Subject: [MMUSIC] Destination field in Transport Header - suggested text

From: Aravind Narasimhan <[email-masked]>
Date: Wed, 19 Feb 2003 11:54:13 -0500

Hey Folks,

Here is my attempt to clarify the text for the destination field of the 
transport header.  The action item was from the Feb 05, 03' conference 
call where the idea of having authorization form the recipient of the 
stream was proposed.  The current text in draft-02 is:

>     destination: The address to which a stream will be sent.  The       |
>          client may specify the destination address with the destina-   |
>          tion parameter. To avoid becoming the unwitting perpetrator of |
>          a remote-controlled denial-of-service attack, a server SHOULD  |
>          authenticate the client and SHOULD log such attempts before    |
>          allowing the client to direct a media stream to an address not |
>          chosen by the server. This is particularly important if RTSP   |
>          commands are issued via UDP, but implementations cannot rely   |
>          on TCP as reliable means of client identification by itself.   |
>          IPv6 addresses is RECOMMENDED to be given as fully qualified   |
>          domain to make it backwards compatible with RFC 2326 implemen- |
>          tations.                                                       |
>

The new suggested text to be placed in Section 12.40, p 75:

    destination:  The address of the stream recipient to which a stream  |
          will be sent. The client originating the RTSP request may      |
          specify the destination address of the stream recipient with   |
          the destination parameter.  When the destination field is      |
          specified, the recipient may be a different party than the     |
          originator of the request. To avoid becoming the unwitting     |
          perpetrator of a remote-controlled denial-of-service attack, a |
          server SHOULD authenticate the client originating the request  |
          and SHOULD log such attempts before allowing the client to     |
          direct a media stream to a recipient address not chosen by the |
          server. While, this is particularly important if RTSP commands |
          are issued via UDP, implementations cannot rely on TCP as      |
          reliable means of client identification by itself either.      |
                                                                         |
          The server SHOULD NOT allow the destination field to be set    |
          unless a mechanism exists in the system to authorize the       |
          request originator to direct streams to the recipient.  It is  |
          preferred that this authorization be performed by the          |
          recipient itself and the credentials passed along to the       |
          server.  However, in certain cases, such as when recipient     |
          address is a multicast group, or when the recipient is unable  |
          to communicate with the server in an out-of-band manner, this  |
          may not be possible.  In these cases server may chose another  |
          method such as a server-resident authorization list to ensure  |
          that the request originator has the proper credentials to      |
          request stream delivery to the recipient.                      |
                                                                         |
          IPv6 addresses are RECOMMENDED to be given as fully qualified  |
          domain to make it backwards compatible with RFC 2326 implemen- |
          tations.                                                       |

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic