Subject: Re: [pntaw] New version of draft-hutton-rtcweb-nat-firewall-considerations

From: "Hutton, Andrew" <[email-masked]>
Date: Thu, 2 Jan 2014 14:56:01 +0000

Hi Sergio,

Going back over some old mails with a view to restarting this discussion and updating my draft.

With regard to the transparent proxy could you explain why there is an advantage to using the RTP over websockets approach as compared to the HTTP CONNECT mechanism as currently described in draft-hutton-rtcweb-nat-firewall-considerations.

Regards
Andy

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: 23 September 2013 10:46
> To: [email-masked]; Hutton, Andrew
> Cc: [email-masked]; [email-masked]
> Subject: RE: [pntaw] New version of draft-hutton-rtcweb-nat-firewall-
> considerations
> 
> Hi,
> 
> Sergio Carcia Murillo wrote:
> >
> > El 22/09/2013 0:48, Hutton, Andrew escribió:
> > > I just don't see any advantage in the TURN over Websockets approach
> over
> > the HTTP Connect initiated tunnel which works without any new
> protocol and
> > therefore works with existing TURN servers.
> >
> > How about transparent proxying?
> >
> 
> Can you elaborate on this?
> 
> I think in either case the proxy sees possibly one transaction. In TURN
> over HTTP CONNECT established TLS connection, the proxy sees the HTTP
> CONNECT transaction and it's destination URI. If it's just
> "transparently" proxying, things will work, which is what we want. On
> the other hand, if there is some explicit policy, the proxy can also
> apply it - for instance if the destination domain is now allowed. I'm
> not sure if the TURN over WS has any advantages in this regard.
> 
> The disadvantage is that TURN over WS would require a change to TURN
> servers. I know you have argued that it is a very trivial change and I
> believe you, but nevertheless all existing servers would need to be
> upgraded and that's the problem.
> 
> Markus