Subject: Re: [martini] Culling tel URIs

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 2 Feb 2010 13:53:40 -0800

[BA] Speaking for myself, I'm fine with culling the TEL URI.  

Adam Roach said:

"Unless application of RFC3263 to those domains somehow yields the IP
address of the PBX, then the answer is a firm "no." "

[BA] This certainly makes sense from a security point of view.   However,
this problem also exists with single AOR registration - so all the question
is whether the requirement is "don't make things worse by circumventing RFC
3263" or whether we're adding a new requirement in addition to RFC 3263.
Personally, I'm fine with requiring that use of domain names in contact URIs
go along with provisioning of A/AAAA and SRV/NAPTR RRs since dynamic DNS
services are widely available and inexpensive.

---

From: Adam Roach <[email-masked]>
Date: Tue, 02 Feb 2010 16:07:06 -0600

On 2/2/10 15:53, Feb 2, Bernard Aboba wrote:
> [BA] This certainly makes sense from a security point of view.   
> However, this problem also exists with single AOR registration -- so 
> all the question is whether the requirement is "don't make things 
> worse by circumventing RFC 3263" or whether we're adding a new 
> requirement *in addition to* RFC 3263.
>

We're not adding anything new here. If I sent a REGISTER to my service 
provider with a Contact URI of "sip:[email-masked]" -- but took no steps 
to guarantee that RFC3263 procedures applied to the domain "roach.at" 
resolved to me -- then I would be a fool to think that incoming requests 
would magically route to one of my devices.

>    Personally, I'm fine with requiring that use of domain names in 
> contact URIs go along with provisioning of A/AAAA and SRV/NAPTR RRs 
> since dynamic DNS services are widely available and inexpensive.
>

Right. So am I. If the PBX wants to keep DNS updated with its current IP 
address, then it would be free to use a domain name instead of an IP 
address. However, the MARTINI requirements currently make an assertion 
that we can't assume that such a record will exist and be kept up to date.

But while you and I seem to agree on what would be required to use a 
domain name in the R-URI from the SSP to the PBX, that's not what (some? 
most?) MARTINI particpants have been arguing for. AFAICT, the argument 
has been  that we don't bother putting any domain information in DNS 
that resolves to the PBX, but want to design a mechanism whereby -- as I 
put it above -- incoming requests with a domain in the R-URI magically 
route to a the right place.

/a

---

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 2 Feb 2010 14:49:55 -0800

Adam Roach said:

"Right. So am I. If the PBX wants to keep DNS updated with its current IP
address, then it would be free to use a domain name instead of an IP
address." 

[BA] Yes. 

"However, the MARTINI requirements currently make an assertion that we can't
assume that such a record will exist and be kept up to date."

[BA] Right - but not having the RRs in place has consequences - using a
domain name has requires a demonstration of authorization to do so.  

"But while you and I seem to agree on what would be required to use a domain
name in the R-URI from the SSP to the PBX, that's not what (some? most?)
MARTINI particpants have been arguing for. "

[BA] There are two distinct types of proposals that are being discussed, and
at times it is hard to figure out which one is being referred to. One is
"domain registration" in which it is assumed that there are no RRs in place.
The other (which seems like it could be relevant to either the MARTINI up or
"shaken" proposals) is use of a domain name in a Contact URI, where there
may be RRs in place.   Since these approaches have different security
properties, it would be helpful to be clear about which one we're talking
about.  For example, with respect to "domain registration" discussion seems
to have concluded that the domain needs to be delegated by the SSP.
However, for a Contact URI, we only need the RRs to be in place and correct
in order for the SSP to verify ownership.     

AFAICT, the argument has been  that we don't bother putting any domain
information in DNS that resolves to the PBX, but want to design a mechanism
whereby -- as I put it above -- incoming requests with a domain in the R-URI
magically route to a the right place.

[BA] Clearly there will be limits to what can be allowed in order to prevent
security problems.  To prevent confusion though, it would be helpful to be
clear about which restrictions apply to which proposals and in what
circumstances.