From nobody Tue Jan 14 07:12:45 2020 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5125D1200FD for ; Tue, 14 Jan 2020 07:12:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=IrrwLR+X; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=WzRiwBuO Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VvcqY2bbsHPf for ; Tue, 14 Jan 2020 07:12:38 -0800 (PST) Received: from wout5-smtp.messagingengine.com (wout5-smtp.messagingengine.com [64.147.123.21]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC66D120072 for ; Tue, 14 Jan 2020 07:12:38 -0800 (PST) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.west.internal (Postfix) with ESMTP id A23F4471; Tue, 14 Jan 2020 10:12:37 -0500 (EST) Received: from imap4 ([10.202.2.54]) by compute6.internal (MEProxy); Tue, 14 Jan 2020 10:12:37 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:date:from:to:cc:subject:content-type; s=fm3; bh=KNNqKPy8R8Ab8wfm54fRDtLm27gPKoL66U8XmIAoJpM=; b=IrrwL R+XIwoJx27M9Wf14+vDAbPFRHPkUVtQMiyam/qkx89aS7MO9ze/EWNP6yJvF0Fgx PB2lrVRO8EJAJ7uQaH3Xf09pQRAie3bySL4D9IXUrXKonD8TlZxzOZujtpHj9AaR 8ml9WU8PLK82UqItlCfKNCk3SDjn8llEFgcwxaLg47h4vRGXDztXtZBxPR9+/saq cqwKydGmBqolf76B4BQk1SDlA/KhbZA/VZTuCBYBSePCxPM5KZQeorUnRBE3h0bI G8Y+3uuCZVdGKjLmdCjLgmNL0OLGOrZI5fkNnUg+l3A8KJXUdBee/9FhF0X4Ge60 FcyA7MIJ5+CRBhRJQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm1; bh=KNNqKPy8R8Ab8wfm54fRDtLm27gPK oL66U8XmIAoJpM=; b=WzRiwBuOrHqJbc7TC8np8J8+sw4urXzfpvF65nfXoJQzI PCRAWVf/h0Yevucumg8z7QarNbsKSSQZDSzZe4HkQ/fVtzeCkAhdRbTcSrhBpAyy 5hIdjxCN23IDSohN6CkSm8eD7Cvn3CdD7pnWRCO2o6YLkq258niL/OJtMuA7Oytg fguUzUWexH2HT9xQyZ6c/60oQw2fUWqnIxHBszPdedz4cwlRNTGjU2MGYvgN85xb 3464GWiqtiHO3yKkFbocaAfXa/0J12QHaD1kOiz+oH0GkLI0+9kgUJI4AFxpVjcC P4OhCf/MJ/jgBSQvkiC8NC1xRwJb960sDVlymIRTQ== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedugedrtddtgdehhecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefofgggkfffhffvufgtsehttdertderredtnecuhfhrohhmpedfvehhrhhishht ohhphhgvrhcuhghoohgufdcuoegtrgifsehhvggrphhinhhgsghithhsrdhnvghtqeenuc ffohhmrghinhepghhithhhuhgsrdgtohhmpdhnughsshdqshihmhhpohhsihhumhdrohhr ghenucfrrghrrghmpehmrghilhhfrhhomheptggrfieshhgvrghpihhnghgsihhtshdrnh gvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 910A13C00A1; Tue, 14 Jan 2020 10:12:36 -0500 (EST) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.7-754-g09d1619-fmstable-20200113v1 Mime-Version: 1.0 Message-Id: <1ee9034d-ac5b-4e46-9952-d9002f0dd29c@www.fastmail.com> Date: Tue, 14 Jan 2020 07:12:15 -0800 From: "Christopher Wood" To: "Mirja Kuehlewind" , "tram@ietf.org" Cc: "Antoine Delignat-Lavaud" Content-Type: text/plain Archived-At: Subject: [tram] QUIPS 2020 talk invitation X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jan 2020 15:12:43 -0000 Hi Brian, Mirja, I'm writing to invite you to give a talk on your RTT-based geo-location work at the upcoming QUIPS Workshop at NDSS 2020 [2]. Antoine and I think this is fascinating research that offers a different perspective on endpoint privacy than traditionally considered in the IETF. If you are interested, willing, and able to present, please let us know. Note that we are currently inquiring whether or not remote attendance is possible. At this time, we are not able to commit to remote attendance. Best, Chris [1] https://github.com/britram/trilateration/blob/paper-rev-1/paper.ipynb [2] https://www.ndss-symposium.org/ndss2020/cfp-quips-workshop/ From nobody Wed Jan 15 05:47:29 2020 Return-Path: X-Original-To: tram@ietf.org Delivered-To: tram@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E08F312003E; Wed, 15 Jan 2020 05:47:08 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: tram-chairs@ietf.org, simon.perreault@logmein.com, tram@ietf.org, magnus.westerlund@ericsson.com X-Test-IDTracker: no X-IETF-IDTracker: 6.116.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <157909602884.4692.18207708180012919638.idtracker@ietfa.amsl.com> Date: Wed, 15 Jan 2020 05:47:08 -0800 Archived-At: Subject: [tram] tram - Not having a session at IETF 107 X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jan 2020 13:47:09 -0000 Simon Perreault, a chair of the tram working group, indicated that the tram working group does not plan to hold a session at IETF 107. This message was generated and sent by the IETF Meeting Session Request Tool. From nobody Thu Jan 16 17:27:02 2020 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F14E120059; Thu, 16 Jan 2020 17:26:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RsK2lfpOTHj3; Thu, 16 Jan 2020 17:26:54 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0FFE512004A; Thu, 16 Jan 2020 17:26:53 -0800 (PST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id C5EF33897D; Thu, 16 Jan 2020 20:26:24 -0500 (EST) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 8C417E7F; Thu, 16 Jan 2020 20:26:52 -0500 (EST) From: Michael Richardson to: tram@ietf.org, behave@ietf.org In-Reply-To: <11345.1579216274@localhost> References: <20200110123841.GD8801@faui48f.informatik.uni-erlangen.de> <29758.1578671195@localhost> <11345.1579216274@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [tram] [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh requests when using short-term credentials X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jan 2020 01:26:56 -0000 --=-=-= Content-Type: text/plain https://www.rfc-editor.org/errata_search.php?eid=4933 4933> Section 17.3.3 says: 4933> An attacker might attempt to disrupt service to other users of the 4933> TURN server by sending Refresh requests or CreatePermission requests 4933> that (through source address spoofing) appear to be coming from 4933> another user of the TURN server. TURN prevents this by requiring 4933> that the credentials used in CreatePermission, Refresh, and 4933> ChannelBind messages match those used to create the initial 4933> allocation. Thus, the fake requests from the attacker will be 4933> rejected. 4933> Notes: 4933> When using short-term, credentials expire after a specific amount of time 4933> (such as 5 4933> minutes) and clients get new credentials. The restriction imposed at section 4933> 17.3.3 4933> prevents from refreshing allocation or permission using the new credentials. 4933> This RFC approves RFC 5389. So one can use short-term credentials. But 4933> short-term credentials are useless if it can not be used to refresh 4933> allocation or permission. 4933> The goal of 17.3.3 can be achieved by sending 438 with the new nonce. a) I think we should accept this as verified. b) It seems that sending with the new nonce will work. This requires some text changes, and we can now perhaps use the errata patcher with XML. I've asked for the XML (if there is any), and I'll suggest some changes to the text. