[tram] Multiple allocations SV: I-D Action: draft-ietf-tram-turnbis-15.txt

["Karl Stahl" <[e-mail]>]

Justin> It's not clear to me why multiple addresses of the same family are ever needed

SIMPLY: Real-time media is not only over the public Internet

In fact, most of today’s telephony VoIP goes over other networks that the Internet.

 

Most SIP trunking into enterprise PBXs comes on higher quality pipes for that telephony VoIP, and the large enterprises that  block UDP access from their LANs (and which the https://tools.ietf.org/html/rfc7478 Web Real-Time Communication Use Cases and Requirements as well as your and Benjamin’s  https://www.ietf.org/archive/id/draft-ietf-rtcweb-return-02.txt 

have the aim of supporting) most often ALSO have a higher quality WANs between their branch offices. There is big business putting VoIP over those networks (today it is SIP based using SBCs, future will use WebRTC and Network Provided Turn-servers.

 

And a third need is in even seen in home access routers: Those telephony RJ11 FXS-ports you see on them, are typically connected to SPs VoIP higher quality than Internet networks (maybe an IMS network). There is a lot of policy based routing going in, especially with real-time media.

 

For doing that with ICE/TURN and network provided TURN server on the LAN, the “TURN Proxy” as you call it, simply needs the multiple Allocation. It is a simple and elegant solution (You would NOT like the alternative of addressing several TURN servers (auto discovered) on the LAN from the Client). 

 

Justin> and even if we supported this, how the client would be expected to select between them

Do you see problems with the approach of offering all and selecting the first that works, just like Happy Eyeballs?

 

I don’t have SSODA background and not so much HTTPS proxy background as you – More from real-time communication with SIP VoIP and arranging  NAT/Firewall traversal using SBC (don’t like that misused name on our products that are really SIP aware firewalls in line with the MIDCOM work from the time before ICE/TURN/STUN) which may be why we see different needs. 

 

I’m not saying anything of that SSODA is wrong or work wasted – on the contrary – I want it generalized because we need it! 

 

Olle, I also think there one day will (have to be) a separate document that … clearly how network-provided TURN-servers is supposed to work (there is more that should/could be done in there also), but now we need have the base standards to support instead of hinder it, which was one thing TRAM was supposed to achieve..

 

Olle> security section of RFC 8155 … On the other hand, I don’t really like how it was added to that RFC

It was the other way around…

The TRAM intent of what became https://www.rfc-editor.org/rfc/pdfrfc/rfc8155.txt.pdf  was (from mile stone) “TURN server discovery mechanism for enterprises and ISPs to IESG” that is Network Provided TURN server in local or access network.

 

The intent was NOT Brandon’s Network Provided TURN servers that are OUTSIDE the local or access network and it is very unfortunate that https://www.rfc-editor.org/rfc/rfc8155.txt took the approach “This document describes three discovery mechanisms, so as to maximize the opportunity for discovery, based on the network in which the TURN client finds itself.” (We definitely don’t want to find Brandon’s turn servers when trying to discover the very private TURN server on the LAN – unfortunately making RFC 8155 more or less useless for its intended purpose (under my protest).

 

/Karl

Från: Justin Uberti [mailto:[e-mail]] 
Skickat: den 3 april 2018 07:03
Till: Olle E. Johansson
Kopia: Brandon Williams; Simon Perreault; [e-mail]; [e-mail]; Karl Stahl
Ämne: Re: [tram] Multiple allocations SV: I-D Action: draft-ietf-tram-turnbis-15.txt

 

I spent time with Pal and others coming up with the initial dual allocation concept (SSODA) and there are clear reasons for this approach (as discussed in the intro of the original SSODA doc).

 

It's not clear to me why multiple addresses of the same family are ever needed though, and even if we supported this, how the client would be expected to select between them. It seems like a large expansion of scope beyond the goals of SSODA.

 

On Mon, Apr 2, 2018 at 11:47 AM Olle E. Johansson <[e-mail]> wrote:

Hi!

Well, since Network-provided servers was added to the security section of RFC 8155, I kind of think it’s now in scope for
everything TURN and from that standpoint I do understand Karl’s objections.

On the other hand, I don’t really like how it was added to that RFC and like the idea of a separate document that
clears this mess up and explains clearly how network-provided TURN-servers is supposed to work, the requirements
and additions to the TURN protocol.

The problem with that is that implementors may think it’s just an add-on and not implement it in the TURN client
implementations, which would be harmful in the long run.

Question: Will adding operations or modifying existing ones in a new document make it a mandatory
part of the TURN protocol, an update to the TURN RFC (turnbis as an RFC that is)?

