Subject: f* wildcards (was: [Fwd: Re: [VCARDDAV] AD review of draft-ietf-vcarddav-carddav-07.txt])

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 10 Sep 2009 12:48:03 -0600

I just noticed this aspect of a message that Alexey sent to the vCard
list a few weeks ago. I tend to agree with what Alexey reports from a
recent IESG telechat, but I wonder if it will be codified somehow;
perhaps in the server identity checking I-D we've discussed here?

- -------- Original Message --------
Subject: Re: [VCARDDAV] AD review of draft-ietf-vcarddav-carddav-07.txt
Date: Mon, 17 Aug 2009 00:02:08 +0100
From: Alexey Melnikov <[email-masked]>
To: Cyrus Daboo <[email-masked]>
CC: CardDAV <[email-masked]>
References: <[email-masked]>

<snip/>

3.  Requirements Overview

  o  MUST support secure transport as defined in [RFC2818] using TLS
     [RFC5246];

This recently came up in review of
draft-ietf-geopriv-http-location-delivery-15.txt:

RFC 2818, Section 3.1 says:

 Matching is performed using the matching rules specified by
 [RFC2459].  If more than one identity of a given type is present in
 the certificate (e.g., more than one dNSName name, a match in any one
 of the set is considered acceptable.) Names may contain the wildcard
 character * which is considered to match any single domain name
 component or component fragment. E.g., *.a.com matches foo.a.com but
 not bar.foo.a.com. f*.com matches foo.com but not bar.com.

Based on the discussion during an IESG telechat several ADs agreed that
f* wildcards shouldn't be allowed anymore. So, the document should say
that it complies with RFC 2818, except for f* type wildcards are not
allowed. (wildcards in the leftmost label are still allowed). This is
consistent with the advice from RFC 5280.

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 10 Sep 2009 21:47:19 +0100

Peter Saint-Andre wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
Yes.

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 10 Sep 2009 15:39:47 -0600

>> perhaps in the server identity checking I-D we've discussed here?

Works for me.

This will be in version -02 of draft-saintandre-tls-server-id-check.

Peter

- --
Peter Saint-Andre
https://stpeter.im/