXVv dDtLYXJsIFN0YWhsJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86a2FybC5zdGFobEBpbmdhdGUu Y29tIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPmthcmwuc3RhaGxAaW5nYXRlLmNvbTwvc3Bh bj48L2E+Jmd0OyB3cm90ZTo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDox LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtj b2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5TcGVuY2VyLDwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmk7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPkNhbiB0aGUgYXV0 aG9ycyBvZiB0aGlzIGRpc2NvdmVyeSBkcmFmdCDigJxiZSBvcmRlcmVk4oCdIHRvIGFkZHJlc3Mg dGhlIHR3byBwb2ludHMgYmVsb3c/PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDox LjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtj b2xvcjpibGFjayI+Oi0pPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpi bGFjayI+UG9pbnQgMikgd2FzICh1bm5lY2Vzc2FyaWx5KSBpbnRyb2R1Y2VkIGR1cmluZyB0aGUg RElTQ1VTUzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPihJIGp1c3QgaGlnaGxpZ2h0ZWQgdG8gdGhlIFdH IGxpc3QgdGhhdCBpdCBpcyBOT1QgYWRkcmVzc2VkLCBpbiBzcGl0ZSBvZiB3aGF0IGlzIHNhaWQg YnkgYW4gYXV0aG9yLik8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJs YWNrIj5Qb2ludCAxKSBoYXMgcmVwZWF0ZWRseSBiZWVuIHBvaW50ZWQgb3V0IG9uIHRoaXMgV0cg bGlzdCBzaW5jZSB2ZXJzaW9uIC0wNiBvZiB0aGUgZHJhZnQsIGJ1dCBpZ25vcmVkIGJ5IHRoZSBh dXRob3JzLiAmbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJs YWNrO2JhY2tncm91bmQ6eWVsbG93O21zby1oaWdobGlnaHQ6eWVsbG93Ij5XZSBpbnRlbmQgdG8g YWRkIHRoZSBmb2xsb3dpbmc8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+IHRvIGV4cGxhaW4NCiBzZXJ2ZXIgYmVoYXZp b3IgYSBsaXR0bGUgYmV0dGVyOjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPuKAnEEgVFVSTiBhbnljYXN0 IHNlcnZlciBwZXJmb3JtcyBjaGVja3MgMSB0byA3IGRpc2N1c3NlZCBpbiBTZWN0aW9uIDYuMiBv ZiBSRkM1NzY2LiBJZiBhbGwgY2hlY2tzIHBhc3MsIHRoZSBUVVJOIGFueWNhc3Qgc2VydmVyIE1V U1QgcmVzcG9uZCB3aXRoIGENCiAzMDAgKFRyeSBBbHRlcm5hdGUpIGVycm9yIGFzIGRlc2NyaWJl ZCBpbiBbUkZDNTc2Nl074oCdPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibHVlIj5bS2FybF0gVGhhdCBtdXN0IGJl IGFuIHVwZGF0ZSBvZiBSRkM1NzY2LiBPciBkb2VzIOKAnDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5UVVJOIGFueWNh c3Qgc2VydmVyPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmk7Y29sb3I6Ymx1ZSI+4oCdDQogaW1wbHkgdGhhdCB0aGVyZSBBTFNPIGlzIGEg4oCc VFVSTiB1bmljYXN0IHNlcnZlcuKAnSBhdCB0aGUgc2FtZSBpbnRlcmZhY2UgYWNjZXB0aW5nIHRo ZSBBbGxvY2F0ZSByZXF1ZXN0PyAmbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsdWUiPk15IHByb3Bvc2Fs IGlzIGJldHRlciAoaW4gc2V2ZXJhbCBhc3BlY3RzKSBhbmQgZG9u4oCZdCBuZWVkIHRvIHVwZGF0 ZSBSRkM1NzY2IHR1cm4gc2VydmVyIGJlaGF2aW9yLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPiZuYnNw Ozwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmk7Y29sb3I6YmxhY2siPkFzIHRoZSB0ZXh0IGlzIGluIHRoaXMgdmVyc2lvbiAtMTAg b2YgdGhlIGRyYWZ0IG5vdyBpcywgaXQgZG9lcyBOT1QgZnVsZmlsbCBpdHMgcHVycG9zZSB0byBk aXNjb3ZlciBhIG5ldHdvcmsgcHJvdmlkZWQgVFVSTiBzZXJ2ZXIgdG8gYWxsb3cgcmVhbC10aW1l DQogY29tbXVuaWNhdGlvbiwgaW4gc2l0dWF0aW9ucyB3aGVyZSBpdCBvdGhlcndpc2UgaXMgbm90 IHBvc3NpYmxlIG9yIGJhZC48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4tIEl0IGRvZXMgbm90IHByb3Zp ZGUgYSBtZXRob2Qgc3VpdGFibGUgZm9yDQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+ZHJhZnQtaWV0Zi1ydGN3ZWIt cmV0dXJuLTAxPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+LSBJdCBkb2VzIG5vdCBtZWV0IHRoZSBhdXRv Y29uZmlndXJhdGlvbiBvZiBSRkMgNzQ3OCAoV2ViIFJlYWwtVGltZSBDb21tdW5pY2F0aW9uIFVz ZSBDYXNlcyBhbmQgUmVxdWlyZW1lbnRzKSAyLjMuNS4xLg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+ Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+TW9yZSBnZW5lcmFsbHkgKHJlZ2FyZGluZyB0aGUg bWFuZGF0aW5nIG9mIChEKVRMUywgc3VkZGVubHkgaW50cm9kdWNlZCBkdXJpbmcgdGhlIERJU0NV U1MpOjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPldlIHNob3VsZCBiZSBhYmxlIHRvIHVzZSBXZWJSVEMg ZXZlcnl3aGVyZSB3ZSBjYW4gYW5kIGRvIHN1cmYsIGFuZCBmb3IgZmlyZXdhbGwvTkFUIHRyYXZl cnNhbCBhbmQgcXVhbGl0eSBpdCBpcyBpbiBtYW55IGNhc2VzIG5lY2Vzc2FyeSB0byBwYXJhbGxl bA0KIHRoZSBsb2NhbCBmaXJld2FsbC9hY2Nlc3Mgcm91dGVyL2RlZmF1bHQgZ2F0ZXdheSB3aXRo IGEgVFVSTiBzZXJ2ZXIsIHRvIGdldCBhIGdvb2QgbWVkaWEgcGF0aC4gVGhlIGF1dG9tYXRpYyBk aXNjb3Zlcnkgb2Ygc3VjaCBuZXR3b3JrIHByb3ZpZGVkIHR1cm4gc2VydmVyIHNob3VsZCBiZSBn aXZlbiBieSB0aGlzIGRyYWZ0LCBidXQgaXQgc2hvdWxkIE5PVCBzZXQgdXAgcmVzdHJpY3Rpb25z IGZvciBpdCB1c2FnZSAoZXNwZWNpYWxseSB3aGVuIGl0DQogaXMgdW5uZWNlc3NhcnkgYW5kIGJs b2NrcyB0aGUgZ2VuZXJhbCB1c2FnZSBlLmcuIHN1Y2ggYXMgc3BlY2lmaWVkIGluIDwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJs YWNrIj5kcmFmdC1pZXRmLXJ0Y3dlYi1yZXR1cm4tMDE8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+KS4NCjwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7 Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPk5vdCBtYW5kYXRpbmcgRFRMUyBvcGVucyB1cCB0 aGUgY2xpZW50L3NlcnZlciB0byBhIGhvc3Qgb2YgYXR0YWNrcyBzdWNoIGFzIGFuIGF0dGFja2Vy IHNlbmRpbmcgZmFrZSByZXF1ZXN0cy9yZXNwb25zZXMuIFRoZSBkcmFmdCBpcyBtZWFudCBmb3Ig Z2VuZXJhbCBwdXJwb3NlDQogVFVSTiBzZXJ2ZXIgZGlzY292ZXJ5LCBub3Qgc3BlY2lmaWMgdG8g V2ViUlRDLCBhbmQgaGVuY2UsIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGhhdmUgdG8gYmUgYnJv YWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi1QcmFzaGFudGg8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPiZu YnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPlRoZSBhdXRob3JzIG9mIHRoaXMgZHJhZnQgc2VlbSB0 byBoYXZlIHNvbWUgb3RoZXIgdXNlIGNhc2UgaW4gbWluZCwgYnV0IHRoYXQgbXVzdCBub3QgYmxv Y2sgdGhlIHVzYWdlIGZvciB3aGljaCB0aGlzIGRpc2NvdmVyeSBzcGVjaWZpY2F0aW9uIHdhcyBy ZXF1aXJlZC4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6YmxhY2siPkFzIHdyaXR0ZW4gaW4gdGhpcyB2ZXJzaW9u IC0xMCBvZiB0aGUgZHJhZnQsIGl0IGlzIGEgc2hvd3N0b3BwZXIuPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFj ayI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+L0thcmw8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj4m bmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+Jm5i