Subject: RE: [Sip] Re: Some comments on RFC 3329 (Security Mechanism Agree ment for the S ession Initiation Protocol)

From: "Drage, Keith (Keith)" <[email-masked]>
Date: Thu, 10 Apr 2003 17:22:59 +0100

For the Require header, I was arguing for nothing more than a general case of that used in sec-agree, i.e. that the proxy must contain the application reflected by the option-tag in the Require header before that specific option-tag can be removed. I would not envisage any removal of any other option-tag.

It may also be possible to argue that for the removal to occur, it should be tested by the presence of the appropriate (i.e. the same) option-tag in a Proxy-Require header.

So I support Gonzalo in saying that this is necessary for sec-agree, but I think it would be useful to clearly state what is allowed in the respect in RFC 3261.

Keith

Keith Drage
Lucent Technologies
Tel: +44 1793 776249
Email: [email-masked] 

> -----Original Message-----
> From: Gonzalo Camarillo [mailto:[email-masked]]
> Sent: 03 April 2003 11:02
> To: Jonathan Rosenberg
> Cc: Drage, Keith (Keith); [email-masked]'; [email-masked]';
> [email-masked]'; [email-masked]';
> [email-masked]'; [email-masked]'
> Subject: Re: [Sip] Re: Some comments on RFC 3329 (Security Mechanism
> Agreement for the S ession Initiation Protocol)
> 
> 
> Jonathan,
> 
> > Interrestingly, RFC3329 is not the first RFC to have a 
> proxy remove a 
> > proxy-require header. RFC 3323 (Privacy extensions) does 
> the same thing 
> > for much the same reason. As such, I agree that this is 
> probably a bug 
> > in RFC3261, and that evil table 2/3 should be modified to amr, with 
> > explanatory text explaining under what conditions. I don't 
> think proxies 
> > can modify Require, however.
> 
> In general, proxies cannot modify Require. However, sec-agree 
> is a very 
> special mechanism that is inteded to be used *only* with the 
> next hop. 
> That's why the UAC adds both Proxy-Require and Require to the 
> request. 
> To cover the case where the next (first) hop is already the 
> UAS (which 
> would ignore the proxy-require header).
> 
> In any event, sec-agree lets the proxy remove the Require tag because 
> the same tag (sec-agree) appears in the proxy-require, and 
> this ensures 
> that the proxy understands sec-agree and knows what it is 
> doing when is 
> removing the Require tag.
> 
> Of course, Require header removal by proxies in any other 
> scenario would 
> be very bad.
> 
> Gonzalo
> 
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 15 Apr 2003 00:39:46 -0400

Drage, Keith (Keith) wrote:
> For the Require header, I was arguing for nothing more than a general
> case of that used in sec-agree, i.e. that the proxy must contain the
> application reflected by the option-tag in the Require header before
> that specific option-tag can be removed. I would not envisage any
> removal of any other option-tag.

Really, the problem is that sec-agree needs a new type of Require 
header, which is "Next-Hop-Require". It means that the recipient of a 
request with this header must understand the extension, and if it does, 
remove that header, else reject the request. Of course, you can't 
introduce the Next-Hop-Require header field as an extension without 
using Proxy-Require and Require in the request, which sort of brings you 
back to square one.

I must admit I am not fond of the idea of a proxy removing a Require 
header under any circumstances, but I don't see a better solution given 
that this needs to be introduced in a backwards compatible way. In that 
case, Keith's suggested semantics seem right. I'll make a note in 
bugzilla about it.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Scientist                             Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com