Subject: [BEHAVE] [Technical Errata Reported] RFC5389 (2010)

From: RFC Errata System <[email-masked]>
Date: Thu, 21 Jan 2010 00:06:34 -0800 (PST)

The following errata report has been submitted for RFC5389,
"Session Traversal Utilities for NAT (STUN)".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=5389&eid=2010

--------------------------------------
Type: Technical
Reported by: Pasi Eronen <[email-masked]>

Section: 7.2.2

Original Text
-------------
For purposes of usage with this specification, the client treats the
domain name or IP address used in Section 8.1 as the host portion of
the URI that has been dereferenced.

Corrected Text
--------------

Notes
-----
The reference should be to Section 9, not 8.1.

Unfortunately, even with this purely editorial fix, the text is
ambiguous: the procedure described in Section 9 would typically use at
least three different domain names: (1) the configured domain name,
like "example.com"; (2) the domain name used in the SRV query, like
"_stuns._tcp.example.com"; and (3) the domain name found in the SRV
record and used for A/AAAA query, like "stunserver3.foobar.example".
And they have *very* different security implications...

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5389 (draft-ietf-behave-rfc3489bis-18)
--------------------------------------
Title               : Session Traversal Utilities for NAT (STUN)
Publication Date    : October 2008
Author(s)           : J. Rosenberg, R. Mahy, P. Matthews, D. Wing
Category            : PROPOSED STANDARD
Source              : Behavior Engineering for Hindrance Avoidance
Area                : Transport
Stream              : IETF
Verifying Party     : IESG