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl4hDVwACgkQgItw+93Q 3WXqjAf+IuyqsvvUxg0X+tv4aJ114EuoAJr3ZJXgix7HCoxZBB0xm2wIROLSsYg4 Y8ih6vFerBUYwYVNhUgVSI3ecf7qUe9lLwzsOv2jsx07H4SL9PM5F5gdtoKjSMTC RoNcHkvQuzuBzLHkFOmsGRGKkQ80T9gJUJLSnz/740NMUu83XXvMFcawv/2yzgP+ 5Ck6aGl46LP+xRp5xsHHSCRL6VBa8ZUYibIgX2rTjgY/BjX60vIft4nkSxSD9h5G esUwC4uJwCggeaRdalg9Ta3aq+lkpRLha8snHSk5jFzumhFbIepwSyVfG0qaa14n yDGa/W1VXPKdoV8jjBSX9Df83p2oTQ== =6h7P -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jan 17 10:01:14 2020 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3FA2120074 for ; Fri, 17 Jan 2020 10:01:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UBtVMSZ2MWcy for ; Fri, 17 Jan 2020 10:01:02 -0800 (PST) Received: from mail-vs1-xe41.google.com (mail-vs1-xe41.google.com [IPv6:2607:f8b0:4864:20::e41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2988612007A for ; Fri, 17 Jan 2020 10:01:02 -0800 (PST) Received: by mail-vs1-xe41.google.com with SMTP id p6so15349851vsj.11 for ; Fri, 17 Jan 2020 10:01:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AH4PcVDJXEBO80p7U9/qJUawaF/cZHM8sH8rjVksWys=; b=oj6RkPhmQX8WquxSkyGLbN2UG1CeI78ZhVUTFD168Rp2ijhBTubg2Aud/6bLwhi8ep muA6thPc6Bmn+uDrmF9XLXWEEPvmJTyJWsbJ0dgHf5eKTGo64DRo8Alq395Gk6eBvcCB 8MbLb8sV5IYE4XTK6E27LdSvU+0ArtIvtU41izP0jhyYUnWO4LyPlDbjqFNvUbVtwdvU cBC8ty2EMEJJbtQ7Tg5O9vXIvXb5INqK0RDZSOfzjMsiWlBrSAYbO2sGIt/H+JWevU84 GNyQWSDzqjWPydZYY+Q13q25TyNKezLc6DTR+HjaoZBF+zhIUFS3+LMDTIzB7qs4xb+3 g1Yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AH4PcVDJXEBO80p7U9/qJUawaF/cZHM8sH8rjVksWys=; b=sVsuPBN8l06wtWKg0gr0lD5ijSDLDt2iqBhbRlwiZd+7zVTxK+DLtfPpvbQ83fr7wc Gu16tm7Ym8f1moF2Lm2ToB+OEb7nVHrwKXnB99lb6y7a85sgTLQqpIvblaBqkxxmQTL/ flYQvdwW5pQts6zTpiy6kgKS9ypRmk9G5656SmQyOUeX82v1uLNHYoPV5im4a/XQDWKn csdTWkOoXz5EioxMLLXymwMu0yK0L+ZZ85XYFvXdKdAN42MxiB0pPniJge3+EaGLgDSx FGZn86asyIS00m4WxQ3w0VmroVLMnhTJOEHDzLvTl/j1Y17Vvsp+Yk/FVee4JYylU0Fm GpNw== X-Gm-Message-State: APjAAAUnE3VHt5GgQZjQVOdurjtdCaYr8NFn8n9gtHiH2AoK5Ul55RvE oawq21I36D5hKd6VC9PQFG46+d9lUFAKkCRAFjLv/g== X-Google-Smtp-Source: APXvYqxiHzRRsr8t+8Je591l1H1vZI+En5qudE8vL9szAn4ICyG0A3Fbnl81nbwAalCSlTyIW32+HFxlLNINEttnarI= X-Received: by 2002:a67:8716:: with SMTP id j22mr5784667vsd.177.1579284060750; Fri, 17 Jan 2020 10:01:00 -0800 (PST) MIME-Version: 1.0 References: <20200110123841.GD8801@faui48f.informatik.uni-erlangen.de> <29758.1578671195@localhost> <11345.1579216274@localhost> <12509.1579224412@localhost> In-Reply-To: <12509.1579224412@localhost> From: Justin Uberti Date: Fri, 17 Jan 2020 10:00:48 -0800 Message-ID: To: Michael Richardson Cc: tram@ietf.org, behave Content-Type: multipart/alternative; boundary="000000000000711d28059c59b9ea" Archived-At: Subject: Re: [tram] [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh requests when using short-term credentials X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jan 2020 18:01:08 -0000 --000000000000711d28059c59b9ea Content-Type: text/plain; charset="UTF-8" Both a/b seem sensible to me. On Thu, Jan 16, 2020 at 5:27 PM Michael Richardson wrote: > > https://www.rfc-editor.org/errata_search.php?eid=4933 > > 4933> Section 17.3.3 says: > > 4933> An attacker might attempt to disrupt service to other users of > the > 4933> TURN server by sending Refresh requests or CreatePermission > requests > 4933> that (through source address spoofing) appear to be coming from > 4933> another user of the TURN server. TURN prevents this by requiring > 4933> that the credentials used in CreatePermission, Refresh, and > 4933> ChannelBind messages match those used to create the initial > 4933> allocation. Thus, the fake requests from the attacker will be > 4933> rejected. > 4933> Notes: > > 4933> When using short-term, credentials expire after a specific > amount of time > 4933> (such as 5 > 4933> minutes) and clients get new credentials. The restriction > imposed at section > 4933> 17.3.3 > 4933> prevents from refreshing allocation or permission using the new > credentials. > > 4933> This RFC approves RFC 5389. So one can use short-term > credentials. But > 4933> short-term credentials are useless if it can not be used to > refresh > 4933> allocation or permission. > > 4933> The goal of 17.3.3 can be achieved by sending 438 with the new > nonce. > > a) I think we should accept this as verified. > b) It seems that sending with the new nonce will work. This requires some > text changes, and we can now perhaps use the errata patcher with XML. > I've asked for the XML (if there is any), and I'll suggest some changes > to > the text. > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > > _______________________________________________ > Behave mailing list > Behave@ietf.org > https://www.ietf.org/mailman/listinfo/behave > --000000000000711d28059c59b9ea Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Both a/b seem sensible to me.

On Thu, Jan 16, 2020 at 5:27 = PM Michael Richardson <mcr+ie= tf@sandelman.ca> wrote:

https://www.rfc-editor.org/errata_search.php?= eid=3D4933

=C2=A0 =C2=A0 4933> Section 17.3.3 says:

=C2=A0 =C2=A0 4933> An attacker might attempt to disrupt service to othe= r users of the
=C2=A0 =C2=A0 4933> TURN server by sending Refresh requests or CreatePer= mission requests
=C2=A0 =C2=A0 4933> that (through source address spoofing) appear to be = coming from
=C2=A0 =C2=A0 4933> another user of the TURN server.=C2=A0 TURN prevents= this by requiring
=C2=A0 =C2=A0 4933> that the credentials used in CreatePermission, Refre= sh, and
=C2=A0 =C2=A0 4933> ChannelBind messages match those used to create the = initial
=C2=A0 =C2=A0 4933> allocation.=C2=A0 Thus, the fake requests from the a= ttacker will be
=C2=A0 =C2=A0 4933> rejected.
=C2=A0 =C2=A0 4933> Notes:

=C2=A0 =C2=A0 4933> When using short-term, credentials expire after a sp= ecific amount of time
=C2=A0 =C2=A0 4933> (such as 5
=C2=A0 =C2=A0 4933> minutes) and clients get new credentials. The restri= ction imposed at section
=C2=A0 =C2=A0 4933> 17.3.3
=C2=A0 =C2=A0 4933> prevents from refreshing allocation or permission us= ing the new credentials.

=C2=A0 =C2=A0 4933> This RFC approves RFC 5389. So one can use short-ter= m credentials. But
=C2=A0 =C2=A0 4933> short-term credentials are useless if it can not be = used to refresh
=C2=A0 =C2=A0 4933> allocation or permission.

=C2=A0 =C2=A0 4933> The goal of 17.3.3 can be achieved by sending 438 wi= th the new nonce.

a) I think we should accept this as verified.
b) It seems that sending with the new nonce will work.=C2=A0 This requires = some
=C2=A0 =C2=A0text changes, and we can now perhaps use the errata patcher wi= th XML.
