Subject: [tram] DTLS: should it update RFC7064?

From: Simon Perreault <[email-masked]>
Date: Mon, 26 May 2014 13:44:18 -0400

This text in draft-ietf-tram-stun-dtls-02 section 4.1.1 struck me as 
potentially requiring an "Updates: 7064" mention in the header:

    The <host> value MUST be used when using the rules in Section 7.2.2
    of [RFC5389] to verify the server identity.  A STUN URI containing an
    IP address MUST be rejected, unless the domain is provided by the
    same mechanism that provided the STUN URI, and that this domain name
    can be passed to the verification code.

Yay or nay?

Simon

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Fri, 30 May 2014 03:52:30 -0600

Hi Simon,

Sorry, I missed this email.

>    can be passed to the verification code.

I do not think so.  We do not change the fact that a STUN (or TURN) URI
can contain an IP address, we simply state that when used to establish a
(D)TLS connection to a STUN/TURN server, an URI containing an IP address
must be rejected (unless a domain name can be provided in parallel).

This said, on the subject of Updates, a case can be made to have this
draft updating RFC 5928 and probably also RFC 5389 (early versions of
the draft had these).

-- 
Marc Petit-Huguenin
Developer  |  Jive Communications, Inc.
Jive.com  |  [email-masked]