Subject: RE: [SIP] 183 in call flows.

From: "Ryner, Jerry" <[email-masked]>
Date: Tue, 17 Apr 2001 17:27:26 -0700

I think there has been some confusion here.  I sent the email raising the
security issue and not Robert.  What I meant by "valid" was simply a well
formed SDP.

My point is that processing packets before an SDP is received can lead to
very poor performance, especially if a new call is attempted very quickly
after a previous call was terminated.  You can imagine a scenario where the
SIP BYE sequence fails due to a network failure to a particular proxy say.
After timing out and returning to Idle, the SIP endpoint initiates a new
call to a different SIP endpoint or proxy.  If the first call's remote
endpoint did not hang up, the new call will be receiving RTP packets from
both endpoints.

Hackers sending RTP (not sophisticated imposters) and "stuck" channels will
also cause problems in this early media phase.

I realize that the bis currently allows for early media without an SDP but I
thought I would share with the forum that we have been requested by major
international carriers to never allow our gateways to do that.

Jerry Ryner
Nuera Communications, Inc.

 -----Original Message-----
From: 	Christer Holmberg [mailto:[email-masked]] 
Sent:	Tuesday, April 17, 2001 3:38 AM
To:	Fairlie-Cuninghame, Robert
Cc:	Ryner, Jerry; [email-masked]'
Subject:	Re: [SIP] 183 in call flows.

 << File: Card for Christer Holmberg >> 
Hi Robert,

First, I guess this is related to the discussion about when the UAC
should be able to receive media in the first place.

It has been proposed (I guess this is also what the bis currently says)
that a UAC should be able to receive media as soon as the INVITE has
been sent, ie. it may receive early media even without a 183 provisional
response. Or, even if a 183 provisional response is sent the media may
"reach" the UAC before the 183 (which is the main reason that the media
channel should be opened after the INVITE).

>Additionally, I do not think it is unreasonable that if you are about
>to send media then you know the address it will be sent from (assuming
>that it will be sent from the same address that you specify in the
>reverse SDP). Are you saying that you shouldn't include SDP in a 200
>OK because it might be behind a NAT? Of course you aren't - the SDP in
>the 183 can only help an ALG resolve this situation not prevent it.

You have to include the SDP in the 200 OK response, but my issue was
more about your proposal to add the SDP as a MUST in the 183 provisional
response, and how you can ensure that it is a "valid" SDP.

Also, I guess the SDP may even change in the 200 OK. Would you then
allow the new SDP? 

Regards,

Christer Holmberg
Ericsson Finland

> Regards,
> 
> Robert.
> 
> -----Original Message-----
> From:   Christer Holmberg [mailto:[email-masked]]
> Sent:   Tuesday, April 17, 2001 7:43 AM
> To:     Ryner, Jerry
> Cc:     Fairlie-Cuninghame, Robert; [email-masked]'
> Subject:        Re: [SIP] 183 in call flows.
> 
>  << File: Card for Christer Holmberg >>
> Hi Robert,
> 
> What do you consider as a "valid" SDP?
> 
> For example, if dynamic IP address allocation is used, or if one party
> 
> is behind a firewall, or in a VPN, it is very difficult to make the
> validity test based on the media IP address. And, if it's only about
> sending any SDP in the 183 message, I think the hacker can also do
> that
> as well.
> 
> Regards,
> 
> Christer Holmberg
> Ericsson Finland