Re: [tram] I-D Action: draft-ietf-tram-turnbis-19.txt

["Konda, Tirumaleswar Reddy" <[e-mail]>]

Hosts infected with malware contact the command & control server in the Internet and not the other way around and currently most malware communication is encrypted using TLS (some of them use Tor) and I don't see a reason why they would want to move to use ICE connectivity checks to obfuscate traffic. 

The update does not change the default behavior of the TURN server i.e. all incoming traffic including STUN traffic is dropped without permissions installed, and TURN server administrator must enable the configuration to allow inbound STUN connectivity checks without explicit permission. A Enterprise network that does not want to relax the firewall like rules on the TURN server need not turn on this feature. Further, simple misuse can be easily detected using the techniques discussed in the last paragraph in section 19.2  (Firewall Considerations). 

Cheers,
-Tiru

> -----Original Message-----
> From: tram <[e-mail]> On Behalf Of Jonathan Lennox
> Sent: Monday, August 13, 2018 8:58 PM
> To: Brandon Williams <brandon.williams=[e-mail]>
> Cc: Cullen Jennings <[e-mail]>; Eric Rescorla <[e-mail]>;
> [e-mail]; Justin Uberti <[e-mail]>; Ram Mohan R (rmohanr)
> <[e-mail]>; Nils Ohlmeier <[e-mail]>
> Subject: Re: [tram] I-D Action: draft-ietf-tram-turnbis-19.txt
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> I’d also like to get security review of this change, especially from the
> perspective of people running firewalls.
> 
> One of the design goals of TURN originally was that it behave like an address-
> dependent filtering firewall / NAT — you can’t get incoming traffic from a peer
> you don’t already know about.  This was so it can’t be used to tunnel
> connections to an open server behind a firewall, e.g. to allow a controller
> somewhere on the open Internet to contact malware running inside a
> corporate network.
> 
> Thus, network operators can be more confident about allowing TURN traffic out
> through their firewalls.
> 
> Permissionless ICE relay support breaks this guarantee, if you can tunnel your
> traffic to make it look like ICE connectivity checks, and I’m worried it will make
> operators less willing to allow TURN out of their networks.
> 
> Now, maybe the relevant operators are already not allowing TURN, or there
> are already plenty of ways to tunnel in traffic, so this isn’t a concern.  But if we
> change this property, I’d like to make sure we’re doing so with full
> consciousness and deliberation.
> 
> > On Aug 10, 2018, at 3:35 PM, Brandon Williams
> <brandon.williams=[e-mail]> wrote:
> >
> > Hi all,
> >
> > The one remaining item that I have been hoping for before submitted
> > turnbis for publication is review of permissionless ICE relay support
> > from someone who intends to make use of this new feature in the
> > protocol. I attempted to get commitments for review from EKR and
> > Cullen in Montreal, but they were each busy enough with other things
> > that they weren't prepared to make such a commitment. So, with that in
> > mind, I have a couple of questions for the list.
> >
> > For those of you who have reviewed this new content (namely Nils,
> > Justin, and Ram): Have any of you implemented support for this
> > capability? Or do you intend to in the near future?
> >
> > For the rest of you, is there anyone who has not reviewed the changes
> > yet who has implemented these changes?
> >
> > I'm mostly concerned about verifying that an implementor has looked at
> > this carefully enough to be confident that it can be implemented
> > effectively, especially as regards relevant security controls to
> > protect the client that is behind a relay that supports this capability.
> >
> > I'll appreciate any feedback from the list about this.
> >
> > Thanks,
> > --Brandon
> >
> > On 06/04/2018 02:24 AM, Konda, Tirumaleswar Reddy wrote:
> >> This revision addresses comments from Justin.
> >>
> >> -Tiru
> >>
> >>> -----Original Message-----
> >>> From: tram [mailto:[e-mail]] On Behalf Of internet-
> >>> [e-mail]
> >>> Sent: Monday, June 4, 2018 11:51 AM
> >>> To: [e-mail]
> >>> Cc: [e-mail]
> >>> Subject: [tram] I-D Action: draft-ietf-tram-turnbis-19.txt
> >>>
> >>>
> >>>
> >>> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> >>> This draft is a work item of the TURN Revised and Modernized WG of the
> IETF.
> >>>
> >>>        Title           : Traversal Using Relays around NAT (TURN): Relay
> Extensions
> >>> to Session Traversal Utilities for NAT (STUN)
> >>>        Authors         : Tirumaleswar Reddy
> >>>                          Alan Johnston
> >>>                          Philip Matthews
> >>>                          Jonathan Rosenberg
> >>> 	Filename        : draft-ietf-tram-turnbis-19.txt
> >>> 	Pages           : 84
> >>> 	Date            : 2018-06-03
> >>>
> >>> Abstract:
> >>>   If a host is located behind a NAT, then in certain situations it can
> >>>   be impossible for that host to communicate directly with other hosts
> >>>   (peers).  In these situations, it is necessary for the host to use
> >>>   the services of an intermediate node that acts as a communication
> >>>   relay.  This specification defines a protocol, called TURN (Traversal
> >>>   Using Relays around NAT), that allows the host to control the
> >>>   operation of the relay and to exchange packets with its peers using
> >>>   the relay.  TURN differs from some other relay control protocols in
> >>>   that it allows a client to communicate with multiple peers using a
> >>>   single relay address.
> >>>
> >>>   The TURN protocol was designed to be used as part of the ICE
> >>>   (Interactive Connectivity Establishment) approach to NAT traversal,
> >>>   though it also can be used without ICE.
> >>>
> >>>   This document obsoletes RFC 5766 and RFC 6156.
> >>>
> >>>
> >>> The IETF datatracker status page for this draft is:
> >>> https://datatracker.ietf.org/doc/draft-ietf-tram-turnbis/
> >>>
> >>> There are also htmlized versions available at:
> >>> https://tools.ietf.org/html/draft-ietf-tram-turnbis-19
> >>> https://datatracker.ietf.org/doc/html/draft-ietf-tram-turnbis-19
> >>>
> >>> A diff from the previous version is available at:
> >>> https://www.ietf.org/rfcdiff?url2=draft-ietf-tram-turnbis-19
> >>>
> >>>
> >>> Please note that it may take a couple of minutes from the time of
> >>> submission until the htmlized version and diff are available at tools.ietf.org.
> >>>
> >>> Internet-Drafts are also available by anonymous FTP at:
> >>> ftp://ftp.ietf.org/internet-drafts/
> >>>
> >>> _______________________________________________
> >>> tram mailing list
> >>> [e-mail]
> >>> https://www.ietf.org/mailman/listinfo/tram
> >>
> >> _______________________________________________
> >> tram mailing list
> >> [e-mail]
> >> https://www.ietf.org/mailman/listinfo/tram
> >>
> >
> > --
> > Brandon Williams
> > Platform Engineering
> > Akamai Technologies Inc.
> >
> > _______________________________________________
> > tram mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/tram
> >
> 
> _______________________________________________
> tram mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tram