Subject: [tram] Removing Permissionless ICE relay support from turnbis draft

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 14 Feb 2019 10:35:42 +0000

Hi all,

The Permissionless ICE relay support added to the turnbis draft has hit a roadblock during the security review by Eric, Martin and Christian. The security attack identified is as follows:

The TURN client currently expects that it will not receive anything via the
server from a peer that it did not explicitly permit. Based on that
assumption, the client could assume that receiving such an unsolicited
packets indicates compromise of either the local network or the server
itself, and it could reasonably decide not to trust the local network or
the server to transport its communication.

In order to address the above threat additional changes are required to the draft to incorporate one of the following proposals:

[1] Martin suggested to add an extension that the client can include when creating the binding to request this behavior, and a signal in the response that indicates that this configuration has been applied.

[2] Dan proposed to create permissions based on STUN username to avoid the permissionless problem in the TRAM mailing list, see https://mailarchive.ietf.org/arch/msg/tram/T66px9mcjcqyvBypHpnMutKOEfk).

[3] Brandon and Justin had submitted a draft (https://tools.ietf.org/html/draft-williams-tram-ufrag-permission-00) to introduce a new type of TURN permission that will allow any ICE connectivity check message that contains the offerer's ufrag value to be accepted on a relay address for delivery over the associated TURN tunnel.

Since it too late in the process to discuss and adopt one of these proposals, we are planning to remove this optimization from turnbis draft.

If there is interest in the WG to pursue Permissionless ICE relay support, a new draft can be published.

Cheers,
-Tiru