[rtcweb] Same location media

[Roman Shpount <[e-mail]>]

Changing the topic from "A plea for simplicity, marketability..."

On Thu, Oct 20, 2011 at 11:57 AM, Iñaki Baz Castillo <[e-mail]> wrote:

> Also you are asuming that the media is sent to the same IP of the web
> server (in case a RTCweb scenario does not include user2user calls).
> This is a too much simplified scenario, and you miss that a DNS A
> record can point to N IP's, and you also miss the case in which the
> webserver has an IP different than the media server (regardless they
> both are located within the same provider infrastucture). The browser
> cannot determine it by itself, so security is always a need, and IMHO
> it's a bad idea to allow a very corner case in which such security
> could be relaxed.
>
>
I am not missing the DNS issues. I wanted to bring this up in my previous
email, but did not want to confuse the issue. I don't advocate for this case
at all, I just wanted to clarify that "same origin media" does not
necessarily mean two phones in the same location and means media going to
the same location as JavaScript origination.

Few additional points related to this:

1. This is what Flash is doing now for streaming media. It does not need
consent to send media to the same server that sent the flash app.

2. I am not sure we standardized that only IP addresses are allowed in media
description.DNS names might still be allowed then this issue will become the
issue of doing a literal match.

3. There is still a security issue with ICE: we validate that STUN request
can be processed, but not that the media actually should be accepted from
this application. In some sense, current Flash cross domain polices are
stricter, since they not only validate that media is acceptable at this IP
but that it is acceptable from the app served from particular server.

In general, I think this is a good thing if I can get readily available
hardware components and connect RTC clients to my existing infrastructure (I
do have an JavaScript/HTTP to SIP proxy solution already). If we are not
breaking anything by doing this, there might be some benefit for allowing
this. But on the other hand, I already got ICE/SRTP to non-ICE/RTP media
proxy as well, so if this is not supported I will not suffer much :).

_____________
Roman Shpount