Re: [rtcweb] WGLC for draft-ietf-rtcweb-ip-handling

Justin Uberti <juberti@google.com> Fri, 20 April 2018 00:03 UTC

Return-Path: <juberti@google.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6505126DED for <rtcweb@ietfa.amsl.com>; Thu, 19 Apr 2018 17:03:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.009
X-Spam-Level:
X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aO2Sz9nKroXX for <rtcweb@ietfa.amsl.com>; Thu, 19 Apr 2018 17:03:09 -0700 (PDT)
Received: from mail-ua0-x235.google.com (mail-ua0-x235.google.com [IPv6:2607:f8b0:400c:c08::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F51F126CB6 for <rtcweb@ietf.org>; Thu, 19 Apr 2018 17:03:09 -0700 (PDT)
Received: by mail-ua0-x235.google.com with SMTP id r16so4607310uak.11 for <rtcweb@ietf.org>; Thu, 19 Apr 2018 17:03:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=a/P1YpUhSHF2aShxzSXp+nBBTK1awLJozmjOXShN2NU=; b=wUC6vFM+i8z0Nn3zgc7Z9+xjHiIvdCXHem3PuNNIG2CYkk9eQw4fHVuKwDETV1OgwZ Ezjhjp8qggPBH/47HZtinZ1weAN78oH8JgIUT2RZUDXLT5r9Ngz22k+IEsLPgy/l6jdj HEDzA2qjHa2iJztHD6JfYZIbQrHxMWIEckijAdVeRXdIG1l3oJYzU/X19yqJIQISGFTY DqE5tQxZJMqB1Y9wglUmERu1A00wQlJhMVOW5843ABOY5WClUDfFZBy8Jgq3bh/BVsfN wh3vS5yahlR+r9neC1U6tWvtQ0zQgMLAFpiuHxCorhZq1l1+wBuE1ox+QL+1aT4mHcde KKpA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=a/P1YpUhSHF2aShxzSXp+nBBTK1awLJozmjOXShN2NU=; b=AfawT/PTwt+h8IpHLjFtd6nyjixPF2Y5PjCCDNpWlnmLjGoseP6sY1iNfP/6OJWn/t xtopKgyHVEHUTCZaThmFEJfV2mRGdeg5oIvOPTTvWX+BH/3RgGl9i/Tomuwat0eUDJMK R4XjALlLQHg7utEEJWK+8mPbegqEsOjgg85mcqR1OVFgGjcyB8WDTCN7TZQ8M1ZuxQe7 QsZ66i64js9pN8brDrtPoKZbaCJsYgI4LUkoH45KPIiQFC+zh8ZsAe0l5aWiWmN2dOg9 PN1vTYgZCgw23/1BvbnK3R+WV0uV/MbQXdcvcjMB3fYO0bTD6ImiZQhRX0h0d8+UrnRl ASPg==
X-Gm-Message-State: ALQs6tB+oTddpYGwZrAyhNl4GI7OVFWkAj/UIzoqkB3Tp7wQsJheMmhn iyS1OTCqzRTVUrepyeN2Y8/j7fkZDKuOmpGV9CSC7A==
X-Google-Smtp-Source: AIpwx4+KABqT2n6rOtyqBS4RQdJWUnCmnUJLooJetdfyE5mXWlkMFOwpRLtWB1EyIY0212ZvPSxLxLkSQnaDK9j5M/E=
X-Received: by 10.159.35.105 with SMTP id 96mr6237702uae.100.1524182587512; Thu, 19 Apr 2018 17:03:07 -0700 (PDT)
MIME-Version: 1.0
References: <1D5B431C-801E-4F8C-8026-6BCBB72FF478@sn3rd.com> <CAOJ7v-2gmxpsGp=25pcJmnkYmipZdCFOqU4nLtAVSznLsZo9rQ@mail.gmail.com> <4902F7BF-0D20-4EA6-9E78-D22C90EFCE22@westhawk.co.uk> <CAOJ7v-3NsqD6pq-kkMw81+2n_D8qf558CKeCE76ZypyxwCgs9g@mail.gmail.com> <CAOJ7v-2NJ1vhVUerZ1cn8MP9hD_vgAYBurjeQKMx76Aa_U=n=Q@mail.gmail.com> <A8B32C11-30BD-4DA8-9BAB-FA26747BFF66@westhawk.co.uk> <CAOJ7v-0VNCjGdhtz56jwwksBcfPk=9wuxfMgwi8mq7ViFyWpuw@mail.gmail.com> <DDEE408B-B49E-465E-B17B-C2813AF4F2F4@westhawk.co.uk> <CAOJ7v-26f1hrujtegK6_U50E0MZPy5zmf0yDUWBY5oqrKQmGQg@mail.gmail.com> <CAOJ7v-2fn-SdR2VUbVVHbMB-_Rw9gV0nsRnc2Ace+682LBJBag@mail.gmail.com> <7E9CBD87-6C00-4CF8-AEDE-D2AEFC3213FA@westhawk.co.uk> <CAOJ7v-1sHcm46BCttHMNA4gjUTL98RwBRm-H1HGpF7Bwx2ceGA@mail.gmail.com> <03257894-7D79-463D-BC3A-5B388680A3E7@sn3rd.com> <CAOJ7v-3ycQH4Ho9OJsuYRR3M4GwsPGGkHzx=E0hKbFObSjRxkw@mail.gmail.com> <C06A6EB6-5CD2-4F33-8495-4CC42FFF169B@mozilla.com> <CAOJ7v-1YC9BEtYXLDAjDVaWBT1odawV39+4NTBmc0RG9pMF06g@mail.gmail.com> <a9520cb1-4d63-5ffa-c01f-0bf8c13826a6@gmail.com>
In-Reply-To: <a9520cb1-4d63-5ffa-c01f-0bf8c13826a6@gmail.com>
From: Justin Uberti <juberti@google.com>
Date: Fri, 20 Apr 2018 00:02:54 +0000
Message-ID: <CAOJ7v-3HBRjiRdfx=2ZWPJ=NjZdcWKFjTtEjAM0qMr6q5j207A@mail.gmail.com>
To: Lennart Grahl <lennart.grahl@gmail.com>
Cc: RTCWeb IETF <rtcweb@ietf.org>
Content-Type: multipart/alternative; boundary="001a11352a06b408a5056a3c690c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtcweb/1pcOPw5BW104uw8F3cWYiGVhyno>
Subject: Re: [rtcweb] WGLC for draft-ietf-rtcweb-ip-handling
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rtcweb/>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Apr 2018 00:03:12 -0000

