draft-ietf-avtcore-rfc5764-mux-fixes-01.txt   draft-ietf-avtcore-rfc5764-mux-fixes-02.txt 
AVTCORE M. Petit-Huguenin AVTCORE M. Petit-Huguenin
Internet-Draft Impedance Mismatch Internet-Draft Impedance Mismatch
Updates: 5764 (if approved) G. Salgueiro Updates: 5764 (if approved) G. Salgueiro
Intended status: Standards Track Cisco Systems Intended status: Standards Track Cisco Systems
Expires: September 25, 2015 March 24, 2015 Expires: September 25, 2015 March 24, 2015
Multiplexing Scheme Updates for Secure Real-time Transport Protocol Multiplexing Scheme Updates for Secure Real-time Transport Protocol
(SRTP) Extension for Datagram Transport Layer Security (DTLS) (SRTP) Extension for Datagram Transport Layer Security (DTLS)
draft-ietf-avtcore-rfc5764-mux-fixes-01 draft-ietf-avtcore-rfc5764-mux-fixes-02
Abstract Abstract
This document defines how Datagram Transport Layer Security (DTLS), This document defines how Datagram Transport Layer Security (DTLS),
Real-time Transport Protocol (RTP), Real-time Transport Control Real-time Transport Protocol (RTP), Real-time Transport Control
Protocol (RTCP), Session Traversal Utilities for NAT (STUN), Protocol (RTCP), Session Traversal Utilities for NAT (STUN), and
Traversal Using Relays around NAT (TURN), and Stream Control Traversal Using Relays around NAT (TURN) packets are multiplexed on a
Transmission Protocol (SCTP) over UDP packets are multiplexed on a
single receiving socket. It overrides the guidance from SRTP single receiving socket. It overrides the guidance from SRTP
Extension for DTLS [RFC5764], which suffered from three issues Extension for DTLS [RFC5764], which suffered from three issues
described and fixed in this document. described and fixed in this document.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
skipping to change at page 2, line 14 skipping to change at page 2, line 13
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Implicit Allocation of Codepoints for New STUN Methods . 3 1.1. Implicit Allocation of Codepoints for New STUN Methods . 3
1.2. Multiplexing Byte Allocation for SCTP over UDP . . . . . 4 1.2. Implicit Allocation of New Codepoints for TLS
1.3. Implicit Allocation of New Codepoints for TLS
ContentTypes . . . . . . . . . . . . . . . . . . . . . . 4 ContentTypes . . . . . . . . . . . . . . . . . . . . . . 4
1.4. Multiplexing of TURN Channels . . . . . . . . . . . . . . 5 1.3. Multiplexing of TURN Channels . . . . . . . . . . . . . . 5
1.5. Demultiplexing Algorithm Test Order . . . . . . . . . . . 6 1.4. Demultiplexing Algorithm Test Order . . . . . . . . . . . 6
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 6 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 6
3. RFC 5764 Updates . . . . . . . . . . . . . . . . . . . . . . 6 3. RFC 5764 Updates . . . . . . . . . . . . . . . . . . . . . . 6
4. Implementation Status . . . . . . . . . . . . . . . . . . . . 8 4. Implementation Status . . . . . . . . . . . . . . . . . . . . 7
5. Security Considerations . . . . . . . . . . . . . . . . . . . 8 5. Security Considerations . . . . . . . . . . . . . . . . . . . 8
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8
6.1. STUN Methods . . . . . . . . . . . . . . . . . . . . . . 8 6.1. STUN Methods . . . . . . . . . . . . . . . . . . . . . . 8
6.2. TLS ContentType . . . . . . . . . . . . . . . . . . . . . 9 6.2. TLS ContentType . . . . . . . . . . . . . . . . . . . . . 9
6.3. TURN Channel Numbers . . . . . . . . . . . . . . . . . . 9 6.3. TURN Channel Numbers . . . . . . . . . . . . . . . . . . 9
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 9
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 10 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 10
8.1. Normative References . . . . . . . . . . . . . . . . . . 10 8.1. Normative References . . . . . . . . . . . . . . . . . . 10
8.2. Informative References . . . . . . . . . . . . . . . . . 11 8.2. Informative References . . . . . . . . . . . . . . . . . 10
