Subject: [xmpp] Special-casing of roster set routing

From: Paul Aurich <[email-masked]>
Date: Wed, 14 Apr 2010 21:50:48 -0700

As discussed several (wow, actually many) months ago [1], the section on
Roster Sets (2.1.4 now) includes the text "The server MUST ignore any
'to' address specified on the IQ...".

There seemed to be consensus at the time that the special-casing there
was undesirable and that it should be replaced with a note about
verifying that the sender is authorized to perform the set, but I just
noticed that the text is still there in -06.

Have I forgotten some intervening discussion?

~Paul

[1] http://www.ietf.org/mail-archive/web/xmpp/current/msg00024.html

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 15 Apr 2010 09:17:21 -0600

> Have I forgotten some intervening discussion?

I think the spec editor neglected to fix this. Will do in the next version.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 21 Apr 2010 15:37:57 -0600

> I think the spec editor neglected to fix this. Will do in the next version.

We never settled on text. I suggest the following...

###

      Note: Traditionally, the IQ stanza of the roster set has included
      no 'to' address (and special-case checking of such IQ stanzas was
      encouraged by the predecessor to this specification), with the
      result all roster sets were sent from an authenticated resource of
      the account whose roster was being updated.  However, the special-
      casing is no longer encouraged; therefore, if the roster set
      includes a 'to' address then the server MUST verify that the
      sender of the roster set is authorized to update the roster, and
      if not return a <forbidden/> error.

###

And naturally we'll need to provide examples of that error flow.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 21 Apr 2010 16:08:54 -0600

>       if not return a <forbidden/> error.

I think this is clearer:

      Note: Traditionally, the IQ stanza of the roster set included no
      'to' address, with the result all roster sets were sent from an
      authenticated resource of the account whose roster was being
      updated.  In addition, the predecessor to this specification
      required a server to perform special-case checking of roster set
      stanzas to ignore the 'to' address; however, this specification
      has removed that special-casing, which means that a roster set
      stanza might include a 'to' address other than that of the sender.
      Therefore, the server MUST verify that the sender of the roster
      set stanza is authorized to update the roster, and if not return a
      <forbidden/> error.

/psa

---

From: Matthew Wild <[email-masked]>
Date: Wed, 21 Apr 2010 22:25:35 +0100

>       set stanza is authorized to update the roster, and if not return a

+1, I think it is. However I'm not convinced we even need to mention the
historical part at all (and therefore increase clarity further).

Any server MUST verify the sender is authorized to access/modify the roster
and that's that, it seems pretty clear and is unrelated to whether the
previous spec required servers to ignore 'to' addresses.

Thoughts?

Matthew

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 21 Apr 2010 17:16:15 -0600

> previous spec required servers to ignore 'to' addresses.

Yes, that's that, but it's a change from RFC 3921 so I think it's
helpful to call out the change so that client and server developers know
that they need to pay special attention to something with such
significant security implications. Or would you rather that this go in
the security considerations section of rfc3291bis?

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Matthew Wild <[email-masked]>
Date: Wed, 21 Apr 2010 23:21:05 +0100

> the security considerations section of rfc3291bis?

That would work for me. Though I really don't want to make a fuss, I'm
sure the text you proposed would suffice as-is.

Matthew, trying not to be too pedantic

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 21 Apr 2010 22:02:13 -0600

> sure the text you proposed would suffice as-is.

OK.

> Matthew, trying not to be too pedantic

Me, too. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Kevin Smith <[email-masked]>
Date: Thu, 22 Apr 2010 09:08:26 +0100

>      set stanza is authorized to update the roster, and if not return a

I'm happy with this text, an would run with this. I think it's helpful
to call out the changes.

/K

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 22 Apr 2010 05:52:59 -0600

> I'm happy with this text, an would run with this. I think it's helpful

OK. In 3920bis-07 I'll include that text and add an example for
<forbidden/> on a roster set.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/