Re: [tram] Alissa Cooper's Discuss on draft-ietf-tram-stun-origin-05: (with DISCUSS)

[Simon Perreault <[e-mail]>]

Le 2015-05-11 19:30, Alissa Cooper a écrit :
> For requests sent with authentication, I understand that the origin
> attribute needs to be accurate in order for the client to authenticate.
> In those cases, the STUN server can rely on the attribute it receives.
> But for requests without authentication, what prevents the client from
> lying?

Note that the client does not know in advance whether its request is
going to be authenticated or not. Although I supposes it could try to
guess, or maybe re-try the request without lying when it receives an
authentication challenge.

> And if those requests are not (D)TLS-protected, what prevents them
> from being modified in transit?

Nothing. Per STUN design. Unauthenticated requests cannot be trusted.
The server operator can require authentication if trust is a problem.

> I understand Alan to be saying that the
> justification for the origin in this case is operational troubleshooting,
> but if the server can't rely on the origin it receives, doesn't that make
> it risky for the server to act on that information?

Note that this concern applies to all other pieces of information
contained in unauthenticated STUN requests.

Simon