Re: [rtcweb] Same location media

[Bernard Aboba <[e-mail]>]

Yes, Turn over TLS is non-distinguishable.  However, we've found deep inspection firewalls that will actually attempt to parse the TLS negotiation.  This creates brittleness to extensions in general.  Anything that is not "vanilla" could potentially fall prey, including TLS extensions, Websockets, etc.  Sad, but true.

Date: Thu, 20 Oct 2011 13:58:40 -0400
Subject: Re: [rtcweb] Same location media
From: [e-mail]
To: [e-mail]
CC: [e-mail]


On Thu, Oct 20, 2011 at 1:02 PM, Bernard Aboba <[e-mail]> wrote:






[BA] With respect to TURN with TCP/TLS we have found some firewalls that actually do deep packet inspection.  So if you're sending to TCP port 80 and aren't using HTTP, or are sending to port 443 and aren't using TLS (or are using TLS extensions the firewall doesn't understand), the firewall can block.   So yes, it is important to support TURN with TCP/TLS, but it should be recognized that even with that, there will still be a significant percentage of failures. 

 		 	   		  

TURN over TLS is non-distinguishable (unless I am missing something) from HTTPS connection. It is using the same TLS transport as HTTPS and firewall cannot inspect the actual data transmitted. Firewall can probably do some sort of heuristics based on packet sizes, but this will not be reliable enough to distinguish TURN over TLS from HTTPS (or real time media over HTTPS). In any case, if people are persistent enough they will find the way to block RTC connections regardless of the protocol used.

_____________
Roman Shpount