=C2=A0 =C2=A0I've asked for the XML (if there is any), and I'll sug= gest some changes to
=C2=A0 =C2=A0the text.

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
=C2=A0-=3D IPv6 IoT consulting =3D-




--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
=C2=A0-=3D IPv6 IoT consulting =3D-



_______________________________________________
Behave mailing list
Behave@ietf.org https://www.ietf.org/mailman/listinfo/behave
--000000000000711d28059c59b9ea-- From nobody Fri Jan 24 08:29:07 2020 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76AE51209D8; Fri, 24 Jan 2020 08:29:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id orTxrzmNatK6; Fri, 24 Jan 2020 08:28:59 -0800 (PST) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-db3eur04on0605.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0c::605]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99D3E1209CD; Fri, 24 Jan 2020 08:28:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YKshzy/6UwwzDKir+f4kcAZb4nJ0mNDKnuRPjfw7ziu4aup6PCwkK2QDxMu7NqHcMnA/ZyLzqm/NMbx5s0aDcFTUrSoiLPfASVBE2IHrC/6GhscuUiOVwwzwcQvhTtsfSMknGR3GukkYYvVJT0j0XPi3LAhurcN6QrkeixJXfDFt2cEHZzGj4ahPIRi4b07Sw7kCni+4MNwxocMWeLp7w6n+JzdkQx1xBf3dCRRNkg4sdk/npxC5LQ6md++pvToZHkO6ORspQuYoOhC36oYNnWlGN63P3Ddf/QyVYLFQDTwIlz+Rd/RjjXzqH/1ClZDZEzInKB8PCa3cvcQKHyeAWg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TlSg2Bzhj1HuH9Jud2j9Hz745e1iStC9hf6QvE6wjus=; b=nacNc/4l/tOegSGga/o2/1K8vFf/dXCUyCRcPeV/w7QpnaXIMVsix1HJZKbowdYOCM4GMIQUCbnJClt8GphoN2iHfGuPZtWdEurDp//LKpbm6qtEIOzk8WikUK1gLg6jD5/bdnxVWEQY6YhMFrMZb1rAqZrJSHhyWuqjiwkdmV/dhWwvman6UVCEw9iAe6d+nJxyzhgY05XyZbVlTJtO2+VZNHG3GUwfD3e7yEnakIVzhxaBtgYgWCH4C06KhrlNBqftyzjpxJv8I6BspBOtl3zIc70GwZpsZjMVH74EBkYAs5DXDounUyrWxe+PjDLdIgDmhxz2EIM8MXg0GdhOuA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TlSg2Bzhj1HuH9Jud2j9Hz745e1iStC9hf6QvE6wjus=; b=SSvV3/gtQkl+SeAbqFP58GbutKf3kbs6Ub2L94OqR6n+ujXSZnmZ5nuHciwLd9RWF3VgJo9/n3K2VTpWTQ2/y3DTlD9SsE5gmyx6vY98pupzez9pU7/bgJuzeFWcDTrvGF0RFBzrHOSlobrcBSle4Dc4egcBlvo5U+lnmLZIKkk= Received: from DB7PR07MB4572.eurprd07.prod.outlook.com (52.135.133.12) by DB7PR07MB5878.eurprd07.prod.outlook.com (20.177.193.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2665.14; Fri, 24 Jan 2020 16:28:56 +0000 Received: from DB7PR07MB4572.eurprd07.prod.outlook.com ([fe80::cd9a:187a:90ab:3544]) by DB7PR07MB4572.eurprd07.prod.outlook.com ([fe80::cd9a:187a:90ab:3544%5]) with mapi id 15.20.2665.017; Fri, 24 Jan 2020 16:28:55 +0000 From: Magnus Westerlund To: "mcr+ietf@sandelman.ca" , "juberti=40google.com@dmarc.ietf.org" CC: "behave@ietf.org" , "tram@ietf.org" Thread-Topic: [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh requests when using short-term credentials Thread-Index: AQHVzMYeLbYkY+2WaUmMx8s8Q4kFvafuENgAgAEVswCACualAA== Date: Fri, 24 Jan 2020 16:28:55 +0000 Message-ID: References: <20200110123841.GD8801@faui48f.informatik.uni-erlangen.de> <29758.1578671195@localhost> <11345.1579216274@localhost> <12509.1579224412@localhost> In-Reply-To: Accept-Language: sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=magnus.westerlund@ericsson.com; x-originating-ip: [192.176.1.84] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b65cbbc5-036f-48a6-64cc-08d7a0ea81e4 x-ms-traffictypediagnostic: DB7PR07MB5878: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 02929ECF07 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(346002)(136003)(366004)(376002)(39860400002)(189003)(199004)(66476007)(36756003)(6512007)(8676002)(76116006)(91956017)(81156014)(66946007)(81166006)(54906003)(66556008)(64756008)(110136005)(66616009)(66446008)(86362001)(5660300002)(53546011)(6506007)(4326008)(16799955002)(966005)(478600001)(71200400001)(2906002)(316002)(26005)(186003)(8936002)(44832011)(2616005)(6486002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB7PR07MB5878; H:DB7PR07MB4572.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: G1rmoZsLawpU6vl3B9pnCGPw9lFru+xemuTYffXGQ2Ljq1HgjBlos5a/e8ydZNVNr9xMpwCbpUmoMpxRcISuG2fRHhTqCM3KfqkB+yQYzIwOuAibWz3p0So1/ZNEB4HcxN8nKyCw6MeJINiG0Fkl9RYD89nnpAhlTiZuTYaNRTZmhPOU4yaeB7OMgKIEiUeU4d6nRrekfG5nLae2MC3bizB4aewPyH93Zz6r9NO5xfSmOt3PVCftb+X+D+LrRbeEg8kDx5AAblvEt5WYBUP+j7Bm/PMaPcF5ZXa5Lty0/+wy994np6XUsWoJloWINhEdzKRyI7IMiOmmC+Kr2EHLeg/f83jCaBqgcLShyhwZl4LXsdPDOt2tVLlcm3NBwYACZiYMuJnnk7VYIrij+y2sa8zvobwwSBasHXytxguMvo0PPXUYzjKAHTyYIr56o9Ofu/3WYm1b8KCtvBHInuyk6FTRcxG1JLUfrBnGVSbR0os= x-ms-exchange-antispam-messagedata: a4m6gFqAfhDDg4vbloz31hOfJ0VEMnPbarRz01rMzH1qBoU9NSeug1mHnGDjyBhP3AkfCQ2hHrBoYwm6UDjwkapHAq6poxDCiyJXFRD62q+3QcGcQin1yNnVTQ80ftQDz/Z0epXWVCEX72lB5x2kZw== x-ms-exchange-transport-forked: True Content-Type: