Re: [Stox] SIPS URIs and SIP/XMPP gateways - WAS: review: stox-core-04

["Olle E. Johansson" <[e-mail]>]

30 sep 2013 kl. 15:37 skrev Robert Sparks <[e-mail]>:

> On 9/29/13 8:55 PM, Peter Saint-Andre wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> 
>> On 9/27/13 10:14 AM, Peter Saint-Andre wrote:
>>> On 9/27/13 7:46 AM, Robert Sparks wrote:
>>>> (Adding Jon)
>>>> Peter - is there nothing in XMPP that lets a client say "I want
>>>> this to use secure transports only - have it fail rather than
>>>> use an insecure transport anywhere along its delivery path?"
>>> No. That doesn't mean we don't need it (although in general people
>>> have thought we *wouldn't* need it if we could just define an
>>> end-to-end encryption method that solve all the relevant use
>>> cases).
>>> 
>>>> That's the primary property you should discuss. Without putting
>>>> a lot of thinking into it, I suspect that if you _don't_ have a
>>>> way to express that available (which is what I'm taking away from
>>>> your last sentence), the right guidance in the document is to
>>>> refuse to gateway a SIP request that expresses that requirement.
>>> Indeed, that seems correct.
>>> 
>>> Thanks for the guidance.
>> Here is proposed text:
>> 
>>    As specified in Section 26.4.4 of [RFC3261], a To header or a
>>    Request-URI containing a SIPS URI is used to indicate that all hops
>>    in a communication path need to be protected using Transport Layer
>>    Security [RFC5246].  Because XMPP lacks a way to signal that all hops
>>    need to be encrypted, if the To header or Request-URI of a SIP
>>    message is a SIPS URI then the SIP-to-XMPP gateway MUST NOT translate
>>    the SIP message into an XMPP stanza and MUST NOT route it to the
>>    destination XMPP server.
> wfm. You might also talk about not using sips when going XMPP->SIP.
> If you haven't found it already, see also RFC5630.

Agree. It will help a lot of developers to explain that even if you find NAPTR
records indicating that a destination ONLY supports TLS connections,
you will look up _sips._tcp in SRV but this does NOT mean that you are going
to use a SIPS: uri. The _sips SRV tag and the SIPS: uri are unfortunately
very similar but not directly related in a confusing way :-)

/O