RE: [midcom] draft-ietf-midcom-requirements-01.txt

I wrote the scenario draft precisely so we could check that what we are
designing enables the use that we are planning. In section 2.3.1,
"Explicit call from an internal host", I wrote:

	We should note that, at step 2, the internal server 
	must learn the external mappings of the internal address 
	and ports; at this stage, it does no know the IP address 
	and ports of the third party.

This is very much a fact of life. If you are unwilling to open the hole
before you know the complete five-tuple, then there is a race condition
between opening the hole and receiving the first audio packets;
announcements and first words will sometimes be clipped. A few lines
letter, the scenario text explains that:

	The description assumes that the hosts use the same UDP ports 
	in both direction of the media communication. This is not 
	necessarily the case. The source IP address may be unpredictable

	in the case of multi-homed hosts; the source port may be 
	systematically different from the receive port in some 
	implementation, e.g. parallel processing of the send and receive

	channels by different software or hardware components. 

SIP and SDP, as they are defined today, only provide the address at
which a host is ready to receive data. They do not document the sending
address. The requirement document already mention that the protocol
should allow use of wildcards for specifying pinholes. We may expect
this to be used frequently.

-- Christian Huitema

> -----Original Message-----
> From: richard.swale@bt.com [mailto:richard.swale@bt.com] 
> Sent: Monday, June 25, 2001 10:13 AM
> To: Christian Huitema; mshore@cisco.com; 
> christopher.a.martin@wcom.com; midcom@ietf.org
> Subject: RE: [midcom] draft-ietf-midcom-requirements-01.txt
> 
> 
> Christian,
> 
> > The examples about RTP have outlined the fact that RTP pin-hole 
> > typically are of the form "allow data from unknown sources 
> and ports 
> > to reach a specific address and port." It is true that the 
> average RTP
> > session will require 2 pinholes. But in this case, the direction is
> > expressed trivially; there is no need for a multi-value field.
> > 
> 
> While possible as an option I don't think openning ports to 
> allow allow data
> from unknown sources and ports is necessarily wise as a 
> security policy for
> a complete solution. We should allow for more precise cases 
> where a more
> strict policy is applied( open an RTP stream from THIS source 
> and port to
> THAT source and port.), shouldn't we?
> 
> regards
> 
> Richard
> 
> _______________________________________________
> midcom mailing list
> midcom@ietf.org
> http://www.ietf.org/mailman/listinfo/midcom
> 

_______________________________________________
midcom mailing list
midcom@ietf.org
http://www.ietf.org/mailman/listinfo/midcom