[Masque] Filtering function of the Masque server for traffic incoming to the client

[Magnus Westerlund <[e-mail]>]

Hi,

A question I have to the WG is how its view are on filtering function of the
MASQUE server for incoming traffic from remote addresses. This comes from the
perspective of what is in TURN for this. TURN requires the client to explcitly
indicate the remote address (IP + Port) to receive traffic. 

So the question is what behavior we do expect from MASQUE for both UDP and for
IP. For UDP I think only accepting traffic from the reverse 5-tuple that the
client requested to communicate to. 

For IP I think the decision is tougher. But, I think the primary question is if
one should be able to run a server as a client of the MASQUE server. If it does
then any traffic to the leased IP address needs to be accepted. Thus questions
about being open for any traffic and potential for attack traffic etc. 

A special case if one doesn't allow any remote source through to the client, is
that some traffic that doesn't match IP 3-tuple still need forwarding. The best
example I have is that a MASQUE server will need to look at the ICMP traffic
comming in to the IP address and match the included header to existing context
and forward it to the relevant client if it matches. 

So what are peoples opinion here?


Cheers

Magnus Westerlund 


----------------------------------------------------------------------
Networks, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Torshamnsgatan 23           | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------