Subject: Re: [tram] I-D Action: draft-ietf-tram-turnbis-19.txt

From: Brandon Williams <[email-masked]>
Date: Fri, 10 Aug 2018 15:35:29 -0400

Hi all,

The one remaining item that I have been hoping for before submitted
turnbis for publication is review of permissionless ICE relay support
from someone who intends to make use of this new feature in the
protocol. I attempted to get commitments for review from EKR and Cullen
in Montreal, but they were each busy enough with other things that they
weren't prepared to make such a commitment. So, with that in mind, I
have a couple of questions for the list.

For those of you who have reviewed this new content (namely Nils,
Justin, and Ram): Have any of you implemented support for this
capability? Or do you intend to in the near future?

For the rest of you, is there anyone who has not reviewed the changes
yet who has implemented these changes?

I'm mostly concerned about verifying that an implementor has looked at
this carefully enough to be confident that it can be implemented
effectively, especially as regards relevant security controls to protect
the client that is behind a relay that supports this capability.

I'll appreciate any feedback from the list about this.

Thanks,
--Brandon

On 06/04/2018 02:24 AM, Konda, Tirumaleswar Reddy wrote:
> This revision addresses comments from Justin.
> 
> -Tiru
> 
>> -----Original Message-----
>> From: tram [mailto:[email-masked]] On Behalf Of internet-
>> [email-masked]
>> Sent: Monday, June 4, 2018 11:51 AM
>> To: [email-masked]
>> Cc: [email-masked]
>> Subject: [tram] I-D Action: draft-ietf-tram-turnbis-19.txt
>>
>>
>>
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the TURN Revised and Modernized WG of the IETF.
>>
>>         Title           : Traversal Using Relays around NAT (TURN): Relay Extensions
>> to Session Traversal Utilities for NAT (STUN)
>>         Authors         : Tirumaleswar Reddy
>>                           Alan Johnston
>>                           Philip Matthews
>>                           Jonathan Rosenberg
>> 	Filename        : draft-ietf-tram-turnbis-19.txt
>> 	Pages           : 84
>> 	Date            : 2018-06-03
>>
>> Abstract:
>>    If a host is located behind a NAT, then in certain situations it can
>>    be impossible for that host to communicate directly with other hosts
>>    (peers).  In these situations, it is necessary for the host to use
>>    the services of an intermediate node that acts as a communication
>>    relay.  This specification defines a protocol, called TURN (Traversal
>>    Using Relays around NAT), that allows the host to control the
>>    operation of the relay and to exchange packets with its peers using
>>    the relay.  TURN differs from some other relay control protocols in
>>    that it allows a client to communicate with multiple peers using a
>>    single relay address.
>>
>>    The TURN protocol was designed to be used as part of the ICE
>>    (Interactive Connectivity Establishment) approach to NAT traversal,
>>    though it also can be used without ICE.
>>
>>    This document obsoletes RFC 5766 and RFC 6156.
>>
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-tram-turnbis/
>>
>> There are also htmlized versions available at:
>> https://tools.ietf.org/html/draft-ietf-tram-turnbis-19
>> https://datatracker.ietf.org/doc/html/draft-ietf-tram-turnbis-19
>>
>> A diff from the previous version is available at:
>> https://www.ietf.org/rfcdiff?url2=draft-ietf-tram-turnbis-19
>>
>>
>> Please note that it may take a couple of minutes from the time of submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>>
>> _______________________________________________
>> tram mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/tram
> 
> _______________________________________________
> tram mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tram
> 

-- 
Brandon Williams
Platform Engineering
Akamai Technologies Inc.

---

From: Nils Ohlmeier <[email-masked]>
Date: Fri, 10 Aug 2018 13:59:15 -0700

Hi Brandon,

Mozilla doesn’t own or operate TURN servers or server code.
I’m expecting that Firefox ICE implementation would start to answer STUN bindings requests from the TURN relay right away with no change.
So if I’m not mistaken it should work with a TURN server right away.

Happy to test with a server implementation/prototype any time.

