Subject: RE: [Sip] B2BUA - Security

From: "Mahey, Sonit" <[email-masked]>
Date: Thu, 5 Dec 2002 13:00:20 -0500

Thanks, Christian.

Assuming IPv4 addresses and without delving into the draft RFC on STUN:
The SDP contains the RTP/RTCP port numbers that are private and these are
also required to be NAT'd. Now, if the SDP, which forms part of the SIP
body, is encrypted, how will RTP/RTCP ports be translated?

regards,
- sonit

> -----Original Message-----
> From: Christian Huitema [mailto:[email-masked]]
> Sent: Thursday, December 05, 2002 12:54 PM
> To: Mahey, Sonit; Jonathan Rosenberg; Pete Cordell
> Cc: [email-masked]
> Subject: RE: [Sip] B2BUA - Security
> 
> 
> > From: Mahey, Sonit [mailto:[email-masked]]
> > Sent: Thursday, December 05, 2002 9:14 AM
> >
> > I agree with Jonathan.
> > 
> > That brings up the question:
> > Is NAT traversal for encrypted SIP traffic addressed anywhere?
> 
> There are two possibilities. If your application only uses UDP, it is
> possible to use IPv4 and STUN to find out the "outside ports" for your
> UDP traffic (check draft-ietf-midcom-stun-03.txt); you may need to use
> the "a:rtcp" convention to encode port numbers in SDP (check
> draft-ietf-mmusic-sdp4nat-03.txt). If you need to also support TCP, or
> use IPSEC, or generally do away with the complications of 
> NAT, the best
> solution is to just move to IPv6; see Teredo
> (draft-ietf-ngtrans-shipworm-08.txt) for one possible way to 
> carry IPv6
> across NAT, and 6to4 (RFC 3056 & 3068) for a possible way to 
> upgrade the
> NAT and make it an IPv6 router.
> 
> -- Christian Huitema
> 
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 06 Dec 2002 01:13:44 -0500

When STUN is used, there is no need to translate. THe client itself 
inserts the proper addresses.

If you are not using stun, and rather using an ALG or an FCP ala midcom, 
and the SIP body is encrypted, well, right now you are out of luck. I 
will once again point out that this is the reason I wrote the session 
policy draft:

http://www.jdrosen.net/papers/draft-rosenberg-sipping-session-policy-00.txt

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com