Traversal Using Relays around NAT (TURN) Resolution Mechanism(Unaffiliated)petithug@acm.orgThis document defines a resolution mechanism to generate a list of server transport addresses that can be tried to create a Traversal Using Relays around NAT (TURN) allocation.
The TURN specification defines a process for a TURN client to find TURN servers by using DNS SRV resource records, but this process does not let the TURN server administrators provision the preferred TURN transport protocol between the client and the server and for the TURN client to discover this preference.
This document defines an S-NAPTR application for this purpose.
This application defines "RELAY" as an application service tag and "turn.udp", "turn.tcp", and "turn.tls" as application protocol tags.
Another usage of the resolution mechanism described in this document would be Remote Hosting as described in section 4.4.
For example a VoIP provider who does not want to deploy TURN servers could use the servers deployed by another company but could still want to provide configuration parameters to its customers without explicitly showing this relationship.
The mechanism permits one to implement this indirection, without preventing the company hosting the TURN servers from managing them as it see fit.
can be used as a convenient way of carrying the four components needed by the resolution mechanism described in this document.The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .
The resolution mechanism is used only to create an allocation.
All other transactions use the IP address, transport and port used for a successful allocation creation.
The resolution algorithm uses a boolean flag, <secure>; an IP address or domain name, <host>; a port number that can be empty, <port>; and a transport name that can be "udp", "tcp" or empty, <transport> as input.
This four parameters are part of the user configuration of the TURN client.
The resolution mechanism also uses as input a list ordered by preference of TURN transports (UDP, TCP, TLS) supported that is provided by the application using the TURN client.
This list reflects the capabilities and preferences of the application code as opposed to the configuration parameters that reflect the preferences of the user of the application.
The output of the algorithm is a list of {IP address, transport, port} tuples that a TURN client can try in order to create an allocation on a TURN server.
An Allocate error response as specified in section 6.4 of is processed as a failure as specified by section 2.2.4.
The resolution stops when a TURN client gets a successful Allocate response from a TURN server.
After an allocation succeeds or all the allocations fail, the resolution context MUST be discarded and the resolution algorithm MUST be restarted from the beginning for any subsequent allocation.
Servers blacklisted as described in section 6.4 of SHOULD NOT be used for the specified duration even if returned by a subsequent resolution.
First the resolution algorithm checks that the parameters can be resolved with the list of TURN transports supported by the application:If <secure> is false and <transport> is defined as "udp" but the list of TURN transports supported by the application does not contain UDP then the resolution MUST stop with an error.If <secure> is false and <transport> is defined as "tcp" but the list of TURN transports supported by the application does not contain TCP then the resolution MUST stop with an error.If <secure> is true and <transport> is defined as "udp" then the algorithm MUST stop with an error.If <secure> is true and <transport> is defined as "tcp" but the list of TURN transports supported by the application does not contain TLS then the resolution MUST stop with an error.If <secure> is true and <transport> is not defined but the list of TURN transports supported by the application does not contain TLS then the resolution MUST stop with an error.If <transport> is defined but unknown then the resolution MUST stop with an error.
After verifying the validity of the URI elements, the algorithm filters the list of TURN transports supported by the application by removing the UDP and TCP TURN transport if <secure> is true.
If the list of TURN transports is empty after this filtering, the resolution MUST stop with an error.
After filtering the list of TURN transports supported by the application, the algorithm applies the steps described below.
Note that in some steps, <secure> and <transport> have to be converted to a TURN transport.
If <secure> is false and <transport> is defined as "udp" then the TURN UDP transport is used.
If <secure> is false and <transport> is defined as "tcp" then the TURN TCP transport is used.
If <secure> is true and <transport> is defined as "tcp" then the TURN TLS transport is used.
This is summarized in .
<secure><transport>TURN Transportfalse"udp"UDPfalse"tcp"TCPtrue"tcp"TLS
If <host> is an IP address, then it indicates the specific IP address to be used.
If <port> is not defined, the default port declared in for the "turn" SRV service name if <secure> is false, or the "turns" SRV service name if <secure> is true MUST be used for contacting the TURN server.
If <transport> is defined then <secure> and <transport> are converted to a TURN transport as specified in .
If <transport> is not defined, the filtered TURN transports supported by the application are tried by preference order.