multipart/signed; micalg="sha-256"; protocol="application/x-pkcs7-signature"; boundary="=-+3O9BxMnmXJaS5FWNAoS" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: b65cbbc5-036f-48a6-64cc-08d7a0ea81e4 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jan 2020 16:28:55.7655 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 84ZgeyCIn70FlHm/wKROQVNNSh0PAdAV9UbzDwXcIucKFUU4+gbcFq5egTWWddeJ/uCzJQncRQiD1I5WIGdnu4BXdxGojIZOcQOarjAG/C4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR07MB5878 Archived-At: Subject: Re: [tram] [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh requests when using short-term credentials X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jan 2020 16:29:02 -0000 --=-+3O9BxMnmXJaS5FWNAoS Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I think the primary question is if this errata points to an issue that rema= ins within the updated TURN specification:=20 https://datatracker.ietf.org/doc/draft-ietf-tram-turnbis/ So the question to the TRAM WG people.=20 Section 21.3.3. (the equivalent to 17.3.3) has the same text. However, I th= ink the underlying question is if the existing mechanism and especially for sta= le nonce prevents an insider attacker that otherwise have the user name and password for the user can take over an allocation when the nonce expires?= =20 However, I have the suspistion that the reporter has made an erronous assum= ption as short-term security is not allowed with TURN. Section 4 of RFC 5766 do requires long-term or other equal strong mechanism. Thus, another aspect is= if the nonce actually will expire? Or can a client actually loose their alloca= tions when the nonce expires and attacker manages to make the request first?=20 Cheers Magnus Westerlund On Fri, 2020-01-17 at 10:00 -0800, Justin Uberti wrote: > Both a/b seem sensible to me. >=20 > On Thu, Jan 16, 2020 at 5:27 PM Michael Richardson > wrote: > > https://www.rfc-editor.org/errata_search.php?eid=3D4933 > >=20 > > 4933> Section 17.3.3 says: > >=20 > > 4933> An attacker might attempt to disrupt service to other users o= f the > > 4933> TURN server by sending Refresh requests or CreatePermission > > requests > > 4933> that (through source address spoofing) appear to be coming fr= om > > 4933> another user of the TURN server. TURN prevents this by requi= ring > > 4933> that the credentials used in CreatePermission, Refresh, and > > 4933> ChannelBind messages match those used to create the initial > > 4933> allocation. Thus, the fake requests from the attacker will b= e > > 4933> rejected. > > 4933> Notes: > >=20 > > 4933> When using short-term, credentials expire after a specific am= ount > > of time > > 4933> (such as 5 > > 4933> minutes) and clients get new credentials. The restriction imp= osed > > at section > > 4933> 17.3.3 > > 4933> prevents from refreshing allocation or permission using the n= ew > > credentials. > >=20 > > 4933> This RFC approves RFC 5389. So one can use short-term credent= ials. > > But > > 4933> short-term credentials are useless if it can not be used to > > refresh > > 4933> allocation or permission. > >=20 > > 4933> The goal of 17.3.3 can be achieved by sending 438 with the ne= w > > nonce. > >=20 > > a) I think we should accept this as verified. > > b) It seems that sending with the new nonce will work. This requires s= ome > > text changes, and we can now perhaps use the errata patcher with XML= . > > I've asked for the XML (if there is any), and I'll suggest some chan= ges > > to > > the text. > >=20 > > -- > > Michael Richardson , Sandelman Software Works > > -=3D IPv6 IoT consulting =3D- > >=20 > >=20 > >=20 > >=20 > > -- > > Michael Richardson , Sandelman Software Works > > -=3D IPv6 IoT consulting =3D- > >=20 > >=20 > >=20 > > _______________________________________________ > > Behave mailing list > > Behave@ietf.org > > https://www.ietf.org/mailman/listinfo/behave >=20 > _______________________________________________ > Behave mailing list > Behave@ietf.org > https://www.ietf.org/mailman/listinfo/behave --=20 Cheers Magnus Westerlund=20 ---------------------------------------------------------------------- Networks, Ericsson Research ---------------------------------------------------------------------- Ericsson AB | Phone +46 10 7148287 Torshamnsgatan 23 | Mobile +46 73 0949079 SE-164 80 Stockholm, Sweden | mailto: magnus.westerlund@ericsson.com ---------------------------------------------------------------------- --=-+3O9BxMnmXJaS5FWNAoS Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEtww ggYHMIID76ADAgECAhALRm3NcHtuMGWutmt5cXntMA0GCSqGSIb3DQEBCwUAMEcxCzAJBgNVBAYT AlNFMREwDwYDVQQKDAhFcmljc3NvbjElMCMGA1UEAwwcRXJpY3Nzb24gTkwgSW5kaXZpZHVhbCBD QSB2MzAeFw0xNzEyMTUwNzIyMjNaFw0yMDEyMTUwNzIyMjJaMHAxETAPBgNVBAoMCEVyaWNzc29u