c3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_5E4834691E3148C28D8FD61DA6660776ciscocom_-- From nobody Tue Oct 18 15:33:01 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23D29129497; Tue, 18 Oct 2016 15:32:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UBfSTpc4LgiG; Tue, 18 Oct 2016 15:32:56 -0700 (PDT) Received: from mail-yw0-x230.google.com (mail-yw0-x230.google.com [IPv6:2607:f8b0:4002:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D696212947C; Tue, 18 Oct 2016 15:32:55 -0700 (PDT) Received: by mail-yw0-x230.google.com with SMTP id t192so5281055ywf.0; Tue, 18 Oct 2016 15:32:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=zkotpClSwwFt6ydowDPXkG6qLrQv9gNStYbsOrXMq+M=; b=wUG0iB7Da8MxUHi3B2Pn6DOegTrYFRprjomsI+Mmc9PpJIQFmlh+x95AJdKy0252hY zZRq3dwQ23DO2qFIDy56/iQr9Vb07KoqKjgGRA9HrVCzmQlGFPPhb5PneDkOwiU8zK1s GrfM0Anjs//hj/NLp6yleD7tGUiIIoKAD58hE/UZJJhvdOxr0fDmxBLTMOHyBF9KVtUQ BlugGxFzlgM8gxJC1RcoeyNAOo3zUHKS9dVs4RFv9fd7EZZ/zGwDFGRxeHVRX0T+Ganu LY54G+vAMShcR8U6LaVKXnZtDMUm5D1vfl/4kAP+P4/xsFYeoywv62VHTv2ytiJe3hTw XItA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=zkotpClSwwFt6ydowDPXkG6qLrQv9gNStYbsOrXMq+M=; b=mKJ/waxZouqswXo4x5eQWltDpHKHCcHvE1yY6uftDsKuo+ISDAEiuL6j5+hu6rchW3 NZAEcmfAbyYL+r6U7O+N8MBoGhOTCcOb/UqeN7OIPC11CSmNYqW0ntsATbFqupPXO8IM 9V6YNiVfwFmcb9OhkPoMzFuBeRuiXBjnPl4PGS/EXS2GmOIh+JvMIAbpAo7dNp4XtiuU PVYdIpVksJwdd7eCX81iBJNLs8C6PzG/hvD4KyvAMm+i53jB1DjVNYvuuIQpFjb27AO1 C4ZU3nLqDw26TCoFqjfpiG+rdzBapGcGklfynr2xcTJamYOcgZ+QRtsxcyWDajdaBkLX Z5rQ== X-Gm-Message-State: AA6/9Rl+2We4jBJmNQxayqsj1Civ8RS/jx6Q/gcE7nyuXfdVp1/4RfVfAlG2bXFPGtek9vtKysHqoafNij5XIg== X-Received: by 10.13.231.199 with SMTP id q190mr3078626ywe.26.1476829975063; Tue, 18 Oct 2016 15:32:55 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.47.215 with HTTP; Tue, 18 Oct 2016 15:32:53 -0700 (PDT) Received: by 10.37.47.215 with HTTP; Tue, 18 Oct 2016 15:32:53 -0700 (PDT) In-Reply-To: <555D599A-12DE-4C73-870A-48597910EED2@nostrum.com> References: <147269306853.31916.11958166980739260630.idtracker@ietfa.amsl.com> <362B7B05-81DA-49D7-8452-9BA21F991D00@nostrum.com> <94397E90-8765-4AAE-81C2-49B8C5B39132@nostrum.com> <23373C96-0D5F-4C0B-82EA-B93CE91ABA0F@nostrum.com> <06a5626c99c54b95864158677435fe79@XCH-RCD-017.cisco.com> <555D599A-12DE-4C73-870A-48597910EED2@nostrum.com> From: Spencer Dawkins at IETF Date: Tue, 18 Oct 2016 17:32:53 -0500 Message-ID: To: Ben Campbell Content-Type: multipart/alternative; boundary=94eb2c0815520ecce4053f2b46db Archived-At: Cc: Prashanth Patil , "tram-chairs@ietf.org" , "tram@ietf.org" , draft-ietf-tram-turn-server-discovery@ietf.org, Tirumaleswar Reddy , Simon Perreault , iesg@ietf.org Subject: Re: [tram] Ben Campbell's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS and COMMENT) X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2016 22:32:57 -0000 --94eb2c0815520ecce4053f2b46db Content-Type: text/plain; charset=UTF-8 I'm replying to Ben's original Discuss here, although he has cleared and there are multiple threads where I could be replying ... After talking with Ben and the TRAM chairs, it looks like two issues came up while resolving Ben's Discuss that seem appropriate for me to work through at this point in the process. First, the proposed resolution handles authentication in a way that assumes deployment in some scenarios, but not others, and the TRAM working group hasn't had an opportunity to look at the proposed resolution in this form yet. The working group needs to have rough consensus on a product of the working group. So, I will ask the TRAM working group to review that change, in discussion on the TRAM mailing list, and report back. The discussion on the TRAM mailing list can start now. Second, the proposed resolution added a significant update to a requirement RFC 5766 placed on the use of authentication, and the broader community hasn't had an opportunity to review that because it happened after Last Call. Ben and I talked, and I think a second Last Call that draws attention to the update will be appropriate. I'll wait until the TRAM working group reports back to start that second Last Call. Conveniently, Terry Manderson still holds a Discuss for an issue that's been resolved, but if Terry does clear his Discuss before we've finished the two steps I listed above, I'll ballot a Discuss for the reasons listed in this email, to hold the document in IESG Evaluation. Thanks, all, for your input, and we'll work through this, too. Spencer, as responsible Area Director --94eb2c0815520ecce4053f2b46db Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

I'm replying to Ben's original Discuss here, althoug= h he has cleared and there are multiple threads where I could be replying .= ..

After talking with Ben and the TRAM chairs, it looks like tw= o issues came up while resolving Ben's Discuss that seem appropriate fo= r me to work through at this point in the process.

First, the proposed resolution handles authentication in a w= ay that assumes deployment in some scenarios, but not others, and the TRAM = working group hasn't had an opportunity to look at the proposed resolut= ion in this form yet.

The working group needs to have rough consensus on a product= of the working group. So, I will ask the TRAM working group to review that= change, in discussion on the TRAM mailing list, and report back.

The discussion on the TRAM mailing list can start now.

Second, the proposed resolution added a significant update t= o a requirement RFC 5766 placed on the use of authentication, and the broad= er community hasn't had an opportunity to review that because it happen= ed after Last Call. Ben and I talked, and I think a second Last Call that d= raws attention to the update will be appropriate.

