Re: [tram] Allow TURN to forward inbound connectivity checks without permission

[Simon Perreault <[e-mail]>]

Wow, I had totally forgotten about ufrag perms!

2018-03-19 22:43 GMT+00:00 Nils Ohlmeier <[e-mail]>:
>
> I also like the idea of simply forwarding all binding requests to the TURN
> client. Because 1) it does not expose the ufrag to the network when talking
> to the TURN server. And 2) it’s easier for the TURN server to just check
> for the STUN request type and hot have to parse for the ufrag attribute as
> well.
>

Same opinion here. The point of permissions is to prevent TURN clients from
being able to run generic servers. It seems like always allowing STUN
packets would preserve this feature while solving the session establishment
latency problem. And would be quite a bit simpler to implement than ufrag
perms. Have your cake, eat it, and eat it a second time.

Also, because this is so simple (just one sentence to specify it!), and
impact potential is so great (make Brandon happy!), I wonder if we
shouldn't simply add it to TURN-bis while there's still time.

One question which comes to my mind is if the TURN server at some point,
> e.g. after receiving the permission request, stops forwarding the binding
> requests blindly?


Because the allocation might be paired with multiple remote candidates, I
think we'd need to always forward STUN blindly.

Simon