Appendix A. Release notes . . . . . . . . . . . . . . . . . . . 11 Appendix A. Release notes . . . . . . . . . . . . . . . . . . . 11
A.1. Modifications between draft-ietf-avtcore-rfc5764-mux- A.1. Modifications between draft-ietf-avtcore-rfc5764-mux-
fixes-01 and draft-ietf-avtcore-rfc5764-mux-fixes-00 . . 11 fixes-01 and draft-ietf-avtcore-rfc5764-mux-fixes-00 . . 11
A.2. Modifications between draft-ietf-avtcore-rfc5764-mux- A.2. Modifications between draft-ietf-avtcore-rfc5764-mux-
fixes-01 and draft-ietf-avtcore-rfc5764-mux-fixes-00 . . 11
A.3. Modifications between draft-ietf-avtcore-rfc5764-mux-
fixes-00 and draft-petithuguenin-avtcore-rfc5764-mux- fixes-00 and draft-petithuguenin-avtcore-rfc5764-mux-
fixes-02 . . . . . . . . . . . . . . . . . . . . . . . . 12 fixes-02 . . . . . . . . . . . . . . . . . . . . . . . . 12
A.3. Modifications between draft-petithuguenin-avtcore-rfc5764 A.4. Modifications between draft-petithuguenin-avtcore-rfc5764
-mux-fixes-00 and draft-petithuguenin-avtcore-rfc5764 -mux-fixes-00 and draft-petithuguenin-avtcore-rfc5764
-mux-fixes-01 . . . . . . . . . . . . . . . . . . . . . . 12 -mux-fixes-01 . . . . . . . . . . . . . . . . . . . . . . 12
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 12 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 12
1. Introduction 1. Introduction
Section 5.1.2 of Secure Real-time Transport Protocol (SRTP) Extension Section 5.1.2 of Secure Real-time Transport Protocol (SRTP) Extension
for DTLS [RFC5764] defines a scheme for a Real-time Transport for DTLS [RFC5764] defines a scheme for a Real-time Transport
Protocol (RTP) [RFC3550] receiver to demultiplex Datagram Transport Protocol (RTP) [RFC3550] receiver to demultiplex Datagram Transport
Layer Security (DTLS) [RFC6347], Session Traversal Utilities for NAT Layer Security (DTLS) [RFC6347], Session Traversal Utilities for NAT
(STUN) [RFC5389] and Secure Real-time Transport Protocol (STUN) [I-D.ietf-tram-stunbis] and Secure Real-time Transport
(SRTP)/Secure Real-time Transport Control Protocol (SRTCP) [RFC3711] Protocol (SRTP)/Secure Real-time Transport Control Protocol (SRTCP)
packets that are arriving on the RTP port. Unfortunately, this [RFC3711] packets that are arriving on the RTP port. Unfortunately,
demultiplexing scheme has created problematic issues: this demultiplexing scheme has created problematic issues:
1. It implicitly allocated codepoints for new STUN methods without 1. It implicitly allocated codepoints for new STUN methods without
an IANA registry reflecting these new allocations. an IANA registry reflecting these new allocations.
2. It implicitly allocated codepoints for new Transport Layer 2. It implicitly allocated codepoints for new Transport Layer
Security (TLS) ContentTypes without an IANA registry reflecting Security (TLS) ContentTypes without an IANA registry reflecting
these new allocations. these new allocations.
3. It did not take into account the fact that the Traversal Using 3. It did not take into account the fact that the Traversal Using
Relays around NAT (TURN) usage of STUN can create TURN channels Relays around NAT (TURN) usage of STUN can create TURN channels
skipping to change at page 4, line 14 skipping to change at page 4, line 14
0x000-0x7FF IETF Review 0x000-0x7FF IETF Review
0x800-0xFFF Designated Expert 0x800-0xFFF Designated Expert
NEW: NEW:
0x000-0x07F IETF Review 0x000-0x07F IETF Review
0x080-0x0FF Designated Expert 0x080-0x0FF Designated Expert
0x100-0xFFF Reserved 0x100-0xFFF Reserved
1.2. Multiplexing Byte Allocation for SCTP over UDP 1.2. Implicit Allocation of New Codepoints for TLS ContentTypes
[I-D.ietf-tram-stunbis] defines two new transports for STUN, SCTP
over UDP and SCTP over DTLS over UDP. This document allocates the
value 5 as to multiplex SCTP over STUN. This value restricts the
source and destination port numbers that can be used by SCTP over
UDP.
