Subject: RE: [SIP] Proxies modifying SDP

From: Baniel Uri-CUB001 <[email-masked]>
Date: Mon, 18 Dec 2000 22:11:34 -0600

Thanks a lot , Steve, sounds good!

Uri 

-----Original Message-----
From: Steve Donovan
To: Baniel Uri-CUB001; 'Neil Deason'; [email-masked]; [email-masked]; [email-masked]
Sent: 12/18/00 7:17 PM
Subject: RE: [SIP] Proxies modifying SDP

Baniel,

Thanks for the clarification.  Keep in mind that I am not an expert on
H.323, so I don't fully understand the H323 gate keeper mode you refer
to.

This said, in order to implement what you refer to, you have a few
options,
none of which directly  involves a proxy.

- The easiest way to handle this is to put a SIP user agent directly on
the
media gateway and have that user agent directly determine the address of
and
type of media to use for the call.

- If you want to have another device "control" the media flow, this is
more
appropriately done using a Media Gateway Controller (MGC).  The MGC
would be
a SIP end point, not a proxy.  It would communicate with the MG using
one of
the control protocols (MGCP, MEGACO, ...).  With it being a SIP
end-point,
it can do what ever it wants to the SDP, within the bounds of the rules
specified in the SIP specification.

There may be a proxy (or multiple proxies) between the caller and the
MGC/MG, but its job is to route the SIP request.  As stated earlier, the
message body of the request is opaque.

Hope this helps...

Steve

---
Steven R. Donovan
Architect                           dynamicsoft
mailto:[email-masked]     5100 Tennyson Parkway
sip:[email-masked]    Plano, Texas 75025
tel:+1-972-473-5469                 http://www.dynamicsoft.com

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Baniel Uri-CUB001
> Sent: Monday, December 18, 2000 7:05 PM
> To: 'Steve Donovan'; Baniel Uri-CUB001; 'Neil Deason';
> [email-masked]; [email-masked]; [email-masked]
> Subject: RE: [SIP] Proxies modifying SDP
>
>
> Hmm...
> Probably I was not clear and hence the confusion.
> My intention was to be able to mimic the 'H323 gate keeper mode'
> functionality, i.e. to have the end points think they talk to
> each other (in
> the media streaming phase) but actually the media goes via a gate
> keeper. In
> our SIP world this should be just a MG (Media Gateway).
> The control may still go via a SIP proxy server, that is why I think
> changing SDP fields (specifically the IP address for receiving
> media as well
> as the RTP ports) may easily achieve this goal
>
> Uri
>
> -----Original Message-----
> From: Steve Donovan [mailto:[email-masked]]
> Sent: Sunday, December 17, 2000 9:12 PM
> To: Baniel Uri-CUB001; 'Neil Deason'; [email-masked];
> [email-masked]; [email-masked]
> Subject: RE: [SIP] Proxies modifying SDP
>
>
> Although I am having a hard time understanding why it would be
> necessary to
> modify the SDP to cause the call to go through a specific gateway, as
Neil
> correctly points out, this is likely to be a function of a
> back-to-back UA.
>
> Why is it not enough to have the proxy route the call to the gateway
in
> question by changing the request-URI to point to the gateway?
>
> Steve
>
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]]On Behalf Of Baniel Uri-CUB001
> > Sent: Friday, December 15, 2000 1:51 PM
> > To: 'Neil Deason'; [email-masked]; [email-masked];
> > [email-masked]
> > Subject: RE: [SIP] Proxies modifying SDP
> >
> >
> > I see it as the requested way of forcing the media stream to go
> > via an 'IP switch' (like the H323 MCU).
> > If a proxy server is not allowed or if it is not appropriate for
> > it to touch the SDP element, then is there any other way to make
> > sure the media stream goes via our MCU gateway. (There could be
> > various of reasons why we would want to have such a gateway)
> >
> > What do u think?
> >
> > Uri
> >
> > -----Original Message-----
> > From: Neil Deason [mailto:[email-masked]]
> > Sent: Friday, December 15, 2000 12:30 PM
> > To: [email-masked]; [email-masked]; [email-masked]
> > Subject: RE: [SIP] Proxies modifying SDP
> >
> >
> >
> > >Bernie Hoeneisen wrote:
> > > > I have question concerning the case, when SIP proxies modify
SDP,
> > > > which is AFAIK against SIP principles, isn't it?
> > >I do not think so.
> > >Why is that *against* SIP principles?  What principles?'
> >
> > The fundamental concept that payloads are opaque to SIP Proxy
> > Servers. To do this sort of thing you probably want to use a
> > back to back UA.
> >
> > Cheers,
> > Neil.
> > --
> > Ubiquity Software, UK                    www.ubiquity.net
> >
> > > > In the concrete case, proxies would be able to remove certain
codecs
> > > > from the INVITE messages, depending on the current policy in the
> > > > network. (The UAS gets a subset of the codecs, which were
originally
> > > > sent by the UAC.)
> > > > What impact does such a proxy behavior have to SIP? I can think
of
> > > > problems with authentication and message integrity checking
> (UAC signs
> > > > message with its private key).
> > >It certainly depends on the security mechanism used.  For
> e.g., with the
> > >simple basic md5, it does not cause any issue.
> > >
> > >Jean-Francois
> >
> >
>
________________________________________________________________________
_
> > Get Your Private, Free E-mail from MSN Hotmail at
http://www.hotmail.com.
>
>
> _______________________________________________
> SIP mailing list
> [email-masked]
> http://lists.bell-labs.com/mailman/listinfo/sip
>
> _______________________________________________
> SIP mailing list
> [email-masked]
> http://lists.bell-labs.com/mailman/listinfo/sip
>