I'll wait until the TRAM working group reports back to s= tart that second Last Call.

Conveniently, Terry Manderson still holds a Discuss for an i= ssue that's been resolved, but if Terry does clear his Discuss before w= e've finished the two steps I listed above, I'll ballot a Discuss f= or the reasons listed in this email, to hold the document in IESG Evaluatio= n.

Thanks, all, for your input, and we'll work through this= , too.

Spencer, as responsible Area Director

--94eb2c0815520ecce4053f2b46db-- From nobody Thu Oct 27 17:15:04 2016 Return-Path: X-Original-To: tram@ietf.org Delivered-To: tram@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id F249012943C; Thu, 27 Oct 2016 17:14:57 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.36.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147761369798.24618.13761113495680750148.idtracker@ietfa.amsl.com> Date: Thu, 27 Oct 2016 17:14:57 -0700 Archived-At: Cc: tram@ietf.org Subject: [tram] I-D Action: draft-ietf-tram-stun-pmtud-03.txt X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Oct 2016 00:14:59 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the TURN Revised and Modernized of the IETF. Title : Path MTU Discovery Using Session Traversal Utilities for NAT (STUN) Authors : Marc Petit-Huguenin Gonzalo Salgueiro Filename : draft-ietf-tram-stun-pmtud-03.txt Pages : 15 Date : 2016-10-27 Abstract: This document describes a Session Traversal Utilities for NAT (STUN) Usage for Path MTU Discovery (PMTUD) between a client and a server. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tram-stun-pmtud/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tram-stun-pmtud-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tram-stun-pmtud-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Oct 27 18:13:27 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CC301294BD for ; Thu, 27 Oct 2016 18:13:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.952 X-Spam-Level: X-Spam-Status: No, score=-14.952 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K6XuRa1ZFIlk for ; Thu, 27 Oct 2016 18:13:25 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4C7D129440 for ; Thu, 27 Oct 2016 18:13:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8910; q=dns/txt; s=iport; t=1477617204; x=1478826804; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=h12OmtHyNZiLJfcaPLYyPSFNrcEJwyxSYkXLpc3W9Qk=; b=HfuAwlO7hROjLT/LJx2mVVLfa4xD6wJQZ1czgjMcubJOn7CUpuYYYcYj viHTCg52z2ccZ90g8CLnGyL2fSHxFYKTOdhtzKpx+DXErv/7tgcWo1Hod KrS6qml1nqJzzpOwozKHvQW1kYj2eNPHSO2yhZ/YwqG7YrVk0rfyUbAq0 g=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AaAQCTpRJY/4wNJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgyoBAQEBAR1YbRAHjS+WfpQ/ggcdC4V7AhqBZz8UAQIBAQEBAQE?= =?us-ascii?q?BYiiEYgEBAQMBAQEBIBEzBwsFCwIBCBgCAiYCAgIlCxUQAQEEDgWITAgOsU2Me?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBAQEBARcFgQeFNoF9CIJQhBkRAQYWgwQsgi8FlDi?= =?us-ascii?q?FXgGGLIMIhm6BboRtiAKBJ40LhAABHjZfgxscgVJyAQEBhW6BIIEJAQEB?= X-IronPort-AV: E=Sophos;i="5.31,406,1473120000"; d="scan'208";a="167650130" Received: from alln-core-7.cisco.com ([173.36.13.140]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 28 Oct 2016 01:13:24 +0000 Received: from XCH-RCD-020.cisco.com (xch-rcd-020.cisco.com [173.37.102.30]) by alln-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id u9S1DNiS025166 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Fri, 28 Oct 2016 01:13:23 GMT Received: from xch-aln-009.cisco.com (173.36.7.19) by XCH-RCD-020.cisco.com (173.37.102.30) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 27 Oct 2016 20:13:22 -0500 Received: from xch-aln-009.cisco.com ([173.36.7.19]) by XCH-ALN-009.cisco.com ([173.36.7.19]) with mapi id 15.00.1210.000; Thu, 27 Oct 2016 20:13:22 -0500 From: "Gonzalo Salgueiro (gsalguei)" To: "Tirumaleswar Reddy (tireddy)" Thread-Topic: [tram] Review of draft-ietf-tram-stun-pmtud-02 Thread-Index: AdHwWlrSIFhNo2FmSx+I6/nnmmONpRAiAcOA Date: Fri, 28 Oct 2016 01:13:22 +0000 Message-ID: <7759E420-156A-429B-9310-84135FA79D5A@cisco.com> References: <251036f13c0f4415b06c31c5de39a9d3@XCH-RCD-017.cisco.com> In-Reply-To: <251036f13c0f4415b06c31c5de39a9d3@XCH-RCD-017.cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.157.215] Content-Type: text/plain; charset="utf-8" Content-ID: <3FA7523948CC67438AE9A302DD3E1E59@emea.cisco.