Subject: [rtcweb] Why http://www.ietf.org/id/draft-miniero-rtcweb-http-fallback-00.txt ?

From: Iñaki Baz Castillo <[email-masked]>
Date: Tue, 7 Aug 2012 20:04:00 +0200

Hi, I'm reading
http://www.ietf.org/id/draft-miniero-rtcweb-http-fallback-00.txt:

   This draft describes a way to implement an HTTP Fallback for RTP
   media streams, that is, a way to effectively encapsulate RTP packets
   in HTTP messages in order to traverse proxies and firewalls.

Well, why does WebRTC need it at all? don't we have TURN over TCP/TLS?

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Tue, 07 Aug 2012 11:12:38 -0700

On 08/07/2012 11:04 AM, Iñaki Baz Castillo wrote:
> This draft describes a way to implement an HTTP Fallback for RTP media
> streams, that is, a way to effectively encapsulate RTP packets in HTTP
> messages in order to traverse proxies and firewalls.
> 

Or TURN over Websocket.

- -- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: http://blog.marc.petit-huguenin.org
Profile: http://www.linkedin.com/in/petithug

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Tue, 7 Aug 2012 20:18:58 +0200

> Or TURN over Websocket.

Why do we need that? By using TURN over TLS we have all we need to
avoid stupid hotel's firewalls (that provide "Internet free access"
but just for HTTP port 80 and HTTPS port 443). It just about setting a
TURN server listening TLS on port 443, am I right?

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: Roman Shpount <[email-masked]>
Date: Tue, 7 Aug 2012 14:30:03 -0400

> TURN server listening TLS on port 443, am I right?
You still got the locations where the only way to connect to anything is
via the man-in-the-middle accept HTTP request and resend it proxies. Such
proxies will install their own certificate in the client certificate chain
and will decode every request. TURN over websocket will work over such
connection, but regular TURN will not. I am not sure how much effort we
want to spend supporting this, since we are talking about prisons,
military, and other similar nice places which will generally would try to
avoid supporting WebRTC due to its own security.
_____________
Roman Shpount

---

From: Lorenzo Miniero <[email-masked]>
Date: Tue, 7 Aug 2012 21:00:42 +0200

Iñaki,

discussions would be much easier to follow if you just answered to the original thread, rather than opening a new one... about your question, please see inline.

On Tue, 7 Aug 2012 20:18:58 +0200

> TURN server listening TLS on port 443, am I right?

"Do we need that" is exactly what I wanted to ask by publishing the draft. There was already some discussions in the past, someone even suggested just deploying TURN over HTTP (a bit like Marc's point on WebSockets), and TURN over TLS (or just anything on 443, for what matters) is another viable solution.

The problem IMHO is that, just as Roman pointed out in his reply, that's not always a way out. In my experience such a scenario is not only limited to those ultra-closed environments he mentioned, but that's probably debatable (who closes his network that way, probably doesn't want anything else to go through anyway).

About the "just pipe everything on 443", please refer to my reply to Hannes in the original thread, as I've answered more extensively there.

Lorenzo

> -- 
> Iñaki Baz Castillo
> <[email-masked]>
> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb

-- 
Lorenzo Miniero, COB

Meetecho s.r.l.
Web Conferencing and Collaboration Tools
http://www.meetecho.com