Re: [rtcweb] Same location media

[Salvatore Loreto <[e-mail]>]

On 10/20/11 9:05 PM, Bernard Aboba wrote:
> Yes, Turn over TLS is non-distinguishable.  However, we've found deep 
> inspection firewalls that will actually attempt to parse the TLS 
> negotiation.  This creates brittleness to extensions in general.  
> Anything that is not "vanilla" could potentially fall prey, including 
> TLS extensions, Websockets, etc.  Sad, but true.
but then also your fallback proposal to send media on WebSocket
can potentially fall, isn't it?
or am I missing something?

/Sal
>
> ------------------------------------------------------------------------
> Date: Thu, 20 Oct 2011 13:58:40 -0400
> Subject: Re: [rtcweb] Same location media
> From: [e-mail]
> To: [e-mail]
> CC: [e-mail]
>
>
>
> On Thu, Oct 20, 2011 at 1:02 PM, Bernard Aboba 
> <[e-mail] <mailto:[e-mail]>> wrote:
>
>     [BA] With respect to TURN with TCP/TLS we have found some
>     firewalls that actually do deep packet inspection.  So if you're
>     sending to TCP port 80 and aren't using HTTP, or are sending to
>     port 443 and aren't using TLS (or are using TLS extensions the
>     firewall doesn't understand), the firewall can block.   So yes, it
>     is important to support TURN with TCP/TLS, but it should be
>     recognized that even with that, there will still be a significant
>     percentage of failures.
>
>
> TURN over TLS is non-distinguishable (unless I am missing something) 
> from HTTPS connection. It is using the same TLS transport as HTTPS and 
> firewall cannot inspect the actual data transmitted. Firewall can 
> probably do some sort of heuristics based on packet sizes, but this 
> will not be reliable enough to distinguish TURN over TLS from HTTPS 
> (or real time media over HTTPS). In any case, if people are persistent 
> enough they will find the way to block RTC connections regardless of 
> the protocol used.
> _____________
> Roman Shpount
>
>