Subject: [Megaco] remote SOURCE address

From: Troy Cauble <[email-masked]>
Date: Thu, 06 Sep 2001 17:03:49 -0400

Section 7.1.8, "Local and Remote Descriptors" distinguishes 
between the two with:

	"Local refers to the media received by the MG and
	Remote refers to the media sent by the MG."

I'd like to see a clarification stating that the remote
destination address (specified by the Remote Descriptor)
is also the remote source address.  (Where "address"
means IP address AND port in UDP.)

Section 10.3 discusses checking the IP address and port
of inbound packets against the Remote Descriptor (but 
doesn't require it).  This presumes that the Remote 
Descriptor describes the remote SOURCE address.

Comments?
-troy

_______________________________________________
Megaco mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/megaco

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Mon, 10 Sep 2001 18:54:38 -0400

The MIDCOM WG is wrestling with the question of how to get some control over
middle boxes such as NATs and firewalls.  SIP has been making the most noise
about what it needs to work with these things, but obviously Megaco/H.248
has some problems too.  We're talking about both the application protocol
and the media streams, of course.  The MIDCOM architectural model assumes
the presence of agents which are aware of application requests, on the one
hand, and are accredited to middle boxes to open pinholes to satisfy those
requests, on the other.  MIDCOM is just finishing up its requirements, after
which it will be rechartered to choose a protocol to operate between the
MIDCOM agent and the middlebox.

My response to you was based on my belief that your proposal was a
declaration of how NATs should work, as opposed to how Megaco/H.248 should
work.  I stand to be corrected, but if I am right, we don't have much chance
of making the declaration stick.

-----Original Message-----
From: Troy Cauble [mailto:[email-masked]]
Sent: Monday, September 10, 2001 5:33 PM
To: Taylor, Tom-PT [NORSE:B881:EXCH]
Cc: MEGACO list
Subject: Re: [Megaco] remote SOURCE address

Tom,

NATs cause issues more fundamental than whether or 
not the remote source address is the remote destination 
address.  Setting up the media stream through NATs is
tricky in general.  I don't think the requirement that
the remote destination address be the remote source address
adds any difficulty.

If you can negotiate an exposed IP4 address and port on 
the NAT to serve as the other MG's remote destination 
address, I see no reason that it can't also serve as the
remote source address.

The setup is an interesting question though.  If an MG is 
behind a NAT, returning it's hidden (probably non-routable) 
address in response to an Add wouldn't be any good.  It seems
that either

A) the MG must be NAT-aware and return an IP and port (*) 
on the NAT in response to an Add, or 

B) the NAT is smart enough to hack H.248 messages as they pass
through!  (Unlikely!)

Either is pretty ugly.

  *  Unless given some ability to reserve ports on the NAT box,
     I think an MG could operate as an "exposed host".  But I
     think this approach could still have NAT-port-conflicts
     with applications on other hosts.  Otherwise the MG could 
     be restricted to a resonably small, known range of port numbers.  
     Either way, you run into problems supporting more than one MG 
     behind the same NAT.

Have NATs been addressed anywhere (w.r.t. H.248)?

If it wasn't obvious, I brought up the remote-source-address question
because I'm worried about "barge-in".  As 10.3 points out, having a 
known remote source address to check against isn't perfect (address 
spoofing), but it's better than nothing.

I really don't see encryption as a practical means of stopping "barge-in".

What's an MG supposed to do, accept RTP traffic from anywhere?

-troy

> Tom-PT Taylor wrote:
> 
> On the one hand, you're absolutely right about what sec. 10.3 assumes.  On
> the other, I suspect it's an optimistic assumption.  It's especially
> dangerous where NATs sit between the source and destination.
> 
> Anyone else want to comment?
> 
> -----Original Message-----
> From: Troy Cauble [mailto:[email-masked]]
> Sent: Thursday, September 06, 2001 5:04 PM
> To: MEGACO list
> Subject: [Megaco] remote SOURCE address
>