MRowGAYDVQQDDBFNYWdudXMgV2VzdGVybHVuZDEtMCsGCSqGSIb3DQEJARYebWFnbnVzLndlc3Rl cmx1bmRAZXJpY3Nzb24uY29tMRAwDgYDVQQFEwdlcmFtc3dkMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAsKlHZvB3TsmLEDtPSiFFKAh73S2wApt+laqg5eXTqonqnzT9ykEGL2dx9mBT +2WZiIKxo4w2sisVl3EEYTqXTkctpur7cN29gLC8F3tJHGI2sUVpO9AwpVrN+UuHEVetHt7hdxW9 uYd0LJJ8TP6/wGkIfAFaZxlZUn79O2eHElfih1iVIiTZXLcEe1rBJtzhUNRHWgOm2vQlDJ4sCpig GFq5w+XSRviEQMkQZRvw1CQmb35QS/C/T36ogzIRHDuAdkoSaiUOY/S2dLp4HkwvOOg+tADpaHkr bdmdnjKGrYSnJigmxw14pJugxL/Vb2EeVcgpAfVVst7Lm4POPRI8+wIDAQABo4IBxDCCAcAwSAYD VR0fBEEwPzA9oDugOYY3aHR0cDovL2NybC50cnVzdC50ZWxpYS5jb20vZXJpY3Nzb25ubGluZGl2 aWR1YWxjYXYzLmNybDCBggYIKwYBBQUHAQEEdjB0MCgGCCsGAQUFBzABhhxodHRwOi8vb2NzcDIu dHJ1c3QudGVsaWEuY29tMEgGCCsGAQUFBzAChjxodHRwOi8vY2EudHJ1c3QudGVsaWFzb25lcmEu Y29tL2VyaWNzc29ubmxpbmRpdmlkdWFsY2F2My5jZXIwKQYDVR0RBCIwIIEebWFnbnVzLndlc3Rl cmx1bmRAZXJpY3Nzb24uY29tMFUGA1UdIAROMEwwSgYMKwYBBAGCDwIDAQESMDowOAYIKwYBBQUH AgEWLGh0dHBzOi8vcmVwb3NpdG9yeS50cnVzdC50ZWxpYXNvbmVyYS5jb20vQ1BTMB0GA1UdJQQW MBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4EFgQU5ivuhpU51W4UhBDBWwf8XsU837YwHwYD VR0jBBgwFoAUHHsZnpecdqwgPdjc45Fq49stplMwDgYDVR0PAQH/BAQDAgWgMA0GCSqGSIb3DQEB CwUAA4ICAQBn0FKukg00UN/c/ESpxSIaYTrsd8liHHMu5rLpOBNOacpGNBMGNgUDDt4QihhoQR3c vhYXCrAM59NTvw0HNlgqHZoEeVY7YnJJYnJXDCLUfkK5Dn28E3QrzykkF6giUOXDyF9mhWYbSAkJ yx0Yj0Xc8en3wYNyoFYEqjlKtZrdV0pcgFzEeXVLS8DWrzSy7+KfUtDOEiM6H3zO3nsq++KBmsOi SKkWn4oYERZg5KElEAHis9av+3KIaEPnOAt8QRWRpFfGZ4d89F16qFvElup5n7l864FqxnC2friD o4hLQY6ENaOaYIihXhbl2UYxAGDk89aJm/S5pYyq7wzm+KK3IcUl60rmc8SJlt6QXKw0wXEOE1Mu bauYKMsad2s8jD+rEkXp+agTRl+sezWaRxHBpxuUKDd6MhwDig3SZi1qP7D/Ds4V+JLIjjUJc25l 9tvMGC9+lqI0P+vMI3Zyrou0NNfb55uLQaq18O+7BZ8Kv7jvFdxYyUgbxQ0SPEiyhylcLHAmJeLC QaiZHmCREBkCLKSf0O4lE2TrVzdOD38wjzuQ27U3UddVCD9EQ3tF7o6EVhpxJJUlB6xe/2UWwy4Z la71dKLUhakdVrN5abzxqFWvzOAT9nBa2HzYVBtpbcu6KGh72YJ+M79fa9iIkcQCgUnw3gIAeWd/ /n4YbY2QhDCCBgcwggPvoAMCAQICEAtGbc1we24wZa62a3lxee0wDQYJKoZIhvcNAQELBQAwRzEL MAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxFcmljc3NvbiBOTCBJbmRp dmlkdWFsIENBIHYzMB4XDTE3MTIxNTA3MjIyM1oXDTIwMTIxNTA3MjIyMlowcDERMA8GA1UECgwI RXJpY3Nzb24xGjAYBgNVBAMMEU1hZ251cyBXZXN0ZXJsdW5kMS0wKwYJKoZIhvcNAQkBFh5tYWdu dXMud2VzdGVybHVuZEBlcmljc3Nvbi5jb20xEDAOBgNVBAUTB2VyYW1zd2QwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCwqUdm8HdOyYsQO09KIUUoCHvdLbACm36VqqDl5dOqieqfNP3K QQYvZ3H2YFP7ZZmIgrGjjDayKxWXcQRhOpdORy2m6vtw3b2AsLwXe0kcYjaxRWk70DClWs35S4cR V60e3uF3Fb25h3QsknxM/r/AaQh8AVpnGVlSfv07Z4cSV+KHWJUiJNlctwR7WsEm3OFQ1EdaA6ba 9CUMniwKmKAYWrnD5dJG+IRAyRBlG/DUJCZvflBL8L9PfqiDMhEcO4B2ShJqJQ5j9LZ0ungeTC84 6D60AOloeStt2Z2eMoathKcmKCbHDXikm6DEv9VvYR5VyCkB9VWy3subg849Ejz7AgMBAAGjggHE MIIBwDBIBgNVHR8EQTA/MD2gO6A5hjdodHRwOi8vY3JsLnRydXN0LnRlbGlhLmNvbS9lcmljc3Nv bm5saW5kaXZpZHVhbGNhdjMuY3JsMIGCBggrBgEFBQcBAQR2MHQwKAYIKwYBBQUHMAGGHGh0dHA6 Ly9vY3NwMi50cnVzdC50ZWxpYS5jb20wSAYIKwYBBQUHMAKGPGh0dHA6Ly9jYS50cnVzdC50ZWxp YXNvbmVyYS5jb20vZXJpY3Nzb25ubGluZGl2aWR1YWxjYXYzLmNlcjApBgNVHREEIjAggR5tYWdu dXMud2VzdGVybHVuZEBlcmljc3Nvbi5jb20wVQYDVR0gBE4wTDBKBgwrBgEEAYIPAgMBARIwOjA4 BggrBgEFBQcCARYsaHR0cHM6Ly9yZXBvc2l0b3J5LnRydXN0LnRlbGlhc29uZXJhLmNvbS9DUFMw HQYDVR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMB0GA1UdDgQWBBTmK+6GlTnVbhSEEMFbB/xe xTzftjAfBgNVHSMEGDAWgBQcexmel5x2rCA92NzjkWrj2y2mUzAOBgNVHQ8BAf8EBAMCBaAwDQYJ KoZIhvcNAQELBQADggIBAGfQUq6SDTRQ39z8RKnFIhphOux3yWIccy7msuk4E05pykY0EwY2BQMO 3hCKGGhBHdy+FhcKsAzn01O/DQc2WCodmgR5VjtickliclcMItR+QrkOfbwTdCvPKSQXqCJQ5cPI X2aFZhtICQnLHRiPRdzx6ffBg3KgVgSqOUq1mt1XSlyAXMR5dUtLwNavNLLv4p9S0M4SIzoffM7e eyr74oGaw6JIqRafihgRFmDkoSUQAeKz1q/7cohoQ+c4C3xBFZGkV8Znh3z0XXqoW8SW6nmfuXzr gWrGcLZ+uIOjiEtBjoQ1o5pgiKFeFuXZRjEAYOTz1omb9LmljKrvDOb4orchxSXrSuZzxImW3pBc rDTBcQ4TUy5tq5goyxp3azyMP6sSRen5qBNGX6x7NZpHEcGnG5QoN3oyHAOKDdJmLWo/sP8OzhX4 ksiONQlzbmX228wYL36WojQ/68wjdnKui7Q019vnm4tBqrXw77sFnwq/uO8V3FjJSBvFDRI8SLKH KVwscCYl4sJBqJkeYJEQGQIspJ/Q7iUTZOtXN04PfzCPO5DbtTdR11UIP0RDe0XujoRWGnEklSUH rF7/ZRbDLhmVrvV0otSFqR1Ws3lpvPGoVa/M4BP2cFrYfNhUG2lty7ooaHvZgn4zv19r2IiRxAKB SfDeAgB5Z3/+fhhtjZCEMIIGwjCCBKqgAwIBAgIQU7h+g+GcmSiTsJtJHOy46zANBgkqhkiG9w0B AQsFADA3MRQwEgYDVQQKDAtUZWxpYVNvbmVyYTEfMB0GA1UEAwwWVGVsaWFTb25lcmEgUm9vdCBD QSB2MTAeFw0xNTEwMjcxMjE2NDZaFw0yNTEwMjcxMjE2NDZaMEcxCzAJBgNVBAYTAlNFMREwDwYD VQQKDAhFcmljc3NvbjElMCMGA1UEAwwcRXJpY3Nzb24gTkwgSW5kaXZpZHVhbCBDQSB2MzCCAiIw DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOzy3wAAuFDyp7vYVLfGk/fjwao71MNGNLSzzl5D tjQtMtl2ZLPZyX6ViqzTN9JOb7uZ6KxuGSpReQvt8XOh7iIhkKH9W5hRpbjTsJmUMJd6zifhOpNK 6iSU3q44+FjsQL1lVtcguUuFG6aZN0N3GFVbgt6jRrASF8t/3wy9bHPAIfMyPybpg6Y2PH5/1Nwk TepoDSmK69LGV+lV2IK6U9OWayZXZFIFIDCoGyFlhFxAEgN+qZ2+Rqg/0TM0oCHvKO2ELSGmAdnJ kwizR42ji/Y9SYTSuG75mzSe6OfCGWM8Db/xvy/20aLEPXNu1PvOgzY63WZ6cmkWnjMlVJ90pWC2 