If the TURN client cannot contact a TURN server with this IP address and port on any of the transports supported by the application then the resolution MUST stop with an error.
If <host> is a domain name and <port> is defined, then <host> is resolved to a list of IP addresses via DNS A and AAAA queries.
If <transport> is defined, then <secure> and <transport> are converted to a TURN transport as specified in .
If <transport> is not defined, the filtered TURN transports supported by the application are tried in preference order.
The TURN client can choose the order to contact the resolved IP addresses in any implementation-specific way.
If the TURN client cannot contact a TURN server with this port, the transport or list of transports, and the resolved IP addresses, then the resolution MUST stop with an error.
If <host> is a domain name and <port> is not defined but <transport> is defined, then the SRV algorithm defined in is used to generate a list of IP address and port tuples.
<host> is used as Name, a value of false for <secure> as "turn" for Service, a value of true for <secure> as "turns" for Service and <transport> as Protocol in the SRV algorithm.
<secure> and <transport> are converted to a TURN transport as specified in and this transport is used with each tuple for contacting the TURN server.
The SRV algorithm recommends doing an A query if the SRV query returns an error or no SRV RR;
in this case the default port declared in for the "turn" SRV service name if <secure> is false, or the "turns" SRV service name if <secure> is true MUST be used for contacting the TURN server.
Also in this case, this specification modifies the SRV algorithm by recommending an A and AAAA query.
If the TURN client cannot contact a TURN server at any of the IP address and port tuples returned by the SRV algorithm with the transport converted from <secure> and <transport> then the resolution MUST stop with an error.
If <host> is a domain name and <port> and <transport> are not defined, then <host> is converted to an ordered list of IP address, port and transport tuples via the S-NAPTR algorithm defined in by using <host> as the initial target domain name and "RELAY" as the Application Service Tag.
The filtered list of TURN transports supported by the application are converted in Application Protocol Tags by using "turn.udp" if the TURN transport is UDP, "turn.tcp" if the TURN transport is TCP and "turn.tls" if the TURN transport is TLS.
The order to try the Application Protocol Tags is provided by the ranking of the first set of NAPTR records.
If multiple Application Protocol Tags have the same ranking, the preferred order set by the application is used.
If the first NAPTR query fails, the processing continues in step 5.
If the TURN client cannot contact a TURN server with any of the IP address, port and transport tuples returned by the S-NAPTR algorithm then the resolution MUST stop with an error.
If the first NAPTR query in the previous step does not return any result then the SRV algorithm defined in is used to generate a list of IP address and port tuples.
The SRV algorithm is applied by using each transport in the filtered list of TURN transports supported by the application for the Protocol, <host> for the Name, "turn" for the Service if <secure> is false or "turns" for the Service if <secure> is true.
The same transport that was used to generate a list of tuples is used with each of this tuples for contacting the TURN server.
The SRV algorithm recommends doing an A query if the SRV query returns an error or no SRV RR;
in this case the default port declared in for the "turn" SRV service name if <secure> is false, or the "turns" SRV service name if <secure> is true MUST be used for contacting the TURN server.
Also in this case, this specification modifies the SRV algorithm by recommending an A and AAAA query.
If the TURN client cannot contact a TURN server at any of the IP address and port tuples returned by the SRV algorithm with the transports from the filtered list then the resolution MUST stop with an error.
With the DNS RRs in and an ordered TURN transport list of {TLS, TCP, UDP}, the resolution algorithm will convert the parameters <secure> with a value of false, <host> with a value of "example.net" and <port> and <transport> been empty to the list of IP addresses, port and protocol tuples in .OrderProtocolIP addressPort1UDP192.0.2.134782TLS192.0.2.153493TCP192.0.2.15000
In the example in , a VoIP provider (example.com) is using the TURN servers managed by the administrators of the example.net domain (defined in ).
The resolution algorithm using the ordered TURN transport list of {TLS, TCP, UDP} would convert the same parameters than in the previous example but with the <host> parameter equal to "example.com" to the list of IP addresses, port and protocol tuples in .
Security considerations for TURN are discussed in .
The Application Service Tag and Application Protocol Tags defined in this document do not introduce any specific security issues beyond the security considerations discussed in .
requests that an S-NAPTR application defines some form of end-to-end authentication to ensure that the correct destination has been reached.
This is achieved by the Long-Term Credential Mechanism defined in [RFC5389], which is mandatory for TURN.
