RFC 7064

URI Scheme for the Session Traversal Utilities for NAT (STUN) Protocol

📅 published November 2013, from ietf

RFC 7064: URI Scheme for the Session Traversal Utilities for NAT (STUN) Protocol ✨🎀

Okay bestie, the title block first 💅 This one is from the Internet Engineering Task Force (IETF) and it's Request for Comments: 7064. It's a Standards Track document, so it's an actual official Internet standard, not just a suggestion 👑 The ISSN is 2070-1721, and it dates from November 2013.

The authors are S. Nandakumar, G. Salgueiro, and P. Jones from Cisco Systems, plus M. Petit-Huguenin from Impedance Mismatch 🦋 The title block doesn't list any RFCs that this one obsoletes or updates, so it stands on its own 🌸

Abstract 💜

This document is all about the syntax and semantics of a Uniform Resource Identifier (URI) scheme for the Session Traversal Utilities for NAT (STUN) protocol. So it defines how a STUN server gets written down as a URI, and what that URI means 🧚

Status of This Memo 🌈

This is an Internet Standards Track document ⭐

It's a product of the Internet Engineering Task Force (IETF), which means it represents the consensus of the IETF community. It went through public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check out Section 2 of RFC 5741 🫶

For the current status, any errata, and how to send feedback on this document, head to http://www.rfc-editor.org/info/rfc7064 🍓

Copyright Notice 🎀

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info. These rules are the ones in effect on the date this document was published, so read them carefully, because they spell out your rights and restrictions for this document 📜 Any Code Components pulled out of this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They're also provided without warranty, as the Simplified BSD License describes 💅

Table of Contents ✨

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
3.  Definition of the "stun" or "stuns" URI . . . . . . . . . . .   3
  3.1.  URI Scheme Syntax . . . . . . . . . . . . . . . . . . . .   3
  3.2.  URI Scheme Semantics  . . . . . . . . . . . . . . . . . .   4
4.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   5
  5.1.  "stun" URI Registration . . . . . . . . . . . . . . . . .   5
  5.2.  "stuns" URI Registration  . . . . . . . . . . . . . . . .   6
6.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   6
7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   7
  7.1.  Normative References  . . . . . . . . . . . . . . . . . .   7
  7.2.  Informative References  . . . . . . . . . . . . . . . . .   7
Appendix A.  Examples . . . . . . . . . . . . . . . . . . . . . .   8
Appendix B.  Design Notes . . . . . . . . . . . . . . . . . . . .   8

1. Introduction 🦋

Okay so this document defines the syntax and semantics of the URI scheme for STUN, which is basically a way to write a STUN server's address as a URI, with all the meaning attached 💖

STUN is a protocol that helps other protocols deal with Network Address Translator (NAT) traversal. An endpoint can use it to figure out the IP address and port that a NAT gave it, to run connectivity checks between two endpoints, and as a keepalive to keep NAT bindings alive 🌸 The specifics of the STUN protocol itself live in RFC 5389 [RFC5389] 📖

The stun and stuns URI schemes are used to point at a stand-alone STUN server, or at any Internet host doing the operations of a STUN server within STUN usages (Section 14 of RFC 5389 [RFC5389]). With standards like WebRTC [WEBRTC] showing up, we expect a ton of endpoints and web apps to find and talk to a STUN server to run the protocol 🔥 That means endpoints and applications need the right configuration so they can identify the STUN server. If the syntax is inconsistent, it adds ambiguity, and that can lead to solutions that don't interoperate and to implementation limitations 💀 The stun and stuns schemes mostly fix this by giving you one consistent way to describe, configure, and exchange the info that identifies a STUN server 👑

2. Terminology 🌈

Here's the vibe check on the keywords. The key words "MUST", "MUST NOT", "REQUIRED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] when they appear in ALL CAPS. When these words are not in ALL CAPS (such as "should" or "Should"), they have their usual English meanings and are not to be interpreted as RFC 2119 key words 🎀 So only the all-caps versions carry the special RFC 2119 meaning, and everything else is just normal English 🙈

3. Definition of the "stun" or "stuns" URI 💜

3.1. URI Scheme Syntax 🧚

The "stun" and "stuns" URIs have the following formal ABNF syntax [RFC5234]:

stunURI       = scheme ":" host [ ":" port ]
scheme        = "stun" / "stuns"

<host> and <port> are specified in [RFC3986]. Those two ABNF productions are defined in [RFC3986] as components of the generic hierarchical URI, but that does NOT mean "stun" and "stuns" URI schemes are hierarchical URIs 🙃 So here's the important bit: developers MUST NOT use a generic hierarchical URI parser to parse a "stun" or "stuns" URI 🚫

3.2. URI Scheme Semantics 🦋

The "stun" and "stuns" URI schemes designate a stand-alone STUN server, or any Internet host performing the operations of a STUN server in the context of STUN usages (Section 14 of RFC 5389 [RFC5389]). STUN supports sending messages over UDP, TCP, or TLS-over-TCP 🌊 The "stuns" URI scheme MUST be used when STUN is run over TLS-over-TCP (or in the future DTLS-over-UDP), and the "stun" scheme MUST be used otherwise 🔐

