Subject: [p2p-sip] SIP, ICE, and an Overlay Network

From: slavitch at objectworld.com (Michael Slavitch)
Date: Thu, 16 Mar 2006 10:18:03 -0500

In such a case a nice P2P protocol would set the HTTP request header
user agent designator to be something truly 'P2PSIP', keeping the
firewall guys happy. Make it politically correct, make it nice, and make
it work.

This means that existing firewalls could support P2PSIP monitoring
without any state changes, only a new policy. 
This would make them and their customers very happy and remove a pain
point as discussed yesterday at VON.

It is an interesting way of solving the problem, and making
bootstrap/configuration friendly and polite.

M

Michael Slavitch           Lead, Strategic Initiatives 
slavitch at objectworld.com   Objectworld Communications Corp. 
+1.613.599.9698 .225       Ottawa, Ontario, Canada

-----Original Message-----
From: p2p-sip-bounces at cs.columbia.edu
[mailto:p2p-sip-bounces at cs.columbia.edu] On Behalf Of Aki Niemi
Sent: March 16, 2006 4:16 AM
To: ext Juha Heinanen
Cc: P2P-SIP
Subject: Re: [p2p-sip] SIP, ICE, and an Overlay Network

Hi Juha,

ext Juha Heinanen wrote:
> Michael Slavitch writes:
> 
>  > The people I need to talk to use Skype.  Nobody that I need to talk

> to  > even knows openser exists, apart from a few alpha geeks, and 
> even  > those alpha geeks use Skype because it's easier, the Skype 
> client is  > better, and Skype is what their girlfriends use.
> 
> i tried to ask, why Skype's NAT traversal is technically better than 
> openser's.  what i have heard about Skype is that it uses very similar

> technology, except that mediaproxies are distributed to customers'
> computers.

I think the main additional thing is that Skype also does a bunch of,
say, "politically incorrect" things, like tunnel via HTTP proxies, to
port 443, etc.

Cheers,
Aki
_______________________________________________
p2p-sip mailing list
p2p-sip at cs.columbia.edu
https://lists.cs.columbia.edu/cucslists/listinfo/p2p-sip

--

-----------------------------------------------

This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful. 

Any views, opinions and content presented in this e-mail are solely those of the author and may not represent those of Objectworld Communications Corp.

---

From: gregd at research.panasonic.com (Greg Daley)
Date: Thu, 16 Mar 2006 15:31:02 -0500

Hi Michael,

> bootstrap/configuration friendly and polite.

We don't want to do this, as it requires modification of proxy
and firewall infrastructure.

There is a reason why we have assigned port numbers.
It's so people can tell what's travelling on a certain port.

If an admin has to install a new firewall or proxy (or upgrade) in
order to stop access of VoIP across my network boundary, they're
either going to be upset at IETF, or not going to let the software
be deployed at all on the network.

So we should have a protocol which is easily identifiable, and
easily blockable (conversely easily openable if need be).  The
security ADs would eat us for dinner if we proposed http traversal
just to get around an organization's legitimately configured
firewall.

Let proprietary vendors do it, and we'll see which protocol is
left on the corporate LAN.

Greg

---

From: slavitch at gmail.com (Michael Slavitch)
Date: Thu, 16 Mar 2006 13:27:33 -0800

Forwarded to the list.

---------- Forwarded message ----------
From: Michael Slavitch <slavitch at gmail.com>
Date: Mar 16, 2006 1:25 PM
Subject: Re: [p2p-sip] SIP, ICE, and an Overlay Network
To: Greg Daley <gregd at research.panasonic.com>

Depending on port numbers for security becomes silly when NAT
traversal comes into play.
If your customers depend on static numbering they are truly kidding
themselves. How is it not easily identifiable?  It is a content lookup
on http.  It is polite, W3 stuff. So what is a well-known number?  I
get access to my file system over WEBDAV. WEBDAV runs over http1.1,
giving me access to an entire network structure over http. Outlook and
Exchange use 443 for reading and writing email if you so choose, and
if your settings are correct you have access to a file system through
outlook.  Streaming video, voice, you name it  runs over 80 or 443.
Google mail pop access is over 995 and something else.

I have 2G of disk space on my gmail drive, which I can get access to over 443.

A clever hack to get around a firewall guessing about access is to
have the equivalent of a secure-id card on  a web server,  an http get
request gives you a server port number that only responds to your
request (an interesting abstraction of STUN).

If the firewall cannot read content the firewall is useless.  NAT
traversal by definition breaks the well-known number rule so that must
be off the table.

A few years ago I got tired of a rather nasty firewall and I put an
ssh server on port 443, and with port tunneling I made an instant
homebrew VPN in a few minutes.   The security officer at this firm
insisted that this was impossible,  and didn't understand it even when
I showed him (I was doing a network analysis, it was part of my job).

Depending on 'well-known numbers' when the world can run anything over
80 or 443 means that your customers do not have a firewall, they have
a port restrictor.