Additionally the usage of TLS has the capability to address the requirement.
In this case the client MUST verify the identity of the server by following the identification procedure in section 7.2.2 of .
This section contains the registration information for one S-NAPTR Application Service Tag and three S-NAPTR Application Protocol Tags (in accordance with ).Application Protocol Tag: RELAYIntended usage: See .Interoperability considerations: N/ASecurity considerations: See .Relevant publications: This document.Contact information: Marc Petit-Huguenin <petithug@acm.org>Author/Change controller: The IESGApplication Protocol Tag: turn.udpIntended usage: See .Interoperability considerations: N/ASecurity considerations: See .Relevant publications: This document.Contact information: Marc Petit-Huguenin <petithug@acm.org>Author/Change controller: The IESGApplication Protocol Tag: turn.tcpIntended usage: See .Interoperability considerations: Security considerations: See .Relevant publications: This document.Contact information: Marc Petit-Huguenin <petithug@acm.org>Author/Change controller: The IESGApplication Protocol Tag: turn.tlsIntended usage: See .Interoperability considerations: N/ASecurity considerations: See .Relevant publications: This document.Contact information: Marc Petit-Huguenin <petithug@acm.org>Author/Change controller: The IESGThanks to Pasi Eronen, Margaret Wasserman, Magnus Westerlund, Juergen Schoenwaelder, Sean Turner, Ted Hardie, Dave Thaler, Alfred E. Heggestad, Eilon Yardeni, Dan Wing, Alfred Hoenes and Jim Kleck for their comments, suggestions and questions that helped to improve this document.This document was written with the xml2rfc tool described in .Key words for use in RFCs to Indicate Requirement LevelsHarvard University1350 Mass. Ave.CambridgeMA 02138- +1 617 495 3864sob@harvard.edu
General
keyword
In many standards track documents several words are used to signify
the requirements in the specification. These words are often
capitalized. This document defines these words as they should be
interpreted in IETF documents. Authors who follow these guidelines
should incorporate this phrase near the beginning of their document:
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
RFC 2119.
Note that the force of these words is modified by the requirement
level of the document in which they are used.
A DNS RR for specifying the location of services (DNS SRV)Troll TechWaldemar Thranes gate 98BOsloN-0175NO+47 22 806390+47 22 806380arnt@troll.noInternet Software Consortium950 Charter StreetRedwood CityCA94063US+1 650 779 7001Microsoft CorporationOne Microsoft WayRedmondWA98052USlevone@microsoft.comThis document describes a DNS RR which specifies the location of the
server(s) for a specific protocol and domain.Domain-Based Application Service Location Using SRV RRs and the Dynamic Delegation Discovery Service (DDDS)This memo defines a generalized mechanism for application service naming that allows service location without relying on rigid domain naming conventions (so-called name hacks). The proposal defines a Dynamic Delegation Discovery System (DDDS) Application to map domain name, application service name, and application protocol dynamically to target server and port. [STANDARDS TRACK]Augmented BNF for Syntax Specifications: ABNFInternet technical specifications often need to define a formal syntax. Over the years, a modified version of Backus-Naur Form (BNF), called Augmented BNF (ABNF), has been popular among many Internet specifications. The current specification documents ABNF. It balances compactness and simplicity with reasonable representational power. The differences between standard BNF and ABNF involve naming rules, repetition, alternatives, order-independence, and value ranges. This specification also supplies additional rule definitions and encoding for a core lexical analyzer of the type common to several Internet specifications. [STANDARDS TRACK]Session Traversal Utilities for NAT (STUN)Session Traversal Utilities for NAT (STUN) is a protocol that serves as a tool for other protocols in dealing with Network Address Translator (NAT) traversal. It can be used by an endpoint to determine the IP address and port allocated to it by a NAT. It can also be used to check connectivity between two endpoints, and as a keep-alive protocol to maintain NAT bindings. STUN works with many existing NATs, and does not require any special behavior from them.</t><t> STUN is not a NAT traversal solution by itself. Rather, it is a tool to be used in the context of a NAT traversal solution. This is an important change from the previous version of this specification (RFC 3489), which presented STUN as a complete solution.