1.3. Implicit Allocation of New Codepoints for TLS ContentTypes
The demultiplexing scheme in [RFC5764] dictates that if the value of The demultiplexing scheme in [RFC5764] dictates that if the value of
the first byte is between 20 and 63 (inclusive), then the packet is the first byte is between 20 and 63 (inclusive), then the packet is
identified to be DTLS. The problem that arises is that this identified to be DTLS. The problem that arises is that this
restricts the TLS ContentType codepoints (as defined in Section 12 of restricts the TLS ContentType codepoints (as defined in Section 12 of
[RFC5246]) to this range, and by extension implicitly allocates [RFC5246]) to this range, and by extension implicitly allocates
ContentType codepoints 0 to 19 and 64 to 255. Unlike STUN, TLS is a ContentType codepoints 0 to 19 and 64 to 255. Unlike STUN, TLS is a
mature protocol that is already well established and widely mature protocol that is already well established and widely
implemented and thus we expect only relatively few new codepoints to implemented and thus we expect only relatively few new codepoints to
be assigned in the future. With respect to TLS packet be assigned in the future. With respect to TLS packet
skipping to change at page 5, line 14 skipping to change at page 5, line 5
0-19 Reserved (MUST be allocated with Standards Action) 0-19 Reserved (MUST be allocated with Standards Action)
20 change_cipher_spec 20 change_cipher_spec
21 alert 21 alert
22 handshake 22 handshake
23 application_data 23 application_data
24 heartbeat 24 heartbeat
25-63 Unassigned 25-63 Unassigned
64-255 Reserved (MUST be allocated with Standards Action) 64-255 Reserved (MUST be allocated with Standards Action)
1.4. Multiplexing of TURN Channels 1.3. Multiplexing of TURN Channels
When used with ICE [RFC5245], an RFC 5764 implementation can receive When used with ICE [RFC5245], an RFC 5764 implementation can receive
packets on the same socket from three different paths, as shown in packets on the same socket from three different paths, as shown in
Figure 1: Figure 1:
1. Directly from the source 1. Directly from the source
2. Through a NAT 2. Through a NAT
3. Relayed by a TURN server 3. Relayed by a TURN server
skipping to change at page 6, line 21 skipping to change at page 6, line 14
In order to prevent future documents from assigning values from the In order to prevent future documents from assigning values from the
unused range to a new protocol, this document modifies the RFC 5764 unused range to a new protocol, this document modifies the RFC 5764
demultiplexing algorithm to properly account for TURN channels by demultiplexing algorithm to properly account for TURN channels by
allocating the values from 64 to 79 for this purpose. allocating the values from 64 to 79 for this purpose.
An implementation that uses the source IP address and port to An implementation that uses the source IP address and port to
identify TURN channel messages MAY not need to restrict the channel identify TURN channel messages MAY not need to restrict the channel
numbers to the above range. numbers to the above range.
1.5. Demultiplexing Algorithm Test Order 1.4. Demultiplexing Algorithm Test Order
This document also changes the demultiplexing algorithm by imposing This document also changes the demultiplexing algorithm by imposing
the order in which the first byte is tested against the list of the order in which the first byte is tested against the list of
existing protocol ranges. This is done in order to ensure that all existing protocol ranges. This is done in order to ensure that all
implementations fail identically in the presence of a new range. implementations fail identically in the presence of a new range.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "MAY", and "OPTIONAL" The key words "MUST", "MUST NOT", "REQUIRED", "MAY", and "OPTIONAL"
in this document are to be interpreted as described in [RFC2119] when in this document are to be interpreted as described in [RFC2119] when
skipping to change at page 7, line 23 skipping to change at page 7, line 23
Figure 3: The DTLS-SRTP receiver's packet demultiplexing algorithm. Figure 3: The DTLS-SRTP receiver's packet demultiplexing algorithm.
Here the field B denotes the leading byte of the packet. Here the field B denotes the leading byte of the packet.
END OLD TEXT END OLD TEXT
NEW TEXT NEW TEXT
The process for demultiplexing a packet is as follows. The receiver The process for demultiplexing a packet is as follows. The receiver
looks at the first byte of the packet. If the value of this byte is looks at the first byte of the packet. If the value of this byte is
in between 0 and 3 (inclusive), then the packet is STUN. Then if the in between 0 and 3 (inclusive), then the packet is STUN. Then if the
value is 5, then the packet is SCTP. Then if the value is between 20 value is between 20 and 63 (inclusive), the packet is DTLS. Then if
and 63 (inclusive), the packet is DTLS. Then if the value is between the value is between 64 and 79 (inclusive), the packet is TURN
64 and 79 (inclusive), the packet is TURN Channel. Then if the value Channel. Then if the value is in between 128 and 191 (inclusive),
is in between 128 and 191 (inclusive), then the packet is RTP (or then the packet is RTP (or RTCP, if both RTCP and RTP are being
RTCP, if both RTCP and RTP are being multiplexed over the same multiplexed over the same destination port). Else if the value does
destination port). Else if the value does not match any known range not match any known range then the packet MUST be dropped and an
then the packet MUST be dropped and an alert MAY be logged. This alert MAY be logged. This process is summarized in Figure 3. When
process is summarized in Figure 3. When new values or ranges are new values or ranges are added, they MUST be tested in ascending
added, they MUST be tested in ascending order. order.
+----------------+ +----------------+
| [0..3] -+--> forward to STUN | [0..3] -+--> forward to STUN
| | | |
| 5 -+--> forward to SCTP
| |
packet --> | [20..63] -+--> forward to DTLS packet --> | [20..63] -+--> forward to DTLS
| | | |
| [64..79] -+--> forward to TURN Channel | [64..79] -+--> forward to TURN Channel
| | | |
| [128..191] -+--> forward to RTP | [128..191] -+--> forward to RTP
+----------------+ +----------------+
Figure 3: The DTLS-SRTP receiver's packet demultiplexing algorithm. Figure 3: The DTLS-SRTP receiver's packet demultiplexing algorithm.
END NEW TEXT END NEW TEXT
skipping to change at page 9, line 4 skipping to change at page 8, line 47
This specification contains the registration information for reserved This specification contains the registration information for reserved
STUN Methods codepoints, as explained in Section 1.1 and in STUN Methods codepoints, as explained in Section 1.1 and in
accordance with the procedures defined in Section 18.1 of [RFC5389]. accordance with the procedures defined in Section 18.1 of [RFC5389].
Value: 0x100-0xFFF Value: 0x100-0xFFF
Name: Reserved (MUST be allocated with IETF Review) Name: Reserved (MUST be allocated with IETF Review)
Reference: RFC5764, RFCXXXX Reference: RFC5764, RFCXXXX
This specification also reassigns the ranges in the STUN Methods This specification also reassigns the ranges in the STUN Methods
Registry as follow: Registry as follow:
Range: 0x000-0x07F Range: 0x000-0x07F
Registration Procedures: IETF Review Registration Procedures: IETF Review
Range: 0x080-0x0FF Range: 0x080-0x0FF
Registration Procedures: Designated Expert Registration Procedures: Designated Expert
6.2. TLS ContentType 6.2. TLS ContentType
This specification contains the registration information for reserved This specification contains the registration information for reserved
TLS ContentType codepoints, as explained in Section 1.3 and in TLS ContentType codepoints, as explained in Section 1.2 and in
accordance with the procedures defined in Section 12 of [RFC5246]. accordance with the procedures defined in Section 12 of [RFC5246].
