Subject: [Sip] draft-rosenberg-sip-outbound-discovery-mid-dialog - dhcp overide or not?

From: Cullen Jennings <[email-masked]>
Date: Fri, 3 Nov 2006 18:25:35 -0800

There is an issues about using outbound proxies discovered thought  
DHCP where it is not clear to me what we want the solution to be.  
Once we are clear on the desired behavior it is trivial to get the  
draft to provide that. Let me try to describe the problem...

If a phone has no configuration, no proxies, no aor etc and it gets  
connected to the networks and finds out a proxy name via DHCP and  
uses that to make outbound calls, I have no problem that is great.  
The question is what happens with a phone that is configured, has a  
AOR, credentials, etc.

One view is that if DHCP returns a result, you use that as the  
outbound. The argument will be made that this is the way you discover  
the proxy in the hotel that lets you traverse the firewall. But  
consider the security implications of this. It means that anyone that  
spoof a DHCP response at a wireless hot spot can force you to connect  
to them. Even if you are doing SIPS, you will pass all your signaling  
through the attackers proxy and they will be able to see it all.

Perhaps there is a part of this that I am missing but the more I  
think about it, it does not seem like you want to actually use  
outbound proxies that were discovered via DHCP.

(Note this has nothing to do with a home proxy telling you to use a  
proxy in a visited network - here someone you trust, the home proxy,  
told you to trust the proxy in the visited network)

--------

One other trivial note - when talking about the names in the  
certificates, I think the text needs to be updated a bit to cover  
certificates that have more than one name in them

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 06 Nov 2006 17:30:43 -0500

You raise an excellent point, Cullen. This is actually a pretty 
fundamental architectural issue that we need to discuss. Its much 
broader than the outbound discovery draft.

The question is - if I'm "roaming" and my SIP UA finds itself in the 
domain of another IP access network provider (like a  hotel), do I need 
to use its SIP services in order to communicate back to my home network? 
I think we've had this model for a long time that said you did, for 
things like firewall traversal and maybe even visited QoS authorization. 
The "hotel" proxy has been a staple of SIP thinking for a long time.

However, there are several issues here:

1. first and foremost, I think the idea tha a visited *access* provider 
even needs to have application layer proxies (like a SIP proxy), is 
anathema to the entire IP model. The idea with IP is to separate access 
for applications. I should be able to get the SIP services from my SIP 
provider without the access network even knowing how to spell SIP.

2. With technologies like ICE, we have far better solutions for firewall 
traversal. The visited network (a hotel for example), could deploy a 
firewall, and black inbound packets unless a pinhole is opened from 
inside to out. The STUN checks would create such a pinhole, and it would 
not require any application layer intelligence in the firewall.

3. the issue Cullen has raised, whereby there is no trust with the 
visited network. Why would I include some unknown random proxy on my 
signaling path? They have no right to see my signaling, any more than 
they would have a right to view my web browsing.

If folks agree to that, its not clear what to *do* about it. To some 
degree it implies we need to deprecate the entire usage of DHCP for 
discoverying proxy servers....

-Jonathan R.

Cullen Jennings wrote:

> 
> There is an issues about using outbound proxies discovered thought  DHCP 
> where it is not clear to me what we want the solution to be.  Once we 
> are clear on the desired behavior it is trivial to get the  draft to 
> provide that. Let me try to describe the problem...
> 
> connected to the networks and finds out a proxy name via DHCP and  uses 
> that to make outbound calls, I have no problem that is great.  The 
> question is what happens with a phone that is configured, has a  AOR, 
> credentials, etc.
> 
> Perhaps there is a part of this that I am missing but the more I  think 
> about it, it does not seem like you want to actually use  outbound 
> proxies that were discovered via DHCP.
> 

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: [email-masked] (Juha Heinanen)
Date: Tue, 7 Nov 2006 08:47:44 +0200

> discoverying proxy servers....

the idea of using visiting network's sip resources is completely bogus
and so is dhcp configuration of sip ua.  the idea of using visited
network's sip resources is yet another bad idea that 3gpp has adopted
for the sole reason of being able to milk the cow as many times as
possible.  in order to support dhcp free configuration of sip ua, we
should have included jonathan's outbound autodiscovery mechanism in
outbound, but for some reason, some people didn't agree to it.

-- juah