Re: [rtcweb] IP handling: Using mDNS names for host candidates

inveterate lurker here; I'd definitely +1 getting this in during the WGLC
for this document if there are no strong objections.

On Mon, Jun 11, 2018 at 8:40 PM, Justin Uberti <
juberti=40google.com@dmarc.ietf.org> wrote:

> The Safari team has come up with a clever approach to avoid disclosing
> private IP addresses for host candidates. As discussed in this WebKit bug
> <https://bugs.webkit.org/show_bug.cgi?id=174500>, the technique works as
> follows:
>
>    1. Register a random UUID-based mDNS name when ICE gathering starts
>    2. Replace the private IP address by a "{UUID}.local" string in each
>    host candidate (and set raddr to 0.0.0.0 for other candidates)
>    3. The other party will do mDNS resolution on any candidate having a
>    .local suffix, similar to how hostnames in candidates are handled in RFC
>    5245, Section 15.1.
>
> This technique is relevant to the IP handling document, as it addresses
> one of the lesser problems (private IP disclosure) from the overall problem
> statement. While I don't think this will have a large impact on the
> document, including the default mode selection, incorporating this
> technique would result in some moderate changes:
>
>    - Section 5.1 would mention concealing private IPs in the default case
>    as an explicit goal.
>    - In Section 6, Mode 2 would change from handling out private IPs to
>    handing out mDNS names.
>    - This document would have to describe the technique or point to
>    another document that describes the technique. mmusic-ice-sip-sdp,
>    Section 4.1
>    <https://tools.ietf.org/html/draft-ietf-mmusic-ice-sip-sdp-20#section-4.1> seems
>    like a good option, as it already covers how to handle DNS names in ICE
>    candidates.
>
> This is a significant improvement and I think we will want to incorporate
> this suggestion. Is this something we could do as part of this WGLC, or
> should we look for another option?
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
>
>

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871