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: "Francois Audet" <[email-masked]>
Date: Tue, 19 Dec 2000 12:09:15 -0500

Indeed. Media never goes through the gatekeeper.

-----Original Message-----
From: Steve Gardell [mailto:[email-masked]]
Sent: Tuesday, December 19, 2000 08:43
To: 'Baniel Uri-CUB001'; [email-masked]
Subject: RE: [SIP] Proxies modifying SDP

If memory serves, a "fully routed" H.323 gatekeepers routes the media
negotiation signalling, but does not route the actual RTP traffic. 

-----Original Message-----
From: Baniel Uri-CUB001 [mailto:[email-masked]]
Sent: Monday, December 18, 2000 8:05 PM
To: 'Steve Donovan'; Baniel Uri-CUB001; 'Neil Deason';

Hmm...
Probably I was not clear and hence the confusion.
My intention was to be able to mimic the 'H323 gate keeper mode'
functionality, i.e. to have the end points think they talk to each other (in
the media streaming phase) but actually the media goes via a gate keeper. In
our SIP world this should be just a MG (Media Gateway).
The control may still go via a SIP proxy server, that is why I think
changing SDP fields (specifically the IP address for receiving media as well
as the RTP ports) may easily achieve this goal

Uri

-----Original Message-----
From: Steve Donovan [mailto:[email-masked]]
Sent: Sunday, December 17, 2000 9:12 PM
To: Baniel Uri-CUB001; 'Neil Deason'; [email-masked];

Although I am having a hard time understanding why it would be necessary to
modify the SDP to cause the call to go through a specific gateway, as Neil
correctly points out, this is likely to be a function of a back-to-back UA.

Why is it not enough to have the proxy route the call to the gateway in
question by changing the request-URI to point to the gateway?

Steve

> > > I have question concerning the case, when SIP proxies modify SDP,
> > > In the concrete case, proxies would be able to remove certain codecs
> > > network. (The UAS gets a subset of the codecs, which were originally
> > > sent by the UAC.)
> > > What impact does such a proxy behavior have to SIP? I can think of
> > > problems with authentication and message integrity checking (UAC signs
> >It certainly depends on the security mechanism used.  For e.g., with the
> _________________________________________________________________________
> Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
>
>

---

From: Baniel Uri-CUB001 <[email-masked]>
Date: Tue, 19 Dec 2000 11:38:35 -0600

Steve you are definitely right.

H323 Gatekeepers can choose have the signaling go via them or go directly between the end points (or between one of them and an end point) , but that has nothing to do with the media.
It is true though that when a gate keeper 'advertises' the media information of the end point it represents to the other side, it may actually advertise a MG, but you said it already...

Sorry for the mistake

Uri

-----Original Message-----
From: Baniel Uri-CUB001 [mailto:[email-masked]]
Sent: Monday, December 18, 2000 8:05 PM
To: 'Steve Donovan'; Baniel Uri-CUB001; 'Neil Deason';

Hmm...

Uri

-----Original Message-----
From: Steve Donovan [mailto:[email-masked]]
Sent: Sunday, December 17, 2000 9:12 PM
To: Baniel Uri-CUB001; 'Neil Deason'; [email-masked];

Steve

---

From: Baniel Uri-CUB001 <[email-masked]>
Date: Tue, 19 Dec 2000 11:51:18 -0600

Guys

You can not change (IP1,Port1) (for RTP) to (Ip2,Port2) without touching it...
We are still just human beings and the proxies are just machines :)

Uri

-----Original Message-----
From: David Frascone [mailto:[email-masked]]
Sent: Tuesday, December 19, 2000 11:33 AM
To: Neil Deason
Cc: David Frascone; [email-masked]
Subject: Re: [SIP] Proxies modifying SDP

That wasn't the one, but it also illustrates it.  Is there any way to do such
ugliness without modifying SDP?