</t><t> This document obsoletes RFC 3489. [STANDARDS TRACK]Traversal Using Relays around NAT (TURN): Relay Extensions to Session Traversal Utilities for NAT (STUN)If a host is located behind a NAT, then in certain situations it can be impossible for that host to communicate directly with other hosts (peers). In these situations, it is necessary for the host to use the services of an intermediate node that acts as a communication relay. This specification defines a protocol, called TURN (Traversal Using Relays around NAT), that allows the host to control the operation of the relay and to exchange packets with its peers using the relay. TURN differs from some other relay control protocols in that it allows a client to communicate with multiple peers using a single relay address. The TURN protocol was designed to be used as part of the ICE (Interactive Connectivity Establishment) approach to NAT traversal, though it can be also used without ICE.Writing I-Ds and RFCs using XMLInvisible Worlds, Inc.660 York StreetSan FranciscoCA94110US+1 415 695 3975mrose@not.invisible.nethttp://invisible.net/
General
RFCRequest for CommentsI-DInternet-DraftXMLExtensible Markup LanguageThis memo presents a technique for using XML
(Extensible Markup Language)
as a source format for documents in the Internet-Drafts (I-Ds) and
Request for Comments (RFC) series.Guidelines and Registration Procedures for New URI SchemesThis document provides guidelines and recommendations for the definition of Uniform Resource Identifier (URI) schemes. It also updates the process and IANA registry for URI schemes. It obsoletes both RFC 2717 and RFC 2718. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.Traversal Using Relays around NAT (TURN) Uniform Resource IdentifiersThis document defines two URI schemes that can be used to provision the configuration values needed by the resolution mechanism defined in .This section must be removed before publication as an RFC.Moved the URI stuff to .Improved the algorithm steps.It is possible to use a TLS transport event if the scheme is turn:.Clarified when to stop the resolution with an error in step 2.Added transport list filtering process.Improved security section following sec-dir review.Fixed nits reported by gen-art review.Added example for remote hosting.Removed URIs section.Editorial modification.
A turn:<host>?transport=TCP URI fails if the list of supported transports contains only TLS.
Using a TLS transport in this case was underspecified.
Reordered paragraphes in section 4.Added table for conversion of <scheme> and <transport> to TURN transport.Various editorial modifications.SRV algorithm changed to "...recommending an A and AAAA query."Put back the changelog for the versions before been accepted as WG item.Shorten the abstract so it does not overflow on the second page.Added text to explicitly say that the resolution is only to create an allocation.Added text about failures.Fixed the default port for TLS in the example.Changed some priority in the example for RFC3958 section 2.2.5.Fixed the service/protocol order for the SRV RR in the example.Removed reference to draft-wood-tae-specifying-uri-transports as it has an experimental status.Fixed the contact email.Changed the IPR to trust200902.Added case for transport defined but unknown.Moved RFC 3958 to Normative References.Added study of draft-wood-tae-specifying-uri-transports in TODO list.Renamed the document to "draft-ietf-behave-turn-uri".Changed author affiliation.Fixed the text in the IANA considerations.Added Running Code Consideration section.Added Remote Hosting example in introduction.
Changed back to opaque URIs because of Section 2.2.
Now use "?" as separator.
Added IANA considerations section.Added security considerations section.Receiving a successful Allocate response stops the resolution mechanism and the resolution context must be discarded after this.Changed from opaque to hierarchical URIs because the ";" character is used in <reg-name>.Various nits.Added <transport-ext> in the ABNF.Use the <rulename> and "literal" usages for free-form text defined by .Fixed various typos.Put the rule to convert <scheme> and <transport> to a TURN transport in a separate paragraph.Modified the SRV usage to be in line with RFC 2782.Clarified that the NAPTR protocol ranking must be used before the application ranking.Added an example.Added release notes.The Application Service Tag is "RELAY" so other relaying mechanisms than TURN (e.g., TWIST) can be registered as Application Protocol Tags.S-NAPTR was preferred to U-NAPTR because there is no use case for U-NAPTR.Adding optional capabilities (IPv6 allocation, preserve bit, etc...) in the resolution process was rejected at the Dublin meeting.
Zap (<http://www.croczilla.com/zap>).
Eilon Yardeni, 8x8 Inc.
Implements version -00.
Reference Implementation of TURN URI parser and resolver (<http://ietf.implementers.org/turn-uri-0.3.zip>).
Marc Petit-Huguenin.
Implements version -05.
(Empty)