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "tram@ietf.org" Subject: Re: [tram] Review of draft-ietf-tram-stun-pmtud-02 X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Oct 2016 01:13:27 -0000 SGkgVGlydSAtIA0KDQpUaGFua3MgZm9yIHRoZSByZXZpZXcuICBTb3JyeSBmb3IgdGhlIGRlbGF5 ZWQgcmVzcG9uc2UgYnV0IGp1c3Qgbm93IGdldHRpbmcgYXJvdW5kIHRvIHByb2Nlc3NpbmcgeW91 ciBlbWFpbC4gIFJlc3BvbnNlcyBpbmxpbmUuLi4NCg0KPiBPbiBBdWcgNiwgMjAxNiwgYXQgODoy OSBQTSwgVGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5KSA8dGlyZWRkeUBjaXNjby5jb20+IHdy b3RlOg0KPiANCj4gQ29tbWVudHMNCj4gIA0KPiAxKQ0KPiAgDQo+ICAgIEEgVFVSTiBjbGllbnQg c3VwcG9ydGluZyB0aGlzIFNUVU4gdXNhZ2Ugd2lsbCBhZGQgYSBQTVRVRC1TVVBQT1JURUQNCj4g ICAgYXR0cmlidXRlIHRvIHRoZSBBbGxvY2F0ZSBSZXF1ZXN0IHNlbnQgdG8gdGhlIFRVUk4gc2Vy dmVyLiAgVGhlIFRVUk4NCj4gICAgc2VydmVyIGNhbiBpbW1lZGlhdGVseSBzdGFydCB0byBzZW5k IHByb2JlcyB0byB0aGUgVFVSTiBjbGllbnQgb24NCj4gICAgcmVjZXB0aW9uIG9mIGFuIEFsbG9j YXRpb24gUmVxdWVzdCB3aXRoIGEgUE1UVUQtU1VQUE9SVEVEIGF0dHJpYnV0ZS4NCj4gICAgVGhl IFRVUk4gY2xpZW50IHdpbGwgdGhlbiB1c2UgdGhlIEltcGxpY2l0IE1lY2hhbmlzbSBkZXNjcmli ZWQgYWJvdmUNCj4gICAgdG8gc2VuZCBwcm9iZXMuDQo+ICANCj4gQ29tbWVudD4gVGhlIGFib3Zl IG1lY2hhbmlzbSBjYW4gYmUgdXNlZCBieSBhdHRhY2tzIHRvIGxhdW5jaCBhbXBsaWZpY2F0aW9u IGF0dGFjayAoanVzdCBsaWtlIGluIEROUy1vdmVyLVVEUCkuDQoNClllcywgeW91IGFyZSByaWdo dC4gIFdlIGhhdmUgcHVibGlzaGVkIGEgbmV3IHZlcnNpb24gdGhhdCBhZGRyZXNzZXMgdGhpcyBj b25jZXJuIGJ5IG1ha2luZyBhdXRoZW50aWNhdGlvbiBtYW5kYXRvcnkgZm9yIGFueSBtZWNoYW5p c20gdGhhdCBjYXJyaWVzIHRoZSBQTVRVRC1TVVBQT1JURUQgYXR0cmlidXRlLiBQbGVhc2UgaGF2 ZSBhIGxvb2sgYXQgdGhlIG5ldyB2ZXJzaW9uIHRvIGVuc3VyZSB5b3UgYXJlIHNhdGlzZmllZCB3 aXRoIHRoZSBhcHByb2FjaC4NCiAgICAgICAgDQo+IDIpDQo+ICANCj4gICAgQW4gSUNFIFtSRkM1 MjQ1XSBjbGllbnQgc3VwcG9ydGluZyB0aGlzIFNUVU4gdXNhZ2Ugd2lsbCBhZGQgYSBQTVRVRC0N Cj4gICAgU1VQUE9SVEVEIGF0dHJpYnV0ZSB0byB0aGUgQmluZGluZyBSZXF1ZXN0IHNlbnQgZHVy aW5nIGEgY29ubmVjdGl2aXR5DQo+ICAgIGNoZWNrLiAgVGhlIElDRSBzZXJ2ZXIgY2FuIGltbWVk aWF0ZWx5IHN0YXJ0IHRvIHNlbmQgcHJvYmVzIHRvIHRoZQ0KPiAgICBJQ0UgY2xpZW50IG9uIHJl Y2VwdGlvbiBvZiBhIEJpbmRpbmcgUmVxdWVzdCB3aXRoIGEgUE1UVUQtU1VQUE9SVEVEDQo+ICAg IGF0dHJpYnV0ZWQuICBMb2NhbCBjYW5kaWRhdGVzIHJlY2VpdmluZyBCaW5kaW5nIFJlcXVlc3Qg d2l0aCB0aGUNCj4gICAgUE1UVUQtU1VQUE9SVEVEIGZsYWcgbXVzdCBub3Qgc3RhcnQgUE1UVUQg d2l0aCB0aGUgcmVtb3RlIGNhbmRpZGF0ZQ0KPiAgICBpZiBhbHJlYWR5IGRvbmUgc28uICBUaGUg SUNFIGNsaWVudCB3aWxsIHRoZW4gdXNlIHRoZSBJbXBsaWNpdA0KPiAgICBNZWNoYW5pc20gZGVz Y3JpYmVkIGFib3ZlIHRvIHNlbmQgcHJvYmVzLg0KPiAgDQo+IENvbW1lbnRzPiANCj4gYSkgV2hh dCBpcyB0aGUgbmVlZCB0byBpbW1lZGlhdGVseSBzZW5kIHByb2JlcyA/DQoNClRoZSBuZXcgdmVy c2lvbiByZW1vdmVzIGFsbCBvZiB0aGUgSUNFIHRleHQuICBXZSB3aWxsIGhhbmRsZSB0aGUgSUNF IHVzZS1jYXNlIGluIGEgc2VwYXJhdGUgZHJhZnQgdGhhdCB3ZSB3aWxsIHB1Ymxpc2ggc2hvcnRs eSBpbiB0aGUgSUNFIFdHLg0KDQo+IGIpIFdoeSBub3Qgd2FpdCB1bnRpbCB0aGUgSUNFIG5vbWlu YXRpb24gaXMgY29tcGxldGUgb3IgdW50aWwgdGhlIHBhaXIgc3RhdGUgaXMgY2hhbmdlZCB0byBT dWNjZWVkZWQgPw0KDQpTZWUgYWJvdmUuDQoNCj4gYykgU0NUUCBhbHNvIGhhcyBwcm9iaW5nIGRp c2N1c3NlZCBpbiBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNDgyMSNzZWN0aW9uLTEw LjIsIHdoeSBjYW4ndCBpdCBiZSB1c2VkDQo+ICAgIChpZiBtZWRpYS9kYXRhIGNoYW5uZWwgYXJl IG11bHRpcGxleGVkIG9uIHRoZSBzYW1lIHBvcnQpID8NCg0KV2UgaGF2ZSBtYWRlIGl0IGV4cGxp Y2l0IGluIHRoZSBuZXcgdmVyc2lvbiB0aGF0IHRoaXMgc3BlY2lmaWNhdGlvbiBpcyBub3QgbWVh bnQgdG8gcmVwbGFjZSBleGlzdGluZyBQTVRVRCBtZWNoYW5pc21zLiAgSWYgdGhlcmUgaXMgYW4g U0NUUCB1c2UgY2FzZSB0aGVuIHRoZSBQTVRVRCBtZWNoYW5pc20gZGVzY3JpYmVkIGluIFNlY3Rp b24gMTAuMiBvZiBSRkMgNDgyMSBjYW4gYmUgdXNlZC4NCg0KPiBkKSBJZiBEVExTIGlzIHVzZWQs IHBhdGggZGlzY292ZXJ5IGNhbiBoYXBwZW4gYWZ0ZXIgRFRMUyBoYW5kc2hha2UgaXMgY29tcGxl dGUNCj4gICAgKHNlZSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjM0NyNzZWN0aW9u LTQuMS4xLjEpDQoNClllcywgYWdyZWVkLiBUaGlzIHNwZWNpZmljYXRpb24gaXMgd3JpdHRlbiB0 byBiZSBpbmRlcGVuZGVudCBvZiBEVExTLCBzbyB0aGVyZSBzaG91bGQgbm8gaW1wYWN0IHRvIHRo ZSB0ZXh0Lg0KIA0KPiAzKQ0KPiAgDQo+ICAgIEEgY2xpZW50IE1VU1QgTk9UIHNlbmQgYSBwcm9i ZSBpZiBpdCBkb2VzIG5vdCBoYXZlIGtub3dsZWRnZSB0aGF0IHRoZQ0KPiAgICBzZXJ2ZXIgc3Vw cG9ydHMgdGhpcyBzcGVjaWZpY2F0aW9uLiAgVGhpcyBpcyBkb25lIGJ5IGFuIGV4dGVybmFsDQo+ ICAgIG1lY2hhbmlzbSBzcGVjaWZpYyB0byBlYWNoIFVEUCBwcm90b2NvbC4gIFNlY3Rpb24gNiBk ZXNjcmliZXMgc29tZSBvZg0KPiAgICB0aGlzIG1lY2hhbmlzbXMuDQo+ICANCj4gQ29tbWVudHM+ IFdoYXQgaWYgbWFuLWluLW1pZGRsZSBhdHRhY2tlciBjaGFuZ2VzIHRoZSByZXF1ZXN0IHRvIGFk ZCBQTVRVRC1TVVBQT1JURUQgPw0KDQpBbnkgcmVxdWVzdCB0aGF0IGNvbnRhaW5zIFBNVFVELVNV UFBPUlRFRCBpcyBub3cgYXV0aGVudGljYXRlZCAoaW4gdGhlIG5ldyB2ZXJzaW9uIG9mIHRoaXMg c3BlY2lmaWNhdGlvbikuDQoNCj4gNCkgVGhlcmUgYXJlIHR3byBtZWNoYW5pc21zIGZvciBwcm9i aW5nLCB3aHkgY2FuJ3Qgd2UgaGF2ZSBqdXN0IG9uZSA/DQoNClRoZSBjb21wbGV0ZSBwcm9iaW5n IG1lY2hhbmlzbSBpcyB0aGUgb25lIHRoYXQgZnVsbHkgaW1wbGVtZW50cyBSRkMgNDgyMS4gIFdl IGFkZGVkIGEgc2ltcGxlIHByb2JpbmcgbWVjaGFuaXNtIGZvciBjYXNlcyB0aGF0IGRvIG5vdCBy ZXF1aXJlIHRoaXMgY29tcGxleGl0eS4gICANCg0KDQo+ICAgICAgU2hvdWxkIGJvdGggcHJvYmlu ZyBtZWNoYW5pc21zIGJlIGltcGxlbWVudGVkID8gDQoNClRoZSBuZXcgdmVyc2lvbiBvZiB0aGUg