Re: [pntaw] TURN over websockets

On Fri, 30 Aug 2013 10:42:09 +0200
Sergio Garcia Murillo <sergio.garcia.murillo@gmail.com> wrote:

> Hi all,
> 
> I will shoot first.
> 
> It is great to finally see some real interest in what I consider to be 
> the blocking point for webrtc in order to run business on top of it, 
> which is the ability to be able to connect through corporate firewalls.
> 
> I have seen some people arguing that with just TURN over TCP on port 443 
> the problem will be solved, but I seriously doubt it. Neither TURN over 
> SSL would do, as most web filters do DPI and will not enable the 
> connection. Also, I have heard lots of voices that says we are trying to 
> override network admin policies with dirty tricks. With whom, I could agree.
> 

That's the main objection I got when I published the (now expired) draft I published a year ago to throw the proverbial "stone in the lake" about an HTTP fallback solution. As I said at the time, I agree with you that the solution doesn't have to be sneaky, and that it could very well be conceived to be network admin-friendly/controllable.

> So, the only way I see to move forward and overcome this issues is by 
> playing according to the WEB rules, and use HTTP standards to enable 
> media connectivity in WebRTC that would play nicely with current 
> corporate HTTP proxies and web filters.
> 
> And,  for me the most viable solution would be to enable TURN over 
> websockets. As most WebRTC services relay on websockets in one way or 
> another for signaling, we could assume that media would work on 100% of 
> the cases where signaling is working today.
> Also, as it is an http based solution, network administrators could 
> apply corporate policies and block connections to not-trusted TURN servers.
> 
> Best regards
> Sergio

I'm not an expert in websockets, which is why in my rough proposal I described a way to do this using plain HTTP, but I guess they'd be good for the purpose as well. The only doubt I have is that, as far as I know, not always websockets are able to traverse some more restrictive components: the popular BitDefender firewall, for instance, apparently doesn't let it through.

Anyway, I'd personally support a work in that direction, and would be willing to help working on it too if needed.

Lorenzo

> _______________________________________________
> pntaw mailing list
> pntaw@ietf.org
> https://www.ietf.org/mailman/listinfo/pntaw

-- 
Lorenzo Miniero, COB

Meetecho s.r.l.
Web Conferencing and Collaboration Tools
http://www.meetecho.com