Subject: [Ietf-behave] TURN Issue #4: TLS TURN requests

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 5 Dec 2005 08:29:50 -0800 (PST)

TURN allows TLS connectivity for the Shared Secret request, but not for 
the Allocate request itself. I have gotten a request to allow the 
Allocate request to run over TLS. Once you've swallowed the RTP-over-TCP 
pill, I don't think this one is a big jump from there.

I'll note that there is currently no way in SDP that I know of to signal 
RTP over TLS; I seem to recall from meeting minutes last month in AVT 
this was discussed and rejected. That means that this mechanism would be 
useful with SIP only in conjunction with the TCP to UDP conversion I 
posted about in Issue #3. In essence, the proposal here is to allow TLS 
to UDP conversion as well.

I'd propose that the general transport of STUN requests (include those 
defined by usages) over TLS be defined in the core STUN spec. TLS is 
already there, but just for Shared Secret. One of the things I want to 
do in the stun revision (like what we did in sip) is separate the 
transport out so that TCP or TLS transport can be used for any request type.

Comments?

Thanks,
Jonathan R.
--
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
jdrosen@xxxxxxxxx                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: Colin Perkins <[email-masked]>
Date: Tue, 6 Dec 2005 10:16:17 -0800 (PST)

On 5 Dec 2005, at 16:29, Jonathan Rosenberg wrote:
TURN allows TLS connectivity for the Shared Secret request, but not  
for the Allocate request itself. I have gotten a request to allow  
the Allocate request to run over TLS. Once you've swallowed the RTP- 
over-TCP pill, I don't think this one is a big jump from there.

I'll note that there is currently no way in SDP that I know of to  
signal RTP over TLS; I seem to recall from meeting minutes last  
month in AVT this was discussed and rejected.
AVT has an existing milestone to work on RTP-over-TLS, but it seems  
no-one is interested in doing the work. The discussion in the meeting  
was that we would remove the milestone when updating our charter,  
unless there was interest.

Colin

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 13 Dec 2005 20:36:34 -0800 (PST)

Interesting - given that draft-ietf-avt-rtp-framing-contrans  and
draft-ietf-mmusic-comedia-tls both seem to be proceeding, I'm surprised to
hear this. I would not be surprised to see more interest in RTP over TLS.

On 12/6/05 10:16 AM, "Colin Perkins" <csp@xxxxxxxxxxxxx> wrote:

> _______________________________________________
> Ietf-behave mailing list
> Ietf-behave@xxxxxxxxxxxxxxxxxxx
> https://list.sipfoundry.org/mailman/listinfo/ietf-behave

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 15 Dec 2005 01:53:16 -0800 (PST)

Cullen Jennings wrote:
Interesting - given that draft-ietf-avt-rtp-framing-contrans  and
draft-ietf-mmusic-comedia-tls both seem to be proceeding, I'm surprised to
hear this. I would not be surprised to see more interest in RTP over TLS.
However neither of these drafts defines the procedure for 
TCP/TLS/RTP/AVP, etc. The comedia TLS author was willing to have it in 
his draft-ietf-mmusic-comedia-tls, however no one volunteered to write 
the text. Thus it got cut out of that draft. No one has so far started 
an separate draft. So unless a volunteer steps forward in AVT this 
milestone and charter item will be removed.

Cheers

Magnus Westerlund

Multimedia Technologies, Ericsson Research EAB/TVA/A
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Torshamsgatan 23           | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: magnus.westerlund@xxxxxxxxxxxx

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 20 Dec 2005 09:44:05 -0800 (PST)

Right, that was my understanding.

The main point, however, is that the feature here under discussion (TURN 
Allocate over TLS) would make sense in conjunction with the UDP 
conversion, in which case there is no need for TCP signaling in the SDP 
itself.

Since there appears to be consensus for the UDP-to-TCP conversion thing, 
and since running over TLS is going to be made generic in the stun 
revision, this capability would come along for the ride, so I'll move 
forward with that.

-Jonathan R.

Magnus Westerlund wrote:

Cullen Jennings wrote:

Interesting - given that draft-ietf-avt-rtp-framing-contrans  and
draft-ietf-mmusic-comedia-tls both seem to be proceeding, I'm 
surprised to
hear this. I would not be surprised to see more interest in RTP over TLS.

Cheers

Magnus Westerlund