From 856c7427d638fe13204dacfcd96abfa74603f221 Mon Sep 17 00:00:00 2001 From: moparisthebest Date: Thu, 16 Feb 2017 00:52:50 -0500 Subject: [PATCH] XEP-0368: Version 0.1.2 Implement more last call comments, editorial changes, mixing SRV records is now SHOULD --- xep-0368.xml | 10 ++++++++-- xep.ent | 1 + 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/xep-0368.xml b/xep-0368.xml index a34d5797..bbea7df2 100644 --- a/xep-0368.xml +++ b/xep-0368.xml @@ -29,6 +29,12 @@ travis@burtrum.org travis@burtrum.org + + 0.1.2 + 2017-02-15 + tjb +

Implement more last call comments, editorial changes, mixing SRV records is now SHOULD.

 + 0.1.1 2017-02-06 @@ -55,7 +61,7 @@ -

&xmppcore; specifies the use of xmpp-client/xmpp-server SRV records as the method of discovering how to connect to an XMPP server. This XEP extends that to include new xmpps-client/xmpps-server SRV records pointing to direct TLS ports and combine priorities and weights as if they were a single SRV record. Applied to both xmpps-client and xmpps-server SRV records, this provides the opportunity to connect to XMPP servers with at least equal and perhaps increased security and privacy over using STARTTLS. It also provides an easy way for clients to bypass restrictive firewalls that only allow HTTPS, and for servers to host multiple protocols/services on a single port.

+

&xmppcore; specifies the use of xmpp-client/xmpp-server SRV records as the method of discovering how to connect to an XMPP server. This XEP extends that to include new xmpps-client/xmpps-server SRV records pointing to direct TLS ports and combine priorities and weights as if they were a single SRV record similar to &rfc6186;. It also provides an easy way for clients to bypass restrictive firewalls that only allow HTTPS, for servers to host multiple protocols/services on a single port, and for servers and clients to take advantage of less round trips and existing direct TLS loadbalancers.
@@ -74,7 +80,7 @@ ]]>

XMPP Core defines SRV records only where 'service' is 'xmpp-client' and 'xmpp-server'. This document specifies to additionally look up records where 'service' is 'xmpps-client' and 'xmpps-server'. This document specifies that the following additional rules apply:

    -
  1. Treat both 'xmpp-' and 'xmpps-' records as the same record with regard to connection order as specified by RFC 2782, in that all priorities and weights are mixed. (so the server operator can decide if they would rather clients connect to tcp with STARTTLS or just with TLS directly)
    2. +
  2. Both 'xmpp-' and 'xmpps-' records SHOULD be treated as the same record with regard to connection order as specified by RFC 2782, in that all priorities and weights are mixed. This enables the server operator to decide if they would rather clients connect with STARTTLS or direct TLS. However, clients MAY choose to prefer one type of connection over the other.
  3. Where 'service' starts with 'xmpps-' the client or server MUST connect with direct TLS enabled.
  4. Where 'service' starts with 'xmpp-' the client or server MUST NOT connect with direct TLS enabled, connection method is unchanged from XMPP Core.
  5. TLS certificates MUST be validated the same way as for STARTTLS. (i.e., as specified in XMPP Core).
    6. diff --git a/xep.ent b/xep.ent index 82804f51..ab674fdc 100644 --- a/xep.ent +++ b/xep.ent @@ -647,6 +647,7 @@ THE SOFTWARE. RFC 6149 RFC 6149: MD2 to Historic Status <http://tools.ietf.org/html/rfc6149>." > RFC 6150 RFC 6150: MD4 to Historic Status <http://tools.ietf.org/html/rfc6150>." > RFC 6151 RFC 6151: Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms <http://tools.ietf.org/html/rfc6151>." > +RFC 6186 RFC 6186: Use of SRV Records for Locating Email Submission/Access Services <http://tools.ietf.org/html/rfc6186>." > RFC 6189 RFC 6189: ZRTP: Media Path Key Agreement for Unicast Secure RTP <http://tools.ietf.org/html/rfc6189>." > RFC 6194 RFC 6194: Updated Security Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms <http://tools.ietf.org/html/rfc6194>." > RFC 6234 RFC 6234: US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF) <http://tools.ietf.org/html/rfc6234>." >