Subject: [Ice] TLS Candidates

From: "Pal Martinsen (palmarti)" <[email-masked]>
Date: Mon, 23 Jan 2017 19:28:36 +0000

Hi all,

There is a need for TLS candidates. We did an implementations, so we thought is was a good idea to write up a draft.

Is this something others are interested in as well?
(As there seems to be no ICE meeting next IETF it would be nice to get the discussion started on the list)

.-.
Pål-Erik

Begin forwarded message:

From: <[email-masked]<mailto:[email-masked]>>
Subject: New Version Notification for draft-martinsen-ice-tls-candidates-00.txt
Date: 20 January 2017 at 14:08:09 GMT+1
To: Nathan Buckles <[email-masked]<mailto:[email-masked]>>, Paal-Erik Martinsen <[email-masked]<mailto:[email-masked]>>

A new version of I-D, draft-martinsen-ice-tls-candidates-00.txt
has been successfully submitted by Paal-Erik Martinsen and posted to the
IETF repository.

Name: draft-martinsen-ice-tls-candidates
Revision: 00
Title: TLS Candidates for ICE
Document date: 2017-01-20
Group: Individual Submission
Pages: 6
URL:            https://www.ietf.org/internet-drafts/draft-martinsen-ice-tls-candidates-00.txt
Status:         https://datatracker.ietf.org/doc/draft-martinsen-ice-tls-candidates/
Htmlized:       https://tools.ietf.org/html/draft-martinsen-ice-tls-candidates-00

Abstract:
  This document introduces TLS candidates to ICE.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.

The IETF Secretariat

---

From: Roman Shpount <[email-masked]>
Date: Mon, 23 Jan 2017 14:44:07 -0500

This is something we are interested in as well. We had looked at TLS ICE
candidates to help traverse some of the more restrictive firewalls.

Regards,

_____________
Roman Shpount

On Mon, Jan 23, 2017 at 2:28 PM, Pal Martinsen (palmarti) <
[email-masked]> wrote:

> Hi all,
>
> There is a need for TLS candidates. We did an implementations, so we
> thought is was a good idea to write up a draft.
>
> *From: *<[email-masked]>
> *Subject: **New Version Notification for
> draft-martinsen-ice-tls-candidates-00.txt*
> *Date: *20 January 2017 at 14:08:09 GMT+1
> *To: *Nathan Buckles <[email-masked]>, Paal-Erik Martinsen <
> [email-masked]>
>
>
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
>
> _______________________________________________
> Ice mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ice
>
>

---

From: Simon Perreault <[email-masked]>
Date: Mon, 23 Jan 2017 15:12:13 -0500

> candidates to help traverse some of the more restrictive firewalls.

Interesting!

Pål-Erik, is your use case also about firewall traversal?

-- 
Simon Perreault
Director of Engineering, Platform | Jive Communications, Inc.
https://jive.com | +1 418 478 0989 ext. 1241 | [email-masked]

---

From: "Pal Martinsen (palmarti)" <[email-masked]>
Date: Tue, 24 Jan 2017 11:57:33 +0000

> On 23 Jan 2017, at 21:12, Simon Perreault <[email-masked]> wrote:
> 

Yes.

Main use-case is where we terminate media at a ICE-lite node and do not want to use a TURN relay.
(In this case we do not want the extra complexity running a set of TURN servers gives us)

A lot of enterprises seems to lock down to TLS 443 and even a HTTP proxy.
(Proxies are briefly mentioned in the draft)

.-.
Pål-Erik

---

From: Peter Thatcher <[email-masked]>
Date: Tue, 24 Jan 2017 21:21:53 +0000

Our implementation of ICE has a type of candidate called "SSLTCP" which
does a fake TLS handshake to get through firewalls that only allow TLS
connections.  We've been using it for years.  And I'm guessing some of our
web products would appreciate that being in other browsers as well, so we
may be interested in seeing it as part of the standard (or a less fake
version of it).  But I don't have any stats about how often those work but
normal TCP candidates don't, so I can't say for sure how useful it really
is.

Yes.

Main use-case is where we terminate media at a ICE-lite node and do not
want to use a TURN relay.
(In this case we do not want the extra complexity running a set of TURN
servers gives us)

.-.
Pål-Erik

> https://jive.com | +1 418 478 0989 ext. 1241 <(418)%20478-0989> |
[email-masked]

---

From: Roman Shpount <[email-masked]>
Date: Tue, 24 Jan 2017 16:55:51 -0500

We have encountered a few large corporate installations that only allowed
TLS connections to port 443. Running TURNS server on port 443 or
nonstandard TLS ICE candidates was the only way to connect calls from these
deployments to the outside world. These installation were few thousand
seats each and belonged to Fortune 100 company. At least for us it was
enough of the incentive to find a solution.

Regards,

_____________
Roman Shpount

On Tue, Jan 24, 2017 at 4:21 PM, Peter Thatcher <[email-masked]>
wrote:

> On Tue, Jan 24, 2017 at 3:57 AM Pal Martinsen (palmarti) <