c3BlY2lmaWNhdGlvbiBzdGF0ZXM6ICJJbXBsZW1lbnRhdGlvbnMgc3VwcG9ydGluZyB0aGlzIHNw ZWNpZmljYXRpb24gTVVTVCBpbXBsZW1lbnQgdGhlIHNlcnZlciBzaWRlIG9mIGJvdGggdGhlIFNp bXBsZSBQcm9iaW5nIG1lY2hhbmlzbSAoU2VjdGlvbiA0LjEpIGFuZCB0aGUgQ29tcGxldGUgUHJv YmluZyBtZWNoYW5pc20gKFNlY3Rpb24gNC4yKS4gIEltcGxlbWVudGF0aW9ucyBzdXBwb3J0aW5n IHRoaXMgc3BlY2lmaWNhdGlvbiBNVVNUIGltcGxlbWVudCB0aGUgY2xpZW50IHNpZGUgb2YgdGhl IENvbXBsZXRlIFByb2JpbmcgbWVjaGFuaXNtLiAgVGhleSBNQVkgaW1wbGVtZW50IHRoZSBjbGll bnQgc2lkZSBvZiB0aGUgU2ltcGxlIFByb2JpbmcgbWVjaGFuaXNtLuKAnQ0KDQo+ICAgICAgSSB0 aGluayBhIGd1aWRhbmNlL3JlY29tbWVuZGF0aW9uIHNlY3Rpb24gd2lsbCBoZWxwIHNlbGVjdCB0 aGUgYXBwcm9wcmlhdGUgcHJvYmluZyBtZWNoYW5pc20uDQoNCldlIGFkZGVkIGEgbmV3IHNlY3Rp b24g4oCcT3ZlcnZpZXcgb2YgT3BlcmF0aW9uc+KAnSBkZXNjcmliaW5nIHRoZSBhZGRlZCBQTVRV RCBjYXBhYmlsaXRpZXMuICBBZGRpdGlvbmFsbHksIHdlIGhhdmUgYWRkZWQgY2xhcmlmeWluZyB0 ZXh0IGJlaW5nIHZlcnkgcHJlc2NyaXB0aXZlIGFib3V0IHdoaWNoIHByb2JpbmcgbWVjaGFuaXNt cyBhcmUgTVRJLg0KDQo+ICA1KSBTYW1lIGNvbW1lbnQgYXMgYWJvdmUgZm9yIHBhY2tldCBpZGVu dGlmaWVyIG1lY2hhbmlzbXMuDQoNCldlIGludGVudGlvbmFsbHkgZGlkIG5vdCBwcm92aWRlIGV4 cGxpY2l0IGd1aWRhbmNlIG9uIHdoaWNoIHBhY2tldCBpZGVudGlmaWNhdGlvbiBtZWNoYW5pc20g dG8gdXNlIGJlY2F1c2UgaXQgaXMgcHJvdG9jb2wgZGVwZW5kZW50LiAgV2Ugc2ltcGx5IHByb3Zp ZGUgdHdvIHBvc3NpYmxlIHBhY2tldCBpZGVudGlmaWNhdGlvbiBtZWNoYW5pc21zIHRvIGhlbHAg aW1wbGVtZW50b3JzLg0KDQo+ICA2KSBXaGF0IGlmIHRoZSBhdHRhY2tlciBjaGFuZ2VzIHRoZSBy ZXBvcnQgcmVzcG9uc2UgZnJvbSB0aGUgc2VydmVyID8NCj4gICAgIChJIHRoaW5rIHlvdSBzaG91 bGQgbWFuZGF0ZSBhdXRoZW50aWNhdGlvbi9EVExTKS4NCg0KQXV0aGVudGljYXRpb24gaXMgbm93 IG1hbmRhdG9yeSBmb3IgdGhlIHJlcG9ydCB0cmFuc2FjdGlvbiBpbiB0aGUgY29tcGxldGUgcHJv YmluZyBtZWNoYW5pc20uDQoNCj4gIDcpIFRoZSBjbGllbnQgU0hPVUxEIHN0b3AgcmV0cmFuc21p dHRpbmcgYWZ0ZXIgMyBtaXNzaW5nIHJlc3BvbnNlcy4NCj4gIA0KPiBjb21tZW50cz4gDQo+IGEp V2h5IDMgd2hlbiBTVFVOIHVzZXMgYnkgNyBieSBkZWZhdWx0ID8NCg0KV2UgdXNlIDMgc2ltcGx5 IHRvIGdldCBhIHJlc3BvbnNlIGZhc3Rlci4gIFRoaXMgaXMgc2ltaWxhciB0byBzb21lIG9mIHRo ZSBkaXNjdXNzaW9ucyBoYXBwZW5pbmcgaW4gdGhlIElDRSBXRyBhYm91dCByZWR1Y2luZyB0aGUg bnVtYmVyIG9mIHJldHJhbnNtaXNzaW9ucyBmb3IgY2VydGFpbiB1c2FnZXMuDQoNCj4gYilJIGRv bid0IHNlZSBhbnkgZGlzY3Vzc2lvbiBvbiBwYWNpbmcgYi93IHJldHJhbnNtaXNzaW9ucy4NCg0K V2UgdXNlIHRoZSBzYW1lIHBhY2luZyBhcyBpbiBSRkMgNTM4OS4gIFdl4oCZdmUgYWRkZWQgdGV4 dCBpbmRpY2F0aW5nIHRoYXQgdGhlIGluaXRpYWwgdmFsdWUgZm9yIFJUTyBzdGF5cyBhdCA1MDAg bXMuDQoNCj4gIDgpIFNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIG5lZWRzIHRvIGRpc2N1c3MgdGhy ZWF0cyBpbiB0aGUgYWJvdmUgY29tbWVudHMuDQoNCldl4oCZdmUgYWRkZWQgcmVsYXRlZCB0ZXh0 IHRvIHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9uIHNlY3Rpb24uDQoNCj4gIDkpIFNlY3Rpb24g NS41LCBVc2luZyBDaGVja3N1bSBhcyBQYWNrZXQgSWRlbnRpZmllcnMNCj4gIA0KPiBXaGVuIHVz aW5nIGNoZWNrc3VtIGFzIHBhY2tldCBpZGVudGlmaWVycywgdGhlIGNsaWVudCBjYWxjdWxhdGUg dGhlDQo+IGNoZWNrc3VtIGZvciBlYWNoIHBhY2tldCBzZW50IG92ZXIgVURQIGFuZCBrZWVwIHRo aXMgY2hlY2tzdW0gaW4gYW4NCj4gb3JkZXJlZCBsaXN0LiAgVGhlIHNlcnZlciBkb2VzIHRoZSBz YW1lIHRoaW5nIGFuZCBzZW5kIGJhY2sgdGhpcyBsaXN0DQo+IGluIHRoZSBSZXBvcnQgUmVzcG9u c2UuDQo+ICANCj4gQ29tbWVudD4gDQo+IGEpICAgICAgIHdoYXQgaWYgdGhlIHBhY2tldHMgYXJy aXZlIG91dC1vZi1vcmRlciBhdCB0aGUgc2VydmVyID8NCg0KVGhleSBjZXJ0YWlubHkgY2FuIGFy cml2ZSBvdXQgb2Ygb3JkZXIgYW5kIHRoaXMgd2lsbCBiZSByZWZsZWN0ZWQgaW4gdGhlIGNvbnRl bnRzIG9mIHRoZSBSZXBvcnQgUmVzcG9uc2UuIFdl4oCZdmUgdHJpZWQgdG8gYWRkIGNsYXJpZnlp bmcgdGV4dCBtYWtpbmcgdGhpcyBjbGVhci4NCg0KPiBiKSAgICAgIHdoYXQgaXMgdGhlIGZvcm1h dCBvZiB0aGUgcmVwb3J0IHJlc3BvbnNlID8NCg0KV2UgaGF2ZSB0ZXh0IGluIHRoZXJlIGluZGlj YXRpbmcgdGhhdCB0aGUgc2VydmVyIGNyZWF0ZXMgYSBSZXBvcnQgUmVzcG9uc2UgYW5kIGFkZHMg YW4gSURFTlRJRklFUlMgYXR0cmlidXRlIHRoYXQgY29udGFpbnMgdGhlIGxpc3Qgb2YgYWxsIGlk ZW50aWZpZXJzIHJlY2VpdmVkIHNvIGZhci4gIA0KDQo+IGMpICAgICAgIFdoYXQgaXMgdGhlIGZv cm1hdCBvZiB0aGUgbmV3IGF0dHJpYnV0ZXMgZGVmaW5lZCBpbiB0aGlzIGRvY3VtZW50ID8NCg0K V2UgaGF2ZSBhZGRlZCBhIG5ldyBzZWN0aW9uIGRlc2NyaWJpbmcgdGhlIGZvcm1hdCBvZiB0aGUg bmV3IGF0dHJpYnV0ZXMuDQoNClBsZWFzZSByZXZpZXcgdGhlIG5ldyB2ZXJzaW9uIHRvIGVuc3Vy ZSB0aGF0IGFsbCB5b3VyIGNvbW1lbnRzIGFyZSBhZGRyZXNzZWQgdG8geW91ciBzYXRpc2ZhY3Rp b24uDQoNCkNoZWVycywNCg0KR29uemFsbw0KDQoNCj4gIA0KPiAtVGlydQ0KPiBfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiB0cmFtIG1haWxpbmcgbGlz dA0KPiB0cmFtQGlldGYub3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdHJhbQ0KDQo= From nobody Thu Oct 27 18:35:02 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5C7A129440 for ; Thu, 27 Oct 2016 18:35:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.952 X-Spam-Level: X-Spam-Status: No, score=-14.952 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V4bd2gwneN1k for ; Thu, 27 Oct 2016 18:34:59 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC3111294E6 for ; Thu, 27 Oct 2016 18:34:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5576; q=dns/txt; s=iport; t=1477618497; x=1478828097; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=DQaGoJtYXIGsnzY2poobHl3fPjv40vMtmsjwK2oLjN0=; b=GKeAoPEFXafh11TGe9xnbm4fL36gGObKLbosw6RnIg+PCdI2ppZKUd64 YFATccdJ84h8/yeWcNsCo6IAasj3NACvFyYrm4lRi8yUximRC17O33hc1 D9B0M4Vkg4miXdyW7auk5VIkOOzUh4RDVWqEV5Sy0M/5Jl77UOEiDfnmv s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B0AQA3qhJY/4MNJK1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgyoBAQEBAR1YbRAHjS+WfpQ/ggcdC4V7AhqBZj8UAQIBAQEBAQEBYii?