I'm trying to leave a SDP parser out of my SIP proxy, but it looks like I might
need to include one :(

On Tue, Dec 19, 2000 at 05:20:25PM +0000, Neil Deason wrote:
> David Frascone wrote:
> > 
> > This might be a useless response, since I can't find the example document that
> > I'm about to refer too . . but . . .  In the documents I read before San Diego,
> > I remember two pictures of a proxied senario.
> > 
> > In the first, the SIP requests were proxied, but the RTP was sent normally.
> > 
> > In the second, the SIP requests were proxied, *and* the RTP was proxied.  In
> > this senario, didn't the SIP proxy have to modify the SDP to get it to work?
> > 
> > Please:  I know someone else read this document, or saw the slides I'm
> > refering too . . . . Someone help refresh my poor tired memory :)
> 
> This sounds like the sort of ugliness forced upon us by 
> firewalls. Maybe you're thinking of 
> draft-rosenberg-sip-entfw-00.txt
> 
> hth,
> Neil.
> -- 
> Ubiquity Software Corporation, UK        http://www.ubiquity.net

---

From: "Anuraj Ennai" <[email-masked]>
Date: Wed, 20 Dec 2000 12:47:06 +0530

Hi all,

I believe proxies should be discouraged from prying
into SDP contents(or any message body that does
not concern them) for scalability, security and
privacy reasons.

The mechanism for capability negotiation etc.
should be implemented at UA, using methods
like OPTIONs and/or headers like supported/
Unsupported or Re-INVITEs. It mandates passing
1 or 2 messages more between the UAs, but in the
end scales up well. If the proxy needs SDP content
negotiation, it can spawn its own call agent which
works exactly like the UA.

In the end, it is all about KISS!!!

Thanks & regards
Anuraj Ennai
Wipro Technologies -India.

Subject:
            Re: [SIP] Proxies modifying SDP
       Date:
            Tue, 19 Dec 2000 10:56:04 -0600
      From:
            David Frascone <[email-masked]>
        To:
            Steve Gardell <[email-masked]>
        CC:
            "'Baniel Uri-CUB001'" <[email-masked]>, [email-masked]
 References:
            1

-Dave

---

From: Baniel Uri-CUB001 <[email-masked]>
Date: Wed, 20 Dec 2000 14:18:24 -0600

Oh well... It all sounds rightful and good, but there may be commercial systems, which will be needing this capability though... Life could be ugly I know...

-----Original Message-----
From: Anuraj Ennai [mailto:[email-masked]]
Sent: Wednesday, December 20, 2000 1:17 AM
To: [email-masked]
Subject: Re: [SIP] Proxies modifying SDP

Hi all,

Thanks & regards
Anuraj Ennai

Subject:

-Dave

---

From: Itamar Gilad <[email-masked]>
Date: Thu, 21 Dec 2000 18:18:32 +0200

Bernie,

I agree with you that this is against SIP's definition of what a proxy is
supposed to do (even though I'm not sure it's spelled out in the RFC).  
Another problem I see is that if a proxy removes one or more codecs it might
create an m= line which has no codecs (empty format list).  AFAIK this is
not strictly illegal in SDP, but it might be very confusing for the
receiving UA.  Note that the proxy can't remove any of the m= lines because
according to SIP the calling UA expects to receive the same number of m=
lines in the response as were sent in the INVITE.

   Itamar

> From: Bernie Hoeneisen [mailto:[email-masked]]
> Sent: Tue, December 19, 2000 7:28 PM
> To: [email-masked]
> Cc: Steve Donovan; Baniel Uri-CUB001; Neil Deason; [email-masked];
> Hi again
> On Mon, 18 Dec 2000 [email-masked] wrote:
> 
> > I suspect the original writer refers to some sort of media gateway 
> > that is not  SIP enabled. Therefore one could not simply  proxy the 
> > call to the gateway. 
> 
> My original question was a bit different one and it is not directly 
> related to media gateways.
> In the case I was describing, there are SIP proxies, which know about
> policy in the network and would interact while the INVITE is
> passing them. Such proxies would remove certain codecs from the SDP.
> I have some doubts, that it is a good idea...
> 
> Thus, I am posting my original question again (see below, last line).
> 
> Hoping for more comments on this...
> 
> Cheers
>  Bernie
> 
> PS: Here my original email:
> 
> 
> On Fri, 15 Dec 2000, Bernie Hoeneisen wrote:
> 
> > Are there any other problems? Any comments are appreciated.
> 
>

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 22 Dec 2000 01:32:05 -0500

Since there are no protocol police, we cannot stop people from these things.
In fact, it is sometimes needed in the harsh realities of NATs and
firewalls. When a network entity does this, however, it really ceases being
a logical proxy, and rather looks like a B2BUA. Thats because it will now
need to handle call state, deal with re-INVITEs and changing of the session
media, session timers, Require headers, and so on. Rather than looking at
this as a perverted proxy, viewing it as a B2BUA makes the requirements for
its processing clear - the same as a UA.

-Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

> Sent: Wednesday, December 20, 2000 3:18 PM
> To: 'Anuraj Ennai'; [email-masked]
> Oh well... It all sounds rightful and good, but there may be 
> commercial systems, which will be needing this capability 
> though... Life could be ugly I know...
>