Re: [tram] Fwd: New Version Notification for draft-williams-tram-ufrag-permission-00.txt

DDOS of spoofed ICE requests can happen already against the host/srflx
candidate, so unclear this is a real-world problem.

On Wed, Oct 14, 2015 at 7:39 PM, Tirumaleswar Reddy (tireddy) <
tireddy@cisco.com> wrote:

> To handle DDOS attack of spoofed ICE requests, did you consider the option
> of signaling the endpoint's short-term password to TURN server so as to
> block those ICE requests ?
> draft-jennings-behave-rtcweb-firewall-01 and this draft are both
> discussing STUN inspection on firewalls and TURN servers but in different
> ways to solve different problems.
>
> -Tiru
>
> > -----Original Message-----
> > From: tram [mailto:tram-bounces@ietf.org] On Behalf Of Brandon Williams
> > Sent: Thursday, October 15, 2015 2:27 AM
> > To: tram@ietf.org
> > Subject: [tram] Fwd: New Version Notification for
> draft-williams-tram-ufrag-
> > permission-00.txt
> >
> > I just posted the below referenced draft. It's focused on improving the
> speed
> > of relayed ICE connectivity checks by defining a new type of permission
> that
> > makes use of the offerer's ICE ufrag.
> >
> > We will appreciate your comments.
> >
> > Thanks,
> > --Brandon
> >
> >
> > -------- Forwarded Message --------
> > Subject: New Version Notification for
> > draft-williams-tram-ufrag-permission-00.txt
> > Date: Wed, 14 Oct 2015 13:49:35 -0700
> > From: internet-drafts@ietf.org
> > To: Brandon Williams <brandon.williams@akamai.com>, Brandon Williams
> > <brandon.williams@akamai.com>, Justin Uberti <justin@uberti.name>,
> > Justin Uberti <justin@uberti.name>
> >
> >
> > A new version of I-D, draft-williams-tram-ufrag-permission-00.txt
> > has been successfully submitted by Brandon Williams and posted to the
> IETF
> > repository.
> >
> > Name:         draft-williams-tram-ufrag-permission
> > Revision:     00
> > Title:                Ufrag Permissions for Traversal Using Relays
> around NAT
> > (TURN)
> > Document date:        2015-10-14
> > Group:                Individual Submission
> > Pages:                9
> > URL:
> >
> https://www.ietf.org/internet-drafts/draft-williams-tram-ufrag-permission-
> > 00.txt
> > Status:
> > https://datatracker.ietf.org/doc/draft-williams-tram-ufrag-permission/
> > Htmlized:
> > https://tools.ietf.org/html/draft-williams-tram-ufrag-permission-00
> >
> >
> > Abstract:
> >     When using a TURN relay, ICE connectivity checks require an explicit
> >     permission or channel binding to be established for each peer address
> >     to be checked.  This requires the answerer to send its candidate
> >     addresses to the offerer via the rendezvous server, which can impose
> >     a latency penalty when the rendezvous server is centrally located.
> >     This document defines a new type of TURN permission that will allow
> >     any ICE connectivity check message that contains the offerer's ufrag
> >     value to be accepted on a relay address for delivery over the
> >     associated TURN tunnel.
> >
> >
> >
> >
> >
> > Please note that it may take a couple of minutes from the time of
> submission
> > until the htmlized version and diff are available at tools.ietf.org.
> >
> > The IETF Secretariat
> >
> >
> >
> > _______________________________________________
> > tram mailing list
> > tram@ietf.org
> > https://www.ietf.org/mailman/listinfo/tram
>
> _______________________________________________
> tram mailing list
> tram@ietf.org
> https://www.ietf.org/mailman/listinfo/tram
>