= =?us-ascii?q?EYgEBAQMBAQEBIBE6CwULAgEIGAICJgICAiULFRACBA4FiEwIDrFMjHkBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEXBYEHhTaBfQiCUIQZEQEGFoMELIIvBZQjFYVeAYY?= =?us-ascii?q?siXaBboRthD+DQ4EnjQuEAAEeNl+FCXKFcYEggQkBAQE?= X-IronPort-AV: E=Sophos;i="5.31,406,1473120000"; d="scan'208";a="162845309" Received: from alln-core-1.cisco.com ([173.36.13.131]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 28 Oct 2016 01:34:56 +0000 Received: from XCH-ALN-018.cisco.com (xch-aln-018.cisco.com [173.36.7.28]) by alln-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id u9S1YuQk020953 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Fri, 28 Oct 2016 01:34:56 GMT Received: from xch-aln-009.cisco.com (173.36.7.19) by XCH-ALN-018.cisco.com (173.36.7.28) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 27 Oct 2016 20:34:56 -0500 Received: from xch-aln-009.cisco.com ([173.36.7.19]) by XCH-ALN-009.cisco.com ([173.36.7.19]) with mapi id 15.00.1210.000; Thu, 27 Oct 2016 20:34:56 -0500 From: "Gonzalo Salgueiro (gsalguei)" To: "Ram Mohan R (rmohanr)" Thread-Topic: [tram] Review of draft-ietf-tram-stun-pmtud-02 Thread-Index: AQHR8TEJIFhNo2FmSx+I6/nnmmONpaC96GcA Date: Fri, 28 Oct 2016 01:34:55 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.157.215] Content-Type: text/plain; charset="utf-8" Content-ID: <43A8E1C1364E0C479142D8B72582A0E2@emea.cisco.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "tram@ietf.org" Subject: Re: [tram] Review of draft-ietf-tram-stun-pmtud-02 X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Oct 2016 01:35:01 -0000 SGkgUmFtIC0gDQoNClRoYW5rcyBmb3IgdGhlIHJldmlldy4gIFNvcnJ5IGZvciB0aGUgZGVsYXll ZCByZXNwb25zZSBidXQganVzdCBub3cgZ2V0dGluZyBhcm91bmQgdG8gcHJvY2Vzc2luZyB5b3Vy IGVtYWlsLiAgUmVzcG9uc2VzIGlubGluZeKApg0KDQo+IE9uIEF1ZyA3LCAyMDE2LCBhdCA5OjU1 IFBNLCBSYW0gTW9oYW4gUiAocm1vaGFucikgPHJtb2hhbnJAY2lzY28uY29tPiB3cm90ZToNCj4g DQo+IEhlcmUgaXMgbXkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtdHJhbS1zdHVuLXBtdHVkIGRyYWZ0 Lg0KPiANCj4gQ29tbWVudHM6DQo+IA0KPiAxKVdoYXQgaXMgYmVoYXZpb3Igb2YgbWlkZGxlIGJv eGVzIGxpa2UgQjJCVUFzICh0aGF0IG1heSBiZSBtZWRpYSBhd2FyZQ0KPiByZWxheSBvciBzaW1w bGUgbWVkaWEgcmVsYXkgYXMgZGVzY3JpYmVkIGluIHNlY3Rpb24gNCBvZg0KPiBodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvcmZjNzU4NCkNCj4gd2hlbiBoYW5kbGluZyBwYXRoTVRVRCBTVFVO IG1lc3NhZ2VzID8NCg0KVGhlIGF1dGhvcnMgZmVsdCB0aGVyZSB3YXNu4oCZdCBhbnkgQjJCVUEt c3BlY2lmYyBiZWhhdmlvciB0aGF0IG5lZWRlZCB0byBiZSBzcGVjaWZpY2FsbHkgY2FsbGVkIG91 dCBhcyBwYXJ0IG9mIHRoaXMgc3BlY2lmaWNhdGlvbi4gRG8geW91IGhhdmUgc29tZXRoaW5nIHNw ZWNpZmljIGluIG1pbmQ/ICBJZiBzbywgY291bGQgeW91IHByb3Bvc2Ugc3BlY2lmaWMgdGV4dCB0 aGF0IHdlIHNob3VsZCBhZGQ/DQoNCj4gMikgSSBhbHNvIGFncmVlIHRvIHNvbWUgb2YgdGhlIHNl Y3VyaXR5IGNvbmNlcm5zIHJhaXNlZCBieSBUaXJ1IGluIHRoZQ0KPiBsaXN0LiBFc3BlY2lhbGx5 IG9uIGhvdyB3ZSBjYW4gYXZvaWQvZGV0ZWN0IHdoZW4gc29tZSBvbmUgaXMgdXNpbmcgdGhlDQo+ IG1lY2hhbmlzbSBkZXNjcmliZWQgaW4gdGhpcyBkcmFmdCBmb3IgbWVjaGFuaXNtICB0byBsYXVu Y2ggYW1wbGlmaWNhdGlvbg0KPiBhdHRhY2sgb3IgbWFuLWluLXRoZS1taWRkbGUgYXR0YWNrcy4N Cg0KV2UgaGF2ZSByZXNwb25kZWQgdG8gVGlydSBvbiBhbGwgaGlzIHBvaW50cy4gUGxlYXNlIGhh dmUgYSBsb29rIGF0IHRoYXQgcmVzcG9uc2UgZm9yIG1vcmUgZGV0YWlscy4NCg0KPiAzKVNlY3Rp b24gNCw1IHNheXMgc2VydmVyIE1VU1QgTk9UIGF1dGhlbnRpY2F0ZS9jaGFsbGVuZ2UgY2xpZW50 LiBXaHkgaXMNCj4gYXV0aGVudGljYXRpb24gbm90IHJlY29tbWVuZGVkIGhlcmUgPyBJZiBwYXRo IE1UVUQgaXMgYmVpbmcgdXNlZCBiZXR3ZWVuDQo+IElDRSBwZWVycywgb3IgYSBTVFVOIGNsaWVu dC9TZXJ2ZXIgdGhleSBhcmUgbGlrZWx5IHRvIGhhdmUgc2hhcmVkIHNlY3JldA0KPiBhbHJlYWR5 IChzaG9ydC10ZXJtIG9yIGxvbmctdGVybSBjcmVkZW50aWFscykuIFNob3VsZCB3ZSBub3QgdXNl IHRoZQ0KPiBleGlzdGluZyBTVFVOIGF1dGhlbnRpY2F0aW9uIHByb2NlZHVyZXMgaGVyZSBhcyB3 ZWxsID8NCg0KWWVzLCBhdXRoZW50aWNhdGlvbiBpcyBub3cgbWFuZGF0b3J5IGZvciBjb21wbGV0 ZSBwcm9iaW5nIG1lY2hhbmlzbS4gIEFsc28sIHRoZSBJQ0UgdXNhZ2UgaGFzIGJlZW4gZW50aXJl bHkgcmVtb3ZlZCBmcm9tIHRoZSBzcGVjaWZpY2F0aW9uIGFuZCB3aWxsIGJlIGRlZmluZWQgaW4g YSBuZXcgc2VwYXJhdGUgZHJhZnQuDQoNCj4gNCkgU2VjdGlvbiA2IHRhbGtzIGFib3V0IGRpZmZl