Subject: [Sipping] New I-D on SIP NAT and Firewall Scenarios and Solutions

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 16 Nov 2001 11:46:24 -0500

Folks,

Rohan Mahy, myself, and Sanjoy Sen submitted a new I-D that documents
scenarios and solutions for a whole bunch of different NAT and firewall
scenarios for SIP. It should appear in the archives shortly, but until it
does, you can pick it up at:

http://www.jdrosen.net/papers/draft-rosenberg-sipping-nat-scenarios-00.txt

It needs a lot more work, but should hopefully help people understand how
all of the various  drafts and solutions fit together.

Thanks,
Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sipping mailing list  http://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Shai Mohaban" <[email-masked]>
Date: Sat, 17 Nov 2001 20:36:17 -0800

Jonathan,

I find this nice and simple for a change...:-)
One comment regarding the security considerations (section 11). You are
saying: "TURN has the important property that compromise of the TURN servers
cannot cause security breaches when the client is within an enterprise." and
I am not sure this is true. Correct me if I am wrong but it seems that a
malicious TURN server can decide to send to the client any traffic it likes
as long as it is coming from the mapped address and port. More than that,
the server can decide when a "call" (or whatever the data stream stands for)
starts and ends and can fake "calls" in general (one at a time, though),
including their content...
I guess we should at least add that authenticating the server is highly
recommended...

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of Jonathan Rosenberg
> Sent: Friday, November 16, 2001 8:46 AM
> To: [email-masked]'
> Cc: [email-masked]'
> Subject: [midcom] New I-D on SIP NAT and Firewall Scenarios and Solutions
>
>
> Folks,
>
> midcom mailing list
> [email-masked]
> http://www1.ietf.org/mailman/listinfo/midcom