haqDm3Yf8TRdjUvAl7Pz1bTuexwShzIGakL7MkCYrEqHMRaojI/VStloQgW76E76zQ2byw5QxrhO UbisBSKRzlTlOZQgYFFAbG6ViF8DOpJh/ygtQwuTLUM5r15G7eynQV1AMTNCWcX+HUvgArUw6RfW 9L58uA68GjktFTV8s9RlDsUqsNcLqeXaV28S2WMday0YGaq/bloS8AD7KuumUKH+Ri9IGO9mJvP0 5tvDHjKpLvv80c3WLJnJU/aznYHYEt2+jjKHOTqdGTxL/zMdpRSQFSuu+KM8NoYrkU1VJqKga+QL sgqKghMp99gu1P1e6KsqseWHdXORrMbjqkBXAgMBAAGjggG4MIIBtDCBigYIKwYBBQUHAQEEfjB8 MC0GCCsGAQUFBzABhiFodHRwOi8vb2NzcC50cnVzdC50ZWxpYXNvbmVyYS5jb20wSwYIKwYBBQUH MAKGP2h0dHA6Ly9yZXBvc2l0b3J5LnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYXJv b3RjYXYxLmNlcjASBgNVHRMBAf8ECDAGAQH/AgEAMFUGA1UdIAROMEwwSgYMKwYBBAGCDwIDAQEC MDowOAYIKwYBBQUHAgEWLGh0dHBzOi8vcmVwb3NpdG9yeS50cnVzdC50ZWxpYXNvbmVyYS5jb20v Q1BTMEsGA1UdHwREMEIwQKA+oDyGOmh0dHA6Ly9jcmwtMy50cnVzdC50ZWxpYXNvbmVyYS5jb20v dGVsaWFzb25lcmFyb290Y2F2MS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA4G A1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUHHsZnpecdqwgPdjc45Fq49stplMwHwYDVR0jBBgwFoAU 8I9ZOACz9Y+algzV6/p7qhfoExIwDQYJKoZIhvcNAQELBQADggIBAFBYa/HVjDu0LqtXQ8iMp8PL Fpqchf41ksQY6R1AsoZbaBUu0NQlAQ9GzlC1pmI5s0cJnuaZI0xV6TiWS3/R2p9UgW61XD9CTIUb AL31mY3BdJf3P46gzKgQEca/DlFjq9GVmuPS4q90BLNgvgoxoHubc3C6s0OaY1sbnay5EhnvrAE4 Q511FlxmJPLnRmQGpieeXa3cPegFfY1kJDKyyFRypF1RuRLXcdMIgKEy5NX1bS3M9dQ4mgmUmVT2 d33UiKSEYQ6s/B+LFaaz4LywXSv2o3W4kbHoQs86IWst821ww0wxsCpEfClIvF7fBw2QkbG/1Pwu zAuLVStEhDzkAqOrMGctKyNEaBsyAn7Eq2eCa8QDXnkmagp9QPsNFs/oqnXj9j1cVtH9a4OPzhtg 0pd7gd0NzU/5QxibXqbYvouQgihGXHQDmaL4ruN7C4arMUqRo82YnREsKL7h3j/jtmzcMLc9Q07F 04QQd/iSR1Y5pIi6PdNBiE2/4uyAXS6KOIGZrPbNQUNrZtwiQpqQNl8AUzgegfPwrYFlFocpaF3d 1m5r+2VKKqiRQVfYPGYeZnWfkcz06JoAhc/9mjbHXSP9hvWYzeLRuoZqHGUdjOX9DIQb926OneV7 C5WMIjSY8ORkamG/HKqngmjypL3gSc6oG/E6B+1i6Ds5j0Qpj5aQMYICzTCCAskCAQEwWzBHMQsw CQYDVQQGEwJTRTERMA8GA1UECgwIRXJpY3Nzb24xJTAjBgNVBAMMHEVyaWNzc29uIE5MIEluZGl2 aWR1YWwgQ0EgdjMCEAtGbc1we24wZa62a3lxee0wDQYJYIZIAWUDBAIBBQCgggFDMBgGCSqGSIb3 DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIwMDEyNDE2Mjg1NFowLwYJKoZIhvcN AQkEMSIEIOfIcsiG68fOILAKImWI8k40/LxjleYdq0lgbErn3EVBMGoGCSsGAQQBgjcQBDFdMFsw RzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxFcmljc3NvbiBOTCBJ bmRpdmlkdWFsIENBIHYzAhALRm3NcHtuMGWutmt5cXntMGwGCyqGSIb3DQEJEAILMV2gWzBHMQsw CQYDVQQGEwJTRTERMA8GA1UECgwIRXJpY3Nzb24xJTAjBgNVBAMMHEVyaWNzc29uIE5MIEluZGl2 aWR1YWwgQ0EgdjMCEAtGbc1we24wZa62a3lxee0wDQYJKoZIhvcNAQEBBQAEggEAApAc4Ndqo8O/ YTwys+gOIekTlXtRflAdAWNoBteaLA11eCF5Y1pc1c21dsRFB86UVoVe9nqLyltxfKVMYV351Jxa U3SRep44s+IUfajkMhzGMYzG8TV6iN85duv5XFM4xwqH2z4bIHsbschPU38w8y4lg9ncqNxb1P2+ cQf/DDUWJtv+vU9kQzeveUuaN+mqeXTC25WwI9Hz837cCiw/14GWMgZUBDK9JLGJc4er1+NkobGt Q4M5YK9OZRow3boBxJPOm+aWmaHE54amBPcZ9skOkOkycGIEjqiGnkCDC2ci1ZZFQcAZLmQehxS0 XQ06A2BvikH5a6JHnO/VO2PwIwAAAAAAAA== --=-+3O9BxMnmXJaS5FWNAoS-- From nobody Mon Jan 27 04:56:35 2020 Return-Path: X-Original-To: tram@ietfa.amsl.com Delivered-To: tram@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADD58120118 for ; Mon, 27 Jan 2020 04:56:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rdExMza-GV_p for ; Mon, 27 Jan 2020 04:56:31 -0800 (PST) Received: from us-smtp-delivery-140.mimecast.com (us-smtp-delivery-140.mimecast.com [63.128.21.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8573120115 for ; Mon, 27 Jan 2020 04:56:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=mimecast20190606; t=1580129790; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jRRRbudEgBK6Iw5DmhIsPwLyEV/ra8PghxKLp7efBcQ=; b=CsoTfsKNgUJn6YArR4ALLn8mwRKTqQRHVtZRpDuuWb/rvyjskQUDqgBRmFVcwVq3NRa7hE 6JByqz5ql03Z66gEV4dTX4GufcTfj0LvrDALT0cjMZOvR7ohdh3RQLG59YQaycuzPa6hve fPPyrgMHbThhTzbnbj3TeHqVap8I3Q0= Received: from NAM10-MW2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2104.outbound.protection.outlook.com [104.47.55.104]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-212-2jV_GU9XMhuZ1rYybJeLkQ-1; Mon, 27 Jan 2020 07:56:26 -0500 Received: from CY4PR1601MB1254.namprd16.prod.outlook.com (10.172.118.12) by CY4PR1601MB1221.namprd16.prod.outlook.com (10.172.115.