Subject: Re: [Simple] WGLC of draft-ietf-simple-msrp-sessmatch-09 - Error reporting

From: Cullen Jennings <[email-masked]>
Date: Tue, 11 Jan 2011 16:51:17 -0700

On Dec 20, 2010, at 12:00 PM, Christer Holmberg wrote:

> Hi,
> 
> I am splitting up the issues in different thread.
> 
> For some of the security related issues I will need to discuss with my collegue, who is currently on winter vacation.
> 
> Regarding error reporting:
> --------------------------
> 
>>> The ALG only rewrites the IP addresses/port numbers in the media packages. It is
>>> not TCP state aware, nor does it understand the TCP payload (MSRP or TLS/MSRP).
>>> The types of errors it can handle are on ICMP level.
>> 
>> I suspect we are talking past each other here - the way I read you statement, If this was true you would not need this draft as the TLS would not need to be man in the middled. 
>> I'll point out that TLS works fine thought NATs which change the IP address/port numbers so I suspect the use case is something more than just this. If you and/or I are confused 
>> on this, I suspect much of the WG is just as confused.
> 
> Unlike a NAT, an ALG modifies the SDP a=path attribute, which causes a UE session matching failure mechanism (when using the 4975 session matching mechanism). The draft is needed, as it modifies the UE session matching mechanism. Again, we are talking about a *UE* extension :)
> 
> As far as I know there has never been any claim, or confusion expressed by anyone else in the WG, that an ALG would not be able to able to change the IP address/port in the same manner as a NAT. 
> 
> In fact, the whole idea of sessmatch is to allow an ALG to do just that - ie to allow the ALG to tunnel (read: change IP address/port) the MSRP communication, WITHOUT forcing it to terminate TCP/TLS, parse and modify the To-Path/From-Path of the MSRP messages :)
> 
> Regards,

So you are saying an ALG needs to change modify and understand SDP (I'd call this a B2BUA not an ALG but that just terminology) but you are claiming that all the error it would need to deal with in parsing changing SDP can be done with ICMP?  That does not sound real likely to me.

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 12 Jan 2011 11:36:04 +0100

Hi, 

>>>> The ALG only rewrites the IP addresses/port numbers in the media 
>>>> packages. It is not TCP state aware, nor does it 
>>>> understand the TCP payload (MSRP or TLS/MSRP).
>>> I suspect we are talking past each other here - the way I 
>>> read you statement, If this was true you would not need this 
>>> draft as the TLS would not need to be man in the middled. 
>>> I'll point out that TLS works fine thought NATs which 
>>> change the IP address/port numbers so I suspect the use case is 
>>> something more than just this. If you and/or I are confused 
>>  Unlike a NAT, an ALG modifies the SDP a=path attribute, 
>>  which causes a UE session matching failure mechanism (when using the 4975 session 
>>  matching mechanism). The draft is needed, as it modifies the UE 
>>  session matching mechanism. Again, we are talking about a *UE* 
>>  extension :)
>> 
>> As far as I know there has never been any claim, or 
>> confusion expressed by anyone else in the WG, that an ALG 
>> would not be able to able to change the IP address/port in 
>> the same manner as a NAT. 
>> 
>> In fact, the whole idea of sessmatch is to allow an ALG to do just 
>> that - ie to allow the ALG to tunnel (read: change IP address/port) 
>> the MSRP communication, WITHOUT forcing it to terminate TCP/TLS, parse 
>> and modify the To-Path/From-Path of the MSRP messages :)
>
> So you are saying an ALG needs to change modify and 
> understand SDP (I'd call this a B2BUA not an ALG but that 
> just terminology) but you are claiming that all the error it 
> would need to deal with in parsing changing SDP can be done 
> with ICMP?  That does not sound real likely to me. 

That is normal ALG behavior. It modifies the SDP in order to anchor the media, but it doesn't "parse" the media.

Regards,

Christer

---

From: Ben Campbell <[email-masked]>
Date: Wed, 12 Jan 2011 07:28:54 -0600

> That is normal ALG behavior. It modifies the SDP in order to anchor the media, but it doesn't "parse" the media.

What does the ALG do if the SDP is malformed, or it otherwise fails to parse it?

