Subject: [xmpp] Alexey's COMMENTs as of 2010-12-12

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 20 Dec 2010 12:16:05 -0700

Hi Alexey (cc'ing the XMPP WG list),

On 2010-12-12 you updated your DISCUSS and COMMENT regarding
draft-ietf-xmpp-3920bis. Here are some replies to the unclosed issues...

Regarding your DISCUSS about SASL error handling, I think we are close
to resolution in another thread, so I won't mention that here.

You have the following COMMENTs:

1. Stream Attributes (Section 4.6)

###

   The attributes of the root <stream/> element are defined in the
   following sections.

      Security Note: Until and unless the confidentiality and integrity
      of a stream header is ensured via Transport Layer Security as
      described under Section 5, the attributes provided in a stream
      header could be tampered with by an attacker.

Or SASL security layer (e.g. GSSAPI).

###

In my working copy, I have:

      Security Warning: Until and unless the confidentiality and
      integrity of the stream are protected via TLS as described under
      Section 5 or an equivalent security layer (such as the SASL GSSAPI
      mechanism), the attributes provided in a stream header could be
      tampered with by an attacker.

Perhaps I adjusted that after I submitted the latest version.

2. policy-violation stanza error condition (Section 8.3.3.13)

###

   The entity has violated some local service policy (e.g., a message
   contains words that are prohibited by the service); the server MAY
   choose to specify the policy in the <text/> element or in an
   application-specific condition element; the associated error type
   SHOULD be "modify" or "wait" depending on the policy being violated.

   (In the following example, the client sends an XMPP message that is
   too large according to the server's local service policy.)

It might be better to change the description to mention prohibited words
(e.g.
"!!!").
Otherwise this looks too similar to <not-acceptable/>.

   C: <message from=[email-masked]/foo'
               to=[email-masked]'
               id='vq71f4nb'>
        <body>%#&@^!!!</body>
      </message>

###

In my working copy I have:

###

8.3.3.12.  policy-violation

   The entity has violated some local service policy (e.g., a message
   contains words that are prohibited by the service) and the server MAY
   choose to specify the policy in the <text/> element or in an
   application-specific condition element; the associated error type
   SHOULD be "modify" or "wait" depending on the policy being violated.

   (In the following example, the client sends an XMPP message
   containing words that are forbidden according to the server's local
   service policy.)

   C: <message from=[email-masked]/foo'
               to=[email-masked]'
               id='vq71f4nb'>
        <body>%#&@^!!!</body>
      </message>

   S: <message from=[email-masked]'
               id='vq71f4nb'
               to=[email-masked]/foo'>
        <error by='example.net' type='modify'>
          <policy-violation
              xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
        </error>
      </message>

###

3. terminology issue

###

      Service providers SHOULD include the
      DNS-ID identifier type in certificate requests.

XMPP Service providers?

###

Done in my working copy.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/