Value: 0-19 Value: 0-19
Description: Reserved (MUST be allocated with Standards Action) Description: Reserved (MUST be allocated with Standards Action)
DTLS-OK: N/A DTLS-OK: N/A
Reference: RFC5764, RFCXXXX Reference: RFC5764, RFCXXXX
skipping to change at page 9, line 40 skipping to change at page 9, line 35
Description: Reserved (MUST be allocated with Standards Action) Description: Reserved (MUST be allocated with Standards Action)
DTLS-OK: N/A DTLS-OK: N/A
Reference: RFC5764, RFCXXXX Reference: RFC5764, RFCXXXX
6.3. TURN Channel Numbers 6.3. TURN Channel Numbers
This specification contains the registration information for reserved This specification contains the registration information for reserved
TURN Channel Numbers codepoints, as explained in Section 1.4 and in TURN Channel Numbers codepoints, as explained in Section 1.3 and in
accordance with the procedures defined in Section 18 of [RFC5766]. accordance with the procedures defined in Section 18 of [RFC5766].
Value: 0x5000-0xFFFF Value: 0x5000-0xFFFF
Name: Reserved Name: Reserved
Reference: RFCXXXX Reference: RFCXXXX
[RFC EDITOR NOTE: Please replace RFCXXXX with the RFC number of this [RFC EDITOR NOTE: Please replace RFCXXXX with the RFC number of this
document.] document.]
skipping to change at page 11, line 34 skipping to change at page 11, line 28
Utilities for NAT (STUN)", draft-ietf-tram-stunbis-02 Utilities for NAT (STUN)", draft-ietf-tram-stunbis-02
(work in progress), March 2015. (work in progress), March 2015.
Appendix A. Release notes Appendix A. Release notes
This section must be removed before publication as an RFC. This section must be removed before publication as an RFC.
A.1. Modifications between draft-ietf-avtcore-rfc5764-mux-fixes-01 and A.1. Modifications between draft-ietf-avtcore-rfc5764-mux-fixes-01 and
draft-ietf-avtcore-rfc5764-mux-fixes-00 draft-ietf-avtcore-rfc5764-mux-fixes-00
o Remove any discussion about SCTP until a consensus emerges in
TRAM.
A.2. Modifications between draft-ietf-avtcore-rfc5764-mux-fixes-01 and
draft-ietf-avtcore-rfc5764-mux-fixes-00
o Instead of allocating the values that are common on each registry, o Instead of allocating the values that are common on each registry,
the specification now only reserves them, giving the possibility the specification now only reserves them, giving the possibility
to allocate them in case muxing is irrelevant. to allocate them in case muxing is irrelevant.
o STUN range is now 0-3m with 2-3 being Designated Expert. o STUN range is now 0-3m with 2-3 being Designated Expert.
o TLS ContentType 0-19 and 64-255 are now reserved. o TLS ContentType 0-19 and 64-255 are now reserved.
o Add SCTP over UDP value. o Add SCTP over UDP value.
skipping to change at page 12, line 7 skipping to change at page 12, line 7
TURN channels packets then the whole channel numbers are TURN channels packets then the whole channel numbers are
available. available.
o If not the prefix is between 64 and 79. o If not the prefix is between 64 and 79.
o First byte test order is now by incremental values, so failure is o First byte test order is now by incremental values, so failure is
deterministic. deterministic.
o Redraw the demuxing diagram. o Redraw the demuxing diagram.
A.2. Modifications between draft-ietf-avtcore-rfc5764-mux-fixes-00 and A.3. Modifications between draft-ietf-avtcore-rfc5764-mux-fixes-00 and
draft-petithuguenin-avtcore-rfc5764-mux-fixes-02 draft-petithuguenin-avtcore-rfc5764-mux-fixes-02
o Adoption by WG. o Adoption by WG.
o Add reference to STUNbis. o Add reference to STUNbis.
A.3. Modifications between draft-petithuguenin-avtcore-rfc5764-mux- A.4. Modifications between draft-petithuguenin-avtcore-rfc5764-mux-
fixes-00 and draft-petithuguenin-avtcore-rfc5764-mux-fixes-01 fixes-00 and draft-petithuguenin-avtcore-rfc5764-mux-fixes-01
o Change affiliation. o Change affiliation.
Authors' Addresses Authors' Addresses
Marc Petit-Huguenin Marc Petit-Huguenin
Impedance Mismatch Impedance Mismatch
Email: marc@petit-huguenin.org Email: marc@petit-huguenin.org
 End of changes. 22 change blocks. 
43 lines changed or deleted 39 lines changed or added

This html diff was produced by rfcdiff 1.42. The latest version is available from http://tools.ietf.org/tools/rfcdiff/