Re: [MMUSIC] 1 Week WGLC for draft-ietf-mmusic-rtsp-nat-evaluation-06

[Ari Keränen <[e-mail]>]

Hi Magnus,

The diff looked good. Couple of quick nits:

    5.  The RTSP Client uses the RTSP Servers response to create TURN

s/Servers/Server's/

    7.  The first media packet to arrive at the TURN server on the
        external port; If matching established permissions the TURN
        server forwards the media packets to the RTSP client.

s/If matching/If there exists a matching/
or /If the packet matches an/


Cheers,
Ari

On 5/27/13 12:29 PM, Magnus Westerlund wrote:
> Hi,
>
> Sorry for missing the other changes. I think I gotten all the lock down
> changed now. This has resulted in some significant changes in the text
> for TURN relays, including a server implementation requirement. I
> recommend that people do take a look at the diff:
>
> http://www.ietf.org/rfcdiff?url2=draft-ietf-mmusic-rtsp-nat-evaluation-08
>
> Cheers
>
> Magnus
>
>
> On 2013-05-23 19:58, Ari Keränen wrote:
>> On 5/23/13 5:47 PM, Magnus Westerlund wrote:
>>> On 2013-05-17 17:49, Ari Keränen wrote:
>>>
>>>>
>>>>
>>>> 4.9.1.  [TURN] Introduction
>>>>
>>>>      On the external side this is
>>>>      limited to the source address/port pair of the first packet arriving
>>>>      on the binding.  After the first packet has arrived the mapping is
>>>>      "locked down" to that address.  Packets from any other source on
>>>> this
>>>>      address will be discarded.
>>>>
>>>> This doesn't sound right. This behavior was changed (eventually into
>>>> using permissions) somewhere back in draft-rosenberg-midcom-turn-06. See
>>>> http://tools.ietf.org/html/rfc5766#section-2.3 for up-to-date behavior.
>>>> Check also steps 5 & 7 in the next section and section 4.9.4 for more
>>>> lock down text.
>>>
>>> I changed this to:
>>>
>>> To prevent DoS attacks on either recipient, the packets forwarded are
>>> restricted to the specific source address. On the client side it is
>>> restricted to the source setting up the allocation. On the external side
>>> this is limited to the source address/port pair that have been given
>>> permission by the TURN client creating the allocation. Packets from any
>>> other source on this address will be discarded.
>>>
>>> I will shortly submit an updated draft.
>>
>> Looks good to me. However, also the following sections had some "lock
>> down" text that should be updated (see details on my original mail above).
>>
>>
>> Cheers,
>> Ari
>>
>>
>>
>
>