Re: New Liaison Statement, "W3C WEBRTC WG to IETF MMUSIC WG"

Just read this now  and a few points ... 

1) I don't think this answer the questions asked.

2) the a and b miss the discussion of the context where this happens where things like a 2nd DTLS connection replacing a prior DTLS connection but on the same flow. 

I'm focused on getting JSEP completed right now so don't plan to spend time on this till somewhat later. 


> On Apr 21, 2017, at 6:44 AM, Flemming Andreasen <[email protected]> wrote:
> 
> Greetings MMUSIC.
> 
> The issue raised below has been discussed on the MMUSIC mailing (see thread starting at https://www.ietf.org/mail-archive/web/mmusic/current/msg17646.html) and the recent MMUSIC meeting at IETF 98 (Chicago). A summary discussion has been provided at https://github.com/w3c/webrtc-pc/pull/1026#issuecomment-291194679 as well.
> 
> Based on the above, we suggest to answer the liaison statement as follows:
> 
> <quote>
> Thank you for raising the question regarding playout of unverified media to the MMUSIC WG. We have looked further into the issue raised and we would like to request a clarification of the exact sequence of events that WEBRTC believes can lead to this. In particular, we ask you to please show either
> (a) how ICE can complete prior to DTLS fingerprint exchange, or
> (b) how media can be received prior to ICE completing
> 
> It is currently unclear to us how either of these situations can arise in which case we do not believe the issue raised would apply to WebRTC.
> 
> For further background information, please refer to:
> - https://www.ietf.org/mail-archive/web/mmusic/current/msg17646.html
> - https://github.com/w3c/webrtc-pc/pull/1026#issuecomment-291194679
> </quote>
> 
> Please let the chairs know (before April 28) if you have any comments.
> 
> Thanks
> 
> -- Flemming
> 
> 
> 
> On 4/3/17 11:30 AM, Liaison Statement Management Tool wrote:
>> Title: W3C WEBRTC WG to IETF MMUSIC WG
>> Submission Date: 2017-04-03
>> URL of the IETF Web page: https://datatracker.ietf.org/liaison/1511/
>> Please reply by 2017-04-16
>> From: Bernard Aboba <[email protected]>
>> To: Flemming Andreasen <[email protected]>,Bo Burman <[email protected]>
>> Cc: Adam Roach <[email protected]>,Flemming Andreasen <[email protected]>,Ben Campbell <[email protected]>,Bo Burman <[email protected]>,Alexey Melnikov <[email protected]>,Multiparty Multimedia Session Control Discussion List <[email protected]>
>> Response Contacts: [email protected], [email protected], [email protected]
>> Technical Contacts:
>> Purpose: For action
>> 
>> Body: Colleagues:
>> 
>> In the W3C WEBRTC WG, an issue has been submitted relating to playout of unverified media:
>> https://github.com/w3c/webrtc-pc/issues/849
>> 
>> It has been suggested that if the browser is configured to do so, that playout be allowed for a limited period
>> (e.g. 5 seconds) prior to fingerprint verification:
>> https://github.com/w3c/webrtc-pc/pull/1026
>> 
>> Section 6.2 of draft-ietf-mmusic-4572-update-13 contains the following text, carried over from RFC 4572:
>> 
>> Note that when the offer/answer model is being used, it is possible
>> for a media connection to outrace the answer back to the offerer.
>> Thus, if the offerer has offered a 'setup:passive' or 'setup:actpass'
>> role, it MUST (as specified in RFC 4145 [7]) begin listening for an
>> incoming connection as soon as it sends its offer. However, it MUST
>> NOT assume that the data transmitted over the TLS connection is valid
>> until it has received a matching fingerprint in an SDP answer. If
>> the fingerprint, once it arrives, does not match the client's
>> certificate, the server endpoint MUST terminate the media connection
>> with a bad_certificate error, as stated in the previous paragraph.
>> 
>> Given the outstanding issue relating to handling of unverified media, the Chairs of the W3C WEBRTC WG
>> would like to request clarification from the IETF MMUSIC WG as to the meaning of the "MUST NOT" in the
>> above paragraph. In particular, what is it permitted for a WebRTC implementation to do with received data prior
>> to verification? For example:
>> 
>> 1. May data received over the data channel be provided to the web application prior to verification?
>> 2. May received media be played out prior to verification?
>> Attachments:
>> 
>>     webrtc-liason-to-mmusic copy.pdf
>>     https://www.ietf.org/lib/dt/documents/LIAISON/liaison-2017-04-03-w3c-webrtc-mmusic-w3c-webrtc-wg-to-ietf-mmusic-wg-attachment-1.pdf
>> 
>> .
>> 
> 
> _______________________________________________
> mmusic mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/mmusic