Best regards
  Nils Ohlmeier

> On Aug 10, 2018, at 12:35, Brandon Williams <[email-masked]> wrote:
> 
> Hi all,
>

---

From: Jonathan Lennox <[email-masked]>
Date: Mon, 13 Aug 2018 11:28:20 -0400

I’d also like to get security review of this change, especially from the perspective of people running firewalls.

One of the design goals of TURN originally was that it behave like an address-dependent filtering firewall / NAT — you can’t get incoming traffic from a peer you don’t already know about.  This was so it can’t be used to tunnel connections to an open server behind a firewall, e.g. to allow a controller somewhere on the open Internet to contact malware running inside a corporate network.

Thus, network operators can be more confident about allowing TURN traffic out through their firewalls.

Permissionless ICE relay support breaks this guarantee, if you can tunnel your traffic to make it look like ICE connectivity checks, and I’m worried it will make operators less willing to allow TURN out of their networks.

Now, maybe the relevant operators are already not allowing TURN, or there are already plenty of ways to tunnel in traffic, so this isn’t a concern.  But if we change this property, I’d like to make sure we’re doing so with full consciousness and deliberation.

> On Aug 10, 2018, at 3:35 PM, Brandon Williams <brandon.williams=[email-masked]> wrote:
> 
> Hi all,
>

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 14 Aug 2018 07:29:22 +0000

Hosts infected with malware contact the command & control server in the Internet and not the other way around and currently most malware communication is encrypted using TLS (some of them use Tor) and I don't see a reason why they would want to move to use ICE connectivity checks to obfuscate traffic. 

The update does not change the default behavior of the TURN server i.e. all incoming traffic including STUN traffic is dropped without permissions installed, and TURN server administrator must enable the configuration to allow inbound STUN connectivity checks without explicit permission. A Enterprise network that does not want to relax the firewall like rules on the TURN server need not turn on this feature. Further, simple misuse can be easily detected using the techniques discussed in the last paragraph in section 19.2  (Firewall Considerations). 

Cheers,
-Tiru

> From: tram <[email-masked]> On Behalf Of Jonathan Lennox
> Sent: Monday, August 13, 2018 8:58 PM
> To: Brandon Williams <brandon.williams=[email-masked]>
> Cc: Cullen Jennings <[email-masked]>; Eric Rescorla <[email-masked]>;
> [email-masked]; Justin Uberti <[email-masked]>; Ram Mohan R (rmohanr)
> <[email-masked]>; Nils Ohlmeier <[email-masked]>
> Subject: Re: [tram] I-D Action: draft-ietf-tram-turnbis-19.txt
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> One of the design goals of TURN originally was that it behave like an address-
> dependent filtering firewall / NAT — you can’t get incoming traffic from a peer
> you don’t already know about.  This was so it can’t be used to tunnel
> connections to an open server behind a firewall, e.g. to allow a controller
> somewhere on the open Internet to contact malware running inside a
> corporate network.
> 
> Permissionless ICE relay support breaks this guarantee, if you can tunnel your
> traffic to make it look like ICE connectivity checks, and I’m worried it will make
> operators less willing to allow TURN out of their networks.
> 
> Now, maybe the relevant operators are already not allowing TURN, or there
> are already plenty of ways to tunnel in traffic, so this isn’t a concern.  But if we
> change this property, I’d like to make sure we’re doing so with full
> consciousness and deliberation.
> 
> > On Aug 10, 2018, at 3:35 PM, Brandon Williams
> <brandon.williams=[email-masked]> wrote:
> >
> > Hi all,
> >
> > protocol. I attempted to get commitments for review from EKR and
> > Cullen in Montreal, but they were each busy enough with other things
> > that they weren't prepared to make such a commitment. So, with that in
> > mind, I have a couple of questions for the list.
> >
> > effectively, especially as regards relevant security controls to
> > protect the client that is behind a relay that supports this capability.
> >
> >>> Please note that it may take a couple of minutes from the time of
> >>> submission until the htmlized version and diff are available at tools.ietf.org.
> >>>