Re: [tram] Fwd: New Version Notification for draft-williams-tram-ufrag-permission-00.txt

["Tirumaleswar Reddy (tireddy)" <[e-mail]>]

I meant with this change an attacker by just knowing the ufrag can now launch an attack on the TURN server and on the endpoint by  sending spoofed ICE requests with valid ufrag but invalid message-integrity, and can use any source IP address and possibly launch DDOS attack, TURN server will just forward those ICE requests to the endpoint.

-Tiru

From: Justin Uberti [mailto:[e-mail]]
Sent: Thursday, October 15, 2015 11:38 AM
To: Tirumaleswar Reddy (tireddy)
Cc: Brandon Williams; [e-mail]
Subject: Re: [tram] Fwd: New Version Notification for draft-williams-tram-ufrag-permission-00.txt

DDOS of spoofed ICE requests can happen already against the host/srflx candidate, so unclear this is a real-world problem.

On Wed, Oct 14, 2015 at 7:39 PM, Tirumaleswar Reddy (tireddy) <[e-mail]<mailto:[e-mail]>> wrote:
To handle DDOS attack of spoofed ICE requests, did you consider the option of signaling the endpoint's short-term password to TURN server so as to block those ICE requests ?
draft-jennings-behave-rtcweb-firewall-01 and this draft are both discussing STUN inspection on firewalls and TURN servers but in different ways to solve different problems.

-Tiru

> -----Original Message-----
> From: tram [mailto:[e-mail]<mailto:[e-mail]>] On Behalf Of Brandon Williams
> Sent: Thursday, October 15, 2015 2:27 AM
> To: [e-mail]<mailto:[e-mail]>
> Subject: [tram] Fwd: New Version Notification for draft-williams-tram-ufrag-
> permission-00.txt
>
> I just posted the below referenced draft. It's focused on improving the speed
> of relayed ICE connectivity checks by defining a new type of permission that
> makes use of the offerer's ICE ufrag.
>
> We will appreciate your comments.
>
> Thanks,
> --Brandon
>
>
> -------- Forwarded Message --------
> Subject: New Version Notification for
> draft-williams-tram-ufrag-permission-00.txt
> Date: Wed, 14 Oct 2015 13:49:35 -0700
> From: [e-mail]<mailto:[e-mail]>
> To: Brandon Williams <[e-mail]<mailto:[e-mail]>>, Brandon Williams
> <[e-mail]<mailto:[e-mail]>>, Justin Uberti <[e-mail]<mailto:[e-mail]>>,
> Justin Uberti <[e-mail]<mailto:[e-mail]>>
>
>
> A new version of I-D, draft-williams-tram-ufrag-permission-00.txt
> has been successfully submitted by Brandon Williams and posted to the IETF
> repository.
>
> Name:         draft-williams-tram-ufrag-permission
> Revision:     00
> Title:                Ufrag Permissions for Traversal Using Relays around NAT
> (TURN)
> Document date:        2015-10-14
> Group:                Individual Submission
> Pages:                9
> URL:
> https://www.ietf.org/internet-drafts/draft-williams-tram-ufrag-permission-
> 00.txt
> Status:
> https://datatracker.ietf.org/doc/draft-williams-tram-ufrag-permission/
> Htmlized:
> https://tools.ietf.org/html/draft-williams-tram-ufrag-permission-00
>
>
> Abstract:
>     When using a TURN relay, ICE connectivity checks require an explicit
>     permission or channel binding to be established for each peer address
>     to be checked.  This requires the answerer to send its candidate
>     addresses to the offerer via the rendezvous server, which can impose
>     a latency penalty when the rendezvous server is centrally located.
>     This document defines a new type of TURN permission that will allow
>     any ICE connectivity check message that contains the offerer's ufrag
>     value to be accepted on a relay address for delivery over the
>     associated TURN tunnel.
>
>
>
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.
>
> The IETF Secretariat
>
>
>
> _______________________________________________
> tram mailing list
> [e-mail]<mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/tram

_______________________________________________
tram mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/tram