Subject: Re: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft

From: Jiri Kuthan <[email-masked]>
Date: Tue, 04 Mar 2003 16:01:27 +0100

At 09:28 AM 2/27/2003, Gonzalo Camarillo wrote:
>Juha,
>
>[removing SIP (but keeping SIPPING) from the cc: ]
>
>Do you mean that you would like to see a note along these lines added to
>the draft?
>
>"Note that, in order to perform accounting, a SIP proxy server should
>see and authenticate every message sent over the dialog."

It is more difficult than that.

First, you need to have some authentication criteria for calls. Authenticating 
everything is not an option (how about callers from other domains). So it is 
a matter of your domain's policy to tell what calls should go through AAA.
You decide that on receipt of INVITE. That's still trivial.

Now when you decide to authenticate and account a call, the more tricky part
is bye. If a proxy server decides to authenticate/account a call, it must
record-route the original INVITE with some "accounted call" hint. There is
in many cases no other way to correlate thee BYEs to the space of aaa-ed
calls. That's doable too. Just add Record-Route: <sip:foo.bar;lr;use_aaa=yes>

The most compelling issue to me now is integrity of Record-Routes. If 
the BYE originator can send a BYE and manipulate RR (e.g., 
<sip:foo.bar;lr;use_aaa=NO>, it will be obviously useless.

-Jiri 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Gonzalo Camarillo <[email-masked]>
Date: Wed, 05 Mar 2003 12:40:05 +0200

Jiri,

> <sip:foo.bar;lr;use_aaa=NO>, it will be obviously useless.

This is ouside of the scope of the requirements. You can force a request
to traverse a certain proxy using different mechanisms. Those mechanisms
are not SIP-AAA specific.

Gonzalo

---

From: Gonzalo Camarillo <[email-masked]>
Date: Wed, 05 Mar 2003 19:58:39 +0200

Jiri,

> On the other hand, general framework/requriements documents should imho
> spell such considerations as they are strongly tied to security of the
> system as a whole.

Yes, I believe that I will add some considerations to the draft. I
believe that it is worthwhile documenting at least some parts of our
discussions.

Gonzalo

---

From: Jiri Kuthan <[email-masked]>
Date: Wed, 5 Mar 2003 12:04:32 +0100 (MET)

> are not SIP-AAA specific.

Using record-routing in transactional proxy to achieve dialog-based 
AAA functionality is what I have been proposing and I'm glad we
agree on that.

I maintain though, that if record-routing is used in this way and there 
is no integrity of record-routing information, it is not applicable to 
sensitive applications such as AAA.

I of course don't need any spec support to achieve integrity. I can 
add any parameter to record-route and one of them can be a digest value. 
On the other hand, general framework/requriements documents should imho 
spell such considerations as they are strongly tied to security of the 
system as a whole.

-Jiri