Re: [apps-discuss] Apps Area Review team review: draft-ietf-martini-gin-10.txt

[Adam Roach <[e-mail]>]

Ted:

Thank you for your detailed review. I have applied your comments to 
version -11 of the document (now available in the repository), except as 
noted below.

On 11/30/10 4:11 PM, Ted Hardie wrote:
> Section 7.4 contains two elements which it may be appropriate to consider
> for inclusion in the Security Considerations.  The first of these is that
> proxies will not be able to apply policy decisions on as granular a basis as
> before:
>
>     Proxies will be unable to make policy decisions on a
>     contact-by-contact basis regarding whether to include themselves in
>     the path.  Second, and similarly, all AORs on the SIP-PBX that are
>     registered with a common REGISTER request will be forced to share a
>     common Service-Route.

I tried to reiterate this issue in the security section with the 
following paragraph:

    As noted in Section 7.4, intermediaries need to take care if they use
    a policy token in the Path and Service-Route mechanisms, as doing so
    will cause them to apply the same policy to all users serviced by the
    same SIP-PBX.  This may frequently be the correct behavior, but
    circumstances can arise in which differentiation of user policy is
    required.

This text was in the version you reviewed. Do you think it needs to be 
amended in some way to capture the issue you highlight above, or does 
this text address your concern?

> Would this extend to proxies including themselves for the purposes of
> CALEA?  If so, this might be a privacy issue.

Proxies can't use Path to insert themselves for LI purposes, as doing so 
would be inherently visible to user agents (which could potentially 
alert users to the condition). In my experience, LI in SIP is performed 
via mechanisms that are unrelated to any of the mechanisms described in 
this document.

/a