Subject: RE: [SIP] meaning of IP address in SDP

From: Romel Khan <[email-masked]>
Date: Tue, 1 May 2001 19:15:45 -0400

Service providers may have a need to be able to send RTP streams to a port
and receive RTP streams from a different port (different IP address and UDP
port). Jonathan Rosenberg's point would solve that need. But security is
definitely an issue (i.e. if no encryption method such as TLS/SSL has been
decided between sender & receiver). After an entity sends its receiving port
through SDP and does not care who sends data to that receiving port is most
probably not going to be an acceptable solution to many providers who may
not wish to use encryption either. 
So shouldn't SDP RFC be enhanced to be able to include the sending port in
case different from the receiving port?

Thanks.

Romel Khan
Ph: (732)-363-0213, x241

-----Original Message-----
From: Christian Huitema [mailto:[email-masked]]
Sent: Tuesday, May 01, 2001 5:11 PM
To: Jonathan Rosenberg
Cc: [email-masked]
Subject: RE: [SIP] meaning of IP address in SDP

Jonathan,

The point were this is likely to be tested is firewall traversal. For
security reasons, we are tempted to open a pinhole that specifies a
"five tuple" -- source and destination IP address and port, protocol
type. This requires being able to predict the source address used by the
other end. According to your rule, we would not be able to do that. This
seems reason enough to reconsider.

By the way, the technical argument that you give is weak. It is possible
to bind a socket to an address, which makes address selection possible
even on multi-homed machines.

-- Christian Huitema

> -----Original Message-----
> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Friday, April 27, 2001 1:46 PM
> To: [email-masked]'
> Subject: [SIP] meaning of IP address in SDP
> 
> Folks,
> 
> There appears to be some continuing confusion about the interpretation
of
> the IP address in the SDP of an INVITE or 200 OK.
> 
> When user A sends an INVITE with SDP, and the stream is sendrecv
(which is
> the default), the IP address in the c line for that stream is the
address
> where A expects to receive media for that stream. It DOES NOT imply
that
> the
> source address of media that A sends will be equal to that IP address.
The
> source IP address is chosen by the underlying OS based on its routing
> tables. As such, a multihomed host has no way to know what the source
> address of its RTP packets will be, until it actually tries to send
them.
> So, clearly, the IP address in the c line in the INVITE cannot
possibly be
> the source address, since A doesn't even know yet where it will send
> packets.
> 
> Unfortunately, since rfc2543 does not explicitly say that the source
> address
> won't be the address in the c line, several implementations appear to
have
> assumed that it will be. I want to make sure we are clear that this
> assumption is false.
> 
> Please, in your implementations, do not make any assumptions about the
> source address of media.
> 
> Thanks,
> Jonathan R.
> 
> ---
> Jonathan D. Rosenberg                       72 Eagle Rock Ave.
> Chief Scientist                             First Floor
> dynamicsoft                                 East Hanover, NJ 07936
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
> 
> 
> _______________________________________________
> This list is for continuing development of the SIP protocol.
> The sip-implementor's list is the place to discuss implementation,
> and to receive advice on understanding existing sip.
> To subscribe to it, send mail to
> [email-masked] with "subscribe" in the body.

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

---

From: "Ranjit Avasarala" <[email-masked]>
Date: Tue, 1 May 2001 18:38:54 -0500

Hi
    But why should the receiver know about sender's sending port? Like if
you go back to socket programming, the server only
needs to know client's receiving port for sending data. it does not bother
about client's sending port. So I feel there is no need
to include sender's port number in the data.

Any comments??

Regards
Ranjit

----- Original Message -----
From: Romel Khan <[email-masked]>
To: 'Christian Huitema' <[email-masked]>; Jonathan Rosenberg
<[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, May 01, 2001 6:15 PM
Subject: RE: [SIP] meaning of IP address in SDP

Thanks.

Romel Khan
Ph: (732)-363-0213, x241

-----Original Message-----
From: Christian Huitema [mailto:[email-masked]]
Sent: Tuesday, May 01, 2001 5:11 PM
To: Jonathan Rosenberg
Cc: [email-masked]
Subject: RE: [SIP] meaning of IP address in SDP

Jonathan,

-- Christian Huitema

of
(which is
address
that
The
them.
possibly be
have

---

From: "Bob Penfield" <[email-masked]>
Date: Wed, 2 May 2001 00:47:42 -0400

----- Original Message -----
From: "Ranjit Avasarala" <[email-masked]>
To: "Romel Khan" <[email-masked]>; "'Christian Huitema'"
<[email-masked]>; "Jonathan Rosenberg"
<[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, May 01, 2001 7:38 PM
Subject: Re: [SIP] meaning of IP address in SDP

> to include sender's port number in the data.

The receiver (UAS) does not need to know the sender's sending port, but a
SIP proxy or ALG in the signalling path that needs to tell a middlebox (e.g.
NAT or Firewall) to let the RTP flow thru needs the sender's sending port,
otherwise it has to say let all packets from any IP Address and port thru to
the sender's (UAC's) receiving port. That would be a very bad thing from a
security point of view.

Bob
d:-)

---

From: "Medhavi" <[email-masked]>
Date: Tue, 1 May 2001 22:00:22 -0400

I dont think that source port/IP address checks provide
any security in this matter. The real security would be using
encryption which may be expensive and hard to get right.

If a hacker wants to break down a call, or interfere with it,
changing the source address/port of the packets which he sends
to that of the actual source is probably the easiest thing to do.
So if the receiver is concerned about security, he must take other
measures as well, in addition to source check. Once we have them in place,
maybe the source check wont be that necessary, and may in fact become
a problem for protocol design later.

----- Original Message -----
From: "Bob Penfield" <[email-masked]>
To: "Ranjit Avasarala" <[email-masked]>; "Romel Khan"
<[email-masked]>; "'Christian Huitema'"
<[email-masked]>; "Jonathan Rosenberg"
<[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, May 02, 2001 12:47 AM
Subject: Re: [SIP] meaning of IP address in SDP