Subject: RE: [Sip] draft-ietf-sip-outbound

From: "Samir Srivastava" <[email-masked]>
Date: Tue, 28 Mar 2006 03:21:40 -0600

I am happy to see there are some who wants to discuss merits/demerits
....

More in line below.

Thx
Samir

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Monday, March 27, 2006 11:36 PM
To: Srivastava, Samir [SC100:8826:EXCH]; Audet, Francois
[SC100:3055:EXCH]; [email-masked];
[email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: RE: [Sip] draft-ietf-sip-outbound

Hi,

I am happy to see the WG to gradually gain rough consensus also on the
mailing list. Here are some comments for a couple of issues that you
raised:

> 3. The other objection was for Authrization. For the old proxies, 
> Client can resubmit the request with creditenials.
> Do we need authrization for KEEP ALIVE traffic ? 

No we definitely do not need it, and the fact that it would be difficult
to disable authorization for PING (considering the old proxies that do
not recognize the method) would just dilute the argument of PING being
backwards compatible towards old proxies. It might be, but there are
known risks.

SS>> Even If PING needs to be authorized, but I have PING with
MAX-FORWARDS =0, then It will not process the PING further and return
483 ( 3261 Section 16.3 item 3 last para). 
Are you thinking anything else, please explain if so.

> STUN also has it ... compare it with MESSAGE-INTEGRITY option of STUN 
> ?

Latest STUN bis introduces STUN usage for NAT keepalive and there is
still an open question if the integrity check would be needed. My
opinion is that for this purpose the integrity check could be disabled.

   The username and password used for STUN integrity can be used for 24
   hours.

      Issue:  do we need message integrity for keepalives when doing
      STUN and SIP on the same port?

SS>> If I am bad guy, who sends the STUN keep alives, with changing /
faked source IP, how
     we want to address it. Only initial handshake (Shared Secret)is
over TLS, correct. I think
Security section of outbound-03 needs to include attacks caused by
"excessive keep alives, which don't adhere to described timers". One can
signal to IDS/IPS if SIP 503 timer is not acknowledged repeatedly by a
UA. What we do for STUN ?

> 5. stun-keepalive flag advantage can be used for PING too with similar

> ping-keepalive flag.

There is currently another thread with subject
RE: [Sip] How to indicate during proxy discovery
thataproxysupports"outbound"

If the conclusion of the thread is that discovery would be done with DNS
(and if there is just STUN keepalive mechanism
specified) then Outbound could drop the keepalive flags alltogether.
At least I could not any more find use for them, to be used within the
protocol between UA and network.

SS>> Fine. I am waiting for the decsion. This is minor point overall. I
prefer less overloading, if we might find some problem ( e.g. PRACK
discussions) then it is easy to fix.

