Re: [rtcweb] Transports: RFC 4941 support?

[Justin Uberti <[e-mail]>]

Your take is what I had in mind. Basically a ruleset like this:

 gather_ipv4_addresses();
 if (has_ipv6) {
  if (has_temporary_addresses && temporaries_not_forbidden_by_policy) {
    gather_temporary_ipv6_addresses();
  } else {
    gather_non_temporary_ipv6_addresses();
 }
}


On Thu, Mar 20, 2014 at 1:56 PM, Ted Hardie <[e-mail]> wrote:

> On Thu, Mar 20, 2014 at 10:07 AM, Dan Wing <[e-mail]> wrote:
>
>>
>> On Mar 20, 2014, at 9:34 AM, Justin Uberti <[e-mail]> wrote:
>>
>>
>>
>>
>>
>> So perhaps:
>>>    "An RTCWEB implementation SHOULD prefer to use temporary addresses
>>> [RFC4941] where host and network policy permit [RFC6724]."
>>> ?
>>>
>>
>> I think it needs to be stronger than that - something like
>> "where
>> host and network policy permit, RTCWEB implementations SHOULD gather IPv6
>> temporary addresses and SHOULD NOT gather non-temporary addresses".
>>
>> Preferring to use temporary addresses is probably not sufficient to
>> prevent linkage, since you will have connectivity checks from the
>> non-temporary addresses. (i.e. an eavesdropper listening over an extended
>> period of time could determine calls are from the same endpoint)
>>
>>
>> Agreed.  I like your suggested wording.
>>
>> -d
>>
>>
>>
> So, I note that in this case where a non-temporary IPv6 address is present
> and  no temporary IPv6 address is present, this appears to push IPv6 out of
> the gathered list completely.  If I have that right, then my view as an
> individual is that this is the wrong result.  It will either force the use
> of IPv4 addresses which are just as linkable as IPv6 non-temporary
> addresses or rely on NATs to get the non-linkability (and provide us all
> the other subtle joys of NAT).
>
> As a friendly amendment, may I suggest "Where both non-temporary and
> temporary addresses are present and host and network policy permit, RTCWEB
> implementations SHOULD gather IPv6 temporary addresses and SHOULD NOT
> gather non-temporary addresses"?
>
> I also confess to a suspicion that Harald's view is the most
> sensible--having a separate policy for this application either won't happen
> or doesn't make much sense.  But if we have one, I'd prefer one that
> doesn't shove IPv6 out the door completely if the host doesn't use
> temporary addresses.
>
> regards,
>
> Ted
>