The required <host> part of the "stun" URI denotes the STUN server host 🏠

For the optional DNS discovery procedure mentioned in Section 9 of RFC 5389, the "stun" URI scheme implies UDP as the transport protocol for SRV lookup, and the "stuns" URI scheme indicates TCP as the transport protocol 🔍

As specified in [RFC5389], the <port> part, if present, denotes the port on which the STUN server is awaiting connection requests. If it's absent, the default port is 3478 for both UDP and TCP. The default port for STUN over TLS is 5349, as per Section 9 of [RFC5389] 🍓

4. Security Considerations 🚨

Please read this part carefully, it matters a lot 😭 The "stun" and "stuns" URI schemes don't introduce any specific security issues beyond the ones discussed in [RFC3986]. These URI schemes are meant for specific environments that involve NAT traversal, and users of the scheme need to carefully consider the security properties of whatever context they're using them in 🔥

Here's the big one. A "stun" or "stuns" URI doesn't include the username or password that the STUN client uses to authenticate. But in certain environments, like WebRTC, the username and password will almost certainly be provisioned remotely by an external agent at the same time a "stuns" URI is sent to that client 😱 So if the username and password were received in the clear, there would be little or no benefit to using a "stuns" URI 💀 For this reason, a STUN client MUST ensure that the username, password, "stuns" URI, and any other security-relevant parameters are received with equivalent security before using the "stuns" URI 🔐 Receiving those parameters over another TLS session can provide the appropriate level of security, as long as both TLS sessions are similarly parameterized, for example with commensurate strength ciphersuites 🫶

5. IANA Considerations 🌸

This section has the registration information for the "stun" and "stuns" URI schemes, following [RFC4395] 📋 Heads up: these URI schemes are meant for very specific NAT traversal environments, so they should not be used otherwise on the open Web or Internet 🙅‍♀️

5.1. "stun" URI Registration 💖

Here's the registration template for stun:

URI scheme name: stun

Status: permanent

URI scheme syntax: See Section 3.1

URI scheme semantics: See Section 3.2

Encoding considerations: There are no encoding considerations beyond
those in [RFC3986].

Applications/protocols that use this URI scheme name:

   The "stun" URI scheme is intended to be used by applications with
   a need to identify a STUN server to be used for NAT traversal.

Interoperability considerations: N/A

Security considerations: See Section 4

Contact: Suhas Nandakumar <snandaku@cisco.com>

Author/Change controller: The IESG

References: RFC 7064

5.2. "stuns" URI Registration ✨

And here's the registration template for stuns, which is basically the same vibe but for the secure version 🔐

URI scheme name: stuns

Status: permanent

URI scheme syntax: See Section 3.1

URI scheme semantics: See Section 3.2

Encoding considerations: There are no encoding considerations beyond
those in [RFC3986].

Applications/protocols that use this URI scheme name:

   The "stuns" URI scheme is intended to be used by applications with
   a need to identify a STUN server to be used for NAT traversal over
   a secure connection.

Interoperability considerations: N/A

Security considerations: See Section 4

Contact: Suhas Nandakumar <snandaku@cisco.com>

Author/Change controller: The IESG

References: RFC 7064

Appendix A. Examples 🧚

Okay, so Table 1 shows examples for the "stun" and "stuns" URI schemes 🎀 For every single one of these, the <host> component is filled in with "example.org" 💖

                      +-----------------------+
                      | URI                   |
                      +-----------------------+
                      | stun:example.org      |
                      | stuns:example.org     |
                      | stun:example.org:8000 |
                      +-----------------------+

                              Table 1

Appendix B. Design Notes 💅

Okay, so one thing people kept bringing up was dropping the "s" suffix from the URI scheme and moving the secure option into a parameter instead (e.g., ;proto=tls) 🙈 We said nope to this, bestie. The need for ;proto= on the STUN URI can't be explained well enough, and supporting it would leave the spec incomplete 😭 It would also break the symmetry between the TURN and STUN URIs, and that's just not it 💀
Following the advice in Section 2.2 of [RFC4395], and because the STUN URI doesn't describe a hierarchical structure, STUN URIs are opaque 🫶 No hierarchy, no drama ✨

Authors' Addresses 🌸

Suhas Nandakumar
Cisco Systems
170 West Tasman Drive
San Jose, CA  95134
USA

EMail: snandaku@cisco.com


Gonzalo Salgueiro
Cisco Systems
7200-12 Kit Creek Road
Research Triangle Park, NC  27709
USA

EMail: gsalguei@cisco.com


Paul E. Jones
Cisco Systems
7025 Kit Creek Road
Research Triangle Park, NC  27709
USA

EMail: paulej@packetizer.com


Marc Petit-Huguenin
Impedance Mismatch

EMail: petithug@acm.org

📦 where this page comes from

ietf: rfc7064 2013-11
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms