Subject: RE: [SIP] 183 in call flows.

From: "Fairlie-Cuninghame, Robert" <[email-masked]>
Date: Tue, 17 Apr 2001 02:57:18 -0700

Hi Christer,

I did not actually mention security in my original email, however, I don't
think your argument is relevant for 183. If a hacker can sniff the INVITE
and generate a response, why don't they just send a 200 OK with SDP instead
of bothering with a 183 response ? If you want message security use message
authentication or IPSEC.

Additionally, I do not think it is unreasonable that if you are about to
send media then you know the address it will be sent from (assuming that it
will be sent from the same address that you specify in the reverse SDP). Are
you saying that you shouldn't include SDP in a 200 OK because it might be
behind a NAT? Of course you aren't - the SDP in the 183 can only help an ALG
resolve this situation not prevent it. 

Besides, as I pointed out in my original email, I am only trying to make the
handling of early media with 183 Session Progress behave consistently to
early media with other response codes (to simplify the damn thing rather
than complicate it)!

Regards,

Robert.

-----Original Message-----
From:	Christer Holmberg [mailto:[email-masked]]
Sent:	Tuesday, April 17, 2001 7:43 AM
To:	Ryner, Jerry
Cc:	Fairlie-Cuninghame, Robert; [email-masked]'
Subject:	Re: [SIP] 183 in call flows.

 << File: Card for Christer Holmberg >> 
Hi Robert,

What do you consider as a "valid" SDP?

For example, if dynamic IP address allocation is used, or if one party
is behind a firewall, or in a VPN, it is very difficult to make the
validity test based on the media IP address. And, if it's only about
sending any SDP in the 183 message, I think the hacker can also do that
as well.

Regards,

Christer Holmberg
Ericsson Finland

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 17 Apr 2001 13:37:46 +0300

Hi Robert,

First, I guess this is related to the discussion about when the UAC
should be able to receive media in the first place.

It has been proposed (I guess this is also what the bis currently says)
that a UAC should be able to receive media as soon as the INVITE has
been sent, ie. it may receive early media even without a 183 provisional
response. Or, even if a 183 provisional response is sent the media may
"reach" the UAC before the 183 (which is the main reason that the media
channel should be opened after the INVITE).

>Additionally, I do not think it is unreasonable that if you are about
>to send media then you know the address it will be sent from (assuming
>that it will be sent from the same address that you specify in the
>reverse SDP). Are you saying that you shouldn't include SDP in a 200
>OK because it might be behind a NAT? Of course you aren't - the SDP in
>the 183 can only help an ALG resolve this situation not prevent it.

You have to include the SDP in the 200 OK response, but my issue was
more about your proposal to add the SDP as a MUST in the 183 provisional
response, and how you can ensure that it is a "valid" SDP.

Also, I guess the SDP may even change in the 200 OK. Would you then
allow the new SDP? 

Regards,

Christer Holmberg
Ericsson Finland