Re: [tram] STUNBIS: TLS verification

Sorry for delay but just getting around to this.

Thanks Olle and Martin for raising this point. For points 1, 3, 4 we have aligned the TLS verification to RFC 6125.  As for point 2, we agree the DNSSEC case is important but the WG has decided not to include using DANE to validate TLS certificates for STUN (draft-petithuguenin-tram-stun-dane<https://tools.ietf.org/html/draft-petithuguenin-tram-stun-dane-04>), so it will need to be handled separately and not as part of this STUNbis effort.

Cheers,

Gonzalo

On Jul 26, 2016, at 1:33 AM, Olle E. Johansson <oej@edvina.net<mailto:oej@edvina.net>> wrote:

On 26 Jul 2016, at 10:22, Martin Thomson <martin.thomson@gmail.com<mailto:martin.thomson@gmail.com>> wrote:

I agree that 6125 is best here.  Simple answers:

On 26 July 2016 at 09:02, Olle E. Johansson <oej@edvina.net<mailto:oej@edvina.net>> wrote:
1) Configured STUN server name: “sollentuna.example.com<http://sollentuna.example.com>”
  Server redirects to “stockholm.example.com<http://stockholm.example.com>”  - which name needs to be in the cert?

If the redirect is authenticated, then it can be stockholm
“can be”  :-)
In SIP we always compare with the original URI and avoid redirections.
In that case it’s “sollentuna”. This is clearly something that needs to be documented.
In 6125 lingo, the server name “sollentuna.example.com<http://sollentuna.example.com>” is the reference identifier.
What you propose is that a STUN redirect change the reference identifier
which I’m fine with. The first STUN server needs a cert for sollentuna.example.com<http://sollentuna.example.com>
so we clearly trust that server. The redirect goes to stockholm and the
cert in that server needs to verify for Stockholm.
I think that case needs to be clear in stunbis.

2) Configured STUN server name: “orust.example.com<http://orust.example.com>”
  DNS SRV leads to “arlanda.example.net<http://arlanda.example.net>” as first selection
  - which name needs to be in the cert?

orust - we don't trust the DNS
Ok, let’s take the DNSsec case later. Marc and I had a draft on that earlier that we
need to revive after this is done.

3) Configured STUN server name: “bromma.example.com<http://bromma.example.com>”
   Certficate has “*.example.com<http://example.com>” - are wildcards approved? (SIP doesn’t approve)

*.example.com<http://example.com> should be OK
Following 6.4.3 in 6125 then

4) Configured STUN server name: “sigtuna.example.com<http://sigtuna.example.com>”
  Cert has “sigtuna.example.com<http://sigtuna.example.com>” in subject - but “sigtuna.example.net<http://sigtuna.example.net>” in SAN
  Is this approved? (In SIP it would not be)

no - I don't see how a complete name mismatch could ever be acceptable
Right, if there are SAN, the Subject CNAMe must be ignored.

/O

_______________________________________________
tram mailing list
tram@ietf.org<mailto:tram@ietf.org>
https://www.ietf.org/mailman/listinfo/tram

_______________________________________________
tram mailing list
tram@ietf.org<mailto:tram@ietf.org>
https://www.ietf.org/mailman/listinfo/tram