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 12 Jan 2011 14:40:38 +0100

Hi, 

>>>>>> The ALG only rewrites the IP addresses/port numbers in 
>>>>>> the media packages. It is not TCP state aware, nor does it understand the 
>>>>>> TCP payload (MSRP or TLS/MSRP).
>>>>> I suspect we are talking past each other here - the way 
>>>>> I read you statement, If this was true you would not need this draft as the 
>>>>> TLS would not need to be man in the middled.
>>>>> I'll point out that TLS works fine thought NATs which change the IP 
>>>>> address/port numbers so I suspect the use case is something more 
>>>>> than just this. If you and/or I are confused on this, I suspect 
>>>>> much of the WG is just as confused.
>>>> 
>>>> which causes a UE session matching failure mechanism (when using the 
>>>> 4975 session matching mechanism). The draft is needed, as it modifies the UE 
>>>> As far as I know there has never been any claim, or confusion 
>>>> expressed by anyone else in the WG, that an ALG would not 
>>>> be able to able to change the IP address/port in the same manner as a NAT.
>>>> 
>>>> In fact, the whole idea of sessmatch is to allow an ALG 
>>>> to do just that - ie to allow the ALG to tunnel (read: change IP 
>>>> address/port) the MSRP communication, WITHOUT forcing it to terminate TCP/TLS, 
>>>> parse and modify the To-Path/From-Path of the MSRP messages :)
>>> 
>>> So you are saying an ALG needs to change modify and understand SDP 
>>> (I'd call this a B2BUA not an ALG but that just 
>>> terminology) but you are claiming that all the error it would need to deal with 
>>> in parsing changing SDP can be done with ICMP?  That does not sound 
>>> real likely to me.
>> 
>>That is normal ALG behavior. It modifies the SDP in order 
>>to anchor the media, but it doesn't "parse" the media.
> 

It might reject the request that carries the SDP. 

But, I don't really see how that is related to sessmatch.

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 12 Jan 2011 15:03:55 +0100

Hi,

I would just like to inform you that I am in the process of putting some text together regarding the assumptions the sessmatch draft makes about ALGs and their behavior.

So, any input is welcome.

I have no problem to add some text saying that it is assumed that an ALG will reject malformed SDP message bodies, if we think it is relevant for sessmatch.

Regards,

Christer

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Christer Holmberg
> Sent: 12. tammikuuta 2011 15:41
> To: Ben Campbell
> Cc: Cullen Jennings; [email-masked]; Simple WG; 
> Gonzalo Camarillo
> Subject: Re: [Simple] WGLC of 
> draft-ietf-simple-msrp-sessmatch-09 - Error reporting
> 
> 
> Hi, 
> 
> the media 
> I read you 
> >>>>> statement, If this was true you would not need this 
> draft as the 
> change the 
> >>>>> IP address/port numbers so I suspect the use case is something 
> >>>>> more than just this. If you and/or I are confused on this, I 
> >>>>> suspect much of the WG is just as confused.
> >>>> 
> >>>> Unlike a NAT, an ALG modifies the SDP a=path attribute, which 
> >>>> causes a UE session matching failure mechanism (when using the
> >>>> 4975 session matching mechanism). The draft is needed, as it 
> >>>> modifies the UE session matching mechanism. Again, we 
> are talking 
> >>>> about a *UE* extension :)
> >>>> 
> >>>> expressed by anyone else in the WG, that an ALG would 
> not be able 
> >>>> to able to change the IP address/port in the same manner 
> as a NAT.
> >>>> 
> to do just 
> >>>> that - ie to allow the ALG to tunnel (read: change IP
> >>>> address/port) the MSRP communication, WITHOUT forcing it to 
> >>>> terminate TCP/TLS, parse and modify the To-Path/From-Path of the 
> >>>> MSRP messages :)
> >>> 
> understand SDP 
> >>> terminology) but you are claiming that all the error it 
> would need 
> >>> to deal with in parsing changing SDP can be done with ICMP?  That 
> >>> does not sound real likely to me.
> >> 
> >>That is normal ALG behavior. It modifies the SDP in order to anchor 
> >>the media, but it doesn't "parse" the media.
> > 
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/simple
>

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 12 Jan 2011 07:11:44 -0700

You need more than some assumptions, you need to define normative language on how ALGs need to act with respect to this mechanism.

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 12 Jan 2011 17:41:57 +0100

Hi,

>with respect to this mechanism.

Any input is welcome.

Regards,

Christer