Subject: RE: [Sip] Proxies Can Modify SDP?

From: "Abbie Barbir"<[email-masked]>
Date: Tue, 5 Feb 2002 13:23:34 -0500

how about a compressed one?

abbie

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Tuesday, February 05, 2002 10:41 AM
> To: Taylor, Tom-PT [CAR:B800:EXCH]
> Cc: [email-masked]'
> Subject: [Sip] Proxies Can Modify SDP?
> 
> 
> Tom-PT Taylor writes:
>  > I've been involved in a little bit of correspondence with 
> TIPHON WG 3, where
>  > there is some question whether proxies are allowed to 
> modify SDP.  I know
>  > this has shown up in E-mail, but it does not show up in 
> 2543bis.  Could
>  > someone confirm this so I can forward the message to TIPHON? 
> 
>    A better question to ask is what happens when a
>    proxy wants to modify SDP, but the SDP was either
>    sent encrypted or end to end.
> 
> 		  Mike
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
>

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 05 Feb 2002 18:49:30 -0500

Danger, Will Robinson, danger!

Having proxies muck with bodies, for the purposes of nat traversal,
compression for low speed access, and so on, is very dangerous
territory. It brings us to issues of robustness, integrity and informed
consent which have been the pain of opes for well over a year now. I
suggest you read RFC 3238 for a summary of some of the issues.

The use of encryption alone means that we know for certain that this
mechanism will not work in many cases. I recommend we steer clear of it
in the spec. Another nicety I came up with was Require. What happens if
a UA modifies the semantic of SDP in some way, and uses Require to
enforce it? Now, the "proxy" will need to look at the Require headers
too. Hmm. Sounds like a B2BUA again.

That means that the column for Content-Length under proxy would be "ar",
since we will need to add one when converting from UDP to TCP. The spec
will mention that as the reason this value is present. However, I
believe the spec should remain as is with regards to the other content
headers; proxies are not supposed to muck with them.

Now, it is true that, ahem, certain prominent sip vendors have products
called firewall control proxies which muck with the SDP. Whether these
things are rightly proxies, based on the SIP spec, or a B2BUA, is more a
matter of technical marketing than standards, so I would not lose too
much sleep over it. Its far less a stretch than what people are calling
softswitches these days ;). Our job here at IETF is to write standards
that work and are good for the Internet.

Thanks,
Jonathan R.

Abbie Barbir wrote:
> > From: Michael Thomas [ mailto:[email-masked] <mailto:[email-masked]> ]
> <https://www1.ietf.org/mailman/listinfo/sip>

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com

---

From: Michael Thomas <[email-masked]>
Date: Tue, 5 Feb 2002 18:00:59 -0800 (PST)

What is the bright line distinction between this
and a proxy (re)writing remote party id? I've
never been entirely comfortable with this general
subject either, but I think it's a bit overbroad
to say that we haven't embarked on this slippery
slope.

		Mike

---

From: Matt Holdrege <[email-masked]>
Date: Tue, 05 Feb 2002 17:58:49 -0800

So should the bis draft mention something about how you SHOULD not mess 
with SDP in between endpoints? I think the lack of such a statement is 
showing right now. It led to this thread.

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 08 Feb 2002 14:53:15 -0500

> to say that we haven't embarked on this slippery

Well, in the case of R-PID, the header was inserted by a proxy in the
first place; its one of these headers thats supposed to be mucked with.

-Jonathan R.