Subject: [core] Suresh Krishnan's Discuss on draft-ietf-core-http-mapping-14: (with DISCUSS and COMMENT)

From: "Suresh Krishnan" <[email-masked]>
Date: Tue, 27 Sep 2016 16:17:43 -0700

Suresh Krishnan has entered the following ballot position for
draft-ietf-core-http-mapping-14: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-core-http-mapping/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thanks for this well written draft. I do have a concern about some
missing behavior. When an IPv6 literal is used the percent encoded square
brackets need to be reverted to their non-percent-encoded form on the
HTTP server in order to be compliant with RFC7252 that uses IP-literal
from RFC3986 for the host component. This is not specified anywhere in
the document.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Just thinking out loud here (Maybe I am being paranoid). There does not
seem to be any kind of limitations on the IPv6 address part of the coap
URI. What stops someone from sticking in a multicast address into the
coap URI (such as the FF0X::FD All CoAP Nodes address) to use the proxy
as DoS attack amplifier?

---

From: "Fossati, Thomas (Nokia - GB)" <[email-masked]>
Date: Tue, 27 Sep 2016 23:50:06 +0000

Hi Suresh,

>https://datatracker.ietf.org/doc/draft-ietf-core-http-mapping/

Thanks!  Would a note in section 5.3.2 work for you?

OLD:

When the authority of the Target CoAP URI is given as an IPv6address,
   then the surrounding square brackets must be percent-encoded in the
   Hosting HTTP URI, in order to comply with the syntax defined in
   Section 3.3. of [RFC3986] for a URI path segment.  E.g.:
   coap://[2001:db8::1]/light?on becomes
   http://p.example.com/hc/coap://%5B2001:db8::1%5D/light?on.

Everything else can be safely copied verbatim from the Target CoAP
   URI to the Hosting HTTP URI.

NEW:

When the authority of the Target CoAP URI is given as an IPv6address,
then the surrounding square brackets must be percent-encoded in the
Hosting HTTP URI, in order to comply with the syntax defined in
Section 3.3. of [RFC3986] for a URI path segment. E.g.:
coap://[2001:db8::1]/light?on becomes
http://p.example.com/hc/coap://%5B2001:db8::1%5D/light?on.

Note that the percent-encoded square brackets shall be reverted to
their non-percent-encoded form when the HC proxy unpacks the Target
CoAP URI.

Everything else can be safely copied verbatim from the Target CoAP
   URI to the Hosting HTTP URI.

It makes no difference how the host is specified in the CoAP URI (as an
IP-literal, IPv4 or "registered name").  It still has to be resolved to an
IP address, and as soon as it's resolved the HC proxy can test if
IN6_IS_ADDR_MULTICAST or IN_MULTICAST.  If it is, then the security
consideration in section 10.1 apply: "It is RECOMMENDED that the requestor
of a multicast resource is strongly authenticated."

Does that address your concern?

Cheers, t

---

From: Suresh Krishnan <[email-masked]>
Date: Wed, 28 Sep 2016 00:56:16 +0000

Hi Thomas,
   Your suggested text works for me. I will clear as soon as the new version 
hits.

Regards
Suresh

---

From: "Fossati, Thomas (Nokia - GB)" <[email-masked]>
Date: Wed, 28 Sep 2016 08:19:07 +0000

Hi Suresh,

>   Your suggested text works for me. I will clear as soon as the new

OK, thanks.  Your new text is in my working copy together with Kathleen's.
 I want to process all IESG reviews before pushing a new version though.

Cheers, t

>>> Please refer to
>>>https://www.ietf.org/iesg/statement/discuss-criteria.html