Re: [xmpp] Clarification of TLS Identity checking in draft-ietf-xmpp-3920bis

[Florian Zeitz <[e-mail]>]

Am 15.03.2011 00:07, schrieb Joe Hildebrand:
> On 3/14/11 4:38 PM, "Florian Zeitz"<[e-mail]>  wrote:
>
>
>> I was recently wondering something related.
>> Do I set the 'to' attribute in the initial stream header to the JID's
>> domainpart, or to the domain I got from a SRV lookup?
>> The later is certainly not sufficient as a source domain. That in turn
>> implies (IMHO) we will always have/want to set the 'to' attribute to the
>> JID's domainpart (and while the draft actually says to put a
>> "domainpart" there, it is not specific on where to get that from,
>> especially for the cases where you can't set a 'from', because you don't
>> know the JID beforehand). I'd therefore assume you'd not use the
>> user-entered FQDN as source domain, but I'd like some clarification on
>> that point, too.
>
> It's always the domain name the user entered, not something you get from the
> (currently untrusted) DNS.  Many servers use this name to figure out which
> certificate to give you when you Start-TLS, rather than having to rely on
> SNI.
>
That is not a sufficient answer.
Stef Walter's point, that I was trying to address, was that in some 
cases the user entered two different domains. One as part of his JID the 
other one as the domain to connect to.
Both are certainly valid options for checking against.
My reasoning was that since you have to use the domainpart of the JID 
when doing SRV (I was not sure from reading the draft, but it seemed 
sensible), it seems logical to do the same when the user specified a FQDN.

--
Florian Zeitz