Subject: [Simple] MSRP - First SEND request purpose?

From: prasun bheri <[email-masked]>
Date: Thu, 22 Dec 2011 13:38:39 +0530

Hello Group,

ref: RFC 4975 (MSRP)
"The first SEND request serves to bind a connection to an MSRP
      session from the perspective of the passive endpoint.  If the
      connection is not authenticated with TLS, and the active endpoint
      did not send an immediate request, the passive endpoint would have
      no way to determine who had connected, and would not be able to
      safely send any requests towards the active party until after the
      active party sends its first request."

>From the passive end point of view:

It knows the remote party's IP and port number from the SDP received.
So upon 'TCP socket accept', it will know the remote party who is connected.
Will it not be sufficent to bind this connection to an MSRP session?

Thanks & Regards
Prasun

---

From: Ben Campbell <[email-masked]>
Date: Thu, 22 Dec 2011 10:06:24 -0600

> Will it not be sufficent to bind this connection to an MSRP session?

HI Prasun,

It's fairly easy for a malicious endpoint to forge a source IP address and port number. The initial SEND request will contain the MSRP URI that the passive endpoint sent to the active endpoint in the SDP exchange. Since that URI is supposed to be hard to guess, that makes it considerably harder for a malicious endpoint to pretend to be the expected peer.

Hope this helps!

Ben.