/O




> On 2 Apr 2018, at 18:46, Brandon Williams <[e-mail]> wrote:
>
> Karl,
>
> There is no WG decision to hinder this, simply a disagreement about approach.
>
> Some of us (the editors in particular) have been working on the turnbis draft for quite some time. It went into WGLC several months ago and it is already well behind the originally agreed schedule in the charter.
>
> Considering the fact that this is not something that was ever called out previously, we are only questioning why it has suddenly become critical to expand the scope of turnbis and thus delay publishing even further.
>
> If there were already a draft that explains the rationale, use cases, and protocol changes, it would be easier to assess the impact and consider inclusion. This was the path followed by a few other new capabilities that were eventually rolled directly into turnbis.
>
> If the WG came to the conclusion that we should not delay turnbis any further but instead should advance the capability as a new RFC candidate, we would already be in a good position to that if we had a draft in hand. If the WG decided to include this in turnbis, we would already have text available.
>
> IOW, I am only resisting the idea of expanding the scope of turnbis without WG consensus to do so; I am not resisting your proposal itself. The suggestion that you take the time to write down your idea in I-D format seems like a good way for you to drive the required WG discussion.
>
> --Brandon
>
> On 03/22/2018 05:17 PM, Karl Stahl wrote:
>> No and this draft cannot be approved without the generalization I have pointed out.
>> I really don’t understand why we are having this resistance.
>> Already the second paragraph of the Abstract states:
>> The TURN protocol was designed to be used as part of the ICE
>>    (Interactive Connectivity Establishment) approach to NAT traversal,
>>    though it also can be used without ICE.
>> And further in the Introduction
>> TURN was designed as one piece in the larger ICE approach to NAT
>>    traversal.  Implementors of TURN are *_urged_* to investigate ICE and
>>    seriously consider using it for their application.
>> **
>> I cannot imagine that there is some WG decision to hinder ICE usage for network provided TURN servers EXCEPT FOR EXACTLY BRANDON’S NETWORK.
>> For now I refrain from writing/debating more – which would override the effort of what is required to generalize as asked.
>> Please be happy that most of the dual allocation work done, can be reused to fulfill the generalization.
>> Tiru and Brandon are encouraged to read the TRAM charter …
>> /Karl
>> *Från:*Simon Perreault [mailto:[e-mail]]
>> *Skickat:* den 21 mars 2018 18:13
>> *Till:* Brandon Williams
>> *Kopia:* Konda, Tirumaleswar Reddy; Olle E. Johansson; Karl Stahl; [e-mail]
>> *Ämne:* Re: [tram] Multiple allocations SV: I-D Action: draft-ietf-tram-turnbis-15.txt
>> 2018-03-21 17:05 GMT+00:00 Brandon Williams <[e-mail] <mailto:[e-mail]>>:
>> Chairs, Any suggestions on approach?
>> The proposal on the table is for Karl+Olle to write their idea into a new draft.
>> Karl+Olle, can you guys live with that?
>> Simon
>> **********************
>> Let me explain more clearly why multiple allocations is needed:
>> ICE is about finding all/many paths for the media, e.g. with the help of
>> TURN servers.
>> Those paths are not over ONE IPv4 network, over ONE IPv6 network or EXACTLY
>> ONE OF EACH.
>> If fact, it is more common that you have several IPv4 networks paths.
>> Now that we have network provided TURN servers, you only ask for Allocation
>> once (contrary to application provided TURN servers, where you can be
>> directed to Allocate several times.) and thus we need all relay addresses in
>> one allocation request.
>> Wasn't that the reason dual allocation was requested? The need for multiple
>> allocation is stronger!
>> Please address this, e.g. like below (seems you are almost there).
>> /Karl
>> ******************* Previous *******************
>> Allowing a turn allocation to return multiple relayed transport addresses,
>> beyond ONE IPv4 and ONE IPv6 (which may sit on the same or on different
>> interfaces/network segments), seems like very small step now when the dual
>> allocation was put in place in this draft. We certainly need it (some
>> reasons below) if TURN is going to be used where needed and we cannot wait
>> for any additional draft.
>> Seems like it is sufficient to extent this table (found in draft 14) with 3
>> new values (as shown):
>> 16.  STUN Attributes
>>    This STUN extension defines the following attributes:
>>      0x000C: CHANNEL-NUMBER
>>      0x000D: LIFETIME
>>      0x0010: Reserved (was BANDWIDTH)
>>      0x0012: XOR-PEER-ADDRESS
>>      0x0013: DATA
>>      0x0016: XOR-RELAYED-ADDRESS
>>      0x0017: REQUESTED-ADDRESS-FAMILY
>>      0x0018: EVEN-PORT
>>      0x0019: REQUESTED-TRANSPORT
>>      0x001A: DONT-FRAGMENT
>>      0x0021: Reserved (was TIMER-VAL)
>>      0x0022: RESERVATION-TOKEN
>>      TBD-CA: ADDITIONAL-ADDRESS-FAMILY
>> ADDITIONAL-ADDRESS-ALL
>> ADDITIONAL-ADDRESS-ALLV4
>> ADDITIONAL-ADDRESS-ALLV6
>>      TBD-CA: ADDRESS-ERROR-CODE
>>      TBD-CA: ICMP
>> Actually, browsing through the draft for ADDITIONAL-ADDRESS-FAMILY, very
>> little text seems to be added for generalization to  ADDITIONAL-ADDRESS-xxx.
>> Almost everything applies to ADDITIONAL-ADDRESS-xxx and can be reused.
>> ADDITIONAL-ADDRESS-ALL should be the default for any modern TURN client.
>> Check! - We need this now.
>> Thanks,
>> Karl
>
> --
> Brandon Williams; Chief Architect
> Cloud Networking; Akamai Technologies Inc.
>
> _______________________________________________
> tram mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tram

_______________________________________________
tram mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tram