RE: [Sip] RE: [BEHAVE] Outbound and SPI

Christian Huitema wrote:

...
> Well, this is exactly the kind of behavior that drove inclusion of
> an obfuscation mechanism in the STUN response.  Some NAT tend to be
> hyperactive.  The proper solution is probably to obfuscate the
> entire SIP traffic.  Running SIP over TLS does it nicely, but if we
> insist on UDP, we may need to ask the SIP group to define an
> encrypted transport.

There is SIP-over-DTLS, draft-jennings-sip-dtls-02.txt (which has
expired).  Of course, continuing to run SIP over UDP only 
encourages the problems discussed in 
draft-heffner-frag-harmful-04.txt.

> By the way, SPI may or may not improve the security of your network.
> SPI requires that the router parse a lot of different packets, in
> order to find possible attacks and protocol violation.  Parsing code
> is a notorious source of bugs.  There are multiple examples of
> maliciously crafted packets triggering a buffer overflow in a
> speedily written parser.  There is also some evidence that the
> quality of code in many of these small routers is not great --
> otherwise, we would not need to reboot them so often.  SPI on a
> small router brings the combination of "lots of parsing code" with
> "questionable quality assurance".  Turning on SPI in the router may
> well be building a bright target for hackers just at the doorstep of
> your network...

I couldn't agree more.

-d

_______________________________________________
Behave mailing list
Behave@ietf.org
https://www1.ietf.org/mailman/listinfo/behave