cmVudCBtZWNoYW5pc21zIGZvciBpbmRpY2F0aW5nIHN1cHBvcnQgZm9yDQo+IHN1cHBvcnRpbmcg dGhlIHBtdHVkIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGJ5IG1lYW5zIG9mIGhhdmluZw0K PiBQTVRVRC1TVVBQT1JURUQgYXR0cmlidXRlIGluIFNUVU4vVFVSTiBtZXNzYWdlcy4gSG93IGRv ZXMgdGhlDQo+IHNlcnZlci9jbGllbnQga25vdyBpdCBpcyB1c2luZyBzaW1wbGUgb3IgY29tcGxl dGUgcHJvYmUgbWVjaGFuaXNtcyA/IElzIGl0DQo+IG9ubHkgYnkgbG9va2luZyBhdCB0aGUgc2Vx dWVuY2Ugb2YgbWVzc2FnZXMgPw0KDQpCb3RoIHNpbXBsZSBhbmQgY29tcGxldGUgcHJvYmluZyBt ZWNoYW5pc21zIGFyZSBNVEkgb24gdGhlIHNlcnZlciBzaWRlLCBzbyB0aGUgY2xpZW50IHRoYXQg cmVjZWl2ZXMgdGhlIFBNVFVELVNVUFBPUlRFRCBhdHRyaWJ1dGUgY2FuIGluaXRpYXRlIGVpdGhl ciBvbmUuDQoNCj4gNSlXb3VsZCBwbXR1ZCBwcm9iZXMgYmUgZG9uZSBvbmx5IG9uY2Ugd2hlbiB0 aGUgNS10dXBsZSBmb3Igc2VuZGluZyBkYXRhDQo+IGlzIHNldHVwIChhcyBwYXJ0IG9mIElDRSBj aGVja3MsIFRVUk4pID8gT3Igd291bGQgdGhlIHByb2JlcyBkb25lDQo+IHBlcmlvZGljYWxseSBk dXJpbmcgYSBzZXNzaW9uID8gSWYgZG9uZSBwZXJpb2RpY2FsbHkgaXQgd291bGQgYmUgZ29vZCB0 bw0KPiBhZGQgaG93IHRoaXMgd291bGQgaW50ZXJhY3Qgd2l0aCBDb25zZW50IGZyZXNobmVzcyBT VFVOIG1lc3NhZ2VzLg0KDQpUaGlzIGlzIGEgZ29vZCBxdWVzdGlvbiBidXQgdGhlIElDRSB0ZXh0 IHdhcyBpbnRlbnRpb25hbGx5IHJlbW92ZWQgZnJvbSB0aGlzIGRyYWZ0LiAgV2Ugd2lsbCBjb25z aWRlciB0aGlzIHdoZW4gZGVmaW5pbmcgdGhlIElDRSBQTVRVRCB1c2FnZSBkcmFmdC4NCg0KPiBN aW5vciBjb21tZW50czoNCj4gMSkgV291bGQgYmUgZ29vZCB0byByZWZlciB0aGUgUkZDIChyZmM1 NzgwKSB0aGF0IGRlZmluZXMgdGhlIFNUVU4gUEFERElORw0KPiBhdHRyaWJ1dGUgYXMgeW91IGFy ZSB1c2luZyB0aGF0IGluIHRoaXMgZG9jdW1lbnQNCg0KRG9uZS4NCg0KPiAyKVNlY3Rpb24gNi4y IHNob3VsZCBiZSBhcHBsaWNhYmxlIGZvciBhbnkgU1RVTiBjbGllbnQgKG5vdCBmb3Igb25seSBU VVJODQo+IGNsaWVudCkgaW50ZXJhY3Rpbmcgd2l0aCBTVFVOIHNlcnZlci4gSW4gY2FzZSBvZiBU VVJOIGNsaWVudC9zZXJ2ZXIgaXQNCj4gd2lsbCBiZSBpbmRpY2F0ZWQgaW4gQUxMT0NBVEUgcmVx dWVzdCBhcyBtZW50aW9uZWQgaW4gZHJhZnQuIEluIGNhc2Ugb2YNCj4gU1RVTiBjbGllbnQvU2Vy dmVyIGl0IHdpbGwgYmUgQmluZFJlcXVlc3QgZnJvbSBjbGllbnQgdG8gU2VydmVyLg0KDQpUaGUg VFVSTiB1c2FnZSBoYXMgYmVlbiBlbnRpcmVseSByZW1vdmVkIGZvcm0gdGhpcyBkcmFmdC4gIEFs c28sIGJlYXIgaW4gbWluZCB0aGF0IHRoZXJlIGlzIG5vIHJlYWwgcHJhY3RpY2FsIHVzZSBmb3Ig YSBUVVJOLWJhc2VkIFBNVFVEIG1lY2hhbmlzbSBiZWNhdXNlIGl0IGlzIG5vdCBlbmQtdG8tZW5k Lg0KDQo+IDMpV291bGQgYmUgZ29vZCB0byBoYXZlIGxhZGRlciBkaWFncmFtcyBzaG93aW5nIHRo ZSBtZXNzYWdlIGZsb3dzIGZvciBib3RoDQo+IHNpbXBsZSBhbmQgY29tcGxldGUgcHJvYmluZyBt ZWNoYW5pc21zLg0KDQpEb25lLiBUaGVzZSBjYW4gYmUgZm91bmQgaW4gdGhlIG5ldyBPdmVydmll dyBvZiBPcGVyYXRpb25zIHNlY3Rpb24gdGhhdCB3YXMgYWRkZWQgKFNlY3Rpb24gMikuDQoNCj4g NClXaHkgaXMgSURFTlRJRklFUlMgU1RVTiBhdHRyaWJ1dGUgbWFkZSBhcyBjb21wcmVoZW5zaXZl LXJlcXVpcmVkIHN0dW4NCj4gYXR0cmlidXRlID8gVGhhdCB3b3VsZCByZXF1aXJlIGFsbCBTVFVO IGFnZW50cyB0byBwcm9jZXNzIHRoYXQgYXR0cmlidXRlDQo+IGFuZCBjYW5ub3Qgc2FmZWx5IGln bm9yZSBpZiBpdCBkb2VzIG5vdCB1bmRlcnN0YW5kLg0KDQpUaGlzIGF0dHJpYnV0ZSBpcyBvbmx5 IHNlbnQgaW4gdGhlIFJlcG9ydCBSZXNwb25zZSBzbyB0aGUgU1RVTiBhZ2VudHMgTVVTVCBrbm93 IGhvdyB0byBwcm9jZXNzIGl0Lg0KDQpQbGVhc2UgcmV2aWV3IHRoZSBuZXcgdmVyc2lvbiB0byBl bnN1cmUgdGhhdCBhbGwgeW91ciBjb21tZW50cyBhcmUgYWRkcmVzc2VkIHRvIHlvdXIgc2F0aXNm YWN0aW9uLg0KDQpDaGVlcnMsDQoNCkdvbnphbG8NCg0KPiANCj4gUmVnYXJkcywNCj4gUmFtDQo+ IA0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiB0 cmFtIG1haWxpbmcgbGlzdA0KPiB0cmFtQGlldGYub3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vdHJhbQ0KDQo= From nobody Thu Oct 27 18:40:26 2016 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07A7B12956F; Thu, 27 Oct 2016 18:40:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.952 X-Spam-Level: X-Spam-Status: No, score=-14.952 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TUphfubw1Cu4; Thu, 27 Oct 2016 18:40:22 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 805881294FE; Thu, 27 Oct 2016 18:40:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1902; q=dns/txt; s=iport; t=1477618822; x=1478828422; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=0sal6It3Rd4WNjDaBa8Qmywo4FVOajeZGacnaO4qJtQ=; b=YO+lrArW0RvYZLjOHOVSFaI8V3aUdyrUxE3ec5OpLfk0Z2iOhI7dwcKm 6/DVP3YhGlz2k3aSaXJtHLnDzNoHgmMyEF0R7/UfTbRGToYI2vV2SZBR1 hOdv2GkcaCram0kgfo+uvn7gkFLLcuXOMnhOjeupt+MaXz9pdRiW9PcJm s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AZAQDZqxJY/4QNJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgyoBAQEBAR1YfQeNL5Z+lD+CBx0LhXsCggA/FAECAQEBAQEBAWI?= =?us-ascii?q?ohGIBAQEDAQEBATc0CwULAgEIGB4QJwslAgQOBQmIQwgOvkUBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEchj2BfYJYhDEWMoJ+gi8FmhYBhiyJdgqBZE6EH4kpiQuEAIQ?= =?us-ascii?q?AAR42X4UJcgGHEIEJAQEB?