Subject: RE: [SIP] Poorman's SIP through firewall.

From: Christian Huitema <[email-masked]>
Date: Tue, 25 Jul 2000 13:54:38 -0700

Jiri,

In one sentence you said:

> ... If an administrator does 
> deploy a firewall, it is not very likely he will allow arbitrary 
> encrypted  traffic to get through it. 

but, a few line later, you wrote:

> Firewalls can hardly prevent communication of two
> colluding parties. Their main value is they minimize
> number of places vulnarable to external attacks.

Don't you see that there is some form of contradiction here? Preventing
e-2-e encryption is a rather dubious way of minimizing the number of places
vulnerable to attack. It has more to do with enforcement of policies. But at
some level, firewall administrators have to trust their users. A blanket ban
on encryption is futile.

End-to-end encryption, in fact, is commonly used between web clients and
servers, with SSL, and most firewalls let that go through -- they would
rather tolerate encryption than force credit card numbers to be carried in
clear text. The equivalent would be the encryption of the RTP payload while
leaving the UDP headers unencrypted; I would certainly expect that to go
through many firewalls.

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Jiri Kuthan <[email-masked]>
Date: Wed, 26 Jul 2000 00:41:16 +0200

> leaving the UDP headers unencrypted; I would certainly expect that to go

Christian,

sorry, I was not precise about problem definition. I've been refering to particular
SIP/SDP/RTP/default-deny-firewall scenarios where packet filtering
at IP+UDP/TCP level cannot be applied to media streams because either
a) RTP streams are encrypted at IP level 
 or
b) SDP is encrypted (in which case a session will not get through firewalls
   because they do not see SDP payload and cannot generate dynamic
   pinholes for media belonging to sessions considered trustworthy)

I agree that if SDP is not encrypted and RTP packets are encrypted at RTP 
level, firewalls still may enforce reasonable packet-filtering policies
and minimize the number of vulnerable places. The same
holds for HTTP/SSL where port numbers are visible and the protocol
does not use session bundling.

Jiri