Security through stupidity isn't security.

M

--
Michael Slavitch
Ottawa, Ontario Canada

--
Michael Slavitch
Ottawa, Ontario Canada

---

From: slavitch at gmail.com (Michael Slavitch)
Date: Thu, 16 Mar 2006 13:33:53 -0800

If WebDav passed security AD's, so must P2PSIP/HTTPS.

E-commerce occurs using WebDav so security is I assume under control
in the application layer.

--
Michael Slavitch
Ottawa, Ontario Canada

---

From: gregd at research.panasonic.com (Greg Daley)
Date: Thu, 16 Mar 2006 17:06:37 -0500

Hi Michael,

You are missing the point.
I'm not for relying on port numbers for security.

I'm for not overloading the mechanisms _yet again_
and allowing systems administrators to:

1) Identify the traffic on the network

2) Provide basic policy control.

People will certainly be able to tunnel stuff out
of the network using customized tools.  I'm just
saying we shouldn't build our protocol on top of the
idea.  Put P2P over SIP over HTTP over SSH over DNS if
you like, just don't propose it when other people are
having a serious attempt at chartering a working group.

People will think the group hasn't made a serious
consideration of operational security requirements.

It's also worth considering that while _outbound_ HTTP
HTTPS and DNS are common on the Internet.  How many
companies allow them inbound?

We're going to have to allow inbound traffic.  Why
not have a well known port?

Greg

---

From: gregd at research.panasonic.com (Greg Daley)
Date: Thu, 16 Mar 2006 17:27:24 -0500

Hi Michael,

> in the application layer.

You've essentially picked a limited, assymmetric application
which requires a server to illustrate how security will work
in a P2P network.  Sure it's fine for file storage.  There are
only a finite number of operations you can do.

Saying something is possible doesn't mean it's a good
match, though.

Providing explicit protocol/port identification allows
straightforward troubleshooting and control.  Sure it doesn't
always work, but it's the principle that most firewalls
are based upon today, and matches the paradigm.

I don't know why you're so against it. Perhaps you have an
esoteric reason you could reveal to the group?

Greg

---

From: dbarrett at quinthar.com (David Barrett)
Date: Thu, 16 Mar 2006 14:28:46 -0800

It seems to me the key sticking point is deciding which is more important:

1) Adhering to the spirit of the IANA
2) Creating a system that "just works" as well as Skype

Clearly, if we can do both, then there's no conflict.  But in the event that
we can't do both, which wins?

I think Michael is arguing that the user trumps all (even if it means
ignoring the IANA).  And I think Greg is arguing that the IANA numbering
can't be violated (even if it means limiting functionality for users).

Personally, I'm in Michael's camp -- if what we make isn't at least as good
for users as Skype is today (and remember, it'll only get better), then
there will be little gain from our effort.

Thus while I like the idea of using well-known IANA port numbers, and I'm
eager to find a way to stick within its guidelines, I'm more concerned with
making the best experience for users.

-david

> From: p2p-sip-bounces at cs.columbia.edu [mailto:p2p-sip-
> bounces at cs.columbia.edu] On Behalf Of Greg Daley
> Sent: Thursday, March 16, 2006 2:07 PM
> To: Michael Slavitch
> Cc: P2P-SIP
> Subject: Re: [p2p-sip] Fwd: SIP, ICE, and an Overlay Network
> 
> Hi Michael,
>

---

From: aki.niemi at nokia.com (Aki Niemi)
Date: Fri, 17 Mar 2006 00:30:23 +0200

Hi,

Many IM clients make use of the HTTP connect (or alternatively, use
socks) method to get through firewalls. Of course, if you for example
run Oscar, then you'd make HTTP connect to port 5190. Your firewall
admin may or may not allow connects to that port.

I think writing up how to use CONNECT (RFC 2817) to connect to port 5060
is trivial. It also has a better chance of getting through IESG review
than explaining how to tunnel P2PSIP over port 443. Probably some ADs
could chime in here with their opinions on this matter.

Also...

> not have a well known port?

Naturally the TCP connection you open using the HTTP proxy works in both
directions. It does require the supernode you connected to to relay
traffic, instead of simply redirecting, though.

Cheers,
Aki

---

From: jh at tutpro.com (Juha Heinanen)
Date: Fri, 17 Mar 2006 00:48:55 +0200

> making the best experience for users.

since we have DNS SRV records, there are no use for well known port
numbers for any application than perhaps DNS.  a firewall that believes
that port 80 or 443 traffic is web traffic is really stupid.

-- juha

---

From: dbarrett at quinthar.com (David Barrett)
Date: Thu, 16 Mar 2006 14:53:13 -0800

> From: Juha Heinanen [mailto:jh at tutpro.com]

Well, stupid or not, I think the argument is that port 80 is "supposed" to
only be HTTP according to the IANA.  The question is to what degree we are
bound by the IANA's guidelines.

-david