= X-IronPort-AV: E=Sophos;i="5.31,406,1473120000"; d="scan'208";a="164816677" Received: from alln-core-10.cisco.com ([173.36.13.132]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 28 Oct 2016 01:40:21 +0000 Received: from XCH-RCD-006.cisco.com (xch-rcd-006.cisco.com [173.37.102.16]) by alln-core-10.cisco.com (8.14.5/8.14.5) with ESMTP id u9S1eLTD008215 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 28 Oct 2016 01:40:21 GMT Received: from xch-aln-009.cisco.com (173.36.7.19) by XCH-RCD-006.cisco.com (173.37.102.16) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 27 Oct 2016 20:40:20 -0500 Received: from xch-aln-009.cisco.com ([173.36.7.19]) by XCH-ALN-009.cisco.com ([173.36.7.19]) with mapi id 15.00.1210.000; Thu, 27 Oct 2016 20:40:20 -0500 From: "Gonzalo Salgueiro (gsalguei)" To: tram mailing list Thread-Topic: I-D Action: draft-ietf-tram-stun-pmtud-03.txt Thread-Index: AQHSMLw+jAGGs7KkskOIvVnobwOKww== Date: Fri, 28 Oct 2016 01:40:20 +0000 Message-ID: References: <147761369798.24618.13761113495680750148.idtracker@ietfa.amsl.com> In-Reply-To: <147761369798.24618.13761113495680750148.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.157.215] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "tram-chairs@ietf.org" , Marc Petit-Huguenin Subject: Re: [tram] I-D Action: draft-ietf-tram-stun-pmtud-03.txt X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Oct 2016 01:40:24 -0000 Hi TRAMsters -=20 This is a new version of the PMTUD draft. It addresses all review comments= from Tiru and Ram. There are currently no remianing open issues. We woul= d greatly appreciate any additional reviews and feedback. Thanks, Gonzalo > On Oct 27, 2016, at 5:14 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts direct= ories. > This draft is a work item of the TURN Revised and Modernized of the IETF. >=20 > Title : Path MTU Discovery Using Session Traversal Utili= ties for NAT (STUN) > Authors : Marc Petit-Huguenin > Gonzalo Salgueiro > Filename : draft-ietf-tram-stun-pmtud-03.txt > Pages : 15 > Date : 2016-10-27 >=20 > Abstract: > This document describes a Session Traversal Utilities for NAT (STUN) > Usage for Path MTU Discovery (PMTUD) between a client and a server. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-tram-stun-pmtud/ >=20 > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-tram-stun-pmtud-03 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-tram-stun-pmtud-03 >=20 >=20 > Please note that it may take a couple of minutes from the time of submiss= ion > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > I-D-Announce mailing list > I-D-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/i-d-announce > Internet-Draft directories: http://www.ietf.org/shadow.html > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt From nobody Sun Oct 30 23:08:13 2016 Return-Path: X-Original-To: tram@ietf.org Delivered-To: tram@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E3648128B38; Sun, 30 Oct 2016 23:08:07 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.36.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147789408792.20625.12025565378176529450.idtracker@ietfa.amsl.com> Date: Sun, 30 Oct 2016 23:08:07 -0700 Archived-At: Cc: tram@ietf.org Subject: [tram] I-D Action: draft-ietf-tram-turnbis-09.txt X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.17 List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Oct 2016 06:08:08 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the TURN Revised and Modernized of the IETF. Title : Traversal Using Relays around NAT (TURN): Relay Extensions to Session Traversal Utilities for NAT (STUN) Authors : Tirumaleswar Reddy Alan Johnston Philip Matthews Jonathan Rosenberg Filename : draft-ietf-tram-turnbis-09.txt Pages : 80 Date : 2016-10-30 Abstract: If a host is located behind a NAT, then in certain situations it can be impossible for that host to communicate directly with other hosts (peers). In these situations, it is necessary for the host to use the services of an intermediate node that acts as a communication relay. This specification defines a protocol, called TURN (Traversal Using Relays around NAT), that allows the host to control the operation of the relay and to exchange packets with its peers using the relay. TURN differs from some other relay control protocols in that it allows a client to communicate with multiple peers using a single relay address. The TURN protocol was designed to be used as part of the ICE (Interactive Connectivity Establishment) approach to NAT traversal, though it also can be used without ICE. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tram-turnbis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tram-turnbis-09 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tram-turnbis-09 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/