On Thu, Apr 19, 2018 at 4:41 PM Lennart Grahl <lennart.grahl@gmail.com>
wrote:

> On 20.04.2018 01:29, Justin Uberti wrote:
> > On Thu, Apr 19, 2018 at 9:22 AM Nils Ohlmeier <nohlmeier@mozilla.com>
> wrote:
> >
> >> While I understand the arguments against adding more mode I still think
> >> the paragraph describing Mode 4 is missing details and causes confusion
> >> among implementers:
> >>
> >> - It is not clear if the word “proxy” refers to a HTTP proxy or a TURN
> >> server.
> >>
> >> This can easily be improved by replacing the word “proxy” with “HTTP
> >> proxy” everywhere in the Mode 4 paragraph.
> >>
> >
> > The proxy doesn't need to be a HTTP proxy; it could be a SOCKS or RETURN
> > proxy (SOCKS is specifically noted in the para).
> >
> >>
> >> - It is unclear how an implementation should behave in the absence of
> such
> >> a proxy.
> >>
> >> I would suggest to add a sentence the implementation should not hand out
> >> any candidates in the absence of a HTTP proxy.
> >>
> >
> > This is a fair point. However, my take is that the behavior should be the
> > same as Mode 3 in this case, as the web server already sees the client
> IP.
> > I could add a sentence to make this super clear.
>
> The web server, yes. But not the other peer. I don't think we can assume
> trust towards the web server equals trust towards the other peer. I
> would agree with Nils that it shouldn't hand out any candidates in this
> case.
>

This is not unique to Mode 4.

This scenario is discussed in detail in
https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-14#section-5.4;
I don't think it needs special mention in this doc.