Subject: [tram] Fwd: New Version Notification for draft-williams-tram-ufrag-permission-00.txt

From: Brandon Williams <[email-masked]>
Date: Wed, 14 Oct 2015 16:57:25 -0400

I just posted the below referenced draft. It's focused on improving the 
speed of relayed ICE connectivity checks by defining a new type of 
permission that makes use of the offerer's ICE ufrag.

We will appreciate your comments.

Thanks,
--Brandon

-------- Forwarded Message --------
Subject: New Version Notification for 
draft-williams-tram-ufrag-permission-00.txt
Date: Wed, 14 Oct 2015 13:49:35 -0700
From: [email-masked]
To: Brandon Williams <[email-masked]>, Brandon Williams 
<[email-masked]>, Justin Uberti <[email-masked]>, 
Justin Uberti <[email-masked]>

A new version of I-D, draft-williams-tram-ufrag-permission-00.txt
has been successfully submitted by Brandon Williams and posted to the
IETF repository.

Name:		draft-williams-tram-ufrag-permission
Revision:	00
Title:		Ufrag Permissions for Traversal Using Relays around NAT (TURN)
Document date:	2015-10-14
Group:		Individual Submission
Pages:		9
URL: 
https://www.ietf.org/internet-drafts/draft-williams-tram-ufrag-permission-00.txt
Status: 
https://datatracker.ietf.org/doc/draft-williams-tram-ufrag-permission/
Htmlized: 
https://tools.ietf.org/html/draft-williams-tram-ufrag-permission-00

Abstract:
    When using a TURN relay, ICE connectivity checks require an explicit
    permission or channel binding to be established for each peer address
    to be checked.  This requires the answerer to send its candidate
    addresses to the offerer via the rendezvous server, which can impose
    a latency penalty when the rendezvous server is centrally located.
    This document defines a new type of TURN permission that will allow
    any ICE connectivity check message that contains the offerer's ufrag
    value to be accepted on a relay address for delivery over the
    associated TURN tunnel.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 15 Oct 2015 02:39:39 +0000

To handle DDOS attack of spoofed ICE requests, did you consider the option of signaling the endpoint's short-term password to TURN server so as to block those ICE requests ?
draft-jennings-behave-rtcweb-firewall-01 and this draft are both discussing STUN inspection on firewalls and TURN servers but in different ways to solve different problems.
 
-Tiru

> -----Original Message-----
> From: tram [mailto:[email-masked]] On Behalf Of Brandon Williams
> Sent: Thursday, October 15, 2015 2:27 AM
> To: [email-masked]
> Subject: [tram] Fwd: New Version Notification for draft-williams-tram-ufrag-
> permission-00.txt
> 
> I just posted the below referenced draft. It's focused on improving the speed
> of relayed ICE connectivity checks by defining a new type of permission that
> makes use of the offerer's ICE ufrag.
> 
> has been successfully submitted by Brandon Williams and posted to the IETF
> repository.
> 
> _______________________________________________
> tram mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tram

---

From: Justin Uberti <[email-masked]>
Date: Wed, 14 Oct 2015 23:07:57 -0700

DDOS of spoofed ICE requests can happen already against the host/srflx
candidate, so unclear this is a real-world problem.

On Wed, Oct 14, 2015 at 7:39 PM, Tirumaleswar Reddy (tireddy) <
[email-masked]> wrote:

> To handle DDOS attack of spoofed ICE requests, did you consider the option
> of signaling the endpoint's short-term password to TURN server so as to
> block those ICE requests ?
> draft-jennings-behave-rtcweb-firewall-01 and this draft are both
> discussing STUN inspection on firewalls and TURN servers but in different
> ways to solve different problems.
>
> -Tiru
>
> speed
> IETF
> > Title:                Ufrag Permissions for Traversal Using Relays
> around NAT
> > (TURN)