Subject: Re: [MMUSIC] Lite mode to ICE TCP

From: Simon Perreault <[email-masked]>
Date: Tue, 01 Feb 2011 11:54:41 -0500

On 2011-01-26 08:38, Kevin P. Fleming wrote:
>>     [...] The lack of connectivity checks is
>>     especially problematic if one of the hosts is behind a NAT and has an
>>     address from a private address space: the peer may accidentally
>>     connect to a host in a different subnet that uses the same private
>>     address space.  This is one of the reasons why a lite implementation
>>     MUST NOT be located behind a NAT.
> 
> Maybe that should be worded a bit differently; a UA that implements both
> full ICE and ICE-lite can certainly be located behind a NAT, but it must
> not choose lite mode when it is behind a NAT. In addition, the
> restriction should be based on communicating *across* the NAT, not the
> location of the implementation. It should be perfectly acceptable for an
> ICE-lite implementation to talk another ICE-lite implementation on a
> private network that is also behind a NAT to a public network, if the
> two implementations are not attempting to communicate across the NAT.
> 
> It's too early in the morning here for me to attempt to draft some text,
> but I'll try later today if nobody else has taken a stab at it :-)

Here's an attempt:

"This is one of the reasons why ICE-lite MUST NOT be used from behind a
NAT (unless it is known, via static configuration or otherwise, that no
communication will happen across the NAT)."

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca

---

From: Ari Keranen <[email-masked]>
Date: Tue, 1 Feb 2011 19:27:39 +0200

> communication will happen across the NAT)."

Thanks for the text Simon. However, while I sympathize with the problem you're trying to solve, this would be inconsistent with what is defined for UDP in ICE RFC, and thus I think this document is not the right place to fix that.

I would rather keep ICE TCP (lite) consistent with ICE UDP and have a different document (maybe one of the 3 we already have) defining the behavior in this use case.

Cheers,
Ari

---

From: Simon Perreault <[email-masked]>
Date: Tue, 01 Feb 2011 12:43:20 -0500

On 2011-02-01 12:27, Ari Keranen wrote:
>> "This is one of the reasons why ICE-lite MUST NOT be used from
>> behind a NAT (unless it is known, via static configuration or
>> otherwise, that no communication will happen across the NAT)."
> 
> Thanks for the text Simon. However, while I sympathize with the
> problem you're trying to solve, this would be inconsistent with what
> is defined for UDP in ICE RFC, and thus I think this document is not
> the right place to fix that.

Makes sense. I honestly don't care that much because implementations
will do whatever they need to do, no matter what gets written. So please
don't let this prevent you from publishing, and let's move on.

Simon

---

From: "Kevin P. Fleming" <[email-masked]>
Date: Tue, 01 Feb 2011 16:27:54 -0600

> don't let this prevent you from publishing, and let's move on.

Agreed :-)

-- 
Kevin P. Fleming
Digium, Inc. | Director of Software Technologies
445 Jan Davis Drive NW - Huntsville, AL 35806 - USA
skype: kpfleming | jabber: [email-masked]
Check us out at www.digium.com & www.asterisk.org

---

From: Ari Keranen <[email-masked]>
Date: Wed, 2 Feb 2011 11:57:07 +0200

> don't let this prevent you from publishing, and let's move on.

Yeah, that is a probable outcome for the folks with this scenario. At least we have warned them about the risks involved.

Also, since the actual choice of words in ICE RFC is that "a lite implementation is only appropriate for devices that will *always* be connected to the public Internet and have a public IP address", I changed the text in the security section to match that:

   This is one of the reasons why the lite mode is not
   appropriate for an ICE agent located behind a NAT.

That's closer to what you also proposed and doesn't normatively prevent future docs to specify lite-like behavior behind a NAT.

Cheers,
Ari

---

From: Ari Keranen <[email-masked]>
Date: Wed, 2 Feb 2011 15:44:57 +0200

Hi Ross,

On Jan 29, 2011, at 3:55 AM, Ross Finlayson wrote:
> Am I the only person annoyed by the spelling "lite"?

Seems that most of us can live with it :) But given that is how the ICE RFC spells it, I guess that's the best option anyway.

Cheers,
Ari