Subject: Re: [Simple] WGLC of draft-ietf-simple-msrp-sessmatch-09 - Error reporting

From: Christer Holmberg <[email-masked]>
Date: Mon, 20 Dec 2010 20:00:10 +0100

Hi,

I am splitting up the issues in different thread.

For some of the security related issues I will need to discuss with my collegue, who is currently on winter vacation.

Regarding error reporting:
--------------------------

>>The ALG only rewrites the IP addresses/port numbers in the media packages. It is
>>not TCP state aware, nor does it understand the TCP payload (MSRP or TLS/MSRP).
>>The types of errors it can handle are on ICMP level.
>
>I suspect we are talking past each other here - the way I read you statement, If this was true you would not need this draft as the TLS would not need to be man in the middled. 
>I'll point out that TLS works fine thought NATs which change the IP address/port numbers so I suspect the use case is something more than just this. If you and/or I are confused 
>on this, I suspect much of the WG is just as confused.

Unlike a NAT, an ALG modifies the SDP a=path attribute, which causes a UE session matching failure mechanism (when using the 4975 session matching mechanism). The draft is needed, as it modifies the UE session matching mechanism. Again, we are talking about a *UE* extension :)

As far as I know there has never been any claim, or confusion expressed by anyone else in the WG, that an ALG would not be able to able to change the IP address/port in the same manner as a NAT. 

In fact, the whole idea of sessmatch is to allow an ALG to do just that - ie to allow the ALG to tunnel (read: change IP address/port) the MSRP communication, WITHOUT forcing it to terminate TCP/TLS, parse and modify the To-Path/From-Path of the MSRP messages :)

Regards,

Christer