Subject: Re: [BEHAVE] TURN Issue #3: Address v. Address and Port Restricted

From: Philip Matthews <[email-masked]>
Date: Sat, 5 Jan 2008 08:37:24 -0500

I am starting to think that the permission policy for TURN should be  
something that is left up to the administrator of the TURN server.  
That is, some administrators may configure their TURN servers to be  
address-restricted, while other may configure theirs to be either  
address-and-port-restricted or endpoint-independent.

The original idea was that, by mandating that TURN must use an  
address-restricted permission policy, corporate IT managers would  
view TURN as "safe" and thus allow TURN through their corporate  
firewalls. But just because we write "MUST be address-restricted" in  
the TURN spec, this doesn't mean that a TURN implementor has to  
follow this policy. A TURN implementor could easily implement another  
policy; there are lots of examples of "MUSTs" in specifications being  
ignored.

This means that corporate IT managers that want to be safe must  
configure their firewalls to allow TURN only to designated TURN  
servers. This is not really a problem, since most clients will need  
credentials that allow them to use a specific TURN server anyway.

So I suggest that we not mandate a specific permission policy in the  
TURN spec, but simply list what we think are the three reasonable  
policies (endpoint-independent, address-restricted, and address-and- 
port-restricted) and list the consequences of each choice.

Comments?

- Philip

_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 8 Jan 2008 20:38:06 -0800

> Comments?

strongly oppose this. I believe this will allow TURN to be widely  
used for violation of firewall administrators desires which will  
result in in being blocked by firewalls - this will reduce our  
success rate of VoIP calls. Not doing this has been a key design  
principle of this work since day one - changing this now is a bad idea.

Cullen <with my individual hat on>