Subject: [BEHAVE] TURN: Restricting who a server will relay to

From: Philip Matthews <[email-masked]>
Date: Wed, 29 Oct 2008 08:33:27 -0400

I have added a few sentences to TURN that explicitly allows a server  
to restrict the range of IP addresses and ports that it will relay to.  
More precisely, restrict the range of IP addresses and ports that can  
appear in an XOR-PEER-ADDRESS attribute in a CreatePermission,  
ChannelBind, or Send. For Send, for example, the text now says:

    The server MAY impose additional restrictions on the range of values
    allowed for the IP address and port contained in the XOR-PEER- 
ADDRESS
    attribute.

This was prompted by my updating of the TURN security considerations  
section to discuss the attack that Cullen raised a couple of weeks  
ago, where a TURN server is located in the DMZ.

I don't see this as adding anything new. An administrator can always  
achieve the same affect by placing the TURN server behind its own  
firewall and configuring the firewall rules appropriately. And even if  
it wasn't explicitly allowed, I suspect that many TURN implementations  
might do it anyway.

Comments?

- Philip

_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave