Re: [rtcweb] [tram] TURN permissions for private ips

[Simon Perreault <[e-mail]>]

Le 2015-08-05 13:46, Philipp Hancke a écrit :
> If a peer sends candidates with IP addresses from the private space,
> permissions for those are created at the TURN server. Potentially not
> utilising transport encryption even.
> 
> I doubt those candidates ever work, so from a privacy point of view it
> seems that clients should not create those permissions in the first
> place. And ICE should probably not try to create pairs.

It's not up to the client to determine what addresses might not might
not work for a given TURN server. There are lots of weird NAT
configurations out there that play games with RFC1918 addresses and can
easily trick clients into doing the wrong thing.

Instead, the server should be the one doing that check because it only
has access to reliable information. It should use the existing mechanism
and return 403 Forbidden for addresses it doesn't like. See RFC 5766
section "9.2. Receiving a CreatePermission Request":

   The server MAY impose restrictions on the IP address allowed in the
   XOR-PEER-ADDRESS attribute -- if a value is not allowed, the server
   rejects the request with a 403 (Forbidden) error.

Simon