Re: [P2PSIP] Choice of STUN peer or TURN peer

"Dan Wing" <dwing@cisco.com> Sat, 02 February 2008 03:26 UTC

Return-Path: <p2psip-bounces@ietf.org>
X-Original-To: ietfarch-p2psip-archive@core3.amsl.com
Delivered-To: ietfarch-p2psip-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 706793A6846; Fri, 1 Feb 2008 19:26:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.926
X-Spam-Level:
X-Spam-Status: No, score=-5.926 tagged_above=-999 required=5 tests=[AWL=0.673, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b339T2933GNc; Fri, 1 Feb 2008 19:26:23 -0800 (PST)
Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B08E3A6912; Fri, 1 Feb 2008 19:26:23 -0800 (PST)
X-Original-To: p2psip@core3.amsl.com
Delivered-To: p2psip@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D782C3A6846 for <p2psip@core3.amsl.com>; Fri, 1 Feb 2008 19:26:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1AT1fpPt+a+E for <p2psip@core3.amsl.com>; Fri, 1 Feb 2008 19:26:21 -0800 (PST)
Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) by core3.amsl.com (Postfix) with ESMTP id E39833A6912 for <p2psip@ietf.org>; Fri, 1 Feb 2008 19:26:21 -0800 (PST)
Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-2.cisco.com with ESMTP; 01 Feb 2008 19:27:57 -0800
Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id m123Rvsp022838; Fri, 1 Feb 2008 19:27:57 -0800
Received: from dwingwxp01 ([10.32.240.196]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m123RuZx018123; Sat, 2 Feb 2008 03:27:57 GMT
From: "Dan Wing" <dwing@cisco.com>
To: "'JiangXingFeng'" <jiang.x.f@huawei.com>, "'Bruce Lowekamp'" <lowekamp@sipeerior.com>
References: <077401c864f7$605bfc80$c4f0200a@cisco.com> <002c01c8654a$d9800450$2d09a40a@china.huawei.com>
Date: Fri, 1 Feb 2008 19:27:56 -0800
Message-ID: <2c7901c8654b$9aaf2020$c4f0200a@cisco.com>
MIME-Version: 1.0
X-Mailer: Microsoft Office Outlook 11
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Thread-Index: AchhxwRiKwoxy6LaSZ6TgKaHnj8wdgC2F6bgABX7SuAAEF+0IAAEkfOg
In-Reply-To: <002c01c8654a$d9800450$2d09a40a@china.huawei.com>
Authentication-Results: sj-dkim-4; header.From=dwing@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; );
Cc: 'P2PSIP Mailing List' <p2psip@ietf.org>
Subject: Re: [P2PSIP] Choice of STUN peer or TURN peer
X-BeenThere: p2psip@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Peer-to-Peer SIP working group discussion list <p2psip.ietf.org>
List-Unsubscribe: <http://www.ietf.org/mailman/listinfo/p2psip>, <mailto:p2psip-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/p2psip>
List-Post: <mailto:p2psip@ietf.org>
List-Help: <mailto:p2psip-request@ietf.org?subject=help>
List-Subscribe: <http://www.ietf.org/mailman/listinfo/p2psip>, <mailto:p2psip-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: p2psip-bounces@ietf.org
Errors-To: p2psip-bounces@ietf.org

 

> -----Original Message-----
> From: JiangXingFeng [mailto:jiang.x.f@huawei.com] 
> Sent: Friday, February 01, 2008 7:23 PM
> To: 'Dan Wing'; 'Bruce Lowekamp'
> Cc: 'P2PSIP Mailing List'
> Subject: RE: [P2PSIP] Choice of STUN peer or TURN peer
> 
> 
> TURN client      Peer X    STUN server        NAT      TURN server
>   |               |           |                   |             |
> 1. |-------------------->|---Give me a Turn Address
> --------->|----------------->|
> 2.                           |<-----------------STUN 
> Request----------|
> 3.                           |-------------------STUN Response------>|
> 4. |<--------------------|<---------here is your TURN
> address-------------------|
>              Figure 1: message flow to get a TURN address
>
> As Bruce suggested that message 1 and 4 will be routed 
> through the overlay.

I don't believe that will work; part of what causes TURN to
be an effective NAT relay is that the TURN client sends
a packet directly to the TURN server's publicly-routable
transport address.  The side effect of the TURN client
doing that is that the TURN client's (evil, nasty) NAT
opens pinholes to communicate bi-directionally with the 
TURN server's transport address.

("evil, nasty" meaning symmetric or port-restricted, using
RFC3489 definitions.)

-d

> So here, we assume the Peer X is the neighbor peer to the TURN server.
> Message 4 will return to TURN client by traversing Peer X or 
> not. Here, we
> assume the NAT has an address-dependent filtering behavior 
> which most NATs
> have. 
> 
> When TURN servers receives message 1 through the overlay, it 
> will set the
> Internal Remote transport address as Peer X's transport 
> address. Then send
> message back to the Internal Remote transport address in its Internal
> 5-tuple. Then NAT will open a port for Peer X. 
> 
> TURN client      Peer Y     Peer B        NAT      TURN server
> |                  |           |             |             |
> 5.|--------------------- ->|-------Send
> Indication---------------------------->| 
> 6.                            |----Binding Request-------     
> | (filtered by
> the NAT)
> 7.
> 8.
> 			Figure 2 message flow for connectivity 
> check in ICE
> 
> When TURN client wants to communicate with Peer B which is 
> also behind the
> NAT (the NAT in front of the Peer B is ignored in the Figure 
> 2), it should
> use overlay routing to exchange their candidates.
> We assume the candidate pair from TURN client is {relayed 
> candidate, server
> reflexive candidate of Peer B}
> So In message 5, TURN client will send a binding message which will be
> encapsulate in the Send Indication and the message will be 
> sent to TURN
> server. 
> There are two ways which could be used to send the message:
> 1. directly, due to NAT has a address-dependent filtering 
> behavior, NAT will
> filter the message;
> 2. through the overlay. yes, the message could arrive at the 
> TURN server.
> But you know, overlay topology is changing and the immediate 
> peer to TURN
> server in message 5 may not be Peer X any more, may be other 
> peer, such as
> Peer Y. For TURN server, it will check its association, and 
> find no matched
> internal 5-tuple, because Internal Remoter Transport address has been
> changed. It will be discarded by the TURN server. 
> 
> On the other hand, Peer B will send a Binding request to TURN client's
> relayed address, whose destination is TURN server. But it will also be
> filtered by the NAT due to its filtering behavior. 
> 
> To be honest, I am not very familiar with ICE. If there is 
> something wrong,
> please point it out. Thanks. 
> 
> JiangXingFeng
> 

_______________________________________________
P2PSIP mailing list
P2PSIP@ietf.org
http://www.ietf.org/mailman/listinfo/p2psip