Regards,

Erkki

>-----Original Message-----
>From: ext Samir Srivastava [mailto:[email-masked]]
>Sent: 28.March.2006 04:48
>To: Francois Audet; Dean Willis; Christer Holmberg ((JO/LMF))
>Cc: [email-masked]; Drage, Keith (Keith); [email-masked]
>Subject: RE: [Sip] draft-ietf-sip-outbound
>
>I agree. But need concrete info where PING was bad.
>
>Thx
>Samir
>
>-----Original Message-----
>From: Audet, Francois [SC100:3055:EXCH]
>Sent: Monday, March 27, 2006 3:07 PM
>To: Dean Willis; Christer Holmberg ((JO/LMF))
>Cc: [email-masked]; Drage, Keith (Keith); [email-masked]
>Subject: RE: [Sip] draft-ietf-sip-outbound
>
>Agree.
>
>The last meeting did indeed produce a strong rough consensus that the 
>way forward was STUN-over-SIP for both UDP and TCP.
>
>As one of the strongest proponent of the PING method, I think it is 
>time to move on and and rally behind the concensus. The community will 
>be best served if we finalize sip-outbound rapidly.
>
>
>
>
>
>> -----Original Message-----
>> From: Dean Willis [mailto:[email-masked]]
>> Sent: Monday, March 27, 2006 14:56
>> To: Christer Holmberg ((JO/LMF))
>> Cc: [email-masked]; Drage, Keith (Keith); [email-masked]
>> Subject: Re: [Sip] draft-ietf-sip-outbound
>> 
>> 
>> 
>> On Mar 27, 2006, at 2:13 AM, Christer Holmberg ((JO/LMF)) wrote:
>> 
>> >
>> > Hi,
>> >
>> > I was not at the face-to-face meeting, but from the mail
>> discussion I
>> > haven't seen a sign of consensus.
>> 
>> Having been the judge-of-consensus at the meeting, I noted
>about 185
>> hands in favor of STUN and about 5 holding out for PING.
>> 
>> That's a pretty strong rough consensus. Admittedly, some of
>the more
>> vocal PING proponents weren't present, but my sense of the
>matter is
>> that the wider body of opinion does favor pursuing the 
>> standardization of the STUN approach.
>> 
>> There was also a clear sense that the community wanted to
>document a
>> single path rather than a set of alternatives. We've had a lot of 
>> folks recently airing frustrations about our usual tendency to 
>> document all proposed solutions to every problem and the rather 
>> horrible interoperability problem that approach might (or may already
>> have) lead to.
>> 
>> --
>> Dean Willis
>> Chair, SIP working group
>> 
>> _______________________________________________
>> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>> This list is for NEW development of the core SIP Protocol Use 
>> [email-masked] for questions on current sip Use 
>> [email-masked] for new developments on the application of sip
>> 
>> 
>
>_______________________________________________
>Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>This list is for NEW development of the core SIP Protocol Use 
>[email-masked] for questions on current sip Use 
>[email-masked] for new developments on the application of sip
>
>
>_______________________________________________
>Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>This list is for NEW development of the core SIP Protocol Use 
>[email-masked] for questions on current sip Use 
>[email-masked] for new developments on the application of sip
>

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: <[email-masked]>
Date: Tue, 28 Mar 2006 13:32:01 +0300

Hi !

>I am happy to see there are some who wants to discuss merits/demerits

OK, even if I am not sure how long I would like to sustain
the discussion as the consensus has more or less settled down
and there is some other work also to be done ...

I have to admit that I have not personally studied the related
security implications deeply, but gave my comments based on 
the arguments and counterarguments I had earlier seen in this
thread. Anyway, here some more thoughts:

>faked source IP, how we want to address it.

I am not sure what kind of harm this specific kind of attack would
make. If the source IP is faked, then the NAT would not any more
pass the STUN response from proxy back to the UA. The UA would only 
correctly see the responses to its STUN request and detect flow failures
accordingly. Remember that according to Outbound it is the
responsibility
of the UA to monitor the state of the flow and try re-establishing it if
necessary.

Or did you mean the case that the bad guy would monitor the UA sending
STUN Binding Requests and send bad responses back before the proxy
sends the good response ? In such a MITM attack the UA would try 
re-registration after each keepalive. But if we would like to 
prevent such an attack, STUN is definitely better than SIP PING
as STUN allows the UA to authenticate the response while there
is no such possibility for SIP responses. The cost however is that
the proxy would be required to perform all the STUN processing for
message integrity and authentication. I am not totally sure what
is the cost-benefit ratio in this case, STUN with or without
authentication sounds viable to me.

>"excessive keep alives, which don't adhere to described 
>timers".

If someone sends a massive amount of rogue PING or STUN keepalives 
to proxy for a DoS attack, I do not think the used protocol really 
makes a difference.

>Are you thinking anything else, please explain if so.

Seems to me that it could be done like that. I do not have any further 
comments to this, in addition to the discussion Jonathan already
gave in the thread earlier:

> So, a normal RFC3261 compliant proxy WILL NOT reject a PING 
> request with a 501. You can force it to reject any request, 
> including PING, by setting Max-Forwards to zero. But the point 
> is, there is lots of other processing in a standard proxy that 
> is going to interfere with your assumptions in this PING method.

And at that point the discussion went to a number of other directions.

Regards,

Erkki

>Sent: 28.March.2006 12:22
>To: Koivusalo Erkki (Nokia-TP-MSW/Helsinki); Francois Audet; 
>[email-masked]; [email-masked]