Re: [apps-discuss] Apps Area Review team review: draft-ietf-martini-gin-10.txt

Ted Hardie <ted.ietf@gmail.com> Tue, 11 January 2011 17:52 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=O58+z1Zok17I0Y+KW9MFHZSlwsR4w3v4Ou48HYI3xgFmTb6PCZypkc4Ok2qJWsxkzJ R5oBO88w0iEkOJZCO3WCMxhjAh99Uu/B+s92xIS+9TznPbfP5OEjKnBeZGq7o1GQdair IOWyNyCsFcgsf0WXM1xl+oXs49yapuFYL1IKI=
MIME-Version: 1.0
In-Reply-To: <4D2BA844.1070801@nostrum.com>
References: <AANLkTi=pF9d0z3vQYAq+mPrpSiDK9OZzVPkE84W+-qGp@mail.gmail.com> <4D2BA844.1070801@nostrum.com>
Date: Tue, 11 Jan 2011 09:54:56 -0800
Message-ID: <AANLkTinmx40ATebTV0T1RFdEqLnCwB7hxnN7TKM0mMcA@mail.gmail.com>
From: Ted Hardie <ted.ietf@gmail.com>
To: Adam Roach <adam@nostrum.com>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Cc: Bernard Aboba <bernard_aboba@hotmail.com>, Spencer Dawkins <spencer@wonderhamster.org>, Apps Discuss <discuss@ietf.org>, IESG <iesg@ietf.org>
Subject: Re: [apps-discuss] Apps Area Review team review: draft-ietf-martini-gin-10.txt
Precedence: list

Hi Adam,

Thanks for the response; some discussion in-line.

On Mon, Jan 10, 2011 at 4:45 PM, Adam Roach <adam@nostrum.com> wrote:
> Ted:
>
> Thank you for your detailed review. I have applied your comments to version
> -11 of the document (now available in the repository), except as noted
> below.
>
> On 11/30/10 4:11 PM, Ted Hardie wrote:
>>
>> Section 7.4 contains two elements which it may be appropriate to consider
>> for inclusion in the Security Considerations.  The first of these is that
>> proxies will not be able to apply policy decisions on as granular a basis
>> as
>> before:
>>
>>    Proxies will be unable to make policy decisions on a
>>    contact-by-contact basis regarding whether to include themselves in
>>    the path.  Second, and similarly, all AORs on the SIP-PBX that are
>>    registered with a common REGISTER request will be forced to share a
>>    common Service-Route.
>
> I tried to reiterate this issue in the security section with the following
> paragraph:
>
>   As noted in Section 7.4, intermediaries need to take care if they use
>   a policy token in the Path and Service-Route mechanisms, as doing so
>   will cause them to apply the same policy to all users serviced by the
>   same SIP-PBX.  This may frequently be the correct behavior, but
>   circumstances can arise in which differentiation of user policy is
>   required.
>

The only difference I see is that the first calls out the Service-Route as
common separately from the application of policy, where the second treats the
application of a particular Service-Route as the application of a
particular policy.
You might choose to call it out separately again, but if you have considered it
and feel the text is fine as it stands, I'm happy with that result.


> This text was in the version you reviewed. Do you think it needs to be
> amended in some way to capture the issue you highlight above, or does this
> text address your concern?
>
>> Would this extend to proxies including themselves for the purposes of
>> CALEA?  If so, this might be a privacy issue.
>
> Proxies can't use Path to insert themselves for LI purposes, as doing so
> would be inherently visible to user agents (which could potentially alert
> users to the condition). In my experience, LI in SIP is performed via
> mechanisms that are unrelated to any of the mechanisms described in this
> document.
>

Thanks for clarifying that this method would not be used for that purpose;
that resolves my concern here.

regards,

Ted

> /a
>

[apps-discuss] Apps Area Review team review: draf… Ted Hardie
Re: [apps-discuss] Apps Area Review team review: … Adam Roach
Re: [apps-discuss] Apps Area Review team review: … Ted Hardie