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2665.22; Mon, 27 Jan 2020 12:56:23 +0000 Received: from CY4PR1601MB1254.namprd16.prod.outlook.com ([fe80::e851:20e8:57bd:fedd]) by CY4PR1601MB1254.namprd16.prod.outlook.com ([fe80::e851:20e8:57bd:fedd%12]) with mapi id 15.20.2665.017; Mon, 27 Jan 2020 12:56:23 +0000 From: "Konda, Tirumaleswar Reddy" To: Magnus Westerlund , "mcr+ietf@sandelman.ca" , "juberti=40google.com@dmarc.ietf.org" CC: "behave@ietf.org" , "tram@ietf.org" Thread-Topic: [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh requests when using short-term credentials Thread-Index: AQHV0tNtiErNXCJjEUGJD1dlX4Iwiaf+etJA Date: Mon, 27 Jan 2020 12:56:23 +0000 Message-ID: References: <20200110123841.GD8801@faui48f.informatik.uni-erlangen.de> <29758.1578671195@localhost> <11345.1579216274@localhost> <12509.1579224412@localhost> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.4.0.45 dlp-reaction: no-action x-originating-ip: [49.37.206.28] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 35669873-fc0b-4464-17f4-08d7a3285022 x-ms-traffictypediagnostic: CY4PR1601MB1221: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 02951C14DC x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(366004)(136003)(39860400002)(346002)(376002)(32952001)(189003)(199004)(478600001)(4326008)(966005)(8676002)(8936002)(186003)(86362001)(81166006)(81156014)(55016002)(9686003)(7696005)(316002)(110136005)(26005)(54906003)(6506007)(53546011)(33656002)(16799955002)(2906002)(5660300002)(52536014)(66446008)(64756008)(66556008)(76116006)(66476007)(66946007)(71200400001)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:CY4PR1601MB1221; H:CY4PR1601MB1254.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: +WJDa1jYSaobLbNhvKEBDfH87joKH8kKbYigy3iF3d7tqUtzIn+IFLY/+UU0MKb8uZLDm98vsl6oVrbn7r3A/omW08a80N7tdTYTR2otYOvnFkjgBnkjkJ4UZfzoBYx9phJvMn8TqMso71+fiGftzxzP1/IiSwm4qcyiBNbKh7oYUB0QthMDH+CnIZSc8aZ9BECx3eZ9pjDU0RxSzcJfmM+Zy0Z2gLd1z+eAyMZ7L6fgA6aG2kdMnHSxgY/kGgpyE6x3yLUbM8jiTilqf2v1v2qbtjOUUbyfLL67dz68HBmmXGf7d8k8cccOFBB3ax4WIShDBQkSA4uOUXBDiwJS9qYc6b2x+uPeP5NcGDFwXwjEzA3ydq6dbJRRign17SRUtVXrFy8E1kf0iazT08F9992ys85xtKlsQ+O+G9WSq/gasAC4iWYjeEi1CRC6zdiqHNYM4XqkhYwGZALdXMzUrz5lPFmgV1VKahICiHCNS+YkrR8kTZdfp1Myu4H08atQmWjh06yxf8+pR0b0hViBNE1/szR6WfHCwjXWOy3+hqrTy143frr9NDVlftxDIwNnE1cPIIAhglyLR49vgtWq3TCxIwM5Y5angtzsWI4FNPw= x-ms-exchange-antispam-messagedata: k6GhP4UA3jwxmViqKxIH7S1p6mGJM6HCd63QJtA3po+KrSzaEYQ9a8/NwQ1dkTos81vZhLGJsGsRS2AjPzmCN/M/91kNf0qZdHkHYdAuYQAKdsHxJcuZSD4MsI3xujXASlmbsoSDbKkHRsS/zN5kzA== x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: mcafee.com X-MS-Exchange-CrossTenant-Network-Message-Id: 35669873-fc0b-4464-17f4-08d7a3285022 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jan 2020 12:56:23.2406 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 2G1WIyyxHiKLMnO1zzlbVwPyocVvWbYHyhkkoCrpFh/ID45PUnff01ARmKDW7CqISKy9f6gxnpx0abt9syoJKpLaYGY3s1InV2CFt+ftT5j5GcjZuEY5e8rOrqLBd3xW X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1601MB1221 X-MC-Unique: 2jV_GU9XMhuZ1rYybJeLkQ-1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: mcafee.com Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 Archived-At: Subject: Re: [tram] [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh requests when using short-term credentials X-BeenThere: tram@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jan 2020 12:56:34 -0000 VGhlIHNob3J0LXRlcm0gY3JlZGVudGlhbCBtZWNoYW5pc20gZm9yIFRVUk4gaXMgZGlzY3Vzc2Vk IGluIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NjM1LCBpdCBhZGRyZXNzZXMgYm90 aCB0aGUgaXNzdWVzIHJhaXNlZCBieSB0aGUgcmVwb3J0ZXINCg0KYSkgU2VjdGlvbiA5IHNheXMs ICBJZiB0aGUgYWNjZXNzIHRva2VuIGV4cGlyZXMsIHRoZW4gdGhlIGNsaWVudCBNVVNUIG9idGFp biBhIG5ldyB0b2tlbiBmcm9tIHRoZSBhdXRob3JpemF0aW9uIHNlcnZlciBhbmQgdXNlIGl0IGZv ciBuZXcNCiAgICBhbGxvY2F0aW9ucy4gIFRoZSBjbGllbnQgTVVTVCB1c2UgdGhlIG5ldyB0b2tl biB0byByZWZyZXNoIGV4aXN0aW5nIGFsbG9jYXRpb25zLiAgVGhpcyB3YXksIHRoZSBjbGllbnQg aGFzIHRvIG1haW50YWluIG9ubHkNCiAgICBvbmUgdG9rZW4gcGVyIFRVUk4gc2VydmVyLg0KYikg U2VjdGlvbiAxMSBkaXNjdXNzZXMgZnJlcXVlbnRseSBjaGFuZ2luZyB0aGUgbm9uY2UuDQoNCkNo ZWVycywNCi1UaXJ1DQoNCj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogdHJh bSA8dHJhbS1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgTWFnbnVzIFdlc3Rlcmx1bmQN Cj4gU2VudDogRnJpZGF5LCBKYW51YXJ5IDI0LCAyMDIwIDk6NTkgUE0NCj4gVG86IG1jcitpZXRm QHNhbmRlbG1hbi5jYTsganViZXJ0aT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmcNCj4gQ2M6 IGJlaGF2ZUBpZXRmLm9yZzsgdHJhbUBpZXRmLm9yZw0KPiBTdWJqZWN0OiBSZTogW3RyYW1dIFtC RUhBVkVdIGVycmF0YSA0OTMzOiBSRkMgNTc2NiBwcmV2ZW50IHNwb29mZWQgcmVmcmVzaA0KPiBy ZXF1ZXN0cyB3aGVuIHVzaW5nIHNob3J0LXRlcm0gY3JlZGVudGlhbHMNCj4gDQo+IEhpLA0KPiAN Cj4gSSB0aGluayB0aGUgcHJpbWFyeSBxdWVzdGlvbiBpcyBpZiB0aGlzIGVycmF0YSBwb2ludHMg dG8gYW4gaXNzdWUgdGhhdCByZW1haW5zDQo+IHdpdGhpbiB0aGUgdXBkYXRlZCBUVVJOIHNwZWNp ZmljYXRpb246DQo+IA0KPiBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1p ZXRmLXRyYW0tdHVybmJpcy8NCj4gDQo+IFNvIHRoZSBxdWVzdGlvbiB0byB0aGUgVFJBTSBXRyBw ZW9wbGUuDQo+IA0KPiBTZWN0aW9uIDIxLjMuMy4gKHRoZSBlcXVpdmFsZW50IHRvIDE3LjMuMykg aGFzIHRoZSBzYW1lIHRleHQuIEhvd2V2ZXIsIEkgdGhpbmsNCj4gdGhlIHVuZGVybHlpbmcgcXVl c3Rpb24gaXMgaWYgdGhlIGV4aXN0aW5nIG1lY2hhbmlzbSBhbmQgZXNwZWNpYWxseSBmb3Igc3Rh bGUNCj4gbm9uY2UgcHJldmVudHMgYW4gaW5zaWRlciBhdHRhY2tlciB0aGF0IG90aGVyd2lzZSBo YXZlIHRoZSB1c2VyIG5hbWUgYW5kDQo+IHBhc3N3b3JkIGZvciB0aGUgdXNlciBjYW4gdGFrZSBv