Re: [rtcweb] [tram] TURN permissions for private ips

[Emil Ivov <[e-mail]>]

On Wednesday, August 5, 2015, Justin Uberti <[e-mail]> wrote:

>
>
> On Wed, Aug 5, 2015 at 11:32 AM, Simon Perreault <[e-mail]
> <javascript:_e(%7B%7D,'cvml','[e-mail]');>> wrote:
>
>> Le 2015-08-05 13:46, Philipp Hancke a écrit :
>> > If a peer sends candidates with IP addresses from the private space,
>> > permissions for those are created at the TURN server. Potentially not
>> > utilising transport encryption even.
>> >
>> > I doubt those candidates ever work, so from a privacy point of view it
>> > seems that clients should not create those permissions in the first
>> > place. And ICE should probably not try to create pairs.
>>
>> It's not up to the client to determine what addresses might not might
>> not work for a given TURN server. There are lots of weird NAT
>> configurations out there that play games with RFC1918 addresses and can
>> easily trick clients into doing the wrong thing.
>>
>
> I am somewhat sympathetic to that, but given that there is measurable
> downside here - extra candidate pairs that take time to check - can you
> supply a concrete example of where the client choosing not to pair a TURN
> candidate with a RFC1918 address would cause a problem?
>

Isn't it enough to just have a route on the TURN server to a 1918 network?
I don't know why someone would do this and what sort of DMZed configuration
it would be but if they could then I don't think clients should try to make
assumptions about the practicality of such a configuration.

It is clearly much easier for the TURN server to check whether or not it
has such a route and refuse to add the permission.

Emil


-- 
sent from my mobile