dmVyIGFuIGFsbG9jYXRpb24gd2hlbiB0aGUgbm9uY2UgZXhwaXJlcz8NCj4gDQo+IEhvd2V2ZXIs IEkgaGF2ZSB0aGUgc3VzcGlzdGlvbiB0aGF0IHRoZSByZXBvcnRlciBoYXMgbWFkZSBhbiBlcnJv bm91cw0KPiBhc3N1bXB0aW9uIGFzIHNob3J0LXRlcm0gc2VjdXJpdHkgaXMgbm90IGFsbG93ZWQg d2l0aCBUVVJOLiBTZWN0aW9uIDQgb2YgUkZDDQo+IDU3NjYgZG8gcmVxdWlyZXMgbG9uZy10ZXJt IG9yIG90aGVyIGVxdWFsIHN0cm9uZyBtZWNoYW5pc20uIFRodXMsIGFub3RoZXINCj4gYXNwZWN0 IGlzIGlmIHRoZSBub25jZSBhY3R1YWxseSB3aWxsIGV4cGlyZT8gT3IgY2FuIGEgY2xpZW50IGFj dHVhbGx5IGxvb3NlIHRoZWlyDQo+IGFsbG9jYXRpb25zIHdoZW4gdGhlIG5vbmNlIGV4cGlyZXMg YW5kIGF0dGFja2VyIG1hbmFnZXMgdG8gbWFrZSB0aGUNCj4gcmVxdWVzdCBmaXJzdD8NCj4gDQo+ IENoZWVycw0KPiANCj4gTWFnbnVzIFdlc3Rlcmx1bmQNCj4gDQo+IA0KPiBPbiBGcmksIDIwMjAt MDEtMTcgYXQgMTA6MDAgLTA4MDAsIEp1c3RpbiBVYmVydGkgd3JvdGU6DQo+ID4gQm90aCBhL2Ig c2VlbSBzZW5zaWJsZSB0byBtZS4NCj4gPg0KPiA+IE9uIFRodSwgSmFuIDE2LCAyMDIwIGF0IDU6 MjcgUE0gTWljaGFlbCBSaWNoYXJkc29uDQo+ID4gPG1jcitpZXRmQHNhbmRlbG1hbi5jYT4NCj4g PiB3cm90ZToNCj4gPiA+IGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2VycmF0YV9zZWFyY2gu cGhwP2VpZD00OTMzDQo+ID4gPg0KPiA+ID4gICAgIDQ5MzM+IFNlY3Rpb24gMTcuMy4zIHNheXM6 DQo+ID4gPg0KPiA+ID4gICAgIDQ5MzM+IEFuIGF0dGFja2VyIG1pZ2h0IGF0dGVtcHQgdG8gZGlz cnVwdCBzZXJ2aWNlIHRvIG90aGVyIHVzZXJzIG9mDQo+IHRoZQ0KPiA+ID4gICAgIDQ5MzM+IFRV Uk4gc2VydmVyIGJ5IHNlbmRpbmcgUmVmcmVzaCByZXF1ZXN0cyBvcg0KPiA+ID4gQ3JlYXRlUGVy bWlzc2lvbiByZXF1ZXN0cw0KPiA+ID4gICAgIDQ5MzM+IHRoYXQgKHRocm91Z2ggc291cmNlIGFk ZHJlc3Mgc3Bvb2ZpbmcpIGFwcGVhciB0byBiZSBjb21pbmcNCj4gZnJvbQ0KPiA+ID4gICAgIDQ5 MzM+IGFub3RoZXIgdXNlciBvZiB0aGUgVFVSTiBzZXJ2ZXIuICBUVVJOIHByZXZlbnRzIHRoaXMg YnkNCj4gcmVxdWlyaW5nDQo+ID4gPiAgICAgNDkzMz4gdGhhdCB0aGUgY3JlZGVudGlhbHMgdXNl ZCBpbiBDcmVhdGVQZXJtaXNzaW9uLCBSZWZyZXNoLCBhbmQNCj4gPiA+ICAgICA0OTMzPiBDaGFu bmVsQmluZCBtZXNzYWdlcyBtYXRjaCB0aG9zZSB1c2VkIHRvIGNyZWF0ZSB0aGUgaW5pdGlhbA0K PiA+ID4gICAgIDQ5MzM+IGFsbG9jYXRpb24uICBUaHVzLCB0aGUgZmFrZSByZXF1ZXN0cyBmcm9t IHRoZSBhdHRhY2tlciB3aWxsIGJlDQo+ID4gPiAgICAgNDkzMz4gcmVqZWN0ZWQuDQo+ID4gPiAg ICAgNDkzMz4gTm90ZXM6DQo+ID4gPg0KPiA+ID4gICAgIDQ5MzM+IFdoZW4gdXNpbmcgc2hvcnQt dGVybSwgY3JlZGVudGlhbHMgZXhwaXJlIGFmdGVyIGEgc3BlY2lmaWMNCj4gPiA+IGFtb3VudCBv ZiB0aW1lDQo+ID4gPiAgICAgNDkzMz4gKHN1Y2ggYXMgNQ0KPiA+ID4gICAgIDQ5MzM+IG1pbnV0 ZXMpIGFuZCBjbGllbnRzIGdldCBuZXcgY3JlZGVudGlhbHMuIFRoZSByZXN0cmljdGlvbg0KPiA+ ID4gaW1wb3NlZCBhdCBzZWN0aW9uDQo+ID4gPiAgICAgNDkzMz4gMTcuMy4zDQo+ID4gPiAgICAg NDkzMz4gcHJldmVudHMgZnJvbSByZWZyZXNoaW5nIGFsbG9jYXRpb24gb3IgcGVybWlzc2lvbiB1 c2luZw0KPiA+ID4gdGhlIG5ldyBjcmVkZW50aWFscy4NCj4gPiA+DQo+ID4gPiAgICAgNDkzMz4g VGhpcyBSRkMgYXBwcm92ZXMgUkZDIDUzODkuIFNvIG9uZSBjYW4gdXNlIHNob3J0LXRlcm0NCj4g Y3JlZGVudGlhbHMuDQo+ID4gPiBCdXQNCj4gPiA+ICAgICA0OTMzPiBzaG9ydC10ZXJtIGNyZWRl bnRpYWxzIGFyZSB1c2VsZXNzIGlmIGl0IGNhbiBub3QgYmUgdXNlZA0KPiA+ID4gdG8gcmVmcmVz aA0KPiA+ID4gICAgIDQ5MzM+IGFsbG9jYXRpb24gb3IgcGVybWlzc2lvbi4NCj4gPiA+DQo+ID4g PiAgICAgNDkzMz4gVGhlIGdvYWwgb2YgMTcuMy4zIGNhbiBiZSBhY2hpZXZlZCBieSBzZW5kaW5n IDQzOCB3aXRoIHRoZQ0KPiA+ID4gbmV3IG5vbmNlLg0KPiA+ID4NCj4gPiA+IGEpIEkgdGhpbmsg d2Ugc2hvdWxkIGFjY2VwdCB0aGlzIGFzIHZlcmlmaWVkLg0KPiA+ID4gYikgSXQgc2VlbXMgdGhh dCBzZW5kaW5nIHdpdGggdGhlIG5ldyBub25jZSB3aWxsIHdvcmsuICBUaGlzIHJlcXVpcmVzDQo+ IHNvbWUNCj4gPiA+ICAgIHRleHQgY2hhbmdlcywgYW5kIHdlIGNhbiBub3cgcGVyaGFwcyB1c2Ug dGhlIGVycmF0YSBwYXRjaGVyIHdpdGgNCj4gWE1MLi4NCj4gPiA+ICAgIEkndmUgYXNrZWQgZm9y IHRoZSBYTUwgKGlmIHRoZXJlIGlzIGFueSksIGFuZCBJJ2xsIHN1Z2dlc3Qgc29tZQ0KPiA+ID4g Y2hhbmdlcyB0bw0KPiA+ID4gICAgdGhlIHRleHQuDQo+ID4gPg0KPiA+ID4gLS0NCj4gPiA+IE1p Y2hhZWwgUmljaGFyZHNvbiA8bWNyK0lFVEZAc2FuZGVsbWFuLmNhPiwgU2FuZGVsbWFuIFNvZnR3 YXJlDQo+IFdvcmtzDQo+ID4gPiAtPSBJUHY2IElvVCBjb25zdWx0aW5nID0tDQo+ID4gPg0KPiA+ ID4NCj4gPiA+DQo+ID4gPg0KPiA+ID4gLS0NCj4gPiA+IE1pY2hhZWwgUmljaGFyZHNvbiA8bWNy K0lFVEZAc2FuZGVsbWFuLmNhPiwgU2FuZGVsbWFuIFNvZnR3YXJlDQo+IFdvcmtzDQo+ID4gPiAt PSBJUHY2IElvVCBjb25zdWx0aW5nID0tDQo+ID4gPg0KPiA+ID4NCj4gPiA+DQo+ID4gPiBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+ID4gQmVoYXZl IG1haWxpbmcgbGlzdA0KPiA+ID4gQmVoYXZlQGlldGYub3JnDQo+ID4gPiBodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2JlaGF2ZQ0KPiA+DQo+ID4gX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gPiBCZWhhdmUgbWFpbGluZyBsaXN0 DQo+ID4gQmVoYXZlQGlldGYub3JnDQo+ID4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9iZWhhdmUNCj4gLS0NCj4gQ2hlZXJzDQo+IA0KPiBNYWdudXMgV2VzdGVybHVuZA0K PiANCj4gDQo+IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCj4gTmV0d29ya3MsIEVyaWNzc29uIFJlc2VhcmNoDQo+ IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0NCj4gRXJpY3Nzb24gQUIgICAgICAgICAgICAgICAgIHwgUGhvbmUgICs0 NiAxMCA3MTQ4Mjg3DQo+IFRvcnNoYW1uc2dhdGFuIDIzICAgICAgICAgICB8IE1vYmlsZSArNDYg NzMgMDk0OTA3OQ0KPiBTRS0xNjQgODAgU3RvY2tob2xtLCBTd2VkZW4gfCBtYWlsdG86IG1hZ251 cy53ZXN0ZXJsdW5kQGVyaWNzc29uLmNvbQ0KPiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNCg==